NixOS

Videos

Overview: NixOS 26.05 on Azure: overview (watch on YouTube)

Launch and log in: NixOS 26.05 on Azure: launch and log in (watch on YouTube)

Security posture

This image ships with no known credential. There is no default password and no baked-in SSH key:

• The image is assembled offline and has never been booted, so it contains no machine-id and no SSH host keys. NixOS regenerates both uniquely on every machine's first boot, so no two virtual machines you launch ever share an identity.
• At first boot, cloud-init creates the admin user you named at VM creation, places it in the wheel group with passwordless sudo, and injects the public key you supplied (or sets the password you chose, if you deployed with a password). No other account can log in.
• Root SSH login is disabled (PermitRootLogin no), and cloud-init also installs a stub in root's authorized_keys that rejects logins.
• The image honors the authentication type you choose in the portal. With an SSH public key (recommended), PasswordAuthentication and KbdInteractiveAuthentication stay disabled, so every login is by key. If you choose a password instead, cloud-init turns PasswordAuthentication on (in /etc/ssh/sshd_config.d/50-cloud-init.conf) so that your password works. KbdInteractiveAuthentication stays off.
• The host firewall is enabled and only TCP 22 is open. There is no swap on the OS disk, and no build or vendor account is left behind.

Deploying the virtual machine

Option A: Azure Portal

• Open the NixOS 26.05 listing by SecureAnyCloud in the Azure Marketplace, then select Get it now and Create.
• Choose your subscription, resource group, VM name, region and size. Standard_B2s is a reasonable starting point.
• Under Administrator account, choose SSH public key (recommended) and supply your key. The image honors the authentication type you choose here. If you choose Password instead, password login is turned on for your admin user and that password works.
• Under Inbound port rules, allow SSH (port 22) from your own network only.
• Select Review + create, then Create.

Option B: Azure CLI

Accept the Marketplace terms once per subscription, then create the VM from the Marketplace image with your SSH key:

az vm image terms accept --urn sac1647283583153:nixos:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-nixos-vm \
  --image sac1647283583153:nixos:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --public-ip-sku Standard

When the VM is running, read its public IP address:

az vm show --resource-group myResourceGroup --name my-nixos-vm --show-details --query publicIps -o tsv

Connecting to your instance

Replace <admin-username> with the username you set when you created the VM, and use the private key that matches the public key you supplied:

ssh -i /path/to/your_key <admin-username>@<public-ip>

Confirm the release and that your session has administrative rights:

nixos-version
# 26.05.<...> (Yarara)
sudo whoami
# root

The declarative model in one minute

Everything about the system lives in Nix configuration. The active configuration on this image is a small module, which you extend and then rebuild. These are the two commands you will use most:

# Rebuild the system from the current configuration and switch to it now:
sudo nixos-rebuild switch
# Rebuild and make it the default at next boot, without switching now:
sudo nixos-rebuild boot

Every switch creates a new generation. If a change misbehaves, roll back:

# Roll the running system back to the previous generation:
sudo nixos-rebuild switch --rollback
# ...or pick any generation from the GRUB boot menu at reboot.

List generations:

sudo nix-env --list-generations --profile /nix/var/nix/profiles/system

Installing software

There are two ways to install software. For a quick, throwaway shell with a package available, run the following. Nothing is permanently installed:

nix-shell -p htop tree

To install software permanently and reproducibly, add it to your configuration rather than using an imperative installer. Create a drop-in module, for example /etc/nixos/configuration.nix (or a file you import from it), as follows:

{ config, pkgs, ... }: { environment.systemPackages = with pkgs; [ htop git tmux ]; }

Then apply it:

sudo nixos-rebuild switch

Opening a port

The host firewall is on and locked to SSH, so declare any extra ports you need. For example, to serve HTTP:

{ ... }: { networking.firewall.allowedTCPPorts = [ 22 80 ]; }

Apply the change with sudo nixos-rebuild switch. Also open the port in your Azure Network Security Group.

Updates and channel policy

This image is deliberately pinned and reproducible: system.autoUpgrade is off, so the machine does not change underneath you, and you update on your own terms.

To fetch the latest packages on the same stable series and rebuild, run:

sudo nix-channel --add https://nixos.org/channels/nixos-26.05 nixos
sudo nix-channel --update sudo nixos-rebuild switch

To opt in to unattended updates, add the following to your configuration:

{ ... }: { system.autoUpgrade = { enable = true; channel = "https://nixos.org/channels/nixos-26.05"; }; }

To move to a newer NixOS release later, point the nixos channel at the new series (for example nixos-26.11 when it is released), then update and rebuild. Bump system.stateVersion only after you read that release's notes.

Azure integration

Both Azure guest agents are enabled and active on this image:

systemctl status waagent
systemctl status cloud-init

Because waagent is present and functional, Azure features that depend on the guest agent, such as az vm run-command and VM extensions, work against instances of this image.

Verifying the shipped posture

Run the following to confirm the security posture yourself:

sudo sshd -T | grep -Ei 'permitrootlogin|passwordauthentication|^port '
# Port 22
# PermitRootLogin no
# PasswordAuthentication no (yes if you deployed with a password) swapon --show
# (empty — no swap) id
# your admin user is a member of the wheel group

Support

Every SecureAnyCloud image is backed by 24/7 support. NixOS and Nix are licensed MIT, and the system closure is entirely open source.

"NixOS" and the NixOS logo are marks of the NixOS Foundation and are used here only to identify the distribution. SecureAnyCloud is not affiliated with or endorsed by the NixOS Foundation.

Deploy on Azure

Launch NixOS 26.05 on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com