NexisOS
TOML configuration
The machine is described in plain TOML instead of a purpose-built language. Every key is validated, and every error names the file it came from.
Features
One system, described in one place.
Packages, services, users, dotfiles, firewall rules and the security policy are managed together by one system manager, from one declarative configuration.
Core system
The pieces that make a NexisOS install reproducible and recoverable.
Hosts and features
A host file lists the features it wants. Features are small reusable files: networking, ssh-server, hardening, doas, timesync. A fleet is one git repository of hosts.
Immutable generations
Each change produces a new sealed composefs generation. Activation is atomic, and every kept generation is in the boot menu for rollback.
FHS-compatible runtime
The store is never the runtime filesystem. Applications see an ordinary /usr, so prebuilt binaries run without patching.
Users and dotfiles
Users, groups and their config files are declared with the host and sealed into the same generation, so rolling back the system rolls back home layers too.
One clean-up command
nexis gc keeps the generations you ask for and frees the rest in one pass. There is no optimise step and no second run per user.
Packaging that stays out of the way
Getting software onto the system should not mean learning a language first.
Your choice of sources
Ordered, pinned sources rather than one central repository: prebuilt binary repositories, your own mirrors, or definitions built from source.
Content-addressed store
Files are stored once under the hash of their contents. Identical files are shared across packages, generations and environments automatically.
Reproducible builds
Builds run in sandboxes with declared inputs. Build scripts are hashed input, so changing how a package is built changes what it is.
Real conflicts are errors
Two packages installing the same path fail the build, naming both packages and the path, instead of one silently winning.
Services with nexis-init
Services are declared, never scripted, and confined by default.
Sandboxed by default
Each service gets a private /tmp and /dev, no network, no new privileges and only the capabilities it declares. Absent settings mean strict, not open.
Scheduled services
schedule = "daily" on a service replaces a separate timer. A machine that was off when a run was due catches up at boot.
Directories and environment
State, runtime, cache and log directories are created for the service user, with environment variables and environment files.
Privilege wrappers
The store carries no set-ID files. A program that needs privilege, such as doas, is declared and placed in /run/wrappers/bin at activation.
Security as part of the system
Every networked install gets these layers by default.
SELinux
refpolicy targeted, enforcing, loaded by nexis-init before any service. Labels are sealed into each generation, with nexis selinux explain for readable denials.
Firewall from services
nftables with default-deny inbound. Ports come from service declarations, so removing a service closes its port. Optional egress default deny.
Verified downloads
Signed repository databases with replay protection, package signatures, size and SHA-256 checks. A tampered download is refused and its server reported.
Package scanning
Built-in checks in Nim: file structure, ELF hardening, and what a new version can do that the old one could not. Atomdrift, Trivy and ClamAV are optional plugins.
A policy you declare
[security] sets the level, the minimum trust and what blocks an install. Held packages go to quarantine, with Ghidra analysis on request.
nexis-guard
Intrusion prevention reading the firewall’s own log: bans port scanners and brute-force sources, reports /etc drift and unexpected set-ID files.
Kernel hardening
KSPP kernel options, plus hardening and hardening-strict features for sysctls, lockdown and signed modules only.
Integrity checks
/usr is verified by fs-verity. With the antivirus feature, a daily store scan re-hashes every object and rescans it with current signatures.
Early development. These are the design and what is being built. See the roadmap for what is still open.