Merge pull request #1404 from Enzime/push-unyymrtpyyvw

[24.11] treewide: point to the new GitHub organization
treewide: point to the new GitHub organization
2025-03-28 11:06:55 +09:00 · 2025-03-28 10:38:39 +09:00 · 2025-03-04 22:07:58 +00:00 · 2025-03-04 13:31:57 -05:00 · 2025-02-14 17:19:06 +00:00 · 2025-02-14 23:29:45 +07:00
39 changed files with 408 additions and 319 deletions
@@ -3,11 +3,11 @@ on:
  pull_request:
  push:
    branches:
-      - master
+      - nix-darwin-24.11

 env:
-  NIXPKGS_BRANCH: nixpkgs-unstable
-  NIX_DARWIN_BRANCH: master
+  NIXPKGS_BRANCH: nixpkgs-24.11-darwin
+  NIX_DARWIN_BRANCH: nix-darwin-24.11
  NIX_VERSION: 2.24.11

 jobs:
@@ -40,7 +40,7 @@ jobs:
        nix_path: nixpkgs=channel:${{ env.NIXPKGS_BRANCH }}
    - name: Install channels
      run: |
-        nix-channel --add https://github.com/LnL7/nix-darwin/archive/${{ env.NIX_DARWIN_BRANCH }}.tar.gz darwin
+        nix-channel --add https://github.com/nix-darwin/nix-darwin/archive/${{ env.NIX_DARWIN_BRANCH }}.tar.gz darwin
        nix-channel --add https://nixos.org/channels/${{ env.NIXPKGS_BRANCH }} nixpkgs
        nix-channel --update
    - name: Install nix-darwin
@@ -189,7 +189,7 @@

    Use a channel for nix-darwin or configure nix.nixPath

-    sudo nix-channel --add https://github.com/LnL7/nix-darwin/archive/master.tar.gz darwin
+    sudo nix-channel --add https://github.com/nix-darwin/nix-darwin/archive/master.tar.gz darwin
    sudo nix-channel --update

    nix.nixPath =
@@ -1,231 +1,3 @@
-[<img src="https://daiderd.com/nix-darwin/images/nix-darwin.png" width="200px" alt="logo" />](https://github.com/LnL7/nix-darwin)
-
 # nix-darwin

-[![Test](https://github.com/LnL7/nix-darwin/actions/workflows/test.yml/badge.svg)](https://github.com/LnL7/nix-darwin/actions/workflows/test.yml)
-
-Nix modules for darwin, `/etc/nixos/configuration.nix` for macOS.
-
-This project aims to bring the convenience of a declarative system approach to macOS.
-nix-darwin is built up around [Nixpkgs](https://github.com/NixOS/nixpkgs), quite similar to [NixOS](https://nixos.org/).
-
-## Prerequisites
-
-The only prerequisite is a Nix implementation, both Nix and Lix are supported.
-
-As the official Nix installer does not include an automated uninstaller, and manual uninstallation on macOS is a complex process, we recommend using one of the following installers instead:
-
- The [Nix installer from Determinate Systems](https://github.com/DeterminateSystems/nix-installer?tab=readme-ov-file#determinate-nix-installer) is only recommended for use with flake-based setups. **Make sure you use it without the `--determinate` flag**. The `--determinate` flag installs the Determinate Nix distribution which does not work out of the box with nix-darwin.
-* The [Lix installer](https://lix.systems/install/#on-any-other-linuxmacos-system) supports both flake-based and channel-based setups.
-
-
-
-## Getting started
-
-Despite being an experimental feature in Nix currently, nix-darwin recommends that beginners use flakes to manage their nix-darwin configurations.
-
-<details>
-<summary>Flakes (Recommended for beginners)</summary>
-
-### Step 1. Creating `flake.nix`
-
-<details>
-<summary>Getting started from scratch</summary>
-<p></p>
-
-If you don't have an existing `configuration.nix`, you can run the following commands to generate a basic `flake.nix` inside `~/.config/nix-darwin`:
-
-```bash
-mkdir -p ~/.config/nix-darwin
-cd ~/.config/nix-darwin
-
-# To use Nixpkgs unstable:
-nix flake init -t nix-darwin/master
-# To use Nixpkgs 24.11:
-nix flake init -t nix-darwin/nix-darwin-24.11
-
-sed -i '' "s/simple/$(scutil --get LocalHostName)/" flake.nix
-```
-
-Make sure to change `nixpkgs.hostPlatform` to `aarch64-darwin` if you are using Apple Silicon.
-
-</details>
-
-<details>
-<summary>Migrating from an existing configuration.nix</summary>
-<p></p>
-
-Add the following to `flake.nix` in the same folder as `configuration.nix`:
-
-```nix
-{
-  description = "John's darwin system";
-
-  inputs = {
-    # Use `github:NixOS/nixpkgs/nixpkgs-24.11-darwin` to use Nixpkgs 24.11.
-    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
-    # Use `github:LnL7/nix-darwin/nix-darwin-24.11` to use Nixpkgs 24.11.
-    nix-darwin.url = "github:LnL7/nix-darwin/master";
-    nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
-  };
-
-  outputs = inputs@{ self, nix-darwin, nixpkgs }: {
-    darwinConfigurations."Johns-MacBook" = nix-darwin.lib.darwinSystem {
-      modules = [ ./configuration.nix ];
-    };
-  };
-}
-```
-
-Make sure to replace `Johns-MacBook` with your hostname which you can find by running `scutil --get LocalHostName`.
-
-Make sure to set `nixpkgs.hostPlatform` in your `configuration.nix` to either `x86_64-darwin` (Intel) or `aarch64-darwin` (Apple Silicon).
-
-</details>
-
-### Step 2. Installing `nix-darwin`
-
-Unlike NixOS, `nix-darwin` does not have an installer, you can just run `darwin-rebuild switch` to install nix-darwin. As `darwin-rebuild` won't be installed in your `PATH` yet, you can use the following command:
-
-```bash
-nix run nix-darwin -- switch --flake ~/.config/nix-darwin
-```
-
-### Step 3. Using `nix-darwin`
-
-After installing, you can run `darwin-rebuild` to apply changes to your system:
-
-```bash
-darwin-rebuild switch --flake ~/.config/nix-darwin
-```
-
-#### Using flake inputs
-
-Inputs from the flake can also be passed into `darwinSystem`. These inputs are then
-accessible as an argument `inputs`, similar to `pkgs` and `lib`, inside the configuration.
-
-```nix
-# in flake.nix
-nix-darwin.lib.darwinSystem {
-  modules = [ ./configuration.nix ];
-  specialArgs = { inherit inputs; };
-}
-```
-
-```nix
-# in configuration.nix
-{ pkgs, lib, inputs }:
-# inputs.self, inputs.nix-darwin, and inputs.nixpkgs can be accessed here
-```
-</details>
-
-<details>
-<summary>Channels</summary>
-
-### Step 1. Creating `configuration.nix`
-
-Copy the [simple](./modules/examples/simple.nix) example to `~/.config/nix-darwin/configuration.nix`.
-
-### Step 2. Adding `nix-darwin` channel
-
-```bash
-# If you use Nixpkgs unstable (the default):
-sudo nix-channel --add https://github.com/LnL7/nix-darwin/archive/master.tar.gz darwin
-# If you use Nixpkgs 24.11:
-sudo nix-channel --add https://github.com/LnL7/nix-darwin/archive/nix-darwin-24.11.tar.gz darwin
-
-sudo nix-channel --update
-```
-
-### Step 3. Installing `nix-darwin`
-
-To install `nix-darwin`, you can just run `darwin-rebuild switch` to install nix-darwin. As `darwin-rebuild` won't be installed in your `PATH` yet, you can use the following command:
-
-```bash
-# If you use Nixpkgs unstable (the default):
-nix-build https://github.com/LnL7/nix-darwin/archive/master.tar.gz -A darwin-rebuild
-# If you use Nixpkgs 24.11:
-nix-build https://github.com/LnL7/nix-darwin/archive/nix-darwin-24.11.tar.gz -A darwin-rebuild
-
-./result/bin/darwin-rebuild switch -I darwin-config=$HOME/.config/nix-darwin/configuration.nix
-```
-
-### Step 4. Using `nix-darwin`
-
-After installing, you can run `darwin-rebuild` to apply changes to your system:
-
-```bash
-darwin-rebuild switch
-```
-
-### Step 5. Updating `nix-darwin`
-
-You can update Nixpkgs and `nix-darwin` using the following command:
-
-```bash
-sudo nix-channel --update
-```
-</details>
-
-## Documentation
-
-`darwin-help` will open up a local copy of the reference documentation, it can also be found online [here](https://daiderd.com/nix-darwin/manual/index.html).
-
-The documentation is also available as manpages by running `man 5 configuration.nix`.
-
-## Uninstalling
-
-To run the latest version of the uninstaller, you can run the following command:
-
-```
-nix --extra-experimental-features "nix-command flakes" run nix-darwin#darwin-uninstaller
-```
-
-If that command doesn't work for you, you can try the locally installed uninstaller:
-
-```
-darwin-uninstaller
-```
-
-## Tests
-
-There are basic tests that run sanity checks for some of the modules,
-you can run them like this:
-
-```bash
-# run all tests
-nix-build release.nix -A tests
-# or just a subset
-nix-build release.nix -A tests.environment-path
-```
-
-## Contributing
-
-Let's make Nix on macOS awesome!
-
-Don't hesitate to contribute modules or open an issue.
-
-To build your configuration with local changes you can run this. This
-flag can also be used to override darwin-config or nixpkgs, for more
-information on the `-I` flag look at the nix-build [manpage](https://nixos.org/manual/nix/stable/command-ref/nix-build.html).
-
-```bash
-darwin-rebuild switch -I darwin=.
-```
-
-If you're adding a module, please add yourself to `meta.maintainers`, for example
-
-```nix
-  meta.maintainers = [
-    lib.maintainers.alice or "alice"
-  ];
-
-  options.services.alicebot = # ...
-```
-
-The `or` operator takes care of graceful degradation when `lib` from Nixpkgs
-goes out of sync.
-
-Also feel free to contact me if you have questions,
- Matrix - @daiderd:matrix.org, you can find me in [#macos:nixos.org](https://matrix.to/#/#macos:nixos.org)
- @LnL7 on twitter
+This is the 24.11 release branch of nix-darwin. See [the main readme](https://github.com/nix-darwin/nix-darwin#readme) for documentation.
@@ -0,0 +1,3 @@
+# Written by https://github.com/DeterminateSystems/nix-installer.
+# The contents below are based on options specified at installation time.
+
@@ -0,0 +1,14 @@
+
+# Generated by https://github.com/DeterminateSystems/nix-installer.
+# See `/nix/nix-installer --version` for the version details.
+
+!include nix.custom.conf
+
+experimental-features = nix-command flakes
+always-allow-substitutes = true
+extra-trusted-substituters = https://cache.flakehub.com
+extra-trusted-public-keys = cache.flakehub.com-3:hJuILl5sVK4iKm86JzgdXW12Y2Hwd5G07qKtHTOcDCM= cache.flakehub.com-4:Asi8qIv291s0aYLyH6IOnr5Kf6+OF14WVjkE6t3xMio= cache.flakehub.com-5:zB96CRlL7tiPtzA9/WKyPkp3A2vqxqgdgyTVNGShPDU= cache.flakehub.com-6:W4EGFwAGgBj3he7c5fNh9NkOXw0PUVaxygCVKeuvaqU= cache.flakehub.com-7:mvxJ2DZVHn/kRxlIaxYNMuDG1OvMckZu32um1TadOR8= cache.flakehub.com-8:moO+OVS0mnTjBTcOUh2kYLQEd59ExzyoW1QgQ8XAARQ= cache.flakehub.com-9:wChaSeTI6TeCuV/Sg2513ZIM9i0qJaYsF+lZCXg0J6o= cache.flakehub.com-10:2GqeNlIp6AKp4EF2MVbE1kBOp9iBSyo0UPR9KoR0o1Y=
+bash-prompt-prefix = (nix:$name)\040
+max-jobs = auto
+extra-nix-path = nixpkgs=flake:nixpkgs
+upgrade-nix-store-path-url = https://install.determinate.systems/nix-upgrade/stable/universal
@@ -0,0 +1,4 @@
+
+# Written by https://github.com/DeterminateSystems/nix-installer.
+# The contents below are based on options specified at installation time.
+
@@ -0,0 +1,13 @@
+# Generated by https://github.com/DeterminateSystems/nix-installer.
+# See `/nix/nix-installer --version` for the version details.
+
+extra-experimental-features = nix-command flakes
+always-allow-substitutes = true
+extra-trusted-substituters = https://cache.flakehub.com
+extra-trusted-public-keys = cache.flakehub.com-3:hJuILl5sVK4iKm86JzgdXW12Y2Hwd5G07qKtHTOcDCM= cache.flakehub.com-4:Asi8qIv291s0aYLyH6IOnr5Kf6+OF14WVjkE6t3xMio= cache.flakehub.com-5:zB96CRlL7tiPtzA9/WKyPkp3A2vqxqgdgyTVNGShPDU= cache.flakehub.com-6:W4EGFwAGgBj3he7c5fNh9NkOXw0PUVaxygCVKeuvaqU= cache.flakehub.com-7:mvxJ2DZVHn/kRxlIaxYNMuDG1OvMckZu32um1TadOR8= cache.flakehub.com-8:moO+OVS0mnTjBTcOUh2kYLQEd59ExzyoW1QgQ8XAARQ= cache.flakehub.com-9:wChaSeTI6TeCuV/Sg2513ZIM9i0qJaYsF+lZCXg0J6o= cache.flakehub.com-10:2GqeNlIp6AKp4EF2MVbE1kBOp9iBSyo0UPR9KoR0o1Y=
+bash-prompt-prefix = (nix:$name)\040
+max-jobs = auto
+extra-nix-path = nixpkgs=flake:nixpkgs
+upgrade-nix-store-path-url = https://install.determinate.systems/nix-upgrade/stable/universal
+
+!include nix.custom.conf
@@ -30,7 +30,7 @@ let
      declarations = map
        (decl:
          if lib.hasPrefix (toString prefix) (toString decl) then
-            gitHubDeclaration "LnL7" "nix-darwin" revision
+            gitHubDeclaration "nix-darwin" "nix-darwin" revision
              (lib.removePrefix "/"
                (lib.removePrefix (toString prefix) (toString decl)))
          # TODO: handle this in a better way (may require upstream
@@ -37,7 +37,7 @@ assert enableNixpkgsReleaseCheck -> checkRelease lib || throw ''

      inputs = {
        nixpkgs.url = "github:NixOS/nixpkgs/NIXPKGS-BRANCH";
-        nix-darwin.url = "github:LnL7/nix-darwin/NIX-DARWIN-BRANCH";
+        nix-darwin.url = "github:nix-darwin/nix-darwin/NIX-DARWIN-BRANCH";
        nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
        # …
      };
@@ -46,7 +46,7 @@ assert enableNixpkgsReleaseCheck -> checkRelease lib || throw ''

      $ sudo nix-channel --list
      nixpkgs https://nixos.org/channels/NIXPKGS-BRANCH
-      darwin https://github.com/LnL7/nix-darwin/archive/NIX-DARWIN-BRANCH.tar.gz
+      darwin https://github.com/nix-darwin/nix-darwin/archive/NIX-DARWIN-BRANCH.tar.gz
      …
      $ nix-channel --list
      …
@@ -58,12 +58,12 @@ assert enableNixpkgsReleaseCheck -> checkRelease lib || throw ''
  You can then fix your channels like this:

      $ sudo nix-channel --add https://nixos.org/channels/NIXPKGS-BRANCH nixpkgs
-      $ sudo nix-channel --add https://github.com/LnL7/nix-darwin/archive/NIX-DARWIN-BRANCH.tar.gz darwin
+      $ sudo nix-channel --add https://github.com/nix-darwin/nix-darwin/archive/NIX-DARWIN-BRANCH.tar.gz darwin
      $ sudo nix-channel --update

  After that, activating your system again should work correctly. If it
  doesn’t, please open an issue at
-  <https://github.com/LnL7/nix-darwin/issues/new> and include as much
+  <https://github.com/nix-darwin/nix-darwin/issues/new> and include as much
  information as possible.
 '';

@@ -77,7 +77,7 @@ let
    };
  };

-  eval = lib.evalModules (builtins.removeAttrs args [ "lib" ] // {
+  eval = lib.evalModules (builtins.removeAttrs args [ "lib" "enableNixpkgsReleaseCheck" ] // {
    class = "darwin";
    modules = modules ++ [ argsModule ] ++ baseModules;
    specialArgs = { modulesPath = builtins.toString ./modules; } // specialArgs;
@@ -2,16 +2,16 @@
  "nodes": {
    "nixpkgs": {
      "locked": {
-        "lastModified": 1736241350,
-        "narHash": "sha256-CHd7yhaDigUuJyDeX0SADbTM9FXfiWaeNyY34FL1wQU=",
+        "lastModified": 1735954111,
+        "narHash": "sha256-yPzRuUXx99iu9QMF9GKxxqqC7kpKdFlQi7PA9N85wxQ=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "8c9fd3e564728e90829ee7dbac6edc972971cd0f",
+        "rev": "a4c40a8a970c147cea7e98e86b2ff2ffb184aedd",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
+        "ref": "nixpkgs-24.11-darwin",
        "repo": "nixpkgs",
        "type": "github"
      }
@@ -2,7 +2,7 @@
  description = "A collection of darwin modules";

  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-24.11-darwin";
  };

  outputs = { self, nixpkgs }: let
@@ -2,8 +2,8 @@
  description = "Example nix-darwin system flake";

  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
-    nix-darwin.url = "github:LnL7/nix-darwin/master";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-24.11-darwin";
+    nix-darwin.url = "github:nix-darwin/nix-darwin/nix-darwin-24.11";
    nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
  };

@@ -137,7 +137,7 @@ let
    config = {
      brewBundleCmd = concatStringsSep " " (
        optional (!config.autoUpdate) "HOMEBREW_NO_AUTO_UPDATE=1"
-        ++ [ "brew bundle --file='${brewfileFile}' --no-lock" ]
+        ++ [ "brew bundle --file='${brewfileFile}'" ]
        ++ optional (!config.upgrade) "--no-upgrade"
        ++ optional (config.cleanup == "uninstall") "--cleanup"
        ++ optional (config.cleanup == "zap") "--cleanup --zap"
@@ -118,7 +118,6 @@ in
      echo "configuring networking..." >&2

      ${optionalString (cfg.computerName != null) ''
-        # shellcheck disable=SC1112
        scutil --set ComputerName ${escapeShellArg cfg.computerName}
      ''}
      ${optionalString (cfg.hostName != null) ''
@@ -49,13 +49,16 @@ let

      mkKeyValuePairs = attrs: concatStringsSep "\n" (mapAttrsToList mkKeyValue attrs);

+      isExtra = key: hasPrefix "extra-" key;
+
    in
    pkgs.writeTextFile {
      name = "nix.conf";
      text = ''
        # WARNING: this file is generated from the nix.* options in
        # your nix-darwin configuration. Do not edit it!
-        ${mkKeyValuePairs cfg.settings}
+        ${mkKeyValuePairs (filterAttrs (key: value: !(isExtra key)) cfg.settings)}
+        ${mkKeyValuePairs (filterAttrs (key: value: isExtra key) cfg.settings)}
        ${cfg.extraOptions}
      '';
      checkPhase =
@@ -134,6 +137,34 @@ let
        namedPaths ++ searchPaths;
  };

+  handleUnmanaged = managedConfig: mkMerge [
+    (mkIf cfg.enable managedConfig)
+    (mkIf (!cfg.enable) {
+      system.activationScripts.nix-daemon.text = ''
+        # Restore unmanaged Nix daemon if present
+        unmanagedNixProfile=/nix/var/nix/profiles/default
+        if [[
+          -e /run/current-system/Library/LaunchDaemons/org.nixos.nix-daemon.plist
+          && -e $unmanagedNixProfile/Library/LaunchDaemons/org.nixos.nix-daemon.plist
+        ]]; then
+          printf >&2 'restoring unmanaged Nix daemon...\n'
+          cp \
+            "$unmanagedNixProfile/Library/LaunchDaemons/org.nixos.nix-daemon.plist" \
+            /Library/LaunchDaemons
+          launchctl load -w /Library/LaunchDaemons/org.nixos.nix-daemon.plist
+        fi
+      '';
+    })
+  ];
+
+  managedDefault = name: default: {
+    default = if cfg.enable then default else throw ''
+      ${name}: accessed when `nix.enable` is off; this is a bug in
+      nix-darwin or a third‐party module
+    '';
+    defaultText = default;
+  };
+
 in

 {
@@ -144,7 +175,6 @@ in
    in
    [
      # Only ever in NixOS
-      (mkRemovedOptionModule [ "nix" "enable" ] "No `nix-darwin` equivalent to this NixOS option.")
      (mkRemovedOptionModule [ "nix" "daemonCPUSchedPolicy" ] (altOption "nix.daemonProcessType"))
      (mkRemovedOptionModule [ "nix" "daemonIOSchedClass" ] (altOption "nix.daemonProcessType"))
      (mkRemovedOptionModule [ "nix" "daemonIOSchedPriority" ] (altOption "nix.daemonIOLowPriority"))
@@ -165,9 +195,34 @@ in

    nix = {

+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether to enable Nix.
+
+          Disabling this will stop nix-darwin from managing the
+          installed version of Nix, the nix-daemon launchd daemon, and
+          the settings in {file}`/etc/nix/nix.conf`.
+
+          This allows you to use nix-darwin without it taking over your
+          system installation of Nix. Some nix-darwin functionality
+          that relies on managing the Nix installation, like the
+          `nix.*` options to adjust Nix settings or configure a Linux
+          builder, will be unavailable. You will also have to upgrade
+          Nix yourself, as nix-darwin will no longer do so.
+
+          ::: {.warning}
+          If you have already removed your global system installation
+          of Nix, this will break nix-darwin and you will have to
+          reinstall Nix to fix it.
+          :::
+        '';
+      };
+
      package = mkOption {
        type = types.package;
-        default = pkgs.nix;
+        inherit (managedDefault "nix.package" pkgs.nix) default;
        defaultText = literalExpression "pkgs.nix";
        description = ''
          This option specifies the Nix package instance to use throughout the system.
@@ -177,7 +232,16 @@ in
      # Not in NixOS module
      useDaemon = mkOption {
        type = types.bool;
-        default = false;
+        # We assume that unmanaged Nix installations use the daemon by
+        # default, to match the logic in nix-darwin 25.05. This is
+        # weird, but it matches the default behaviour in practice
+        # (since `services.nix-daemon.enable` is on by default and sets
+        # `nix.useDaemon` to true), and since `nix.enable` didn’t
+        # previously exist, it’s not a backwards‐compatibility concern;
+        # we can consequently avoid bifurcating the user experience
+        # across the release branches.
+        default = !config.nix.enable;
+        defaultText = literalExpression "!config.nix.enable";
        description = ''
          If set, Nix will use the daemon to perform operations.
          Use this instead of services.nix-daemon.enable if you don't want the
@@ -187,7 +251,7 @@ in

      distributedBuilds = mkOption {
        type = types.bool;
-        default = false;
+        inherit (managedDefault "nix.distributedBuilds" false) default defaultText;
        description = ''
          Whether to distribute builds to the machines listed in
          {option}`nix.buildMachines`.
@@ -197,7 +261,7 @@ in
      # Not in NixOS module
      daemonProcessType = mkOption {
        type = types.enum [ "Background" "Standard" "Adaptive" "Interactive" ];
-        default = "Standard";
+        inherit (managedDefault "nix.daemonProcessType" "Standard") default defaultText;
        description = ''
          Nix daemon process resource limits class. These limits propagate to
          build processes. `Standard` is the default process type
@@ -212,7 +276,7 @@ in
      # Not in NixOS module
      daemonIOLowPriority = mkOption {
        type = types.bool;
-        default = false;
+        inherit (managedDefault "nix.daemonIOLowPriority" false) default defaultText;
        description = ''
          Whether the Nix daemon process should considered to be low priority when
          doing file system I/O.
@@ -340,7 +404,7 @@ in
            };
          };
        });
-        default = [ ];
+        inherit (managedDefault "nix.buildMachines" [ ]) default defaultText;
        description = ''
          This option lists the machines to be used if distributed builds are
          enabled (see {option}`nix.distributedBuilds`).
@@ -354,7 +418,7 @@ in
      envVars = mkOption {
        type = types.attrs;
        internal = true;
-        default = { };
+        inherit (managedDefault "nix.envVars" { }) default defaultText;
        description = "Environment variables used by Nix.";
      };

@@ -369,6 +433,7 @@ in

      nrBuildUsers = mkOption {
        type = types.int;
+        inherit (managedDefault "nix.nrBuildUsers" 0) default defaultText;
        description = ''
          Number of `nixbld` user accounts created to
          perform secure concurrent builds.  If you receive an error
@@ -396,11 +461,13 @@ in
      # Definition differs substantially from NixOS module
      nixPath = mkOption {
        type = nixPathType;
-        default = lib.optionals cfg.channel.enable [
-          # Include default path <darwin-config>.
-          { darwin-config = "${config.environment.darwinConfig}"; }
-          "/nix/var/nix/profiles/per-user/root/channels"
-        ];
+        inherit (managedDefault "nix.nixPath" (
+          lib.optionals cfg.channel.enable [
+            # Include default path <darwin-config>.
+            { darwin-config = "${config.environment.darwinConfig}"; }
+            "/nix/var/nix/profiles/per-user/root/channels"
+          ]
+        )) default;

        defaultText = lib.literalExpression ''
          lib.optionals cfg.channel.enable [
@@ -422,7 +489,7 @@ in

      checkConfig = mkOption {
        type = types.bool;
-        default = true;
+        inherit (managedDefault "nix.checkConfig" true) default defaultText;
        description = ''
          If enabled (the default), checks for data type mismatches and that Nix
          can parse the generated nix.conf.
@@ -483,7 +550,7 @@ in
            };
          }
        ));
-        default = { };
+        inherit (managedDefault "nix.registry" { }) default defaultText;
        description = ''
          A system-wide flake registry.
        '';
@@ -491,7 +558,7 @@ in

      extraOptions = mkOption {
        type = types.lines;
-        default = "";
+        inherit (managedDefault "nix.extraOptions" "") default defaultText;
        example = ''
          keep-outputs = true
          keep-derivations = true
@@ -660,7 +727,7 @@ in
            };
          };
        };
-        default = { };
+        inherit (managedDefault "nix.settings" { }) default defaultText;
        description = ''
          Configuration for Nix, see
          <https://nixos.org/manual/nix/stable/#sec-conf-file>
@@ -678,7 +745,7 @@ in

  ###### implementation

-  config = {
+  config = handleUnmanaged {
    environment.systemPackages =
      [
        nixPackage
@@ -702,6 +769,8 @@ in
      "5d23e6d7015756c6f300f8cd558ec4d9234ca61deefd4f2478e91a49760b0747"  # DeterminateSystems Nix installer 0.16.0
      "e4974acb79c56148cb8e92137fa4f2de9b7356e897b332fc4e6769e8c0b83e18"  # DeterminateSystems Nix installer 0.20.0
      "966d22ef5bb9b56d481e8e0d5f7ca2deaf4d24c0f0fc969b2eeaa7ae0aa42907"  # DeterminateSystems Nix installer 0.22.0
+      "53712b4335030e2dbfb46bb235f8cffcac83fea404bd32dc99417ac89e2dd7c5"  # DeterminateSystems Nix installer 0.33.0
+      "6bb8d6b0dd16b44ee793a9b8382dac76c926e4c16ffb8ddd2bb4884d1ca3f811"  # DeterminateSystems Nix installer 0.34.0
      "24797ac05542ff8b52910efc77870faa5f9e3275097227ea4e50c430a5f72916"  # lix-installer 0.17.1 with flakes
      "b027b5cad320b5b8123d9d0db9f815c3f3921596c26dc3c471457098e4d3cc40"  # lix-installer 0.17.1 without flakes
    ];
@@ -757,7 +826,7 @@ in

        # Not in NixOS module
        { assertion = elem "nixbld" config.users.knownGroups -> elem "nixbld" createdGroups; message = "refusing to delete group nixbld in users.knownGroups, this would break nix"; }
-        { assertion = elem "_nixbld1" config.users.knownGroups -> elem "_nixbld1" createdUsers; message = "refusing to delete user _nixbld1 in users.knownUsers, this would break nix"; }
+        { assertion = elem "_nixbld1" config.users.knownUsers -> elem "_nixbld1" createdUsers; message = "refusing to delete user _nixbld1 in users.knownUsers, this would break nix"; }
        { assertion = config.users.groups ? "nixbld" -> config.users.groups.nixbld.members != []; message = "refusing to remove all members from nixbld group, this would break nix"; }

        {
@@ -822,8 +891,56 @@ in
      ]);
    users.knownGroups = mkIf cfg.configureBuildUsers [ "nixbld" ];

+    # The Determinate Systems installer puts user‐specified settings in
+    # `/etc/nix/nix.custom.conf` since v0.33.0. Supplement the
+    # `/etc/nix/nix.conf` hash check so that we don’t accidentally
+    # clobber user configuration.
+    #
+    # TODO: Maybe this could use a more general file placement mechanism
+    # to express that we want it deleted and know only one hash?
+    system.activationScripts.etcChecks.text = mkAfter ''
+      nixCustomConfKnownSha256Hashes=(
+        # v0.33.0
+        6787fade1cf934f82db554e78e1fc788705c2c5257fddf9b59bdd963ca6fec63
+        # v0.34.0
+        3bd68ef979a42070a44f8d82c205cfd8e8cca425d91253ec2c10a88179bb34aa
+      )
+      if [[ -e /etc/nix/nix.custom.conf ]]; then
+        nixCustomConfSha256Output=$(shasum -a 256 /etc/nix/nix.custom.conf)
+        nixCustomConfSha256Hash=''${nixCustomConfSha256Output%% *}
+        nixCustomConfIsKnown=
+        for nixCustomConfKnownSha256Hash
+          in "''${nixCustomConfKnownSha256Hashes[@]}"
+        do
+          if
+            [[ $nixCustomConfSha256Hash == "$nixCustomConfKnownSha256Hash" ]]
+          then
+            nixCustomConfIsKnown=1
+            break
+          fi
+        done
+        if [[ ! $nixCustomConfIsKnown ]]; then
+          printf >&2 '\e[1;31merror: custom settings in `/etc/nix/nix.custom.conf`, aborting activation\e[0m\n'
+          printf >&2 'You will need to migrate these to nix-darwin `nix.*` settings if you\n'
+          printf >&2 'wish to keep them. Check the manual for the appropriate settings and\n'
+          printf >&2 'add them to your system configuration, then run:\n'
+          printf >&2 '\n'
+          printf >&2 '  $ sudo mv /etc/nix/nix.custom.conf{,.before-nix-darwin}\n'
+          printf >&2 '\n'
+          printf >&2 'and activate your system again.\n'
+          exit 2
+        fi
+      fi
+    '';
+
    # Unrelated to use in NixOS module
-    system.activationScripts.nix-daemon.text = mkIf cfg.useDaemon ''
+    system.activationScripts.nix-daemon.text = ''
+      # Follow up on the `/etc/nix/nix.custom.conf` check.
+      # TODO: Use a more generalized file placement mechanism for this.
+      if [[ -e /etc/nix/nix.custom.conf ]]; then
+        mv /etc/nix/nix.custom.conf{,.before-nix-darwin}
+      fi
+    '' + optionalString cfg.useDaemon ''
      if ! diff /etc/nix/nix.conf /run/current-system/etc/nix/nix.conf &> /dev/null || ! diff /etc/nix/machines /run/current-system/etc/nix/machines &> /dev/null; then
          echo "reloading nix-daemon..." >&2
          launchctl kill HUP system/org.nixos.nix-daemon
@@ -160,6 +160,13 @@ in
  };

  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.nix.enable;
+        message = ''`nix.linux-builder.enable` requires `nix.enable`'';
+      }
+    ];
+
    system.activationScripts.preActivation.text = ''
      mkdir -p ${cfg.workingDirectory}
    '';
@@ -4,7 +4,7 @@ let
  nix-tools = pkgs.callPackage ../../pkgs/nix-tools {
    inherit (config.system) profile;
    inherit (config.environment) systemPath;
-    nixPackage = config.nix.package;
+    nixPackage = if config.nix.enable then config.nix.package else null;
  };

  darwin-uninstaller = pkgs.callPackage ../../pkgs/darwin-uninstaller { };
@@ -37,8 +37,8 @@ in
    setNixPath = mkOption {
      type = types.bool;

-      default = cfg.source != null;
-      defaultText = "config.nixpkgs.flake.source != null";
+      default = config.nix.enable && cfg.source != null;
+      defaultText = literalExpression ''config.nix.enable && nixpkgs.flake.source != null'';

      description = ''
        Whether to set {env}`NIX_PATH` to include `nixpkgs=flake:nixpkgs` such that `<nixpkgs>`
@@ -57,8 +57,8 @@ in
    setFlakeRegistry = mkOption {
      type = types.bool;

-      default = cfg.source != null;
-      defaultText = "config.nixpkgs.flake.source != null";
+      default = config.nix.enable && cfg.source != null;
+      defaultText = literalExpression ''config.nix.enable && config.nixpkgs.flake.source != null'';

      description = ''
        Whether to pin nixpkgs in the system-wide flake registry (`/etc/nix/registry.json`) to the
@@ -85,6 +85,18 @@ in
            be set, since it is implemented in terms of indirection through the flake registry.
          '';
        }
+
+        # TODO: Upstream these to NixOS.
+
+        {
+          assertion = cfg.setNixPath -> config.nix.enable;
+          message = ''`nixpkgs.flake.setNixPath` requires `nix.enable`'';
+        }
+
+        {
+          assertion = cfg.setFlakeRegistry -> config.nix.enable;
+          message = ''`nixpkgs.flake.setFlakeRegistry` requires `nix.enable`'';
+        }
      ];
    }
    (mkIf cfg.setFlakeRegistry {
@@ -21,7 +21,9 @@
        ln -sfn $(cat ${config.system.profile}/systemConfig) /run/current-system

        # Prevent the current configuration from being garbage-collected.
-        ln -sfn /run/current-system /nix/var/nix/gcroots/current-system
+        if [[ -d /nix/var/nix/gcroots ]]; then
+          ln -sfn /run/current-system /nix/var/nix/gcroots/current-system
+        fi

        ${config.system.activationScripts.etcChecks.text}
        ${config.system.activationScripts.etc.text}
@@ -51,6 +51,14 @@ in {
  };

  config = mkIf cfg.enable {
+    # TODO: Upstream this to NixOS.
+    assertions = [
+      {
+        assertion = config.nix.enable;
+        message = ''`services.cachix-agent.enable` requires `nix.enable`'';
+      }
+    ];
+
    launchd.daemons.cachix-agent = {
      script = ''
        . ${cfg.credentialsFile}
@@ -13,6 +13,11 @@ in
 {
  config.assertions = flatten (
    flip mapAttrsToList config.services.github-runners (name: cfg: map (mkIf cfg.enable) [
+      # TODO: Upstream this to NixOS.
+      {
+        assertion = config.nix.enable;
+        message = ''`services.github-runners.${name}.enable` requires `nix.enable`'';
+      }
      {
        assertion = (cfg.user == null && cfg.group == null) || (cfg.user != null);
        message = "`services.github-runners.${name}`: Either set `user` and `group` to `null` to have nix-darwin manage them or set at least `user` explicitly";
@@ -22,6 +22,14 @@ in
  };

  config = mkIf cfg.enable {
+    # TODO: Upstream this to NixOS.
+    assertions = [
+      {
+        assertion = config.nix.enable;
+        message = ''`services.hercules-ci-agent.enable` requires `nix.enable`'';
+      }
+    ];
+
    launchd.daemons.hercules-ci-agent = {
      script = "exec ${cfg.package}/bin/hercules-ci-agent --config ${cfg.tomlFile}";

@@ -29,6 +29,14 @@ in
  };

  config = mkIf cfg.enable {
+    # TODO: Upstream this to NixOS.
+    assertions = [
+      {
+        assertion = config.nix.enable;
+        message = ''`services.lorri.enable` requires `nix.enable`'';
+      }
+    ];
+
    environment.systemPackages = [ pkgs.lorri ];
    launchd.user.agents.lorri = {
      command = with pkgs; "${lorri}/bin/lorri daemon";
@@ -43,4 +51,4 @@ in
      };
    };
  };
-}
+}
@@ -10,7 +10,7 @@ in
  options = {
    services.nix-daemon.enable = mkOption {
      type = types.bool;
-      default = true;
+      default = config.nix.enable;
      description = "Whether to enable the nix-daemon service.";
    };

@@ -62,15 +62,20 @@ in

  ###### implementation

-  config = mkIf cfg.automatic {
+  config = {
+    assertions = [
+      {
+        assertion = cfg.automatic -> config.nix.enable;
+        message = ''nix.gc.automatic requires nix.enable'';
+      }
+    ];

-    launchd.daemons.nix-gc = {
+    launchd.daemons.nix-gc = mkIf cfg.automatic {
      command = "${config.nix.package}/bin/nix-collect-garbage ${cfg.options}";
      environment.NIX_REMOTE = optionalString config.nix.useDaemon "daemon";
      serviceConfig.RunAtLoad = false;
      serviceConfig.StartCalendarInterval = cfg.interval;
      serviceConfig.UserName = cfg.user;
    };
-
  };
 }
@@ -58,9 +58,15 @@ in

  ###### implementation

-  config = mkIf cfg.automatic {
+  config = {
+    assertions = [
+      {
+        assertion = cfg.automatic -> config.nix.enable;
+        message = ''nix.optimise.automatic requires nix.enable'';
+      }
+    ];

-    launchd.daemons.nix-optimise = {
+    launchd.daemons.nix-optimise = mkIf cfg.automatic {
      environment.NIX_REMOTE = optionalString config.nix.useDaemon "daemon";
      command = "${lib.getExe' config.nix.package "nix-store"} --optimise";
      serviceConfig = {
@@ -69,6 +75,5 @@ in
        UserName = cfg.user;
      };
    };
-
  };
 }
@@ -46,6 +46,13 @@ in
  };

  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.nix.enable;
+        message = ''`services.ofborg.enable` requires `nix.enable`'';
+      }
+    ];
+
    warnings = mkIf (isDerivation cfg.configFile) [
      "services.ofborg.configFile is a derivation, credentials will be world readable"
    ];
@@ -13,6 +13,32 @@ let
    mkTextDerivation = name: text: pkgs.writeScript "activate-${name}" text;
  };

+  activationPath =
+    lib.makeBinPath [
+      pkgs.gnugrep
+      pkgs.coreutils
+    ]
+    + lib.optionalString (!config.nix.enable) ''
+      $(
+        # If `nix.enable` is off, there might be an unmanaged Nix
+        # installation (say in `/nix/var/nix/profiles/default`) that
+        # activation scripts (such as Home Manager) want to find on the
+        # `$PATH`. Search for it directly to avoid polluting the
+        # activation script environment with everything on the
+        # `environment.systemPath`.
+        if nixEnvPath=$(
+          PATH="${config.environment.systemPath}" command -v nix-env
+        ); then
+          printf ':'
+          ${lib.getExe' pkgs.coreutils "dirname"} -- "$(
+            ${lib.getExe' pkgs.coreutils "readlink"} \
+              --canonicalize-missing \
+              -- "$nixEnvPath"
+          )"
+        fi
+      )''
+    + ":@out@/sw/bin:/usr/bin:/bin:/usr/sbin:/sbin";
+
 in

 {
@@ -40,7 +66,9 @@ in
      #! ${stdenv.shell}
      set -e
      set -o pipefail
-      export PATH="${pkgs.gnugrep}/bin:${pkgs.coreutils}/bin:@out@/sw/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+
+      PATH="${activationPath}"
+      export PATH

      systemConfig=@out@

@@ -81,7 +109,9 @@ in
      ln -sfn "$(readlink -f "$systemConfig")" /run/current-system

      # Prevent the current configuration from being garbage-collected.
-      ln -sfn /run/current-system /nix/var/nix/gcroots/current-system
+      if [[ -d /nix/var/nix/gcroots ]]; then
+        ln -sfn /run/current-system /nix/var/nix/gcroots/current-system
+      fi

      exit $_status
    '';
@@ -91,7 +121,9 @@ in
      #! ${stdenv.shell}
      set -e
      set -o pipefail
-      export PATH="${pkgs.gnugrep}/bin:${pkgs.coreutils}/bin:@out@/sw/bin:/usr/bin:/bin"
+
+      PATH="${activationPath}"
+      export PATH

      systemConfig=@out@

@@ -31,6 +31,23 @@ let
    fi
  '';

+  determinate = ''
+    if [[ -e /usr/local/bin/determinate-nixd ]]; then
+      printf >&2 '\e[1;31merror: Determinate detected, aborting activation\e[0m\n'
+      printf >&2 'Determinate uses its own daemon to manage the Nix installation that\n'
+      printf >&2 'conflicts with nix-darwin’s native Nix management.\n'
+      printf >&2 '\n'
+      printf >&2 'To turn off nix-darwin’s management of the Nix installation, set:\n'
+      printf >&2 '\n'
+      printf >&2 '    nix.enable = false;\n'
+      printf >&2 '\n'
+      printf >&2 'This will allow you to use nix-darwin with Determinate. Some nix-darwin\n'
+      printf >&2 'functionality that relies on managing the Nix installation, like the\n'
+      printf >&2 '`nix.*` options to adjust Nix settings or configure a Linux builder,\n'
+      printf >&2 'will be unavailable.\n'
+      exit 2
+    fi
+  '';

  oldBuildUsers = ''
    if dscl . -list /Users | grep -q '^nixbld'; then
@@ -118,7 +135,6 @@ let
        printf >&2 'Possible causes include setting up a new Nix installation with an\n'
        printf >&2 'existing nix-darwin configuration, setting up a new nix-darwin\n'
        printf >&2 'installation with an existing Nix installation, or manually increasing\n'
-        # shellcheck disable=SC2016
        printf >&2 'your `system.stateVersion` setting.\n'
        printf >&2 '\n'
        printf >&2 'You can set the configured group ID to match the actual value:\n'
@@ -139,7 +155,6 @@ let
      printf >&2 '\n'
      printf >&2 '    services.nix-daemon.enable = false;\n'
      printf >&2 '\n'
-      # shellcheck disable=SC2016
      printf >&2 'and remove `nix.useDaemon` from your configuration if it is present.\n'
      printf >&2 '\n'
      exit 2
@@ -211,7 +226,7 @@ let
    if ! test -e "$darwinPath"; then
        echo "[1;31merror: Changed <darwin> but target does not exist, aborting activation[0m" >&2
        echo "Add the darwin repo as a channel or set nix.nixPath:" >&2
-        echo "$ sudo nix-channel --add https://github.com/LnL7/nix-darwin/archive/master.tar.gz darwin" >&2
+        echo "$ sudo nix-channel --add https://github.com/nix-darwin/nix-darwin/archive/master.tar.gz darwin" >&2
        echo "$ sudo nix-channel --update" >&2
        echo >&2
        echo "or set" >&2
@@ -279,7 +294,6 @@ let
    if [[ -d /etc/ssh/authorized_keys.d ]]; then
        printf >&2 '\e[1;31merror: /etc/ssh/authorized_keys.d exists, aborting activation\e[0m\n'
        printf >&2 'SECURITY NOTICE: The previous implementation of the\n'
-        # shellcheck disable=SC2016
        printf >&2 '`users.users.<name>.openssh.authorizedKeys.*` options would not delete\n'
        printf >&2 'authorized keys files when the setting for a given user was removed.\n'
        printf >&2 '\n'
@@ -302,7 +316,6 @@ let
        echo "Homebrew doesn't seem to be installed. Please install homebrew separately." >&2
        echo "You can install homebrew using the following command:" >&2
        echo >&2
-        # shellcheck disable=SC2016
        echo '    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"' >&2
        echo >&2
        exit 2
@@ -323,21 +336,22 @@ in
  options = {
    system.checks.verifyNixPath = mkOption {
      type = types.bool;
-      default = true;
+      default = config.nix.enable;
      description = "Whether to run the NIX_PATH validation checks.";
    };

    system.checks.verifyNixChannels = mkOption {
      type = types.bool;
-      default = config.nix.channel.enable;
+      default = config.nix.enable && config.nix.channel.enable;
      description = "Whether to run the nix-channels validation checks.";
    };

    system.checks.verifyBuildUsers = mkOption {
      type = types.bool;
      default =
-        (config.nix.useDaemon && !(config.nix.settings.auto-allocate-uids or false))
-        || config.nix.configureBuildUsers;
+        config.nix.enable &&
+        ((config.nix.useDaemon && !(config.nix.settings.auto-allocate-uids or false))
+          || config.nix.configureBuildUsers);
      description = "Whether to run the Nix build users validation checks.";
    };

@@ -353,11 +367,12 @@ in
    system.checks.text = mkMerge [
      darwinChanges
      runLink
+      (mkIf config.nix.enable determinate)
      (mkIf (cfg.verifyBuildUsers && !config.nix.configureBuildUsers) oldBuildUsers)
      (mkIf cfg.verifyBuildUsers buildUsers)
      (mkIf cfg.verifyBuildUsers preSequoiaBuildUsers)
      (mkIf config.nix.configureBuildUsers buildGroupID)
-      nixDaemon
+      (mkIf config.nix.enable nixDaemon)
      nixStore
      (mkIf (config.nix.gc.automatic && config.nix.gc.user == null) nixGarbageCollector)
      (mkIf (config.nix.optimise.automatic && config.nix.optimise.user == null) nixStoreOptimiser)
@@ -135,7 +135,10 @@ in
        chmod u+x $out/activate-user
        unset activationUserScript

-        shellcheck $out/activate $out/activate-user
+        # We exclude the warnings for `…` in single‐quote strings and
+        # non‐ASCII quotation marks as they are noisy and lead to a lot
+        # of false positives in our user‐facing output:
+        shellcheck --exclude=SC2016,SC1112 $out/activate $out/activate-user

        echo -n "$systemConfig" > $out/systemConfig

@@ -56,11 +56,36 @@ with lib;
        Hide items in Stage Manager.
      '';
    };
+
+    system.defaults.WindowManager.EnableTilingByEdgeDrag = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Enable dragging windows to screen edges to tile them. The default is true.
+      '';
+    };
+
+    system.defaults.WindowManager.EnableTopTilingByEdgeDrag = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Enable dragging windows to the menu bar to fill the screen. The default is true.
+      '';
+    };
+
+    system.defaults.WindowManager.EnableTilingOptionAccelerator = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Enable holding alt to tile windows. The default is true.
+      '';
+    };
+
    system.defaults.WindowManager.EnableTiledWindowMargins = mkOption {
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        Enable Window Margins. The default is true.
+        Enable window margins when tiling windows. The default is true.
      '';
    };

@@ -149,7 +149,6 @@ in
        if ! sudo dscl . -change /Users/nobody NFSHomeDirectory "$homeDirectory" "$homeDirectory" &> /dev/null; then
          if [[ -n "$SSH_CONNECTION" ]]; then
            printf >&2 '\e[1;31merror: users cannot be %s over SSH without Full Disk Access, aborting activation\e[0m\n' "$2"
-            # shellcheck disable=SC2016
            printf >&2 'The user %s could not be %s as `darwin-rebuild` was not executed with Full Disk Access over SSH.\n' "$1" "$2"
            printf >&2 'You can either:\n'
            printf >&2 '\n'
@@ -157,7 +156,6 @@ in
            printf >&2 '\n'
            printf >&2 'or\n'
            printf >&2 '\n'
-            # shellcheck disable=SC2016
            printf >&2 '  run `darwin-rebuild` in a graphical session.\n'
            printf >&2 '\n'
            printf >&2 'The option "Allow full disk access for remote users" can be found by\n'
@@ -171,11 +169,9 @@ in

            if ! sudo dscl . -change /Users/nobody NFSHomeDirectory "$homeDirectory" "$homeDirectory" &> /dev/null; then
              printf >&2 '\e[1;31merror: permission denied when trying to %s user %s, aborting activation\e[0m\n' "$2" "$1"
-              # shellcheck disable=SC2016
              printf >&2 '`darwin-rebuild` requires permissions to administrate your computer,\n'
              printf >&2 'please accept the dialog that pops up.\n'
              printf >&2 '\n'
-              # shellcheck disable=SC2016
              printf >&2 'If you do not wish to be prompted every time `darwin-rebuild updates your users,\n'
              printf >&2 'you can grant Full Disk Access to your terminal emulator in System Settings.\n'
              printf >&2 '\n'
@@ -224,7 +220,6 @@ in
          if [ "$u" -gt 501 ]; then
            # TODO: add `darwin.primaryUser` as well
            if [[ ${name} == "$USER" ]]; then
-              # shellcheck disable=SC2016
              printf >&2 '\e[1;31merror: refusing to delete the user calling `darwin-rebuild` (%s), aborting activation\e[0m\n', ${name}
              exit 1
            fi
@@ -12,8 +12,8 @@ with lib;
  launchd.daemons = mkForce {};
  launchd.user.agents = mkForce {};

-  # Don't try to reload `nix-daemon`
-  nix.useDaemon = mkForce false;
+  # Restore any unmanaged `nix-daemon`.
+  nix.enable = false;

  system.activationScripts.postUserActivation.text = mkAfter ''
    if [[ -L ~/.nix-defexpr/channels/darwin ]]; then
@@ -30,14 +30,6 @@ with lib;
        rm /etc/static
    fi

-    # If the Nix Store is owned by root then we're on a multi-user system
-    if [[ -O /nix/store ]]; then
-        if [[ -e /nix/var/nix/profiles/default/Library/LaunchDaemons/org.nixos.nix-daemon.plist ]]; then
-            sudo cp /nix/var/nix/profiles/default/Library/LaunchDaemons/org.nixos.nix-daemon.plist /Library/LaunchDaemons/org.nixos.nix-daemon.plist
-            sudo launchctl load -w /Library/LaunchDaemons/org.nixos.nix-daemon.plist
-        fi
-    fi
-
    # grep will return 1 when no lines matched which makes this line fail with `set -eo pipefail`
    dscl . -list /Users UserShell | { grep "\s/run/" || true; } | awk '{print $1}' | while read -r user; do
      shell=$(dscl . -read /Users/"$user" UserShell)
@@ -31,8 +31,11 @@ in writeShellApplication {
    echo >&2 "    - remove /Applications/Nix Apps symlink"
    echo >&2 "    - cleanup static /etc files"
    echo >&2 "    - disable and remove all launchd services managed by nix-darwin"
-    if [[ $(stat -f '%Su' /nix/store) == "root" ]]; then
-      echo >&2 "    - restore nix-daemon service from nix installer as this is a multi-user install"
+    if [[
+      -e /run/current-system/Library/LaunchDaemons/org.nixos.nix-daemon.plist
+      && -e /nix/var/nix/profiles/default/Library/LaunchDaemons/org.nixos.nix-daemon.plist
+    ]]; then
+      echo >&2 "    - restore nix-daemon service from the Nix installer"
    fi
    echo >&2

@@ -88,7 +91,7 @@ in writeShellApplication {
        launchctl print system/org.nixos.nix-daemon
        pgrep -l nix-daemon
        test -e /Library/LaunchDaemons/org.nixos.nix-daemon.plist
-        [[ "$(shasum -a 256 /Library/LaunchDaemons/org.nixos.nix-daemon.plist | awk '{print $1}')" == "$(shasum -a 256 /Library/LaunchDaemons/org.nixos.nix-daemon.plist | awk '{print $1}')" ]]
+        [[ "$(shasum -a 256 /Library/LaunchDaemons/org.nixos.nix-daemon.plist | awk '{print $1}')" == "$(shasum -a 256 /nix/var/nix/profiles/default/Library/LaunchDaemons/org.nixos.nix-daemon.plist | awk '{print $1}')" ]]
        nix-store --store daemon -q --hash ${stdenv.shell}
      fi
      echo >&2 ok
@@ -88,6 +88,7 @@ in {
  tests.launchd-setenv = makeTest ./tests/launchd-setenv.nix;
  tests.networking-hostname = makeTest ./tests/networking-hostname.nix;
  tests.networking-networkservices = makeTest ./tests/networking-networkservices.nix;
+  tests.nix-enable = makeTest ./tests/nix-enable.nix;
  tests.nixpkgs-overlays = makeTest ./tests/nixpkgs-overlays.nix;
  tests.programs-ssh = makeTest ./tests/programs-ssh.nix;
  tests.programs-tmux = makeTest ./tests/programs-tmux.nix;
@@ -524,6 +524,21 @@ defaults write com.apple.WindowManager 'EnableTiledWindowMargins' $'<?xml versio
 <plist version="1.0">
 <true/>
 </plist>'
+defaults write com.apple.WindowManager 'EnableTilingByEdgeDrag' $'<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<true/>
+</plist>'
+defaults write com.apple.WindowManager 'EnableTilingOptionAccelerator' $'<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<true/>
+</plist>'
+defaults write com.apple.WindowManager 'EnableTopTilingByEdgeDrag' $'<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<true/>
+</plist>'
 defaults write com.apple.WindowManager 'GloballyEnabled' $'<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -0,0 +1,16 @@
+{ config, ... }:
+
+{
+  nix.enable = false;
+
+  test = ''
+    printf >&2 'checking for unexpected Nix binary in /sw/bin\n'
+    [[ -e ${config.out}/sw/bin/nix-env ]] && exit 1
+
+    printf >&2 'checking for unexpected nix-daemon plist in /Library/LaunchDaemons\n'
+    [[ -e ${config.out}/Library/LaunchDaemons/org.nixos.nix-daemon.plist ]] && exit 1
+
+    printf >&2 'checking for late‐bound Nix lookup in /activate\n'
+    grep nixEnvPath= ${config.out}/activate
+  '';
+}
@@ -96,6 +96,9 @@
  system.defaults.WindowManager.AppWindowGroupingBehavior = true;
  system.defaults.WindowManager.StandardHideDesktopIcons = false;
  system.defaults.WindowManager.HideDesktop = false;
+  system.defaults.WindowManager.EnableTilingByEdgeDrag = true;
+  system.defaults.WindowManager.EnableTopTilingByEdgeDrag = true;
+  system.defaults.WindowManager.EnableTilingOptionAccelerator = true;
  system.defaults.WindowManager.EnableTiledWindowMargins = true;
  system.defaults.WindowManager.StandardHideWidgets = true;
  system.defaults.WindowManager.StageManagerHideWidgets = true;
@@ -1,4 +1,4 @@
 {
-  "release": "25.05",
-  "isReleaseBranch": false
+  "release": "24.11",
+  "isReleaseBranch": true
 }
Author	SHA1	Message	Date
Michael HoangandGitHub	fc843893ce	Merge pull request #1404 from Enzime/push-unyymrtpyyvw [24.11] treewide: point to the new GitHub organization	2025-03-28 11:06:55 +09:00
EmilyandMichael Hoang	6c3563897b	treewide: point to the new GitHub organization (cherry picked from commit `ce5a3b9db9`)	2025-03-28 10:38:39 +09:00
EmilyandGitHub	c172f50b55	Merge pull request #1365 from stepbrobd/nix-darwin-24.11 [24.11] homebrew: remove --no-lock flag	2025-03-04 22:07:58 +00:00
Yifei Sun	4a19b0dcee	homebrew: remove `--no-lock` flag https://github.com/Homebrew/homebrew-bundle/pull/1630 (cherry picked from commit `d06cf700ee`)	2025-03-04 13:31:57 -05:00
EmilyandGitHub	353846417f	Merge pull request #1340 from emilazy/push-ykqknxqmlvmm [24.11] treewide: add checks for `nix.enable`	2025-02-14 17:19:06 +00:00
Michael HoangandGitHub	e904ef02b0	Merge pull request #1338 from Enzime/push-nxtlkvowmzpy [24.11] nix: place `extra`-prefixed settings after their non-prefixed variants	2025-02-14 23:29:45 +07:00
SanderandMichael Hoang	c363e6c967	nix: place `extra-`prefixed settings after their non-prefixed variants Fixes #626. Essentially a copy of NixOS's workaround: https://github.com/NixOS/nixpkgs/pull/278064 (cherry picked from commit `5926058aec`)	2025-02-14 23:03:27 +07:00
Emily	d0f10e610f	{activation-scripts,activate-system}: check `gcroots` before linking When `nix.enable` is off, we don’t necessarily have an active Nix installation, so there won’t necessarily be an active `/nix/var/nix/gcroots` directory to link things into. NixOS just skips this unconditionally when `nix.enable` is off, but that doesn’t work well with a context in which we usually expect `nix.enable` to be coupled with an unmanaged system installation of Nix. (cherry picked from commit `731910af01`)	2025-02-14 15:55:25 +00:00
Emily	67d262f923	nix: catch reads of unmanaged defaults When we’re not managing the Nix installation, these defaults aren’t used out of the box and won’t accurately represent the state of any unmanaged Nix or the desired Nix package, so reading the option defaults is a bug. This was previously a warning for `nix.package` and a silent failure for all the others. Now that all the problematic accesses in nix-darwin have been appropriately conditionalized, and since a throw gives a backtrace where a warning doesn’t, give throwing defaults to all the `nix.*` options that don’t reflect reality and that that modules shouldn’t be reading when `nix.enable` is off. I’m not in love with the implementation strategy here… ideally we’d think of something better than this and then upstream it to NixOS. `nix.nrBuildUsers` growing a fake default that is never used is particularly unfortunate. But this should hopefully catch mistakes in module code reasonably reliably. (cherry picked from commit `cd445c5465`)	2025-02-14 15:55:25 +00:00
Emily	a66e5dada1	cachix-agent: check for `nix.enable` (cherry picked from commit `42e16f31c6`)	2025-02-14 15:55:25 +00:00
Emily	4884d2a217	github-runner: check for `nix.enable` (cherry picked from commit `e3bde1588b`)	2025-02-14 15:55:25 +00:00
Emily	1a3bd58667	ofborg: check for `nix.enable` (cherry picked from commit `f4e2805e19`)	2025-02-14 15:55:25 +00:00
Emily	68760fcd7f	lorri: check for `nix.enable` (cherry picked from commit `aba0c60eba`)	2025-02-14 15:55:25 +00:00
Emily	9f452b8c83	hercules-ci-agent: check for `nix.enable` (cherry picked from commit `57c93ffe6c`)	2025-02-14 15:55:25 +00:00
Emily	77e5f792a8	nixpkgs-flake: check for `nix.enable` (cherry picked from commit `147ed950e3`)	2025-02-14 15:55:25 +00:00
Emily	f49eef1b2c	linux-builder: check for `nix.enable` (cherry picked from commit `7cca8f95f7`)	2025-02-14 15:55:25 +00:00
Emily	be5f5c546f	nix-optimise: check for `nix.enable` This was added to Nixpkgs in eb8b70c020e6693b29634660fa173d7f14f882eb. (cherry picked from commit `0176a5082b`)	2025-02-14 15:55:25 +00:00
Emily	6374102082	nix-gc: check for `nix.enable` This was added to Nixpkgs in eb8b70c020e6693b29634660fa173d7f14f882eb. (cherry picked from commit `fc9367a9ec`)	2025-02-14 15:55:18 +00:00
EmilyandGitHub	f81c16138a	Merge pull request #1326 from emilazy/push-kmnlnvvnortv [24.11] nix: add `nix.enable` option to disable Nix management	2025-02-11 19:30:49 +00:00
Emily	78a8ba905f	readme: point to `master` branch readme Ideally we’d have separate manuals per release, but in the meantime this should help avoid user confusion.	2025-02-07 22:06:31 +00:00
Emily	b2b26e8856	checks: add check for Determinate This provides a more useful error message than the `/etc/nix/nix.conf` hash mismatch error that would otherwise occur. (cherry picked from commit `03877755e9`)	2025-02-07 22:06:31 +00:00
Emily	3032a10c4c	activation-scripts: add unmanaged system Nix to activation path Currently, the `bin` directory of the configured system is embedded in the `$PATH` of activation scripts, but not other elements of the default `environment.systemPath` like `/nix/var/nix/profiles/default/bin` or `/usr/local/bin`. This means that when nix-darwin is not managing the Nix installation, activation scripts like Home Manager’s that want to look up the system‐managed Nix can’t find it. Search for it on the entire `environment.systemPath` and add the appropriate directory if found. We leave the launchd `activate-system` daemon alone, because it has erroneously referred to `@out@/sw/bin` forever and therefore never got a Nix on the path to begin with. That’s a problem for another time. (The more ideal solution is probably for Home Manager activation to be driven by launchd or something, but that’s a longer‐term goal.) (cherry picked from commit `fb2bc03f92`)	2025-02-07 22:06:31 +00:00
Emily	a9590d5bb2	nix: set `nix.useDaemon` by default for unmanaged Nix	2025-02-07 22:06:31 +00:00
Emily	32b00fd339	nix: add `nix.enable` option to disable Nix management This is an equivalent of the `nix.enable` option from NixOS and Home Manager. On NixOS, it mostly serves to allow building fixed‐configuration systems without any Nix installation at all. It should work for that purpose with nix-darwin too, and the implementation is largely the same, but the main use case is more similar to the Home Manager option: to allow the use of nix-darwin with an unmanaged system installation of Nix, including when there is another service expecting to manage it, as with Determinate. By providing an escape hatch to opt out of Nix management entirely, this will also allow us to consolidate and simplify our existing Nix installation management, by being more opinionated about things like taking ownership of the daemon and the build users. Porting one option from NixOS lets us drop two that only ever existed in nix-darwin and reduce overall complexity. (cherry picked from commit `e182d8dff6`)	2025-02-07 22:06:31 +00:00
Emily	338d5d5bf2	nix: fix typo in assertion conditional (cherry picked from commit `8f227c405e`)	2025-02-07 19:50:50 +00:00
Emily	6c08608ffe	system: tweak ShellCheck settings (cherry picked from commit `e1976612f0`)	2025-02-07 19:08:01 +00:00
EmilyandGitHub	cae8d1c4a3	Merge pull request #1291 from emilazy/push-nnnnzznsrppr [24.11] eval-config: omit `enableNixpkgsReleaseCheck` from `lib.evalModules`	2025-01-21 00:57:47 +00:00
EmilyandGitHub	2b5bc0996b	Merge pull request #1288 from emilazy/push-wovknoqtqqkl [24.11] checks: check `/etc/nix/nix.custom.conf` hash	2025-01-21 00:56:16 +00:00
Emily	6bae5163e2	eval-config: omit `enableNixpkgsReleaseCheck` from `lib.evalModules` (cherry picked from commit `87b61d6666`)	2025-01-21 00:55:28 +00:00
EmilyandGitHub	361e80a157	Merge pull request #1289 from belak-forks/belak/additional-window-options-24.11-backport [24.11] Add support for additional window tiling options	2025-01-21 00:42:52 +00:00
Kaleb Elwert	91fe110021	Add support for additional window tiling options This adds support for the following defaults: - com.apple.WindowManager.EnableTilingByEdgeDrag - com.apple.WindowManager.EnableTopTilingByEdgeDrag - com.apple.WindowManager.EnableTilingOptionAccelerator (cherry picked from commit `4075a3c23a`)	2025-01-20 16:12:41 -08:00
Emily	e5c5c10f09	nix: add hashes for Determinate Systems installer v0.33.0 and v0.34.0 (cherry picked from commit `8abb2e7244`)	2025-01-20 22:23:53 +00:00
Emily	f2ddf5b588	nix: check `/etc/nix/nix.custom.conf` hash (cherry picked from commit `2fe899db70`)	2025-01-20 22:23:53 +00:00
EmilyandGitHub	944c2b1817	Merge pull request #1268 from emilazy/push-qxywskyyqkvm nix-darwin 24.11	2025-01-14 02:15:23 +00:00
Emily	4e9943b2ca	nix-darwin 24.11	2025-01-14 01:47:32 +00:00