Skip to content

NixOS on AWS: Complete Setup Guide for Base NixOS 25.05 AMI

Most NixOS tutorials assume you'll install from scratch and figure out the rest. That's a 2-hour detour into dependency conflicts and broken configurations.

There's a faster way: use a prebuilt AMI that boots into a working NixOS system in under 5 minutes.

This tutorial walks through launching the Base NixOS 25.05 AMI on AWS EC2, verifying it works, and making your first declarative configuration change.

Prerequisites

Before starting:

  • An AWS account with EC2 access
  • An EC2 key pair (ECDSA recommended, RSA is deprecated on modern NixOS)
  • Basic familiarity with SSH

No NixOS experience required. That's the point.

Step 1: Subscribe to the AMI

  1. Go to the Base NixOS 25.05 listing on AWS Marketplace
  2. Click Continue to Subscribe
  3. Accept the terms
  4. Click Continue to Configuration and select your region

The AMI is free—AWS charges only for the EC2 instance you launch.

Step 2: Launch the Instance

From the AWS Marketplace:

  1. Click Launch
  2. Choose an instance type (t3.small is fine for testing, m5.large for production)
  3. Select your key pair
  4. Configure security group: allow SSH (port 22) from your IP
  5. Click Launch

Wait 30-60 seconds for the instance to initialize.

Step 3: Connect via SSH

ssh ec2-user@<your-public-ip>

You're in. The system is running NixOS 25.05 with:

  • Firewall enabled
  • Password authentication disabled
  • Root login disabled
  • Only essential services running

Check the NixOS version:

cat /etc/os-release

You should see NixOS 25.05 in the output.

Step 4: Explore the Configuration

The entire system state is defined in one file:

cat /etc/nixos/configuration.nix

This is the declarative configuration. Every installed package, every service, every setting—defined here. Not accumulated over time through manual commands.

The AMI comes with a minimal setup:

  • SSH server (hardened)
  • Firewall (enabled by default)
  • ec2-user with sudo privileges
  • Cloud-init for automated bootstrapping

Step 5: Make a Change

Let's install a package to see the declarative workflow in action.

  1. Edit the configuration:
sudo nano /etc/nixos/configuration.nix
  1. Add a package to the environment.systemPackages list:
environment.systemPackages = with pkgs; [
  vim
  git
  htop
];
  1. Apply the change:
sudo nixos-rebuild switch

NixOS downloads the packages, builds the new system configuration, and switches to it atomically. No partial installs, no broken dependencies.

  1. Verify:
vim --version
git --version
htop --version

All three are installed. If you hadn't added them, they wouldn't exist—there's no hidden state.

Step 6: Test a Rollback

This is where NixOS earns its reputation.

Something broken? Roll back to the previous configuration:

sudo nixos-rebuild switch --rollback

Instant. The packages you just added are gone. The system is exactly as it was before.

This isn't a backup restore. It's a zero-cost operation that takes seconds—NixOS keeps previous generations available by default.

What's Preconfigured

The Base NixOS 25.05 AMI includes these security hardening measures:

Feature Status
Firewall Enabled
SSH password auth Disabled
Root SSH login Disabled
Default user ec2-user (sudo)
ECDSA keys Supported (RSA deprecated)
Cloud-init Compatible
Desktop XRDP + KDE Plasma ready

You don't need to harden anything. It's production-ready from first boot.

Optional: Enable Remote Desktop

The AMI includes XRDP + KDE Plasma support. To enable it:

  1. Edit /etc/nixos/configuration.nix
  2. Uncomment the XRDP line (look for the xrdp comment block)
  3. Rebuild:
sudo nixos-rebuild switch
  1. Set a password for ec2-user:
passwd
  1. Connect via RDP client to your instance's public IP

This gives you a full graphical desktop environment on a cloud instance—useful for development, testing, or running GUI applications remotely.

Next Steps

Now that you have a working NixOS instance:

  • Define services: Add Nginx, PostgreSQL, or Docker as declarative services in configuration.nix
  • Version control: Commit your configuration.nix to Git for full infrastructure history
  • Scale: Use the same configuration file to launch identical instances
  • Integrate: Pair with Terraform or Pulumi for complete infrastructure as code

The NixOS manual covers the full configuration reference.

Why This AMI

Building NixOS from scratch takes 1-2 hours. This AMI skips that entirely:

  • Pre-hardened: Security best practices applied at build time
  • Minimal footprint: Only essential services running
  • Cloud-optimized: Designed for EC2 with cloud-init support
  • Up-to-date: Based on NixOS 25.05 stable release

For teams evaluating NixOS on AWS, this is the fastest path from "interested" to "running in production."

Launch the AMI: Base NixOS 25.05 on AWS Marketplace