NexisOS logo NexisOS
A declarative Linux distribution

Your system.
Your configuration.
Your control.

Inspired by NixOS: the whole machine is declared in plain TOML, built into a content-addressed store and booted as a sealed, read-only generation you can roll back. Applications still see an ordinary Linux filesystem, and SELinux, a firewall and intrusion prevention are part of the design rather than add-ons.

Explore NexisOS → View on GitHub
How it works

From a few TOML files to a whole system

  1. 01

    Hosts and features

    Each machine is a short host file listing the features it wants: networking, SSH, hardening, antivirus, a desktop. Applications keep their own config files, versioned alongside.

  2. 02

    Verified packages

    Packages come prebuilt from sources you choose, or are built from source. Every download is checked against signatures and hashes, then scanned against the security policy you declared.

  3. 03

    Content-addressed store

    Every file is stored once under the hash of its contents, so duplicates never exist and there is no clean-up pass to remove them later.

  4. 04

    Sealed generations

    The store is composed into a read-only composefs image with a normal FHS layout and its own SELinux labels. Each change is a new generation; the old ones stay in the boot menu.

Built around deliberate design

Declarative system management, a conventional Linux runtime, and security that is part of the system model.

📦

One system manager

nexis handles packages, services, users, dotfiles, firewall rules and generations from one configuration.

↻

Atomic generations

Sealed composefs images, switched atomically and rolled back from the boot menu.

⚙

nexis-init

A small PID 1 with pidfd supervision, sandboxed services and scheduled jobs built in.

🛡

SELinux by default

Enforcing refpolicy, with labels sealed into each generation instead of a boot-time relabel.

🔍

Package security

Signatures, hashes, built-in checks and optional scanners before anything reaches the store.

🚧

nexis-guard

Intrusion prevention that bans scanners, brute-force sources and servers that send tampered packages.

🧹

Fast clean-up

Reference-counted garbage collection: one command, and no store-wide optimise pass.

📂

Normal Linux layout

/usr/bin/foo is a real path. Prebuilt binaries run unmodified.

What is NexisOS?

NexisOS is a free and open-source Linux distribution focused on transparency, control, reproducibility, security, and system integrity through declarative system configuration.

It takes NixOS's declarative, rollback-safe model and changes the trade-offs: plain TOML instead of a language, application configs as real files instead of options, and a store that is never the runtime filesystem.

NexisOS is in early development. There is no installable release yet; the design and source are public on GitHub.

Learn more →