NixShield

NixShield defines four complete NixOS systems built from a common hardened baseline:

Configuration	Intended VM
nixshield-workstation	Secure daily workstation
nixshield-admin	Privileged administration workstation
nixshield-pentest	Authorized pentest and lab workstation
nixshield-soc	SOC analyst and DFIR workstation

This version does not use nixos-rebuild build-vm. Each profile is installed directly on its own VMware VM with nixos-rebuild build, test, then switch.

Recommended deployment model

Create four NixOS VMware VMs, or install one template VM and clone it four times:

VM template
├── clone → NixShield Workstation
├── clone → NixShield Admin
├── clone → NixShield Pentest
└── clone → NixShield SOC

Each clone keeps its own disk UUID and therefore needs its own generated hardware-configuration.nix.

Repository layout

hosts/<role>/
├── default.nix
├── hardware-configuration.nix   # generated locally, ignored by Git
├── boot-local.nix               # generated locally, ignored by Git
└── user-local.nix               # generated locally, ignored by Git

profiles/<role>/                  # role-specific packages and settings
modules/                          # common reusable system modules
scripts/                          # prepare/build/test/switch helpers

Installation guide

The complete installation procedure, including the purpose and order of the helper scripts, is documented in docs/INSTALLATION.md. The shorter deployment rationale remains in docs/DEPLOYMENT.md.

Tool collections

Role-specific package lists are grouped under modules/tools/. For example, the Pentest profile composes Python, recon, web, Windows/AD, password-auditing, exploitation and connectivity modules.

Deploy the Pentest system on the current VM

Take a VMware snapshot first, then:

cd ~/NixShield
bash scripts/prepare-host.sh pentest

This copies the current VM's /etc/nixos/hardware-configuration.nix, creates an appropriate local bootloader file, and records the current regular username in a local ignored file.

Review the generated files:

sed -n '1,220p' hosts/pentest/hardware-configuration.nix
cat hosts/pentest/boot-local.nix
cat hosts/pentest/user-local.nix

Build the complete system without activating it:

bash scripts/build-host.sh pentest

Temporarily activate it until the next reboot:

bash scripts/test-host.sh pentest

After checking networking, GNOME and failed services:

hostnamectl
systemctl --failed
ip address

make it persistent:

bash scripts/switch-host.sh pentest

Reboot after the first profile installation:

sudo reboot

Deploy another role

Run the same workflow inside the corresponding cloned VM:

bash scripts/prepare-host.sh soc
bash scripts/build-host.sh soc
bash scripts/test-host.sh soc
bash scripts/switch-host.sh soc

Do not normally switch one production VM repeatedly between Pentest, Admin and SOC. Separate clones provide better isolation and make the architecture easier to demonstrate.

Important: system.stateVersion

modules/common/base.nix contains system.stateVersion. It must normally match the value from the original installation, not the latest NixOS release. Check it with:

grep -R "system.stateVersion" /etc/nixos

Change the repository value before the first switch if necessary.

User account

NixShield does not impose a fixed username. bash scripts/prepare-host.sh <role> detects the regular user running the script and writes the local, Git-ignored file:

hosts/<role>/user-local.nix

For example:

{ ... }:

{
  nixshield.user.name = "alice";
}

The selected username is displayed in GDM and keeps Bash as the default login shell. Passwords are not stored in Git; the existing mutable user password remains usable. Shared Bash aliases and the colored prompt are defined in modules/common/shell.nix. Run the preparation script as the regular user, not as root.

Rollback

Temporary activation with test disappears after reboot. For a persistent generation:

sudo nixos-rebuild switch --rollback

You can also select an earlier generation from the boot menu.

VMware integration

All hosts import:

virtualisation.vmware.guest.enable = true;

Shared folders and clipboard also depend on VMware host settings and the display protocol. File transfer through Git, SCP or a VMware shared folder is more reliable than drag-and-drop.

Validation

nix flake show
nix flake check --no-build --show-trace

A full nix flake check builds every configuration and can require substantial disk space and time.

Security note

Pentest tools are intended solely for systems and networks you own or are explicitly authorized to test. NixShield is a portfolio reference implementation, not a certified CIS, ANSSI or DISA baseline.