DAWO-NixOS: How the Dutch Government Is Rebuilding the Workplace

A laptop becomes a blueprint

Imagine a municipal employee opening a laptop after a weekend update. The machine boots, email works, and the browser looks familiar, but nobody can quickly prove which settings, packages, and security rules are actually in place. Another laptop, bought at the same time, has drifted into a slightly different state.

That ordinary bit of IT friction is the doorway into DAWO, short for Digitaal Autonome Werkomgeving Overheid, or Digital Autonomous Workplace for Government. The Dutch initiative is building an open, inspectable foundation for government work instead of placing every important function inside one supplier’s suite.

The more useful question is not whether DAWO looks exactly like Microsoft. It is what a Microsoft alternative looks like when it begins with the operating system. As of September 25, 2026, the public DAWO site lists DAWO-NixOS version 0.1.2, released on August 15, after an initial release in June and a municipal rollout in July. This is an active construction project, not a finished replacement that every ministry can install tomorrow.

DAWO is not one giant replacement suite

DAWO is an open blueprint made from parts that can be inspected, changed, or replaced independently. Those parts cover the operating system, cloud infrastructure, collaboration software, and artificial intelligence. The idea resembles a well-designed workshop: tools should fit together, but replacing one tool should not force you to throw away the entire room.

That distinction matters. A government could adopt DAWO-NixOS while choosing different collaboration services, identity systems, or cloud components. Digital autonomy does not mean refusing every commercial product. It means keeping enough control over the architecture, data, source code, and operating knowledge to change direction when circumstances require it.

Why NixOS is the foundation

NixOS is a Linux distribution, meaning a packaged operating system built around the Linux kernel, system tools, installers, and software packages. Its unusual feature is declarative configuration. Instead of recording a long sequence of clicks and commands, you describe the state you want, and NixOS builds the machine to match it.

Think of the difference between repairing a kitchen by memory and keeping a precise set of construction plans. With memory, two kitchens slowly become different. With plans, another team can rebuild the same layout and compare changes before anything is installed.

A small illustrative NixOS configuration might look like this:

{ pkgs,... }:
{
 services.printing.enable = true;

 environment.systemPackages = with pkgs; [
 firefox
 libreoffice
 ];
}

The first setting declares that printing should be enabled. The package list declares which applications belong on the machine. It does not describe every installation step because the Nix package manager and NixOS modules know how to turn those declarations into a working system.

An administrator applies the result with nixos-rebuild switch. NixOS creates a new system generation, which is a complete version of the operating system configuration. Updates are atomic, meaning they succeed as an all-or-nothing change, and older generations remain available for rollback:

sudo nixos-rebuild switch --rollback

That behavior is valuable in government IT. If a policy change or package update causes trouble, the recovery path is part of the operating system rather than an emergency reconstruction from scattered notes. When the configuration and its dependency versions are stored in version control, a tested workplace can also be reproduced on another machine.

From one laptop to a fleet

A single reproducible laptop is useful. A fleet, meaning a large group of managed devices, is where the approach becomes more interesting.

The DAWO-NixOS repository uses a flake-based build system. A flake is a project description that records its inputs, such as package collections, and defines the outputs it can build. The repository also divides its settings into modules, reusable pieces for hardware, networking, desktops, users, services, and security controls.

That structure gives an organisation a shared baseline without erasing every local decision. A national or municipal team can inherit the common foundation, add its own hardware profile, and explain the difference in code. The result is closer to a reviewed engineering change than to a mysterious setting hidden inside an administrator’s console.

DAWO-Sextant extends this idea into device management. It is currently a proof of concept for a self-hosted control plane, meaning the management layer that coordinates a fleet. The project is positioned as an alternative to Microsoft Intune, but its design is different from a conventional cloud dashboard: the desired state of devices lives in a Git repository, changes pass a build check, and rollouts can move through small rings before reaching the wider fleet.

Devices pull their approved configuration instead of waiting for a central server to push arbitrary commands. This Git-based operating style, often called GitOps, gives administrators a history they can read, review, compare, and show to an auditor. It also makes the question of who changed a setting much less mysterious.

The hard part is not installing Linux

NixOS brings a steep learning curve. Its package model, file layout, and configuration language differ from the Linux distributions most support teams know. Hardware support, smart-card readers, printers, video conferencing, proprietary business applications, and document compatibility all become practical tests.

A declarative file can state that a service should exist. It cannot make an unsupported device driver appear or guarantee that an old line-of-business application will behave perfectly. DAWO therefore has to solve the human side as carefully as the technical side: curated software choices, useful documentation, training, help-desk procedures, and a workplace that feels capable rather than restrictive.

Security evidence is another substantial task. The Dutch government’s baseline information-security framework describes the controls organisations need, but teams still have to translate those controls into measurable settings. DAWO’s own workshop material identifies a need for NixOS-specific scans based on Center for Internet Security benchmarks, so compliance can be checked continuously rather than asserted once in a project document.

Open source reduces dependence on a single vendor, but it does not remove maintenance. Someone still has to review changes, track vulnerabilities, test hardware, maintain packages, and respond when a dependency changes direction. The public repositories make that work visible; they do not make the work disappear.

What success would look like

For DAWO, success would mean more than a different desktop background. It would mean:

• a policy change appears as a reviewed, traceable configuration change;
• a laboratory laptop and a production laptop can be rebuilt from the same tested baseline;
• a failed rollout can be stopped and reversed without rebuilding every device by hand; and
• the operating system, cloud, and collaboration layers can evolve independently.

That is why DAWO-NixOS is interesting even before it becomes a broad public-sector platform. It treats the workplace as something that can be described, tested, inspected, and replaced in pieces.

DAWO is not a declaration that Microsoft has vanished from Dutch government offices. It is a practical bet that digital autonomy begins with architecture. NixOS makes the state of a computer explicit; DAWO adds shared governance, open repositories, and a path toward a workplace no single supplier completely owns.