Nixisolated

Qubes-inspired workflow isolation for NixOS using MicroVMs.

The goal of this repository is to design and implement a workstation layout that:

• isolates secrets by activity and trust domain,
• limits the blast radius of supply-chain compromise,
• keeps risky internet-sourced work disposable,
• stays usable enough for daily development and communication.

The current design is documented in docs/ARCHITECTURE.md.

The first implementation scaffold will expose:

• reusable NixOS modules for host and guest policy,
• template and profile modules for each VM class,
• a reference host module you can import into a real machine config,
• disposable VM definitions built from template-based guest configs.

Trying It

Right now, the repository is best treated as a design-aware scaffold.

What you can already try:

1. fetch the flake inputs,
2. evaluate or build a guest runner,
3. launch a guest imperatively with nix run,
4. import the reference host module into a real NixOS host later.

See docs/BOOTSTRAP.md for the exact commands and current limitations.

Implementation will follow the architecture in phases:

1. minimal host orchestration,
2. reusable VM profiles and templates,
3. disposable project sandboxes,
4. secret delivery and network policy,
5. ergonomics and day-to-day workflow polish.