Know what every laptopis actually running.
Every laptop in your organisation, described in one place that belongs to you. You can see what each machine runs, and show it to an auditor without preparing anything.
Modernise the workplace, or keep control of it. Most tools make you pick one.
Open-source fleet management for NixOS laptops. You run it yourself, and how every machine is set up is written down in a file you own.
We build on NixOS because a bad update rolls back, the same description builds the same machine, and no vendor owns the base.
- How it is set up
- Written down, in a file you own
- Who reaches in
- Nobody. Laptops fetch it themselves
- Evidence
- Exported per control, not assembled
Three steps. That is the whole loop.
Nobody changes a laptop by hand, not even us.
Write
Change one line in the file that describes your laptops.
Test
It is built and checked first. Broken never leaves the building.
Ship
A few machines first, then the rest. It stops itself if something is off.
Why NixOS.
We did not pick an operating system to be different. We picked the one that makes a fleet provable, and built the best tooling we could on top of it.
A bad update rolls back
Every change is a new generation of the system. If it does not boot or does not work, the laptop starts the previous one.
The same description, the same machine
A configuration builds into the same system every time. A laptop in the field matches the description, or it says it does not.
A very large package collection
What your organisation needs is usually already packaged, pinned to a version, and building.
No vendor decides for you
NixOS is a community distribution. Nobody can change the licence, raise a price per seat, or end of life it out from under you.
Not just managed. Provable.
Traditional MDM sends commands to a device and records whether they seemed to land. Sextant describes what the device should be, and the device builds itself into that. The difference shows up everywhere.
You describe the result
Not the steps to get there. Two laptops with the same description end up identical, whatever they were before.
You can show it
What a laptop runs is a fact you can hand over, not a claim. The audit trail is a side effect of the work.
A new laptop in one pass
Plug it in, walk away, pick up a finished machine. No image to maintain by hand.
NIS2 moved the question from trust to proof.
Directors are personally accountable now. Sextant shows what is on a laptop, exactly, instead of a report about what should be on it.
A full list of what runs
Which software is on which laptop, down to the version.
Software you keep yourself
Your own copy of everything the fleet installs, so a hacked supplier does not reach you.
Evidence, not a report
ISO 27001 and NIS2 evidence, exported per control, straight from what the laptops report.
Self-hosted, or through a partner.
Neither column is the paid edition. It is the same software under the same licence, and the difference is who keeps the server running.
This is a project, not a product.
Nobody sells you a seat here. The code is EUPL 1.2, the decisions are public, and the fastest way in is to run it and tell us what broke.
Run it in two commands
A console, a database and sixty simulated devices on your own machine. Ctrl-c deletes everything it made.
Read what was decided and why
Every choice that shaped the product is a written record in the repository, including the ones argued against.
Take something that is open
Issues are labelled and the unclaimed ones are the ones to take. Nobody has to ask permission to start.
One document for every laptop.site.audit.
Take it, run it, help build it.
The software is yours under the EUPL 1.2 and needs nobody’s permission. What the project needs is people: a laptop model we have never imaged, a language nobody has translated, a bug found by running it for real.