369 lines
11 KiB
Nix
369 lines
11 KiB
Nix
{
|
|
description = "Example Darwin system flake";
|
|
|
|
inputs = {
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
|
|
flake-utils.url = "github:numtide/flake-utils";
|
|
nix-darwin.url = "github:LnL7/nix-darwin";
|
|
nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
|
|
agenix = {
|
|
url = "github:ryantm/agenix";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
railbird-secrets = {
|
|
url = "git+ssh://gitea@dev.railbird.ai:1123/railbird/secrets-flake.git";
|
|
};
|
|
nix-homebrew.url = "github:zhaofengli-wip/nix-homebrew";
|
|
brew-src = {
|
|
url = "github:Homebrew/brew/5.1.7";
|
|
flake = false;
|
|
};
|
|
|
|
# Optional: Declarative tap management
|
|
homebrew-core = {
|
|
url = "github:homebrew/homebrew-core";
|
|
flake = false;
|
|
};
|
|
homebrew-cask = {
|
|
url = "github:homebrew/homebrew-cask";
|
|
flake = false;
|
|
};
|
|
home-manager.url = "github:nix-community/home-manager";
|
|
home-manager.inputs.nixpkgs.follows = "nixpkgs";
|
|
|
|
git-sync-rs = {
|
|
url = "github:colonelpanic8/git-sync-rs";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
codex-cli-nix = {
|
|
# Default branch is `main` on GitHub (not `master`).
|
|
url = "github:sadjow/codex-cli-nix/main";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
claude-code-nix = {
|
|
url = "github:sadjow/claude-code-nix";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
keepbook = {
|
|
url = "github:colonelpanic8/keepbook";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
inputs.flake-utils.follows = "flake-utils";
|
|
};
|
|
|
|
git-blame-rank = {
|
|
url = "github:colonelpanic8/git-blame-rank";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
inputs.flake-utils.follows = "flake-utils";
|
|
};
|
|
};
|
|
|
|
outputs = inputs @ {
|
|
self,
|
|
agenix,
|
|
git-sync-rs,
|
|
nix-darwin,
|
|
nixpkgs,
|
|
home-manager,
|
|
nix-homebrew,
|
|
...
|
|
}: let
|
|
libDir = ../dotfiles/lib;
|
|
# Keep this on the currently-existing macOS account until the target user
|
|
# exists locally and its home directory has been migrated.
|
|
activePrimaryUser = "kat";
|
|
targetPrimaryUser = "imalison";
|
|
primaryUser = activePrimaryUser;
|
|
personalUsers = [
|
|
activePrimaryUser
|
|
targetPrimaryUser
|
|
];
|
|
# Home Manager activation should only target accounts that exist today.
|
|
# Add targetPrimaryUser here when the macOS account is ready.
|
|
enabledHomeUsers = [
|
|
activePrimaryUser
|
|
];
|
|
sharedHomeModules = [./home/common.nix];
|
|
ivanHomeModules = [./home/ivan.nix];
|
|
homeForUser = user: "/Users/${user}";
|
|
configuration = {
|
|
pkgs,
|
|
lib,
|
|
config,
|
|
...
|
|
}: let
|
|
essentialPkgs = (import ../nix-shared/system/essential.nix {inherit pkgs lib inputs;}).environment.systemPackages;
|
|
disabledAppleSymbolicHotKey = parameters: {
|
|
enabled = false;
|
|
value = {
|
|
inherit parameters;
|
|
type = "standard";
|
|
};
|
|
};
|
|
in {
|
|
networking.hostName = "mac-demarco-mini";
|
|
imports = [
|
|
(import ./gitea-actions-runner.nix)
|
|
];
|
|
age = {
|
|
identityPaths = [
|
|
"${config.users.users.${primaryUser}.home}/.ssh/id_ed25519"
|
|
"/etc/ssh/ssh_host_ed25519_key"
|
|
"/etc/ssh/ssh_host_rsa_key"
|
|
];
|
|
secrets.gitea-runner-token.file = ../nixos/secrets/gitea-runner-token.mac-demarco-mini.age;
|
|
};
|
|
services.gitea-actions-runner = {
|
|
user = "gitea-runner";
|
|
instances.nix = {
|
|
enable = true;
|
|
name = config.networking.hostName;
|
|
url = "https://dev.railbird.ai";
|
|
tokenFile = config.age.secrets.gitea-runner-token.path;
|
|
labels = [
|
|
"nix-darwin-${pkgs.stdenv.hostPlatform.system}:host"
|
|
"macos-aarch64-darwin"
|
|
"nix:host"
|
|
];
|
|
settings = {
|
|
cache = {
|
|
enabled = true;
|
|
};
|
|
host = {
|
|
workdir_parent = "/var/lib/gitea-runner/action-cache-dir";
|
|
};
|
|
};
|
|
hostPackages = with pkgs; [
|
|
bash
|
|
coreutils
|
|
curl
|
|
direnv
|
|
gawk
|
|
just
|
|
git-lfs
|
|
isort
|
|
git
|
|
gnused
|
|
ncdu
|
|
nixVersions.stable
|
|
nodejs
|
|
openssh
|
|
wget
|
|
];
|
|
};
|
|
};
|
|
|
|
launchd.daemons.gitea-runner-nix.serviceConfig.EnvironmentVariables = {
|
|
XDG_CONFIG_HOME = "/var/lib/gitea-runner";
|
|
XDG_CACHE_HOME = "/var/lib/gitea-runner/.cache";
|
|
XDG_RUNTIME_DIR = "/var/lib/gitea-runner/tmp";
|
|
};
|
|
|
|
system.primaryUser = primaryUser;
|
|
|
|
security.sudo.extraConfig = ''
|
|
${primaryUser} ALL=(ALL) NOPASSWD: ALL
|
|
'';
|
|
|
|
system.defaults.NSGlobalDomain."com.apple.swipescrolldirection" = false;
|
|
system.defaults.CustomUserPreferences."com.apple.screensaver".idleTime = 300;
|
|
system.defaults.CustomUserPreferences."com.apple.symbolichotkeys".AppleSymbolicHotKeys = {
|
|
# Disable input source shortcuts that conflict with launcher usage.
|
|
"60" = disabledAppleSymbolicHotKey [32 49 262144];
|
|
"61" = disabledAppleSymbolicHotKey [32 49 786432];
|
|
# Disable Spotlight's Command-Space and Finder search window shortcuts.
|
|
"64" = disabledAppleSymbolicHotKey [32 49 1048576];
|
|
"65" = disabledAppleSymbolicHotKey [32 49 1572864];
|
|
};
|
|
system.defaults.screensaver.askForPassword = false;
|
|
system.defaults.screensaver.askForPasswordDelay = 0;
|
|
|
|
system.activationScripts.postActivation.text = ''
|
|
echo >&2 "current-host screensaver defaults..."
|
|
launchctl asuser "$(id -u -- ${primaryUser})" sudo --user=${primaryUser} -- defaults -currentHost write com.apple.screensaver askForPassword -bool false
|
|
launchctl asuser "$(id -u -- ${primaryUser})" sudo --user=${primaryUser} -- defaults -currentHost write com.apple.screensaver askForPasswordDelay -int 0
|
|
'';
|
|
|
|
power.sleep = {
|
|
computer = "never";
|
|
display = "never";
|
|
harddisk = "never";
|
|
};
|
|
|
|
# launchd.daemons.gitea-runner-restarter = {
|
|
# serviceConfig = {
|
|
# ProgramArguments = [
|
|
# "/usr/bin/env"
|
|
# "bash"
|
|
# "-c"
|
|
# ''
|
|
# SERVICE_NAME="org.nixos.gitea-runner-nix"
|
|
# while true; do
|
|
# # Check the second column of launchctl list output for our service
|
|
# EXIT_CODE=$(sudo launchctl list | grep "$SERVICE_NAME" | awk '{print $2}')
|
|
# if [ -z "$EXIT_CODE" ]; then
|
|
# echo "$(date): $SERVICE_NAME is running correctly. Terminating the restarter."
|
|
# exit 0
|
|
# else
|
|
# echo "$(date): $SERVICE_NAME is not running or in error state. Attempting to restart..."
|
|
# sudo launchctl bootout system/$SERVICE_NAME 2>/dev/null || true
|
|
# sudo launchctl load /Library/LaunchDaemons/$SERVICE_NAME.plist
|
|
# sleep 2 # Give the service some time to start
|
|
# fi
|
|
# done
|
|
# ''
|
|
# ];
|
|
# RunAtLoad = true;
|
|
# ThrottleInterval = 300;
|
|
# };
|
|
# };
|
|
|
|
launchd.daemons.does-anything-work = {
|
|
serviceConfig = {
|
|
ProgramArguments = ["/usr/bin/env" "bash" "-c" "date > /var/log/does-anything-work"];
|
|
RunAtLoad = true;
|
|
};
|
|
};
|
|
|
|
nixpkgs.overlays = [
|
|
(import ../nix-shared/overlays)
|
|
# Use codex and claude-code from dedicated flakes with cachix
|
|
(final: prev: {
|
|
codex = inputs.codex-cli-nix.packages.${prev.stdenv.hostPlatform.system}.default;
|
|
claude-code = inputs.claude-code-nix.packages.${prev.stdenv.hostPlatform.system}.default;
|
|
git-sync-rs = git-sync-rs.packages.${prev.stdenv.hostPlatform.system}.default;
|
|
})
|
|
];
|
|
environment.systemPackages =
|
|
essentialPkgs
|
|
++ [
|
|
pkgs.gnupg
|
|
pkgs.spotify
|
|
];
|
|
|
|
nixpkgs.config.allowUnfree = true;
|
|
|
|
# Install GUI-visible fonts into /Library/Fonts/Nix Fonts.
|
|
fonts.packages = with pkgs; [
|
|
nerd-fonts.jetbrains-mono
|
|
];
|
|
|
|
# Homebrew casks (managed by nix-darwin, installed by nix-homebrew)
|
|
homebrew = {
|
|
enable = true;
|
|
taps = builtins.attrNames config.nix-homebrew.taps;
|
|
brews = [
|
|
"ddcctl"
|
|
"m1ddc"
|
|
];
|
|
casks = [
|
|
"codex-app"
|
|
"ghostty"
|
|
"hammerspoon"
|
|
"raycast"
|
|
"vlc"
|
|
];
|
|
masApps = {
|
|
Xcode = 497799835;
|
|
};
|
|
onActivation.cleanup = "zap";
|
|
};
|
|
|
|
# Auto upgrade nix package and the daemon service.
|
|
launchd.user.envVariables.PATH = config.environment.systemPath;
|
|
launchd.user.agents.hammerspoon.serviceConfig = {
|
|
ProgramArguments = ["/usr/bin/open" "-gja" "Hammerspoon"];
|
|
RunAtLoad = true;
|
|
};
|
|
|
|
programs.direnv.enable = true;
|
|
|
|
# Necessary for using flakes on this system.
|
|
nix.settings = {
|
|
experimental-features = "nix-command flakes";
|
|
substituters = [
|
|
"https://cache.nixos.org"
|
|
"https://codex-cli.cachix.org"
|
|
"https://claude-code.cachix.org"
|
|
];
|
|
trusted-public-keys = [
|
|
"codex-cli.cachix.org-1:1Br3H1hHoRYG22n//cGKJOk3cQXgYobUel6O8DgSing="
|
|
"claude-code.cachix.org-1:YeXf2aNu7UTX8Vwrze0za1WEDS+4DuI2kVeWEE4fsRk="
|
|
];
|
|
};
|
|
|
|
# Set Git commit hash for darwin-version.
|
|
system.configurationRevision = self.rev or self.dirtyRev or null;
|
|
|
|
# Used for backwards compatibility, please read the changelog before changing
|
|
system.stateVersion = 4;
|
|
|
|
# The platform the configuration will be used on.
|
|
|
|
nixpkgs.hostPlatform = "aarch64-darwin";
|
|
users.users =
|
|
lib.genAttrs personalUsers (user: {
|
|
name = user;
|
|
home = homeForUser user;
|
|
openssh.authorizedKeys.keys = inputs.railbird-secrets.keys.kanivanKeys;
|
|
})
|
|
// {
|
|
gitea-runner = {
|
|
name = "gitea-runner";
|
|
isHidden = false;
|
|
home = "/Users/gitea-runner";
|
|
createHome = false;
|
|
};
|
|
};
|
|
|
|
programs.zsh = {
|
|
enable = true;
|
|
enableSyntaxHighlighting = true;
|
|
};
|
|
home-manager = {
|
|
useGlobalPkgs = true;
|
|
useUserPackages = true;
|
|
backupFileExtension = "hm-backup";
|
|
extraSpecialArgs = {
|
|
inherit inputs libDir;
|
|
};
|
|
sharedModules = sharedHomeModules;
|
|
users = lib.genAttrs enabledHomeUsers (_: {
|
|
imports = ivanHomeModules;
|
|
});
|
|
};
|
|
};
|
|
in {
|
|
darwinConfigurations."mac-demarco-mini" = nix-darwin.lib.darwinSystem {
|
|
modules = [
|
|
agenix.darwinModules.default
|
|
home-manager.darwinModules.home-manager
|
|
nix-homebrew.darwinModules.nix-homebrew
|
|
{
|
|
nix-homebrew = {
|
|
enable = true;
|
|
user = primaryUser;
|
|
autoMigrate = true;
|
|
package =
|
|
inputs.brew-src
|
|
// {
|
|
name = "brew-5.1.7";
|
|
version = "5.1.7";
|
|
};
|
|
taps = {
|
|
"homebrew/homebrew-core" = inputs.homebrew-core;
|
|
"homebrew/homebrew-cask" = inputs.homebrew-cask;
|
|
};
|
|
};
|
|
}
|
|
configuration
|
|
];
|
|
};
|
|
|
|
# Expose the package set, including overlays, for convenience.
|
|
darwinPackages = self.darwinConfigurations."mac-demarco-mini".pkgs;
|
|
};
|
|
}
|