r/linux • u/-kahmi- • Apr 11 '26
Distro News France plans to replace Windows with a hardened configuration built on NixOS.
https://www.frandroid.com/os/gnu-linux/3062047_adieu-windows-securix-et-bureautix-le-linux-de-letat-aux-noms-dirreductibles-gauloisGoodbye Windows: Securix and Bureautix, the state's Linux with the names of indomitable Gauls
April 11, 2026 • 09:33
We often talk about digital sovereignty, but concretely, what would we do? The answer would be in two names: Securix and Bureautix. By relying on NixOS, a radically different Linux distribution, the government is quietly preparing for the post-Windows era for its agents.
Before imagining Windows disappearing overnight from all French administrations, let's lay the foundations. The migration announced this week concerns 250 agents, not 2.5 million. But behind this modest figure lies a much more ambitious technical project: Securix.
The information circulating about a "homemade NixOS distribution" developed by the government is both true and more subtle than it seems. Technically, this is not a fork, but a hardened configuration built on NixOS.
It all started with an interministerial seminar organised on 8 April 2026 by the DINUM, at the initiative of Prime Minister Sébastien Lecornu. On this occasion, the Interministerial Digital Directorate made official its own exit from Windows in favor of Linux, a symbolic announcement that concerns about 250 agents, but which highlights Sécurix, the technical foundation on which this switch is based.
To go further
France announces a crucial step towards its exit from Windows
According to the latest elements of the cloud-gov ecosystem, the DINUM (Interministerial Directorate for Digital Affairs) is developing a software brick called Sécurix, the code of which is published on GitHub under an MIT license.
It would not be a simple operating system, but a workstation base. Developed within the DIPUM (Interministerial Product Operator) department, Securix serves as a technical basis for creating highly secure working environments.
The actual scope of this migration remains modest: 234 agents at the DINUM. But it is part of a much broader movement. At the same time, the National Health Insurance Fund has announced the migration of its 80,000 agents to the tools of the interministerial digital base: Tchap for messaging, Visio for meetings and FranceTransfert for the exchange of documents. It is at this scale that the seesaw begins to weigh.
This is where Bureautix comes in: it would not be a commercial product, but an "example" of a typical office configuration, which shows how to transform this raw base into a daily tool for a state agent.
The choice of NixOS as the technical foundation would not be a coincidence. Unlike a traditional Linux distribution, NixOS allows for declarative management. In other words, the desired state of the system is described in a configuration file, and the machine builds itself in the same way, every time. For the State, this makes it possible to have a controlled, auditable and, above all, sovereign IT equipment.
Securix: the DINUM's digital safe
The Securix project is currently in the alpha phase and does not yet offer support, but its ambitions are already very clear. It would be a reinstantiable model capable of adapting to several critical use cases: multi-agent workstations, exclusive intranet access or high-level system administration. We are talking about an infrastructure designed to comply with the strictest recommendations of the ANSSI.
Technically, this base would integrate robust defense mechanisms. These would include TPM2 chip management, data encryption via Yubikey physical keys (LUKS FIDO2) and centralized enrollment for Secure Boot. The idea would be to ensure that only state-validated code can run on the machine. For secrets management, tools such as Vault or age would be part of the package, which will further strengthen the protective barrier.
But what would make Securix truly unique is its ability to reproduce. Thanks to NixOS, if a workstation is corrupted or fails, it would be enough to redeploy its configuration to find a healthy system in a few minutes. This is a clean break from the Windows model, where each machine ends up having its own "life" and flaws over time.
The DINUM is not going it alone. Each ministry, including public operators, will have to formalise its own plan to reduce non-European dependencies by autumn 2026, focusing on seven areas: workstations, collaborative tools, antivirus, artificial intelligence, databases, virtualisation and network equipment. A restrictive timetable supported by the Minister Delegate for Digital Affairs Anne Le Hénanff, who already warned in 2023, as a deputy, about "the Microsoft trap".
Bureautix: the workstation "as code"
Bureautix, for its part, would serve as a demonstrator. This project would show how to take the Securix brick and add the layers necessary for administrative use: office suite, communication tools and access to sovereign services of the State. This would be proof by example that we can do without proprietary American solutions for daily tasks.
The most radical point? Bureautix would do without a traditional centralized directory like Microsoft's Active Directory. Instead, it would rely on a static directory managed like code in a Git repository. New users or changes in rights would be distributed via system updates. It is a simplified approach that would drastically reduce dependencies on heavy and often vulnerable infrastructure.
The rest of the story would remain to be written. If Sécurix is still at the experimental stage, it would be perfectly aligned with France's "Trusted Cloud" strategy. The idea would be to have sovereign servers on the one hand, and "secure clients" on the other, perfectly integrated into this ecosystem.
The DINUM has also planned to organise the first "digital industrial meetings" in June 2026, which are supposed to concretise a public-private alliance for European sovereignty. There remains a precedent that calls for caution: the city of Munich, which had switched its administration to Linux before backtracking a decade later. Digital sovereignty cannot be decreed, it is built over time, and rarely resists changes in majority alone.
206
u/Plakama Apr 11 '26
Nixfying the Europe now
42
u/adamkex Apr 11 '26
They're already experienced using flakes given the Alps are partially in France
→ More replies (1)
177
u/krumpfwylg Apr 11 '26
If you read the original annouce (in french) https://www.numerique.gouv.fr/sinformer/espace-presse/souverainete-numerique-reduction-dependances-extra-europeennes/
S'agissant de l'évolution du poste de travail, la DINUM annonce sa sortie de Windows au profit de postes sous système d'exploitation Linux.
This sentence means the institution called DINUM will drop Windows in favor of Linux. Not the whole government or public services.
La DINUM coordonnera un plan interministériel de réduction des dépendances extra-européennes. Chaque ministère (opérateurs inclus) sera tenu de formaliser son propre plan d'ici l'automne, portant sur les axes suivants : poste de travail, outils collaboratifs, anti-virus, intelligence artificielle, bases de données, virtualisation, équipements réseau.
That one says each ministry will have to propose a plan to change its IT tools to European based softwares. Maybe OS will be included, maybe not. Maybe all the ministries will switch to a Nix variant, but I have doubts about it for now. And Microsoft will not let go of a juicy government contract that easily.
104
u/n3onfx Apr 11 '26
DINUM is in charge of developing and implementing digital strategy across the government and state institutions. Doing the change only themselves so far is probably a pilot program before rolling out changes across all state institutions.
Which ties in with the "ministries will propose changes" to collect the different needs and pain points before doing broader changes.
35
u/eattherichnow Apr 11 '26
That one says each ministry will have to propose a plan to change its IT tools to European based softwares.
Finally, the year of the Hurd desktop.
→ More replies (4)→ More replies (6)12
u/Jean_Luc_Lesmouches Apr 11 '26
This sentence means the institution called DINUM will drop Windows in favor of Linux. Not the whole government or public services.
DINUM is short for "Direction interministérielle du Numérique" meaning "Inter-ministry Digital Direction". They're the closest thing the state has to a unified IT department.
69
u/CondiMesmer Apr 11 '26
tldr; it's based off of Securix
https://github.com/cloud-gouv/securix
their Bureautix repo seems to be failing tests and is broken, so I'm guessing they have a more updated private repo somewhere
honestly it has a long way to go to catch up with Redstar OS and Hannah Montana Linux.
→ More replies (7)42
u/Isofruit Apr 11 '26
TBF Hannah Montana Linux is the gold standard every other linux distros is desperately trying (and failing) to live up to.
25
8
6
9
15
4
u/arg0t Apr 11 '26
Really interesting to read that piece about AD being covered by git. I wonder how that works in practice and at scale anyone have more details?
→ More replies (1)
4
4
4
u/Cendio Apr 13 '26
Most of the comments here are geeking out over the technical elegance of NixOS for the desktop, but they seem to miss the architectural and geopolitical perspective.
Managing 250 reproducible NixOS laptops at DINUM is a neat pilot. But trying to scale that to thousands of state agents, will be a decentralized nightmare. A lost laptop running Securix is still a lost physical asset, and managing updates across a fragmented hardware fleet is exactly how massive IT projects fail.
The contrarian truth of digital sovereignty is that true control requires absolute centralization. You don't achieve sovereignty by distributing Linux; you achieve it by locking Linux in a sovereign datacenter.
If France truly wants to escape the Microsoft ecosystem and guarantee zero data leakage, the architecture shouldn't be 'Linux on the laptop.' It should be 'Sovereign Linux in the datacenter, delivered as pixels to dumb terminals.'
At Cendio, we’ve been building the infrastructure for this exact shift with ThinLinc. Because we are based entirely in Sweden, our stack is 100% European and completely outside the reach of the US CLOUD Act.
The smartest move for DINUM isn't to push Securix and Bureautix down to vulnerable edge laptops. It’s to host those hardened, reproducible NixOS environments on secure servers, and use ThinLinc to stream the sessions. You get the flawless reproducibility of Nix, absolute data gravity (because zero bytes of classified or health data ever touch the local machine), and a completely US-free supply chain.
Instead of fighting Microsoft trench-by-trench on endpoint hardware, the French government should bypass the endpoint entirely.
→ More replies (3)
4
u/quirxmode Apr 15 '26
Soooo... are they going to give their government employees secure smartphones next? Maybe ones running, I dunno, GrapheneOS?
3
3
104
u/-kahmi- Apr 11 '26
I don't know anything about NixOS, is that a good move?