Programme
Introduction
- Getting to know each other
- DAWO team update
Deep dive
- Introduction to the DAWO-NixOS architecture by Rutger Putter
- Questions and discussion
Lunch and networking
Extending and improving the DAWO blueprint together
- Architecture and technology
- Compliance and security
- Governance
DAWO community project pitch
- Sextant: a graphical interface for NixOS management as an alternative to Intune, by Bram Buijs
Closing
Architecture and technology
The technical setup looks for a balance between standardisation (taking work off people’s hands) and autonomy (freedom of choice).
- The 80 percent rule. The Core Basis provides a ready-made starter set (covering at least 80 percent) with hard, non-optional security and legislative baselines that are closed by default.
- Strict import management. Derived environments, such as the one used by the VNG, must always import the latest version of the Core to avoid version conflicts.
- Comply or explain. The Core enforces a safe standard, but gives organisations the technical room to deviate with good reason, for example on whether USB sticks are allowed.
- Flake inputs. Local organisations can override configuration at the highest level with minimal code changes, which keeps the codebase clean.
User experience: the toy shop
The transition has to feel like a gain for users, not a step backwards.
- A treasure chest of tools. Open source offers many innovative applications that make people more productive, such as Magic Wormhole.
- A gateway. The Core will act as a curated toy shop. System administrators do not have to go looking themselves; they get a menu of validated, safe tools that can be enabled at the press of a button.
Compliance and security
The core problem: fragmented security policy
Information security across the Dutch government is highly fragmented. Frameworks such as the Baseline Informatiebeveiliging Overheid (BIO) prescribe what has to happen, but not how it should be set up technically. As a result every organisation, whether a municipality, water authority or public body, develops its own security policy. Centrally developed IT solutions therefore rarely fit local policy directly.
The solution: a standardised blueprint
To get from abstract policy to measurable, technical configuration, a link between three elements is proposed.
- BIO, the abstract framework. The baseline guideline.
- ICO Wizard, theme filters and risks. An online tool that filters out irrelevant standards, such as physical access. What remains is a manageable subset of measures specific to, for example, the workplace.
- CIS Controls Level 2, technical hardening. An international framework that translates, through ISO mapping, into concrete technical parameters such as an exact log retention period.
One challenge: a deviating numbering scheme with added leading zeros within the BIO working group has to be undone in software first, before an automatic link with CIS becomes possible.
Automated hardening
CIS benchmarks make it possible to test the hardening of systems automatically. Because these scans do not yet exist for NixOS, the operating system used in this project, the benchmarks and scanning capabilities have to be developed specifically for NixOS in order to demonstrate compliance continuously.
Breaking the risk deadlock
Government projects are traditionally slowed down by endless discussions with CISOs about unforeseen risks just before going live.
The ICO Wizard contains a standard set of risks linked directly to the standards. That makes it immediately clear which risks are objectively covered, so the conversation with the CISO can be limited to the specific residual risks. That leads to faster decisions at management level.
Main action points
- Data cleansing. Straighten out the numbering with leading zeros in the BIO so that an automatic ISO and CIS link becomes possible.
- Develop NixOS CIS scans. Translate the CIS Unix benchmarks into an automated scanner for NixOS.
- Implement risk mapping. Integrate the risk library from the ICO Wizard into the project documentation, so that local CISOs can give their approval more quickly.
Governance
To convince decision-makers of the move to open source, the initiative has to be positioned as a strategic and societal shift.
Positioning and urgency
- Strategic autonomy. Reducing dependence on American Big Tech. That strengthens the European economy, improves the negotiating position thanks to a real exit strategy, and limits geopolitical risks such as the American Cloud Act.
- Quality and compliance. The initiative carries a mark of quality from the Ministry of the Interior. It also helps organisations meet strict ISO 27001 requirements, where current Windows environments often fall short, and it fits new government policy against supplier concentration.
- Evidence from practice. There are already successful national and international examples, such as a German state migrating 50,000 civil servants. It also builds up local IT expertise.
Communication and adoption
To take away the hesitation among decision-makers and users, three concrete initiatives have been formulated.
- Press and evangelist kit. A ready-made communication toolkit to generate positive media attention.
- Experience centre. A digital test environment where people can see for themselves that the software works.
- Libraries as pilot locations. Setting up public computers as a testing ground, to create a societal learning effect, possibly funded in part from cybersecurity budgets.
DAWO-Sextant
Within the DAWO community we have been working behind the scenes on the future of our digital autonomy. We are proud to present the proof of concept of Sextant: a declarative fleet control plane, designed for managing DAWO-NixOS workplaces on our own terms.
Sextant acts as the sovereign glue between workplace hardware, the identity provider and the underlying infrastructure.
- GitOps-based, config as data. No opaque push updates or vendor lock-in. The desired state of every device is recorded transparently and traceably in Git.
- Not a traditional MDM. Sextant works through a safe pull model, without the risk of a third party wiping devices remotely.
- A network of our own. Including a built-in, self-hosted mesh VPN based on NetBird and WireGuard, so devices stay securely connected anywhere.
This project shows how government and industry make an impact together. Development happens entirely in the open on code.overheid.nl, joining forces between our own government developers, who bring in day-to-day practice and the strict security requirements of the public sector, and DOSBA, the trade association for open source companies, for deep open source expertise and professional continuity.
Will you help build it?
The project is an active proof of concept and we can use the help. Whether you have development experience or simply want to think along about the architecture and the use cases within your own organisation: