feat: switch fi (darwin) to Determinate Nix, keep caches declarative

[Multipixelone]

What

Switch the fi macOS host from nix-darwin-managed Nix to Determinate Nix, while keeping every cache/substituter and Nix setting declarative in the flake. The store is not reinstalled — Determinate takes over /etc/nix, nix-darwin keeps doing everything else.

How it works

Importing inputs.determinate.darwinModules.default does two things itself:

1. forces nix.enable = lib.mkForce false (nix-darwin no longer writes /etc/nix/nix.conf), and
2. exposes determinateNix.*, which writes /etc/nix/nix.custom.conf and /etc/determinate/config.json.

So this is the third option — not "let nix-darwin manage the install" and not "set nix.enable = false and hand-edit nix.custom.conf". Config stays in the flake under determinateNix.*.

Changes

• modules/fi/determinate.nix (new) — import the Determinate darwin module and configure determinateNix.customSettings:
  • extra-substituters / extra-trusted-public-keys reuse the repo-wide caches aggregate (modules/nixpkgs/substituters.nix), the same list that feeds the flake nixConfig and the NixOS hosts — so the Mac stays in sync.
  • extra-experimental-features = [ "pipe-operators" ] and trusted-users.
  • All extra-* (additive) so Determinate's own defaults (nix-command/flakes, cache.nixos.org, the FlakeHub cache) are preserved rather than clobbered.
• modules/fi/system.nix — drop nix.enable / nix.settings (inert once Determinate owns nix.conf); those settings now live in customSettings.
• modules/fi/linux-builder.nix — port nix.linux-builder → determinateNix.nixosVmBasedLinuxBuilder. Same Nixpkgs darwin.linux-builder VM, same ephemeral, both aarch64-linux/x86_64-linux, same tuning (6 cores / 40 GB disk / 8 GB mem), same builder@localhost:31022. nix-darwin's own nix.linux-builder can't be used here because it asserts nix.enable, which Determinate forces off. (Determinate also ships a native Virtualization.framework builder; this keeps the existing VM verbatim.)
• flake.nix / flake-file — add the determinate input (flakehub.com/f/DeterminateSystems/determinate/3).

Follow-ups before activating on the Mac

This environment has no nix, so two generated artifacts couldn't be produced here:

1. flake.nix was hand-edited to mirror what write-flake produces — run nix run .#write-flake to confirm there's no drift.
2. flake.lock does not yet contain the determinate input — it auto-locks on the first eval (darwin-rebuild / nix flake check), or run nix flake lock to lock it explicitly.

Activate with just darwin-switch fi (or just darwin-bootstrap fi on a fresh machine).

🤖 Generated with Claude Code

---

Generated by Claude Code