Overview
cobalt is a NixOS configuration for a laptop used for sensitive work. It is built so that if the device is lost or taken, the data stays confidential, and so that the whole system can be audited, rebuilt and re-hardened from a single declarative source.
Design in one paragraph
Section titled “Design in one paragraph”The internal disk is a LUKS2 container whose header lives on a removable USB key; without the key
the disk reads as random data and the machine cannot boot. Unlock is a YubiKey tap (PIN + touch),
with an offline recovery passphrase as the fallback. Secure Boot (signed UKIs) and a firmware
password resist tampering with the boot chain. The root filesystem is reset to a blank snapshot on
every boot; only /home, /nix and an explicit /persist allowlist survive. Network egress goes
through a rule-based proxy with a default-deny firewall, randomised Wi-Fi MAC addresses and IPv6 privacy
addresses. Risky applications run confined (Flatpak + portals, AppArmor).
What it does not do
Section titled “What it does not do”- It does not stop a live, privileged attacker who already runs code as you.
- It does not defeat coercion. The most reliable protection is not carrying sensitive data across a hostile boundary at all (encrypt → upload → wipe → re-download).
- It does not protect against cold-boot / RAM attacks while powered on or suspended — shut down fully when at risk.
- It does not hide metadata at the other end of a conversation, nor stop the other party keeping copies.
- Deniability features are trade-offs, not guarantees; see the architecture reference.
Where to go next
Section titled “Where to go next”- Runbook → Install: the first installation, step by step.
- Reference → Architecture: threat model, storage layout, boot chain, network, sandboxing.
- Reference → Packages: what is installed and why; opt-in features.