France’s interministerial digital directorate, the DINUM, is building its own secure workstation operating system, and it is doing it in the open: SécurixOS lives in the state’s cloud-gouv GitHub organisation, is MIT licensed, and its README describes exactly what it is. A base OS built on NixOS, aimed first at system administration, office work and development on machines handling unprotected information, with restricted-level information as a possible later step. The project labels itself alpha and offers no support for now. What it offers instead is a very specific checklist, published.
What is in it
The hardening follows ANSSI’s recommendations for GNU/Linux systems, down to a custom kernel built to those rules, with individual hardening options disableable when a use case needs it. The identity model is the part that reads most unlike a normal desktop: login is FIDO2, and the password is only a fallback mechanism; the disk itself is decrypted with a FIDO2 key, with a backup key generated at installation. TPM2 and YubiKey support sits underneath, secrets are encrypted with age or a Vault server, and Secure Boot enrolment is centralised, PK and KEK included. The project’s tests build a Sécurix VM from the same definitions and probe how it behaves, which is the NixOS-native way of proving a hardening claim. Because it is NixOS underneath, the same machine definition can be re-instantiated for different shapes of work: multi-user, multi-level, intranet-only, different teams, different VPN roots. That reproducibility is the whole argument for NixOS here, and it is the same argument that carried the Dutch government’s desktop project to the same base this autumn.
What is still coming
The roadmap lists the pieces that turn a hardened box into a managed fleet. A trace sink to send a Sécurix machine’s activity to a collector. A “phone home” step that registers the machine’s TPM2-backed SSH key with the infrastructure repository and authorises it to decrypt age secrets, so onboarding a new workstation becomes a business process rather than a manual ritual. Rotation and management of Secure Boot keys on top of TPM2. Contributors are told to bring NixOS expertise, and that AI-generated pull requests without review or testing will be closed. The README is in French; the code, issues and pull requests are in English.
My read
Sécurix is alpha, French, and aimed at administrators rather than homes, and none of that limits its value as a document. It is a rare thing to watch a state assemble its security checklist in public: FIDO2-first login, a kernel built to an auditor’s rules, and an onboarding path designed to be a business process. Anyone hardening a fleet can read the same guides it cites, which is the point of publishing the work at all.
Source: the Sécurix repository (README, in French).