[Backport release-26.05] users: realpath home dirs before comparison (#1824 )

users: realpath home dirs before comparison
When we create users with homedir under /var, they end up with NFSHomeDirectory under /private/var because /var is a symlink. This breaks consequent activations and requires that user overrides their home dir attribute with /private/var/... to pass the activation precheck. `realpath` should normalize the discrepancy. (cherry picked from commit 08278afff6)
2026-07-10 21:38:14 -07:00 · 2026-07-10 21:42:49 -04:00 · 2026-06-18 01:41:05 -07:00 · 2026-06-17 23:53:59 -07:00 · 2026-06-17 23:53:59 -07:00 · 2026-06-11 08:01:01 -07:00
274 changed files with 20585 additions and 2747 deletions
@@ -0,0 +1,2 @@
+# nixpkgs: format with `nixfmt`
+dc1c716ded39758062ed7e6bc410ad274119de9f
@@ -0,0 +1 @@
+github: [emilazy, Enzime]
@@ -0,0 +1,135 @@
+name: "Test"
+on:
+  pull_request:
+  merge_group:
+  push:
+    branches:
+      - nix-darwin-26.05
+
+env:
+  NIXPKGS_BRANCH: nixpkgs-26.05-darwin
+  NIX_VERSION: 2.24.11
+
+jobs:
+  # The `test-stable` and `install-against-stable` job names are
+  # load‐bearing, despite their inaccuracy on the unstable branch, as
+  # they are set as required checks in the repository configuration,
+  # which only repository admins can change.
+  #
+  # TODO: Change them once the repository configuration is updated.
+
+  test-stable:
+    runs-on: macos-14
+    steps:
+    - uses: actions/checkout@v4
+    - name: Install Nix
+      uses: cachix/install-nix-action@v30
+      with:
+        install_url: https://releases.nixos.org/nix/nix-${{ env.NIX_VERSION }}/install
+    - run: nix flake check --override-input nixpkgs nixpkgs/${{ env.NIXPKGS_BRANCH }}
+
+  install-against-stable:
+    runs-on: macos-14
+    timeout-minutes: 30
+    steps:
+    - uses: actions/checkout@v4
+    - name: Install Nix
+      uses: cachix/install-nix-action@v30
+      with:
+        install_url: https://releases.nixos.org/nix/nix-${{ env.NIX_VERSION }}/install
+        nix_path: nixpkgs=channel:${{ env.NIXPKGS_BRANCH }}
+    - name: Install channels
+      run: |
+        sudo nix-channel --add https://nixos.org/channels/${{ env.NIXPKGS_BRANCH }} nixpkgs
+        sudo nix-channel --update
+    - name: Install nix-darwin
+      run: |
+        sudo mkdir -p /etc/nix-darwin
+        sudo cp modules/examples/simple.nix /etc/nix-darwin/configuration.nix
+
+        nixConfHash=$(shasum -a 256 /etc/nix/nix.conf | cut -d ' ' -f 1)
+        sudo /usr/bin/sed -i.bak \
+          "s/# programs.fish.enable = true;/ \
+            imports = [ \
+              ({ options, ... }: { \
+                nix.settings.access-tokens = [ \"github.com=\${{ secrets.GITHUB_TOKEN }}\" ]; \
+                environment.etc.\"nix\/nix.conf\".knownSha256Hashes = [ \"$nixConfHash\" ]; \
+                nix.nixPath = \
+                  [ { darwin = \"${PWD////\/}\"; } ] \
+                  ++ options.nix.nixPath.default; \
+              }) \
+            ]; \
+          /" \
+          /etc/nix-darwin/configuration.nix
+
+        sudo nix run .#darwin-rebuild -- switch \
+          -I darwin=. \
+          -I darwin-config=/etc/nix-darwin/configuration.nix
+    - name: Switch to new configuration
+      run: |
+        . /etc/bashrc
+
+        sudo /usr/bin/sed -i.bak \
+          "s/pkgs.vim/pkgs.hello/" \
+          /etc/nix-darwin/configuration.nix
+
+        sudo darwin-rebuild switch
+
+        hello
+    - name: Test uninstallation of nix-darwin
+      run: |
+        # We need to specify `--extra-experimental-features` because `experimental-features` is set by
+        # `cachix/install-nix-action` but not by our default config above
+        sudo nix run .#darwin-uninstaller \
+          --extra-experimental-features "nix-command flakes" \
+          --override-input nixpkgs nixpkgs/${{ env.NIXPKGS_BRANCH }}
+        sudo nix run .#darwin-uninstaller.tests.uninstaller \
+          --extra-experimental-features "nix-command flakes" \
+          --override-input nixpkgs nixpkgs/${{ env.NIXPKGS_BRANCH }}
+
+  install-flake:
+    runs-on: macos-14
+    timeout-minutes: 30
+    steps:
+    - uses: actions/checkout@v4
+    - name: Install Nix
+      uses: cachix/install-nix-action@v30
+      with:
+        install_url: https://releases.nixos.org/nix/nix-${{ env.NIX_VERSION }}/install
+    - name: Install nix-darwin
+      run: |
+        sudo mkdir -p /etc/nix-darwin
+        darwin=$(pwd)
+        pushd /etc/nix-darwin
+          sudo nix flake init -t $darwin
+          nixConfHash=$(shasum -a 256 /etc/nix/nix.conf | cut -d ' ' -f 1)
+          sudo /usr/bin/sed -i.bak \
+            "s/# programs.fish.enable = true;/nix.settings.access-tokens = [ \"github.com=\${{ secrets.GITHUB_TOKEN }}\" ]; environment.etc.\"nix\/nix.conf\".knownSha256Hashes = [ \"$nixConfHash\" ];/" \
+            flake.nix
+          sudo /usr/bin/sed -i.bak \
+            's/darwinConfigurations."simple"/darwinConfigurations."'$(scutil --get LocalHostName)'"/g' \
+            flake.nix
+          sudo /usr/bin/sed -i.bak \
+            's/nixpkgs.hostPlatform = "aarch64-darwin";/nixpkgs.hostPlatform = "'$(nix eval --expr builtins.currentSystem --impure --raw)'";/' \
+            flake.nix
+        popd
+        sudo nix run .#darwin-rebuild -- switch \
+          --override-input nix-darwin . \
+          --override-input nixpkgs nixpkgs/${{ env.NIXPKGS_BRANCH }}
+    - name: Switch to new configuration
+      run: |
+        . /etc/bashrc
+
+        sudo /usr/bin/sed -i.bak \
+          "s/pkgs.vim/pkgs.hello/" \
+          /etc/nix-darwin/flake.nix
+
+        sudo darwin-rebuild switch \
+          --override-input nix-darwin . \
+          --override-input nixpkgs nixpkgs/${{ env.NIXPKGS_BRANCH }}
+
+        hello
+    - name: Test uninstallation of nix-darwin
+      run: |
+        sudo nix run .#darwin-uninstaller --override-input nixpkgs nixpkgs/${{ env.NIXPKGS_BRANCH }}
+        sudo nix run .#darwin-uninstaller.tests.uninstaller --override-input nixpkgs nixpkgs/${{ env.NIXPKGS_BRANCH }}
@@ -0,0 +1,45 @@
+name: Update website
+
+on:
+  push:
+    branches:
+      - master
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build
+    runs-on: macos-14
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
+      - name: Install Nix
+        uses: cachix/install-nix-action@02a151ada4993995686f9ed4f1be7cfbb229e56f
+      - name: Build website
+        run: nix build .#website -o _site
+      - name: Upload website
+        id: deployment
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa
+
+  # See: <https://github.com/actions/deploy-pages?tab=readme-ov-file#usage>
+  deploy:
+    name: Deploy
+    needs: build
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e
@@ -0,0 +1,3 @@
+.DS_Store
+*.swp
+result*
@@ -1,19 +0,0 @@
-language: nix
-matrix:
-  include:
-    - os: osx
-      osx_image: xcode8.2
-      script:
-      - nix-build ./release.nix -A examples.simple
-      - nix-build ./release.nix -A tests.system-packages
-      - nix-build ./release.nix -A tests.system-path-bash
-      - nix-build ./release.nix -A tests.system-path-fish
-      - nix-build ./release.nix -A tests.system-path-zsh
-    - os: osx
-      osx_image: xcode7.3
-      script:
-      - nix-build ./release.nix -A examples.simple
-      - nix-build ./release.nix -A tests.system-packages
-      - nix-build ./release.nix -A tests.system-path-bash
-      - nix-build ./release.nix -A tests.system-path-fish
-      - nix-build ./release.nix -A tests.system-path-zsh
@@ -0,0 +1,289 @@
+2026-05-16
+- The reversed split-window key bindings previously generated by
+  `programs.tmux.enableSensible` are no longer emitted when
+  `system.stateVersion` is 7 or later, so tmux uses its conventional
+  behavior: `%` splits the current pane horizontally and `"` splits it
+  vertically.
+
+  Existing configurations with `system.stateVersion` 6 or earlier keep
+  the previous reversed bindings. You can explicitly choose either
+  behavior with `programs.tmux.reverseSplitBindings`.
+
+2026-02-10
+- Major changes to `homebrew` module
+
+  `homebrew.brewPrefix` was renamed to `homebrew.prefix`, and its semantics
+  changed: the old option pointed to the bin directory (e.g.,
+  `/opt/homebrew/bin`), while the new option points to the Homebrew prefix
+  (e.g., `/opt/homebrew`), matching `brew --prefix`.
+
+  `homebrew.whalebrews` was removed. Whalebrew support was removed from
+  Homebrew Bundle in Homebrew 4.7.0 (Nov 2025), so `whalebrew` entries in a
+  Brewfile now cause `brew bundle` to fail.
+
+  `homebrew.global.lockfiles` and `homebrew.global.noLock` no longer have any
+  effect. Homebrew Bundle removed lockfile support in Homebrew 4.4.0 (Oct 2024).
+
+  `homebrew.onActivation.cleanup` now supports a `"check"` mode, which checks
+  for unlisted packages and aborts activation if any are found, without
+  removing them.
+
+  Shell integration options were added: `homebrew.enableBashIntegration`,
+  `homebrew.enableFishIntegration`, and `homebrew.enableZshIntegration`.
+
+  New Brewfile entry types were added: `homebrew.goPackages`,
+  `homebrew.cargoPackages`, and `homebrew.vscode`.
+
+  New options were added for brews: `postinstall`, `link = "overwrite"`, and
+  `restart_service = "always"`. The `postinstall` option was also added for
+  casks.
+
+2025-01-30
+- Previously, some nix-darwin options applied to the user running
+  `darwin-rebuild`. As part of a long‐term migration to make
+  nix-darwin focus on system‐wide activation and support first‐class
+  multi‐user setups, all system activation now runs as `root`, and
+  these options instead apply to the `system.primaryUser` user.
+
+  You will get an evaluation error if you are using any options to
+  which this applies.
+
+  To continue using these options, set `system.primaryUser` to the name
+  of the user you have been using to run `darwin-rebuild`. In the long
+  run, this setting will be deprecated and removed after all the
+  functionality it is relevant for has been adjusted to allow
+  specifying the relevant user separately, moved under the
+  `users.users.*` namespace, or migrated to Home Manager.
+
+  Accordingly, `darwin-rebuild` must now be run as root, the
+  `system.activationScripts.{extraUserActivation,preUserActivation,
+  postUserActivation}` settings have been removed, and all activation
+  scripts are now executed as `root` – be careful if you override any
+  of them.
+
+  If you run into any unexpected issues with the migration, please
+  open an issue at <https://github.com/nix-darwin/nix-darwin/issues/new>
+  and include as much information as possible.
+
+2025-01-29
+- There is now a `nix.enable` toggle to disable management of the Nix
+  installation. Nix installation management has been made more
+  opinionated as a consequence; nix-darwin now only supports managing a
+  multi‐user daemon installation of Nix, and unconditionally takes
+  ownership of the nix-daemon launchd daemon and the `_nixbld*` build
+  users when Nix installation management is enabled.
+
+  If the new constraints do not work with your setup, you can disable
+  the `nix.enable` option to opt out of Nix installation management
+  entirely; see the option documentation for caveats.
+
+2025-01-18
+- The default configuration path for all new installations
+  is `/etc/nix-darwin`. This was already the undocumented
+  default for `darwin-rebuild switch` when using flakes. This
+  is implemented by setting `environment.darwinConfig` to
+  `"/etc/nix-darwin/configuration.nix"` by default when
+  `system.stateVersion` ≥ 6.
+
+2024-09-10
+- The default Nix build user group ID is now set to 350 when
+  `system.stateVersion` ≥ 5, to reflect the default for new Nix
+  installations. This only affects installations that enable
+  `nix.configureBuildUsers`, and any divergence will be detected on
+  system activation. To use `nix.configureBuildUsers` with a higher
+  `system.stateVersion` on installations using the old group ID, set:
+
+      ids.gids.nixbld = 30000;
+
+  We do not recommend trying to change the group ID with macOS user
+  management tools without a complete uninstallation and reinstallation
+  of Nix.
+
+2024-06-15
+- SECURITY NOTICE: The previous implementation of the
+  `users.users.<name>.openssh.authorizedKeys.*` options would not delete
+  authorized keys files when the setting for a given user was removed.
+
+  This means that if you previously stopped managing a user's authorized
+  SSH keys with nix-darwin, or intended to revoke their access by
+  removing the option, the previous set of keys could still be used to
+  log in as that user.
+
+  You can check the /etc/ssh/authorized_keys.d directory to see which
+  keys were permitted; afterwards, please remove the directory and
+  re-run activation. The options continue to be supported and will now
+  correctly permit only the keys in your current system configuration.
+
+2022-08-24
+- Major changes to `homebrew` module
+  `homebrew.cleanup` was renamed to `homebrew.onActivation.cleanup`.
+
+  `homebrew.autoUpdate` was renamed to `homebrew.onActivation.autoUpdate`.
+
+  `homebrew.onActivation.upgrade` was added, and the default behavior of the
+  module was changed to not upgrade installed formulae and apps.
+
+  `homebrew.global.autoUpdate` was added.
+
+  `homebrew.global.noLock` was replaced with `hombrew.global.lockfiles`.
+
+  `homebrew.caskArgs` submodule was added for configuring arguments to be used
+  for all casks.
+
+  `homebrew.{taps,brews,casks}` were reimplemented as lists of submodules,
+  instead of lists of strings, with well documented options for all available
+  arguments for these Brewfile entry types, while preserving backwards
+  compatibility with the previous implementation.
+
+2022-08-14
+- nix module updated to bring it back in sync with it's NixOS counterpart
+  It should now be much more fiesable to share code for this module between
+  `nix-darwin` and NixOS configs.
+
+  `nix-darwin` now requires Nix >= 2.2.
+
+  `nix.package` can no longer be a path to a profile.
+
+  `nix.version` option has been removed. Use `nix.package.version` if you want
+  to reference the version Nix installed/used by your config.
+
+  Many options moved/renamed from `nix.*` to `nix.settings.*`. For example
+  `nix.binaryCaches` is now `nix.settings.substituters`.
+
+  You can use `nix.settings` to set any option in `nix.conf`.
+
+  `users.nix.*` options moved to `nix.*`.
+
+  `nix.daemonIONice` was renamed to `nix.daemonIOLowPriority`, and
+  `nix.daemonNiceLevel` was removed in favor a new option
+  `nix.nix.daemonProcessType`.
+
+2021-01-16
+- Added `homebrew` module, to manage formulas installed by Homebrew via `brew bundle`.
+
+2020-10-25
+- The option environment.variables.SHELL is no longer set automatically when,
+  eg. programs.zsh.enable is configured.
+
+2020-09-12
+- Options using the deprecated loaOf where removed, see https://github.com/NixOS/nixpkgs/pull/96042
+
+    The following options no longer accept lists:
+    environment.etc, environment.launchAgents.*, environment.launchDaemons.*,
+    users.users, programs.ssh.knownHosts
+
+2019-05-04
+- A configuration.nix manpage is now included by default, run
+  `man 5 configuration.nix` or `darwin-help`. The documentation option can be
+  disabled to exclude the manual and it's extra build dependencies.
+
+    documentation.enable = false;
+
+2019-05-01
+- nix.nixPath entries are now merged by default
+  system.stateVersion > 3
+
+    For the original behaviour, override the option using a higher priority.
+
+    nix.nixPath = lib.mkForce [ "darwin-config=/configuration.nix" ... ];
+
+  This option also supports specifying named NIX_PATH entries using an
+  attribute set now.
+
+    nix.nixPath = [{ darwin = "/src/darwin"; }];
+
+2019-02-23
+- The users module now supports declarative per-user packages similar to nixos.
+  eg.
+
+    users.users.<name>.packages = [ pkgs.hello ];
+
+2019-01-02
+- The NIX_PATH validation can be disabled now, this is particularly useful if
+  the darwin configuration is deployed from another machine in which case it
+  often doesn't matter that darwin-rebuild won't work on the host itself.
+
+    system.checks.verifyNixPath = false;
+
+2018-03-29
+- default nix.package no longer uses the default profile.
+  system.stateVersion > 2
+
+    For the original behaviour configure nix.package
+
+    nix.package = "/nix/var/nix/profiles/default";
+
+2018-03-06
+- added ssh.knownHosts, to manage global known_hosts.
+
+2018-01-16
+- fixed issue for single-user installs, be careful when rolling back to a
+  revision after 9792b08fdf049524742143f4f788e3eb61a769fda.
+
+    If you run into trouble try NIX_REMOTE= darwin-rebuild switch.
+
+2018-01-13
+- added users.users and users.groups to manage user accounts.
+  Changes will not be applied to existing users or groups.
+
+2018-01-08
+- added networking.networkservices, to manage dns servers and searchdomains.
+  This will clear existing values when enabled.
+
+2018-01-06
+- added nixpkgs.overlays, there is a chapter on overlays in the nixpkgs manual
+  https://nixos.org/nixpkgs/manual/#chap-overlays with more information.
+
+2018-01-04
+- the nix.useDaemon/services.nix-daemon.enable options now automatically
+  reload the daemon for you when nix.conf changes.
+
+2017-11-29
+- the security.enableAccessibilityAccess option was removed since it
+  no longer works on macOS 10.12 and later.
+
+2017-11-06
+- the programs.fish module was rewritten based on improvements from
+  NixOS. This might have some incompatible changes compared to the
+  previous implementation.
+
+2017-10-06
+- loeOf was removed from nixpkgs in 10881bbe11b2f66ebfa880795e5bc01a04158da4
+
+    Using single items instead of a list no longer works for
+    environment.systemPath and launchd.<serviceType>.<name>.path
+
+2017-10-01
+- added system.stateVersion option, add this to your configuration to
+  avoid breaking changes.  This changelog and the activation checks
+  will show instructions on what to do to safely increment this value.
+
+2017-07-06
+- added user channels to the default nix.nixPath
+
+    Using a user channel now works without any custom configuration.
+    See https://github.com/NixOS/nix/issues/1548 if you are running into
+    issues when updating your channel.
+
+2017-07-28
+- added support for command-not-found, using nix-index
+
+    programs.nix-index.enable = true;
+
+2017-07-23
+- darwin entry in the default nix.nixPath was removed for
+  system.stateVersion > 1
+
+    Use a channel for nix-darwin or configure nix.nixPath
+
+    sudo nix-channel --add https://github.com/nix-darwin/nix-darwin/archive/master.tar.gz darwin
+    sudo nix-channel --update
+
+    nix.nixPath =
+      [ "darwin=$HOME/.nix-defexpr/darwin"
+        "darwin-config=$HOME/.nixpkgs/darwin-configuration.nix"
+        "/nix/var/nix/profiles/per-user/root/channels"
+      ];
+
+2017-01-09
+- nix.profile was renamed to nix.package
@@ -0,0 +1,7 @@
+Copyright 2017 <Daiderd Jordan>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
@@ -1,212 +1,3 @@
-[<img src="https://lnl7.github.io/nix-darwin/images/nix-darwin.png" width="200px" alt="logo" />](https://github.com/LnL7/nix-darwin)
-
 # nix-darwin

-[![Build Status](https://travis-ci.org/LnL7/nix-darwin.svg?branch=master)](https://travis-ci.org/LnL7/nix-darwin)
-
-Nix modules for darwin, `/etc/nixos/configuration.nix` for macOS.
-
-## Install
-
-This will link the system profile to `/run/current-system`. You have to create `/run` or symlink it to `private/var/run`.
-If you use a symlink, you'll probably also want to add `services.activate-system.enable = true;` to your configuration.
-
-> NOTE: the system activation scripts don't overwrite existing etc files, so files like `/etc/bashrc` won't be used by default.
-Either modify the existing file to source/import the one from `/etc/static` or remove it.
-
-```bash
-# install nixpkgs version, which enables libsodium support (for signed binary caches)
-# this is not required if you already upgraded nix at some point
-nix-env -iA nixpkgs.nix
-
-sudo ln -s private/var/run /run
-
-git clone git@github.com:LnL7/nix-darwin.git ~/.nix-defexpr/darwin
-cp ~/.nix-defexpr/darwin/modules/examples/simple.nix ~/.nixpkgs/darwin-configuration.nix
-
-# bootstrap build using default nix.nixPath
-export NIX_PATH=darwin=$HOME/.nix-defexpr/darwin:darwin-config=$HOME/.nixpkgs/darwin-configuration.nix:$NIX_PATH
-
-# you can also use this to rebootstrap nix-darwin in case
-# darwin-rebuild is to old to activate the system.
-$(nix-build '<darwin>' -A system --no-out-link)/sw/bin/darwin-rebuild build
-$(nix-build '<darwin>' -A system --no-out-link)/sw/bin/darwin-rebuild switch
-
-. /etc/static/bashrc
-```
-
-... or for `fish`:
-
-```fish
-(nix-build '<darwin>' -A system --no-out-link)/sw/bin/darwin-rebuild build
-(nix-build '<darwin>' -A system --no-out-link)/sw/bin/darwin-rebuild switch
-```
-
-This will create and manage a system profile in `/run/current-system`, just like nixos.
-
-The default `NIX_PATH` in nix-darwin will look for this repository in `~/.nix-defexpr/darwin` and for your configuration in `~/.nixpkgs/darwin-configuration.nix`.
-If you want to change these you can set your own with `nix.nixPath = [ ];`.
-
-```
-$ darwin-rebuild switch
-building the system configuration...
-these derivations will be built:
-  /nix/store/vfad6xgjzr56jcs051cg6vzch4dby92y-etc-zprofile.drv
-  /nix/store/cbmkscxsz0k02ynaph5xaxm1aql0p3vq-etc.drv
-  /nix/store/r5fpn177jhc16f8iyzk12gcw4pivzpbw-nixdarwin-system-16.09.drv
-building path(s) ‘/nix/store/wlq89shja597ip7mrmjv7yzk2lwyh8n0-etc-zprofile’
-building path(s) ‘/nix/store/m8kcm1pa5j570h3indp71a439wsh9lzq-etc’
-building path(s) ‘/nix/store/l735ffcdvcvy60i8pqf6v00vx7lnm6mz-nixdarwin-system-16.09’
-setting up /etc...
-setting up launchd services...
-writing defaults...
-$
-```
-
-```
-$ darwin-option services.activate-system.enable                                                                                                                                            ~/src/nix-darwin
-Value:
-true
-
-Default:
-false
-
-Example:
-no example
-
-Description:
-Whether to activate system at boot time.
-```
-
-## Example configuration
-
-Check out [modules/examples](https://github.com/LnL7/nix-darwin/tree/master/modules/examples) for some example configurations.
-
-```nix
-{ pkgs, ... }:
-{
-
-  # List packages installed in system profile. To search by name, run:
-  # $ nix-env -qaP | grep wget
-  environment.systemPackages =
-    [ pkgs.nix-repl
-    ];
-
-  # Create /etc/bashrc that loads the nix-darwin environment.
-  programs.bash.enable = true;
-
-  # Recreate /run/current-system symlink after boot.
-  services.activate-system.enable = true;
-
-}
-```
-
-## Modules
-
-### system.defaults
-
-A set of [modules](https://github.com/LnL7/nix-darwin/tree/master/modules/system/defaults) to manage macOS settings.
-
-```nix
-{
-  system.defaults.dock.autohide = true;
-  system.defaults.dock.orientation = "left";
-  system.defaults.dock.showhidden = true;
-}
-```
-
-> NOTE: you have to restart the dock in order for these changes to apply. `killall Dock`
-
-### environment.etc
-
-Set of files to be linked in `/etc`, this won't overwrite any existing files.
-Either modify the existing file to source/import the one from `/etc/static` or remove it.
-
-```nix
-{
-  environment.etc."foorc".text = ''
-    export FOO=1
-
-    if test -f /etc/foorc.local; then
-      . /etc/foorc.local
-    fi
-  '';
-
-  # Global user configuration, symlink these to the appropriate file:
-  # $ ln -s /etc/static/per-user/lnl/gitconfig ~/.gitconfig
-  environment.etc."per-user/lnl/gitconfig".text = ''
-    [include]
-      path = .gitconfig.local
-
-    [color]
-      ui = auto
-  '';
-}
-```
-
-### launchd.daemons
-
-Definition of launchd agents/daemons. The [serviceConfig](https://github.com/LnL7/nix-darwin/blob/master/modules/launchd/launchd.nix) options are used to generate the launchd plist file.
-
-```nix
-{
-  launchd.daemons.foo = {
-    serviceConfig.ProgramArguments = [ "/usr/bin/touch" "/tmp/foo.lock" ];
-    serviceConfig.RunAtLoad = true;
-  };
-}
-```
-
-### services
-
-A set of modules for predefined services, these generate the appropriate launchd daemons for you.
-
-```nix
-{
-  services.nix-daemon.enable = true;
-  services.nix-daemon.tempDir = "/nix/tmp";
-}
-```
-
-### programs
-
-A set of modules to manage configuration of certain programs.
-
-```nix
-{ pkgs, ... }:
-
-{
-  environment.shellAliases.ls = "${pkgs.coreutils}/bin/ls";
-
-  programs.bash.enable = true;
-
-  programs.vim.enable = true;
-  programs.vim.enableSensible = true;
-}
-```
-
-### nixpkgs.config
-
-This attribute set is used as nixpkgs configuration when using nix-darwin.
-
-```nix
-{
-  environment.systemPackages =
-    [ # Use vim_configurable from packageOverrides
-      lnl.vim
-    ];
-
-  nixpkgs.config.allowUnfree = true;
-
-  nixpkgs.config.packageOverrides = pkgs: {
-    lnl.vim = pkgs.vim_configurable.customize {
-      name = "vim";
-      vimrcConfig.customRC = ''
-        set nocompatible
-        filetype plugin indent on
-        syntax on
-      '';
-    };
-  };
-}
-```
+This is the 26.05 release branch of nix-darwin. See [the main readme](https://github.com/nix-darwin/nix-darwin#readme) for documentation
@@ -1,63 +1,23 @@
-{ nixpkgs ? <nixpkgs>, configuration ? <darwin-config>, system ? builtins.currentSystem
+{ nixpkgs ? <nixpkgs>
+, configuration ? <darwin-config>
+, system ? builtins.currentSystem
 , pkgs ? import nixpkgs { inherit system; }
+, lib ? pkgs.lib
 }:

 let
-
-  packages = { config, lib, pkgs, ... }: {
-    config = {
-      _module.args.pkgs = import nixpkgs {
-        inherit system;
-        inherit (config.nixpkgs) config;
-      };
+  eval = import ./eval-config.nix {
+    inherit lib;
+    modules = [
+      configuration
+      { nixpkgs.source = lib.mkDefault nixpkgs; }
+    ] ++ lib.optional (system != null) {
+      nixpkgs.system = lib.mkDefault system;
    };
  };
-
-  eval = pkgs.lib.evalModules {
-    check = true;
-    modules =
-      [ configuration
-        packages
-        ./modules/alias.nix
-        ./modules/system
-        ./modules/system/activation-scripts.nix
-        ./modules/system/defaults-write.nix
-        ./modules/system/defaults/NSGlobalDomain.nix
-        ./modules/system/defaults/LaunchServices.nix
-        ./modules/system/defaults/dock.nix
-        ./modules/system/defaults/finder.nix
-        ./modules/system/defaults/trackpad.nix
-        ./modules/system/etc.nix
-        ./modules/system/launchd.nix
-        ./modules/time
-        ./modules/nix
-        ./modules/nix/nix-darwin.nix
-        ./modules/nix/nixpkgs.nix
-        ./modules/environment
-        ./modules/launchd
-        ./modules/security
-        ./modules/services/activate-system.nix
-        ./modules/services/khd.nix
-        ./modules/services/kwm.nix
-        ./modules/services/emacs.nix
-        ./modules/services/mopidy.nix
-        ./modules/services/nix-daemon.nix
-        ./modules/services/nix-gc.nix
-        ./modules/programs/bash.nix
-        ./modules/programs/fish.nix
-        ./modules/programs/man.nix
-        ./modules/programs/nix-script.nix
-        ./modules/programs/tmux.nix
-        ./modules/programs/vim.nix
-        ./modules/programs/zsh
-      ];
-  };
-
 in
+eval // {
+  darwin-uninstaller = pkgs.callPackage ./pkgs/darwin-uninstaller { };

-{
-  inherit (eval.config._module.args) pkgs;
-  inherit (eval) options config;
-
-  system = eval.config.system.build.toplevel;
+  inherit (pkgs.callPackage ./pkgs/nix-tools { }) darwin-option darwin-rebuild darwin-version;
 }
@@ -0,0 +1,8 @@
+# System-wide profile for interactive zsh(1) login shells.
+
+# Setup user specific overrides for this in ~/.zprofile. See zshbuiltins(1)
+# and zshoptions(1) for more details.
+
+if [ -x /usr/libexec/path_helper ]; then
+	eval `/usr/libexec/path_helper -s`
+fi
@@ -0,0 +1,18 @@
+
+# Nix
+if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ]; then
+    . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
+fi
+# End Nix
+
+        
+# System-wide .bashrc file for interactive bash(1) shells.
+if [ -z "$PS1" ]; then
+   return
+fi
+
+PS1='\h:\W \u\$ '
+# Make bash check its window size after a process completes
+shopt -s checkwinsize
+
+[ -r "/etc/bashrc_$TERM_PROGRAM" ] && . "/etc/bashrc_$TERM_PROGRAM"
@@ -0,0 +1,10 @@
+# Generated by https://install.lix.systems/.
+# See `/nix/nix-installer --version` for the version details.
+
+build-users-group = nixbld
+experimental-features = nix-command flakes
+bash-prompt-prefix = (nix:$name)\040
+max-jobs = auto
+substituters = https://cache.nixos.org https://cache.lix.systems
+trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=
+extra-nix-path = nixpkgs=flake:nixpkgs
@@ -0,0 +1,82 @@
+
+# Nix
+if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ]; then
+    . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
+fi
+# End Nix
+
+        
+# System-wide profile for interactive zsh(1) shells.
+
+# Setup user specific overrides for this in ~/.zshrc. See zshbuiltins(1)
+# and zshoptions(1) for more details.
+
+# Correctly display UTF-8 with combining characters.  We'll assume UTF-8 if the
+# locale(1) binary is missing entirely.
+if [[ ! -x /usr/bin/locale ]] || [[ "$(locale LC_CTYPE)" == "UTF-8" ]]; then
+    setopt COMBINING_CHARS
+fi
+
+# Disable the log builtin, so we don't conflict with /usr/bin/log
+disable log
+
+# Save command history
+HISTFILE=${ZDOTDIR:-$HOME}/.zsh_history
+HISTSIZE=2000
+SAVEHIST=1000
+
+# Beep on error
+setopt BEEP
+
+# Use keycodes (generated via zkbd) if present, otherwise fallback on
+# values from terminfo
+if [[ -r ${ZDOTDIR:-$HOME}/.zkbd/${TERM}-${VENDOR} ]] ; then
+    source ${ZDOTDIR:-$HOME}/.zkbd/${TERM}-${VENDOR}
+else
+    typeset -g -A key
+
+    [[ -n "$terminfo[kf1]" ]] && key[F1]=$terminfo[kf1]
+    [[ -n "$terminfo[kf2]" ]] && key[F2]=$terminfo[kf2]
+    [[ -n "$terminfo[kf3]" ]] && key[F3]=$terminfo[kf3]
+    [[ -n "$terminfo[kf4]" ]] && key[F4]=$terminfo[kf4]
+    [[ -n "$terminfo[kf5]" ]] && key[F5]=$terminfo[kf5]
+    [[ -n "$terminfo[kf6]" ]] && key[F6]=$terminfo[kf6]
+    [[ -n "$terminfo[kf7]" ]] && key[F7]=$terminfo[kf7]
+    [[ -n "$terminfo[kf8]" ]] && key[F8]=$terminfo[kf8]
+    [[ -n "$terminfo[kf9]" ]] && key[F9]=$terminfo[kf9]
+    [[ -n "$terminfo[kf10]" ]] && key[F10]=$terminfo[kf10]
+    [[ -n "$terminfo[kf11]" ]] && key[F11]=$terminfo[kf11]
+    [[ -n "$terminfo[kf12]" ]] && key[F12]=$terminfo[kf12]
+    [[ -n "$terminfo[kf13]" ]] && key[F13]=$terminfo[kf13]
+    [[ -n "$terminfo[kf14]" ]] && key[F14]=$terminfo[kf14]
+    [[ -n "$terminfo[kf15]" ]] && key[F15]=$terminfo[kf15]
+    [[ -n "$terminfo[kf16]" ]] && key[F16]=$terminfo[kf16]
+    [[ -n "$terminfo[kf17]" ]] && key[F17]=$terminfo[kf17]
+    [[ -n "$terminfo[kf18]" ]] && key[F18]=$terminfo[kf18]
+    [[ -n "$terminfo[kf19]" ]] && key[F19]=$terminfo[kf19]
+    [[ -n "$terminfo[kf20]" ]] && key[F20]=$terminfo[kf20]
+    [[ -n "$terminfo[kbs]" ]] && key[Backspace]=$terminfo[kbs]
+    [[ -n "$terminfo[kich1]" ]] && key[Insert]=$terminfo[kich1]
+    [[ -n "$terminfo[kdch1]" ]] && key[Delete]=$terminfo[kdch1]
+    [[ -n "$terminfo[khome]" ]] && key[Home]=$terminfo[khome]
+    [[ -n "$terminfo[kend]" ]] && key[End]=$terminfo[kend]
+    [[ -n "$terminfo[kpp]" ]] && key[PageUp]=$terminfo[kpp]
+    [[ -n "$terminfo[knp]" ]] && key[PageDown]=$terminfo[knp]
+    [[ -n "$terminfo[kcuu1]" ]] && key[Up]=$terminfo[kcuu1]
+    [[ -n "$terminfo[kcub1]" ]] && key[Left]=$terminfo[kcub1]
+    [[ -n "$terminfo[kcud1]" ]] && key[Down]=$terminfo[kcud1]
+    [[ -n "$terminfo[kcuf1]" ]] && key[Right]=$terminfo[kcuf1]
+fi
+
+# Default key bindings
+[[ -n ${key[Delete]} ]] && bindkey "${key[Delete]}" delete-char
+[[ -n ${key[Home]} ]] && bindkey "${key[Home]}" beginning-of-line
+[[ -n ${key[End]} ]] && bindkey "${key[End]}" end-of-line
+[[ -n ${key[Up]} ]] && bindkey "${key[Up]}" up-line-or-search
+[[ -n ${key[Down]} ]] && bindkey "${key[Down]}" down-line-or-search
+
+# Default prompt
+PS1="%n@%m %1~ %# "
+
+# Useful support for interacting with Terminal.app or other terminal programs
+[ -r "/etc/zshrc_$TERM_PROGRAM" ] && . "/etc/zshrc_$TERM_PROGRAM"
@@ -0,0 +1,81 @@
+
+# Nix
+if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ]; then
+    . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
+fi
+# End Nix
+
+        
+# System-wide profile for interactive zsh(1) shells.
+
+# Setup user specific overrides for this in ~/.zshrc. See zshbuiltins(1)
+# and zshoptions(1) for more details.
+
+# Correctly display UTF-8 with combining characters.
+if [[ "$(locale LC_CTYPE)" == "UTF-8" ]]; then
+    setopt COMBINING_CHARS
+fi
+
+# Disable the log builtin, so we don't conflict with /usr/bin/log
+disable log
+
+# Save command history
+HISTFILE=${ZDOTDIR:-$HOME}/.zsh_history
+HISTSIZE=2000
+SAVEHIST=1000
+
+# Beep on error
+setopt BEEP
+
+# Use keycodes (generated via zkbd) if present, otherwise fallback on
+# values from terminfo
+if [[ -r ${ZDOTDIR:-$HOME}/.zkbd/${TERM}-${VENDOR} ]] ; then
+    source ${ZDOTDIR:-$HOME}/.zkbd/${TERM}-${VENDOR}
+else
+    typeset -g -A key
+
+    [[ -n "$terminfo[kf1]" ]] && key[F1]=$terminfo[kf1]
+    [[ -n "$terminfo[kf2]" ]] && key[F2]=$terminfo[kf2]
+    [[ -n "$terminfo[kf3]" ]] && key[F3]=$terminfo[kf3]
+    [[ -n "$terminfo[kf4]" ]] && key[F4]=$terminfo[kf4]
+    [[ -n "$terminfo[kf5]" ]] && key[F5]=$terminfo[kf5]
+    [[ -n "$terminfo[kf6]" ]] && key[F6]=$terminfo[kf6]
+    [[ -n "$terminfo[kf7]" ]] && key[F7]=$terminfo[kf7]
+    [[ -n "$terminfo[kf8]" ]] && key[F8]=$terminfo[kf8]
+    [[ -n "$terminfo[kf9]" ]] && key[F9]=$terminfo[kf9]
+    [[ -n "$terminfo[kf10]" ]] && key[F10]=$terminfo[kf10]
+    [[ -n "$terminfo[kf11]" ]] && key[F11]=$terminfo[kf11]
+    [[ -n "$terminfo[kf12]" ]] && key[F12]=$terminfo[kf12]
+    [[ -n "$terminfo[kf13]" ]] && key[F13]=$terminfo[kf13]
+    [[ -n "$terminfo[kf14]" ]] && key[F14]=$terminfo[kf14]
+    [[ -n "$terminfo[kf15]" ]] && key[F15]=$terminfo[kf15]
+    [[ -n "$terminfo[kf16]" ]] && key[F16]=$terminfo[kf16]
+    [[ -n "$terminfo[kf17]" ]] && key[F17]=$terminfo[kf17]
+    [[ -n "$terminfo[kf18]" ]] && key[F18]=$terminfo[kf18]
+    [[ -n "$terminfo[kf19]" ]] && key[F19]=$terminfo[kf19]
+    [[ -n "$terminfo[kf20]" ]] && key[F20]=$terminfo[kf20]
+    [[ -n "$terminfo[kbs]" ]] && key[Backspace]=$terminfo[kbs]
+    [[ -n "$terminfo[kich1]" ]] && key[Insert]=$terminfo[kich1]
+    [[ -n "$terminfo[kdch1]" ]] && key[Delete]=$terminfo[kdch1]
+    [[ -n "$terminfo[khome]" ]] && key[Home]=$terminfo[khome]
+    [[ -n "$terminfo[kend]" ]] && key[End]=$terminfo[kend]
+    [[ -n "$terminfo[kpp]" ]] && key[PageUp]=$terminfo[kpp]
+    [[ -n "$terminfo[knp]" ]] && key[PageDown]=$terminfo[knp]
+    [[ -n "$terminfo[kcuu1]" ]] && key[Up]=$terminfo[kcuu1]
+    [[ -n "$terminfo[kcub1]" ]] && key[Left]=$terminfo[kcub1]
+    [[ -n "$terminfo[kcud1]" ]] && key[Down]=$terminfo[kcud1]
+    [[ -n "$terminfo[kcuf1]" ]] && key[Right]=$terminfo[kcuf1]
+fi
+
+# Default key bindings
+[[ -n ${key[Delete]} ]] && bindkey "${key[Delete]}" delete-char
+[[ -n ${key[Home]} ]] && bindkey "${key[Home]}" beginning-of-line
+[[ -n ${key[End]} ]] && bindkey "${key[End]}" end-of-line
+[[ -n ${key[Up]} ]] && bindkey "${key[Up]}" up-line-or-search
+[[ -n ${key[Down]} ]] && bindkey "${key[Down]}" down-line-or-search
+
+# Default prompt
+PS1="%n@%m %1~ %# "
+
+# Useful support for interacting with Terminal.app or other terminal programs
+[ -r "/etc/zshrc_$TERM_PROGRAM" ] && . "/etc/zshrc_$TERM_PROGRAM"
@@ -0,0 +1,2 @@
+# Added by tailscaled
+nameserver 100.100.100.100
@@ -0,0 +1,3 @@
+# Written by https://github.com/DeterminateSystems/nix-installer.
+# The contents below are based on options specified at installation time.
+
@@ -0,0 +1,80 @@
+# System-wide profile for interactive zsh(1) shells.
+
+# Setup user specific overrides for this in ~/.zshrc. See zshbuiltins(1)
+# and zshoptions(1) for more details.
+
+# Correctly display UTF-8 with combining characters.
+if [[ "$(locale LC_CTYPE)" == "UTF-8" ]]; then
+    setopt COMBINING_CHARS
+fi
+
+# Disable the log builtin, so we don't conflict with /usr/bin/log
+disable log
+
+# Save command history
+HISTFILE=${ZDOTDIR:-$HOME}/.zsh_history
+HISTSIZE=2000
+SAVEHIST=1000
+
+# Beep on error
+setopt BEEP
+
+# Use keycodes (generated via zkbd) if present, otherwise fallback on
+# values from terminfo
+if [[ -r ${ZDOTDIR:-$HOME}/.zkbd/${TERM}-${VENDOR} ]] ; then
+    source ${ZDOTDIR:-$HOME}/.zkbd/${TERM}-${VENDOR}
+else
+    typeset -g -A key
+
+    [[ -n "$terminfo[kf1]" ]] && key[F1]=$terminfo[kf1]
+    [[ -n "$terminfo[kf2]" ]] && key[F2]=$terminfo[kf2]
+    [[ -n "$terminfo[kf3]" ]] && key[F3]=$terminfo[kf3]
+    [[ -n "$terminfo[kf4]" ]] && key[F4]=$terminfo[kf4]
+    [[ -n "$terminfo[kf5]" ]] && key[F5]=$terminfo[kf5]
+    [[ -n "$terminfo[kf6]" ]] && key[F6]=$terminfo[kf6]
+    [[ -n "$terminfo[kf7]" ]] && key[F7]=$terminfo[kf7]
+    [[ -n "$terminfo[kf8]" ]] && key[F8]=$terminfo[kf8]
+    [[ -n "$terminfo[kf9]" ]] && key[F9]=$terminfo[kf9]
+    [[ -n "$terminfo[kf10]" ]] && key[F10]=$terminfo[kf10]
+    [[ -n "$terminfo[kf11]" ]] && key[F11]=$terminfo[kf11]
+    [[ -n "$terminfo[kf12]" ]] && key[F12]=$terminfo[kf12]
+    [[ -n "$terminfo[kf13]" ]] && key[F13]=$terminfo[kf13]
+    [[ -n "$terminfo[kf14]" ]] && key[F14]=$terminfo[kf14]
+    [[ -n "$terminfo[kf15]" ]] && key[F15]=$terminfo[kf15]
+    [[ -n "$terminfo[kf16]" ]] && key[F16]=$terminfo[kf16]
+    [[ -n "$terminfo[kf17]" ]] && key[F17]=$terminfo[kf17]
+    [[ -n "$terminfo[kf18]" ]] && key[F18]=$terminfo[kf18]
+    [[ -n "$terminfo[kf19]" ]] && key[F19]=$terminfo[kf19]
+    [[ -n "$terminfo[kf20]" ]] && key[F20]=$terminfo[kf20]
+    [[ -n "$terminfo[kbs]" ]] && key[Backspace]=$terminfo[kbs]
+    [[ -n "$terminfo[kich1]" ]] && key[Insert]=$terminfo[kich1]
+    [[ -n "$terminfo[kdch1]" ]] && key[Delete]=$terminfo[kdch1]
+    [[ -n "$terminfo[khome]" ]] && key[Home]=$terminfo[khome]
+    [[ -n "$terminfo[kend]" ]] && key[End]=$terminfo[kend]
+    [[ -n "$terminfo[kpp]" ]] && key[PageUp]=$terminfo[kpp]
+    [[ -n "$terminfo[knp]" ]] && key[PageDown]=$terminfo[knp]
+    [[ -n "$terminfo[kcuu1]" ]] && key[Up]=$terminfo[kcuu1]
+    [[ -n "$terminfo[kcub1]" ]] && key[Left]=$terminfo[kcub1]
+    [[ -n "$terminfo[kcud1]" ]] && key[Down]=$terminfo[kcud1]
+    [[ -n "$terminfo[kcuf1]" ]] && key[Right]=$terminfo[kcuf1]
+fi
+
+# Default key bindings
+[[ -n ${key[Delete]} ]] && bindkey "${key[Delete]}" delete-char
+[[ -n ${key[Home]} ]] && bindkey "${key[Home]}" beginning-of-line
+[[ -n ${key[End]} ]] && bindkey "${key[End]}" end-of-line
+[[ -n ${key[Up]} ]] && bindkey "${key[Up]}" up-line-or-search
+[[ -n ${key[Down]} ]] && bindkey "${key[Down]}" down-line-or-search
+
+# Default prompt
+PS1="%n@%m %1~ %# "
+
+# Useful support for interacting with Terminal.app or other terminal programs
+[ -r "/etc/zshrc_$TERM_PROGRAM" ] && . "/etc/zshrc_$TERM_PROGRAM"
+
+# Nix
+if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ]; then
+  . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
+fi
+# End Nix
+
@@ -0,0 +1,10 @@
+# System-wide .bashrc file for interactive bash(1) shells.
+if [ -z "$PS1" ]; then
+   return
+fi
+
+PS1='\h:\W \u\$ '
+# Make bash check its window size after a process completes
+shopt -s checkwinsize
+
+[ -r "/etc/bashrc_$TERM_PROGRAM" ] && . "/etc/bashrc_$TERM_PROGRAM"
@@ -0,0 +1,74 @@
+# System-wide profile for interactive zsh(1) shells.
+
+# Setup user specific overrides for this in ~/.zshrc. See zshbuiltins(1)
+# and zshoptions(1) for more details.
+
+# Correctly display UTF-8 with combining characters.  We'll assume UTF-8 if the
+# locale(1) binary is missing entirely.
+if [[ ! -x /usr/bin/locale ]] || [[ "$(locale LC_CTYPE)" == "UTF-8" ]]; then
+    setopt COMBINING_CHARS
+fi
+
+# Disable the log builtin, so we don't conflict with /usr/bin/log
+disable log
+
+# Save command history
+HISTFILE=${ZDOTDIR:-$HOME}/.zsh_history
+HISTSIZE=2000
+SAVEHIST=1000
+
+# Beep on error
+setopt BEEP
+
+# Use keycodes (generated via zkbd) if present, otherwise fallback on
+# values from terminfo
+if [[ -r ${ZDOTDIR:-$HOME}/.zkbd/${TERM}-${VENDOR} ]] ; then
+    source ${ZDOTDIR:-$HOME}/.zkbd/${TERM}-${VENDOR}
+else
+    typeset -g -A key
+
+    [[ -n "$terminfo[kf1]" ]] && key[F1]=$terminfo[kf1]
+    [[ -n "$terminfo[kf2]" ]] && key[F2]=$terminfo[kf2]
+    [[ -n "$terminfo[kf3]" ]] && key[F3]=$terminfo[kf3]
+    [[ -n "$terminfo[kf4]" ]] && key[F4]=$terminfo[kf4]
+    [[ -n "$terminfo[kf5]" ]] && key[F5]=$terminfo[kf5]
+    [[ -n "$terminfo[kf6]" ]] && key[F6]=$terminfo[kf6]
+    [[ -n "$terminfo[kf7]" ]] && key[F7]=$terminfo[kf7]
+    [[ -n "$terminfo[kf8]" ]] && key[F8]=$terminfo[kf8]
+    [[ -n "$terminfo[kf9]" ]] && key[F9]=$terminfo[kf9]
+    [[ -n "$terminfo[kf10]" ]] && key[F10]=$terminfo[kf10]
+    [[ -n "$terminfo[kf11]" ]] && key[F11]=$terminfo[kf11]
+    [[ -n "$terminfo[kf12]" ]] && key[F12]=$terminfo[kf12]
+    [[ -n "$terminfo[kf13]" ]] && key[F13]=$terminfo[kf13]
+    [[ -n "$terminfo[kf14]" ]] && key[F14]=$terminfo[kf14]
+    [[ -n "$terminfo[kf15]" ]] && key[F15]=$terminfo[kf15]
+    [[ -n "$terminfo[kf16]" ]] && key[F16]=$terminfo[kf16]
+    [[ -n "$terminfo[kf17]" ]] && key[F17]=$terminfo[kf17]
+    [[ -n "$terminfo[kf18]" ]] && key[F18]=$terminfo[kf18]
+    [[ -n "$terminfo[kf19]" ]] && key[F19]=$terminfo[kf19]
+    [[ -n "$terminfo[kf20]" ]] && key[F20]=$terminfo[kf20]
+    [[ -n "$terminfo[kbs]" ]] && key[Backspace]=$terminfo[kbs]
+    [[ -n "$terminfo[kich1]" ]] && key[Insert]=$terminfo[kich1]
+    [[ -n "$terminfo[kdch1]" ]] && key[Delete]=$terminfo[kdch1]
+    [[ -n "$terminfo[khome]" ]] && key[Home]=$terminfo[khome]
+    [[ -n "$terminfo[kend]" ]] && key[End]=$terminfo[kend]
+    [[ -n "$terminfo[kpp]" ]] && key[PageUp]=$terminfo[kpp]
+    [[ -n "$terminfo[knp]" ]] && key[PageDown]=$terminfo[knp]
+    [[ -n "$terminfo[kcuu1]" ]] && key[Up]=$terminfo[kcuu1]
+    [[ -n "$terminfo[kcub1]" ]] && key[Left]=$terminfo[kcub1]
+    [[ -n "$terminfo[kcud1]" ]] && key[Down]=$terminfo[kcud1]
+    [[ -n "$terminfo[kcuf1]" ]] && key[Right]=$terminfo[kcuf1]
+fi
+
+# Default key bindings
+[[ -n ${key[Delete]} ]] && bindkey "${key[Delete]}" delete-char
+[[ -n ${key[Home]} ]] && bindkey "${key[Home]}" beginning-of-line
+[[ -n ${key[End]} ]] && bindkey "${key[End]}" end-of-line
+[[ -n ${key[Up]} ]] && bindkey "${key[Up]}" up-line-or-search
+[[ -n ${key[Down]} ]] && bindkey "${key[Down]}" down-line-or-search
+
+# Default prompt
+PS1="%n@%m %1~ %# "
+
+# Useful support for interacting with Terminal.app or other terminal programs
+[ -r "/etc/zshrc_$TERM_PROGRAM" ] && . "/etc/zshrc_$TERM_PROGRAM"
@@ -0,0 +1,7 @@
+
+# Set up Nix only on SSH connections
+# See: https://github.com/DeterminateSystems/nix-installer/pull/714
+if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ] && [ -n "${SSH_CONNECTION:-}" ] && [ "${SHLVL:-0}" -eq 1 ]; then
+    . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
+fi
+# End Nix
@@ -0,0 +1,14 @@
+
+# Generated by https://github.com/DeterminateSystems/nix-installer.
+# See `/nix/nix-installer --version` for the version details.
+
+!include nix.custom.conf
+
+experimental-features = nix-command flakes
+always-allow-substitutes = true
+extra-trusted-substituters = https://cache.flakehub.com
+extra-trusted-public-keys = cache.flakehub.com-3:hJuILl5sVK4iKm86JzgdXW12Y2Hwd5G07qKtHTOcDCM= cache.flakehub.com-4:Asi8qIv291s0aYLyH6IOnr5Kf6+OF14WVjkE6t3xMio= cache.flakehub.com-5:zB96CRlL7tiPtzA9/WKyPkp3A2vqxqgdgyTVNGShPDU= cache.flakehub.com-6:W4EGFwAGgBj3he7c5fNh9NkOXw0PUVaxygCVKeuvaqU= cache.flakehub.com-7:mvxJ2DZVHn/kRxlIaxYNMuDG1OvMckZu32um1TadOR8= cache.flakehub.com-8:moO+OVS0mnTjBTcOUh2kYLQEd59ExzyoW1QgQ8XAARQ= cache.flakehub.com-9:wChaSeTI6TeCuV/Sg2513ZIM9i0qJaYsF+lZCXg0J6o= cache.flakehub.com-10:2GqeNlIp6AKp4EF2MVbE1kBOp9iBSyo0UPR9KoR0o1Y=
+bash-prompt-prefix = (nix:$name)\040
+max-jobs = auto
+extra-nix-path = nixpkgs=flake:nixpkgs
+upgrade-nix-store-path-url = https://install.determinate.systems/nix-upgrade/stable/universal
@@ -0,0 +1,9 @@
+# Generated by https://github.com/DeterminateSystems/nix-installer.
+# See `/nix/nix-installer --version` for the version details.
+
+build-users-group = nixbld
+experimental-features = nix-command flakes repl-flake
+bash-prompt-prefix = (nix:$name)\040
+max-jobs = auto
+extra-nix-path = nixpkgs=flake:nixpkgs
+upgrade-nix-store-path-url = https://install.determinate.systems/nix-upgrade/stable/universal
@@ -0,0 +1,17 @@
+# System-wide .bashrc file for interactive bash(1) shells.
+if [ -z "$PS1" ]; then
+   return
+fi
+
+PS1='\h:\W \u\$ '
+# Make bash check its window size after a process completes
+shopt -s checkwinsize
+
+[ -r "/etc/bashrc_$TERM_PROGRAM" ] && . "/etc/bashrc_$TERM_PROGRAM"
+
+# Nix
+if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ]; then
+  . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
+fi
+# End Nix
+
@@ -0,0 +1,4 @@
+
+# Written by https://github.com/DeterminateSystems/nix-installer.
+# The contents below are based on options specified at installation time.
+
@@ -0,0 +1,13 @@
+# Generated by https://github.com/DeterminateSystems/nix-installer.
+# See `/nix/nix-installer --version` for the version details.
+
+extra-experimental-features = nix-command flakes
+always-allow-substitutes = true
+extra-trusted-substituters = https://cache.flakehub.com
+extra-trusted-public-keys = cache.flakehub.com-3:hJuILl5sVK4iKm86JzgdXW12Y2Hwd5G07qKtHTOcDCM= cache.flakehub.com-4:Asi8qIv291s0aYLyH6IOnr5Kf6+OF14WVjkE6t3xMio= cache.flakehub.com-5:zB96CRlL7tiPtzA9/WKyPkp3A2vqxqgdgyTVNGShPDU= cache.flakehub.com-6:W4EGFwAGgBj3he7c5fNh9NkOXw0PUVaxygCVKeuvaqU= cache.flakehub.com-7:mvxJ2DZVHn/kRxlIaxYNMuDG1OvMckZu32um1TadOR8= cache.flakehub.com-8:moO+OVS0mnTjBTcOUh2kYLQEd59ExzyoW1QgQ8XAARQ= cache.flakehub.com-9:wChaSeTI6TeCuV/Sg2513ZIM9i0qJaYsF+lZCXg0J6o= cache.flakehub.com-10:2GqeNlIp6AKp4EF2MVbE1kBOp9iBSyo0UPR9KoR0o1Y=
+bash-prompt-prefix = (nix:$name)\040
+max-jobs = auto
+extra-nix-path = nixpkgs=flake:nixpkgs
+upgrade-nix-store-path-url = https://install.determinate.systems/nix-upgrade/stable/universal
+
+!include nix.custom.conf
@@ -0,0 +1,3 @@
+# Written by https://github.com/NixOS/nix-installer
+# The contents below are based on options specified at installation time.
+
@@ -0,0 +1,10 @@
+# Generated by https://github.com/NixOS/nix-installer
+# See `/nix/nix-installer --version` for the version details.
+
+extra-experimental-features = nix-command flakes
+always-allow-substitutes = true
+bash-prompt-prefix = (nix:$name)\040
+max-jobs = auto
+extra-nix-path = nixpkgs=flake:nixpkgs
+
+!include nix.custom.conf
@@ -0,0 +1,11 @@
+# Generated by https://install.lix.systems/.
+# See `/nix/lix-installer --version` for the version details.
+
+extra-experimental-features = nix-command
+always-allow-substitutes = true
+extra-trusted-substituters = https://cache.lix.systems
+extra-trusted-public-keys = cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=
+bash-prompt-prefix = (nix:$name)\040
+max-jobs = auto
+
+!include nix.custom.conf
@@ -0,0 +1,12 @@
+# Generated by https://github.com/DeterminateSystems/nix-installer.
+# See `/nix/nix-installer --version` for the version details.
+
+build-users-group = nixbld
+experimental-features = nix-command flakes
+always-allow-substitutes = true
+extra-trusted-substituters = https://cache.flakehub.com
+extra-trusted-public-keys = cache.flakehub.com-3:hJuILl5sVK4iKm86JzgdXW12Y2Hwd5G07qKtHTOcDCM= cache.flakehub.com-4:Asi8qIv291s0aYLyH6IOnr5Kf6+OF14WVjkE6t3xMio= cache.flakehub.com-5:zB96CRlL7tiPtzA9/WKyPkp3A2vqxqgdgyTVNGShPDU= cache.flakehub.com-6:W4EGFwAGgBj3he7c5fNh9NkOXw0PUVaxygCVKeuvaqU= cache.flakehub.com-7:mvxJ2DZVHn/kRxlIaxYNMuDG1OvMckZu32um1TadOR8= cache.flakehub.com-8:moO+OVS0mnTjBTcOUh2kYLQEd59ExzyoW1QgQ8XAARQ= cache.flakehub.com-9:wChaSeTI6TeCuV/Sg2513ZIM9i0qJaYsF+lZCXg0J6o= cache.flakehub.com-10:2GqeNlIp6AKp4EF2MVbE1kBOp9iBSyo0UPR9KoR0o1Y=
+bash-prompt-prefix = (nix:$name)\040
+max-jobs = auto
+extra-nix-path = nixpkgs=flake:nixpkgs
+upgrade-nix-store-path-url = https://install.determinate.systems/nix-upgrade/stable/universal
@@ -0,0 +1,8 @@
+# Generated by https://github.com/DeterminateSystems/nix-installer.
+# See `/nix/nix-installer --version` for the version details.
+
+build-users-group = nixbld
+experimental-features = nix-command flakes repl-flake
+bash-prompt-prefix = (nix:$name)\040
+max-jobs = auto
+extra-nix-path = nixpkgs=flake:nixpkgs
@@ -0,0 +1,11 @@
+# List of acceptable shells for chpass(1).
+# Ftpd will not allow users to connect who are not using
+# one of these shells.
+
+/bin/bash
+/bin/csh
+/bin/dash
+/bin/ksh
+/bin/sh
+/bin/tcsh
+/bin/zsh
@@ -0,0 +1,3 @@
+# Written by https://install.lix.systems/.
+# The contents below are based on options specified at installation time.
+
@@ -0,0 +1,9 @@
+# Generated by https://install.lix.systems/.
+# See `/nix/nix-installer --version` for the version details.
+
+build-users-group = nixbld
+experimental-features = nix-command
+bash-prompt-prefix = (nix:$name)\040
+max-jobs = auto
+substituters = https://cache.nixos.org https://cache.lix.systems
+trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=
@@ -0,0 +1,81 @@
+# System-wide profile for interactive zsh(1) shells.
+
+# Setup user specific overrides for this in ~/.zshrc. See zshbuiltins(1)
+# and zshoptions(1) for more details.
+
+# Correctly display UTF-8 with combining characters.  We'll assume UTF-8 if the
+# locale(1) binary is missing entirely.
+if [[ ! -x /usr/bin/locale ]] || [[ "$(locale LC_CTYPE)" == "UTF-8" ]]; then
+    setopt COMBINING_CHARS
+fi
+
+# Disable the log builtin, so we don't conflict with /usr/bin/log
+disable log
+
+# Save command history
+HISTFILE=${ZDOTDIR:-$HOME}/.zsh_history
+HISTSIZE=2000
+SAVEHIST=1000
+
+# Beep on error
+setopt BEEP
+
+# Use keycodes (generated via zkbd) if present, otherwise fallback on
+# values from terminfo
+if [[ -r ${ZDOTDIR:-$HOME}/.zkbd/${TERM}-${VENDOR} ]] ; then
+    source ${ZDOTDIR:-$HOME}/.zkbd/${TERM}-${VENDOR}
+else
+    typeset -g -A key
+
+    [[ -n "$terminfo[kf1]" ]] && key[F1]=$terminfo[kf1]
+    [[ -n "$terminfo[kf2]" ]] && key[F2]=$terminfo[kf2]
+    [[ -n "$terminfo[kf3]" ]] && key[F3]=$terminfo[kf3]
+    [[ -n "$terminfo[kf4]" ]] && key[F4]=$terminfo[kf4]
+    [[ -n "$terminfo[kf5]" ]] && key[F5]=$terminfo[kf5]
+    [[ -n "$terminfo[kf6]" ]] && key[F6]=$terminfo[kf6]
+    [[ -n "$terminfo[kf7]" ]] && key[F7]=$terminfo[kf7]
+    [[ -n "$terminfo[kf8]" ]] && key[F8]=$terminfo[kf8]
+    [[ -n "$terminfo[kf9]" ]] && key[F9]=$terminfo[kf9]
+    [[ -n "$terminfo[kf10]" ]] && key[F10]=$terminfo[kf10]
+    [[ -n "$terminfo[kf11]" ]] && key[F11]=$terminfo[kf11]
+    [[ -n "$terminfo[kf12]" ]] && key[F12]=$terminfo[kf12]
+    [[ -n "$terminfo[kf13]" ]] && key[F13]=$terminfo[kf13]
+    [[ -n "$terminfo[kf14]" ]] && key[F14]=$terminfo[kf14]
+    [[ -n "$terminfo[kf15]" ]] && key[F15]=$terminfo[kf15]
+    [[ -n "$terminfo[kf16]" ]] && key[F16]=$terminfo[kf16]
+    [[ -n "$terminfo[kf17]" ]] && key[F17]=$terminfo[kf17]
+    [[ -n "$terminfo[kf18]" ]] && key[F18]=$terminfo[kf18]
+    [[ -n "$terminfo[kf19]" ]] && key[F19]=$terminfo[kf19]
+    [[ -n "$terminfo[kf20]" ]] && key[F20]=$terminfo[kf20]
+    [[ -n "$terminfo[kbs]" ]] && key[Backspace]=$terminfo[kbs]
+    [[ -n "$terminfo[kich1]" ]] && key[Insert]=$terminfo[kich1]
+    [[ -n "$terminfo[kdch1]" ]] && key[Delete]=$terminfo[kdch1]
+    [[ -n "$terminfo[khome]" ]] && key[Home]=$terminfo[khome]
+    [[ -n "$terminfo[kend]" ]] && key[End]=$terminfo[kend]
+    [[ -n "$terminfo[kpp]" ]] && key[PageUp]=$terminfo[kpp]
+    [[ -n "$terminfo[knp]" ]] && key[PageDown]=$terminfo[knp]
+    [[ -n "$terminfo[kcuu1]" ]] && key[Up]=$terminfo[kcuu1]
+    [[ -n "$terminfo[kcub1]" ]] && key[Left]=$terminfo[kcub1]
+    [[ -n "$terminfo[kcud1]" ]] && key[Down]=$terminfo[kcud1]
+    [[ -n "$terminfo[kcuf1]" ]] && key[Right]=$terminfo[kcuf1]
+fi
+
+# Default key bindings
+[[ -n ${key[Delete]} ]] && bindkey "${key[Delete]}" delete-char
+[[ -n ${key[Home]} ]] && bindkey "${key[Home]}" beginning-of-line
+[[ -n ${key[End]} ]] && bindkey "${key[End]}" end-of-line
+[[ -n ${key[Up]} ]] && bindkey "${key[Up]}" up-line-or-search
+[[ -n ${key[Down]} ]] && bindkey "${key[Down]}" down-line-or-search
+
+# Default prompt
+PS1="%n@%m %1~ %# "
+
+# Useful support for interacting with Terminal.app or other terminal programs
+[ -r "/etc/zshrc_$TERM_PROGRAM" ] && . "/etc/zshrc_$TERM_PROGRAM"
+
+# Nix
+if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ]; then
+  . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
+fi
+# End Nix
+
@@ -0,0 +1 @@
+build-users-group = nixbld
@@ -0,0 +1,6 @@
+# Generated by https://github.com/DeterminateSystems/nix-installer, version 0.14.0.
+build-users-group = nixbld
+experimental-features = nix-command flakes repl-flake
+bash-prompt-prefix = (nix:$name)\040
+max-jobs = auto
+extra-nix-path = nixpkgs=flake:nixpkgs
@@ -0,0 +1,7 @@
+
+# Set up Nix only on SSH connections
+# See: https://github.com/DeterminateSystems/nix-installer/pull/714
+if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ] && [ -n "${SSH_CONNECTION}" ] && [ "${SHLVL}" -eq 1 ]; then
+    . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
+fi
+# End Nix
@@ -0,0 +1,12 @@
+# Generated by https://install.lix.systems/.
+# See `/nix/lix-installer --version` for the version details.
+
+extra-experimental-features = nix-command flakes
+always-allow-substitutes = true
+extra-trusted-substituters = https://cache.lix.systems
+extra-trusted-public-keys = cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=
+bash-prompt-prefix = (nix:$name)\040
+max-jobs = auto
+extra-nix-path = nixpkgs=flake:nixpkgs
+
+!include nix.custom.conf
@@ -0,0 +1,10 @@
+# Generated by https://github.com/DeterminateSystems/nix-installer.
+# See `/nix/nix-installer --version` for the version details.
+
+build-users-group = nixbld
+experimental-features = nix-command flakes
+always-allow-substitutes = true
+bash-prompt-prefix = (nix:$name)\040
+max-jobs = auto
+extra-nix-path = nixpkgs=flake:nixpkgs
+upgrade-nix-store-path-url = https://install.determinate.systems/nix-upgrade/stable/universal
@@ -0,0 +1,5 @@
+build-users-group = nixbld
+
+max-jobs = 32
+cores = 1
+sandbox = false
@@ -0,0 +1,12 @@
+# System-wide profile for interactive zsh(1) login shells.
+
+# Setup user specific overrides for this in ~/.zprofile. See zshbuiltins(1)
+# and zshoptions(1) for more details.
+
+if [ -z "$LANG" ]; then
+	export LANG=C.UTF-8
+fi
+
+if [ -x /usr/libexec/path_helper ]; then
+	eval `/usr/libexec/path_helper -s`
+fi
@@ -0,0 +1,6 @@
+# Generated by https://github.com/DeterminateSystems/nix-installer, version 0.10.0.
+experimental-features = nix-command flakes auto-allocate-uids
+build-users-group = nixbld
+auto-optimise-store = true
+extra-nix-path = nixpkgs=flake:nixpkgs
+bash-prompt-prefix = (nix:$name)\040
@@ -0,0 +1,73 @@
+# System-wide profile for interactive zsh(1) shells.
+
+# Setup user specific overrides for this in ~/.zshrc. See zshbuiltins(1)
+# and zshoptions(1) for more details.
+
+# Correctly display UTF-8 with combining characters.
+if [[ "$(locale LC_CTYPE)" == "UTF-8" ]]; then
+    setopt COMBINING_CHARS
+fi
+
+# Disable the log builtin, so we don't conflict with /usr/bin/log
+disable log
+
+# Save command history
+HISTFILE=${ZDOTDIR:-$HOME}/.zsh_history
+HISTSIZE=2000
+SAVEHIST=1000
+
+# Beep on error
+setopt BEEP
+
+# Use keycodes (generated via zkbd) if present, otherwise fallback on
+# values from terminfo
+if [[ -r ${ZDOTDIR:-$HOME}/.zkbd/${TERM}-${VENDOR} ]] ; then
+    source ${ZDOTDIR:-$HOME}/.zkbd/${TERM}-${VENDOR}
+else
+    typeset -g -A key
+
+    [[ -n "$terminfo[kf1]" ]] && key[F1]=$terminfo[kf1]
+    [[ -n "$terminfo[kf2]" ]] && key[F2]=$terminfo[kf2]
+    [[ -n "$terminfo[kf3]" ]] && key[F3]=$terminfo[kf3]
+    [[ -n "$terminfo[kf4]" ]] && key[F4]=$terminfo[kf4]
+    [[ -n "$terminfo[kf5]" ]] && key[F5]=$terminfo[kf5]
+    [[ -n "$terminfo[kf6]" ]] && key[F6]=$terminfo[kf6]
+    [[ -n "$terminfo[kf7]" ]] && key[F7]=$terminfo[kf7]
+    [[ -n "$terminfo[kf8]" ]] && key[F8]=$terminfo[kf8]
+    [[ -n "$terminfo[kf9]" ]] && key[F9]=$terminfo[kf9]
+    [[ -n "$terminfo[kf10]" ]] && key[F10]=$terminfo[kf10]
+    [[ -n "$terminfo[kf11]" ]] && key[F11]=$terminfo[kf11]
+    [[ -n "$terminfo[kf12]" ]] && key[F12]=$terminfo[kf12]
+    [[ -n "$terminfo[kf13]" ]] && key[F13]=$terminfo[kf13]
+    [[ -n "$terminfo[kf14]" ]] && key[F14]=$terminfo[kf14]
+    [[ -n "$terminfo[kf15]" ]] && key[F15]=$terminfo[kf15]
+    [[ -n "$terminfo[kf16]" ]] && key[F16]=$terminfo[kf16]
+    [[ -n "$terminfo[kf17]" ]] && key[F17]=$terminfo[kf17]
+    [[ -n "$terminfo[kf18]" ]] && key[F18]=$terminfo[kf18]
+    [[ -n "$terminfo[kf19]" ]] && key[F19]=$terminfo[kf19]
+    [[ -n "$terminfo[kf20]" ]] && key[F20]=$terminfo[kf20]
+    [[ -n "$terminfo[kbs]" ]] && key[Backspace]=$terminfo[kbs]
+    [[ -n "$terminfo[kich1]" ]] && key[Insert]=$terminfo[kich1]
+    [[ -n "$terminfo[kdch1]" ]] && key[Delete]=$terminfo[kdch1]
+    [[ -n "$terminfo[khome]" ]] && key[Home]=$terminfo[khome]
+    [[ -n "$terminfo[kend]" ]] && key[End]=$terminfo[kend]
+    [[ -n "$terminfo[kpp]" ]] && key[PageUp]=$terminfo[kpp]
+    [[ -n "$terminfo[knp]" ]] && key[PageDown]=$terminfo[knp]
+    [[ -n "$terminfo[kcuu1]" ]] && key[Up]=$terminfo[kcuu1]
+    [[ -n "$terminfo[kcub1]" ]] && key[Left]=$terminfo[kcub1]
+    [[ -n "$terminfo[kcud1]" ]] && key[Down]=$terminfo[kcud1]
+    [[ -n "$terminfo[kcuf1]" ]] && key[Right]=$terminfo[kcuf1]
+fi
+
+# Default key bindings
+[[ -n ${key[Delete]} ]] && bindkey "${key[Delete]}" delete-char
+[[ -n ${key[Home]} ]] && bindkey "${key[Home]}" beginning-of-line
+[[ -n ${key[End]} ]] && bindkey "${key[End]}" end-of-line
+[[ -n ${key[Up]} ]] && bindkey "${key[Up]}" up-line-or-search
+[[ -n ${key[Down]} ]] && bindkey "${key[Down]}" down-line-or-search
+
+# Default prompt
+PS1="%n@%m %1~ %# "
+
+# Useful support for interacting with Terminal.app or other terminal programs
+[ -r "/etc/zshrc_$TERM_PROGRAM" ] && . "/etc/zshrc_$TERM_PROGRAM"
@@ -0,0 +1,2 @@
+
+build-users-group = nixbld
@@ -0,0 +1,147 @@
+{ pkgs
+, options
+, config
+, version
+, revision
+, nixpkgsRevision
+, extraSources ? []
+, prefix ? ../..
+}:
+
+with pkgs;
+
+let
+  lib = pkgs.lib;
+
+  gitHubDeclaration = user: repo: ref: subpath:
+    # Default to `master` if we don't know what revision the system
+    # configuration is using (custom nixpkgs, etc.).
+    let urlRef = if ref != null then ref else "master";
+    in {
+      url = "https://github.com/${user}/${repo}/blob/${urlRef}/${subpath}";
+      name = "<${repo}/${subpath}>";
+    };
+
+  optionsDoc = buildPackages.nixosOptionsDoc {
+    inherit options;
+    transformOptions = opt: opt // {
+      # Clean up declaration sites to not refer to the nix-darwin source tree.
+      # TODO: handle `extraSources`? (it's not set anywhere)
+      declarations = map
+        (decl:
+          if lib.hasPrefix (toString prefix) (toString decl) then
+            gitHubDeclaration "nix-darwin" "nix-darwin" revision
+              (lib.removePrefix "/"
+                (lib.removePrefix (toString prefix) (toString decl)))
+          # TODO: handle this in a better way (may require upstream
+          # changes to nixpkgs)
+          else if decl == "lib/modules.nix" then
+            gitHubDeclaration "NixOS" "nixpkgs" nixpkgsRevision decl
+          else decl)
+        opt.declarations;
+    };
+  };
+
+in rec {
+  # TODO: Use `optionsDoc.optionsJSON` directly once upstream
+  # `nixosOptionsDoc` is more customizable.
+  optionsJSON = runCommand "options.json"
+    { meta.description = "List of nix-darwin options in JSON format"; }
+    ''
+      mkdir -p $out/{share/doc,nix-support}
+      cp -a ${optionsDoc.optionsJSON}/share/doc/nixos $out/share/doc/darwin
+      substitute \
+        ${optionsDoc.optionsJSON}/nix-support/hydra-build-products \
+        $out/nix-support/hydra-build-products \
+        --replace-fail \
+          '${optionsDoc.optionsJSON}/share/doc/nixos' \
+          "$out/share/doc/darwin"
+    '';
+
+  # Generate the nix-darwin manual.
+  manualHTML = runCommand "darwin-manual-html"
+    { nativeBuildInputs = [ buildPackages.nixos-render-docs ];
+      styles = lib.sourceFilesBySuffices (pkgs.path + "/doc") [ ".css" ];
+      meta.description = "The Darwin manual in HTML format";
+      allowedReferences = ["out"];
+    }
+    ''
+      # Generate the HTML manual.
+      dst=$out/share/doc/darwin
+      mkdir -p $dst
+
+      cp $styles/style.css $dst
+      cp -r ${pkgs.documentation-highlighter} $dst/highlightjs
+
+      substitute ${./manual.md} manual.md \
+        --replace-fail '@DARWIN_VERSION@' "${version}" \
+        --replace-fail \
+          '@DARWIN_OPTIONS_JSON@' \
+          ${optionsJSON}/share/doc/darwin/options.json
+
+      # Pass --redirects option if nixos-render-docs supports it
+      if nixos-render-docs manual html --help | grep --silent -E '^\s+--redirects\s'; then
+        redirects_opt="--redirects ${./redirects.json}"
+      fi
+
+      # TODO: --manpage-urls?
+      nixos-render-docs -j $NIX_BUILD_CORES manual html \
+        --manpage-urls ${pkgs.writeText "manpage-urls.json" "{}"} \
+        --revision ${lib.escapeShellArg revision} \
+        --generator "nixos-render-docs ${lib.version}" \
+        $redirects_opt \
+        --stylesheet style.css \
+        --stylesheet highlightjs/mono-blue.css \
+        --script ./highlightjs/highlight.pack.js \
+        --script ./highlightjs/loader.js \
+        --toc-depth 1 \
+        --chunk-toc-depth 1 \
+        ./manual.md \
+        $dst/index.html
+
+      mkdir -p $out/nix-support
+      echo "nix-build out $out" >> $out/nix-support/hydra-build-products
+      echo "doc manual $dst" >> $out/nix-support/hydra-build-products
+    '';
+
+  # Index page of the nix-darwin manual.
+  manualHTMLIndex = "${manualHTML}/share/doc/darwin/index.html";
+
+  manualEpub = builtins.throw "The nix-darwin EPUB manual has been removed.";
+
+  # Generate the nix-darwin manpages.
+  manpages = runCommand "darwin-manpages"
+    { nativeBuildInputs = [ buildPackages.nixos-render-docs ];
+      allowedReferences = ["out"];
+    }
+    ''
+      # Generate manpages.
+      mkdir -p $out/share/man/man5
+      nixos-render-docs -j $NIX_BUILD_CORES options manpage \
+        --revision ${lib.escapeShellArg revision} \
+        ${optionsJSON}/share/doc/darwin/options.json \
+        $out/share/man/man5/configuration.nix.5
+
+      # TODO: get these parameterized in upstream nixos-render-docs
+      sed -i -e '
+        /^\.TH / s|NixOS|nix-darwin|g
+
+        /^\.SH "NAME"$/ {
+          N
+          s|NixOS|nix-darwin|g
+        }
+
+        /^\.SH "DESCRIPTION"$/ {
+          N; N
+          s|/etc/nixos/configuration|configuration|g
+          s|NixOS|nix-darwin|g
+          s|nixos|nix-darwin|g
+        }
+
+        /\.SH "AUTHORS"$/ {
+          N; N
+          s|Eelco Dolstra and the Nixpkgs/NixOS contributors|Daiderd Jordan and the nix-darwin contributors|g
+        }
+      ' $out/share/man/man5/configuration.nix.5
+    '';
+}
@@ -0,0 +1,8 @@
+# nix-darwin Configuration Options {#book-darwin-manual}
+## Version @DARWIN_VERSION@
+
+```{=include=} options
+id-prefix: opt-
+list-id: configuration-variable-list
+source: @DARWIN_OPTIONS_JSON@
+```
@@ -0,0 +1,5 @@
+{
+  "book-darwin-manual": [
+    "index.html#book-darwin-manual"
+  ]
+}
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <title>nix-darwin</title>
+    <script>
+      window.location.replace("https://github.com/nix-darwin/nix-darwin#readme");
+    </script>
+    <noscript>
+      <meta
+        http-equiv="refresh"
+        content="0; url=https://github.com/nix-darwin/nix-darwin#readme">
+    </noscript>
+  </head>
+  <body>
+    <h1>nix-darwin</h1>
+    <p>
+      nix-darwin is a declarative configuration system for macOS, based
+      on Nix. See the
+      <a href="https://github.com/nix-darwin/nix-darwin#readme">GitHub
+      repository</a> for more information.
+    </p>
+  </body>
+</html>
@@ -0,0 +1,91 @@
+let
+  nixDarwinVersion = builtins.fromJSON (builtins.readFile ./version.json);
+
+  checkRelease = lib:
+    # Avoid breaking configurations when the unstable Nixpkgs version
+    # rolls over.
+    #
+    # TODO: Something more refined than this would be ideal, as this
+    # still means you could be using unstable nix-darwin 25.05 with
+    # Nixpkgs 26.05, which would be unfortunate.
+    if nixDarwinVersion.isReleaseBranch then
+      lib.trivial.release == nixDarwinVersion.release
+    else
+      lib.versionAtLeast lib.trivial.release nixDarwinVersion.release;
+in
+
+{ lib
+, modules
+, baseModules ? import ./modules/module-list.nix
+, specialArgs ? { }
+, check ? true
+, enableNixpkgsReleaseCheck ? true
+}@args:
+
+assert enableNixpkgsReleaseCheck -> checkRelease lib || throw ''
+
+  nix-darwin now uses release branches that correspond to Nixpkgs releases.
+  The nix-darwin and Nixpkgs branches in use must match, but you are currently
+  using nix-darwin ${nixDarwinVersion.release} with Nixpkgs ${lib.trivial.release}.
+
+  On macOS, you should use either the `nixpkgs-unstable` or
+  `nixpkgs-YY.MM-darwin` branches of Nixpkgs. These correspond to the
+  `master` and `nix-darwin-YY.MM` branches of nix-darwin, respectively. Check
+  <https://status.nixos.org/> for the currently supported Nixpkgs releases.
+
+  If you’re using flakes, make sure your inputs look like this:
+
+      inputs = {
+        nixpkgs.url = "github:NixOS/nixpkgs/NIXPKGS-BRANCH";
+        nix-darwin.url = "github:nix-darwin/nix-darwin/NIX-DARWIN-BRANCH";
+        nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
+        # …
+      };
+
+  If you’re using channels, you can check your current channels with:
+
+      $ sudo nix-channel --list
+      nixpkgs https://nixos.org/channels/NIXPKGS-BRANCH
+      darwin https://github.com/nix-darwin/nix-darwin/archive/NIX-DARWIN-BRANCH.tar.gz
+      …
+      $ nix-channel --list
+      …
+
+  If `darwin` or `nixpkgs` are present in `nix-channel --list` (without
+  `sudo`), you should delete them with `nix-channel --remove NAME`. These can
+  contribute to version mismatch problems.
+
+  You can then fix your channels like this:
+
+      $ sudo nix-channel --add https://nixos.org/channels/NIXPKGS-BRANCH nixpkgs
+      $ sudo nix-channel --add https://github.com/nix-darwin/nix-darwin/archive/NIX-DARWIN-BRANCH.tar.gz darwin
+      $ sudo nix-channel --update
+
+  After that, activating your system again should work correctly. If it
+  doesn’t, please open an issue at
+  <https://github.com/nix-darwin/nix-darwin/issues/new> and include as much
+  information as possible.
+'';
+
+let
+  argsModule = {
+    _file = ./eval-config.nix;
+    config = {
+      _module.args = {
+        inherit baseModules modules;
+      };
+    };
+  };
+
+  eval = lib.evalModules (builtins.removeAttrs args [ "lib" "enableNixpkgsReleaseCheck" ] // {
+    class = "darwin";
+    modules = modules ++ [ argsModule ] ++ baseModules;
+    specialArgs = { modulesPath = builtins.toString ./modules; } // specialArgs;
+  });
+  
+  withExtraAttrs = configuration: configuration // {
+    inherit (configuration._module.args) pkgs;
+    system = configuration.config.system.build.toplevel;
+    extendModules = args: withExtraAttrs (configuration.extendModules args);
+  };
+in withExtraAttrs eval
@@ -0,0 +1,11 @@
+{
+  lib,
+  ...
+}:
+{
+  options.flake.darwinConfigurations = lib.mkOption {
+    type = lib.types.lazyAttrsOf lib.types.raw;
+    default = { };
+    description = "Darwin system configurations";
+  };
+}
@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1779622335,
+        "narHash": "sha256-ViA62qtL5za7V3d5I8OA9q9JcFhsVAiL5jVHwEclWqk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "705e9929918b43bd7b715dc0a878ac870449bb03",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-26.05-darwin",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
@@ -0,0 +1,92 @@
+{
+  description = "A collection of darwin modules";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-26.05-darwin";
+  };
+
+  outputs = { self, nixpkgs }: let
+    forAllSystems = nixpkgs.lib.genAttrs [ "aarch64-darwin" "x86_64-darwin" "aarch64-linux" "x86_64-linux" ];
+    forDarwinSystems = nixpkgs.lib.genAttrs [ "aarch64-darwin" "x86_64-darwin" ];
+
+    jobs = forAllSystems (system: import ./release.nix {
+      inherit nixpkgs system;
+
+      nix-darwin = self;
+    });
+  in {
+    lib = {
+      evalConfig = import ./eval-config.nix;
+
+      darwinSystem = args@{ modules, ... }: self.lib.evalConfig (
+        { inherit (nixpkgs) lib; }
+        // nixpkgs.lib.optionalAttrs (args ? pkgs) { inherit (args.pkgs) lib; }
+        // builtins.removeAttrs args [ "system" "pkgs" "inputs" ]
+        // {
+          modules = modules
+            ++ nixpkgs.lib.optional (args ? pkgs) ({ lib, ... }: {
+              _module.args.pkgs = lib.mkForce args.pkgs;
+            })
+            # Backwards compatibility shim; TODO: warn?
+            ++ nixpkgs.lib.optional (args ? system) ({ lib, ... }: {
+              nixpkgs.system = lib.mkDefault args.system;
+            })
+            # Backwards compatibility shim; TODO: warn?
+            ++ nixpkgs.lib.optional (args ? inputs) {
+              _module.args.inputs = args.inputs;
+            }
+            ++ [ ({ lib, ... }: {
+              nixpkgs.source = lib.mkDefault nixpkgs;
+              nixpkgs.flake.source = lib.mkDefault nixpkgs.outPath;
+
+              system.checks.verifyNixPath = lib.mkDefault false;
+
+              system.darwinVersionSuffix = ".${self.shortRev or self.dirtyShortRev or "dirty"}";
+              system.darwinRevision = let
+                rev = self.rev or self.dirtyRev or null;
+              in
+                lib.mkIf (rev != null) rev;
+            }) ];
+          });
+    };
+
+    overlays.default = final: prev: {
+      inherit (prev.callPackage ./pkgs/nix-tools { }) darwin-rebuild darwin-option darwin-version;
+
+      darwin-uninstaller = prev.callPackage ./pkgs/darwin-uninstaller { };
+    };
+
+    flakeModules.default = ./flake-module.nix;
+
+    darwinModules.hydra = ./modules/examples/hydra.nix;
+    darwinModules.lnl = ./modules/examples/lnl.nix;
+    darwinModules.simple = ./modules/examples/simple.nix;
+
+    templates.default = {
+      path = ./modules/examples/flake;
+      description = "nix flake init -t nix-darwin";
+    };
+
+    checks = forDarwinSystems (system: jobs.${system}.tests // jobs.${system}.examples);
+
+    packages = forAllSystems (system: {
+      inherit (jobs.${system}.docs) manualHTML manpages optionsJSON;
+    } // (nixpkgs.lib.optionalAttrs (nixpkgs.lib.hasSuffix "darwin" system) (let
+      pkgs = import nixpkgs {
+        inherit system;
+        overlays = [ self.overlays.default ];
+      };
+    in {
+      default = self.packages.${system}.darwin-rebuild;
+
+      inherit (pkgs) darwin-option darwin-rebuild darwin-version darwin-uninstaller;
+
+      # TODO: Include manuals for active release branches in the website.
+      # (This may involve moving it to a separate repository.)
+      website = pkgs.linkFarm "nix-darwin-website" {
+        "index.html" = ./doc/website/index.html;
+        manual = "${self.packages.${system}.manualHTML}/share/doc/darwin";
+      };
+    })));
+  };
+}
@@ -9,17 +9,28 @@ in
 {
  options = {

-    nix.profile = mkOption { default = null; };
+    networking.networkservices = mkOption { internal = true; default = null; };
+    security.enableAccessibilityAccess = mkOption { internal = true; default = null; };
+    security.accessibilityPrograms = mkOption { internal = true; default = null; };

  };

  config = {

    assertions =
-      [ { assertion = config.nix.profile == null; message = "nix.profile was renamed to nix.package"; }
+      [ { assertion = config.security.enableAccessibilityAccess == null; message = "security.enableAccessibilityAccess was removed, it's broken since 10.12 because of SIP"; }
+        { assertion = config.system.activationScripts.extraPostActivation.text == ""; message = "system.activationScripts.extraPostActivation was renamed to system.activationScripts.postActivation"; }
+        { assertion = config.system.activationScripts.extraUserPostActivation.text == ""; message = "system.activationScripts.extraUserPostActivation was renamed to system.activationScripts.postUserActivation"; }
      ];

-    nix.package = mkIf (config.nix.profile != null) config.nix.profile;
+    warnings = mkIf (config.networking.networkservices != null) [
+      "networking.networkservices was renamed to networking.knownNetworkServices"
+    ];
+
+    networking.knownNetworkServices = mkIf (config.networking.networkservices != null) config.networking.networkservices;
+
+    system.activationScripts.extraPostActivation.text = mkDefault "";
+    system.activationScripts.extraUserPostActivation.text = mkDefault "";

  };
 }
@@ -0,0 +1,149 @@
+# This module defines the packages that appear in
+# /run/current-system/sw.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+
+  makeDrvBinPath = lib.concatMapStringsSep ":" (p: if lib.isDerivation p then "${p}/bin" else p);
+
+  defaultPackageNames = [ ];
+  defaultPackages = map (
+    n:
+    let
+      pkg = pkgs.${n};
+    in
+    lib.setPrio ((pkg.meta.priority or lib.meta.defaultPriority) + 3) pkg
+  ) defaultPackageNames;
+  defaultPackagesText = "[ ${lib.concatMapStringsSep " " (n: "pkgs.${n}") defaultPackageNames} ]";
+
+in
+
+{
+  imports = [
+    (lib.mkRenamedOptionModule ["environment" "postBuild"] ["environment" "extraSetup"])
+  ];
+
+  options = {
+
+    environment = {
+      systemPath = lib.mkOption {
+        type = lib.types.listOf (lib.types.either lib.types.path lib.types.str);
+        description = "The set of paths that are added to PATH.";
+        apply = x: if lib.isList x then makeDrvBinPath x else x;
+      };
+
+      systemPackages = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
+        default = [ ];
+        example = lib.literalExpression "[ pkgs.firefox pkgs.thunderbird ]";
+        description = ''
+          The set of packages that appear in
+          /run/current-system/sw.  These packages are
+          automatically available to all users, and are
+          automatically updated every time you rebuild the system
+          configuration.  (The latter is the main difference with
+          installing them in the default profile,
+          {file}`/nix/var/nix/profiles/default`.
+        '';
+      };
+
+      defaultPackages = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
+        default = defaultPackages;
+        defaultText = lib.literalMD ''
+          these packages, with their `meta.priority` numerically increased
+          (thus lowering their installation priority):
+
+              ${defaultPackagesText}
+        '';
+        example = [ ];
+        description = ''
+          Set of default packages that aren't strictly necessary
+          for a running system, entries can be removed for a more
+          minimal NixOS installation.
+
+          Like with systemPackages, packages are installed to
+          {file}`/run/current-system/sw`. They are
+          automatically available to all users, and are
+          automatically updated every time you rebuild the system
+          configuration.
+        '';
+      };
+
+      pathsToLink = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        # According to https://github.com/NixOS/nixpkgs/blob/2795c506fe8fb7b03c36ccb51f75b6df0ab2553f/nixos/modules/config/system-path.nix#L108-L109
+        # `/lib` needs to be added to make NSS modules work, however currently we don't add it
+        # and it's unclear whether the comment applies on macOS as well.
+        default = [ ];
+        example = [ "/share/doc" ];
+        description = "List of directories to be symlinked in {file}`/run/current-system/sw`.";
+      };
+
+      extraOutputsToInstall = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        example = [
+          "dev"
+          "info"
+        ];
+        description = ''
+          Entries listed here will be appended to the `meta.outputsToInstall` attribute for each package in `environment.systemPackages`, and the files from the corresponding derivation outputs symlinked into {file}`/run/current-system/sw`.
+
+          For example, this can be used to install the `dev` and `info` outputs for all packages in the system environment, if they are available.
+
+          To use specific outputs instead of configuring them globally, select the corresponding attribute on the package derivation, e.g. `libxml2.dev` or `coreutils.info`.
+        '';
+      };
+
+      extraSetup = lib.mkOption {
+        type = lib.types.lines;
+        default = "";
+        description = "Shell fragments to be run after the system environment has been created. This should only be used for things that need to modify the internals of the environment, e.g. generating MIME caches. The environment being built can be accessed at $out.";
+      };
+
+    };
+
+    system = {
+
+      path = lib.mkOption {
+        internal = true;
+        description = ''
+          The packages you want in the system environment.
+        '';
+      };
+
+    };
+
+  };
+
+  config = {
+
+    environment.systemPackages = config.environment.defaultPackages;
+
+    environment.pathsToLink = [
+      "/bin"
+      "/share/locale"
+    ];
+
+    system.path = pkgs.buildEnv {
+      name = "system-path";
+      paths = config.environment.systemPackages;
+      inherit (config.environment) pathsToLink extraOutputsToInstall;
+      ignoreCollisions = true;
+      # !!! Hacky, should modularise.
+      # outputs TODO: note that the tools will often not be linked by default
+      postBuild = ''
+        # Remove wrapped binaries, they shouldn't be accessible via PATH.
+        find $out/bin -maxdepth 1 -name ".*-wrapped" -type l -delete
+
+        ${config.environment.extraSetup}
+      '';
+    };
+
+  };
+}
@@ -0,0 +1,90 @@
+# This module manages the terminfo database
+# and its integration in the system.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+
+  options = {
+    environment.enableAllTerminfo = lib.mkOption {
+      default = false;
+      type = lib.types.bool;
+      description = ''
+        Whether to install all terminfo outputs
+      '';
+    };
+
+    security.sudo.keepTerminfo = lib.mkOption {
+      default = true;
+      type = lib.types.bool;
+      description = ''
+        Whether to preserve the `TERMINFO` and `TERMINFO_DIRS`
+        environment variables, for `root` and the `admin` group.
+      '';
+    };
+  };
+
+  config = {
+
+    # This should not contain packages that are broken or can't build, since it
+    # will break this expression
+    #
+    # can be generated with:
+    # lib.attrNames (lib.filterAttrs
+    #  (_: drv: (builtins.tryEval (
+    #    lib.isDerivation drv && drv ? terminfo && drv.meta.available && !drv.meta.broken && !drv.meta.unsupported)).value)
+    #  pkgs)
+    environment.systemPackages = lib.mkIf config.environment.enableAllTerminfo (
+      map (x: x.terminfo) (
+        with pkgs.pkgsBuildBuild;
+        [
+          alacritty
+          alacritty-graphics
+          ghostty-bin
+          kitty
+          mtm
+          rio
+          rxvt-unicode-unwrapped
+          rxvt-unicode-unwrapped-emoji
+          st
+          tmux
+          wezterm
+        ]
+      )
+    );
+
+    environment.pathsToLink = [
+      "/share/terminfo"
+    ];
+
+    environment.etc.terminfo = {
+      source = "${config.system.path}/share/terminfo";
+    };
+
+    # TODO: use `environment.profileRelativeSessionVariables`
+    environment.variables = {
+      TERMINFO_DIRS = map (path: path + "/share/terminfo") config.environment.profiles ++ [ "/usr/share/terminfo" ];
+    };
+
+    environment.extraInit = ''
+      # reset TERM with new TERMINFO available (if any)
+      export TERM=$TERM
+    '';
+
+    security =
+      let
+        extraConfig = ''
+
+          # Keep terminfo database for root and %admin.
+          Defaults:root,%admin env_keep+=TERMINFO_DIRS
+          Defaults:root,%admin env_keep+=TERMINFO
+        '';
+      in
+      lib.mkIf config.security.sudo.keepTerminfo {
+        sudo = { inherit extraConfig; };
+      };
+  };
+}
@@ -0,0 +1,111 @@
+{ config, lib, pkgs, baseModules, modules, ... }:
+
+with lib;
+
+let
+  cfg = config.documentation;
+
+  # To reference the regular configuration from inside the docs evaluation further down.
+  # While not strictly necessary, this extra binding avoids accidental name capture in
+  # the future.
+  regularConfig = config;
+
+  argsModule = {
+    config._module.args = lib.mkForce (regularConfig._module.args // {
+      modules = [ ];
+    });
+  };
+
+  /* For the purpose of generating docs, evaluate options with each derivation
+    in `pkgs` (recursively) replaced by a fake with path "\${pkgs.attribute.path}".
+    It isn't perfect, but it seems to cover a vast majority of use cases.
+    Caveat: even if the package is reached by a different means,
+    the path above will be shown and not e.g. `${config.services.foo.package}`. */
+  manual = import ../../doc/manual {
+    inherit pkgs config;
+    version = config.system.darwinVersion;
+    revision = config.system.darwinRevision;
+    inherit (config.system) nixpkgsRevision;
+    options =
+      let
+        scrubbedEval = import ../../eval-config.nix {
+          inherit lib;
+          modules = [ argsModule ];
+          specialArgs = { pkgs = scrubDerivations "pkgs" pkgs; };
+        };
+        scrubDerivations = namePrefix: pkgSet: mapAttrs
+          (name: value:
+            let wholeName = "${namePrefix}.${name}"; in
+            if isAttrs value then
+              scrubDerivations wholeName value
+              // (optionalAttrs (isDerivation value) { outPath = "\${${wholeName}}"; })
+            else value
+          )
+          pkgSet;
+      in scrubbedEval.options;
+  };
+
+  helpScript = pkgs.writeScriptBin "darwin-help"
+    ''
+      #! ${pkgs.stdenv.shell} -e
+      open ${manual.manualHTMLIndex}
+    '';
+in
+
+{
+  options = {
+    documentation.enable = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Whether to install documentation of packages from
+        {option}`environment.systemPackages` into the generated system path.
+
+        See "Multiple-output packages" chapter in the nixpkgs manual for more info.
+      '';
+      # which is at ../../../doc/multiple-output.xml
+    };
+
+    documentation.man.enable = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Whether to install manual pages and the {command}`man` command.
+        This also includes "man" outputs.
+      '';
+    };
+
+    documentation.info.enable = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Whether to install info pages and the {command}`info` command.
+        This also includes "info" outputs.
+      '';
+    };
+
+    documentation.doc.enable = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Whether to install documentation distributed in packages' `/share/doc`.
+        Usually plain text and/or HTML.
+        This also includes "doc" outputs.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    programs.man.enable = cfg.man.enable;
+    programs.info.enable = cfg.info.enable;
+
+    environment.systemPackages = mkMerge [
+      (mkIf cfg.man.enable [ manual.manpages ])
+      (mkIf cfg.doc.enable [ manual.manualHTML helpScript ])
+    ];
+
+    system.build.manual = manual;
+
+  };
+}
@@ -1,66 +1,60 @@
-{ config, lib, pkgs, ... }:
+{ options, config, lib, pkgs, ... }:

 with lib;

 let
-
  cfg = config.environment;

  exportVariables =
    mapAttrsToList (n: v: ''export ${n}="${v}"'') cfg.variables;

  aliasCommands =
-    mapAttrsFlatten (n: v: ''alias ${n}="${v}"'') cfg.shellAliases;
+    mapAttrsToList (n: v: ''alias ${n}=${escapeShellArg v}'')
+      (filterAttrs (k: v: v != null) cfg.shellAliases);
+in

-  makeDrvBinPath = concatMapStringsSep ":" (p: if isDerivation p then "${p}/bin" else p);
+{
+  imports = [
+    (mkRemovedOptionModule [ "environment" "loginShell" ] ''
+      This option was only used to change the default command in tmux.
+
+      This has been removed in favour of changing the default command or default shell in tmux directly.
+    '')
+  ];

-in {
  options = {
-
-    environment.systemPackages = mkOption {
-      type = types.listOf types.package;
-      default = [];
-      example = literalExample "[ pkgs.nix-repl pkgs.vim ]";
-      description = ''
-        The set of packages that appear in
-        /run/current-system/sw.  These packages are
-        automatically available to all users, and are
-        automatically updated every time you rebuild the system
-        configuration.  (The latter is the main difference with
-        installing them in the default profile,
-        <filename>/nix/var/nix/profiles/default</filename>.
-      '';
-    };
-
-    environment.systemPath = mkOption {
-      type = types.loeOf types.str;
-      description = "The set of paths that are added to PATH.";
-      apply = x: if isList x then makeDrvBinPath x else x;
-    };
-
    environment.profiles = mkOption {
      type = types.listOf types.str;
      description = "A list of profiles used to setup the global environment.";
    };

-    environment.extraOutputsToInstall = mkOption {
-      type = types.listOf types.str;
-      default = [];
-      example = [ "doc" "info" "devdoc" ];
-      description = "List of additional package outputs to be symlinked into <filename>/run/current-system/sw</filename>.";
-    };
+    environment.darwinConfig = mkOption {
+      type = types.nullOr (types.either types.path types.str);
+      default =
+        if config.nixpkgs.flake.setNixPath then
+          # Don’t set this for flake‐based systems.
+          null
+        else if config.system.stateVersion >= 6 then
+          "/etc/nix-darwin/configuration.nix"
+        else
+          "${config.system.primaryUserHome}/.nixpkgs/darwin-configuration.nix";
+      defaultText = literalExpression ''
+        if config.nixpkgs.flake.setNixPath then
+          # Don’t set this for flake‐based systems.
+          null
+        else if config.system.stateVersion >= 6 then
+          "/etc/nix-darwin/configuration.nix"
+        else
+          "''${config.system.primaryUserHome}/.nixpkgs/darwin-configuration.nix"
+      '';
+      description = ''
+        The path of the darwin configuration.nix used to configure the system,
+        this updates the default darwin-config entry in NIX_PATH. Since this
+        changes an environment variable it will only apply to new shells.

-    environment.pathsToLink = mkOption {
-      type = types.listOf types.str;
-      default = [];
-      example = [ "/share/doc" ];
-      description = "List of directories to be symlinked in <filename>/run/current-system/sw</filename>.";
-    };
-
-    environment.loginShell = mkOption {
-      type = types.str;
-      default = "$SHELL";
-      description = "Configure default login shell.";
+        NOTE: Changing this requires running {command}`darwin-rebuild switch -I darwin-config=/path/to/configuration.nix`
+        the first time to make darwin-rebuild aware of the custom location.
+      '';
    };

    environment.variables = mkOption {
@@ -94,9 +88,29 @@ in {
      description = ''
        Shell script code called during global environment initialisation
        after all variables and profileVariables have been set.
+        This code is assumed to be shell-independent, which means you should
+        stick to pure sh without sh word split.
+      '';
+    };
+
+    environment.shellInit = mkOption {
+      default = "";
+      description = ''
+        Shell script code called during shell initialisation.
        This code is asumed to be shell-independent, which means you should
        stick to pure sh without sh word split.
      '';
+      type = types.lines;
+    };
+
+    environment.loginShellInit = mkOption {
+      default = "";
+      description = ''
+        Shell script code called during login shell initialisation.
+        This code is asumed to be shell-independent, which means you should
+        stick to pure sh without sh word split.
+      '';
+      type = types.lines;
    };

    environment.interactiveShellInit = mkOption {
@@ -108,49 +122,57 @@ in {
      '';
      type = types.lines;
    };
-
  };

  config = {

-    environment.systemPath = [ (makeBinPath cfg.profiles) "/usr/local/bin:/usr/bin:/usr/sbin:/bin:/sbin" ];
+    # This is horrible, sorry.
+    system.requiresPrimaryUser = mkIf (
+      config.nix.enable
+      && !config.nixpkgs.flake.setNixPath
+      && config.system.stateVersion < 6
+      && options.environment.darwinConfig.highestPrio == (mkOptionDefault {}).priority
+    ) [
+      "environment.darwinConfig"
+    ];

-    environment.profiles =
-      [ # Use user, default and system profiles.
-        "$HOME/.nix-profile"
-        "/nix/var/nix/profiles/default"
-        "/run/current-system/sw"
-      ];
+    environment.systemPath = mkMerge [
+      [ (makeBinPath cfg.profiles) ]
+      (mkOrder 1200 [ "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin" ])
+    ];

-    environment.pathsToLink =
-      [ "/bin"
-        "/lib"
-        "/share/info"
-        "/share/locale"
-      ];
+    # Use user, default and system profiles.
+    environment.profiles = mkMerge [
+      (mkOrder 800 [ "$HOME/.nix-profile" ])
+      [ "/run/current-system/sw" "/nix/var/nix/profiles/default" ]
+    ];

    environment.extraInit = ''
-       # reset TERM with new TERMINFO available (if any)
-       export TERM=$TERM
-
       export NIX_USER_PROFILE_DIR="/nix/var/nix/profiles/per-user/$USER"
       export NIX_PROFILES="${concatStringsSep " " (reverseList cfg.profiles)}"
    '';

    environment.variables =
-      { NIX_SSL_CERT_FILE = mkDefault "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+      {
+        XDG_CONFIG_DIRS = map (path: path + "/etc/xdg") cfg.profiles;
+        XDG_DATA_DIRS = map (path: path + "/share") cfg.profiles;
        EDITOR = mkDefault "nano";
        PAGER = mkDefault "less -R";
      };

-    system.path = pkgs.buildEnv {
-      name = "system-path";
-      paths = cfg.systemPackages;
-      inherit (cfg) pathsToLink extraOutputsToInstall;
-    };
+    system.build.setEnvironment = pkgs.writeText "set-environment" ''
+      # Prevent this file from being sourced by child shells.
+      export __NIX_DARWIN_SET_ENVIRONMENT_DONE=1

-    system.build.setEnvironment = concatStringsSep "\n" exportVariables;
-    system.build.setAliases = concatStringsSep "\n" aliasCommands;
+      export PATH=${config.environment.systemPath}
+      ${concatStringsSep "\n" exportVariables}

+      # Extra initialisation
+      ${cfg.extraInit}
+    '';
+
+    system.build.setAliases = pkgs.writeText "set-aliases" ''
+      ${concatStringsSep "\n" aliasCommands}
+    '';
  };
 }
@@ -0,0 +1,43 @@
+{
+  description = "Example nix-darwin system flake";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-26.05-darwin";
+    nix-darwin.url = "github:nix-darwin/nix-darwin/nix-darwin-26.05";
+    nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  outputs = inputs@{ self, nix-darwin, nixpkgs }:
+  let
+    configuration = { pkgs, ... }: {
+      # List packages installed in system profile. To search by name, run:
+      # $ nix-env -qaP | grep wget
+      environment.systemPackages =
+        [ pkgs.vim
+        ];
+
+      # Necessary for using flakes on this system.
+      nix.settings.experimental-features = "nix-command flakes";
+
+      # Enable alternative shell support in nix-darwin.
+      # programs.fish.enable = true;
+
+      # Set Git commit hash for darwin-version.
+      system.configurationRevision = self.rev or self.dirtyRev or null;
+
+      # Used for backwards compatibility, please read the changelog before changing.
+      # $ darwin-rebuild changelog
+      system.stateVersion = 6;
+
+      # The platform the configuration will be used on.
+      nixpkgs.hostPlatform = "aarch64-darwin";
+    };
+  in
+  {
+    # Build darwin flake using:
+    # $ darwin-rebuild build --flake .#simple
+    darwinConfigurations."simple" = nix-darwin.lib.darwinSystem {
+      modules = [ configuration ];
+    };
+  };
+}
@@ -0,0 +1,47 @@
+{ config, lib, pkgs, ... }:
+
+let
+  environment = lib.concatStringsSep " "
+    [ "NIX_REMOTE=daemon"
+      "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+    ];
+in
+
+{
+  nix.settings.substituters = [ "http://cache1" ];
+  nix.settings.trusted-public-keys = [ "cache.daiderd.com-1:R8KOWZ8lDaLojqD+v9dzXAqGn29gEzPTTbr/GIpCTrI=" ];
+
+  nix.settings.trusted-users = [ "@admin" "@hydra" ];
+
+  nix.extraOptions = ''
+    pre-build-hook =
+  '';
+
+  nix.gc.automatic = true;
+  nix.gc.options = "--max-freed $((25 * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | awk '{ print $4 }')))";
+
+  environment.etc."per-user/hydra/ssh/authorized_keys".text = lib.concatStringsSep "\n"
+    [ "command=\"${environment} ${config.nix.package}/bin/nix-store --serve --write\" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCVsc0pHGsskoayziMhA2e59bHPWe0bbKgusmqhuJFBGQ1BAk9UmPzKCWE3nCiV6CLD1+SygVkBjb06DYtc+94BnzviCa9qZtL0G4+2vhp6x8OvXh8xlf/eWw3k5MWlvu+kjJFpbW8wHWTiUqzH+uEeHklAosT0lFNjiIYd/Vs3JAezhUR62a6c7ZjWOd5F7ALGEKzOiwC4i37kSgGsIWNCbe0Ku7gyr718zhMGeyxax6saHhnkSpIB+7d6oHhKeiJSFMWctNmz1/qxXUPbxNaJvqgdKlVHhN+B7x/TIbkVr5pTC59Okx9LTcpflFIv79VT+Gf1K7VypZpSvJjG0xFRt8iDs1+ssWFBfvpo94vUbZ+ZwMDcBGR5iJeO41Gj5fYn5aaDl32RXfJ9Fkwael1L6pcXtkIc66jk+KQQpgoeNj8Y3Emntpqva/2AM41wDDvr5tKp5KhEKFLM95CoiWq+g88pZLcpqLK7wooDVqNkVUEbMaj9lBN0AzU9mcsIRGvTa6CmWAdBvwqS2fRZD97Oarqct9AWgb0X6mOUq9BJNi4i4xvjgnVkylLwtLUnibR/PeXMtkb9bv6BEZXNf5ACqxSjKXJyaIHI65I5TILCr5eEgaujgvmkREn6U3T1NZAUIeVe9aVYLqehYh79OHUBzggoHqidRrXBB/6zdg9UgQ=="
+      "command=\"${environment} ${config.nix.package}/bin/nix-store --serve --write\" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCnubA1pRqlpoAXkZ1q5nwhqi1RY2z840wFLFDj7vAMSups9E2U8PNIVtuVYApZpkBWIpzD4GGbQTF5Itnu5uBpJswc2Yat9yGWO/guuVyXIaRoBIM0Pg1WBWcWsz+k4rNludu9UQ74FHqEiqZIuIuOcgV+RIZn8xQlGt2kUqN9TWboHhZz8Zhx7EtGSJH6MJRLn3mA/pPjOF6k1jiiFG1pVDuqBTZPANkelWYCWAJ46jCyhxXltWE/jkBYGc/XbB8yT7DFE1XC6TVsSEp68R9PhVG3yqxqY06sniEyduSoGt/TDr6ycERd93bvLElXFATes85YiFszeaUgayYSKwQPe0q7YeHMhIXL0UYJYaKVVgT9saFDiHDzde7kKe+NA+J4+TbIk7Y/Ywn0jepsYV13M7TyEqgqbu9fvVGF3JI9+4g0m1gAzHTa7n6iiAedtz+Pi79uCEpRD2hWSSoLWroyPlep8j1p2tygtFsrieePEukesoToCTwqg1Ejnjh+yKdtUbc6xpyRvl3hKeO8QbCpfaaVd27e4vE4lP2JMW6nOo8b0wlVXQIFe5K2zh52q1MSwhLAq6Kg8oPmgj0lru4IivmPc+/NVwd3Qj3E9ZB8LRfTesfbcxHrC8lF5dL/QpLMeLwebrwCxL19gI0kxmDIaUQuHSyP3B2z+EmBKcN/Xw=="
+    ];
+
+  users.knownGroups = [ "hydra" ];
+  users.knownUsers = [ "hydra" ];
+  users.groups.hydra = { gid = 530; description = "Hydra builder group"; members = [ "hydra" ]; };
+  users.users.hydra = { uid = 530; gid = 530; description = "Hydra"; home = "/Users/hydra"; shell = "/bin/bash"; };
+
+  system.activationScripts.postActivation.text = ''
+    printf "disabling spotlight indexing... "
+    mdutil -i off -d / &> /dev/null
+    mdutil -E / &> /dev/null
+    echo "ok"
+
+    printf "configuring ssh keys for hydra... "
+    mkdir -p ~hydra/.ssh
+    cp -f /etc/per-user/hydra/ssh/authorized_keys ~hydra/.ssh/authorized_keys
+    chown hydra:hydra ~hydra ~hydra/.ssh ~hydra/.ssh/authorized_keys
+    echo "ok"
+  '';
+
+  system.stateVersion = 6;
+}
@@ -1,71 +1,102 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, inputs, pkgs, ... }:
+
 {
+  system.primaryUser = "lnl";
+
  system.defaults.NSGlobalDomain.AppleKeyboardUIMode = 3;
  system.defaults.NSGlobalDomain.ApplePressAndHoldEnabled = false;
  system.defaults.NSGlobalDomain.InitialKeyRepeat = 10;
  system.defaults.NSGlobalDomain.KeyRepeat = 1;
+  system.defaults.NSGlobalDomain.NSAutomaticCapitalizationEnabled = false;
+  system.defaults.NSGlobalDomain.NSAutomaticInlinePredictionEnabled = false;
  system.defaults.NSGlobalDomain.NSAutomaticDashSubstitutionEnabled = false;
+  system.defaults.NSGlobalDomain.NSAutomaticPeriodSubstitutionEnabled = false;
  system.defaults.NSGlobalDomain.NSAutomaticQuoteSubstitutionEnabled = false;
  system.defaults.NSGlobalDomain.NSAutomaticSpellingCorrectionEnabled = false;
  system.defaults.NSGlobalDomain.NSNavPanelExpandedStateForSaveMode = true;
  system.defaults.NSGlobalDomain.NSNavPanelExpandedStateForSaveMode2 = true;
+  system.defaults.NSGlobalDomain._HIHideMenuBar = true;

  system.defaults.dock.autohide = true;
+  system.defaults.dock.mru-spaces = false;
  system.defaults.dock.orientation = "left";
  system.defaults.dock.showhidden = true;
-  system.defaults.dock.mru-spaces = false;

  system.defaults.finder.AppleShowAllExtensions = true;
  system.defaults.finder.QuitMenuItem = true;
  system.defaults.finder.FXEnableExtensionChangeWarning = false;

  system.defaults.trackpad.Clicking = true;
+  system.defaults.trackpad.TrackpadThreeFingerDrag = true;
+
+  system.keyboard.enableKeyMapping = true;
+  system.keyboard.remapCapsLockToControl = true;

  environment.systemPackages =
-    [ pkgs.curl
+    [
+      config.programs.vim.package
+
+      pkgs.awscli
+      pkgs.brotli
+      pkgs.ctags
+      pkgs.curl
+      pkgs.direnv
+      pkgs.entr
      pkgs.fzf
      pkgs.gettext
      pkgs.git
+      pkgs.gnupg
      pkgs.htop
      pkgs.jq
-      pkgs.mosh
-      pkgs.silver-searcher
-
-      pkgs.nix-repl
+      pkgs.ripgrep
+      pkgs.shellcheck
    ];

-  environment.extraOutputsToInstall = [ "man" ];
+  services.yabai.enable = true;
+  services.yabai.package = pkgs.yabai;
+  services.skhd.enable = true;

-  services.khd.enable = true;
-  services.khd.enableAccessibilityAccess = true;
-  services.kwm.enable = true;
-  services.kwm.enableAccessibilityAccess = true;
+  # security.sandbox.profiles.fetch-nixpkgs-updates.closure = [ pkgs.cacert pkgs.git ];
+  # security.sandbox.profiles.fetch-nixpkgs-updates.allowNetworking = true;
+  # security.sandbox.profiles.fetch-nixpkgs-updates.writablePaths = [ (toString ~/Code/nixos/nixpkgs) ];

-  launchd.user.agents.fetch-nixpkgs = {
-    command = "${pkgs.git}/bin/git -C ~/.nix-defexpr/nixpkgs fetch origin master";
-    environment.GIT_SSL_CAINFO = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
-    serviceConfig.KeepAlive = false;
-    serviceConfig.ProcessType = "Background";
-    serviceConfig.StartInterval = 60;
-  };
+  # launchd.user.agents.fetch-nixpkgs-updates = {
+  #   command = "/usr/bin/sandbox-exec -f ${config.security.sandbox.profiles.fetch-nixpkgs-updates.profile} ${pkgs.git}/bin/git -C ${toString ~/Code/nixos/nixpkgs} fetch origin master";
+  #   environment.HOME = "";
+  #   environment.NIX_SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+  #   serviceConfig.KeepAlive = false;
+  #   serviceConfig.ProcessType = "Background";
+  #   serviceConfig.StartInterval = 360;
+  # };

-  services.activate-system.enable = true;
-  # services.nix-daemon.enable = true;
-  # services.nix-daemon.tempDir = "/build/tmp";
+  # Dotfiles.
+  # launchd.user.agents.letty = {
+  #   serviceConfig.Program = "${pkgs.lnl.letty}/bin/letty-blink";
+  #   serviceConfig.WatchPaths = ["/var/mail/lnl"];
+  #   serviceConfig.KeepAlive = false;
+  #   serviceConfig.ProcessType = "Background";
+  # };
+
+  # services.nix-daemon.enableSocketListener = true;

-  # nix.distributedBuilds = true;
  nix.extraOptions = ''
    gc-keep-derivations = true
    gc-keep-outputs = true
-
-    pre-build-hook =
+    min-free = 17179870000
+    max-free = 17179870000
+    log-lines = 128
  '';

-  nix.binaryCachePublicKeys = [ "cache.daiderd.com-1:R8KOWZ8lDaLojqD+v9dzXAqGn29gEzPTTbr/GIpCTrI=" ];
-  nix.trustedBinaryCaches = [ https://d3i7ezr9vxxsfy.cloudfront.net ];
-  nix.trustedUsers = [ "@admin" ];
+  nix.settings.trusted-public-keys = [ "cache.daiderd.com-1:R8KOWZ8lDaLojqD+v9dzXAqGn29gEzPTTbr/GIpCTrI=" ];
+  nix.settings.trusted-substituters = [ "https://d3i7ezr9vxxsfy.cloudfront.net" ];

-  programs.nix-script.enable = true;
+  nix.settings.sandbox = true;
+  nix.settings.extra-sandbox-paths = [ "/private/tmp" "/private/var/tmp" "/usr/bin/env" ];
+
+  programs.nix-index.enable = true;
+
+  # programs.gnupg.agent.enable = true;
+  # programs.gnupg.agent.enableSSHSupport = true;

  programs.tmux.enable = true;
  programs.tmux.enableSensible = true;
@@ -73,143 +104,94 @@
  programs.tmux.enableFzf = true;
  programs.tmux.enableVim = true;

-  programs.tmux.tmuxConfig = ''
+  programs.tmux.extraConfig = ''
    bind 0 set status
+    bind S choose-session

+    bind-key -r "<" swap-window -t -1
+    bind-key -r ">" swap-window -t +1
+
+    bind-key -n M-c run "tmux send-keys -t .+ C-\\\\ && tmux send-keys -t .+ C-a C-k C-l Up && tmux send-keys -t .+ Enter"
+    bind-key -n M-r run "tmux send-keys -t .+ C-a C-k C-l Up && tmux send-keys -t .+ Enter"
+
+    set -g pane-active-border-style fg=black
+    set -g pane-border-style fg=black
    set -g status-bg black
    set -g status-fg white
+    set -g status-right '#[fg=white]#(id -un)@#(hostname)   #(jq --raw-output '.darwinLabel' /run/current-system/darwin-version.json)'
  '';

-  programs.vim.enable = true;
-  programs.vim.enableSensible = true;
+  environment.etc."nix/user-sandbox.sb".text = ''
+    (version 1)
+    (allow default)
+    (deny file-write*
+          (subpath "/nix"))
+    (allow file-write*
+           (subpath "/nix/var/nix/gcroots/per-user")
+           (subpath "/nix/var/nix/profiles/per-user"))

-  programs.vim.plugins = [
-    { names = [ "ReplaceWithRegister" "vim-indent-object" "vim-sort-motion" ]; }
-    { names = [ "ale" "vim-gitgutter" "vim-dispatch" ]; }
-    { names = [ "commentary" "vim-eunuch" "repeat" "tabular" ]; }
-    { names = [ "fzfWrapper" "youcompleteme" ]; }
-    { names = [ "gist-vim" "webapi-vim" ]; }
-    { names = [ "polyglot" "colors-solarized" ]; }
-    { names = [ "python-mode" ]; }
-  ];
+    (allow process-exec
+          (literal "/bin/ps")
+          (with no-sandbox))
+  '';

-  programs.vim.extraKnownPlugins = with pkgs; {
-    ale = vimUtils.buildVimPluginFrom2Nix {
-      name = "vim-ale-2017-05-16";
-      src = fetchgit {
-        url = "https://github.com/w0rp/ale";
-        rev = "e2860f8a26dc9c04bb4ad6fb59ffb8c743717149";
-        sha256 = "1mpqvfyl47ap32g9qprxpwfcgxhm25ar6qy3p01n77fygva0371d";
-      };
-    };
+  # programs.vim.enable = true;
+  # programs.vim.enableSensible = true;
+  programs.vim.package = pkgs.neovim.override {
+    configure = {
+      packages.darwin.start = with pkgs.vimPlugins; [
+        vim-sensible
+        vim-surround
+        ReplaceWithRegister
+        polyglot
+        fzfWrapper
+        ale
+        deoplete-nvim
+      ];

-    vim-nix = vimUtils.buildVimPluginFrom2Nix {
-      name = "vim-nix-2017-04-30";
-      src = fetchFromGitHub {
-        owner = "LnL7";
-        repo = "vim-nix";
-        rev = "867488a04c2ddc47f0f235f37599a06472fea299";
-        sha256 = "1mwc06z9q45cigyxd0r9qnfs4ph6lbcwx50rf5lmpavakcn3vqir";
-      };
+      customRC = ''
+        set completeopt=menuone
+        set encoding=utf-8
+        set hlsearch
+        set list
+        set number
+        set showcmd
+        set splitright
+
+        cnoremap %% <C-r>=expand('%:h') . '/'<CR>
+        nnoremap // :nohlsearch<CR>
+
+        let mapleader = ' '
+
+        " fzf
+        nnoremap <Leader>p :FZF<CR>
+
+        " vim-surround
+        vmap s S
+
+        " ale
+        nnoremap <Leader>d :ALEGoToDefinition<CR>
+        nnoremap <Leader>D :ALEGoToDefinitionInVSplit<CR>
+        nnoremap <Leader>k :ALESignature<CR>
+        nnoremap <Leader>K :ALEHover<CR>
+        nnoremap [a :ALEPreviousWrap<CR>
+        nnoremap ]a :ALENextWrap<CR>
+
+        " deoplete
+        inoremap <expr><C-g> deoplete#undo_completion()
+        inoremap <expr><C-l> deoplete#refresh()
+        inoremap <silent><expr><C-Tab> deoplete#mappings#manual_complete()
+        inoremap <silent><expr><Tab> pumvisible() ? "\<C-n>" : "\<TAB>"
+
+        let g:deoplete#enable_at_startup = 1
+      '';
    };
  };

-  programs.vim.vimConfig =  ''
-    colorscheme solarized
-    set bg=dark
+  # Dotfiles.
+  # programs.vim.package = mkForce pkgs.lnl.vim;

-    set clipboard=unnamed
-    set relativenumber
-
-    set backup
-    set backupdir=~/.vim/tmp/backup//
-    set backupskip=/tmp/*,/private/tmp/*
-    set directory=~/.vim/tmp/swap/
-    set noswapfile
-    set undodir=~/.vim/tmp/undo//
-    set undofile
-
-    if !isdirectory(expand(&undodir))
-      call mkdir(expand(&undodir), "p")
-    endif
-    if !isdirectory(expand(&backupdir))
-      call mkdir(expand(&backupdir), "p")
-    endif
-    if !isdirectory(expand(&directory))
-      call mkdir(expand(&directory), "p")
-    endif
-
-    vmap s S
-
-    inoremap <C-g> <Esc><CR>
-    vnoremap <C-g> <Esc><CR>
-    cnoremap <C-g> <Esc><CR>
-
-    cnoremap %% <C-r>=expand('%:h') . '/'<CR>
-
-    let mapleader = ' '
-    nnoremap <Leader>p :FZF<CR>
-    nnoremap <silent> <Leader>e :exe 'FZF ' . expand('%:h')<CR>
-
-    function! s:ag_to_qf(line)
-      let parts = split(a:line, ':')
-      return {'filename': parts[0], 'lnum': parts[1], 'col': parts[2],
-            \ 'text': join(parts[3:], ':')}
-    endfunction
-
-    function! s:ag_handler(lines)
-      if len(a:lines) < 2 | return | endif
-
-      let cmd = get({'ctrl-x': 'split',
-            \ 'ctrl-v': 'vertical split',
-            \ 'ctrl-t': 'tabe'}, a:lines[0], 'e')
-      let list = map(a:lines[1:], 's:ag_to_qf(v:val)')
-
-      let first = list[0]
-      execute cmd escape(first.filename, ' %#\')
-      execute first.lnum
-      execute 'normal!' first.col.'|zz'
-
-      if len(list) > 1
-        call setqflist(list)
-        copen
-        wincmd p
-      endif
-    endfunction
-
-    command! -nargs=* Ag call fzf#run({
-          \ 'source':  printf('${pkgs.ag}/bin/ag --nogroup --column --color "%s"',
-          \                   escape(empty(<q-args>) ? '^(?=.)' : <q-args>, '"\')),
-          \ 'sink*':   function('<sid>ag_handler'),
-          \ 'options': '--ansi --expect=ctrl-t,ctrl-v,ctrl-x --delimiter : --nth 4.. '.
-          \            '--multi --bind ctrl-a:select-all,ctrl-d:deselect-all '.
-          \            '--color hl:68,hl+:110',
-          \ 'down':    '50%' })
-
-    highlight clear SignColumn
-
-    let g:ale_sign_error = '⨉'
-    let g:ale_sign_warning = '⚠'
-
-    " let g:ycm_add_preview_to_completeopt = 1
-    let g:ycm_autoclose_preview_window_after_completion = 1
-    let g:ycm_autoclose_preview_window_after_insertion = 1
-
-    let g:ycm_seed_identifiers_with_syntax = 1
-    let g:ycm_semantic_triggers = {}
-
-    nmap <Leader>D :YcmCompleter GetDoc<CR>
-    nmap <Leader>d :YcmCompleter GoToDefinition<CR>
-    nmap <Leader>r :YcmCompleter GoToReferences<CR>
-
-    let g:pymode_folding = 0
-    let g:pymode_lint = 0
-    let g:pymode_options_colorcolumn = 0
-    let g:pymode_options_max_line_length = 120
-    let g:pymode_rope_complete_on_dot = 0
-    let g:pymode_rope_regenerate_on_write = 0
-
-  '';
+  programs.bash.completion.enable = true;

  programs.zsh.enable = true;
  programs.zsh.enableBashCompletion = true;
@@ -217,24 +199,62 @@
  programs.zsh.enableFzfGit = true;
  programs.zsh.enableFzfHistory = true;

-  programs.zsh.variables.cfg = "$HOME/.nixpkgs/darwin-config.nix";
+  programs.zsh.variables.cfg = "/etc/nix-darwin/configuration.nix";
  programs.zsh.variables.darwin = "$HOME/.nix-defexpr/darwin";
-  programs.zsh.variables.pkgs = "$HOME/.nix-defexpr/nixpkgs";
+  programs.zsh.variables.nixpkgs = "$HOME/.nix-defexpr/nixpkgs";


  programs.zsh.promptInit = ''
    autoload -U promptinit && promptinit

-    PROMPT='%B%(?..%? )%b⇒ '
-    RPROMPT='%F{green}%~%f'
+    setopt PROMPTSUBST
+
+    _prompt_nix() {
+      [ -z "$IN_NIX_SHELL" ] || echo "%F{yellow}%B[''${name:+$name}]%b%f "
+    }
+
+    PS1='%F{red}%B%(?..%? )%b%f%# '
+    RPS1='$(_prompt_nix)%F{green}%~%f'
+
+    if [ -n "$IN_NIX_SANDBOX" ]; then
+      PS1+='%F{red}[sandbox]%f '
+    fi
  '';

  programs.zsh.loginShellInit = ''
    reexec() {
-      unset __ETC_ZSHRC_SOURCED
-      unset __ETC_ZSHENV_SOURCED
-      unset __ETC_ZPROFILE_SOURCED
-      exec $SHELL -c 'echo "reexecuting shell: $SHELL" >&2 && exec $SHELL -l'
+        unset __NIX_DARWIN_SET_ENVIRONMENT_DONE
+        unset __ETC_ZPROFILE_SOURCED __ETC_ZSHENV_SOURCED __ETC_ZSHRC_SOURCED
+        exec $SHELL -c 'echo >&2 "reexecuting shell: $SHELL" && exec $SHELL -l'
+    }
+
+    reexec-tmux() {
+        unset __NIX_DARWIN_SET_ENVIRONMENT_DONE
+        unset __ETC_ZPROFILE_SOURCED __ETC_ZSHENV_SOURCED __ETC_ZSHRC_SOURCED
+        exec tmux new-session -A -s _ "$@"
+    }
+
+    reexec-sandbox() {
+        unset __NIX_DARWIN_SET_ENVIRONMENT_DONE
+        unset __ETC_ZPROFILE_SOURCED __ETC_ZSHENV_SOURCED __ETC_ZSHRC_SOURCED
+        export IN_NIX_SANDBOX=1
+        exec /usr/bin/sandbox-exec -f /etc/nix/user-sandbox.sb $SHELL -l
+    }
+
+    ls() {
+        ${pkgs.coreutils}/bin/ls --color=auto "$@"
+    }
+
+    install_name_tool() {
+        ${pkgs.darwin.cctools}/bin/install_name_tool "$@"
+    }
+
+    nm() {
+        ${pkgs.darwin.cctools}/bin/nm "$@"
+    }
+
+    otool() {
+        ${pkgs.darwin.cctools}/bin/otool "$@"
    }
  '';

@@ -249,330 +269,57 @@
    zle -N up-line-or-beginning-search
  '';

-  environment.variables.HOMEBREW_CASK_OPTS = "--appdir=/Applications/cask";
+  environment.variables.SHELL = "${pkgs.zsh}/bin/zsh";
+
+  environment.variables.LANG = "en_US.UTF-8";

  environment.shellAliases.g = "git log --pretty=color -32";
+  environment.shellAliases.gb = "git branch";
  environment.shellAliases.gc = "git checkout";
  environment.shellAliases.gcb = "git checkout -B";
  environment.shellAliases.gd = "git diff --minimal --patch";
  environment.shellAliases.gf = "git fetch";
-  environment.shellAliases.gl = "git log --pretty=color --graph";
-  environment.shellAliases.glog = "git log --pretty=nocolor";
+  environment.shellAliases.ga = "git log --pretty=color --all";
+  environment.shellAliases.gg = "git log --pretty=color --graph";
+  environment.shellAliases.gl = "git log --pretty=nocolor";
  environment.shellAliases.grh = "git reset --hard";
  environment.shellAliases.l = "ls -lh";
-  environment.shellAliases.ls = "ls -G";
-  environment.shellAliases.nb = "nix-build";
-  environment.shellAliases.ni = "nix-instantiate";
-  environment.shellAliases.ns = "nix-shell";

-  nix.nixPath =
-    [ # Use local nixpkgs checkout instead of channels.
-      "darwin=$HOME/.nix-defexpr/darwin"
-      "darwin-config=$HOME/.nixpkgs/darwin-configuration.nix"
-      "nixpkgs=$HOME/.nix-defexpr/nixpkgs"
-      "/nix/var/nix/profiles/per-user/root/channels"
-    ];
+  environment.extraInit = ''
+    # Load and export variables from environment.d.
+    if [ -d /etc/environment.d ]; then
+        set -a
+        . /etc/environment.d/*
+        set +a
+    fi
+  '';

  nixpkgs.config.allowUnfree = true;
-  nixpkgs.config.packageOverrides = pkgs: {
-    ycmd = pkgs.ycmd.override { gocode = null; godef = null; rustracerd = null; };
-  };

-  # TODO: add module for per-user config, etc, ...
-  environment.etc."per-user/lnl/gitconfig".text = ''
-    [include]
-      path = .gitconfig.local
+  nixpkgs.overlays = [
+    (self: super: {
+      vim_configurable = super.vim_configurable.override {
+        guiSupport = "no";
+      };
+    })
+  ];

-    [core]
-      excludesfile = ~/.gitignore
-      autocrlf     = input
+  # Dotfiles.
+  # nixpkgs.overlays = mkAfter inputs.dotfiles.darwinOverlays;

-    [color]
-      ui = auto
+  # Dotfiles.
+  # services.yabai.enable = true;
+  # services.yabai.package = pkgs.yabai;
+  # services.skhd.skhdConfig = builtins.readFile "${inputs.dotfiles}/skhd/skhdrc";
+  # services.yabai.extraConfig = builtins.readFile "${inputs.dotfiles}/yabai/yabairc";

-    [pretty]
-      color = format:%C(yellow)%h%Cblue%d%Creset %s %C(white)  %an, %ar%Creset
-      nocolor = format:%h%d %s   %an, %ar
+  # Dotfiles.
+  # $ cat ~/.gitconfig
+  # [include]
+  #     path = /etc/per-user/lnl/gitconfig
+  # environment.etc."per-user/lnl/gitconfig".text = builtins.readFile "${inputs.dotfiles}/git/gitconfig";

-    [user]
-      name = Daiderd Jordan
+  nix.nrBuildUsers = 32;

-    [github]
-      user = LnL7
-  '';
-
-  environment.etc."per-user/lnl/khdrc".text = ''
-    # remap left-control h/j/k/l -> arrow keys
-    lctrl - h         [Safari]      :   khd -p "- left"
-    lctrl - j         [Safari]      :   khd -p "- down"
-    lctrl - k         [Safari]      :   khd -p "- up"
-    lctrl - l         [Safari]      :   khd -p "- right"
-
-    shift + lctrl - h [Safari]      :   khd -p "shift - left"
-    shift + lctrl - j [Safari]      :   khd -p "shift - down"
-    shift + lctrl - k [Safari]      :   khd -p "shift - up"
-    shift + lctrl - l [Safari]      :   khd -p "shift - right"
-
-    # remap left-control a / e   -> start / end of line
-    lctrl - a         [Safari]      :   khd -p "cmd - left"
-    lctrl - e         [Safari]      :   khd -p "cmd - right"
-
-    shift + lctrl - e [Safari]      :   khd -p "shift + cmd - left"
-    shift + lctrl - e [Safari]      :   khd -p "shift + cmd - right"
-
-    # remap left-control b / w   -> start / end of word
-    lctrl - b         [Safari]      :   khd -p "alt - left"
-    lctrl - w         [Safari]      :   khd -p "alt - right"
-
-    shift + lctrl - b [Safari]      :   khd -p "shift + alt - left"
-    shift + lctrl - w [Safari]      :   khd -p "shift + alt - right"
-
-    # remap left-control u / d   -> page up / page down
-    lctrl - u         [Safari]      :   khd -p "alt - up"
-    lctrl - d         [Safari]      :   khd -p "alt - down"
-
-    shift + lctrl - u [Safari]      :   khd -p "shift + alt - up"
-    shift + lctrl - d [Safari]      :   khd -p "shift + alt - down"
-
-    # remap left-control x       -> forward delete
-    lctrl - x         [Safari]      :   khd -p "- delete"
-
-    # remap left-control g       -> escape
-    lctrl - g         [Safari]      :   khd -p "0x35"
-
-
-    # modifier only mappings
-    khd mod_trigger_timeout 0.2
-    lctrl    :   khd -p "0x35"
-    lshift   :   khd -p "shift - 9"
-    rshift   :   khd -p "shift - 0"
-
-
-    # enable kwm compatibility mode
-    khd kwm on
-
-
-    # set border color for different modes
-    # khd mode default color 0xddd5c4a1
-    khd mode default color 0x00000000
-    khd mode switcher color 0xddbdd322
-    khd mode scratchpad color 0xddd75f5f
-    khd mode swap color 0xdd458588
-    khd mode tree color 0xddfabd2f
-    khd mode space color 0xddb16286
-    khd mode info color 0xddcd950c
-
-
-    # toggle between modes
-    alt - f                 :   khd -e "mode activate switcher"
-    switcher + alt - f      :   khd -e "mode activate default"
-    swap + alt - f          :   khd -e "mode activate switcher"
-    space + alt - f         :   khd -e "mode activate switcher"
-    tree + alt - f          :   khd -e "mode activate switcher"
-    info + alt - f          :   khd -e "mode activate switcher"
-    scratchpad + alt - f    :   khd -e "mode activate switcher"
-
-    switcher + alt - g      :   khd -e "mode activate default"
-    swap + alt - g          :   khd -e "mode activate default"
-    space + alt - g         :   khd -e "mode activate default"
-    tree + alt - g          :   khd -e "mode activate default"
-    info + alt - g          :   khd -e "mode activate default"
-    scratchpad + alt - g    :   khd -e "mode activate default"
-    switcher + ctrl - g     :   khd -e "mode activate default"
-    swap + ctrl - g         :   khd -e "mode activate default"
-    space + ctrl - g        :   khd -e "mode activate default"
-    tree + ctrl - g         :   khd -e "mode activate default"
-    info + ctrl - g         :   khd -e "mode activate default"
-    scratchpad + ctrl - g   :   khd -e "mode activate default"
-    switcher - 0x35         :   khd -e "mode activate default"
-    swap - 0x35             :   khd -e "mode activate default"
-    space - 0x35            :   khd -e "mode activate default"
-    tree - 0x35             :   khd -e "mode activate default"
-    info - 0x35             :   khd -e "mode activate default"
-    scratchpad - 0x35       :   khd -e "mode activate default"
-
-    switcher - w            :   khd -e "mode activate scratchpad"
-    switcher - a            :   khd -e "mode activate swap"
-    switcher - s            :   khd -e "mode activate space"
-    switcher - d            :   khd -e "mode activate tree"
-    switcher - q            :   khd -e "mode activate info"
-
-
-    # switcher mode
-    switcher - r            :   khd -e "reload" # reload config
-    switcher + shift - r    :   khd -e "mode activate default";\
-                            :   killall kwm     # restart kwm
-
-    switcher - return       :   open -na /Applications/Utilities/Terminal.app;\
-                                khd -e "mode activate default"
-
-    switcher - h            :   kwmc window -f west
-    switcher - l            :   kwmc window -f east
-    switcher - j            :   kwmc window -f south
-    switcher - k            :   kwmc window -f north
-    switcher - n            :   kwmc window -fm prev
-    switcher - m            :   kwmc window -fm next
-
-    switcher - 1            :   kwmc space -fExperimental 1
-    switcher - 2            :   kwmc space -fExperimental 2
-    switcher - 3            :   kwmc space -fExperimental 3
-    switcher - 4            :   kwmc space -fExperimental 4
-    switcher - 5            :   kwmc space -fExperimental 5
-    switcher - 6            :   kwmc space -fExperimental 6
-
-    switcher - z            :   kwmc space -fExperimental left
-    switcher - c            :   kwmc space -fExperimental right
-    switcher - f            :   kwmc space -fExperimental previous
-
-    switcher + shift - z    :   kwmc window -m space left;\
-                                kwmc space -fExperimental left
-
-    switcher + shift - c    :   kwmc window -m space right;\
-                                kwmc space -fExperimental right
-
-    switcher + shift - 1    :   kwmc display -f 0
-    switcher + shift - 2    :   kwmc display -f 1
-    switcher + shift - 3    :   kwmc display -f 2
-
-
-    scratchpad - a          :   kwmc scratchpad add
-    scratchpad - s          :   kwmc scratchpad toggle 0
-    scratchpad - d          :   kwmc scratchpad remove
-
-    scratchpad - 1          :   kwmc scratchpad toggle 1
-    scratchpad - 2          :   kwmc scratchpad toggle 2
-    scratchpad - 3          :   kwmc scratchpad toggle 3
-    scratchpad - 4          :   kwmc scratchpad toggle 4
-    scratchpad - 5          :   kwmc scratchpad toggle 5
-    scratchpad - 6          :   kwmc scratchpad toggle 6
-
-
-    # swap mode
-    swap - h                :   kwmc window -s west
-    swap - j                :   kwmc window -s south
-    swap - k                :   kwmc window -s north
-    swap - l                :   kwmc window -s east
-    swap - m                :   kwmc window -s mark
-
-    swap + shift - k        :   kwmc window -m north
-    swap + shift - l        :   kwmc window -m east
-    swap + shift - j        :   kwmc window -m south
-    swap + shift - h        :   kwmc window -m west
-    swap + shift - m        :   kwmc window -m mark
-
-    swap - 1                :   kwmc window -m space 1
-    swap - 2                :   kwmc window -m space 2
-    swap - 3                :   kwmc window -m space 3
-    swap - 4                :   kwmc window -m space 4
-    swap - 5                :   kwmc window -m space 5
-
-    swap - z                :   kwmc window -m space left
-    swap - c                :   kwmc window -m space right
-
-    swap + shift - 1        :   kwmc window -m display 0
-    swap + shift - 2        :   kwmc window -m display 1
-    swap + shift - 3        :   kwmc window -m display 2
-
-
-    # space mode
-    space - a               :   kwmc space -t bsp
-    space - s               :   kwmc space -t monocle
-    space - d               :   kwmc space -t float
-
-    space - x               :   kwmc space -g increase horizontal
-    space - y               :   kwmc space -g increase vertical
-
-    space + shift - x       :   kwmc space -g decrease horizontal
-    space + shift - y       :   kwmc space -g decrease vertical
-
-    space - left            :   kwmc space -p increase left
-    space - right           :   kwmc space -p increase right
-    space - up              :   kwmc space -p increase top
-    space - down            :   kwmc space -p increase bottom
-    space - p               :   kwmc space -p increase all
-
-    space + shift - left    :   kwmc space -p decrease left
-    space + shift - right   :   kwmc space -p decrease right
-    space + shift - up      :   kwmc space -p decrease top
-    space + shift - down    :   kwmc space -p decrease bottom
-    space + shift - p       :   kwmc space -p decrease all
-
-
-    # tree mode
-    tree - a                :   kwmc window -c type bsp
-    tree - s                :   kwmc window -c type monocle
-    tree - f                :   kwmc window -z fullscreen
-    tree - d                :   kwmc window -z parent
-    tree - w                :   kwmc window -t focused
-    tree - r                :   kwmc tree rotate 90
-
-    tree - q                :   kwmc window -c split - mode toggle;\
-                                khd -e "mode activate default"
-
-    tree - c                :   kwmc window -c type toggle;\
-                                khd -e "mode activate default"
-
-    tree - h                :   kwmc window -c expand 0.05 west
-    tree - j                :   kwmc window -c expand 0.05 south
-    tree - k                :   kwmc window -c expand 0.05 north
-    tree - l                :   kwmc window -c expand 0.05 east
-    tree + shift - h        :   kwmc window -c reduce 0.05 west
-    tree + shift - j        :   kwmc window -c reduce 0.05 south
-    tree + shift - k        :   kwmc window -c reduce 0.05 north
-    tree + shift - l        :   kwmc window -c reduce 0.05 east
-
-    tree - p                :   kwmc tree -pseudo create
-    tree + shift - p        :   kwmc tree -pseudo destroy
-
-    tree - o                :   kwmc window -s prev
-    tree + shift - o        :   kwmc window -s next
-  '';
-
-  environment.etc."per-user/lnl/kwm/kwmrc".text = ''
-    kwmc config tiling bsp
-    kwmc config split-ratio 0.5
-    kwmc config spawn left
-
-
-    kwmc config padding 28 2 2 2
-    kwmc config gap 2 2
-    kwmc config display 1 padding 40 20 20 20
-    kwmc config display 1 gap 10 10
-    kwmc config display 2 padding 40 20 20 20
-    kwmc config display 2 gap 10 10
-
-    kwmc config space 0 1 name main
-    kwmc config space 0 2 name rnd
-    kwmc config space 0 3 mode monocle
-    kwmc config space 0 3 name web
-    kwmc config space 1 1 name rnd
-    kwmc config space 1 1 mode monocle
-    kwmc config space 2 1 name web
-
-
-    kwmc config focus-follows-mouse on
-    kwmc config mouse-follows-focus on
-    kwmc config standby-on-float on
-    kwmc config center-on-float on
-    kwmc config float-non-resizable on
-    kwmc config lock-to-container on
-    kwmc config cycle-focus on
-    kwmc config optimal-ratio 1.605
-
-    kwmc config border focused on
-    kwmc config border focused size 2
-    kwmc config border focused color 0x00000000
-    kwmc config border focused radius 6
-
-    kwmc config border marked on
-    kwmc config border marked size 2
-    kwmc config border marked color 0xDD7f7f7f
-    kwmc config border marked radius 6
-
-    kwmc rule owner="Airmail" properties={float="true"}
-    kwmc rule owner="Apple Store" properties={float="true"}
-    kwmc rule owner="System Preferences" properties={float="true"}
-    kwmc rule owner="iTerm2" properties={role="AXDialog"}
-    kwmc rule owner="iTunes" properties={float="true"}
-  '';
+  system.stateVersion = 6;
 }
@@ -1,16 +1,16 @@
-{ config, lib, pkgs, ... }:
-{
+{ config, pkgs, ... }:

+{
  # List packages installed in system profile. To search by name, run:
  # $ nix-env -qaP | grep wget
  environment.systemPackages =
-    [ pkgs.nix-repl
+    [ pkgs.vim
    ];

-  # Create /etc/bashrc that loads the nix-darwin environment.
-  programs.bash.enable = true;
-
-  # Recreate /run/current-system symlink after boot.
-  services.activate-system.enable = true;
+  # Enable alternative shell support in nix-darwin.
+  # programs.fish.enable = true;

+  # Used for backwards compatibility, please read the changelog before changing.
+  # $ darwin-rebuild changelog
+  system.stateVersion = 6;
 }
@@ -0,0 +1,67 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.fonts;
+in
+
+{
+  imports = [
+    (lib.mkRemovedOptionModule [ "fonts" "enableFontDir" ] "No nix-darwin equivalent to this NixOS option. This is not required to install fonts.")
+    (lib.mkRemovedOptionModule [ "fonts" "fontDir" "enable" ] "No nix-darwin equivalent to this NixOS option. This is not required to install fonts.")
+    (lib.mkRemovedOptionModule [ "fonts" "fonts" ] ''
+      This option has been renamed to `fonts.packages' for consistency with NixOS.
+
+      Note that the implementation now keeps fonts in `/Library/Fonts/Nix Fonts' to allow them to coexist with fonts not managed by nix-darwin; existing fonts will be left directly in `/Library/Fonts' without getting updates and should be manually removed.'')
+  ];
+
+  options = {
+    fonts.packages = lib.mkOption {
+      type = lib.types.listOf lib.types.path;
+      default = [ ];
+      example = lib.literalExpression "[ pkgs.dejavu_fonts ]";
+      description = ''
+        List of fonts to install into {file}`/Library/Fonts/Nix Fonts`.
+      '';
+    };
+  };
+
+  config = {
+
+    system.build.fonts = pkgs.runCommand "fonts"
+      { preferLocalBuild = true; }
+      ''
+        mkdir -p $out/Library/Fonts
+        store_dir=${lib.escapeShellArg builtins.storeDir}
+        while IFS= read -rd "" f; do
+          dest="$out/Library/Fonts/Nix Fonts/''${f#"$store_dir/"}"
+          mkdir -p "''${dest%/*}"
+          ln -sf "$f" "$dest"
+        done < <(
+          find -L ${lib.escapeShellArgs cfg.packages} \
+            -type f \
+            -regex '.*\.\(ttf\|ttc\|otf\|dfont\)' \
+            -print0
+        )
+      '';
+
+    system.activationScripts.fonts.text = ''
+      printf >&2 'setting up /Library/Fonts/Nix Fonts...\n'
+
+      # rsync uses the mtime + size of files to determine whether they
+      # need to be copied by default. This is inadequate for Nix store
+      # paths, but we don't want to use `--checksum` as it makes
+      # activation consistently slow when you have large fonts
+      # installed. Instead, we ensure that fonts are linked according to
+      # their full store paths in `system.build.fonts`, so that any
+      # given font path should only ever have one possible content.
+      ${pkgs.rsync}/bin/rsync \
+        --archive \
+        --copy-links \
+        --delete-during \
+        --delete-missing-args \
+        "$systemConfig/Library/Fonts/Nix Fonts" \
+        '/Library/Fonts/'
+    '';
+
+  };
+}
@@ -1,17 +1,15 @@
 { config, lib, pkgs, ... }:

-with import ./lib.nix { inherit lib; };
 with lib;

 let
-
  inherit (pkgs) stdenv;

  cfg = config.launchd;

  toEnvironmentText = name: value: {
    name = "${value.serviceConfig.Label}.plist";
-    value.text = toPLIST value.serviceConfig;
+    value.text = generators.toPlist { escape = true; } value.serviceConfig;
  };

  launchdConfig = import ./launchd.nix;
@@ -22,7 +20,6 @@ let
    { config, name, ... }:
    let

-      cmd = config.command;
      env = config.environment // optionalAttrs (config.path != "") { PATH = config.path; };

    in
@@ -37,11 +34,11 @@ let
        };

        path = mkOption {
-          type = types.loeOf (types.either types.path types.str);
+          type = types.listOf (types.either types.path types.str);
          default = [];
          description = ''
-            Packages added to the service's <envar>PATH</envar>
-            environment variable.  Only the <filename>bin</filename>
+            Packages added to the service's {env}`PATH`
+            environment variable.  Only the {file}`bin`
            and subdirectories of each package is added.
          '';
          apply = ps: if isList ps then (makeDrvBinPath ps) else ps;
@@ -76,8 +73,8 @@ let
            };
          default = {};
          description = ''
-            Each attribute in this set specifies an option for a <key> in the plist.
-            https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man5/launchd.plist.5.html
+            Each attribute in this set specifies an option for a key in the plist.
+            <https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man5/launchd.plist.5.html>
          '';
        };
      };
@@ -89,16 +86,28 @@ let
          ${config.script}
        '');

-        serviceConfig.Label = mkDefault "org.nixos.${name}";
-        serviceConfig.ProgramArguments = mkIf (cmd != "") [ "/bin/sh" "-c" "exec ${cmd}" ];
+        serviceConfig.Label = mkDefault "${cfg.labelPrefix}.${name}";
+        serviceConfig.ProgramArguments = mkIf (config.command != "") [
+          "/bin/sh"
+          "-c"
+          "/bin/wait4path /nix/store && exec ${config.command}"
+        ];
        serviceConfig.EnvironmentVariables = mkIf (env != {}) env;
      };
    };
-
 in

 {
  options = {
+    launchd.labelPrefix = mkOption {
+      type = types.str;
+      default = "org.nixos";
+      description = ''
+        The default prefix of the service label. Individual services can
+        override this by setting the Label attribute.
+      '';
+    };
+
    launchd.envVariables = mkOption {
      type = types.attrsOf (types.either types.str (types.listOf types.str));
      default = {};
@@ -161,7 +170,16 @@ in

    launchd.user.agents = mkOption {
      default = {};
-      type = types.attrsOf (types.submodule serviceOptions);
+      type = types.attrsOf (types.submodule [
+        serviceOptions
+        ({ name, ... }: {
+          options.managedBy = lib.mkOption {
+            type = lib.types.str;
+            internal = true;
+            default = lib.showOption [ "launchd" "user" "agents" name ];
+          };
+        })
+      ]);
      description = ''
        Definition of per-user launchd agents.

@@ -178,6 +196,18 @@ in

  config = {

+    system.requiresPrimaryUser =
+      lib.map (
+        name:
+        lib.showOption [
+          "launchd"
+          "user"
+          "envVariables"
+          name
+        ]
+      ) (attrNames cfg.user.envVariables)
+      ++ lib.map ({ managedBy, ... }: managedBy) (attrValues cfg.user.agents);
+
    environment.launchAgents = mapAttrs' toEnvironmentText cfg.agents;
    environment.launchDaemons = mapAttrs' toEnvironmentText cfg.daemons;

@@ -2,32 +2,35 @@

 with lib;

+let
+  launchdTypes = import ./types.nix { inherit config lib; };
+in
+
 {
  options = {
    Label = mkOption {
      type = types.str;
-      description = ''
-        This required key uniquely identifies the job to launchd.
-      '';
+      description = "This required key uniquely identifies the job to launchd.";
    };

    Disabled = mkOption {
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        This optional key is used as a hint to launchctl(1) that it should not submit this job to launchd when
-        loading a job or jobs. The value of this key does NOT reflect the current state of the job on the run-ning running
-        ning system. If you wish to know whether a job is loaded in launchd, reading this key from a configura-tion configuration
-        tion file yourself is not a sufficient test. You should query launchd for the presence of the job using
-        the launchctl(1) list subcommand or use the ServiceManagement framework's SMJobCopyDictionary() method.
+        This optional key is used as a hint to `launchctl(1)` that it should not submit this job to launchd when
+        loading a job or jobs. The value of this key does NOT reflect the current state of the job on the running
+        system. If you wish to know whether a job is loaded in launchd, reading this key from a configuration
+        file yourself is not a sufficient test. You should query launchd for the presence of the job using
+        the `launchctl(1)` list subcommand or use the ServiceManagement framework's
+        `SMJobCopyDictionary()` method.

        Note that as of Mac OS X v10.6, this key's value in a configuration file conveys a default value, which
-        is changed with the [-w] option of the launchctl(1) load and unload subcommands. These subcommands no
-        longer modify the configuration file, so the value displayed in the configuration file is not necessar-ily necessarily
-        ily the value that launchctl(1) will apply. See launchctl(1) for more information.
+        is changed with the [-w] option of the `launchctl(1)` load and unload subcommands. These subcommands no
+        longer modify the configuration file, so the value displayed in the configuration file is not necessarily
+        the value that `launchctl(1)` will apply. See `launchctl(1)` for more information.

-        Please also be mindful that you should only use this key if the provided on-demand and KeepAlive crite-ria criteria
-        ria are insufficient to describe the conditions under which your job needs to run. The cost to have a
+        Please also be mindful that you should only use this key if the provided on-demand and KeepAlive criteria
+        are insufficient to describe the conditions under which your job needs to run. The cost to have a
        job loaded in launchd is negligible, so there is no harm in loading a job which only runs once or very
        rarely.
      '';
@@ -61,11 +64,11 @@ with lib;
      type = types.nullOr (types.submodule {
        options = {
          Wait = mkOption {
-            type = types.nullOr types.str;
+            type = types.nullOr (types.either types.bool types.str);
            default = null;
            description = ''
              This flag corresponds to the "wait" or "nowait" option of inetd. If true, then the listening
-              socket is passed via the standard in/out/error file descriptors. If false, then accept(2) is
+              socket is passed via the standard in/out/error file descriptors. If false, then `accept(2)` is
              called on behalf of the job, and the result is passed via the standard in/out/error descriptors.
            '';
          };
@@ -77,8 +80,8 @@ with lib;
      type = types.nullOr (types.listOf types.str);
      default = null;
      description = ''
-        This configuration file only applies to the hosts listed with this key. Note: One should set kern.host-name kern.hostname
-        name in sysctl.conf(5) for this feature to work reliably.
+        This configuration file only applies to the hosts listed with this key. Note: One should set kern.hostname
+        in `sysctl.conf(5)` for this feature to work reliably.
      '';
    };

@@ -86,17 +89,17 @@ with lib;
      type = types.nullOr (types.listOf types.str);
      default = null;
      description = ''
-        This configuration file only applies to hosts NOT listed with this key. Note: One should set kern.host-name kern.hostname
-        name in sysctl.conf(5) for this feature to work reliably.
+        This configuration file only applies to hosts NOT listed with this key. Note: One should set kern.hostname
+        in `sysctl.conf(5)` for this feature to work reliably.
      '';
    };

    LimitLoadToSessionType = mkOption {
-      type = types.nullOr types.str;
+      type = types.nullOr (types.oneOf [types.str (types.listOf types.str)]);
      default = null;
      description = ''
        This configuration file only applies to sessions of the type specified. This key is used in concert
-        with the -S flag to launchctl.
+        with the -S flag to {command}`launchctl`.
      '';
    };

@@ -104,7 +107,7 @@ with lib;
      type = types.nullOr types.path;
      default = null;
      description = ''
-        This key maps to the first argument of execvp(3).  If this key is missing, then the first element of
+        This key maps to the first argument of `execvp(3)`.  If this key is missing, then the first element of
        the array of strings provided to the ProgramArguments will be used instead.  This key is required in
        the absence of the ProgramArguments key.
      '';
@@ -114,17 +117,28 @@ with lib;
      type = types.nullOr (types.listOf types.str);
      default = null;
      description = ''
-        This key maps to the second argument of execvp(3).  This key is required in the absence of the Program
-        key. Please note: many people are confused by this key. Please read execvp(3) very carefully!
+        This key maps to the second argument of `execvp(3)`.  This key is required in the absence of the Program
+        key. Please note: many people are confused by this key. Please read `execvp(3)` very carefully!
      '';
+      # TODO: Remove this some time after 25.11.
+      apply =
+        val:
+        if (builtins.isNull val) then
+          val
+        else
+          (map (
+            item:
+            lib.warnIf (lib.hasInfix "&amp;" item)
+              "A value for `ProgramArguments` contains the literal string `&amp;`. This is no longer necessary and will lead to double-escaping, as nix-darwin now automatically escapes special characters."
+            item
+          ) val);
    };

    EnableGlobbing = mkOption {
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        This flag causes launchd to use the glob(3) mechanism to update the program arguments before invoca-tion. invocation.
-        tion.
+        This flag causes launchd to use the `glob(3)` mechanism to update the program arguments before invocation.
      '';
    };

@@ -132,8 +146,8 @@ with lib;
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        This flag instructs launchd that the job promises to use vproc_transaction_begin(3) and
-        vproc_transaction_end(3) to track outstanding transactions that need to be reconciled before the
+        This flag instructs launchd that the job promises to use `vproc_transaction_begin(3)` and
+        `vproc_transaction_end(3)` to track outstanding transactions that need to be reconciled before the
        process can safely terminate. If no outstanding transactions are in progress, then launchd is free to
        send the SIGKILL signal.
      '';
@@ -195,14 +209,29 @@ with lib;
            '';
          };

+          Crashed = mkOption {
+            type = types.nullOr types.bool;
+            default = null;
+            description = ''
+              If true, the the job will be restarted as long as it exited due to a signal which is typically
+              associated with a crash (SIGILL, SIGSEGV, etc.). If false, the job will be restarted in the
+              inverse condition.
+            '';
+          };
+
+          AfterInitialDemand = mkOption {
+            type = types.nullOr types.bool;
+            default = null;
+          };
+
        };
      }));
      default = null;
      description = ''
        This optional key is used to control whether your job is to be kept continuously running or to let
        demand and conditions control the invocation. The default is false and therefore only demand will start
-        the job. The value may be set to true to unconditionally keep the job alive. Alternatively, a dictio-nary dictionary
-        nary of conditions may be specified to selectively control whether launchd keeps a job alive or not. If
+        the job. The value may be set to true to unconditionally keep the job alive. Alternatively, a dictionary
+        of conditions may be specified to selectively control whether launchd keeps a job alive or not. If
        multiple keys are provided, launchd ORs them, thus providing maximum flexibility to the job to refine
        the logic and stall if necessary. If launchd finds no reason to restart the job, it falls back on
        demand based invocation.  Jobs that exit quickly and frequently when configured to be kept alive will
@@ -223,7 +252,7 @@ with lib;
      type = types.nullOr types.str;
      default = null;
      description = ''
-        This optional key is used to specify a directory to chroot(2) to before running the job.
+        This optional key is used to specify a directory to `chroot(2)` to before running the job.
      '';
    };

@@ -231,7 +260,7 @@ with lib;
      type = types.nullOr types.str;
      default = null;
      description = ''
-        This optional key is used to specify a directory to chdir(2) to before running the job.
+        This optional key is used to specify a directory to `chdir(2)` to before running the job.
      '';
    };

@@ -239,7 +268,7 @@ with lib;
      type = types.nullOr (types.attrsOf types.str);
      default = null;
      description = ''
-        This optional key is used to specify additional environmental variables to be set before running the
+        This optional key is used to specify additional environment variables to be set before running the
        job.
      '';
    };
@@ -248,7 +277,7 @@ with lib;
      type = types.nullOr types.int;
      default = null;
      description = ''
-        This optional key specifies what value should be passed to umask(2) before running the job. Known bug:
+        This optional key specifies what value should be passed to `umask(2)` before running the job. Known bug:
        Property lists don't support octal, so please convert the value to decimal.
      '';
    };
@@ -287,7 +316,7 @@ with lib;
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        This optional key specifies whether initgroups(3) should be called before running the job.  The default
+        This optional key specifies whether `initgroups(3)` should be called before running the job.  The default
        is true in 10.5 and false in 10.4. This key will be ignored if the UserName key is not set.
      '';
    };
@@ -329,57 +358,23 @@ with lib;

    StartCalendarInterval = mkOption {
      default = null;
-      example = { Hour = 2; Minute = 30; };
+      example = [{ Hour = 2; Minute = 30; }];
      description = ''
-        This optional key causes the job to be started every calendar interval as specified. Missing arguments
-        are considered to be wildcard. The semantics are much like crontab(5).  Unlike cron which skips job
-        invocations when the computer is asleep, launchd will start the job the next time the computer wakes
+        This optional key causes the job to be started every calendar interval as specified. The semantics are
+        much like {manpage}`crontab(5)`: Missing attributes are considered to be wildcard. Unlike cron which skips
+        job invocations when the computer is asleep, launchd will start the job the next time the computer wakes
        up.  If multiple intervals transpire before the computer is woken, those events will be coalesced into
-        one event upon wake from sleep.
+        one event upon waking from sleep.
+
+        ::: {.important}
+        The list must not be empty and must not contain duplicate entries (attrsets which compare equally).
+        :::
+
+        ::: {.caution}
+        Since missing attrs become wildcards, an empty attrset effectively means "every minute".
+        :::
      '';
-      type = types.nullOr (types.listOf (types.submodule {
-        options = {
-          Minute = mkOption {
-            type = types.nullOr types.int;
-            default = null;
-            description = ''
-              The minute on which this job will be run.
-            '';
-          };
-
-          Hour = mkOption {
-            type = types.nullOr types.int;
-            default = null;
-            description = ''
-              The hour on which this job will be run.
-            '';
-          };
-
-          Day = mkOption {
-            type = types.nullOr types.int;
-            default = null;
-            description = ''
-              The day on which this job will be run.
-            '';
-          };
-
-          Weekday = mkOption {
-            type = types.nullOr types.int;
-            default = null;
-            description = ''
-              The weekday on which this job will be run (0 and 7 are Sunday).
-            '';
-          };
-
-          Month = mkOption {
-            type = types.nullOr types.int;
-            default = null;
-            description = ''
-              The month on which this job will be run.
-            '';
-          };
-        };
-      }));
+      type = types.nullOr launchdTypes.StartCalendarInterval;
    };

    StandardInPath = mkOption {
@@ -387,7 +382,7 @@ with lib;
      default = null;
      description = ''
        This optional key specifies what file should be used for data being supplied to stdin when using
-        stdio(3).
+        `stdio(3)`.
      '';
    };

@@ -395,7 +390,7 @@ with lib;
      type = types.nullOr types.path;
      default = null;
      description = ''
-        This optional key specifies what file should be used for data being sent to stdout when using stdio(3).
+        This optional key specifies what file should be used for data being sent to stdout when using `stdio(3)`.
      '';
    };

@@ -403,7 +398,7 @@ with lib;
      type = types.nullOr types.path;
      default = null;
      description = ''
-        This optional key specifies what file should be used for data being sent to stderr when using stdio(3).
+        This optional key specifies what file should be used for data being sent to stderr when using `stdio(3)`.
      '';
    };

@@ -428,7 +423,7 @@ with lib;
    SoftResourceLimits = mkOption {
      default = null;
      description = ''
-        Resource limits to be imposed on the job. These adjust variables set with setrlimit(2).  The following
+        Resource limits to be imposed on the job. These adjust variables set with `setrlimit(2)`.  The following
        keys apply:
      '';
      type = types.nullOr (types.submodule {
@@ -454,7 +449,7 @@ with lib;
            default = null;
            description = ''
              The maximum size (in bytes) of the data segment for a process; this defines how far a program may
-              extend its break with the sbrk(2) system call.
+              extend its break with the `sbrk(2)` system call.
            '';
          };

@@ -479,8 +474,8 @@ with lib;
            default = null;
            description = ''
              The maximum number of open files for this process.  Setting this value in a system wide daemon
-              will set the sysctl(3) kern.maxfiles (SoftResourceLimits) or kern.maxfilesperproc (HardResource-Limits) (HardResourceLimits)
-              Limits) value in addition to the setrlimit(2) values.
+              will set the `sysctl(3)` kern.maxfiles (SoftResourceLimits) or kern.maxfilesperproc (HardResourceLimits)
+              value in addition to the `setrlimit(2)` values.
            '';
          };

@@ -489,8 +484,8 @@ with lib;
            default = null;
            description = ''
              The maximum number of simultaneous processes for this user id.  Setting this value in a system
-              wide daemon will set the sysctl(3) kern.maxproc (SoftResourceLimits) or kern.maxprocperuid
-              (HardResourceLimits) value in addition to the setrlimit(2) values.
+              wide daemon will set the `sysctl(3)` kern.maxproc (SoftResourceLimits) or kern.maxprocperuid
+              (HardResourceLimits) value in addition to the `setrlimit(2)` values.
            '';
          };

@@ -520,7 +515,7 @@ with lib;
      default = null;
      example = { NumberOfFiles = 4096; };
      description = ''
-        Resource limits to be imposed on the job. These adjust variables set with setrlimit(2).  The following
+        Resource limits to be imposed on the job. These adjust variables set with `setrlimit(2)`.  The following
        keys apply:
      '';
      type = types.nullOr (types.submodule {
@@ -546,7 +541,7 @@ with lib;
            default = null;
            description = ''
              The maximum size (in bytes) of the data segment for a process; this defines how far a program may
-              extend its break with the sbrk(2) system call.
+              extend its break with the `sbrk(2)` system call.
            '';
          };

@@ -562,7 +557,7 @@ with lib;
            type = types.nullOr types.int;
            default = null;
            description = ''
-              The maximum size (in bytes) which a process may lock into memory using the mlock(2) function.
+              The maximum size (in bytes) which a process may lock into memory using the `mlock(2)` function.
            '';
          };

@@ -571,8 +566,8 @@ with lib;
            default = null;
            description = ''
              The maximum number of open files for this process.  Setting this value in a system wide daemon
-              will set the sysctl(3) kern.maxfiles (SoftResourceLimits) or kern.maxfilesperproc (HardResource-Limits) (HardResourceLimits)
-              Limits) value in addition to the setrlimit(2) values.
+              will set the `sysctl(3)` kern.maxfiles (SoftResourceLimits) or kern.maxfilesperproc (HardResourceLimits)
+              value in addition to the `setrlimit(2)` values.
            '';
          };

@@ -581,8 +576,8 @@ with lib;
            default = null;
            description = ''
              The maximum number of simultaneous processes for this user id.  Setting this value in a system
-              wide daemon will set the sysctl(3) kern.maxproc (SoftResourceLimits) or kern.maxprocperuid
-              (HardResourceLimits) value in addition to the setrlimit(2) values.
+              wide daemon will set the `sysctl(3)` kern.maxproc (SoftResourceLimits) or kern.maxprocperuid
+              (HardResourceLimits) value in addition to the `setrlimit(2)` values.
            '';
          };

@@ -625,22 +620,22 @@ with lib;
        resource limits based on what kind of job it is. If left unspecified, the system will apply light
        resource limits to the job, throttling its CPU usage and I/O bandwidth. The following are valid values:

-           Background
-           Background jobs are generally processes that do work that was not directly requested by the user.
-           The resource limits applied to Background jobs are intended to prevent them from disrupting the
-           user experience.
+        Background
+        : Background jobs are generally processes that do work that was not directly requested by the user.
+          The resource limits applied to Background jobs are intended to prevent them from disrupting the
+          user experience.

-           Standard
-           Standard jobs are equivalent to no ProcessType being set.
+        Standard
+        : Standard jobs are equivalent to no ProcessType being set.

-           Adaptive
-           Adaptive jobs move between the Background and Interactive classifications based on activity over
-           XPC connections. See xpc_transaction_begin(3) for details.
+        Adaptive
+        : Adaptive jobs move between the Background and Interactive classifications based on activity over
+          XPC connections. See `xpc_transaction_begin(3)` for details.

-           Interactive
-           Interactive jobs run with the same resource limitations as apps, that is to say, none. Interac-tive Interactive
-           tive jobs are critical to maintaining a responsive user experience, and this key should only be
-           used if an app's ability to be responsive depends on it, and cannot be made Adaptive.
+        Interactive
+        : Interactive jobs run with the same resource limitations as apps, that is to say, none. Interactive
+          jobs are critical to maintaining a responsive user experience, and this key should only be
+          used if an app's ability to be responsive depends on it, and cannot be made Adaptive.
      '';
    };

@@ -648,8 +643,8 @@ with lib;
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        When a job dies, launchd kills any remaining processes with the same process group ID as the job.  Set-ting Setting
-        ting this key to true disables that behavior.
+        When a job dies, launchd kills any remaining processes with the same process group ID as the job. Setting
+        this key to true disables that behavior.
      '';
    };

@@ -662,6 +657,15 @@ with lib;
      '';
    };

+    LowPriorityBackgroundIO = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        This optional key specifies whether the kernel should consider this daemon to be low priority when
+        doing file system I/O when the process is throttled with the Darwin-background classification.
+      '';
+    };
+
    LaunchOnlyOnce = mkOption {
      type = types.nullOr types.bool;
      default = null;
@@ -673,7 +677,7 @@ with lib;

    MachServices = mkOption {
      default = null;
-      example = { ResetAtClose = true; };
+      example = { "org.nixos.service" = { ResetAtClose = true; }; };
      description = ''
        This optional key is used to specify Mach services to be registered with the Mach bootstrap sub-system.
        Each key in this dictionary should be the name of service to be advertised. The value of the key must
@@ -682,7 +686,7 @@ with lib;
        Finally, for the job itself, the values will be replaced with Mach ports at the time of check-in with
        launchd.
      '';
-      type = types.nullOr (types.submodule {
+      type = types.nullOr (types.attrsOf (types.either types.bool (types.submodule {
        options = {
          ResetAtClose = mkOption {
            type = types.nullOr types.bool;
@@ -690,8 +694,8 @@ with lib;
            description = ''
              If this boolean is false, the port is recycled, thus leaving clients to remain oblivious to the
              demand nature of job. If the value is set to true, clients receive port death notifications when
-              the job lets go of the receive right. The port will be recreated atomically with respect to boot-strap_look_up() bootstrap_look_up()
-              strap_look_up() calls, so that clients can trust that after receiving a port death notification,
+              the job lets go of the receive right. The port will be recreated atomically with respect to bootstrap_look_up()
+              calls, so that clients can trust that after receiving a port death notification,
              the new port will have already been recreated. Setting the value to true should be done with
              care. Not all clients may be able to handle this behavior. The default value is false.
            '';
@@ -706,7 +710,52 @@ with lib;
            '';
          };
        };
-      });
+      })));
+    };
+
+    LaunchEvents = mkOption {
+      type = types.nullOr (types.attrs);
+      default = null;
+      description = ''
+        Specifies higher-level event types to be used as launch-on-demand event
+        sources.  Each sub-dictionary defines events for a particular event
+        subsystem, such as "com.apple.iokit.matching", which can be used to
+        launch jobs based on the appearance of nodes in the IORegistry. Each
+        dictionary within the sub-dictionary specifies an event descriptor that
+        is specified to each event subsystem. With this key, the job promises to
+        use the xpc_set_event_stream_handler(3) API to consume events. See
+        xpc_events(3) for more details on event sources.
+      '';
+      example = {
+        "com.apple.iokit.matching" = {
+          "com.apple.usb.device" = {
+            IOMatchLaunchStream = true;
+            IOProviderClass = "IOUSBDevice";
+            idProduct = "*";
+            idVendor = "*";
+          };
+        };
+      };
+    };
+
+    ServiceIPC = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        This optional key specifies whether the job participates in advanced
+        communication with launchd. The default is false. This flag is
+        incompatible with the inetdCompatibility key.
+      '';
+    };
+
+    SessionCreate = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        This key specifies that the job should be spawned into a new security
+        audit session rather than the default session for the context is belongs
+        to. See auditon(2) for details.
+      '';
    };

    Sockets = mkOption {
@@ -714,16 +763,16 @@ with lib;
      description = ''
        This optional key is used to specify launch on demand sockets that can be used to let launchd know when
        to run the job. The job must check-in to get a copy of the file descriptors using APIs outlined in
-        launch(3).  The keys of the top level Sockets dictionary can be anything. They are meant for the appli-cation application
-        cation developer to use to differentiate which descriptors correspond to which application level proto-cols protocols
-        cols (e.g. http vs. ftp vs. DNS...).  At check-in time, the value of each Sockets dictionary key will
+        launch(3).  The keys of the top level Sockets dictionary can be anything. They are meant for the application
+        developer to use to differentiate which descriptors correspond to which application level protocols
+        (e.g. http vs. ftp vs. DNS...).  At check-in time, the value of each Sockets dictionary key will
        be an array of descriptors. Daemon/Agent writers should consider all descriptors of a given key to be
        to be effectively equivalent, even though each file descriptor likely represents a different networking
        protocol which conforms to the criteria specified in the job configuration file.

-        The parameters below are used as inputs to call getaddrinfo(3).
+        The parameters below are used as inputs to call `getaddrinfo(3)`.
      '';
-      type = types.nullOr (types.loaOf (types.submodule {
+      type = types.nullOr (types.attrsOf (types.submodule {
        options = {
          SockType = mkOption {
            type = types.nullOr (types.enum [ "stream" "dgram" "seqpacket" ]);
@@ -738,7 +787,7 @@ with lib;
            type = types.nullOr types.bool;
            default = null;
            description = ''
-              This optional key specifies whether listen(2) or connect(2) should be called on the created file
+              This optional key specifies whether `listen(2)` or `connect(2)` should be called on the created file
              descriptor. The default is true ("to listen").
            '';
          };
@@ -747,7 +796,7 @@ with lib;
            type = types.nullOr types.str;
            default = null;
            description = ''
-              This optional key specifies the node to connect(2) or bind(2) to.
+              This optional key specifies the node to `connect(2)` or `bind(2)` to.
            '';
          };

@@ -755,7 +804,7 @@ with lib;
            type = types.nullOr types.str;
            default = null;
            description = ''
-              This optional key specifies the service on the node to connect(2) or bind(2) to.
+              This optional key specifies the service on the node to `connect(2)` or `bind(2)` to.
            '';
          };

@@ -771,7 +820,7 @@ with lib;
            type = types.nullOr (types.enum [ "TCP" ]);
            default = null;
            description = ''
-              This optional key specifies the protocol to be passed to socket(2).  The only value understood by
+              This optional key specifies the protocol to be passed to `socket(2)`.  The only value understood by
              this key at the moment is "TCP".
            '';
          };
@@ -780,8 +829,8 @@ with lib;
            type = types.nullOr types.path;
            default = null;
            description = ''
-              This optional key implies SockFamily is set to "Unix". It specifies the path to connect(2) or
-              bind(2) to.
+              This optional key implies SockFamily is set to "Unix". It specifies the path to `connect(2)` or
+              `bind(2)` to.
            '';
          };

@@ -790,8 +839,8 @@ with lib;
            default = null;
            description = ''
              This optional key is a variant of SockPathName. Instead of binding to a known path, a securely
-              generated socket is created and the path is assigned to the environment variable that is inher-ited inherited
-              ited by all jobs spawned by launchd.
+              generated socket is created and the path is assigned to the environment variable that is inherited
+              by all jobs spawned by launchd.
            '';
          };

@@ -809,8 +858,7 @@ with lib;
            default = null;
            description = ''
              This optional key can be used to request that the service be registered with the
-              mDNSResponder(8).  If the value is boolean, the service name is inferred from the SockService-Name. SockServiceName.
-              Name.
+              `mDNSResponder(8)`.  If the value is boolean, the service name is inferred from the SockServiceName.
            '';
          };

@@ -819,9 +867,9 @@ with lib;
            default = null;
            description = ''
              This optional key can be used to request that the datagram socket join a multicast group.  If the
-              value is a hostname, then getaddrinfo(3) will be used to join the correct multicast address for a
-              given socket family.  If an explicit IPv4 or IPv6 address is given, it is required that the Sock-Family SockFamily
-              Family family also be set, otherwise the results are undefined.
+              value is a hostname, then `getaddrinfo(3)` will be used to join the correct multicast address for a
+              given socket family.  If an explicit IPv4 or IPv6 address is given, it is required that the SockFamily
+              family also be set, otherwise the results are undefined.
            '';
          };
        };
@@ -829,6 +877,5 @@ with lib;
    };
  };

-  config = {
-  };
+  config = {};
 }
@@ -1,57 +0,0 @@
-{ lib }:
-
-with lib;
-
-let
-
-  attrFilter = name: value: name != "_module" && value != null;
-
-in
-
-rec {
-
-  toPLIST = x: ''
-    <?xml version="1.0" encoding="UTF-8"?>
-    <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-    <plist version="1.0">
-  '' + pprExpr "" x
-     + "\n</plist>";
-
-  pprExpr = ind: x:
-    if isNull x then "" else
-    if isBool x then pprBool ind x else
-    if isInt x then pprInt ind x else
-    if isString x then pprStr ind x else
-    if isList x then pprList ind x else
-    if isAttrs x then pprAttrs ind x else
-    throw "invalid plist type";
-
-  pprLiteral = ind: x: ind + x;
-
-  pprBool = ind: x: pprLiteral ind  (if x then "<true/>" else "<false/>");
-  pprInt = ind: x: pprLiteral ind "<integer>${toString x}</integer>";
-  pprStr = ind: x: pprLiteral ind "<string>${x}</string>";
-  pprKey = ind: x: pprLiteral ind "<key>${x}</key>";
-
-  pprIndent = ind: (pprExpr "\t${ind}");
-
-  pprItem = ind: concatMapStringsSep "\n" (pprIndent ind);
-
-  pprList = ind: x: concatStringsSep "\n" [
-    (pprLiteral ind "<array>")
-    (pprItem ind x)
-    (pprLiteral ind "</array>")
-  ];
-
-  pprAttrs = ind: x: concatStringsSep "\n" [
-    (pprLiteral ind "<dict>")
-    (pprAttr ind x)
-    (pprLiteral ind "</dict>")
-  ];
-
-  pprAttr = ind: x: concatStringsSep "\n" (flatten (mapAttrsToList (name: value: optional (attrFilter name value) [
-    (pprKey "\t${ind}" name)
-    (pprExpr "\t${ind}" value)
-  ]) x));
-
-}
@@ -0,0 +1,110 @@
+{ lib, ... }:
+
+let
+  inherit (lib) imap1 types mkOption showOption optionDescriptionPhrase mergeDefinitions;
+  inherit (builtins) map filter length deepSeq throw toString concatLists;
+  inherit (lib.options) showDefs;
+  wildcardText = lib.literalMD "`*`";
+
+  /**
+    A type of list which does not allow duplicate elements. The base/inner
+    list type to use (e.g. `types.listOf` or `types.nonEmptyListOf`) is passed
+    via argument `listType`, which must be the final type and not a function.
+
+    NOTE: The extra check for duplicates is quadratic and strict, so use this
+    type sparingly and only:
+
+      * when needed, and
+      * when the list is expected to be recursively short (e.g. < 10 elements)
+        and shallow (i.e. strict evaluation of the list won't take too long)
+
+    The implementation of this function is similar to that of
+    `types.nonEmptyListOf`.
+  */
+  types'.uniqueList = listType: listType // {
+      description = "unique ${types.optionDescriptionPhrase (class: class == "noun") listType}";
+      substSubModules = m: types'.uniqueList (listType.substSubModules m);
+      # This has been taken from the implementation of `types.listOf`, but has
+      # been modified to throw on duplicates. This check cannot be done in the
+      # `check` fn as this check is deep/strict, and because `check` runs
+      # prior to merging.
+      merge = loc: defs:
+        let
+          # Each element of `dupes` is a list. When there are duplicates,
+          # later lists will be duplicates of earlier lists, so just throw on
+          # the first set of duplicates found so that we don't have duplicate
+          # error msgs.
+          checked = filter (li:
+            if length li > 1
+            then throw "The option `${showOption loc}' contains duplicate entries after merging:\n${showDefs li}"
+            else false) dupes;
+          dupes = map (def: filter (def': def'.value == def.value) merged) merged;
+          merged = filter (x: x ? value) (concatLists (imap1 (n: def:
+            imap1 (m: el:
+              let
+                inherit (def) file;
+                loc' = loc ++ ["[definition ${toString n}-entry ${toString m}]"];
+              in
+                (mergeDefinitions
+                  loc'
+                  listType.nestedTypes.elemType
+                  [{ inherit file; value = el; }]
+                ).optionalValue // {inherit loc' file;}
+            ) def.value
+          ) defs));
+      in
+        deepSeq checked (map (x: x.value) merged);
+    };
+in {
+  StartCalendarInterval = let
+    CalendarIntervalEntry = types.submodule {
+      options = {
+        Minute = mkOption {
+          type = types.nullOr (types.ints.between 0 59);
+          default = null;
+          defaultText = wildcardText;
+          description = ''
+            The minute on which this job will be run.
+          '';
+        };
+
+        Hour = mkOption {
+          type = types.nullOr (types.ints.between 0 23);
+          default = null;
+          defaultText = wildcardText;
+          description = ''
+            The hour on which this job will be run.
+          '';
+        };
+
+        Day = mkOption {
+          type = types.nullOr (types.ints.between 1 31);
+          default = null;
+          defaultText = wildcardText;
+          description = ''
+            The day on which this job will be run.
+          '';
+        };
+
+        Weekday = mkOption {
+          type = types.nullOr (types.ints.between 0 7);
+          default = null;
+          defaultText = wildcardText;
+          description = ''
+            The weekday on which this job will be run (0 and 7 are Sunday).
+          '';
+        };
+
+        Month = mkOption {
+          type = types.nullOr (types.ints.between 1 12);
+          default = null;
+          defaultText = wildcardText;
+          description = ''
+            The month on which this job will be run.
+          '';
+        };
+      };
+    };
+  in
+    types.either CalendarIntervalEntry (types'.uniqueList (types.nonEmptyListOf CalendarIntervalEntry));
+}
@@ -5,17 +5,14 @@
 with lib;

 let
-
  fileName = file: last (splitString "/" file);
  mkDefaultIf = cond: value: mkIf cond (mkDefault value);

  drv = mkTextDerivation (fileName name) config.text;
-
 in

 {
  options = {
-
    enable = mkOption {
      type = types.bool;
      default = true;
@@ -48,6 +45,11 @@ in
      '';
    };

+    knownSha256Hashes = mkOption {
+      internal = true;
+      type = types.listOf types.str;
+      default = [];
+    };
  };

  config = {
@@ -0,0 +1,54 @@
+# This module was derived from
+# https://github.com/NixOS/nixpkgs/blob/000387627d26f245a6d9a0a7a60b7feddecaeec0/nixos/modules/misc/meta.nix
+{ lib, ... }:
+
+with lib;
+
+let
+  maintainer = mkOptionType {
+    name = "maintainer";
+    check = email: elem email (attrValues lib.maintainers);
+    merge = loc: defs: listToAttrs (singleton (nameValuePair (last defs).file (last defs).value));
+  };
+
+  listOfMaintainers = types.listOf maintainer // {
+    # Returns list of
+    #   { "module-file" = [
+    #        "maintainer1 <first@nixos.org>"
+    #        "maintainer2 <second@nixos.org>" ];
+    #   }
+    merge = loc: defs:
+      zipAttrs
+        (flatten (imap1 (n: def: imap1 (m: def':
+          maintainer.merge (loc ++ ["[${toString n}-${toString m}]"])
+            [{ inherit (def) file; value = def'; }]) def.value) defs));
+  };
+
+in
+
+{
+  options = {
+    meta = {
+
+      maintainers = mkOption {
+        type = listOfMaintainers;
+        internal = true;
+        default = [];
+        example = [ lib.maintainers.lnl7 ];
+        description = ''
+          List of maintainers of each module.  This option should be defined at
+          most once per module.
+
+          NOTE: `lib` comes from Nixpkgs, which can go out of
+          sync with nix-darwin. For this reason, use definitions like
+          `maintainers.alice or "alice"`.
+        '';
+      };
+
+    };
+  };
+
+  meta.maintainers = [
+    maintainers.roberth or "roberth"
+  ];
+}
@@ -0,0 +1,53 @@
+# Based on: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/misc/ids.nix
+
+# This module defines the global list of uids and gids.  We keep a
+# central list to prevent id collisions.
+
+# IMPORTANT!
+# We only add static uids and gids for services where it is not feasible
+# to change uids/gids on service start, in example a service with a lot of
+# files.
+
+{ lib, config, ... }:
+
+let
+  inherit (lib) types;
+in
+{
+  options = {
+
+    ids.uids = lib.mkOption {
+      internal = true;
+      description = ''
+        The user IDs used in NixOS.
+      '';
+      type = types.attrsOf types.int;
+    };
+
+    ids.gids = lib.mkOption {
+      internal = true;
+      description = ''
+        The group IDs used in NixOS.
+      '';
+      type = types.attrsOf types.int;
+    };
+
+  };
+
+  config = {
+
+    ids.uids = {
+      nixbld = lib.mkDefault 350;
+      _prometheus-node-exporter = 534;
+      _dnscrypt-proxy = 535;
+    };
+
+    ids.gids = {
+      nixbld = lib.mkDefault (if config.system.stateVersion < 5 then 30000 else 350);
+      _prometheus-node-exporter = 534;
+      _dnscrypt-proxy = 535;
+    };
+
+  };
+
+}
@@ -0,0 +1,15 @@
+{ lib, ... }:
+
+{
+  options = {
+    lib = lib.mkOption {
+      default = { };
+
+      type = lib.types.attrsOf lib.types.attrs;
+
+      description = ''
+        This option allows modules to define helper functions, constants, etc.
+      '';
+    };
+  };
+}
@@ -0,0 +1,123 @@
+[
+  ./alias.nix
+  ./config/system-path.nix
+  ./config/terminfo.nix
+  ./documentation
+  ./meta.nix
+  ./misc/ids.nix
+  ./misc/lib.nix
+  ./security/pam.nix
+  ./security/pki
+  ./security/sandbox
+  ./security/sudo.nix
+  ./system
+  ./system/base.nix
+  ./system/primary-user.nix
+  ./system/checks.nix
+  ./system/activation-scripts.nix
+  ./system/applications.nix
+  ./system/defaults-write.nix
+  ./system/defaults/controlcenter.nix
+  ./system/defaults/LaunchServices.nix
+  ./system/defaults/NSGlobalDomain.nix
+  ./system/defaults/GlobalPreferences.nix
+  ./system/defaults/CustomPreferences.nix
+  ./system/defaults/clock.nix
+  ./system/defaults/dock.nix
+  ./system/defaults/finder.nix
+  ./system/defaults/hitoolbox.nix
+  ./system/defaults/iCal.nix
+  ./system/defaults/screencapture.nix
+  ./system/defaults/screensaver.nix
+  ./system/defaults/alf.nix
+  ./system/defaults/loginwindow.nix
+  ./system/defaults/magicmouse.nix
+  ./system/defaults/smb.nix
+  ./system/defaults/SoftwareUpdate.nix
+  ./system/defaults/spaces.nix
+  ./system/defaults/trackpad.nix
+  ./system/defaults/universalaccess.nix
+  ./system/defaults/ActivityMonitor.nix
+  ./system/defaults/WindowManager.nix
+  ./system/etc.nix
+  ./system/keyboard.nix
+  ./system/launchd.nix
+  ./system/nvram.nix
+  ./system/patches.nix
+  ./system/shells.nix
+  ./system/startup.nix
+  ./system/version.nix
+  ./time
+  ./networking
+  ./networking/applicationFirewall.nix
+  ./nix
+  ./nix/linux-builder.nix
+  ./nix/nix-darwin.nix
+  ./nix/nixpkgs.nix
+  ./nix/nixpkgs-flake.nix
+  ./environment
+  ./fonts
+  ./launchd
+  ./power
+  ./power/sleep.nix
+  ./services/activate-system
+  ./services/aerospace
+  ./services/autossh.nix
+  ./services/buildkite-agents.nix
+  ./services/chunkwm.nix
+  ./services/cachix-agent.nix
+  ./services/dnsmasq.nix
+  ./services/dnscrypt-proxy.nix
+  ./services/emacs.nix
+  ./services/eternal-terminal.nix
+  ./services/github-runner
+  ./services/gitlab-runner.nix
+  ./services/hercules-ci-agent
+  ./services/ipfs.nix
+  ./services/karabiner-elements
+  ./services/khd
+  ./services/kwm
+  ./services/lorri.nix
+  ./services/mail/offlineimap.nix
+  ./services/mopidy.nix
+  ./services/monitoring/telegraf.nix
+  ./services/monitoring/netdata.nix
+  ./services/monitoring/prometheus-node-exporter.nix
+  ./services/netbird.nix
+  ./services/nix-daemon.nix
+  ./services/nix-gc
+  ./services/nix-optimise
+  ./services/ofborg
+  ./services/openssh.nix
+  ./services/postgresql
+  ./services/privoxy
+  ./services/redis
+  ./services/sketchybar
+  ./services/skhd
+  ./services/spacebar
+  ./services/spotifyd.nix
+  ./services/synapse-bt.nix
+  ./services/synergy
+  ./services/tailscale.nix
+  ./services/trezord.nix
+  ./services/wg-quick.nix
+  ./services/yabai
+  ./services/nextdns
+  ./services/jankyborders
+  ./programs/_1password.nix
+  ./programs/_1password-gui.nix
+  ./programs/arqbackup.nix
+  ./programs/bash
+  ./programs/direnv.nix
+  ./programs/fish.nix
+  ./programs/gnupg.nix
+  ./programs/man.nix
+  ./programs/info
+  ./programs/nix-index
+  ./programs/ssh.nix
+  ./programs/tmux.nix
+  ./programs/vim.nix
+  ./programs/zsh
+  ./homebrew.nix
+  ./users
+]
@@ -0,0 +1,73 @@
+{ config, lib, ... }:
+let
+  cfg = config.networking.applicationFirewall;
+
+  socketfilterfw =
+    option: value:
+    lib.concatStringsSep " " [
+      "/usr/libexec/ApplicationFirewall/socketfilterfw"
+      "--${option}"
+      (if value then "on" else "off")
+    ];
+in
+{
+  meta.maintainers = [
+    (lib.maintainers.prince213 or "prince213")
+    (lib.maintainers.ryanccn or "ryanccn")
+  ];
+
+  options.networking.applicationFirewall = {
+    enable = lib.mkOption {
+      type = lib.types.nullOr lib.types.bool;
+      default = null;
+      example = true;
+      description = "Whether to enable application firewall.";
+    };
+
+    blockAllIncoming = lib.mkOption {
+      type = lib.types.nullOr lib.types.bool;
+      default = null;
+      example = true;
+      description = "Whether to block all incoming connections.";
+    };
+
+    allowSigned = lib.mkOption {
+      type = lib.types.nullOr lib.types.bool;
+      default = null;
+      example = true;
+      description = "Whether to allow built-in software to receive incoming connections.";
+    };
+
+    allowSignedApp = lib.mkOption {
+      type = lib.types.nullOr lib.types.bool;
+      default = null;
+      example = true;
+      description = "Whether to allow downloaded signed software to receive incoming connections.";
+    };
+
+    enableStealthMode = lib.mkOption {
+      type = lib.types.nullOr lib.types.bool;
+      default = null;
+      example = true;
+      description = "Whether to enable stealth mode.";
+    };
+  };
+
+  config = {
+    system.activationScripts.networking.text = ''
+      echo "configuring application firewall..." >&2
+
+      ${lib.optionalString (cfg.enable != null) (socketfilterfw "setglobalstate" cfg.enable)}
+      ${lib.optionalString (cfg.blockAllIncoming != null) (
+        socketfilterfw "setblockall" cfg.blockAllIncoming
+      )}
+      ${lib.optionalString (cfg.allowSigned != null) (socketfilterfw "setallowsigned" cfg.allowSigned)}
+      ${lib.optionalString (cfg.allowSignedApp != null) (
+        socketfilterfw "setallowsignedapp" cfg.allowSignedApp
+      )}
+      ${lib.optionalString (cfg.enableStealthMode != null) (
+        socketfilterfw "setstealthmode" cfg.enableStealthMode
+      )}
+    '';
+  };
+}
@@ -0,0 +1,212 @@
+{ config, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.networking;
+
+  hostnameRegEx = ''^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$'';
+
+  emptyList = lst: if lst != [] then lst else ["empty"];
+
+  onOff = cond: if cond then "on" else "off";
+
+  setNetworkServices = optionalString (cfg.knownNetworkServices != []) ''
+    networkservices=$(networksetup -listallnetworkservices)
+    ${concatMapStringsSep "\n" (srv: ''
+      case "$networkservices" in
+        *${lib.escapeShellArg srv}*)
+          networksetup -setdnsservers ${lib.escapeShellArgs ([ srv ] ++ (emptyList cfg.dns))}
+          networksetup -setsearchdomains ${lib.escapeShellArgs ([ srv ] ++ (emptyList cfg.search))}
+          ${optionalString (cfg.dhcpClientId != null) ''
+            networksetup -setdhcp ${lib.escapeShellArgs [ srv cfg.dhcpClientId ]}
+          ''}
+          ;;
+      esac
+    '') cfg.knownNetworkServices}
+  '';
+in
+
+{
+  options = {
+    networking.computerName = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "John’s MacBook Pro";
+      description = ''
+        The user-friendly name for the system, set in System Preferences > Sharing > Computer Name.
+
+        Setting this option is equivalent to running `scutil --set ComputerName`.
+
+        This name can contain spaces and Unicode characters.
+      '';
+    };
+
+    networking.hostName = mkOption {
+      type = types.nullOr (types.strMatching hostnameRegEx);
+      default = null;
+      example = "Johns-MacBook-Pro";
+      description = ''
+        The hostname of your system, as visible from the command line and used by local and remote
+        networks when connecting through SSH and Remote Login.
+
+        Setting this option is equivalent to running the command `scutil --set HostName`.
+
+        (Note that networking.localHostName defaults to the value of this option.)
+      '';
+    };
+
+    networking.localHostName = mkOption {
+      type = types.nullOr (types.strMatching hostnameRegEx);
+      default = cfg.hostName;
+      example = "Johns-MacBook-Pro";
+      description = ''
+        The local hostname, or local network name, is displayed beneath the computer's name at the
+        top of the Sharing preferences pane. It identifies your Mac to Bonjour-compatible services.
+
+        Setting this option is equivalent to running the command `scutil --set LocalHostName`, where
+        running, e.g., `scutil --set LocalHostName 'Johns-MacBook-Pro'`, would set
+        the systems local hostname to "Johns-MacBook-Pro.local". The value of this option defaults
+        to the value of the networking.hostName option.
+
+        By default on macOS the local hostname is your computer's name with ".local" appended, with
+        any spaces replaced with hyphens, and invalid characters omitted.
+      '';
+    };
+
+    networking.domain = mkOption {
+      default = null;
+      example = "home.arpa";
+      type = types.nullOr types.str;
+      description = ''
+        The domain.  It can be left empty if it is auto-detected through DHCP.
+      '';
+    };
+
+    networking.fqdn = mkOption {
+      type = types.str;
+      default =
+        if (cfg.hostName != "" && cfg.domain != null) then
+          "${cfg.hostName}.${cfg.domain}"
+        else
+          throw ''
+            The FQDN is required but cannot be determined from `networking.hostName`
+            and `networking.domain`. Please ensure these options are set properly or
+            set `networking.fqdn` directly.
+          '';
+      defaultText = literalExpression ''"''${networking.hostName}.''${networking.domain}"'';
+      description = ''
+        The fully qualified domain name (FQDN) of this host. By default, it is
+        the result of combining `networking.hostName` and `networking.domain.`
+
+        Using this option will result in an evaluation error if the hostname is empty or
+        no domain is specified.
+
+        Modules that accept a mere `networking.hostName` but prefer a fully qualified
+        domain name may use `networking.fqdnOrHostName` instead.
+      '';
+    };
+
+    networking.fqdnOrHostName = mkOption {
+      readOnly = true;
+      type = types.str;
+      default = if cfg.domain == null then cfg.hostName else cfg.fqdn;
+      defaultText = literalExpression ''
+        if cfg.domain == null then cfg.hostName else cfg.fqdn
+      '';
+      description = ''
+        Either the fully qualified domain name (FQDN), or just the host name if
+        it does not exists.
+
+        This is a convenience option for modules to read instead of `fqdn` when
+        a mere `hostName` is also an acceptable value; this option does not
+        throw an error when `domain` is unset.
+      '';
+    };
+
+    networking.knownNetworkServices = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      example = [ "Wi-Fi" "Ethernet Adaptor" "Thunderbolt Ethernet" ];
+      description = ''
+        List of networkservices that should be configured.
+
+        To display a list of all the network services on the server's
+        hardware ports, use {command}`networksetup -listallnetworkservices`.
+      '';
+    };
+
+    networking.dhcpClientId = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "my-client-id";
+      description = ''
+        The DHCP client identifier to use when requesting an IP address from a DHCP server.
+
+        If this option is set, it will be used by the system when requesting an IP address.
+        If not set, no changes will be made.
+
+        Set to the string "empty" to clear any previously configured client ID
+        and restore the system default behavior.
+      '';
+    };
+
+    networking.dns = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      example = [ "8.8.8.8" "8.8.4.4" "2001:4860:4860::8888" "2001:4860:4860::8844" ];
+      description = "The list of dns servers used when resolving domain names.";
+    };
+
+    networking.search = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      description = "The list of search paths used when resolving domain names.";
+    };
+
+    networking.wakeOnLan.enable = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Enable Wake-on-LAN for the device.
+
+        Battery powered devices may require being connected to power.
+      '';
+    };
+  };
+
+  config = {
+
+    warnings = [
+      (mkIf (cfg.knownNetworkServices == [] && cfg.dns != []) "networking.knownNetworkServices is empty, dns servers will not be configured.")
+      (mkIf (cfg.knownNetworkServices == [] && cfg.search != []) "networking.knownNetworkServices is empty, dns searchdomains will not be configured.")
+      (mkIf (cfg.knownNetworkServices == [] && cfg.dhcpClientId != null) "networking.knownNetworkServices is empty, dhcp client ID will not be configured.")
+    ];
+
+    system.activationScripts.networking.text = ''
+      echo "configuring networking..." >&2
+
+      ${optionalString (cfg.computerName != null) ''
+        scutil --set ComputerName ${escapeShellArg cfg.computerName}
+      ''}
+      ${optionalString (cfg.hostName != null) ''
+        scutil --set HostName ${escapeShellArg cfg.hostName}
+      ''}
+      ${optionalString (cfg.localHostName != null) ''
+        scutil --set LocalHostName ${escapeShellArg cfg.localHostName}
+      ''}
+
+      ${setNetworkServices}
+
+      ${optionalString (cfg.wakeOnLan.enable != null) ''
+        systemsetup -setWakeOnNetworkAccess '${onOff cfg.wakeOnLan.enable}' &> /dev/null
+      ''}
+
+      if [ -e /etc/hosts.before-nix-darwin ]; then
+        echo "restoring /etc/hosts..." >&2
+        sudo mv /etc/hosts{.before-nix-darwin,}
+      fi
+    '';
+
+  };
+}
@@ -0,0 +1,234 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.nix.linux-builder;
+in
+
+{
+  imports = [
+    (mkRemovedOptionModule [ "nix" "linux-builder" "modules" ] "This option has been replaced with `nix.linux-builder.config` which allows setting options directly like `nix.linux-builder.config.networking.hostName = \"banana\";.")
+  ];
+
+  options.nix.linux-builder = {
+    enable = mkEnableOption "Linux builder";
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.darwin.linux-builder;
+      defaultText = "pkgs.darwin.linux-builder";
+      apply = pkg: pkg.override (old: {
+        # the linux-builder package requires `modules` as an argument, so it's
+        # always non-null.
+        modules = old.modules ++ [ cfg.config ];
+      });
+      description = ''
+        This option specifies the Linux builder to use.
+      '';
+    };
+
+    config = mkOption {
+      type = types.deferredModule;
+      default = { };
+      example = literalExpression ''
+        ({ pkgs, ... }:
+
+        {
+          environment.systemPackages = [ pkgs.neovim ];
+        })
+      '';
+      description = ''
+        This option specifies extra NixOS configuration for the builder. You should first use the Linux builder
+        without changing the builder configuration otherwise you may not be able to build the Linux builder.
+      '';
+    };
+
+    mandatoryFeatures = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      defaultText = literalExpression ''[]'';
+      example = literalExpression ''[ "big-parallel" ]'';
+      description = ''
+        A list of features mandatory for the Linux builder. The builder will
+        be ignored for derivations that don't require all features in
+        this list. All mandatory features are automatically included in
+        {var}`supportedFeatures`.
+
+        This sets the corresponding `nix.buildMachines.*.mandatoryFeatures` option.
+      '';
+    };
+
+    maxJobs = mkOption {
+      type = types.ints.positive;
+      default = cfg.package.nixosConfig.virtualisation.cores;
+      defaultText = ''
+        The `virtualisation.cores` of the build machine's final NixOS configuration.
+      '';
+      example = 2;
+      description = ''
+        Instead of setting this directly, you should set
+        {option}`nix.linux-builder.config.virtualisation.cores` to configure
+        the amount of cores the Linux builder should have.
+
+        The number of concurrent jobs the Linux builder machine supports. The
+        build machine will enforce its own limits, but this allows hydra
+        to schedule better since there is no work-stealing between build
+        machines.
+
+        This sets the corresponding `nix.buildMachines.*.maxJobs` option.
+      '';
+    };
+
+    protocol = mkOption {
+      type = types.str;
+      default = "ssh-ng";
+      defaultText = literalExpression ''"ssh-ng"'';
+      example = literalExpression ''"ssh"'';
+      description = ''
+        The protocol used for communicating with the build machine.  Use
+        `ssh-ng` if your remote builder and your local Nix version support that
+        improved protocol.
+
+        Use `null` when trying to change the special localhost builder without a
+        protocol which is for example used by hydra.
+      '';
+    };
+
+    speedFactor = mkOption {
+      type = types.ints.positive;
+      default = 1;
+      defaultText = literalExpression ''1'';
+      description = ''
+        The relative speed of the Linux builder. This is an arbitrary integer
+        that indicates the speed of this builder, relative to other
+        builders. Higher is faster.
+
+        This sets the corresponding `nix.buildMachines.*.speedFactor` option.
+      '';
+    };
+
+    supportedFeatures = mkOption {
+      type = types.listOf types.str;
+      default = [ "kvm" "benchmark" "big-parallel" ];
+      defaultText = literalExpression ''[ "kvm" "benchmark" "big-parallel" ]'';
+      example = literalExpression ''[ "kvm" "big-parallel" ]'';
+      description = ''
+        A list of features supported by the Linux builder. The builder will
+        be ignored for derivations that require features not in this
+        list.
+
+        This sets the corresponding `nix.buildMachines.*.supportedFeatures` option.
+      '';
+    };
+
+    systems = mkOption {
+      type = types.listOf types.str;
+      default = [ cfg.package.nixosConfig.nixpkgs.hostPlatform.system ];
+      defaultText = ''
+        The `nixpkgs.hostPlatform.system` of the build machine's final NixOS configuration.
+      '';
+      example = literalExpression ''
+        [
+          "x86_64-linux"
+          "aarch64-linux"
+        ]
+      '';
+      description = ''
+        This option specifies system types the build machine can execute derivations on.
+
+        This sets the corresponding `nix.buildMachines.*.systems` option.
+      '';
+    };
+
+
+    workingDirectory = mkOption {
+      type = types.str;
+      default = "/var/lib/linux-builder";
+      description = ''
+        The working directory of the Linux builder daemon process.
+      '';
+    };
+
+    ephemeral = mkEnableOption ''
+      wipe the builder's filesystem on every restart.
+
+      This is disabled by default as maintaining the builder's Nix Store reduces
+      rebuilds. You can enable this if you don't want your builder to accumulate
+      state.
+    '';
+  };
+
+  config = mkMerge [
+    (mkIf (!cfg.enable) {
+      system.activationScripts.preActivation.text = ''
+        rm -rf ${cfg.workingDirectory}
+      '';
+    })
+    (mkIf cfg.enable {
+      assertions = [
+        {
+          assertion = config.nix.enable;
+          message = ''`nix.linux-builder.enable` requires `nix.enable`'';
+        }
+      ];
+
+      system.activationScripts.preActivation.text = ''
+        # Migrate if using the old working directory
+        if [ -e /var/lib/darwin-builder ] && [ ! -e ${cfg.workingDirectory} ]; then
+          mv /var/lib/darwin-builder ${cfg.workingDirectory}
+        fi
+
+        mkdir -p ${cfg.workingDirectory}
+      '';
+
+      launchd.daemons.linux-builder = {
+        environment = {
+          inherit (config.environment.variables) NIX_SSL_CERT_FILE;
+        };
+
+        # create-builder uses TMPDIR to share files with the builder, notably certs.
+        # macOS will clean up files in /tmp automatically that haven't been accessed in 3+ days.
+        # If we let it use /tmp, leaving the computer asleep for 3 days makes the certs vanish.
+        # So we'll use /run/org.nixos.linux-builder instead and clean it up ourselves.
+        script = ''
+          export TMPDIR=/run/org.nixos.linux-builder USE_TMPDIR=1
+          rm -rf $TMPDIR
+          mkdir -p $TMPDIR
+          trap "rm -rf $TMPDIR" EXIT
+          ${lib.optionalString cfg.ephemeral ''
+            rm -f ${cfg.workingDirectory}/${cfg.package.nixosConfig.networking.hostName}.qcow2
+          ''}
+          ${cfg.package}/bin/create-builder
+        '';
+
+        serviceConfig = {
+          KeepAlive = true;
+          RunAtLoad = true;
+          WorkingDirectory = cfg.workingDirectory;
+        };
+      };
+
+      environment.etc."ssh/ssh_config.d/100-linux-builder.conf".text = ''
+        Host linux-builder
+          User builder
+          Hostname localhost
+          HostKeyAlias linux-builder
+          Port 31022
+          IdentityFile /etc/nix/builder_ed25519
+      '';
+
+      nix.distributedBuilds = true;
+
+      nix.buildMachines = [{
+        hostName = "linux-builder";
+        sshUser = "builder";
+        sshKey = "/etc/nix/builder_ed25519";
+        publicHostKey = "c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSUpCV2N4Yi9CbGFxdDFhdU90RStGOFFVV3JVb3RpQzVxQkorVXVFV2RWQ2Igcm9vdEBuaXhvcwo=";
+        inherit (cfg) mandatoryFeatures maxJobs protocol speedFactor supportedFeatures systems;
+      }];
+
+      nix.settings.builders-use-substitutes = true;
+    })
+  ];
+}
@@ -1,41 +1,53 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:

 let
+  nix-tools = pkgs.callPackage ../../pkgs/nix-tools {
+    inherit (config.system) profile;
+    inherit (config.environment) systemPath;
+    nixPath = lib.optionalString config.nix.enable (lib.concatStringsSep ":" config.nix.nixPath);
+    nixPackage = if config.nix.enable then config.nix.package else null;
+  };

-  inherit (pkgs) stdenv;
+  darwin-uninstaller = pkgs.callPackage ../../pkgs/darwin-uninstaller { };

-  writeProgram = name: env: src:
-    pkgs.substituteAll ({
-      inherit name src;
-      dir = "bin";
-      isExecutable = true;
-    } // env);
-
-  darwin-option = writeProgram "darwin-option"
-    {
-      inherit (config.system) profile;
-      inherit (stdenv) shell;
-    }
-    ../../pkgs/nix-tools/darwin-option.sh;
-
-  darwin-rebuild = writeProgram "darwin-rebuild"
-    {
-      inherit (config.system) profile;
-      inherit (stdenv) shell;
-      path = "${pkgs.coreutils}/bin:${config.environment.systemPath}";
-    }
-    ../../pkgs/nix-tools/darwin-rebuild.sh;
+  mkToolModule = { name, package ? nix-tools.${name} }: { config, ... }: {
+    options.system.tools.${name}.enable = lib.mkEnableOption "${name} script" // {
+      default = config.system.tools.enable;
+    };

+    config = lib.mkIf config.system.tools.${name}.enable {
+      environment.systemPackages = [ package ];
+    };
+  };
 in

 {
+  options.system = {
+    tools.enable = lib.mkOption {
+      type = lib.types.bool;
+      internal = true;
+      default = true;
+      description = ''
+        Disable internal tools, such as darwin-rebuild and darwin-option. This
+        is useful to shrink systems which are not expected to rebuild or
+        reconfigure themselves. Use at your own risk!
+    '';
+    };
+  };
+
+  imports = [
+    (lib.mkRenamedOptionModule [ "system" "includeUninstaller" ] [ "system" "tools" "darwin-uninstaller" "enable" ])
+    (lib.mkRemovedOptionModule [ "system" "disableInstallerTools" ] "Please use system.tools.enable instead")
+
+    (mkToolModule { name = "darwin-option"; })
+    (mkToolModule { name = "darwin-rebuild"; })
+    (mkToolModule { name = "darwin-version"; })
+    (mkToolModule { name = "darwin-uninstaller"; package = darwin-uninstaller; })
+  ];
+
  config = {
-
-    environment.systemPackages =
-      [ # Include nix-tools by default
-        darwin-option
-        darwin-rebuild
-      ];
-
+    system.build = {
+      inherit (nix-tools) darwin-option darwin-rebuild darwin-version;
+    };
  };
 }
@@ -0,0 +1,117 @@
+{ config, options, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.nixpkgs.flake;
+in
+{
+  options.nixpkgs.flake = {
+    source = mkOption {
+      # In newer Nix versions, particularly with lazy trees, outPath of
+      # flakes becomes a Nix-language path object. We deliberately allow this
+      # to gracefully come through the interface in discussion with @roberth.
+      #
+      # See: https://github.com/NixOS/nixpkgs/pull/278522#discussion_r1460292639
+      type = types.nullOr (types.either types.str types.path);
+
+      default = null;
+      defaultText = "if (using nix-darwin.lib.darwinSystem) then nixpkgs.source else null";
+
+      example = ''builtins.fetchTarball { name = "source"; sha256 = "${lib.fakeHash}"; url = "https://github.com/nixos/nixpkgs/archive/somecommit.tar.gz"; }'';
+
+      description = ''
+        The path to the nixpkgs sources used to build the system. This is automatically set up to be
+        the store path of the nixpkgs flake used to build the system if using
+        `nixpkgs.lib.darwinSystem`, and is otherwise null by default.
+
+        This can also be optionally set if the nix-darwin system is not built with a flake but still uses
+        pinned sources: set this to the store path for the nixpkgs sources used to build the system,
+        as may be obtained by `builtins.fetchTarball`, for example.
+
+        Note: the name of the store path must be "source" due to
+        <https://github.com/NixOS/nix/issues/7075>.
+      '';
+    };
+
+    setNixPath = mkOption {
+      type = types.bool;
+
+      default = config.nix.enable && cfg.source != null;
+      defaultText = literalExpression ''config.nix.enable && nixpkgs.flake.source != null'';
+
+      description = ''
+        Whether to set {env}`NIX_PATH` to include `nixpkgs=flake:nixpkgs` such that `<nixpkgs>`
+        lookups receive the version of nixpkgs that the system was built with, in concert with
+        {option}`nixpkgs.flake.setFlakeRegistry`.
+
+        This is on by default for nix-darwin configurations built with flakes.
+
+        This makes {command}`nix-build '<nixpkgs>' -A hello` work out of the box on flake systems.
+
+        Note that this option makes the nix-darwin closure depend on the nixpkgs sources, which may add
+        undesired closure size if the system will not have any nix commands run on it.
+      '';
+    };
+
+    setFlakeRegistry = mkOption {
+      type = types.bool;
+
+      default = config.nix.enable && cfg.source != null;
+      defaultText = literalExpression ''config.nix.enable && config.nixpkgs.flake.source != null'';
+
+      description = ''
+        Whether to pin nixpkgs in the system-wide flake registry (`/etc/nix/registry.json`) to the
+        store path of the sources of nixpkgs used to build the nix-darwin system.
+
+        This is on by default for nix-darwin configurations built with flakes.
+
+        This option makes {command}`nix run nixpkgs#hello` reuse dependencies from the system, avoid
+        refetching nixpkgs, and have a consistent result every time.
+
+        Note that this option makes the nix-darwin closure depend on the nixpkgs sources, which may add
+        undesired closure size if the system will not have any nix commands run on it.
+      '';
+    };
+  };
+
+  config = mkIf (cfg.source != null) (mkMerge [
+    {
+      assertions = [
+        {
+          assertion = cfg.setNixPath -> cfg.setFlakeRegistry;
+          message = ''
+            Setting `nixpkgs.flake.setNixPath` requires that `nixpkgs.flake.setFlakeRegistry` also
+            be set, since it is implemented in terms of indirection through the flake registry.
+          '';
+        }
+
+        # TODO: Upstream these to NixOS.
+
+        {
+          assertion = cfg.setNixPath -> config.nix.enable;
+          message = ''`nixpkgs.flake.setNixPath` requires `nix.enable`'';
+        }
+
+        {
+          assertion = cfg.setFlakeRegistry -> config.nix.enable;
+          message = ''`nixpkgs.flake.setFlakeRegistry` requires `nix.enable`'';
+        }
+      ];
+    }
+    (mkIf cfg.setFlakeRegistry {
+      nix.registry.nixpkgs.to = mkDefault {
+        type = "path";
+        path = cfg.source;
+      };
+    })
+    (mkIf cfg.setNixPath {
+      # N.B. This does not include darwin-config in NIX_PATH unlike modules/nix/default.nix
+      # because we would need some kind of evil shim taking the *calling* flake's self path,
+      # perhaps, to ever make that work (in order to know where the Nix expr for the system came
+      # from and how to call it).
+      nix.nixPath = mkDefault ([ "nixpkgs=flake:nixpkgs" ]
+        ++ optional config.nix.channel.enable "/nix/var/nix/profiles/per-user/root/channels");
+    })
+  ]);
+}
@@ -1,73 +1,329 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
+{
+  config,
+  options,
+  lib,
+  pkgs,
+  ...
+}:

 let
-  isConfig = x:
-    builtins.isAttrs x || builtins.isFunction x;
+  cfg = config.nixpkgs;
+  opt = options.nixpkgs;

-  optCall = f: x:
-    if builtins.isFunction f
-    then f x
-    else f;
+  isConfig = x: builtins.isAttrs x || lib.isFunction x;

-  mergeConfig = lhs_: rhs_:
+  optCall = f: x: if lib.isFunction f then f x else f;
+
+  mergeConfig =
+    lhs_: rhs_:
    let
-      lhs = optCall lhs_ { inherit pkgs; };
-      rhs = optCall rhs_ { inherit pkgs; };
+      lhs = optCall lhs_ { inherit lib pkgs; };
+      rhs = optCall rhs_ { inherit lib pkgs; };
    in
-    lhs // rhs //
-    optionalAttrs (lhs ? packageOverrides) {
-      packageOverrides = pkgs:
-        optCall lhs.packageOverrides pkgs //
-        optCall (attrByPath ["packageOverrides"] ({}) rhs) pkgs;
-    } //
-    optionalAttrs (lhs ? perlPackageOverrides) {
-      perlPackageOverrides = pkgs:
-        optCall lhs.perlPackageOverrides pkgs //
-        optCall (attrByPath ["perlPackageOverrides"] ({}) rhs) pkgs;
+    lib.recursiveUpdate lhs rhs
+    // lib.optionalAttrs (lhs ? allowUnfreePackages) {
+      allowUnfreePackages = lhs.allowUnfreePackages ++ (lib.attrByPath [ "allowUnfreePackages" ] [ ] rhs);
+    }
+    // lib.optionalAttrs (lhs ? packageOverrides) {
+      packageOverrides =
+        pkgs:
+        optCall lhs.packageOverrides pkgs // optCall (lib.attrByPath [ "packageOverrides" ] { } rhs) pkgs;
+    }
+    // lib.optionalAttrs (lhs ? perlPackageOverrides) {
+      perlPackageOverrides =
+        pkgs:
+        optCall lhs.perlPackageOverrides pkgs
+        // optCall (lib.attrByPath [ "perlPackageOverrides" ] { } rhs) pkgs;
    };

-  configType = mkOptionType {
-    name = "nixpkgs config";
-    check = traceValIfNot isConfig;
-    merge = args: fold (def: mergeConfig def.value) {};
+  configType = lib.mkOptionType {
+    name = "nixpkgs-config";
+    description = "nixpkgs config";
+    check =
+      x:
+      let
+        traceXIfNot = c: if c x then true else lib.traceSeqN 1 x false;
+      in
+      traceXIfNot isConfig;
+    merge = args: lib.foldr (def: mergeConfig def.value) { };
  };

+  overlayType = lib.mkOptionType {
+    name = "nixpkgs-overlay";
+    description = "nixpkgs overlay";
+    check = lib.isFunction;
+    merge = lib.mergeOneOption;
+  };
+
+  pkgsType = lib.types.pkgs // {
+    # This type is only used by itself, so let's elaborate the description a bit
+    # for the purpose of documentation.
+    description = "An evaluation of Nixpkgs; the top level attribute set of packages";
+  };
+
+  hasBuildPlatform = opt.buildPlatform.highestPrio < (lib.mkOptionDefault { }).priority;
+  hasHostPlatform = opt.hostPlatform.isDefined;
+  hasPlatform = hasHostPlatform || hasBuildPlatform;
+
+  # Context for messages
+  hostPlatformLine = lib.optionalString hasHostPlatform "${lib.showOptionWithDefLocs opt.hostPlatform}";
+  buildPlatformLine = lib.optionalString hasBuildPlatform "${lib.showOptionWithDefLocs opt.buildPlatform}";
+
+  legacyOptionsDefined = lib.optional (
+    opt.system.highestPrio < (lib.mkDefault { }).priority
+  ) opt.system;
+
+  defaultPkgs =
+    if opt.hostPlatform.isDefined then
+      let
+        isCross = cfg.buildPlatform != cfg.hostPlatform;
+        systemArgs =
+          if isCross then
+            {
+              localSystem = cfg.buildPlatform;
+              crossSystem = cfg.hostPlatform;
+            }
+          else
+            {
+              localSystem = cfg.hostPlatform;
+            };
+      in
+      import cfg.source (
+        {
+          inherit (cfg) config overlays;
+        }
+        // systemArgs
+      )
+    else
+      import cfg.source {
+        inherit (cfg) config overlays;
+        localSystem = { inherit (cfg) system; };
+      };
+
+  finalPkgs = if opt.pkgs.isDefined then cfg.pkgs.appendOverlays cfg.overlays else defaultPkgs;
+
 in

 {
-  options = {
-
-    nixpkgs.config = mkOption {
-      default = {};
-      example = literalExample
-        ''
-          { firefox.enableGeckoMediaPlayer = true;
-            packageOverrides = pkgs: {
-              firefox60Pkgs = pkgs.firefox60Pkgs.override {
-                enableOfficialBranding = true;
-              };
-            };
-          }
-        '';
-      type = configType;
+  options.nixpkgs = {
+    pkgs = lib.mkOption {
+      type = pkgsType;
+      example = lib.literalExpression "import <nixpkgs> {}";
      description = ''
-        The configuration of the Nix Packages collection.  (For
-        details, see the Nixpkgs documentation.)  It allows you to set
-        package configuration options, and to override packages
-        globally through the <varname>packageOverrides</varname>
-        option.  The latter is a function that takes as an argument
-        the <emphasis>original</emphasis> Nixpkgs, and must evaluate
-        to a set of new or overridden packages.
+        If set, the pkgs argument to all nix-darwin modules is the value of
+        this option, extended with `nixpkgs.overlays`, if
+        that is also set. The nix-darwin and Nixpkgs architectures must
+        match. Any other options in `nixpkgs.*`, notably `config`,
+        will be ignored.
+
+        The default value imports the Nixpkgs from
+        [](#opt-nixpkgs.source). The `config`, `overlays`, `localSystem`,
+        and `crossSystem` are based on this option's siblings.
+
+        This option can be used to increase
+        the performance of evaluation, or to create packages that depend
+        on a container that should be built with the exact same evaluation
+        of Nixpkgs, for example. Applications like this should set
+        their default value using `lib.mkDefault`, so
+        user-provided configuration can override it without using
+        `lib`.
      '';
    };

+    config = lib.mkOption {
+      default = { };
+      example = lib.literalExpression ''
+        { allowBroken = true; allowUnfree = true; }
+      '';
+      type = configType;
+      description = ''
+        Global configuration for Nixpkgs.
+        The complete list of [Nixpkgs configuration options](https://nixos.org/manual/nixpkgs/stable/#sec-config-options-reference) is in the [Nixpkgs manual section on global configuration](https://nixos.org/manual/nixpkgs/stable/#chap-packageconfig).
+
+        Ignored when {option}`nixpkgs.pkgs` is set.
+      '';
+    };
+
+    overlays = lib.mkOption {
+      default = [ ];
+      example = lib.literalExpression ''
+        [
+          (self: super: {
+            openssh = super.openssh.override {
+              hpnSupport = true;
+              kerberos = self.libkrb5;
+            };
+          })
+        ]
+      '';
+      type = lib.types.listOf overlayType;
+      description = ''
+        List of overlays to apply to Nixpkgs.
+        This option allows modifying the Nixpkgs package set accessed through the `pkgs` module argument.
+
+        For details, see the [Overlays chapter in the Nixpkgs manual](https://nixos.org/manual/nixpkgs/stable/#chap-overlays).
+
+        If the {option}`nixpkgs.pkgs` option is set, overlays specified using `nixpkgs.overlays` will be applied after the overlays that were already included in `nixpkgs.pkgs`.
+      '';
+    };
+
+    hostPlatform = lib.mkOption {
+      type = lib.types.either lib.types.str lib.types.attrs; # TODO utilize lib.systems.parsedPlatform
+      example = {
+        system = "aarch64-darwin";
+      };
+      # Make sure that the final value has all fields for sake of other modules
+      # referring to this. TODO make `lib.systems` itself use the module system.
+      apply = lib.systems.elaborate;
+      description = ''
+        Specifies the platform where the nix-darwin configuration will run.
+
+        To cross-compile, set also `nixpkgs.buildPlatform`.
+
+        Ignored when `nixpkgs.pkgs` is set.
+      '';
+    };
+
+    buildPlatform = lib.mkOption {
+      type = lib.types.either lib.types.str lib.types.attrs; # TODO utilize lib.systems.parsedPlatform
+      default = cfg.hostPlatform;
+      example = {
+        system = "x86_64-darwin";
+      };
+      # Make sure that the final value has all fields for sake of other modules
+      # referring to this.
+      apply =
+        inputBuildPlatform:
+        let
+          elaborated = lib.systems.elaborate inputBuildPlatform;
+        in
+        if lib.systems.equals elaborated cfg.hostPlatform then
+          cfg.hostPlatform # make identical, so that `==` equality works; see https://github.com/NixOS/nixpkgs/issues/278001
+        else
+          elaborated;
+      defaultText = lib.literalExpression ''config.nixpkgs.hostPlatform'';
+      description = ''
+        Specifies the platform on which nix-darwin should be built.
+        By default, nix-darwin is built on the system where it runs, but you can
+        change where it's built. Setting this option will cause nix-darwin to be
+        cross-compiled.
+
+        For instance, if you're doing distributed multi-platform deployment,
+        or if you're building machines, you can set this to match your
+        development system and/or build farm.
+
+        Ignored when `nixpkgs.pkgs` is set.
+      '';
+    };
+
+    system = lib.mkOption {
+      type = lib.types.str;
+      example = "x86_64-darwin";
+      default =
+        if opt.hostPlatform.isDefined then
+          throw ''
+            Neither ${opt.system} nor any other option in nixpkgs.* is meant
+            to be read by modules and configurations.
+            Use pkgs.stdenv.hostPlatform instead.
+          ''
+        else
+          throw ''
+            Neither ${opt.hostPlatform} nor the legacy option ${opt.system} has been set.
+            The option ${opt.system} is still fully supported for interoperability,
+            but will be deprecated in the future, so we recommend to set ${opt.hostPlatform}.
+          '';
+      defaultText = lib.literalMD ''
+        Traditionally `builtins.currentSystem`, but unset when invoking nix-darwin through `lib.darwinSystem`.
+      '';
+      description = ''
+        Specifies the Nix platform type on which nix-darwin should be built.
+        It is better to specify `nixpkgs.hostPlatform` instead.
+
+        Ignored when `nixpkgs.pkgs` or `nixpkgs.hostPlatform` is set.
+      '';
+    };
+
+    # nix-darwin only
+
+    source = lib.mkOption {
+      type = lib.types.path;
+      defaultText = lib.literalMD ''
+        `<nixpkgs>` or nix-darwin's `nixpkgs` flake input
+      '';
+      description = ''
+        The path to import Nixpkgs from. If you're setting a custom
+        [](#opt-nixpkgs.pkgs) or `_module.args.pkgs`, setting this
+        to something with `rev` and `shortRev` attributes (such as a
+        flake input or `builtins.fetchGit` result) will also set
+        `system.nixpkgsRevision` and related options.
+        (nix-darwin only)
+      '';
+    };
+
+    constructedByUs = lib.mkOption {
+      type = lib.types.bool;
+      internal = true;
+      description = ''
+        Whether `pkgs` was constructed by this module. This is false when any of
+        `nixpkgs.pkgs` or `_module.args.pkgs` is set. (nix-darwin only)
+      '';
+    };
  };

  config = {
+    _module.args = {
+      pkgs =
+        # We explicitly set the default override priority, so that we do not need
+        # to evaluate finalPkgs in case an override is placed on `_module.args.pkgs`.
+        # After all, to determine a definition priority, we need to evaluate `._type`,
+        # which is somewhat costly for Nixpkgs. With an explicit priority, we only
+        # evaluate the wrapper to find out that the priority is lower, and then we
+        # don't need to evaluate `finalPkgs`.
+        lib.mkOverride lib.modules.defaultOverridePriority finalPkgs.__splicedPackages;
+    };

-    # _module.args.pkgs is defined in ../../default.nix
+    nixpkgs.constructedByUs =
+      # We set it with default priority and it can not be merged, so if the
+      # pkgs module argument has that priority, it's from us.
+      (lib.modules.mergeAttrDefinitionsWithPrio options._module.args).pkgs.highestPrio
+      == lib.modules.defaultOverridePriority
+      # Although, if nixpkgs.pkgs is set, we did forward it, but we did not construct it.
+      && !opt.pkgs.isDefined;

+    assertions = [
+      (
+        let
+          pkgsSystem = finalPkgs.stdenv.targetPlatform.system;
+        in
+        {
+          assertion = cfg.constructedByUs -> !hasPlatform -> cfg.system == pkgsSystem;
+          message = "The nix-darwin nixpkgs.pkgs option was set to a Nixpkgs invocation that compiles to target system ${pkgsSystem} but nix-darwin was configured for system ${config.nixpkgs.system} via nix-darwin option nixpkgs.system. The nix-darwin system settings must match the Nixpkgs target system.";
+        }
+      )
+      {
+        assertion = cfg.constructedByUs -> hasPlatform -> legacyOptionsDefined == [ ];
+        message = ''
+          Your system configures nixpkgs with the platform parameter${lib.optionalString hasBuildPlatform "s"}:
+          ${hostPlatformLine}${buildPlatformLine}
+          However, it also defines the legacy options:
+          ${lib.concatMapStrings lib.showOptionWithDefLocs legacyOptionsDefined}
+          For a future proof system configuration, we recommend to remove
+          the legacy definitions.
+        '';
+      }
+      {
+        assertion = opt.pkgs.isDefined -> cfg.config == { };
+        message = ''
+          Your system configures nixpkgs with an externally created instance.
+          `nixpkgs.config` options should be passed when creating the instance instead.
+
+          Current value:
+          ${lib.generators.toPretty { multiline = true; } cfg.config}
+
+          Defined in:
+          ${lib.concatMapStringsSep "\n" (file: "  - ${file}") opt.config.files}
+        '';
+      }
+    ];
  };
 }
@@ -0,0 +1,49 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.power;
+
+  types = lib.types;
+
+  onOff = cond: if cond then "on" else "off";
+in
+
+{
+  options = {
+    power.restartAfterPowerFailure = lib.mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Whether to restart the computer after a power failure.
+
+        Option is not supported on all devices.
+      '';
+    };
+
+    power.restartAfterFreeze = lib.mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Whether to restart the computer after a system freeze.
+      '';
+    };
+  };
+
+  config = {
+
+    system.activationScripts.power.text = ''
+      echo "configuring power..." >&2
+
+      ${lib.optionalString (cfg.restartAfterPowerFailure != null) ''
+        systemsetup -setRestartPowerFailure \
+          '${onOff cfg.restartAfterPowerFailure}' &> /dev/null
+      ''}
+
+      ${lib.optionalString (cfg.restartAfterFreeze != null) ''
+        systemsetup -setRestartFreeze \
+          '${onOff cfg.restartAfterFreeze}' &> /dev/null
+      ''}
+    '';
+
+  };
+}
@@ -0,0 +1,80 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.power.sleep;
+
+  types = lib.types;
+
+  onOff = cond: if cond then "on" else "off";
+in
+
+{
+  options = {
+    power.sleep.computer = lib.mkOption {
+      type = types.nullOr (types.either types.ints.positive (types.enum ["never"]));
+      default = null;
+      example = "never";
+      description = ''
+        Amount of idle time (in minutes) until the computer sleeps.
+
+        `"never"` disables computer sleeping.
+
+        The system might not be considered idle before connected displays sleep, as
+        per the `power.sleep.display` option.
+      '';
+    };
+
+    power.sleep.display = lib.mkOption {
+      type = types.nullOr (types.either types.ints.positive (types.enum ["never"]));
+      default = null;
+      example = "never";
+      description = ''
+        Amount of idle time (in minutes) until displays sleep.
+
+        `"never"` disables display sleeping.
+      '';
+    };
+
+    power.sleep.harddisk = lib.mkOption {
+      type = types.nullOr (types.either types.ints.positive (types.enum ["never"]));
+      default = null;
+      example = "never";
+      description = ''
+        Amount of idle time (in minutes) until hard disks sleep.
+
+        `"never"` disables hard disk sleeping.
+      '';
+    };
+
+    power.sleep.allowSleepByPowerButton = lib.mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Whether the power button can sleep the computer.
+      '';
+    };
+  };
+
+  config = {
+
+    system.activationScripts.power.text = lib.mkAfter ''
+      ${lib.optionalString (cfg.computer != null) ''
+        systemsetup -setComputerSleep '${toString cfg.computer}' &> /dev/null
+      ''}
+
+      ${lib.optionalString (cfg.display != null) ''
+        systemsetup -setDisplaySleep '${toString cfg.display}' &> /dev/null
+      ''}
+
+      ${lib.optionalString (cfg.harddisk != null) ''
+        systemsetup -setHardDiskSleep '${toString cfg.harddisk}' &> /dev/null
+      ''}
+
+      ${lib.optionalString (cfg.allowSleepByPowerButton != null) ''
+        systemsetup -setAllowPowerButtonToSleepComputer \
+          '${onOff cfg.allowSleepByPowerButton}' &> /dev/null
+      ''}
+    '';
+
+  };
+}
@@ -0,0 +1,49 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.programs._1password-gui;
+in
+{
+  options = {
+    programs._1password-gui = {
+      enable = lib.mkEnableOption "the 1Password GUI application";
+
+      package = lib.mkPackageOption pkgs "1Password GUI" {
+        default = [ "_1password-gui" ];
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # Based on https://github.com/reckenrode/nixos-configs/blob/22b8357fc6ffbd0df5ce50dc417c23a807a268a2/modules/by-name/1p/1password/darwin-module.nix
+    system.activationScripts.applications.text = lib.mkAfter ''
+      install -o root -g wheel -m0555 -d "/Applications/1Password.app"
+
+      rsyncFlags=(
+        # mtime is standardized in the nix store, which would leave only file size to distinguish files.
+        # Thus we need checksums, despite the speed penalty.
+        --checksum
+        # Converts all symlinks pointing outside of the copied tree (thus unsafe) into real files and directories.
+        # This neatly converts all the symlinks pointing to application bundles in the nix store into
+        # real directories, without breaking any relative symlinks inside of application bundles.
+        # This is good enough, because the make-symlinks-relative.sh setup hook converts all $out internal
+        # symlinks to relative ones.
+        --copy-unsafe-links
+        --archive
+        --delete
+        --chmod=-w
+        --no-group
+        --no-owner
+      )
+
+      ${lib.getExe pkgs.rsync} "''${rsyncFlags[@]}" \
+        ${cfg.package}/Applications/1Password.app/ /Applications/1Password.app
+    '';
+  };
+}
+
@@ -0,0 +1,31 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.programs._1password;
+in
+{
+  options = {
+    programs._1password = {
+      enable = lib.mkEnableOption "the 1Password CLI tool";
+
+      package = lib.mkPackageOption pkgs "1Password CLI" {
+        default = [ "_1password-cli" ];
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # Integration with the 1Password GUI will only work if the CLI at `/usr/local/bin/op`
+    # Based on https://github.com/reckenrode/nixos-configs/blob/22b8357fc6ffbd0df5ce50dc417c23a807a268a2/modules/by-name/1p/1password/darwin-module.nix
+    system.activationScripts.applications.text = lib.mkAfter ''
+      install -o root -g wheel -m0555 -D \
+        ${lib.getExe cfg.package} /usr/local/bin/op
+    '';
+  };
+}
+
@@ -0,0 +1,41 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.programs.arqbackup;
+in
+{
+  options = {
+    programs.arqbackup = {
+      enable = lib.mkEnableOption "Arq backup";
+
+      # If `arq` is not available then we set `default` to `null` to prevent
+      # eval from breaking while `arq` hasn't been merged yet. Only if a user
+      # enables the module will they be required to set this option.
+      package = lib.mkPackageOption pkgs "arq" (lib.optionalAttrs (!pkgs ? arq) { default = null; });
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    launchd.daemons.arqagent = {
+      command = "${cfg.package}/Applications/Arq.app/Contents/Resources/ArqAgent.app/Contents/MacOS/ArqAgent";
+      serviceConfig.Label = "com.haystacksoftware.arqagent";
+      serviceConfig.RunAtLoad = true;
+      serviceConfig.KeepAlive = true;
+    };
+
+    launchd.user.agents.ArqMonitor = {
+      command = "${cfg.package}/Applications/Arq.app/Contents/Resources/ArqMonitor.app/Contents/MacOS/ArqMonitor";
+      serviceConfig.Label = "com.haystacksoftware.ArqMonitor";
+      serviceConfig.RunAtLoad = true;
+      serviceConfig.KeepAlive = true;
+      managedBy = "programs.arqbackup.enable";
+    };
+  };
+}
@@ -1,95 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  cfg = config.programs.bash;
-
-  shell = pkgs.runCommand pkgs.bashInteractive.name
-    { buildInputs = [ pkgs.makeWrapper ]; }
-    ''
-      source $stdenv/setup
-
-      mkdir -p $out/bin
-      makeWrapper ${pkgs.bashInteractive}/bin/bash $out/bin/bash
-    '';
-
-in
-
-{
-  options = {
-
-    programs.bash.enable = mkOption {
-      type = types.bool;
-      default = false;
-      description = "Whether to configure bash as an interactive shell.";
-    };
-
-    programs.bash.interactiveShellInit = mkOption {
-      default = "";
-      description = "Shell script code called during interactive bash shell initialisation.";
-      type = types.lines;
-    };
-
-    programs.bash.enableCompletion = mkOption {
-      type = types.bool;
-      default = true;
-      description = "Enable bash completion for all interactive bash shells.";
-    };
-
-  };
-
-  config = mkIf cfg.enable {
-
-    environment.systemPackages =
-      [ # Include bash package
-        pkgs.bashInteractive
-      ] ++ optional cfg.enableCompletion pkgs.bash-completion;
-
-    environment.pathsToLink =
-      [ "/etc/bash_completion.d"
-        "/share/bash-completion/completions"
-      ];
-
-    environment.loginShell = mkDefault "${shell}/bin/bash -l";
-    environment.variables.SHELL = mkDefault "${shell}/bin/bash";
-
-    environment.etc."bashrc".text = ''
-      # /etc/bashrc: DO NOT EDIT -- this file has been generated automatically.
-      # This file is read for interactive shells.
-
-      # Only execute this file once per shell.
-      if [ -n "$__ETC_BASHRC_SOURCED" -o -n "$NOSYSBASHRC" ]; then return; fi
-      __ETC_BASHRC_SOURCED=1
-
-      export PATH=${config.environment.systemPath}
-      ${config.system.build.setEnvironment}
-      ${config.system.build.setAliases}
-
-      ${config.environment.extraInit}
-      ${config.environment.interactiveShellInit}
-      ${cfg.interactiveShellInit}
-
-      ${optionalString cfg.enableCompletion ''
-        source "${pkgs.bash-completion}/etc/profile.d/bash_completion.sh"
-
-        nullglobStatus=$(shopt -p nullglob)
-        shopt -s nullglob
-        for p in $NIX_PROFILES; do
-          for m in "$p/etc/bash_completion.d/"* "$p/share/bash-completion/completions/"*; do
-            source $m
-          done
-        done
-        eval "$nullglobStatus"
-        unset nullglobStatus p m
-      ''}
-
-      # Read system-wide modifications.
-      if test -f /etc/bash.local; then
-        source /etc/bash.local
-      fi
-    '';
-
-  };
-}
@@ -0,0 +1,111 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.bash;
+in
+
+{
+  imports = [
+    (mkRenamedOptionModule [ "programs" "bash" "enableCompletion" ] [ "programs" "bash" "completion" "enable" ])
+  ];
+
+  options = {
+
+    programs.bash.enable = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Whether to configure bash as an interactive shell.";
+    };
+
+    programs.bash.interactiveShellInit = mkOption {
+      default = "";
+      description = "Shell script code called during interactive bash shell initialisation.";
+      type = types.lines;
+    };
+
+    programs.bash.completion = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Enable bash completion for all interactive bash shells.
+
+          NOTE: This doesn't work with bash 3.2, which is installed by default on macOS by Apple.
+        '';
+      };
+
+      package = mkPackageOption pkgs "bash-completion" { };
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+
+    environment.systemPackages =
+      [ # Include bash package
+        pkgs.bashInteractive
+      ] ++ optional cfg.completion.enable cfg.completion.package;
+
+    environment.pathsToLink = optionals cfg.completion.enable
+      [ "/etc/bash_completion.d"
+        "/share/bash-completion/completions"
+      ];
+
+    environment.etc."bashrc".text = ''
+      # /etc/bashrc: DO NOT EDIT -- this file has been generated automatically.
+      # This file is read for interactive shells.
+
+      [ -r "/etc/bashrc_$TERM_PROGRAM" ] && . "/etc/bashrc_$TERM_PROGRAM"
+
+      # Only execute this file once per shell.
+      if [ -n "$__ETC_BASHRC_SOURCED" -o -n "$NOSYSBASHRC" ]; then return; fi
+      __ETC_BASHRC_SOURCED=1
+
+      if [ -z "$__NIX_DARWIN_SET_ENVIRONMENT_DONE" ]; then
+        . ${config.system.build.setEnvironment}
+      fi
+
+      # Return early if not running interactively, but after basic nix setup.
+      [[ $- != *i* ]] && return
+
+      # Make bash check its window size after a process completes
+      shopt -s checkwinsize
+
+      ${config.system.build.setAliases.text}
+
+      ${config.environment.interactiveShellInit}
+      ${cfg.interactiveShellInit}
+
+      ${optionalString cfg.completion.enable ''
+        if [ "$TERM" != "dumb" ]; then
+          source "${cfg.completion.package}/etc/profile.d/bash_completion.sh"
+
+          nullglobStatus=$(shopt -p nullglob)
+          shopt -s nullglob
+          for p in $NIX_PROFILES; do
+            for m in "$p/etc/bash_completion.d/"*; do
+              source $m
+            done
+          done
+          eval "$nullglobStatus"
+          unset nullglobStatus p m
+        fi
+      ''}
+
+      # Read system-wide modifications.
+      if test -f /etc/bash.local; then
+        source /etc/bash.local
+      fi
+    '';
+
+    environment.etc."bashrc".knownSha256Hashes = [
+      "444c716ac2ccd9e1e3347858cb08a00d2ea38e8c12fdc5798380dc261e32e9ef"  # macOS
+      "617b39e36fa69270ddbee19ddc072497dbe7ead840cbd442d9f7c22924f116f4"  # official Nix installer
+      "6be16cf7c24a3c6f7ae535c913347a3be39508b3426f5ecd413e636e21031e66"  # official Nix installer
+      "08ffbf991a9e25839d38b80a0d3bce3b5a6c84b9be53a4b68949df4e7e487bb7"  # DeterminateSystems installer
+    ];
+
+  };
+}
@@ -0,0 +1,182 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}: let
+  cfg = config.programs.direnv;
+  enabledOption =
+    x:
+    lib.mkEnableOption x
+    // {
+      default = true;
+      example = false;
+    };
+  format = pkgs.formats.toml {};
+in {
+  meta.maintainers = [
+    lib.maintainers.mattpolzin or "mattpolzin"
+  ];
+  options.programs.direnv = {
+    enable = lib.mkEnableOption ''
+      direnv integration. Takes care of both installation and
+      setting up the sourcing of the shell. Additionally enables nix-direnv
+      integration.
+    '';
+
+    package = lib.mkPackageOption pkgs "direnv" {};
+
+    finalPackage = lib.mkOption {
+      type = lib.types.package;
+      readOnly = true;
+      description = "The wrapped direnv package.";
+    };
+
+    enableBashIntegration = enabledOption ''
+      Bash integration
+    '';
+    enableZshIntegration = enabledOption ''
+      Zsh integration
+    '';
+    enableFishIntegration = enabledOption ''
+      Fish integration
+    '';
+
+    direnvrcExtra = lib.mkOption {
+      type = lib.types.lines;
+      default = "";
+      example = ''
+        export FOO="foo"
+        echo "loaded direnv!"
+      '';
+      description = ''
+        Extra lines to append to the sourced direnvrc
+      '';
+    };
+
+    silent = lib.mkEnableOption ''
+      the hiding of direnv logging
+    '';
+
+    loadInNixShell =
+      (lib.mkEnableOption ''
+        loading direnv in `nix-shell` `nix shell` or `nix develop`
+      '')
+      // {
+        default = true;
+      };
+
+    nix-direnv = {
+      enable =
+        (lib.mkEnableOption ''
+          a faster, persistent implementation of use_nix and use_flake, to replace the built-in one
+        '')
+        // {
+          default = true;
+        };
+
+      package = lib.mkPackageOption pkgs "nix-direnv" {};
+    };
+
+    settings = lib.mkOption {
+      inherit (format) type;
+      default = {};
+      example = lib.literalExpression ''
+        {
+          global = {
+            log_format = "-";
+            log_filter = "^$";
+          };
+        }
+      '';
+      description = ''
+        Direnv configuration. Refer to {manpage}`direnv.toml(1)`.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    programs = {
+      direnv = {
+        finalPackage = pkgs.symlinkJoin {
+          inherit (cfg.package) name;
+          paths = [cfg.package];
+          # direnv has a fish library which automatically sources direnv for some reason
+          postBuild = ''
+            rm -rf "$out/share/fish"
+          '';
+          meta.mainProgram = "direnv";
+        };
+        settings = lib.mkIf cfg.silent {
+          global = {
+            log_format = lib.mkDefault "-";
+            log_filter = lib.mkDefault "^$";
+          };
+        };
+      };
+      zsh.interactiveShellInit = lib.mkIf cfg.enableZshIntegration ''
+        if ${lib.boolToString cfg.loadInNixShell} || printenv PATH | grep -vqc '/nix/store'; then
+         eval "$(${lib.getExe cfg.finalPackage} hook zsh)"
+        fi
+      '';
+
+      #$NIX_GCROOT for "nix develop" https://github.com/NixOS/nix/blob/6db66ebfc55769edd0c6bc70fcbd76246d4d26e0/src/nix/develop.cc#L530
+      #$IN_NIX_SHELL for "nix-shell"
+      bash.interactiveShellInit = lib.mkIf cfg.enableBashIntegration ''
+        if ${lib.boolToString cfg.loadInNixShell} || [ -z "$IN_NIX_SHELL$NIX_GCROOT$(printenv PATH | grep '/nix/store')" ] ; then
+         eval "$(${lib.getExe cfg.finalPackage} hook bash)"
+        fi
+      '';
+
+      fish.interactiveShellInit = lib.mkIf cfg.enableFishIntegration ''
+        if ${lib.boolToString cfg.loadInNixShell};
+        or printenv PATH | grep -vqc '/nix/store';
+         ${lib.getExe cfg.finalPackage} hook fish | source
+        end
+      '';
+    };
+
+    environment = {
+      systemPackages = [
+        cfg.finalPackage
+      ];
+      variables = {
+        DIRENV_CONFIG = "/etc/direnv";
+      };
+      etc = {
+        "direnv/direnv.toml".source = lib.mkIf (cfg.settings != {}) (
+          format.generate "direnv.toml" cfg.settings
+        );
+        "direnv/direnvrc".text = ''
+          ${lib.optionalString cfg.nix-direnv.enable ''
+            #Load nix-direnv
+            source ${cfg.nix-direnv.package}/share/nix-direnv/direnvrc
+          ''}
+
+           #Load direnvrcExtra
+           ${cfg.direnvrcExtra}
+
+           #Load user-configuration if present (~/.direnvrc or ~/.config/direnv/direnvrc)
+           direnv_config_dir_home="''${DIRENV_CONFIG_HOME:-''${XDG_CONFIG_HOME:-$HOME/.config}/direnv}"
+           if [[ -f $direnv_config_dir_home/direnvrc ]]; then
+             source "$direnv_config_dir_home/direnvrc" >&2
+           elif [[ -f $HOME/.direnvrc ]]; then
+             source "$HOME/.direnvrc" >&2
+           fi
+
+           unset direnv_config_dir_home
+        '';
+
+        "direnv/lib/zz-user.sh".text = ''
+          direnv_config_dir_home="''${DIRENV_CONFIG_HOME:-''${XDG_CONFIG_HOME:-$HOME/.config}/direnv}"
+
+          for lib in "$direnv_config_dir_home/lib/"*.sh; do
+            source "$lib"
+          done
+
+          unset direnv_config_dir_home
+        '';
+      };
+    };
+  };
+}
@@ -1,40 +1,49 @@
-{ config, lib, pkgs, ...}:
+{ config, lib, pkgs, ... }:

 with lib;

 let

-  cfg = config.programs.fish;
  cfge = config.environment;

-  foreignEnv = pkgs.writeText "fish-foreign-env" ''
-    # TODO: environment.shellInit
-    ${cfge.extraInit}
-  '';
+  cfg = config.programs.fish;

-  loginForeignEnv = pkgs.writeText "fish-login-foreign-env" ''
-    # TODO: environment.loginShellInit
-  '';
-
-  interactiveForeignEnv = pkgs.writeText "fish-interactive-foreign-env" ''
-    ${cfge.interactiveShellInit}
-  '';
-
-  shell = pkgs.runCommand pkgs.fish.name
-    { buildInputs = [ pkgs.makeWrapper ]; }
-    ''
-      source $stdenv/setup
-
-      mkdir -p $out/bin
-      makeWrapper ${pkgs.fish}/bin/fish $out/bin/fish
-    '';
-
-  fishAliases = concatStringsSep "\n" (
-    mapAttrsFlatten (k: v: "alias ${k} '${v}'") cfg.shellAliases
+  fishAbbrs = concatStringsSep "\n" (
+    mapAttrsToList (k: v: "abbr -a ${k} -- ${escapeShellArg v}") cfg.shellAbbrs
  );

-  fishVariables =
-    mapAttrsToList (n: v: ''set -x ${n} "${v}"'') cfg.variables;
+  fishAliases = concatStringsSep "\n" (
+    mapAttrsToList (k: v: "alias ${k} ${escapeShellArg v}")
+      (filterAttrs (k: v: v != null) cfg.shellAliases)
+  );
+
+  envShellInit = pkgs.writeText "shellInit" cfge.shellInit;
+
+  envLoginShellInit = pkgs.writeText "loginShellInit" cfge.loginShellInit;
+
+  envInteractiveShellInit = pkgs.writeText "interactiveShellInit" cfge.interactiveShellInit;
+
+  fenv = pkgs.fishPlugins.foreign-env or pkgs.fish-foreign-env;
+
+  # fishPlugins.foreign-env and fish-foreign-env have different function paths
+  fenvFunctionsDir = if (pkgs ? fishPlugins.foreign-env)
+    then "${fenv}/share/fish/vendor_functions.d"
+    else "${fenv}/share/fish-foreign-env/functions";
+
+  sourceEnv = file:
+  if cfg.useBabelfish then
+    "source /etc/fish/${file}.fish"
+  else
+    ''
+      set fish_function_path ${fenvFunctionsDir} $fish_function_path
+      fenv source /etc/fish/foreign-env/${file} > /dev/null
+      set -e fish_function_path[1]
+    '';
+
+  babelfishTranslate = path: name:
+    pkgs.runCommand "${name}.fish" {} ''
+      ${cfg.babelfishPackage}/bin/babelfish < ${path} > $out
+    '';

 in

@@ -45,109 +54,211 @@ in
    programs.fish = {

      enable = mkOption {
-        type = types.bool;
        default = false;
        description = ''
          Whether to configure fish as an interactive shell.
        '';
+        type = types.bool;
      };

-      variables = mkOption {
-        type = types.attrsOf (types.either types.str (types.listOf types.str));
-        default = {};
+      package = lib.mkPackageOption pkgs "fish" { };
+
+      useBabelfish = mkOption {
+        type = types.bool;
+        default = false;
        description = ''
-          A set of environment variables used in the global environment.
-          These variables will be set on shell initialisation.
-          The value of each variable can be either a string or a list of
-          strings.  The latter is concatenated, interspersed with colon
-          characters.
+          If enabled, the configured environment will be translated to native fish using [babelfish](https://github.com/bouk/babelfish).
+          Otherwise, [foreign-env](https://github.com/oh-my-fish/plugin-foreign-env) will be used.
        '';
-        apply = mapAttrs (n: v: if isList v then concatStringsSep ":" v else v);
+      };
+
+      babelfishPackage = mkOption {
+        type = types.package;
+        default = pkgs.babelfish;
+        description = ''
+          The babelfish package to use when useBabelfish is
+          set to true.
+        '';
+      };
+
+      vendor.config.enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether fish should source configuration snippets provided by other packages.
+        '';
+      };
+
+      vendor.completions.enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether fish should use completion files provided by other packages.
+        '';
+      };
+
+      vendor.functions.enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether fish should autoload fish functions provided by other packages.
+        '';
+      };
+
+      shellAbbrs = mkOption {
+        default = {};
+        example = {
+          gco = "git checkout";
+          npu = "nix-prefetch-url";
+        };
+        description = ''
+          Set of fish abbreviations.
+        '';
+        type = with types; attrsOf str;
      };

      shellAliases = mkOption {
-        type = types.attrs;
-        default = cfge.shellAliases;
+        default = config.environment.shellAliases;
        description = ''
-          Set of aliases for fish shell. See <option>environment.shellAliases</option>
+          Set of aliases for fish shell. See {option}`environment.shellAliases`
          for an option format description.
        '';
+        type = types.attrs;
      };

      shellInit = mkOption {
-        type = types.lines;
        default = "";
        description = ''
-          Shell Script code called during fish shell initialisation.
+          Shell script code called during fish shell initialisation.
        '';
+        type = types.lines;
      };

      loginShellInit = mkOption {
-        type = types.lines;
        default = "";
        description = ''
          Shell script code called during fish login shell initialisation.
        '';
+        type = types.lines;
      };

      interactiveShellInit = mkOption {
-        type = types.lines;
        default = "";
        description = ''
          Shell script code called during interactive fish shell initialisation.
        '';
+        type = types.lines;
      };

      promptInit = mkOption {
-        type = types.lines;
        default = "";
        description = ''
          Shell script code used to initialise fish prompt.
        '';
+        type = types.lines;
      };

    };
+
  };

  config = mkIf cfg.enable {

-    environment.systemPackages = [ pkgs.fish ];
+    environment = mkMerge [
+      (mkIf cfg.useBabelfish
+      {
+        etc."fish/setEnvironment.fish".source = babelfishTranslate config.system.build.setEnvironment "setEnvironment";
+        etc."fish/shellInit.fish".source = babelfishTranslate envShellInit "shellInit";
+        etc."fish/loginShellInit.fish".source = babelfishTranslate envLoginShellInit "loginShellInit";
+        etc."fish/interactiveShellInit.fish".source = babelfishTranslate envInteractiveShellInit "interactiveShellInit";
+     })

-    environment.pathsToLink = [ "/share/fish" ];
+      (mkIf (!cfg.useBabelfish)
+      {
+        etc."fish/foreign-env/shellInit".source = envShellInit;
+        etc."fish/foreign-env/loginShellInit".source = envLoginShellInit;
+        etc."fish/foreign-env/interactiveShellInit".source = envInteractiveShellInit;
+      })

-    environment.loginShell = mkDefault "${shell}/bin/fish -l";
-    environment.variables.SHELL = mkDefault "${shell}/bin/fish";
+      {
+        etc."fish/nixos-env-preinit.fish".text =
+        if cfg.useBabelfish
+        then ''
+          # source the NixOS environment config
+          if [ -z "$__NIX_DARWIN_SET_ENVIRONMENT_DONE" ]
+            source /etc/fish/setEnvironment.fish
+          end
+        ''
+        else ''
+          # This happens before $__fish_datadir/config.fish sets fish_function_path, so it is currently
+          # unset. We set it and then completely erase it, leaving its configuration to $__fish_datadir/config.fish
+          set fish_function_path ${fenvFunctionsDir} $__fish_datadir/functions

-    environment.etc."fish/config.fish".text = ''
-      # /etc/fish/config.fish: DO NOT EDIT -- this file has been generated automatically.
+          # source the NixOS environment config
+          if [ -z "$__NIX_DARWIN_SET_ENVIRONMENT_DONE" ]
+            fenv source ${config.system.build.setEnvironment}
+          end

-      set fish_function_path $fish_function_path ${pkgs.fish-foreign-env}/share/fish-foreign-env/functions
+          # clear fish_function_path so that it will be correctly set when we return to $__fish_datadir/config.fish
+          set -e fish_function_path
+        '';
+      }
+      {
+        etc."fish/config.fish".text = ''
+        # /etc/fish/config.fish: DO NOT EDIT -- this file has been generated automatically.

-      set PATH ${replaceStrings [":"] [" "] config.environment.systemPath}
+        # if we haven't sourced the general config, do it
+        if not set -q __fish_nix_darwin_general_config_sourced
+          ${sourceEnv "shellInit"}

-      ${config.system.build.setEnvironment}
+          ${cfg.shellInit}

-      fenv source ${foreignEnv}
-      ${cfg.shellInit}
+          # and leave a note so we don't source this config section again from
+          # this very shell (children will source the general config anew)
+          set -g __fish_nix_darwin_general_config_sourced 1
+        end

-      ${concatStringsSep "\n" fishVariables}
+        # if we haven't sourced the login config, do it
+        status --is-login; and not set -q __fish_nix_darwin_login_config_sourced
+        and begin
+          ${sourceEnv "loginShellInit"}

-      if status --is-login
-        # TODO: environment.loginShellInit
-        ${cfg.loginShellInit}
-      end
+          ${cfg.loginShellInit}

-      if status --is-interactive
-        ${fishAliases}
-        ${optionalString (cfge.interactiveShellInit != "") ''
-          fenv source ${interactiveForeignEnv}
-        ''}
+          # and leave a note so we don't source this config section again from
+          # this very shell (children will source the general config anew)
+          set -g __fish_nix_darwin_login_config_sourced 1
+        end

-        ${cfg.interactiveShellInit}
-        ${cfg.promptInit}
-      end
-    '';
+        # if we haven't sourced the interactive config, do it
+        status --is-interactive; and not set -q __fish_nix_darwin_interactive_config_sourced
+        and begin
+          ${fishAbbrs}
+          ${fishAliases}

+          ${sourceEnv "interactiveShellInit"}
+
+          ${cfg.promptInit}
+          ${cfg.interactiveShellInit}
+
+          # and leave a note so we don't source this config section again from
+          # this very shell (children will source the general config anew,
+          # allowing configuration changes in, e.g, aliases, to propagate)
+          set -g __fish_nix_darwin_interactive_config_sourced 1
+        end
+      '';
+      }
+
+      # include programs that bring their own completions
+      {
+        pathsToLink = []
+          ++ optional cfg.vendor.config.enable "/share/fish/vendor_conf.d"
+          ++ optional cfg.vendor.completions.enable "/share/fish/vendor_completions.d"
+          ++ optional cfg.vendor.functions.enable "/share/fish/vendor_functions.d";
+      }
+
+      { systemPackages = [ cfg.package ]; }
+    ];
  };

 }
@@ -0,0 +1,68 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    getExe'
+    mkIf
+    mkOption
+    mkPackageOption
+    optionalString
+    types
+    ;
+
+  cfg = config.programs.gnupg;
+
+in
+
+{
+  options.programs.gnupg = {
+    package = mkPackageOption pkgs "gnupg" { };
+
+    agent.enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Enables GnuPG agent for every user session.
+      '';
+    };
+
+    agent.enableSSHSupport = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Enable SSH agent support in GnuPG agent. Also sets SSH_AUTH_SOCK
+        environment variable correctly.
+      '';
+    };
+  };
+
+  config = mkIf cfg.agent.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    launchd.user.agents.gnupg-agent.serviceConfig = {
+      ProgramArguments = [
+        (getExe' cfg.package "gpg-connect-agent")
+        "/bye"
+      ];
+      RunAtLoad = cfg.agent.enableSSHSupport;
+      KeepAlive.SuccessfulExit = false;
+    };
+
+    environment.extraInit = ''
+      # Bind gpg-agent to this TTY if gpg commands are used.
+      export GPG_TTY=$(tty)
+    ''
+    + (optionalString cfg.agent.enableSSHSupport ''
+      # SSH agent protocol doesn't support changing TTYs, so bind the agent
+      # to every new TTY.
+      ${getExe' cfg.package "gpg-connect-agent"} --quiet updatestartuptty /bye > /dev/null 2>&1
+
+      export SSH_AUTH_SOCK=$(${getExe' cfg.package "gpgconf"} --list-dirs agent-ssh-socket)
+    '');
+  };
+}
@@ -0,0 +1,35 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.info;
+in
+
+{
+  options = {
+    programs.info.enable = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Whether to enable info pages and the {command}`info` command.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    environment.systemPackages = [ pkgs.texinfoInteractive ];
+
+    environment.pathsToLink = [ "/info" "/share/info" ];
+    environment.extraOutputsToInstall = [ "info" ];
+
+    environment.extraSetup = ''
+      if test -w $out/share/info; then
+        shopt -s nullglob
+        for i in $out/share/info/*.info $out/share/info/*.info.gz; do
+          ${pkgs.texinfoInteractive}/bin/install-info $i $out/share/info/dir
+        done
+      fi
+    '';
+
+  };
+}
@@ -9,8 +9,8 @@ with lib;
      type = types.bool;
      default = true;
      description = ''
-        Whether to enable manual pages and the <command>man</command> command.
-        This also includes "man" outputs of all <literal>systemPackages</literal>.
+        Whether to enable manual pages and the {command}`man` command.
+        This also includes "man" outputs of all `systemPackages`.
      '';
    };

@@ -0,0 +1,33 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.nix-index;
+in
+
+{
+  options = {
+    programs.nix-index.enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether to enable nix-index and its command-not-found helper.";
+    };
+
+    programs.nix-index.package = mkOption {
+      type = types.package;
+      default = pkgs.nix-index;
+      defaultText = "pkgs.nix-index";
+      description = "This option specifies the nix-index package to use.";
+    };
+  };
+
+
+  config = mkIf config.programs.nix-index.enable {
+
+    environment.systemPackages = [ cfg.package ];
+
+    environment.interactiveShellInit = "source ${cfg.package}/etc/profile.d/command-not-found.sh";
+
+  };
+}
@@ -1,47 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  cfg = config.programs.nix-script;
-
-  nix-script = pkgs.substituteAll {
-    inherit (cfg) name;
-    src = ../../pkgs/nix-tools/nix-script.sh;
-    dir = "bin";
-    isExecutable = true;
-  };
-
-in
-
-{
-  options = {
-
-    programs.nix-script.enable = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Whether to enable the nix script.
-      '';
-    };
-
-    programs.nix-script.name = mkOption {
-      type = types.str;
-      default = "nix";
-      description = ''
-        Name to use for the nix script.
-      '';
-    };
-
-  };
-
-  config = mkIf cfg.enable {
-
-    environment.systemPackages =
-      [ # Nix wrapper script
-        nix-script
-      ];
-
-  };
-}
@@ -0,0 +1,200 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.programs.ssh;
+
+  knownHosts = builtins.attrValues cfg.knownHosts;
+
+  host =
+    { name, config, ... }:
+    {
+      options = {
+        certAuthority = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+          description = ''
+            This public key is an SSH certificate authority, rather than an
+            individual host's key.
+          '';
+        };
+        hostNames = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ name ] ++ config.extraHostNames;
+          description = ''
+            The set of system-wide known SSH hosts. To make simple setups more
+            convenient the name of an attribute in this set is used as a host name
+            for the entry. This behaviour can be disabled by setting
+            `hostNames` explicitly. You can use
+            `extraHostNames` to add additional host names without
+            disabling this default.
+          '';
+        };
+        extraHostNames = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [];
+          description = ''
+            A list of additional host names and/or IP numbers used for
+            accessing the host's ssh service. This list is ignored if
+            `hostNames` is set explicitly.
+          '';
+        };
+        publicKey = lib.mkOption {
+          default = null;
+          type = lib.types.nullOr lib.types.str;
+          example = "ecdsa-sha2-nistp521 AAAAE2VjZHN...UEPg==";
+          description = ''
+            The public key data for the host. You can fetch a public key
+            from a running SSH server with the {command}`ssh-keyscan`
+            command. The public key should not include any host names, only
+            the key type and the key itself.
+          '';
+        };
+        publicKeyFile = lib.mkOption {
+          default = null;
+          type = lib.types.nullOr lib.types.path;
+          description = ''
+            The path to the public key file for the host. The public
+            key file is read at build time and saved in the Nix store.
+            You can fetch a public key file from a running SSH server
+            with the {command}`ssh-keyscan` command. The content
+            of the file should follow the same format as described for
+            the `publicKey` option.
+          '';
+        };
+      };
+    };
+  # Taken from: https://github.com/NixOS/nixpkgs/blob/f4aa6afa5f934ece2d1eb3157e392d056be01617/nixos/modules/services/networking/ssh/sshd.nix#L46-L93
+  userOptions = {
+
+    options.openssh.authorizedKeys = {
+      keys = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [];
+        description = ''
+          A list of verbatim OpenSSH public keys that should be added to the
+          user's authorized keys. The keys are added to a file that the SSH
+          daemon reads in addition to the the user's authorized_keys file.
+          You can combine the `keys` and
+          `keyFiles` options.
+          Warning: If you are using `NixOps` then don't use this
+          option since it will replace the key required for deployment via ssh.
+        '';
+      };
+
+      keyFiles = lib.mkOption {
+        type = lib.types.listOf lib.types.path;
+        default = [];
+        description = ''
+          A list of files each containing one OpenSSH public key that should be
+          added to the user's authorized keys. The contents of the files are
+          read at build time and added to a file that the SSH daemon reads in
+          addition to the the user's authorized_keys file. You can combine the
+          `keyFiles` and `keys` options.
+        '';
+      };
+    };
+
+  };
+
+  authKeysFiles = let
+    mkAuthKeyFile = u: lib.nameValuePair "ssh/nix_authorized_keys.d/${u.name}" {
+      text = ''
+        ${builtins.concatStringsSep "\n" u.openssh.authorizedKeys.keys}
+        ${lib.concatMapStrings (f: builtins.readFile f + "\n") u.openssh.authorizedKeys.keyFiles}
+      '';
+    };
+    usersWithKeys = builtins.attrValues (lib.flip lib.filterAttrs config.users.users (n: u:
+      lib.length u.openssh.authorizedKeys.keys != 0 || lib.length u.openssh.authorizedKeys.keyFiles != 0
+    ));
+  in lib.listToAttrs (map mkAuthKeyFile usersWithKeys);
+
+  oldAuthorizedKeysHash = "5a5dc1e20e8abc162ad1cc0259bfd1dbb77981013d87625f97d9bd215175fc0a";
+in
+
+{
+  imports = [
+    (lib.mkRemovedOptionModule [ "services" "openssh" "authorizedKeysFiles" ] "No `nix-darwin` equivalent to this NixOS option.")
+  ];
+
+  options = {
+
+    users.users = lib.mkOption {
+      type = with lib.types; attrsOf (submodule userOptions);
+    };
+
+    programs.ssh.extraConfig = lib.mkOption {
+      type = lib.types.lines;
+      default = "";
+      description = ''
+        Extra configuration text loaded in {file}`ssh_config`.
+        See {manpage}`ssh_config(5)` for help.
+      '';
+    };
+
+    programs.ssh.knownHosts = lib.mkOption {
+      default = {};
+      type = lib.types.attrsOf (lib.types.submodule host);
+      description = ''
+        The set of system-wide known SSH hosts. To make simple setups more
+        convenient the name of an attribute in this set is used as a host name
+        for the entry. This behaviour can be disabled by setting
+        `hostNames` explicitly. You can use
+        `extraHostNames` to add additional host names without
+        disabling this default.
+      '';
+      example = lib.literalExpression ''
+        {
+          myhost = {
+            extraHostNames = [ "myhost.mydomain.com" "10.10.1.4" ];
+            publicKeyFile = ./pubkeys/myhost_ssh_host_dsa_key.pub;
+          };
+          "myhost2.net".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILIRuJ8p1Fi+m6WkHV0KWnRfpM1WxoW8XAS+XvsSKsTK";
+          "myhost2.net/dsa" = {
+            hostNames = [ "myhost2.net" ];
+            publicKeyFile = ./pubkeys/myhost2_ssh_host_dsa_key.pub;
+          };
+        }
+      '';
+    };
+  };
+
+  config = {
+
+    assertions = lib.flip lib.mapAttrsToList cfg.knownHosts (name: data: {
+      assertion = (data.publicKey == null && data.publicKeyFile != null) ||
+                  (data.publicKey != null && data.publicKeyFile == null);
+      message = "knownHost ${name} must contain either a publicKey or publicKeyFile";
+    });
+
+    environment.etc = authKeysFiles //
+      { "ssh/ssh_known_hosts" = lib.mkIf (builtins.length knownHosts > 0) {
+          text = (lib.flip (lib.concatMapStringsSep "\n") knownHosts
+            (h: assert h.hostNames != [];
+              lib.optionalString h.certAuthority "@cert-authority " + builtins.concatStringsSep "," h.hostNames + " "
+              + (if h.publicKey != null then h.publicKey else builtins.readFile h.publicKeyFile)
+            )) + "\n";
+        };
+        "ssh/ssh_config.d/100-nix-darwin.conf".text = config.programs.ssh.extraConfig;
+        "ssh/sshd_config.d/101-authorized-keys.conf" = {
+          text = ''
+            # sshd doesn't like reading from symbolic links, so we cat
+            # the file ourselves.
+            AuthorizedKeysCommand /bin/cat /etc/ssh/nix_authorized_keys.d/%u
+            # Just a simple cat, fine to use _sshd.
+            AuthorizedKeysCommandUser _sshd
+          '';
+          # Allows us to automatically migrate from using a file to a symlink
+          knownSha256Hashes = [ oldAuthorizedKeysHash ];
+        };
+      };
+
+    system.activationScripts.etc.text = ''
+      # Clean up .before-nix-darwin file left over from using knownSha256Hashes
+      auth_keys_orig=/etc/ssh/sshd_config.d/101-authorized-keys.conf.before-nix-darwin
+
+      if [ -e "$auth_keys_orig" ] && [ "$(shasum -a 256 $auth_keys_orig | cut -d ' ' -f 1)" = "${oldAuthorizedKeysHash}" ]; then
+        rm "$auth_keys_orig"
+      fi
+    '';
+  };
+}
@@ -3,7 +3,6 @@
 with lib;

 let
-
  inherit (pkgs) stdenv;

  cfg = config.programs.tmux;
@@ -19,6 +18,7 @@ let
        --set __ETC_ZPROFILE_SOURCED  "" \
        --set __ETC_ZSHENV_SOURCED "" \
        --set __ETC_ZSHRC_SOURCED "" \
+        --set __NIX_DARWIN_SET_ENVIRONMENT_DONE "" \
        --add-flags -f --add-flags /etc/tmux.conf
    '';

@@ -36,24 +36,35 @@ let
    session=$(tmux list-sessions -F '#{session_name}' | fzf --query="$1" --exit-0)
    tmux switch-client -t "$session"
  '';
+in

-in {
+{
+  imports = [
+    (mkRenamedOptionModule [ "programs" "tmux" "tmuxConfig" ] [ "programs" "tmux" "extraConfig" ])
+    (mkRemovedOptionModule [ "programs" "tmux" "defaultCommand" ] "Use `programs.tmux.extraConfig` to configure the default command instead. If unset, tmux will default to using your system configured login shell.")
+  ];
  options = {
-
    programs.tmux.enable = mkOption {
      type = types.bool;
      default = false;
-      description = ''
-        Whether to configure tmux.
-      '';
+      description = "Whether to configure tmux.";
    };

    programs.tmux.enableSensible = mkOption {
      type = types.bool;
      default = false;
      example = true;
+      description = "Enable sensible configuration options for tmux.";
+    };
+
+    programs.tmux.reverseSplitBindings = mkOption {
+      type = types.bool;
+      default = config.system.stateVersion <= 6 && cfg.enableSensible;
+      defaultText = literalExpression "config.system.stateVersion <= 6 && config.programs.tmux.enableSensible";
+      example = true;
      description = ''
-        Enable sensible configuration options for tmux.
+        Whether to reverse the `%` and `"` split-window key bindings
+        emitted by the tmux module.
      '';
    };

@@ -61,27 +72,28 @@ in {
      type = types.bool;
      default = false;
      example = true;
-      description = ''
-        Enable mouse support for tmux.
-      '';
+      description = "Enable mouse support for tmux.";
    };

    programs.tmux.enableFzf = mkOption {
      type = types.bool;
      default = false;
      example = true;
-      description = ''
-        Enable fzf keybindings for selecting tmux sessions and panes.
-      '';
+      description = "Enable fzf keybindings for selecting tmux sessions and panes.";
    };

    programs.tmux.enableVim = mkOption {
      type = types.bool;
      default = false;
      example = true;
-      description = ''
-        Enable vim style keybindings for copy mode, and navigation of tmux panes.
-      '';
+      description = "Enable vim style keybindings for copy mode, and navigation of tmux panes.";
+    };
+
+    programs.tmux.iTerm2 = mkOption {
+      type = types.bool;
+      default = false;
+      example = true;
+      description = "Cater to iTerm2 and its tmux integration, as appropriate.";
    };

    programs.tmux.tmuxOptions = mkOption {
@@ -90,15 +102,19 @@ in {
      default = {};
    };

-    programs.tmux.tmuxConfig = mkOption {
+    programs.tmux.extraConfig = mkOption {
      type = types.lines;
      default = "";
+      description = "Extra configuration to add to {file}`tmux.conf`.";
    };
-
  };

  config = mkIf cfg.enable {

+    warnings = mkIf cfg.iTerm2 [
+      "The programs.tmux.iTerm2 is no longer needed and doesn't do anything anymore"
+    ];
+
    environment.systemPackages =
      [ # Include wrapped tmux package.
        tmux
@@ -106,17 +122,11 @@ in {

    environment.etc."tmux.conf".text = ''
      ${tmuxOptions}
-      ${cfg.tmuxConfig}
+      ${cfg.extraConfig}

      source-file -q /etc/tmux.conf.local
    '';

-    programs.tmux.tmuxOptions.login-shell.text = if stdenv.isDarwin then ''
-      set -g default-command "${pkgs.reattach-to-user-namespace}/bin/reattach-to-user-namespace ${config.environment.loginShell}"
-    '' else ''
-      set -g default-command "${config.environment.loginShell}"
-    '';
-
    programs.tmux.tmuxOptions.sensible.text = mkIf cfg.enableSensible ''
      set -g default-terminal "screen-256color"
      setw -g aggressive-resize on
@@ -128,8 +138,6 @@ in {
      set -s escape-time 0

      bind c new-window -c '#{pane_current_path}'
-      bind % split-window -v -c '#{pane_current_path}'
-      bind '"' split-window -h -c '#{pane_current_path}'

      # TODO: make these interactive
      bind C new-session
@@ -139,6 +147,11 @@ in {
      # set -g utf8 on
    '';

+    programs.tmux.tmuxOptions.splitBindings.text = mkIf cfg.reverseSplitBindings ''
+      bind % split-window -v -c '#{pane_current_path}'
+      bind '"' split-window -h -c '#{pane_current_path}'
+    '';
+
    programs.tmux.tmuxOptions.mouse.text = mkIf cfg.enableMouse ''
      set -g mouse on
      setw -g mouse on
@@ -160,11 +173,12 @@ in {
      bind s split-window -v -c '#{pane_current_path}'
      bind v split-window -h -c '#{pane_current_path}'

-      bind -t vi-copy v begin-selection
+      bind-key -T copy-mode-vi p send-keys -X copy-pipe-and-cancel "tmux paste-buffer"
+      bind-key -T copy-mode-vi v send-keys -X begin-selection
    '' + optionalString stdenv.isLinux ''
-      bind -t vi-copy y copy-selection
+      bind-key -T copy-mode-vi y send-keys -X copy-selection-and-cancel
    '' + optionalString stdenv.isDarwin ''
-      bind -t vi-copy y copy-pipe "${pkgs.reattach-to-user-namespace}/bin/reattach-to-user-namespace pbcopy"
+      bind-key -T copy-mode-vi y send-keys -X copy-pipe-and-cancel "pbcopy"
    '');

  };
@@ -3,49 +3,35 @@
 with lib;

 let
-
  cfg = config.programs.vim;

-  vim = pkgs.vim_configurable.customize {
-    name = "vim";
-    vimrcConfig.customRC = config.environment.etc."vimrc".text;
-    vimrcConfig.vam = {
-      knownPlugins = pkgs.vimPlugins // cfg.extraKnownPlugins;
-      pluginDictionaries = cfg.plugins;
-    };
-  };
-
  text = import ../lib/write-text.nix {
    inherit lib;
    mkTextDerivation = name: text: pkgs.writeText "vim-options-${name}" text;
  };

  vimOptions = concatMapStringsSep "\n" (attr: attr.text) (attrValues cfg.vimOptions);
+in

-in {
+{
  options = {
-
    programs.vim.enable = mkOption {
      type = types.bool;
      default = false;
-      description = ''
-        Whether to configure vim.
-      '';
+      description = "Whether to configure vim.";
    };

    programs.vim.enableSensible = mkOption {
      type = types.bool;
      default = false;
      example = true;
-      description = ''
-        Enable sensible configuration options for vim.
-      '';
+      description = "Enable sensible configuration options for vim.";
    };

    programs.vim.extraKnownPlugins = mkOption {
      type = types.attrsOf types.package;
      default = {};
-      example = literalExample
+      example = literalExpression
        ''
        {
          vim-jsx = pkgs.vimUtils.buildVimPluginFrom2Nix {
@@ -60,18 +46,19 @@ in {
          };
        }
        '';
-      description = ''
-        Custom plugin declarations to add to VAM's knownPlugins.
-      '';
+      description = "Custom plugin declarations to add to VAM's knownPlugins.";
    };

    programs.vim.plugins = mkOption {
      type = types.listOf types.attrs;
      default = [];
      example = [ { names = [ "surround" "vim-nix" ]; } ];
-      description = ''
-        VAM plugin dictionaries to use for vim_configurable.
-      '';
+      description = "VAM plugin dictionaries to use for vim_configurable.";
+    };
+
+    programs.vim.package = mkOption {
+      internal = true;
+      type = types.package;
    };

    programs.vim.vimOptions = mkOption {
@@ -83,21 +70,18 @@ in {
    programs.vim.vimConfig = mkOption {
      type = types.lines;
      default = "";
-      description = ''
-        Extra vimrcConfig to use for vim_configurable.
-      '';
+      description = "Extra vimrcConfig to use for vim_configurable.";
    };
-
  };

  config = mkIf cfg.enable {

    environment.systemPackages =
-      [ # Include vim_configurable package.
-        vim
+      [ # Include vim-full package.
+        cfg.package
      ];

-    environment.variables.EDITOR = "${vim}/bin/vim";
+    environment.variables.EDITOR = "${cfg.package}/bin/vim";

    environment.etc."vimrc".text = ''
      ${vimOptions}
@@ -108,6 +92,15 @@ in {
      endif
    '';

+    programs.vim.package = pkgs.vim-full.customize {
+      name = "vim";
+      vimrcConfig.customRC = config.environment.etc."vimrc".text;
+      vimrcConfig.vam = {
+        knownPlugins = pkgs.vimPlugins // cfg.extraKnownPlugins;
+        pluginDictionaries = cfg.plugins;
+      };
+    };
+
    programs.vim.plugins = mkIf cfg.enableSensible [
      { names = [ "fugitive" "surround" "vim-nix" ]; }
    ];
@@ -1,36 +1,24 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, options, pkgs, ... }:

 with lib;

 let
-
  cfg = config.programs.zsh;
+  opt = options.programs.zsh;

  zshVariables =
    mapAttrsToList (n: v: ''${n}="${v}"'') cfg.variables;

-  fzfCompletion = "${pkgs.fzf.src}/shell/completion.zsh";
-
+  fzfCompletion = ./fzf-completion.zsh;
  fzfGit = ./fzf-git.zsh;
  fzfHistory = ./fzf-history.zsh;
-
-  shell = pkgs.runCommand pkgs.zsh.name
-    { buildInputs = [ pkgs.makeWrapper ]; }
-    ''
-      source $stdenv/setup
-
-      mkdir -p $out/bin
-      makeWrapper ${pkgs.zsh}/bin/zsh $out/bin/zsh
-    '';
-
 in

 {
  options = {
-
    programs.zsh.enable = mkOption {
      type = types.bool;
-      default = false;
+      default = true;
      description = "Whether to configure zsh as an interactive shell.";
    };

@@ -67,10 +55,22 @@ in

    programs.zsh.promptInit = mkOption {
      type = types.lines;
-      default = "autoload -U promptinit && promptinit && prompt walters";
+      default = "autoload -U promptinit && promptinit && prompt suse && setopt prompt_sp";
      description = "Shell script code used to initialise the zsh prompt.";
    };

+    programs.zsh.histSize = mkOption {
+      type = types.int;
+      default = 2000;
+      description = "Change history size.";
+    };
+
+    programs.zsh.histFile = mkOption {
+      type = types.str;
+      default = "$HOME/.zsh_history";
+      description = "Change history file.";
+    };
+
    programs.zsh.enableCompletion = mkOption {
      type = types.bool;
      default = true;
@@ -83,6 +83,19 @@ in
      description = "Enable bash completion for all interactive zsh shells.";
    };

+    programs.zsh.enableGlobalCompInit = mkOption {
+      type = types.bool;
+      default = cfg.enableCompletion;
+      defaultText = literalExpression "config.${opt.enableCompletion}";
+      description = ''
+        Enable execution of compinit call for all interactive zsh shells.
+
+        This option can be disabled if the user wants to extend its
+        `fpath` and a custom `compinit`
+        call in the local config is required.
+      '';
+    };
+
    programs.zsh.enableFzfCompletion = mkOption {
      type = types.bool;
      default = false;
@@ -101,37 +114,59 @@ in
      description = "Enable fzf keybinding for Ctrl-r history search.";
    };

+    programs.zsh.enableAutosuggestions = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Enable zsh-autosuggestions.";
+    };
+
    programs.zsh.enableSyntaxHighlighting = mkOption {
      type = types.bool;
      default = false;
      description = "Enable zsh-syntax-highlighting.";
    };

+    programs.zsh.enableFastSyntaxHighlighting = mkEnableOption "zsh-fast-syntax-highlighting";
  };

  config = mkIf cfg.enable {

+    assertions = [
+      {
+        assertion = !(cfg.enableSyntaxHighlighting && cfg.enableFastSyntaxHighlighting);
+        message = "zsh-syntax-highlighting and zsh-fast-syntax-highlighting are mutually exclusive, please disable one of them.";
+      }
+    ];
    environment.systemPackages =
      [ # Include zsh package
        pkgs.zsh
      ] ++ optional cfg.enableCompletion pkgs.nix-zsh-completions
-        ++ optional cfg.enableSyntaxHighlighting pkgs.zsh-syntax-highlighting;
+        ++ optional cfg.enableAutosuggestions pkgs.zsh-autosuggestions
+        ++ optional cfg.enableSyntaxHighlighting pkgs.zsh-syntax-highlighting
+        ++ optional cfg.enableFastSyntaxHighlighting pkgs.zsh-fast-syntax-highlighting;

    environment.pathsToLink = [ "/share/zsh" ];

-    environment.loginShell = mkDefault "${shell}/bin/zsh -l";
-    environment.variables.SHELL = mkDefault "${shell}/bin/zsh";
-
    environment.etc."zshenv".text = ''
      # /etc/zshenv: DO NOT EDIT -- this file has been generated automatically.
      # This file is read for all shells.

      # Only execute this file once per shell.
-      # But don't clobber the environment of interactive non-login children!
-      if [ -n "$__ETC_ZSHENV_SOURCED" ]; then return; fi
-      export __ETC_ZSHENV_SOURCED=1
+      if [ -n "''${__ETC_ZSHENV_SOURCED-}" ]; then return; fi
+      __ETC_ZSHENV_SOURCED=1

-      ${cfg.shellInit}
+      if [[ -o rcs ]]; then
+        if [ -z "''${__NIX_DARWIN_SET_ENVIRONMENT_DONE-}" ]; then
+          . ${config.system.build.setEnvironment}
+        fi
+
+        # Tell zsh how to find installed completions
+        for p in ''${(z)NIX_PROFILES}; do
+          fpath=($p/share/zsh/site-functions $p/share/zsh/$ZSH_VERSION/functions $p/share/zsh/vendor-completions $fpath)
+        done
+
+        ${cfg.shellInit}
+      fi

      # Read system-wide modifications.
      if test -f /etc/zshenv.local; then
@@ -144,10 +179,11 @@ in
      # This file is read for login shells.

      # Only execute this file once per shell.
-      if [ -n "$__ETC_ZPROFILE_SOURCED" ]; then return; fi
+      if [ -n "''${__ETC_ZPROFILE_SOURCED-}" ]; then return; fi
      __ETC_ZPROFILE_SOURCED=1

      ${concatStringsSep "\n" zshVariables}
+      ${config.system.build.setAliases.text}

      ${cfg.loginShellInit}

@@ -161,43 +197,43 @@ in
      # /etc/zshrc: DO NOT EDIT -- this file has been generated automatically.
      # This file is read for interactive shells.

-      bindkey -e
-      ${optionalString cfg.enableFzfCompletion "source ${fzfCompletion}"}
-      ${optionalString cfg.enableFzfGit "source ${fzfGit}"}
-      ${optionalString cfg.enableFzfHistory "source ${fzfHistory}"}
-
      # Only execute this file once per shell.
      if [ -n "$__ETC_ZSHRC_SOURCED" -o -n "$NOSYSZSHRC" ]; then return; fi
      __ETC_ZSHRC_SOURCED=1

-      # history defaults
-      SAVEHIST=2000
-      HISTSIZE=2000
-      HISTFILE=$HOME/.zsh_history
+      # Setup command line history.
+      # Don't export these, otherwise other shells (bash) will try to use same HISTFILE.
+      SAVEHIST=${builtins.toString cfg.histSize}
+      HISTSIZE=${builtins.toString cfg.histSize}
+      HISTFILE=${cfg.histFile}

      setopt HIST_IGNORE_DUPS SHARE_HISTORY HIST_FCNTL_LOCK

-      export PATH=${config.environment.systemPath}
-      ${config.system.build.setEnvironment}
-      ${config.system.build.setAliases}
+      bindkey -e

-      ${config.environment.extraInit}
      ${config.environment.interactiveShellInit}
      ${cfg.interactiveShellInit}
+
      ${cfg.promptInit}

-      # Tell zsh how to find installed completions
-      for p in ''${(z)NIX_PROFILES}; do
-        fpath+=($p/share/zsh/site-functions $p/share/zsh/$ZSH_VERSION/functions)
-      done
-
-      ${optionalString cfg.enableCompletion "autoload -U compinit && compinit"}
+      ${optionalString cfg.enableGlobalCompInit "autoload -U compinit && compinit"}
      ${optionalString cfg.enableBashCompletion "autoload -U bashcompinit && bashcompinit"}

+      ${optionalString cfg.enableAutosuggestions
+        "source ${pkgs.zsh-autosuggestions}/share/zsh-autosuggestions/zsh-autosuggestions.zsh"
+      }
+
      ${optionalString cfg.enableSyntaxHighlighting
        "source ${pkgs.zsh-syntax-highlighting}/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh"
      }

+      ${optionalString cfg.enableFastSyntaxHighlighting
+        "source ${pkgs.zsh-fast-syntax-highlighting}/share/zsh/plugins/fast-syntax-highlighting/fast-syntax-highlighting.plugin.zsh"
+      }
+
+      ${optionalString cfg.enableFzfCompletion "source ${fzfCompletion}"}
+      ${optionalString cfg.enableFzfGit "source ${fzfGit}"}
+      ${optionalString cfg.enableFzfHistory "source ${fzfHistory}"}

      # Read system-wide modifications.
      if test -f /etc/zshrc.local; then
@@ -205,5 +241,27 @@ in
      fi
    '';

+    environment.etc."zprofile".knownSha256Hashes = [
+      "db8422f92d8cff684e418f2dcffbb98c10fe544b5e8cd588b2009c7fa89559c5"
+      "0235d3c1b6cf21e7043fbc98e239ee4bc648048aafaf6be1a94a576300584ef2"  # macOS
+      "f320016e2cf13573731fbee34f9fe97ba867dd2a31f24893d3120154e9306e92"  # macOS 26b1 and higher
+    ];
+
+    environment.etc."zshrc".knownSha256Hashes = [
+      "19a2d673ffd47b8bed71c5218ff6617dfc5e8533b240b9ba79142a45f8823c23"
+      "fb5827cb4712b7e7932d438067ec4852c8955a9ff0f55e282473684623ebdfa1"  # macOS
+      "4d1ab5704f9d167a042fecac0d056c8a79a8ebd71e032d3489536c8db9ffe3e0"  # macOS 26b1 and higher
+      "c5a00c072c920f46216454978c44df044b2ec6d03409dc492c7bdcd92c94a110"  # official Nix installer
+      "40b0d8751adae5b0100a4f863be5b75613a49f62706427e92604f7e04d2e2261"  # official Nix installer
+      "bf76c5ed8e65e616f4329eccf662ee91be33b8bfd33713ce9946f2fe94fea7fa"  # official Nix installer (macOS 26b1 and higher)
+      "2af1b563e389d11b76a651b446e858116d7a20370d9120a7e9f78991f3e5f336"  # DeterminateSystems installer
+      "27274e44b88a1174787f9a3d437d3387edc4f9aaaf40356054130797f5dc7912"  # DeterminateSystems installer (macOS 26b1 and higher)
+    ];
+
+    environment.etc."zshenv".knownSha256Hashes = [
+      "d07015be6875f134976fce84c6c7a77b512079c1c5f9594dfa65c70b7968b65f"  # DeterminateSystems installer
+      "4e8f7cb9b699511f4ba5f9d5f8de1c9f5efb5c607de88faf5f58b8b9cb38edbf"  # experimental official Nix installer 2.33.3
+    ];
+
  };
 }
@@ -0,0 +1,231 @@
+#     ____      ____
+#    / __/___  / __/
+#   / /_/_  / / /_
+#  / __/ / /_/ __/
+# /_/   /___/_/-completion.zsh
+#
+# - $FZF_TMUX               (default: 0)
+# - $FZF_TMUX_HEIGHT        (default: '40%')
+# - $FZF_COMPLETION_TRIGGER (default: '**')
+# - $FZF_COMPLETION_OPTS    (default: empty)
+
+# To use custom commands instead of find, override _fzf_compgen_{path,dir}
+if ! declare -f _fzf_compgen_path > /dev/null; then
+  _fzf_compgen_path() {
+    echo "$1"
+    command find -L "$1" \
+      -name .git -prune -o -name .svn -prune -o \( -type d -o -type f -o -type l \) \
+      -a -not -path "$1" -print 2> /dev/null | sed 's@^\./@@'
+  }
+fi
+
+if ! declare -f _fzf_compgen_dir > /dev/null; then
+  _fzf_compgen_dir() {
+    command find -L "$1" \
+      -name .git -prune -o -name .svn -prune -o -type d \
+      -a -not -path "$1" -print 2> /dev/null | sed 's@^\./@@'
+  }
+fi
+
+###########################################################
+
+__fzfcmd_complete() {
+  [ -n "$TMUX_PANE" ] && [ "${FZF_TMUX:-0}" != 0 ] && [ ${LINES:-40} -gt 15 ] &&
+    echo "fzf-tmux -d${FZF_TMUX_HEIGHT:-40%}" || echo "fzf"
+}
+
+__fzf_generic_path_completion() {
+  local base lbuf compgen fzf_opts suffix tail fzf dir leftover matches
+  # (Q) flag removes a quoting level: "foo\ bar" => "foo bar"
+  base=${(Q)1}
+  lbuf=$2
+  compgen=$3
+  fzf_opts=$4
+  suffix=$5
+  tail=$6
+  fzf="$(__fzfcmd_complete)"
+
+  setopt localoptions nonomatch
+  dir="$base"
+  while [ 1 ]; do
+    if [[ -z "$dir" || -d ${~dir} ]]; then
+      leftover=${base/#"$dir"}
+      leftover=${leftover/#\/}
+      [ -z "$dir" ] && dir='.'
+      [ "$dir" != "/" ] && dir="${dir/%\//}"
+      dir=${~dir}
+      matches=$(eval "$compgen $(printf %q "$dir")" | FZF_DEFAULT_OPTS="--height ${FZF_TMUX_HEIGHT:-40%} --reverse $FZF_DEFAULT_OPTS $FZF_COMPLETION_OPTS" ${=fzf} ${=fzf_opts} -q "$leftover" | while read item; do
+        echo -n "${(q)item}$suffix "
+      done)
+      matches=${matches% }
+      if [ -n "$matches" ]; then
+        LBUFFER="$lbuf$matches$tail"
+      fi
+      zle redisplay
+      typeset -f zle-line-init >/dev/null && zle zle-line-init
+      break
+    fi
+    dir=$(dirname "$dir")
+    dir=${dir%/}/
+  done
+}
+
+_fzf_path_completion() {
+  __fzf_generic_path_completion "$1" "$2" _fzf_compgen_path \
+    "-m" "" " "
+}
+
+_fzf_dir_completion() {
+  __fzf_generic_path_completion "$1" "$2" _fzf_compgen_dir \
+    "" "/" ""
+}
+
+_fzf_feed_fifo() (
+  command rm -f "$1"
+  mkfifo "$1"
+  cat <&0 > "$1" &
+)
+
+_fzf_complete() {
+  local fifo fzf_opts lbuf fzf matches post
+  fifo="${TMPDIR:-/tmp}/fzf-complete-fifo-$$"
+  fzf_opts=$1
+  lbuf=$2
+  post="${funcstack[2]}_post"
+  type $post > /dev/null 2>&1 || post=cat
+
+  fzf="$(__fzfcmd_complete)"
+
+  _fzf_feed_fifo "$fifo"
+  matches=$(cat "$fifo" | FZF_DEFAULT_OPTS="--height ${FZF_TMUX_HEIGHT:-40%} --reverse $FZF_DEFAULT_OPTS $FZF_COMPLETION_OPTS" ${=fzf} ${=fzf_opts} -q "${(Q)prefix}" | $post | tr '\n' ' ')
+  if [ -n "$matches" ]; then
+    LBUFFER="$lbuf$matches"
+  fi
+  zle redisplay
+  typeset -f zle-line-init >/dev/null && zle zle-line-init
+  command rm -f "$fifo"
+}
+
+_fzf_complete_docker() {
+  local cmd
+  cmd=${tokens[2]}
+  case $cmd in
+    image|push|rmi|run)
+      FZF_DEFAULT_OPTS="--min-height 15 $FZF_DEFAULT_OPTS --preview 'docker ps -af ancestor={+3} -n 4' --preview-window down:5:wrap" \
+        _fzf_complete '-m --header-lines=1' "$@" < <(docker images)
+      ;;
+    *)
+      FZF_DEFAULT_OPTS="--min-height 15 $FZF_DEFAULT_OPTS --preview 'docker logs --tail=5 {+1}' --preview-window down:5:wrap" \
+        _fzf_complete '-m --header-lines=1' "$@" < <(docker ps --all)
+      ;;
+  esac
+}
+
+_fzf_complete_docker_post() {
+  local cmd
+  cmd=${tokens[2]}
+  case $cmd in
+    image|push|rmi|run) awk '{ print ($2 == "<none>") ? $3 : $1 ":" $2}' ;;
+    *) awk '{print $NF}' ;;
+  esac
+}
+
+_fzf_complete_git() {
+  FZF_DEFAULT_OPTS="--min-height 15 $FZF_DEFAULT_OPTS --preview 'git log -5 --oneline {+1}' --preview-window down:5:wrap" \
+    _fzf_complete '-m' "$@" < <(git branch -v)
+}
+
+_fzf_complete_git_post() {
+  awk '{print $1}'
+}
+
+_fzf_complete_telnet() {
+  _fzf_complete '+m' "$@" < <(
+    command grep -v '^\s*\(#\|$\)' /etc/hosts | command grep -Fv '0.0.0.0' |
+        awk '{if (length($2) > 0) {print $2}}' | sort -u
+  )
+}
+
+_fzf_complete_kill() {
+  FZF_DEFAULT_OPTS="--min-height 15 $FZF_DEFAULT_OPTS --preview 'echo {}' --preview-window down:3:wrap" \
+    _fzf_complete '-m --header-lines 1' "$@" < <(command ps -ef -r)
+}
+
+_fzf_complete_kill_post() {
+  awk '{print $2}'
+}
+
+_fzf_complete_ssh() {
+  _fzf_complete '+m' "$@" < <(
+    command cat <(cat ~/.ssh/config /etc/ssh/ssh_config 2> /dev/null | command grep -i '^host' | command grep -v '*') \
+        <(command grep -oE '^[a-z0-9.,:-]+' ~/.ssh/known_hosts | tr ',' '\n' | awk '{ print $1 " " $1 }') \
+        <(command grep -v '^\s*\(#\|$\)' /etc/hosts | command grep -Fv '0.0.0.0') |
+        awk '{if (length($2) > 0) {print $2}}' | sort -u
+  )
+}
+
+_fzf_complete_export() {
+  _fzf_complete '-m' "$@" < <(
+    declare -xp | sed 's/=.*//' | sed 's/.* //'
+  )
+}
+
+_fzf_complete_unset() {
+  _fzf_complete '-m' "$@" < <(
+    declare -xp | sed 's/=.*//' | sed 's/.* //'
+  )
+}
+
+_fzf_complete_unalias() {
+  _fzf_complete '+m' "$@" < <(
+    alias | sed 's/=.*//'
+  )
+}
+
+fzf-completion() {
+  local tokens cmd prefix trigger tail fzf matches lbuf d_cmds
+  setopt localoptions noshwordsplit noksh_arrays noposixbuiltins
+
+  # http://zsh.sourceforge.net/FAQ/zshfaq03.html
+  # http://zsh.sourceforge.net/Doc/Release/Expansion.html#Parameter-Expansion-Flags
+  tokens=(${(z)LBUFFER})
+  if [ ${#tokens} -lt 1 ]; then
+    zle ${fzf_default_completion:-expand-or-complete}
+    return
+  fi
+
+  cmd=${tokens[1]}
+
+  # Explicitly allow for empty trigger.
+  trigger=${FZF_COMPLETION_TRIGGER-'**'}
+  [ -z "$trigger" -a ${LBUFFER[-1]} = ' ' ] && tokens+=("")
+
+  tail=${LBUFFER:$(( ${#LBUFFER} - ${#trigger} ))}
+  # Trigger sequence given
+  if [ ${#tokens} -gt 1 -a "$tail" = "$trigger" ]; then
+    d_cmds=(${=FZF_COMPLETION_DIR_COMMANDS:-cd pushd rmdir})
+
+    [ -z "$trigger"      ] && prefix=${tokens[-1]} || prefix=${tokens[-1]:0:-${#trigger}}
+    [ -z "${tokens[-1]}" ] && lbuf=$LBUFFER        || lbuf=${LBUFFER:0:-${#tokens[-1]}}
+
+    if eval "type _fzf_complete_${cmd} > /dev/null"; then
+      eval "prefix=\"$prefix\" _fzf_complete_${cmd} \"$lbuf\""
+    elif [ ${d_cmds[(i)$cmd]} -le ${#d_cmds} ]; then
+      _fzf_dir_completion "$prefix" "$lbuf"
+    else
+      _fzf_path_completion "$prefix" "$lbuf"
+    fi
+  # Fall back to default completion
+  else
+    zle ${fzf_default_completion:-expand-or-complete}
+  fi
+}
+
+[ -z "$fzf_default_completion" ] && {
+  binding=$(bindkey '^I')
+  [[ $binding =~ 'undefined-key' ]] || fzf_default_completion=$binding[(s: :w)2]
+  unset binding
+}
+
+zle     -N   fzf-completion
+bindkey '^I' fzf-completion
@@ -1,37 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  cfg = config.security;
-
-  runSQL = sql: ''/usr/bin/sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db "${sql}"'';
-
-  allowAccess = client: runSQL ''INSERT or REPLACE INTO access VALUES ('kTCCServiceAccessibility','${client}',1,1,1,NULL,NULL)'';
-  revokeAccess = clients: runSQL ''DELETE FROM access WHERE client LIKE '/nix/store/%' AND client NOT IN (${concatMapStringsSep "," (s: "'${s}'") clients})'';
-
-in
-
-{
-  options = {
-    security.accessibilityPrograms = mkOption {
-      type = types.listOf types.path;
-      default = [];
-      example = literalExample ''[ ''${pkgs.hello}/bin/hello" ]'';
-      description = "List of nix programs that are allowed control through the accessibility APIs.";
-    };
-  };
-
-  config = {
-
-    system.activationScripts.accessibility.text = ''
-      # Set up programs that require accessibility permissions
-      echo "setting up accessibility programs..." >&2
-
-      ${revokeAccess cfg.accessibilityPrograms}
-      ${concatMapStringsSep "\n" allowAccess cfg.accessibilityPrograms}
-    '';
-
-  };
-}
--- a/Show More
+++ b/Show More