Comment by iamnothere
2 days ago
Over 400 comments and it’s all flamewars and almost zero discussion of NixOS.
I think NixOS would be a great solution for this sort of environment. With something like impermanence enabled to make the systems immutable, you could push all configuration from a central server and ensure that there is no drift. You could even use read-only nix stores served over nfs. This would all be easier if your hardware is limited to a few select configurations, of course.
I am curious about your confidence for NFS for the nix store.
My thoughts, ignoring my technical disagreements, would be that you'd want to setup clients to have a specific set of software per their government role. A nix store could expose more software than you planned on supporting (e.g. forgotten software or licensed software).
You could use multiple shares and limit each configuration to the software required. In this case you would share common configs through modules on the build server. The build server would output updated configs to the proper share paths.
A monolithic configuration may be adequate if each machine role only exposes the software that’s needed in its config. Other software that’s in the store could be hidden in some way, like overlay paths, perhaps. There may be other methods too. There’s a similar discussion here although this is about restricting paths via bubblewrap: https://discourse.nixos.org/t/restricting-nix-store-in-a-mou...
Most licensed software wouldn’t be an issue as long as the user doesn’t have license access, I’m assuming the license server would grant or deny access based on the user/user role. Depends on the software I guess.
I wonder if it’s possible to run a bubblewrapped (or similarly restricted) Wayland client and restrict access to store paths that way?