# Shareable NixOS: the ALINA desktop on every teammate's laptop

> The ALINA OS configuration separates what a team shares from what one person decides, so a teammate can run the same agentic desktop on their own NixOS laptop with their own identity and keys.

Status: starter released in openclaw-nix 2026.10.3-r4 · team layer in progress · collaboration planned. Part of [ALINA OS](https://alinaos.com/).

## Layers

| Layer | What belongs there | Test |
|---|---|---|
| Personal | login, name, email, SSH keys, sign-ins, secrets, personal apps | a teammate would replace or delete it |
| Machine | hardware, disks, host name, monitors, single-owner duties | true of this machine and no other |
| Team | desktop, tooling, agent roles, skills, plugins, policy, shared services | every teammate gets it unchanged |
| Product | openclaw-nix: source-built gateway, NixOS/Home Manager modules, starter, doctor | public, MIT |

## Start

```sh
nix run github:alinaos-org/openclaw-nix#init -- ~/laptop
cd ~/laptop
sudo nixos-rebuild switch --flake .#<host>
openclaw models auth login --provider <provider> --device-code   # subscription sign-in
openclaw-doctor
```

`init` asks for user and full name, machine name and time zone, model provider, and subscription or API key. It writes `flake.nix`, `host.nix`, `openclaw.nix`, `openclaw/main.json`, `secrets/openclaw.yaml` (encrypted), `.sops.yaml` and `hardware-configuration.nix`. `--template FLAKE#NAME` generates from a team's own template.

## Secrets contract

Required secrets are derived from the config: bare `${VAR}` references, env SecretRefs, and the gateway token. A reference without its key fails the build and names the key. Secrets are encrypted for the machine's SSH host key and the person's own age key. Subscription sign-ins and chat accounts are never shared.

## Doctor

`openclaw-doctor` checks, per gateway: environment (each required variable set, not empty, not a placeholder), gateway (service active, ready), secrets (OpenClaw's audit passes), models (each default route has a sign-in or key). It names variables, never values.

## Tested

On every change CI generates a laptop with `init`, evaluates it for both sign-in modes, and boots one in a VM: sops-nix renders the env file for that user alone; no secret appears in configs; the gateway accepts only its token; the doctor passes when healthy and fails, naming the variable, when a key is removed.

## Next

Collaboration: one gateway per person federated over a team relay, a shared work board for Dark Factory runs, and a team scope in shared memory, with rules for who may instruct whose agent, audit and revocation.