ThermOS
Think: NixOS meets macOS.
A declarative Linux system. Easy to use, joyful to configure.
Why
NixOS proved declarative system management works. But it was built by hackers for hackers. There is no boundary between what users should see and what modules use internally. That makes a real GUI impossible.
ThermOS draws that boundary. User-facing options are separated from internal wiring, making a real configuration interface possible. Not a code editor, but something closer to system settings.
Why Adios?
A stable user experience requires stable module boundaries. When you change a module, the effect should be local and traceable.
NixOS modules share a single global fixpoint. config is both input
and output. Every module reads from the same namespace it writes to. There is
no boundary between what a module consumes and what it produces, so there is
no way to tell what a change will affect.
Adios separates inputs from outputs. A module declares what it reads, publishes what it produces, and cannot reach into another module without declaring the dependency. That separation is what makes stable interfaces possible, and stable interfaces are what makes a GUI possible.
How it works
Try it
Requires Nix. Container boot needs systemd-nspawn, QEMU boot needs qemu-system-x86_64 with KVM.
git clone https://github.com/hsjobeki/thermos
cd thermos
./run.sh # nspawn container
./run.sh --qemu # QEMU VM (serial console + SSH on :2222)
Login: root / thermos. Stop nspawn: poweroff. Stop QEMU: Ctrl-a x.
SSH into the QEMU VM. Root login is key-only; the authorized key is in systems/qemu.nix (swap in your own).
ssh -p 2222 root@localhost
Roadmap
Contract-based module system with pub/sub data flowBoot in nspawn container with systemd, PAM, SSH, D-BusBoot in QEMU with kernel, initrd, and ext4 disk imageSSH login verified end-to-end in a VM- Boot on real hardware (UEFI, firmware, microcode, disk encryption)
- Live system management: rebuild, switch, rollback
- A Wayland desktop on the same verified base
- Secret and state provisioning outside the root image
- Immutable, cryptographically verified images (UKI, dm-verity, Secure Boot)
- Atomic A/B updates with rollback
- Settings-style configuration UI over the contract layer