Nix Configuration

Declarative, reproducible system configuration using Nix for macOS (nix-darwin) and NixOS. Includes cross-platform development environments for VA projects.

Architecture

This repository uses a dendritic (tree-like) modular architecture with flake-parts and import-tree. Configurations are organized by feature/capability rather than by host:

modules/
├── base/       # Core system: fonts, homebrew, nix-settings, zsh
├── dev/        # Development: cli-tools, editors, git
├── desktop/    # GUI: gnome, gaming, audio (NixOS)
├── services/   # Daemons/agents: Hermes, Hindsight, ollama, open-webui, monitoring, SMB, syncthing, iCloud backup
├── hosts/      # Host-specific: a6mbp, gnarbox, inix, mbp, studio (mbp/a6mbp/studio/inix darwin, gnarbox NixOS)
└── dev-envs/   # VA project environments

Each host imports and composes feature modules. See modules/README.md for detailed structure.

Hosts

mbp (personal macOS)

Personal MacBook Pro with syncthing, Tailscale, a Studio-backed Hermes client, and personal apps (gaming, messaging, document tools). Location: modules/hosts/mbp.nix

a6mbp (work macOS)

Work MacBook Pro with syncthing and work tools (AWS, Docker, DDEV, Slack, Zoom). Location: modules/hosts/a6mbp.nix

studio (media server macOS)

Media server Mac running the primary Hermes gateway and per-user Tailscale-only remote backends, plus ollama, open-webui, monitoring (Prometheus + Grafana), SMB mount, syncthing, and iCloud backup. Bryan's primary backend is available at https://bryans-mac-studio.tail5ba690.ts.net through Tailscale Serve. Traci's isolated headless backend runs under her macOS account and is available at https://bryans-mac-studio.tail5ba690.ts.net:9120 through Tailscale Serve.

Studio also hosts the self-hosted Hindsight shared agent-memory service (bryan instance): dedicated PostgreSQL 17 + pgvector, a uv-locked API on loopback 8888, and an npm-locked Control Plane on IPv6 loopback 9999. The API is exposed tailnet-only at https://bryans-mac-studio.tail5ba690.ts.net:9443 (bearer-authenticated); the key-authenticated Control Plane is exposed at :9444 through an IPv4 loopback compatibility proxy on 9998 that preserves working locale rewrites behind Tailscale Serve. All extraction/consolidation runs through local Ollama. Six-hourly age-encrypted logical backups with tiered retention (48h/14d/4w + pre-upgrade) live under ~/.local/state/hindsight-bryan/backups/, with a monthly disposable restore test; hindsight-bryan-backup-now pre-upgrade takes the mandatory pre-upgrade snapshot. Versions are pinned by modules/services/hindsight-env/ lock files; scripts/check-hindsight-releases.py is the daily read-only Hermes release watch (register with hermes cron add, no-agent mode, workdir this repo). Secrets live in ~/.secrets/hindsight-bryan/ and never enter the store. Location: modules/hosts/studio.nix

iNix (Intel macOS)

Garage and shop machine for reading manuals, project plans, and occasional remote work. Runs on a 2017 iMac Pro (Intel Xeon W) with macOS + nix-darwin. Includes syncthing, Tailscale, and Superwhisper dictation. Until the official Hermes DMG includes an Intel slice, inix provides a pinned local-build installer for the native Desktop app, which connects to Studio's remote backend over Tailscale. The browser dashboard remains available as a fallback. Location: modules/hosts/inix.nix

gnarbox (NixOS desktop)

NixOS desktop with GNOME, gaming (Steam + Proton GE), PipeWire audio, Tailscale, and a Studio-backed Hermes client. Uses the unstable overlay for select packages. Location: modules/hosts/gnarbox.nix

Shared Configuration

All darwin hosts share common packages via feature modules. All hosts (including NixOS) share Nix packages for CLI tools, editors, and fonts.

Feature modules own both platform aspects: darwin uses homebrew.brews/homebrew.casks, NixOS uses environment.systemPackages. This keeps each capability self-contained.

• CLI tools (both platforms): modules/dev/cli-tools.nix
• Git tools (both platforms): modules/dev/git.nix
• Editor tools (both platforms): modules/dev/editors.nix
• Homebrew infrastructure: modules/base/homebrew.nix (onActivation settings, taps, darwin-only items)
• Font: MesloLGS Nerd Font (see modules/base/fonts.nix)

Prerequisites

Apple Silicon Macs (mbp, a6mbp, studio): Install Determinate Nix Installer:

curl -fsSL https://install.determinate.systems/nix | sh -s -- install --determinate

Intel Mac (inix): Determinate Systems lists x86_64-darwin as unsupported. Use the official upstream Nix installer instead (multi-user is the default on macOS):

curl -L https://nixos.org/nix/install | sh

All macOS hosts also need Homebrew installed first. nix-darwin's homebrew module manages your Brewfile; it does not install Homebrew itself. If brew isn't already on the machine:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

NixOS: Nix comes pre-installed.

Installation

Clone the repository:

git clone https://git.snowboardtechie.com/bryan/nix-configs.git ~/code/nix-configs
cd ~/code/nix-configs

Build and activate:

macOS — Apple Silicon (mbp, a6mbp, studio):

First-time bootstrap of nix-darwin (Determinate has flakes enabled already):

sudo nix run nix-darwin/master#darwin-rebuild -- switch --flake '.#mbp'  # or '.#a6mbp', '.#studio'

Subsequent rebuilds:

darwin-rebuild switch --flake '.#mbp'

macOS — Intel (inix):

The upstream Nix installer doesn't enable flakes by default, and modules/base/nix-settings.nix keeps nix.enable = false on darwin (defers Nix config to Determinate, which inix doesn't have). Enable flakes system-wide in /etc/nix/nix.conf so both your user and sudo invocations see them:

echo "experimental-features = nix-command flakes" | sudo tee -a /etc/nix/nix.conf

Bootstrap nix-darwin (this is the step that creates the darwin-rebuild command):

cd ~/code/nix-configs
sudo nix run nix-darwin/master#darwin-rebuild -- switch --flake '.#inix'

Open a new shell, then subsequent rebuilds:

sudo darwin-rebuild switch --flake '.#inix'

NixOS (first build requires experimental features flag):

sudo nixos-rebuild switch --flake '.#gnarbox' --extra-experimental-features 'nix-command flakes'

Usage

Temporary Intel Hermes Desktop workaround

After rebuilding inix, run install-hermes-intel-desktop as the normal user. It builds the pinned, upstream-verified Hermes Desktop source under ~/Library/Caches/hermes-intel-desktop, validates its Intel-native binaries, ad-hoc signs it, and installs the user-managed app at ~/Applications/Hermes.app. In the app, use Settings → Gateway → Remote gateway to connect to Studio at https://bryans-mac-studio.tail5ba690.ts.net and sign in normally. The installer does not store the URL or credentials.

This is temporary until the official public Hermes-Setup.dmg contains an x86_64 slice. The tracked script-only watchdog in scripts/check-hermes-intel-release.py checks the upstream PR and official artifact daily. It is silent while pending and sends one Matrix notification only after both the PR and published installer pass their gates. It never installs or removes software.

Workaround rollback before an official release:

1. Quit Hermes on inix.
2. Move ~/Applications/Hermes.rollback.app back only if the new local build fails.
3. Keep Studio's dashboard and Tailscale configuration unchanged.
4. Do not delete the build cache until the rollback app has launched successfully.

Migration after the verified Matrix notification:

1. Download the exact installer URL named in the notification.
2. Install and launch the official app, reconnect it to Studio, run a real chat, then fully quit and relaunch to verify saved authentication.
3. Obtain Bryan's item-level approval before deleting the locally built app, rollback copy, build cache, installer script, or cron job.
4. List Hermes cron jobs and remove the live watchdog only by its actual runtime job ID.
5. Remove the tracked installer/watchdog files and the inix package declaration in a focused commit, rebuild inix, run nix flake check, and verify the official app still works.

Inkling-Small release watchdog

The tracked watchdog in scripts/check-inkling-small-release.py checks the official Thinking Machines Hugging Face namespace daily for a public, ungated Inkling-Small repository with actual weight files. It stays silent while the release is pending. Once weights appear, its Hermes cron job reviews the official model card, formats and sizes, Apple Silicon runtime support, quantized availability, licensing, and fit on Studio's M2 Ultra with 128 GB unified memory before sending one notification. The release remains pending until that review explicitly acknowledges it, so an interrupted review retries on the next daily run. The job never downloads weights, installs software, or changes the running Ollama/Open WebUI stack.

The recreatable job definition is scripts/inkling-small-release-watch.job.json. Runtime state is private under ~/.hermes/state/inkling-small-release-watch.json and is not committed.

Colibrì GLM-5.2 readiness watchdog

The Hermes watchdog checks grouped-quality Metal support, a complete compatible checkpoint, reproducible Ultra-class Mac Studio evidence, tool-calling stabilization, and blocking regressions before recommending a controlled GLM-5.2 proof of concept. The recreatable, read-only job definition is scripts/colibri-glm52-readiness-watch.job.json. Runtime notification state remains private under ~/.hermes/state/ and is not committed.

GitHub incident recovery watchdog

The tracked monitor in scripts/check-github-status.py polls GitHub's official Statuspage summary every five minutes and emits a timestamp-free snapshot. Hermes suppresses unchanged ticks and uses the local gemma4:31b-mlx model only when the official status changes. This incident-specific finite watch stays silent for its initial baseline and source-health noise, notifies Bryan in Matrix when service meaningfully improves or worsens, and automatically stops after 36 checks (about three hours). The recreatable job definition is scripts/github-status-watch.job.json.

Hindsight release compatibility watchdog

The deterministic watchdog in scripts/check-hindsight-releases.py compares the committed Hindsight API, Control Plane, and coding-agent pins with their latest public releases. A newer coding-agent package is not treated as actionable until the latest released hindsight-api-slim wheel proves that UpdateNodeRequest accepts knowledge-page trigger patches and KnowledgeNode reports the effective trigger. This keeps the known coding-agents 0.4.1 versus API 0.9.1 incompatibility silent while still notifying Bryan when a server release changes or the coordinated update gates pass. The job is read-only and never changes locks, installs packages, restarts services, or updates clients.

The recreatable no-agent job definition is scripts/hindsight-release-watch.job.json. Runtime notification state remains private under ~/.hermes/state/hindsight-release-watch.json and is not committed.

Apply Changes

macOS:

darwin-rebuild switch --flake '~/code/nix-configs#mbp'

NixOS:

sudo nixos-rebuild switch --flake '~/code/nix-configs#gnarbox'

Update Dependencies

nix flake update
# then rebuild using commands above

Development Environments

Cross-platform development environments for VA projects:

• vets-website: Node 22.22.0, Yarn 1.x, Cypress → vets-website
• vets-api: Ruby 3.3.6, PostgreSQL, Redis, Kafka → vets-api
• next-build: Node 24, Yarn 3.x, Playwright → next-build
• component-library: Node 22, Yarn 4.x, Puppeteer → component-library
• content-build: Node 14.15.0, Yarn 1.x, Cypress → content-build
• simpler-grants: Node 20, Python 3.11, pnpm (corepack) → simpler-grants-protocol (Poetry must be installed separately via brew install poetry or pipx install poetry)

Activate manually:

nix develop '~/code/nix-configs#vets-website'

Development environment definitions are located in modules/dev-envs/.

OpenCode

The OpenCode CLI is installed via Homebrew (opencode) on darwin systems and via nixpkgs on NixOS. The OpenCode desktop app (opencode-desktop cask) is installed on mbp and inix.

Authentication:

Authenticate your AI providers:

opencode auth login

Usage:

Start the CLI:

opencode

Documentation:

• OpenCode

Resources

• Nix Manual
• nix-darwin Documentation
• Nixpkgs Package Search
• flake-parts Documentation

3 gits, one repo

This repository syncs to multiple remotes. The primary repository is at git.snowboardtechie.com, with backups on Codeberg and GitHub.

License

This configuration is free to use and modify for your own purposes.