MinBZK/DAWO-NixOS
35
3
Fork 0
Code Issues 24 Pull requests 3 Projects Releases 2 Wiki Activity Actions
Page: Deploy strategy
Pages
Deploy strategy Hardening and extras Home
1 Deploy strategy
Bram Buijs edited this page 2026-06-18 14:30:25 +02:00
Table of Contents

Deploy strategy

How a DAWO device goes from bare hardware to a managed, self-updating workstation.

Layering: who builds what

DAWO-NixOS is the upstream core: blocks plus two tiers (profiles-dawo-core mandatory, profiles-dawo-hardened opt-in). A device is never this repo alone:

  1. DAWO-NixOS -- core blocks, org-neutral, lean by default.
  2. DAWO-NixOS-<org> (BZK, VNG, ...) -- shared org blocks, takes the core as a flake input.
  3. A concrete host (e.g. DAWO-Gem-<name>) -- consumes core + org, pins the hardware and disko layout.

The flake you deploy is the bottom layer; it pulls the others in as inputs.

1. Install: nixos-anywhere

A bare device boots a Linux installer (or NixOS live) with SSH as root. The host already exists in the flake with its hardware and a disko layout, so one command partitions, encrypts (LUKS2) and installs:

nix run github:nix-community/nixos-anywhere -- \
  --flake .#<host> --target-host root@<ip>

Disko is BTRFS single-nvme-luks (the standard layout). For a new hardware model, generate the profile on-device with nixos-facter and import it.

After install, replace the install-time LUKS passwordFile with a real unlock (TPM2 or FIDO2 via systemd-cryptenroll, or an interactive passphrase).

2. Update: deploy-rs (push) or comin (pull)

Two ways to move a running device forward, used together:

  • deploy-rs -- operator push. Every host in the flake is a deploy node; build and activate remotely:

    deploy .#<host>

  • comin -- git-driven pull (the dawo.autoUpdate block). The device polls a flake on code.overheid.nl and rebuilds when new commits land. A bare device tracks the upstream core; a workplace points it at its own overlay flake, so the chosen org config rides along on every update. On by default in profiles-dawo-generic; tune repoUrl / branch / pollSeconds.

Use deploy-rs for hands-on rollout and break-glass, comin for the steady-state fleet that converges on its own.

3. Fleet

One host file per device (modules/hosts/clients/<name>.nix) importing a profile, hardware, disko and users. New device = nixos-anywhere once; everything after is deploy-rs or a comin pull. The mandatory BIO/NCSC baseline (ssh, sysctl, usbguard, chrony, audit) comes in automatically via profiles-dawo-core; opt-in blocks are flipped per workplace (see Hardening and extras).

Secure Boot

Secure Boot hosts use lanzaboote (tracked from master on nixpkgs 26.05). The pkiBundle in /var/lib/sbctl must match the keys enrolled on the device; enroll with the firmware in Setup Mode before first boot.