About

I'm Ryan Lahfa. I build critical systems: hardened workstations, deterministic cloud architectures, sovereign infrastructure: for organizations where downtime, data leakage, or dependency on foreign vendors are not acceptable. I work as a Fractional CTO, typically 1 to 2 days per week, embedded with your team, or in architecture engagements, through Omnicité, a French worker cooperative (SCOP).

I use NixOS because I can't ship systems I can't rebuild from scratch on demand. Declarative configuration and reproducibility[1] are how I get there. From SDLC trust chains (SBOM, CBOM, etc.) to the user's desktop, nothing in between is opaque.

What I do

Sécurix. We built the NixOS workstation for DINUM (France's central government digital directorate) interministerial cloud. Hardened NixOS workstations with Secure Boot, FIDO2-unlocked LUKS full-disk encryption for 200 endpoints. Sécurix replaced a heterogeneous fleet with the NixOS paradigm: zero vendor licensing costs, an approach via open source contributions, audit-ready infrastructure as code from day one, and a slow ramp-up into workstation maturity. Now the baseline for administration workstations at DINUM. Other public bodies and private companies have since engaged pilots.

Hardened admin terminals. We developed the S3NS admin terminal for 200 SREs, built on NixOS with dm-verity and Secure Boot, designed to withstand motivated adversaries. Talk at All Systems Go 2025.

lanzaboote (NLnet grant). The sovereign Secure Boot solution for NixOS, funded by NLnet and the European Commission. Now deployed in production across the US, Europe, and beyond. Used by Sécurix and many other organizations.

Lix. I founded Lix in 2024 to provide a modern alternative to the historical Nix interpreter. Lix relaunched healthy competition in the Nix implementation space: the ecosystem needed it. The vision is to move towards modern, secure APIs (Cap'n'Proto) and a shift toward Rust.

Portail. An access proxy tailored for terminals with regional routing, a rich policy language, a Varlink API, and a high-throughput architecture. Portail is meant to reach Zero Trust features including OIDC and trust inference. Co-developed at DINUM.

DGNum. I created DGNum, the student nonprofit for IT and digital services at ENS Ulm. DGNum rebuilt the school's internet access provisioning for dorms and students on modern stacks with full infrastructure sovereignty: from firmware to user-facing services.

nix-security-tracker (live instance). I architected the NixOS security vulnerability tracker: a centralized system for collecting and managing vulnerability information at scale. Now mostly stewarded by Tweag.

AFNix. I founded AFNix in 2025, the French Nix association (law 1901), to structure community governance and hosting.

Open source. Contributions in the Nix and systemd ecosystems.

Compliance and security expertise

I work within the following frameworks and specifications:

  • SecNumCloud: ANSSI's cloud security qualification. S3NS operates under this framework.
  • ISO/IEC 27001: I help companies engaging into ISO 27001 practices and securing their audit.
  • Diffusion Restreinte and OTAN RESTRICTED: handling of restricted information in government and defense contexts.
  • ANSSI guides: hardening guides, RGS (Référentiel Général de Sécurité), and technical recommendations.
  • NIS2: EU directive on network and information security, as of 19 Aug. 2026 not yet transposed into French law. I can help shaping systems for future NIS2 compliance.

I help clients prepare for PASSI audits. I understand what the auditors are looking for and I understand the audit methodology.

Capacity planning and on-premise infrastructure

I consult on on-premise hardware and datacenter capability building:

  • Picking a colocation: what is needed to operate your workload: power, cooling, network, physical security, and contractual obligations.
  • Picking the right hardware: computing total cost of ownership (TCO), sizing for current and future needs, evaluating the trade-offs between density, redundancy, and cost.
  • Building your staff capability to operate the sites: training, documentation, runbooks, escalation procedures.
  • Building your staff capability to operate the hardware remotely: remote hands, IPMI/BMC best practices, firmware update workflows, disaster recovery drills.

How I work

  • Data-driven and methodological approaches, tailored for your need. I review your operational context, your budget, and figure out a reasonable, sustainable, and workable plan. I try to use COTS as much as possible, but when required, I will offer to build custom software that is easy to maintain or easy to build a community around if this solves a need that no one has solved.
  • My reporting style is very proactive. I will try to build ways for you to keep up with what is going on.
  • I'm more efficient when you give me access to enough infrastructure to build an environment for the work.
  • I've engaged and directed with very large entities with large teams (200+ developers). I understand how to align technical teams, decision makers, and security requirements without having this permanent state of crisis or deadlocks which often lead to burnout for teams.
  • I can deal with mixed environments but I am mostly interested in cases where Nix is possible to use or is present in your organization. If you are interested to build a Nix competence in-house, I can help scaling that.
  • I can offer dynamic availability (scaling up with your needs, scaling down when there's less activity) or fixed availability (1/8, 1/4, 1/2).
  • If you're navigating a SecNumCloud audit, picking a colocation, or deciding if NixOS can run your 200-workstation fleet: let's talk.

Engagement model:

  1. Discovery (1 to 2 weeks): I assess your needs, constraints, and current stack. Output: a scope document with recommendations.
  2. Pilot (1 to 3 months): fixed-price engagement to deliver a working system on a limited scope. Output: a production-ready proof.
  3. Mission (3 to 36 months): fractional CTO or architecture mission, on-site or remote. Output: production systems, team enablement, handover.

Languages: French (native), English (fluent).
Location: Paris, CET timezone. Available on-site in France and remotely.

Background

ENS Ulm Diploma and MPRI (Parisian Master of Research in Computer Science). Cyber 9/12 Challenge winner. NixCon 2022 organizer, 2023 co-organizer. LixCon 2026 organizer. Entrepreneur d'Intérêt Général at the French Ministry of Justice.

Now freelancing through Omnicité, I take on projects where infrastructure is strategic: workstations, admin terminals, firmware trust chains, deterministic deployment, demanding cloud architectures. My vision is aligned with European digital sovereignty: building infrastructure inside EU jurisdiction, with auditable supply chains.

I also work on security and cryptography: end-to-end encryption, multi-level systems including at the application layer.

I can brief a board of directors in the morning and write Linux kernel patches in the afternoon. Different audiences, same standard of detail.

Contact

Omnicité : SCOP (worker cooperative, one-person-one-vote governance, not acquirable by external entities). SIRET 492 196 209 00026, TVA FR28492196209.

This site is hosted in France. No third-party trackers. Comments via Remark42, self-hosted, no tracking.

For commercial and contracting questions, see the buyer FAQ.

  1. Reproducibility here means being able to reproduce configurations and their effects: given the same inputs, the system produces the same behavior. This is distinct from bit-to-bit reproducibility, which is the focus of the Reproducible Builds project. ↩︎