NixOS on Tom Meurs

Declarative Infrastructure as Compliance Documentation: Talos, NixOS, and Audit-Ready Systems

Mon, 23 Mar 2026 19:28:00 +0100

TL;DR Talos and NixOS boot from a file that says what the machine is. That file is what an ISO 27001, SOC 2 or NIS2 auditor asks for, so the evidence collection shrinks to a git log, a diff with no output and an inventory dump. Below is the mapping from config to control, the scripts, and the part that stays hard work.

An ISO 27001 audit starts weeks before the auditor shows up, with someone collecting screenshots. Configuration panels, firewall rules, a dashboard that shows which patches went out. Then the Word documents that describe what the systems are supposed to do. Then the change tickets, dug out of the ticketing system, each one pointing at a “server maintenance” nobody can reconstruct six months later. Everyone treats this as the price of being in business. I did too, for years.

NixOS as a Hypervisor: KVM and QEMU Can Do Everything

Thu, 19 Mar 2026 21:52:00 +0100

TL;DR KVM and QEMU are the engine inside Proxmox and most of the cloud you rent. On NixOS, with libvirt on top, that engine is one block of config, and live migration, memory ballooning, GPU passthrough, SR-IOV and CPU pinning are each a command or an XML snippet away. What Proxmox adds is the dashboard and the delegation, and I’m honest below about how much that’s worth.

Ask around how to run a “real” hypervisor at home and you get the same shortlist. VMware, Hyper-V, or at minimum Proxmox. Something with a web UI, a clustering tab and a marketing page full of enterprise features. The shortlist is so well worn that running VMs without one of those products feels like cutting corners. I don’t blame anyone for that. The marketing is good.

NixOS vs Talos for Kubernetes Nodes: Two Flavors of Immutable Infrastructure

Sun, 15 Mar 2026 20:37:00 +0100

TL;DR Talos and NixOS are both declarative and both can be immutable, and that’s about where the resemblance stops. Talos runs Kubernetes and nothing else, with no shell to drift in. NixOS is a full Linux where the whole machine is one Nix config. I run Talos on my cluster nodes and NixOS on the machines around them, and this post is how I got to that split.

I’ve written about Talos Linux as the immutable Kubernetes OS, and I’ve compared Arch vs NixOS for workstations. After both, the same question kept arriving in my inbox. Why not NixOS on the Kubernetes nodes too?

Arch vs NixOS as a Workstation: Professional and Personal Use

Tue, 03 Mar 2026 21:28:00 +0100

TL;DR I’ve run Arch and NixOS as my daily machine, and today it’s Arch on both desktops and NixOS on the servers. Arch’s reputation for breaking is mostly a missing snapshot. With btrfs, Snapper, dotfiles in git and a package list, a rollback takes 2 minutes and the fear of updates goes away. NixOS earns its learning curve when several machines have to stay identical, and on a server I wouldn’t run anything else.