Nix Configuration

Declarative, reproducible system configuration using Nix for macOS (nix-darwin) and NixOS. Includes cross-platform development environments for VA projects.

Architecture

This repository uses a dendritic (tree-like) modular architecture with flake-parts and import-tree. Configurations are organized by feature/capability rather than by host:

modules/
├── base/       # Core system: fonts, homebrew, nix-settings, zsh
├── dev/        # Development: cli-tools, editors, git
├── desktop/    # GUI: gnome, gaming, audio (NixOS)
├── services/   # Daemons/agents: Hermes, ollama, open-webui, monitoring, SMB, syncthing, iCloud backup
├── hosts/      # Host-specific: a6mbp, gnarbox, inix, mbp, studio (mbp/a6mbp/studio/inix darwin, gnarbox NixOS)
└── dev-envs/   # VA project environments

Each host imports and composes feature modules. See modules/README.md for detailed structure.

Hosts

mbp (personal macOS)

Personal MacBook Pro with syncthing, Tailscale, a Studio-backed Hermes client, and personal apps (gaming, messaging, document tools). Location: modules/hosts/mbp.nix

a6mbp (work macOS)

Work MacBook Pro with syncthing and work tools (AWS, Docker, DDEV, Slack, Zoom). Location: modules/hosts/a6mbp.nix

studio (media server macOS)

Media server Mac running the primary Hermes gateway and per-user Tailscale-only remote backends, plus ollama, open-webui, monitoring (Prometheus + Grafana), SMB mount, syncthing, and iCloud backup. Bryan's primary backend is available at https://bryans-mac-studio.tail5ba690.ts.net through Tailscale Serve. Traci's isolated headless backend runs under her macOS account and is available at https://bryans-mac-studio.tail5ba690.ts.net:9120 through Tailscale Serve. Location: modules/hosts/studio.nix

iNix (Intel macOS)

Garage and shop machine for reading manuals, project plans, and occasional remote work. Runs on a 2017 iMac Pro (Intel Xeon W) with macOS + nix-darwin. Includes syncthing, Tailscale, and Superwhisper dictation. Until the official Hermes DMG includes an Intel slice, inix provides a pinned local-build installer for the native Desktop app, which connects to Studio's remote backend over Tailscale. The browser dashboard remains available as a fallback. Location: modules/hosts/inix.nix

gnarbox (NixOS desktop)

NixOS desktop with GNOME, gaming (Steam + Proton GE), PipeWire audio, Tailscale, and a Studio-backed Hermes client. Uses the unstable overlay for select packages. Location: modules/hosts/gnarbox.nix

Shared Configuration

All darwin hosts share common packages via feature modules. All hosts (including NixOS) share Nix packages for CLI tools, editors, and fonts.

Feature modules own both platform aspects: darwin uses homebrew.brews/homebrew.casks, NixOS uses environment.systemPackages. This keeps each capability self-contained.

• CLI tools (both platforms): modules/dev/cli-tools.nix
• Git tools (both platforms): modules/dev/git.nix
• Editor tools (both platforms): modules/dev/editors.nix
• Homebrew infrastructure: modules/base/homebrew.nix (onActivation settings, taps, darwin-only items)
• Font: MesloLGS Nerd Font (see modules/base/fonts.nix)

Prerequisites

Apple Silicon Macs (mbp, a6mbp, studio): Install Determinate Nix Installer:

curl -fsSL https://install.determinate.systems/nix | sh -s -- install --determinate

Intel Mac (inix): Determinate Systems lists x86_64-darwin as unsupported. Use the official upstream Nix installer instead (multi-user is the default on macOS):

curl -L https://nixos.org/nix/install | sh

All macOS hosts also need Homebrew installed first. nix-darwin's homebrew module manages your Brewfile; it does not install Homebrew itself. If brew isn't already on the machine:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

NixOS: Nix comes pre-installed.

Installation

Clone the repository:

git clone https://git.snowboardtechie.com/bryan/nix-configs.git ~/code/nix-configs
cd ~/code/nix-configs

Build and activate:

macOS — Apple Silicon (mbp, a6mbp, studio):

First-time bootstrap of nix-darwin (Determinate has flakes enabled already):

sudo nix run nix-darwin/master#darwin-rebuild -- switch --flake '.#mbp'  # or '.#a6mbp', '.#studio'

Subsequent rebuilds:

darwin-rebuild switch --flake '.#mbp'

macOS — Intel (inix):

The upstream Nix installer doesn't enable flakes by default, and modules/base/nix-settings.nix keeps nix.enable = false on darwin (defers Nix config to Determinate, which inix doesn't have). Enable flakes system-wide in /etc/nix/nix.conf so both your user and sudo invocations see them:

echo "experimental-features = nix-command flakes" | sudo tee -a /etc/nix/nix.conf

Bootstrap nix-darwin (this is the step that creates the darwin-rebuild command):

cd ~/code/nix-configs
sudo nix run nix-darwin/master#darwin-rebuild -- switch --flake '.#inix'

Open a new shell, then subsequent rebuilds:

sudo darwin-rebuild switch --flake '.#inix'

NixOS (first build requires experimental features flag):

sudo nixos-rebuild switch --flake '.#gnarbox' --extra-experimental-features 'nix-command flakes'

Usage

Temporary Intel Hermes Desktop workaround

After rebuilding inix, run install-hermes-intel-desktop as the normal user. It builds the pinned, upstream-verified Hermes Desktop source under ~/Library/Caches/hermes-intel-desktop, validates its Intel-native binaries, ad-hoc signs it, and installs the user-managed app at ~/Applications/Hermes.app. In the app, use Settings → Gateway → Remote gateway to connect to Studio at https://bryans-mac-studio.tail5ba690.ts.net and sign in normally. The installer does not store the URL or credentials.

This is temporary until the official public Hermes-Setup.dmg contains an x86_64 slice. The tracked script-only watchdog in scripts/check-hermes-intel-release.py checks the upstream PR and official artifact daily. It is silent while pending and sends one Matrix notification only after both the PR and published installer pass their gates. It never installs or removes software.

Workaround rollback before an official release:

1. Quit Hermes on inix.
2. Move ~/Applications/Hermes.rollback.app back only if the new local build fails.
3. Keep Studio's dashboard and Tailscale configuration unchanged.
4. Do not delete the build cache until the rollback app has launched successfully.

Migration after the verified Matrix notification:

1. Download the exact installer URL named in the notification.
2. Install and launch the official app, reconnect it to Studio, run a real chat, then fully quit and relaunch to verify saved authentication.
3. Obtain Bryan's item-level approval before deleting the locally built app, rollback copy, build cache, installer script, or cron job.
4. List Hermes cron jobs and remove the live watchdog only by its actual runtime job ID.
5. Remove the tracked installer/watchdog files and the inix package declaration in a focused commit, rebuild inix, run nix flake check, and verify the official app still works.

Inkling-Small release watchdog

The tracked watchdog in scripts/check-inkling-small-release.py checks the official Thinking Machines Hugging Face namespace daily for a public, ungated Inkling-Small repository with actual weight files. It stays silent while the release is pending. Once weights appear, its Hermes cron job reviews the official model card, formats and sizes, Apple Silicon runtime support, quantized availability, licensing, and fit on Studio's M2 Ultra with 128 GB unified memory before sending one notification. The release remains pending until that review explicitly acknowledges it, so an interrupted review retries on the next daily run. The job never downloads weights, installs software, or changes the running Ollama/Open WebUI stack.

The recreatable job definition is scripts/inkling-small-release-watch.job.json. Runtime state is private under ~/.hermes/state/inkling-small-release-watch.json and is not committed.

Colibrì GLM-5.2 readiness watchdog

The Hermes watchdog checks grouped-quality Metal support, a complete compatible checkpoint, reproducible Ultra-class Mac Studio evidence, tool-calling stabilization, and blocking regressions before recommending a controlled GLM-5.2 proof of concept. The recreatable, read-only job definition is scripts/colibri-glm52-readiness-watch.job.json. Runtime notification state remains private under ~/.hermes/state/ and is not committed.

Apply Changes

macOS:

darwin-rebuild switch --flake '~/code/nix-configs#mbp'

NixOS:

sudo nixos-rebuild switch --flake '~/code/nix-configs#gnarbox'

Update Dependencies

nix flake update
# then rebuild using commands above

Development Environments

Cross-platform development environments for VA projects:

• vets-website: Node 22.22.0, Yarn 1.x, Cypress → vets-website
• vets-api: Ruby 3.3.6, PostgreSQL, Redis, Kafka → vets-api
• next-build: Node 24, Yarn 3.x, Playwright → next-build
• component-library: Node 22, Yarn 4.x, Puppeteer → component-library
• content-build: Node 14.15.0, Yarn 1.x, Cypress → content-build
• simpler-grants: Node 20, Python 3.11, pnpm (corepack) → simpler-grants-protocol (Poetry must be installed separately via brew install poetry or pipx install poetry)

Activate manually:

nix develop '~/code/nix-configs#vets-website'

Development environment definitions are located in modules/dev-envs/.

OpenCode

The OpenCode CLI is installed via Homebrew (opencode) on darwin systems and via nixpkgs on NixOS. The OpenCode desktop app (opencode-desktop cask) is installed on mbp and inix.

Authentication:

Authenticate your AI providers:

opencode auth login

Usage:

Start the CLI:

opencode

Documentation:

• OpenCode

Resources

• Nix Manual
• nix-darwin Documentation
• Nixpkgs Package Search
• flake-parts Documentation

3 gits, one repo

This repository syncs to multiple remotes. The primary repository is at git.snowboardtechie.com, with backups on Codeberg and GitHub.

License

This configuration is free to use and modify for your own purposes.