Personal Nix configuration for Macs, a few NixOS hosts, and Proxmox template automation. Most day-to-day machines are managed with nix-darwin; Linux hosts are defined as NixOS flakes.
Darwin configs:
nauvismac-studiomba15milliwaysbaldrickmagratheabeefcake
NixOS configs:
forgejoproxmox-builderproxmox-template
Colmena also defines deploy targets for forgejo, morphnix, and nvllama.
A new Mac can bootstrap from the public repository without GitHub credentials
or SSH keys. Download the script over HTTPS, then pass the hostname matching a
darwinConfigurations entry:
curl --fail --silent --show-error --location \
https://raw.githubusercontent.com/ironicbadger/nix-config/main/scripts/darwin/new-mac-bootstrap \
--output /tmp/new-mac-bootstrap
chmod +x /tmp/new-mac-bootstrap
/tmp/new-mac-bootstrap HOSTThe script installs Apple's Command Line Tools when needed, Rosetta 2 on Apple
Silicon, the official multi-user Nix distribution, and the selected nix-darwin
configuration. It uses an unauthenticated HTTPS clone at ~/tmp/nix-config by
default; NIX_CONFIG_REPO_DIR and NIX_CONFIG_REPO_URL can override that.
The Darwin configuration disables Spotlight's Command-Space shortcut and sets Desktop & Dock > Click wallpaper to show desktop to "Only in Stage Manager." After the first switch, two macOS-protected settings still require one-time manual approval:
- Open Raycast Settings > General and record Command-Space as the Raycast
Hotkey. Raycast v2 stores settings in an encrypted database, so this cannot
be written safely with
defaults. - Open System Settings > Privacy & Security > Full Disk Access and add/enable Terminal, Ghostty, and Visual Studio Code. Apple requires explicit user approval on an unmanaged Mac; silent grants require an MDM-delivered PPPC profile.
ShinyMac 1.0.5 is installed on all Macs under /Applications/Nix Apps.
Its package clears quarantine attributes to suppress the first-launch Gatekeeper
warning. On first use, enable ShinyMac in System Settings > Privacy & Security >
Accessibility, then restart the app so it can lock the keyboard and trackpad.
Most commands are wrapped in the justfile.
LaunchBox Nightly 0.1.0 (build 20260925034106) is packaged for all Macs under
/Applications/Nix Apps. It requires Apple Silicon and macOS 26 or later.
The package preserves the signed upstream bundle. Use Nix to update it; Sparkle
cannot replace the read-only app in the Nix store. The default launcher shortcut
is Option-Space; complete optional permissions and setup inside the app.
To update, read https://friendlyventures.github.io/LaunchBox/nightly/latest.json,
then update the version, build-specific ZIP URL, and SHA-256 hash in
hosts/common/darwin-launchbox.nix. Obtain the hash with
nix store prefetch-file --json URL and compare it with the upstream .sha256
file. Upstream retains only three nightly downloads, so an old pin may stop
working on machines without a cached archive; refresh the pin when that happens.
just build # build the current host
just switch # switch the current host
just build HOST # build a specific host
just trace HOST # build with --show-trace
just update # update flake.lock
just gc # collect garbageMac-specific helpers:
just mas install # install configured Mac App Store apps
just mas get # acquire and install missing Mac App Store appsNixOS and remote helpers:
just remote ACTION HOST IP
just install IPflake.nix- flake inputs and host definitionshosts/common/- shared Darwin and NixOS moduleshosts/darwin/- per-Mac overrideshosts/nixos/- NixOS host configshome/- Home Manager config and dotfilesmodules/- reusable NixOS modulesscripts/- build, switch, install, CI, and Proxmox helpersdata/- static config data used by scripts and modulesdocs/- longer notes for specific workflows
The Proxmox template workflow has a dedicated note:
CI-friendly template stages are available through:
just ci template-refresh
just ci template-build-temp
just ci template-test-temp
just ci template-promote
just ci template-cleanup