harden
Kernel settings, boot parameters, an sshd that accepts keys only, and a firewall that is closed by default. A configuration that locks you out does not compile: that is an assertion, not a footnote.
Open source, EUPL-1.2
NixOS hardening with tests you can run yourself
sovereign-nix is a set of NixOS modules for servers and laptops that are hard to attack at scale: a reduced attack surface, a different configuration per machine, and a system disk that is wiped at every boot.
The modules are not the interesting part. Anyone can put promises in a manual. What matters is that every promise is tied to a test you can run yourself, and that it says just as clearly what those tests do not prove.
What is in it
diversity
One value per machine reproducibly determines the SSH port and some kernel tuning. Same value, same machine. It makes a fleet less uniform for untargeted scans. It makes no exploit impossible, and the documentation says so.
impermanence
The system root rolls back to empty at every boot. Whatever an attacker left there is gone after a restart. The root of the previous boot is kept for one generation, so an incident can still be investigated.
defaults
DNS over TLS to European resolvers, European time servers. Not a single default points at a US cloud. That is a start of sovereignty, not the end of it.
Claims with evidence, and with limits
The documentation carries a table in which every claim points at the test that checks it. Boot two virtual machines and show they really differ, wipe a disk twice and show the persisted directory survives. One command and you see it yourself.
More importantly, it also states what the tests cannot prove. That the kernel and every binary stay identical between machines, so a working exploit is not stopped by anything here. That a changed SSH port is hygiene rather than a control. That the home directory is not wiped. And that a reboot is no substitute for patching.
When two outside reviewers publicly found holes in it, I measured their points on a test machine rather than arguing them. One of their objections held, one of my own claims did not, and both are now corrected in the documentation with their names against them. That is how it should work.
Why this might matter to you
Under NIS2 and the Dutch Cyber Security Act it is not enough for your systems to be secure. You have to be able to show that they are, and how. An environment whose entire setup lives in version control, and whose security settings are checked automatically, is considerably easier to account for than a server that has been adjusted by hand over the years.
This project is my own evidence of that. I run it myself, the code is public, and you can run the tests without taking my word for anything.
Frequently asked questions
What is NixOS?
NixOS is a Linux distribution in which the entire machine is described in a single configuration. Two machines with the same configuration are identical, any change can be rolled back to the previous version, and there is no room for manual tweaks nobody wrote down. That makes it suitable for environments where you have to be able to demonstrate how a system is set up.
What is an immutable server?
A server you do not modify but redeploy. Changes go through the configuration, not through a terminal on the machine itself. The security benefit is that drift does not quietly accumulate: anything not captured in the configuration disappears at the next deployment.
What does impermanence mean exactly?
The system disk is emptied at every boot and rebuilt from the configuration. Only explicitly listed directories survive. Software an attacker placed in the system directories is gone after a restart. Note that the home directory does survive, so this does not evict an attacker who has settled into a user account.
Does this make a server unhackable?
No, and that claim is not made anywhere. It shrinks the attack surface, it makes untargeted mass scanning less profitable, and it stops an attacker from settling permanently into the system root. It does not stop phishing, a weak password, or a vulnerability in a service you expose yourself. The documentation lists explicitly what the tests do not prove.
Is this production ready?
The modules run on my own machines and every claim is checked by an automated test. It is version 1 and the interfaces may still change, so today I would use it on new systems rather than on an existing production environment without a way back.
What does it cost?
The code is free and open source under the European EUPL-1.2 licence. What costs money is the implementation: mapping your environment, applying the modules and making it demonstrable that they do what they promise. With me that starts with a baseline assessment.
Look yourself, or look together
The code and the tests are public. If you want to know what this means for your environment, book a 30-minute call.