Nix
darwin flake.
rig/brew/Brewfile is the package SSOT. rig/darwin/modules/packages.nix is a tiny nix-darwin bootstrap CLI set (bash, curl, git, jq, ripgrep). Overlap with those Brewfile formulae is OK.
| Path | Role |
|---|---|
rig/darwin/flake.nix + flake.lock | Flake; lock required for --apply |
rig/darwin/hosts/ | Host values |
rig/darwin/modules/packages.nix | Bootstrap CLI only |
rig/darwin/modules/macos-defaults.nix | macOS defaults |
Modules on disk are those two files plus the host import. Do not expect separate shell / services / user module splits.
flake.lock inputs may be type: tarball (archive URL) instead of a github locked.owner / repo / rev. macos.sh recovers the nix-darwin pin from github lock fields or original.owner / repo plus the SHA in locked.url (…/archive/<rev>.tar.gz), then nix run github:…#darwin-rebuild when darwin-rebuild is not on PATH. Gate: just check-darwin-lock.
Host w4w-mbp sets primaryUser, nix.enable = false (Determinate owns nix.conf), Touch ID sudo, and hostname.
macos-defaults manages keyboard repeat and press-and-hold, smart quote/dash/autocorrect behavior, Dock recents/space ordering, tap-to-click and three-finger drag, plus Finder list/search/path/status preferences. It does not manage guest-login or WindowManager/Stage Manager/desktop-click keys.
CustomUserPreferences."com.colliderli.iina" pins IINA scalars by name only: currentInputConfigName, horizontalScrollAction, verticalScrollAction, playbackSpeedScrollAmount, screenshot save/copy/subs/preview/format, useMediaKeys, enableAdvancedSettings. Values stay in the nix module. See IINA.
nix flake lock ./rig/darwin
just darwin-check
just check-darwin-lock
just bootstrap --dry-run