N2
Operating Systems Azure

NixOS 26.05 on Azure User Guide

| Product: NixOS 26.05 on Azure

Overview

This guide covers the deployment and configuration of NixOS 26.05 ("Yarara") on Microsoft Azure using cloudimg's pre configured virtual machine image from the Azure Marketplace.

NixOS is a Linux distribution built on the Nix package manager, with a uniquely declarative model: the entire system, from the kernel and installed packages to services, users and /etc, is generated from a single configuration and rebuilt atomically. You do not edit /etc by hand and hope it sticks; you describe the system you want and NixOS realises it, with the ability to roll back to any previous generation at the boot menu.

This image is pinned to the current stable channel, nixos-26.05, built deterministically from a fixed nixpkgs revision, so the platform you certify against today is the exact platform you keep until you choose to move it forward.

What's included:

  • NixOS 26.05 ("Yarara"), x86-64, Gen2 (UEFI)
  • Built deterministically from a pinned nixpkgs revision on the nixos-26.05 stable channel
  • Azure Linux Agent (waagent) and cloud-init for Azure integration, both enabled
  • OpenSSH enabled, key only
  • Host firewall enabled, with exactly one externally reachable port: SSH on 22
  • No automatic channel upgrades, so the image stays reproducible until you opt in
  • MIT licensed core (Nix / nixpkgs); an entirely open-source system closure, built with allowUnfree = false
  • 24/7 cloudimg support

Platform: Microsoft Azure (Gen2 Hyper V) Default user: the admin username you choose when you create the virtual machine (Azure injects your key into it at first boot)

Security posture

This image ships with no known credential. There is no default password and no baked in SSH key:

  • The image is assembled offline and has never been booted, so it contains no machine-id and no SSH host keys. NixOS regenerates both uniquely on every machine's first boot, so no two virtual machines you launch ever share an identity.
  • At first boot, cloud-init creates the admin user you named at VM creation, places it in the wheel group with passwordless sudo, and injects the public key you supplied. No other account can log in.
  • root SSH login is disabled (PermitRootLogin no), and cloud-init installs a login rejecting stub in root's authorized_keys for good measure.
  • PasswordAuthentication and KbdInteractiveAuthentication are both disabled, so every login is by key.
  • The host firewall is enabled and only TCP 22 is open. There is no swap on the OS disk, and no build or vendor account is left behind.

Connecting to your instance

Replace <admin-username> with the username you set when you created the VM, and use the private key that matches the public key you supplied:

ssh -i /path/to/your_key <admin-username>@<public-ip>

Confirm the release and that your session has administrative rights:

nixos-version
# 26.05.<...> (Yarara)
sudo whoami
# root

The declarative model in one minute

Everything about the system lives in Nix configuration. The active configuration on this image is a small module; you extend it and rebuild. The two commands you will use most:

# Rebuild the system from the current configuration and switch to it now:
sudo nixos-rebuild switch

# Rebuild and make it the default at next boot, without switching now:
sudo nixos-rebuild boot

Every switch creates a new generation. If a change misbehaves, roll back:

# Roll the running system back to the previous generation:
sudo nixos-rebuild switch --rollback

# ...or pick any generation from the GRUB boot menu at reboot.

List generations:

sudo nix-env --list-generations --profile /nix/var/nix/profiles/system

Installing software

Two idioms. For a quick, throwaway shell with a package available (nothing is permanently installed):

nix-shell -p htop tree

To install software permanently and reproducibly, add it to your configuration rather than using an imperative installer. Create a drop-in module, for example /etc/nixos/configuration.nix (or a file you import from it):

{ config, pkgs, ... }:
{
  environment.systemPackages = with pkgs; [
    htop
    git
    tmux
  ];
}

then apply it:

sudo nixos-rebuild switch

Opening a port

Because the host firewall is on and locked to SSH, you declare any extra ports you need. For example, to serve HTTP:

{ ... }:
{
  networking.firewall.allowedTCPPorts = [ 22 80 ];
}

Apply with sudo nixos-rebuild switch. Remember to also open the port in your Azure Network Security Group.

Updates and channel policy

This image is deliberately pinned and reproducible: system.autoUpgrade is off, so the machine will not change underneath you. You update on your own terms.

To fetch the latest packages on the same stable series and rebuild:

sudo nix-channel --add https://nixos.org/channels/nixos-26.05 nixos
sudo nix-channel --update
sudo nixos-rebuild switch

To enable unattended updates (opt in), add to your configuration:

{ ... }:
{
  system.autoUpgrade = {
    enable = true;
    channel = "https://nixos.org/channels/nixos-26.05";
  };
}

To move to a newer NixOS release later, point the nixos channel at the new series (for example nixos-26.11 when it is released), update and rebuild, and bump system.stateVersion only after reading that release's notes.

Azure integration

Both Azure guest agents are enabled and active on this image:

systemctl status waagent
systemctl status cloud-init

Because waagent is present and functional, Azure features that depend on the guest agent, such as az vm run-command and VM extensions, work against instances of this image.

Verifying the shipped posture

You can confirm the security posture yourself:

sudo sshd -T | grep -Ei 'permitrootlogin|passwordauthentication|^port '
# permitrootlogin no
# passwordauthentication no
# port 22

swapon --show      # (empty — no swap)
id                 # your admin user is a member of the wheel group

Support

Every cloudimg image is backed by 24/7 support. NixOS and Nix are licensed MIT; the system closure is entirely open source. "NixOS" and the NixOS logo are marks of the NixOS Foundation and are used here nominatively to identify the distribution; cloudimg is not affiliated with or endorsed by the NixOS Foundation.