nix-darwin and Home Manager configuration

This repository contains my Apple Silicon macOS configuration. It lives at ~/.config/nix and builds the dcmbp nix-darwin host together with the danielcorin Home Manager profile.

Build and apply

Build first so evaluation and package failures happen before privileged activation:

darwin-rebuild build --flake .#dcmbp
sudo darwin-rebuild switch --flake .#dcmbp

Home Manager is imported as a nix-darwin module and is rebuilt with the system. It does not require a separate channel or home-manager switch installation (Home Manager nix-darwin documentation).

Validate

The flake exposes nixfmt-tree as its formatter. Its checks build the complete dcmbp system closure and run deadnix and statix lints:

nix fmt
nix flake check

nixfmt is the official Nix formatter (nixfmt documentation). nix flake check evaluates and builds derivations exposed through checks (Nix command reference).

Layout

• flake.nix wires pinned inputs, the dcmbp host, Home Manager, formatting, and checks.
• hosts/dcmbp contains host identity and compatibility settings.
• modules/darwin contains Homebrew, Nix daemon, and macOS system settings.
• home contains the user profile and program-specific configuration. home/palette.nix holds the Monokai colors shared by Ghostty and ccstatusline.

Design notes

• flake.lock is committed so evaluations resolve the same input revisions (Nix flakes documentation). nix-darwin and Home Manager both follow the same Nixpkgs input.
• system.stateVersion = 5 and home.stateVersion = "23.11" preserve compatibility with the releases that initialized the machine. They should not be raised merely because inputs are newer (Home Manager upgrade guide).
• The host targets aarch64-darwin only. No Intel extra-platforms compatibility is enabled.
• Nix builds use sandboxing, automatic job/core selection, and a trusted-users list containing only root. Nix warns that daemon trust is effectively root access (Nix configuration reference, sandbox setting).
• Garbage collection runs weekly and retains generations for 30 days; store optimization runs automatically. Explicit Weekday scheduling avoids launchd's calendar-day semantics (Apple launchd scheduling documentation, Nix garbage-collection manual).
• Homebrew activation does not update or upgrade packages implicitly. cleanup = "uninstall" converges installed packages without the application-data deletion performed by zap (nix-darwin Homebrew options, Homebrew Bundle documentation).
• Home Manager owns most command-line tools and their configuration. Homebrew owns macOS app bundles, system integrations, and selected formulae. WezTerm's app comes from Homebrew while Home Manager owns its configuration.
• Homebrew installs mise to avoid building it from source through Nix; zsh activates it directly. The official mise guide documents Homebrew as a supported alternative installation (mise installation guide).
• The macOS application firewall and stealth mode are enabled, and automatic macOS updates are allowed (Apple firewall guide, Apple update guide). FileVault and its recovery key remain outside version control (Apple FileVault guide).

Earlier inspiration

I use GitHub Code Search to learn from configurations people have generously open-sourced. Helpful resources include:

• Nixcademy: Nix on macOS
• David Teather: Nix macOS setup
• mhanberg dotfiles
• bphenriques fzf configuration
• Native fix for apps under the MacBook Pro notch
• maxbrunet dotfiles
• malob nixpkgs configuration
• milogert tmux configuration
• Josean Martinez: SketchyBar setup
• Martin Heinz: managing dotfiles with Nix
• davish setup