DAWO-NixOS
Upstream core and blocks for the DAWO government workstation. This repo is a
library of NixOS blocks, not a finished image: organisations consume it and layer
their own config on top.
Principle: lean by default, harden and extend on purpose
The generic image stays as lean as possible. Only the mandatory BIO/NCSC baseline
(profiles-dawo-core) is forced on; everything risky, specialist or org-specific
is an opt-in block that a workplace turns on deliberately. Apps and extras
(smartcard/PKI, YubiKey/FIDO2, extra desktops) are not baked into the base, they
are blocks you enable. This keeps the attack surface and the closure small, and
makes every addition a conscious, documented choice.
Pages
- Deploy strategy -- how a device goes from bare hardware to a
managed, self-updating workstation.
- Hardening and extras -- how to turn on the opt-in
hardening tier and add features and apps (PKI cards, YubiKey, and the like).
Architecture and the design decisions behind the blocks model live in
architecture.md in the repo.