Merge pull request #1404 from Enzime/push-unyymrtpyyvw

[24.11] treewide: point to the new GitHub organization

.github/workflows/test.yml

@@ -3,11 +3,11 @@ on:
   pull_request:
   push:
     branches:
-      - master
+      - nix-darwin-24.11
 
 env:
-  NIXPKGS_BRANCH: nixpkgs-unstable
+  NIXPKGS_BRANCH: nixpkgs-24.11-darwin
-  NIX_DARWIN_BRANCH: master
+  NIX_DARWIN_BRANCH: nix-darwin-24.11
   NIX_VERSION: 2.24.11
 
 jobs:
@@ -40,7 +40,7 @@ jobs:
         nix_path: nixpkgs=channel:${{ env.NIXPKGS_BRANCH }}
     - name: Install channels
       run: |
-        nix-channel --add https://github.com/LnL7/nix-darwin/archive/${{ env.NIX_DARWIN_BRANCH }}.tar.gz darwin
+        nix-channel --add https://github.com/nix-darwin/nix-darwin/archive/${{ env.NIX_DARWIN_BRANCH }}.tar.gz darwin
         nix-channel --add https://nixos.org/channels/${{ env.NIXPKGS_BRANCH }} nixpkgs
         nix-channel --update
     - name: Install nix-darwin

CHANGELOG

@@ -189,7 +189,7 @@
 
     Use a channel for nix-darwin or configure nix.nixPath
 
-    sudo nix-channel --add https://github.com/LnL7/nix-darwin/archive/master.tar.gz darwin
+    sudo nix-channel --add https://github.com/nix-darwin/nix-darwin/archive/master.tar.gz darwin
     sudo nix-channel --update
 
     nix.nixPath =

README.md

@@ -1,231 +1,3 @@
-[<img src="https://daiderd.com/nix-darwin/images/nix-darwin.png" width="200px" alt="logo" />](https://github.com/LnL7/nix-darwin)
-
 # nix-darwin
 
-[![Test](https://github.com/LnL7/nix-darwin/actions/workflows/test.yml/badge.svg)](https://github.com/LnL7/nix-darwin/actions/workflows/test.yml)
+This is the 24.11 release branch of nix-darwin. See [the main readme](https://github.com/nix-darwin/nix-darwin#readme) for documentation.
-
-Nix modules for darwin, `/etc/nixos/configuration.nix` for macOS.
-
-This project aims to bring the convenience of a declarative system approach to macOS.
-nix-darwin is built up around [Nixpkgs](https://github.com/NixOS/nixpkgs), quite similar to [NixOS](https://nixos.org/).
-
-## Prerequisites
-
-The only prerequisite is a Nix implementation, both Nix and Lix are supported.
-
-As the official Nix installer does not include an automated uninstaller, and manual uninstallation on macOS is a complex process, we recommend using one of the following installers instead:
-
-- The [Nix installer from Determinate Systems](https://github.com/DeterminateSystems/nix-installer?tab=readme-ov-file#determinate-nix-installer) is only recommended for use with flake-based setups. **Make sure you use it without the `--determinate` flag**. The `--determinate` flag installs the Determinate Nix distribution which does not work out of the box with nix-darwin.
-* The [Lix installer](https://lix.systems/install/#on-any-other-linuxmacos-system) supports both flake-based and channel-based setups.
-
-
-
-## Getting started
-
-Despite being an experimental feature in Nix currently, nix-darwin recommends that beginners use flakes to manage their nix-darwin configurations.
-
-<details>
-<summary>Flakes (Recommended for beginners)</summary>
-
-### Step 1. Creating `flake.nix`
-
-<details>
-<summary>Getting started from scratch</summary>
-<p></p>
-
-If you don't have an existing `configuration.nix`, you can run the following commands to generate a basic `flake.nix` inside `~/.config/nix-darwin`:
-
-```bash
-mkdir -p ~/.config/nix-darwin
-cd ~/.config/nix-darwin
-
-# To use Nixpkgs unstable:
-nix flake init -t nix-darwin/master
-# To use Nixpkgs 24.11:
-nix flake init -t nix-darwin/nix-darwin-24.11
-
-sed -i '' "s/simple/$(scutil --get LocalHostName)/" flake.nix
-```
-
-Make sure to change `nixpkgs.hostPlatform` to `aarch64-darwin` if you are using Apple Silicon.
-
-</details>
-
-<details>
-<summary>Migrating from an existing configuration.nix</summary>
-<p></p>
-
-Add the following to `flake.nix` in the same folder as `configuration.nix`:
-
-```nix
-{
-  description = "John's darwin system";
-
-  inputs = {
-    # Use `github:NixOS/nixpkgs/nixpkgs-24.11-darwin` to use Nixpkgs 24.11.
-    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
-    # Use `github:LnL7/nix-darwin/nix-darwin-24.11` to use Nixpkgs 24.11.
-    nix-darwin.url = "github:LnL7/nix-darwin/master";
-    nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
-  };
-
-  outputs = inputs@{ self, nix-darwin, nixpkgs }: {
-    darwinConfigurations."Johns-MacBook" = nix-darwin.lib.darwinSystem {
-      modules = [ ./configuration.nix ];
-    };
-  };
-}
-```
-
-Make sure to replace `Johns-MacBook` with your hostname which you can find by running `scutil --get LocalHostName`.
-
-Make sure to set `nixpkgs.hostPlatform` in your `configuration.nix` to either `x86_64-darwin` (Intel) or `aarch64-darwin` (Apple Silicon).
-
-</details>
-
-### Step 2. Installing `nix-darwin`
-
-Unlike NixOS, `nix-darwin` does not have an installer, you can just run `darwin-rebuild switch` to install nix-darwin. As `darwin-rebuild` won't be installed in your `PATH` yet, you can use the following command:
-
-```bash
-nix run nix-darwin -- switch --flake ~/.config/nix-darwin
-```
-
-### Step 3. Using `nix-darwin`
-
-After installing, you can run `darwin-rebuild` to apply changes to your system:
-
-```bash
-darwin-rebuild switch --flake ~/.config/nix-darwin
-```
-
-#### Using flake inputs
-
-Inputs from the flake can also be passed into `darwinSystem`. These inputs are then
-accessible as an argument `inputs`, similar to `pkgs` and `lib`, inside the configuration.
-
-```nix
-# in flake.nix
-nix-darwin.lib.darwinSystem {
-  modules = [ ./configuration.nix ];
-  specialArgs = { inherit inputs; };
-}
-```
-
-```nix
-# in configuration.nix
-{ pkgs, lib, inputs }:
-# inputs.self, inputs.nix-darwin, and inputs.nixpkgs can be accessed here
-```
-</details>
-
-<details>
-<summary>Channels</summary>
-
-### Step 1. Creating `configuration.nix`
-
-Copy the [simple](./modules/examples/simple.nix) example to `~/.config/nix-darwin/configuration.nix`.
-
-### Step 2. Adding `nix-darwin` channel
-
-```bash
-# If you use Nixpkgs unstable (the default):
-sudo nix-channel --add https://github.com/LnL7/nix-darwin/archive/master.tar.gz darwin
-# If you use Nixpkgs 24.11:
-sudo nix-channel --add https://github.com/LnL7/nix-darwin/archive/nix-darwin-24.11.tar.gz darwin
-
-sudo nix-channel --update
-```
-
-### Step 3. Installing `nix-darwin`
-
-To install `nix-darwin`, you can just run `darwin-rebuild switch` to install nix-darwin. As `darwin-rebuild` won't be installed in your `PATH` yet, you can use the following command:
-
-```bash
-# If you use Nixpkgs unstable (the default):
-nix-build https://github.com/LnL7/nix-darwin/archive/master.tar.gz -A darwin-rebuild
-# If you use Nixpkgs 24.11:
-nix-build https://github.com/LnL7/nix-darwin/archive/nix-darwin-24.11.tar.gz -A darwin-rebuild
-
-./result/bin/darwin-rebuild switch -I darwin-config=$HOME/.config/nix-darwin/configuration.nix
-```
-
-### Step 4. Using `nix-darwin`
-
-After installing, you can run `darwin-rebuild` to apply changes to your system:
-
-```bash
-darwin-rebuild switch
-```
-
-### Step 5. Updating `nix-darwin`
-
-You can update Nixpkgs and `nix-darwin` using the following command:
-
-```bash
-sudo nix-channel --update
-```
-</details>
-
-## Documentation
-
-`darwin-help` will open up a local copy of the reference documentation, it can also be found online [here](https://daiderd.com/nix-darwin/manual/index.html).
-
-The documentation is also available as manpages by running `man 5 configuration.nix`.
-
-## Uninstalling
-
-To run the latest version of the uninstaller, you can run the following command:
-
-```
-nix --extra-experimental-features "nix-command flakes" run nix-darwin#darwin-uninstaller
-```
-
-If that command doesn't work for you, you can try the locally installed uninstaller:
-
-```
-darwin-uninstaller
-```
-
-## Tests
-
-There are basic tests that run sanity checks for some of the modules,
-you can run them like this:
-
-```bash
-# run all tests
-nix-build release.nix -A tests
-# or just a subset
-nix-build release.nix -A tests.environment-path
-```
-
-## Contributing
-
-Let's make Nix on macOS awesome!
-
-Don't hesitate to contribute modules or open an issue.
-
-To build your configuration with local changes you can run this. This
-flag can also be used to override darwin-config or nixpkgs, for more
-information on the `-I` flag look at the nix-build [manpage](https://nixos.org/manual/nix/stable/command-ref/nix-build.html).
-
-```bash
-darwin-rebuild switch -I darwin=.
-```
-
-If you're adding a module, please add yourself to `meta.maintainers`, for example
-
-```nix
-  meta.maintainers = [
-    lib.maintainers.alice or "alice"
-  ];
-
-  options.services.alicebot = # ...
-```
-
-The `or` operator takes care of graceful degradation when `lib` from Nixpkgs
-goes out of sync.
-
-Also feel free to contact me if you have questions,
-- Matrix - @daiderd:matrix.org, you can find me in [#macos:nixos.org](https://matrix.to/#/#macos:nixos.org)
-- @LnL7 on twitter

doc/known-files/3bd68ef979a42070a44f8d82c205cfd8e8cca425d91253ec2c10a88179bb34aa

@@ -0,0 +1,3 @@
+# Written by https://github.com/DeterminateSystems/nix-installer.
+# The contents below are based on options specified at installation time.
+

doc/known-files/53712b4335030e2dbfb46bb235f8cffcac83fea404bd32dc99417ac89e2dd7c5

@@ -0,0 +1,14 @@
+
+# Generated by https://github.com/DeterminateSystems/nix-installer.
+# See `/nix/nix-installer --version` for the version details.
+
+!include nix.custom.conf
+
+experimental-features = nix-command flakes
+always-allow-substitutes = true
+extra-trusted-substituters = https://cache.flakehub.com
+extra-trusted-public-keys = cache.flakehub.com-3:hJuILl5sVK4iKm86JzgdXW12Y2Hwd5G07qKtHTOcDCM= cache.flakehub.com-4:Asi8qIv291s0aYLyH6IOnr5Kf6+OF14WVjkE6t3xMio= cache.flakehub.com-5:zB96CRlL7tiPtzA9/WKyPkp3A2vqxqgdgyTVNGShPDU= cache.flakehub.com-6:W4EGFwAGgBj3he7c5fNh9NkOXw0PUVaxygCVKeuvaqU= cache.flakehub.com-7:mvxJ2DZVHn/kRxlIaxYNMuDG1OvMckZu32um1TadOR8= cache.flakehub.com-8:moO+OVS0mnTjBTcOUh2kYLQEd59ExzyoW1QgQ8XAARQ= cache.flakehub.com-9:wChaSeTI6TeCuV/Sg2513ZIM9i0qJaYsF+lZCXg0J6o= cache.flakehub.com-10:2GqeNlIp6AKp4EF2MVbE1kBOp9iBSyo0UPR9KoR0o1Y=
+bash-prompt-prefix = (nix:$name)\040
+max-jobs = auto
+extra-nix-path = nixpkgs=flake:nixpkgs
+upgrade-nix-store-path-url = https://install.determinate.systems/nix-upgrade/stable/universal

doc/known-files/6787fade1cf934f82db554e78e1fc788705c2c5257fddf9b59bdd963ca6fec63

@@ -0,0 +1,4 @@
+
+# Written by https://github.com/DeterminateSystems/nix-installer.
+# The contents below are based on options specified at installation time.
+

doc/known-files/6bb8d6b0dd16b44ee793a9b8382dac76c926e4c16ffb8ddd2bb4884d1ca3f811

@@ -0,0 +1,13 @@
+# Generated by https://github.com/DeterminateSystems/nix-installer.
+# See `/nix/nix-installer --version` for the version details.
+
+extra-experimental-features = nix-command flakes
+always-allow-substitutes = true
+extra-trusted-substituters = https://cache.flakehub.com
+extra-trusted-public-keys = cache.flakehub.com-3:hJuILl5sVK4iKm86JzgdXW12Y2Hwd5G07qKtHTOcDCM= cache.flakehub.com-4:Asi8qIv291s0aYLyH6IOnr5Kf6+OF14WVjkE6t3xMio= cache.flakehub.com-5:zB96CRlL7tiPtzA9/WKyPkp3A2vqxqgdgyTVNGShPDU= cache.flakehub.com-6:W4EGFwAGgBj3he7c5fNh9NkOXw0PUVaxygCVKeuvaqU= cache.flakehub.com-7:mvxJ2DZVHn/kRxlIaxYNMuDG1OvMckZu32um1TadOR8= cache.flakehub.com-8:moO+OVS0mnTjBTcOUh2kYLQEd59ExzyoW1QgQ8XAARQ= cache.flakehub.com-9:wChaSeTI6TeCuV/Sg2513ZIM9i0qJaYsF+lZCXg0J6o= cache.flakehub.com-10:2GqeNlIp6AKp4EF2MVbE1kBOp9iBSyo0UPR9KoR0o1Y=
+bash-prompt-prefix = (nix:$name)\040
+max-jobs = auto
+extra-nix-path = nixpkgs=flake:nixpkgs
+upgrade-nix-store-path-url = https://install.determinate.systems/nix-upgrade/stable/universal
+
+!include nix.custom.conf

doc/manual/default.nix

@@ -30,7 +30,7 @@ let
       declarations = map
         (decl:
           if lib.hasPrefix (toString prefix) (toString decl) then
-            gitHubDeclaration "LnL7" "nix-darwin" revision
+            gitHubDeclaration "nix-darwin" "nix-darwin" revision
               (lib.removePrefix "/"
                 (lib.removePrefix (toString prefix) (toString decl)))
           # TODO: handle this in a better way (may require upstream

eval-config.nix

@@ -37,7 +37,7 @@ assert enableNixpkgsReleaseCheck -> checkRelease lib || throw ''
 
       inputs = {
         nixpkgs.url = "github:NixOS/nixpkgs/NIXPKGS-BRANCH";
-        nix-darwin.url = "github:LnL7/nix-darwin/NIX-DARWIN-BRANCH";
+        nix-darwin.url = "github:nix-darwin/nix-darwin/NIX-DARWIN-BRANCH";
         nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
         # …
       };
@@ -46,7 +46,7 @@ assert enableNixpkgsReleaseCheck -> checkRelease lib || throw ''
 
       $ sudo nix-channel --list
       nixpkgs https://nixos.org/channels/NIXPKGS-BRANCH
-      darwin https://github.com/LnL7/nix-darwin/archive/NIX-DARWIN-BRANCH.tar.gz
+      darwin https://github.com/nix-darwin/nix-darwin/archive/NIX-DARWIN-BRANCH.tar.gz
       …
       $ nix-channel --list
       …
@@ -58,12 +58,12 @@ assert enableNixpkgsReleaseCheck -> checkRelease lib || throw ''
   You can then fix your channels like this:
 
       $ sudo nix-channel --add https://nixos.org/channels/NIXPKGS-BRANCH nixpkgs
-      $ sudo nix-channel --add https://github.com/LnL7/nix-darwin/archive/NIX-DARWIN-BRANCH.tar.gz darwin
+      $ sudo nix-channel --add https://github.com/nix-darwin/nix-darwin/archive/NIX-DARWIN-BRANCH.tar.gz darwin
       $ sudo nix-channel --update
 
   After that, activating your system again should work correctly. If it
   doesn’t, please open an issue at
-  <https://github.com/LnL7/nix-darwin/issues/new> and include as much
+  <https://github.com/nix-darwin/nix-darwin/issues/new> and include as much
   information as possible.
 '';
 
@@ -77,7 +77,7 @@ let
     };
   };
 
-  eval = lib.evalModules (builtins.removeAttrs args [ "lib" ] // {
+  eval = lib.evalModules (builtins.removeAttrs args [ "lib" "enableNixpkgsReleaseCheck" ] // {
     class = "darwin";
     modules = modules ++ [ argsModule ] ++ baseModules;
     specialArgs = { modulesPath = builtins.toString ./modules; } // specialArgs;

flake.lock

@@ -2,16 +2,16 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1736241350,
+        "lastModified": 1735954111,
-        "narHash": "sha256-CHd7yhaDigUuJyDeX0SADbTM9FXfiWaeNyY34FL1wQU=",
+        "narHash": "sha256-yPzRuUXx99iu9QMF9GKxxqqC7kpKdFlQi7PA9N85wxQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8c9fd3e564728e90829ee7dbac6edc972971cd0f",
+        "rev": "a4c40a8a970c147cea7e98e86b2ff2ffb184aedd",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
+        "ref": "nixpkgs-24.11-darwin",
         "repo": "nixpkgs",
         "type": "github"
       }

flake.nix

@@ -2,7 +2,7 @@
   description = "A collection of darwin modules";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-24.11-darwin";
   };
 
   outputs = { self, nixpkgs }: let

modules/examples/flake/flake.nix

@@ -2,8 +2,8 @@
   description = "Example nix-darwin system flake";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-24.11-darwin";
-    nix-darwin.url = "github:LnL7/nix-darwin/master";
+    nix-darwin.url = "github:nix-darwin/nix-darwin/nix-darwin-24.11";
     nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
   };
 

modules/homebrew.nix

@@ -137,7 +137,7 @@ let
     config = {
       brewBundleCmd = concatStringsSep " " (
         optional (!config.autoUpdate) "HOMEBREW_NO_AUTO_UPDATE=1"
-        ++ [ "brew bundle --file='${brewfileFile}' --no-lock" ]
+        ++ [ "brew bundle --file='${brewfileFile}'" ]
         ++ optional (!config.upgrade) "--no-upgrade"
         ++ optional (config.cleanup == "uninstall") "--cleanup"
         ++ optional (config.cleanup == "zap") "--cleanup --zap"

modules/networking/default.nix

@@ -118,7 +118,6 @@ in
       echo "configuring networking..." >&2
 
       ${optionalString (cfg.computerName != null) ''
-        # shellcheck disable=SC1112
         scutil --set ComputerName ${escapeShellArg cfg.computerName}
       ''}
       ${optionalString (cfg.hostName != null) ''

modules/nix/default.nix

@@ -49,13 +49,16 @@ let
 
       mkKeyValuePairs = attrs: concatStringsSep "\n" (mapAttrsToList mkKeyValue attrs);
 
+      isExtra = key: hasPrefix "extra-" key;
+
     in
     pkgs.writeTextFile {
       name = "nix.conf";
       text = ''
         # WARNING: this file is generated from the nix.* options in
         # your nix-darwin configuration. Do not edit it!
-        ${mkKeyValuePairs cfg.settings}
+        ${mkKeyValuePairs (filterAttrs (key: value: !(isExtra key)) cfg.settings)}
+        ${mkKeyValuePairs (filterAttrs (key: value: isExtra key) cfg.settings)}
         ${cfg.extraOptions}
       '';
       checkPhase =
@@ -134,6 +137,34 @@ let
         namedPaths ++ searchPaths;
   };
 
+  handleUnmanaged = managedConfig: mkMerge [
+    (mkIf cfg.enable managedConfig)
+    (mkIf (!cfg.enable) {
+      system.activationScripts.nix-daemon.text = ''
+        # Restore unmanaged Nix daemon if present
+        unmanagedNixProfile=/nix/var/nix/profiles/default
+        if [[
+          -e /run/current-system/Library/LaunchDaemons/org.nixos.nix-daemon.plist
+          && -e $unmanagedNixProfile/Library/LaunchDaemons/org.nixos.nix-daemon.plist
+        ]]; then
+          printf >&2 'restoring unmanaged Nix daemon...\n'
+          cp \
+            "$unmanagedNixProfile/Library/LaunchDaemons/org.nixos.nix-daemon.plist" \
+            /Library/LaunchDaemons
+          launchctl load -w /Library/LaunchDaemons/org.nixos.nix-daemon.plist
+        fi
+      '';
+    })
+  ];
+
+  managedDefault = name: default: {
+    default = if cfg.enable then default else throw ''
+      ${name}: accessed when `nix.enable` is off; this is a bug in
+      nix-darwin or a third‐party module
+    '';
+    defaultText = default;
+  };
+
 in
 
 {
@@ -144,7 +175,6 @@ in
     in
     [
       # Only ever in NixOS
-      (mkRemovedOptionModule [ "nix" "enable" ] "No `nix-darwin` equivalent to this NixOS option.")
       (mkRemovedOptionModule [ "nix" "daemonCPUSchedPolicy" ] (altOption "nix.daemonProcessType"))
       (mkRemovedOptionModule [ "nix" "daemonIOSchedClass" ] (altOption "nix.daemonProcessType"))
       (mkRemovedOptionModule [ "nix" "daemonIOSchedPriority" ] (altOption "nix.daemonIOLowPriority"))
@@ -165,9 +195,34 @@ in
 
     nix = {
 
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether to enable Nix.
+
+          Disabling this will stop nix-darwin from managing the
+          installed version of Nix, the nix-daemon launchd daemon, and
+          the settings in {file}`/etc/nix/nix.conf`.
+
+          This allows you to use nix-darwin without it taking over your
+          system installation of Nix. Some nix-darwin functionality
+          that relies on managing the Nix installation, like the
+          `nix.*` options to adjust Nix settings or configure a Linux
+          builder, will be unavailable. You will also have to upgrade
+          Nix yourself, as nix-darwin will no longer do so.
+
+          ::: {.warning}
+          If you have already removed your global system installation
+          of Nix, this will break nix-darwin and you will have to
+          reinstall Nix to fix it.
+          :::
+        '';
+      };
+
       package = mkOption {
         type = types.package;
-        default = pkgs.nix;
+        inherit (managedDefault "nix.package" pkgs.nix) default;
         defaultText = literalExpression "pkgs.nix";
         description = ''
           This option specifies the Nix package instance to use throughout the system.
@@ -177,7 +232,16 @@ in
       # Not in NixOS module
       useDaemon = mkOption {
         type = types.bool;
-        default = false;
+        # We assume that unmanaged Nix installations use the daemon by
+        # default, to match the logic in nix-darwin 25.05. This is
+        # weird, but it matches the default behaviour in practice
+        # (since `services.nix-daemon.enable` is on by default and sets
+        # `nix.useDaemon` to true), and since `nix.enable` didn’t
+        # previously exist, it’s not a backwards‐compatibility concern;
+        # we can consequently avoid bifurcating the user experience
+        # across the release branches.
+        default = !config.nix.enable;
+        defaultText = literalExpression "!config.nix.enable";
         description = ''
           If set, Nix will use the daemon to perform operations.
           Use this instead of services.nix-daemon.enable if you don't want the
@@ -187,7 +251,7 @@ in
 
       distributedBuilds = mkOption {
         type = types.bool;
-        default = false;
+        inherit (managedDefault "nix.distributedBuilds" false) default defaultText;
         description = ''
           Whether to distribute builds to the machines listed in
           {option}`nix.buildMachines`.
@@ -197,7 +261,7 @@ in
       # Not in NixOS module
       daemonProcessType = mkOption {
         type = types.enum [ "Background" "Standard" "Adaptive" "Interactive" ];
-        default = "Standard";
+        inherit (managedDefault "nix.daemonProcessType" "Standard") default defaultText;
         description = ''
           Nix daemon process resource limits class. These limits propagate to
           build processes. `Standard` is the default process type
@@ -212,7 +276,7 @@ in
       # Not in NixOS module
       daemonIOLowPriority = mkOption {
         type = types.bool;
-        default = false;
+        inherit (managedDefault "nix.daemonIOLowPriority" false) default defaultText;
         description = ''
           Whether the Nix daemon process should considered to be low priority when
           doing file system I/O.
@@ -340,7 +404,7 @@ in
             };
           };
         });
-        default = [ ];
+        inherit (managedDefault "nix.buildMachines" [ ]) default defaultText;
         description = ''
           This option lists the machines to be used if distributed builds are
           enabled (see {option}`nix.distributedBuilds`).
@@ -354,7 +418,7 @@ in
       envVars = mkOption {
         type = types.attrs;
         internal = true;
-        default = { };
+        inherit (managedDefault "nix.envVars" { }) default defaultText;
         description = "Environment variables used by Nix.";
       };
 
@@ -369,6 +433,7 @@ in
 
       nrBuildUsers = mkOption {
         type = types.int;
+        inherit (managedDefault "nix.nrBuildUsers" 0) default defaultText;
         description = ''
           Number of `nixbld` user accounts created to
           perform secure concurrent builds.  If you receive an error
@@ -396,11 +461,13 @@ in
       # Definition differs substantially from NixOS module
       nixPath = mkOption {
         type = nixPathType;
-        default = lib.optionals cfg.channel.enable [
+        inherit (managedDefault "nix.nixPath" (
-          # Include default path <darwin-config>.
+          lib.optionals cfg.channel.enable [
-          { darwin-config = "${config.environment.darwinConfig}"; }
+            # Include default path <darwin-config>.
-          "/nix/var/nix/profiles/per-user/root/channels"
+            { darwin-config = "${config.environment.darwinConfig}"; }
-        ];
+            "/nix/var/nix/profiles/per-user/root/channels"
+          ]
+        )) default;
 
         defaultText = lib.literalExpression ''
           lib.optionals cfg.channel.enable [
@@ -422,7 +489,7 @@ in
 
       checkConfig = mkOption {
         type = types.bool;
-        default = true;
+        inherit (managedDefault "nix.checkConfig" true) default defaultText;
         description = ''
           If enabled (the default), checks for data type mismatches and that Nix
           can parse the generated nix.conf.
@@ -483,7 +550,7 @@ in
             };
           }
         ));
-        default = { };
+        inherit (managedDefault "nix.registry" { }) default defaultText;
         description = ''
           A system-wide flake registry.
         '';
@@ -491,7 +558,7 @@ in
 
       extraOptions = mkOption {
         type = types.lines;
-        default = "";
+        inherit (managedDefault "nix.extraOptions" "") default defaultText;
         example = ''
           keep-outputs = true
           keep-derivations = true
@@ -660,7 +727,7 @@ in
             };
           };
         };
-        default = { };
+        inherit (managedDefault "nix.settings" { }) default defaultText;
         description = ''
           Configuration for Nix, see
           <https://nixos.org/manual/nix/stable/#sec-conf-file>
@@ -678,7 +745,7 @@ in
 
   ###### implementation
 
-  config = {
+  config = handleUnmanaged {
     environment.systemPackages =
       [
         nixPackage
@@ -702,6 +769,8 @@ in
       "5d23e6d7015756c6f300f8cd558ec4d9234ca61deefd4f2478e91a49760b0747"  # DeterminateSystems Nix installer 0.16.0
       "e4974acb79c56148cb8e92137fa4f2de9b7356e897b332fc4e6769e8c0b83e18"  # DeterminateSystems Nix installer 0.20.0
       "966d22ef5bb9b56d481e8e0d5f7ca2deaf4d24c0f0fc969b2eeaa7ae0aa42907"  # DeterminateSystems Nix installer 0.22.0
+      "53712b4335030e2dbfb46bb235f8cffcac83fea404bd32dc99417ac89e2dd7c5"  # DeterminateSystems Nix installer 0.33.0
+      "6bb8d6b0dd16b44ee793a9b8382dac76c926e4c16ffb8ddd2bb4884d1ca3f811"  # DeterminateSystems Nix installer 0.34.0
       "24797ac05542ff8b52910efc77870faa5f9e3275097227ea4e50c430a5f72916"  # lix-installer 0.17.1 with flakes
       "b027b5cad320b5b8123d9d0db9f815c3f3921596c26dc3c471457098e4d3cc40"  # lix-installer 0.17.1 without flakes
     ];
@@ -757,7 +826,7 @@ in
 
         # Not in NixOS module
         { assertion = elem "nixbld" config.users.knownGroups -> elem "nixbld" createdGroups; message = "refusing to delete group nixbld in users.knownGroups, this would break nix"; }
-        { assertion = elem "_nixbld1" config.users.knownGroups -> elem "_nixbld1" createdUsers; message = "refusing to delete user _nixbld1 in users.knownUsers, this would break nix"; }
+        { assertion = elem "_nixbld1" config.users.knownUsers -> elem "_nixbld1" createdUsers; message = "refusing to delete user _nixbld1 in users.knownUsers, this would break nix"; }
         { assertion = config.users.groups ? "nixbld" -> config.users.groups.nixbld.members != []; message = "refusing to remove all members from nixbld group, this would break nix"; }
 
         {
@@ -822,8 +891,56 @@ in
       ]);
     users.knownGroups = mkIf cfg.configureBuildUsers [ "nixbld" ];
 
+    # The Determinate Systems installer puts user‐specified settings in
+    # `/etc/nix/nix.custom.conf` since v0.33.0. Supplement the
+    # `/etc/nix/nix.conf` hash check so that we don’t accidentally
+    # clobber user configuration.
+    #
+    # TODO: Maybe this could use a more general file placement mechanism
+    # to express that we want it deleted and know only one hash?
+    system.activationScripts.etcChecks.text = mkAfter ''
+      nixCustomConfKnownSha256Hashes=(
+        # v0.33.0
+        6787fade1cf934f82db554e78e1fc788705c2c5257fddf9b59bdd963ca6fec63
+        # v0.34.0
+        3bd68ef979a42070a44f8d82c205cfd8e8cca425d91253ec2c10a88179bb34aa
+      )
+      if [[ -e /etc/nix/nix.custom.conf ]]; then
+        nixCustomConfSha256Output=$(shasum -a 256 /etc/nix/nix.custom.conf)
+        nixCustomConfSha256Hash=''${nixCustomConfSha256Output%% *}
+        nixCustomConfIsKnown=
+        for nixCustomConfKnownSha256Hash
+          in "''${nixCustomConfKnownSha256Hashes[@]}"
+        do
+          if
+            [[ $nixCustomConfSha256Hash == "$nixCustomConfKnownSha256Hash" ]]
+          then
+            nixCustomConfIsKnown=1
+            break
+          fi
+        done
+        if [[ ! $nixCustomConfIsKnown ]]; then
+          printf >&2 '\e[1;31merror: custom settings in `/etc/nix/nix.custom.conf`, aborting activation\e[0m\n'
+          printf >&2 'You will need to migrate these to nix-darwin `nix.*` settings if you\n'
+          printf >&2 'wish to keep them. Check the manual for the appropriate settings and\n'
+          printf >&2 'add them to your system configuration, then run:\n'
+          printf >&2 '\n'
+          printf >&2 '  $ sudo mv /etc/nix/nix.custom.conf{,.before-nix-darwin}\n'
+          printf >&2 '\n'
+          printf >&2 'and activate your system again.\n'
+          exit 2
+        fi
+      fi
+    '';
+
     # Unrelated to use in NixOS module
-    system.activationScripts.nix-daemon.text = mkIf cfg.useDaemon ''
+    system.activationScripts.nix-daemon.text = ''
+      # Follow up on the `/etc/nix/nix.custom.conf` check.
+      # TODO: Use a more generalized file placement mechanism for this.
+      if [[ -e /etc/nix/nix.custom.conf ]]; then
+        mv /etc/nix/nix.custom.conf{,.before-nix-darwin}
+      fi
+    '' + optionalString cfg.useDaemon ''
       if ! diff /etc/nix/nix.conf /run/current-system/etc/nix/nix.conf &> /dev/null || ! diff /etc/nix/machines /run/current-system/etc/nix/machines &> /dev/null; then
           echo "reloading nix-daemon..." >&2
           launchctl kill HUP system/org.nixos.nix-daemon

modules/nix/linux-builder.nix

@@ -160,6 +160,13 @@ in
   };
 
   config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.nix.enable;
+        message = ''`nix.linux-builder.enable` requires `nix.enable`'';
+      }
+    ];
+
     system.activationScripts.preActivation.text = ''
       mkdir -p ${cfg.workingDirectory}
     '';

modules/nix/nix-darwin.nix

@@ -4,7 +4,7 @@ let
   nix-tools = pkgs.callPackage ../../pkgs/nix-tools {
     inherit (config.system) profile;
     inherit (config.environment) systemPath;
-    nixPackage = config.nix.package;
+    nixPackage = if config.nix.enable then config.nix.package else null;
   };
 
   darwin-uninstaller = pkgs.callPackage ../../pkgs/darwin-uninstaller { };

modules/nix/nixpkgs-flake.nix

@@ -37,8 +37,8 @@ in
     setNixPath = mkOption {
       type = types.bool;
 
-      default = cfg.source != null;
+      default = config.nix.enable && cfg.source != null;
-      defaultText = "config.nixpkgs.flake.source != null";
+      defaultText = literalExpression ''config.nix.enable && nixpkgs.flake.source != null'';
 
       description = ''
         Whether to set {env}`NIX_PATH` to include `nixpkgs=flake:nixpkgs` such that `<nixpkgs>`
@@ -57,8 +57,8 @@ in
     setFlakeRegistry = mkOption {
       type = types.bool;
 
-      default = cfg.source != null;
+      default = config.nix.enable && cfg.source != null;
-      defaultText = "config.nixpkgs.flake.source != null";
+      defaultText = literalExpression ''config.nix.enable && config.nixpkgs.flake.source != null'';
 
       description = ''
         Whether to pin nixpkgs in the system-wide flake registry (`/etc/nix/registry.json`) to the
@@ -85,6 +85,18 @@ in
             be set, since it is implemented in terms of indirection through the flake registry.
           '';
         }
+
+        # TODO: Upstream these to NixOS.
+
+        {
+          assertion = cfg.setNixPath -> config.nix.enable;
+          message = ''`nixpkgs.flake.setNixPath` requires `nix.enable`'';
+        }
+
+        {
+          assertion = cfg.setFlakeRegistry -> config.nix.enable;
+          message = ''`nixpkgs.flake.setFlakeRegistry` requires `nix.enable`'';
+        }
       ];
     }
     (mkIf cfg.setFlakeRegistry {

modules/services/activate-system/default.nix

@@ -21,7 +21,9 @@
         ln -sfn $(cat ${config.system.profile}/systemConfig) /run/current-system
 
         # Prevent the current configuration from being garbage-collected.
-        ln -sfn /run/current-system /nix/var/nix/gcroots/current-system
+        if [[ -d /nix/var/nix/gcroots ]]; then
+          ln -sfn /run/current-system /nix/var/nix/gcroots/current-system
+        fi
 
         ${config.system.activationScripts.etcChecks.text}
         ${config.system.activationScripts.etc.text}

modules/services/cachix-agent.nix

@@ -51,6 +51,14 @@ in {
   };
 
   config = mkIf cfg.enable {
+    # TODO: Upstream this to NixOS.
+    assertions = [
+      {
+        assertion = config.nix.enable;
+        message = ''`services.cachix-agent.enable` requires `nix.enable`'';
+      }
+    ];
+
     launchd.daemons.cachix-agent = {
       script = ''
         . ${cfg.credentialsFile}

modules/services/github-runner/service.nix

@@ -13,6 +13,11 @@ in
 {
   config.assertions = flatten (
     flip mapAttrsToList config.services.github-runners (name: cfg: map (mkIf cfg.enable) [
+      # TODO: Upstream this to NixOS.
+      {
+        assertion = config.nix.enable;
+        message = ''`services.github-runners.${name}.enable` requires `nix.enable`'';
+      }
       {
         assertion = (cfg.user == null && cfg.group == null) || (cfg.user != null);
         message = "`services.github-runners.${name}`: Either set `user` and `group` to `null` to have nix-darwin manage them or set at least `user` explicitly";

modules/services/hercules-ci-agent/default.nix

@@ -22,6 +22,14 @@ in
   };
 
   config = mkIf cfg.enable {
+    # TODO: Upstream this to NixOS.
+    assertions = [
+      {
+        assertion = config.nix.enable;
+        message = ''`services.hercules-ci-agent.enable` requires `nix.enable`'';
+      }
+    ];
+
     launchd.daemons.hercules-ci-agent = {
       script = "exec ${cfg.package}/bin/hercules-ci-agent --config ${cfg.tomlFile}";
 

modules/services/lorri.nix

@@ -29,6 +29,14 @@ in
   };
 
   config = mkIf cfg.enable {
+    # TODO: Upstream this to NixOS.
+    assertions = [
+      {
+        assertion = config.nix.enable;
+        message = ''`services.lorri.enable` requires `nix.enable`'';
+      }
+    ];
+
     environment.systemPackages = [ pkgs.lorri ];
     launchd.user.agents.lorri = {
       command = with pkgs; "${lorri}/bin/lorri daemon";
@@ -43,4 +51,4 @@ in
       };
     };
   };
-}
+}

modules/services/nix-daemon.nix

@@ -10,7 +10,7 @@ in
   options = {
     services.nix-daemon.enable = mkOption {
       type = types.bool;
-      default = true;
+      default = config.nix.enable;
       description = "Whether to enable the nix-daemon service.";
     };
 

modules/services/nix-gc/default.nix

@@ -62,15 +62,20 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.automatic {
+  config = {
+    assertions = [
+      {
+        assertion = cfg.automatic -> config.nix.enable;
+        message = ''nix.gc.automatic requires nix.enable'';
+      }
+    ];
 
-    launchd.daemons.nix-gc = {
+    launchd.daemons.nix-gc = mkIf cfg.automatic {
       command = "${config.nix.package}/bin/nix-collect-garbage ${cfg.options}";
       environment.NIX_REMOTE = optionalString config.nix.useDaemon "daemon";
       serviceConfig.RunAtLoad = false;
       serviceConfig.StartCalendarInterval = cfg.interval;
       serviceConfig.UserName = cfg.user;
     };
-
   };
 }

modules/services/nix-optimise/default.nix

@@ -58,9 +58,15 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.automatic {
+  config = {
+    assertions = [
+      {
+        assertion = cfg.automatic -> config.nix.enable;
+        message = ''nix.optimise.automatic requires nix.enable'';
+      }
+    ];
 
-    launchd.daemons.nix-optimise = {
+    launchd.daemons.nix-optimise = mkIf cfg.automatic {
       environment.NIX_REMOTE = optionalString config.nix.useDaemon "daemon";
       command = "${lib.getExe' config.nix.package "nix-store"} --optimise";
       serviceConfig = {
@@ -69,6 +75,5 @@ in
         UserName = cfg.user;
       };
     };
-
   };
 }

modules/services/ofborg/default.nix

@@ -46,6 +46,13 @@ in
   };
 
   config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.nix.enable;
+        message = ''`services.ofborg.enable` requires `nix.enable`'';
+      }
+    ];
+
     warnings = mkIf (isDerivation cfg.configFile) [
       "services.ofborg.configFile is a derivation, credentials will be world readable"
     ];

modules/system/activation-scripts.nix

@@ -13,6 +13,32 @@ let
     mkTextDerivation = name: text: pkgs.writeScript "activate-${name}" text;
   };
 
+  activationPath =
+    lib.makeBinPath [
+      pkgs.gnugrep
+      pkgs.coreutils
+    ]
+    + lib.optionalString (!config.nix.enable) ''
+      $(
+        # If `nix.enable` is off, there might be an unmanaged Nix
+        # installation (say in `/nix/var/nix/profiles/default`) that
+        # activation scripts (such as Home Manager) want to find on the
+        # `$PATH`. Search for it directly to avoid polluting the
+        # activation script environment with everything on the
+        # `environment.systemPath`.
+        if nixEnvPath=$(
+          PATH="${config.environment.systemPath}" command -v nix-env
+        ); then
+          printf ':'
+          ${lib.getExe' pkgs.coreutils "dirname"} -- "$(
+            ${lib.getExe' pkgs.coreutils "readlink"} \
+              --canonicalize-missing \
+              -- "$nixEnvPath"
+          )"
+        fi
+      )''
+    + ":@out@/sw/bin:/usr/bin:/bin:/usr/sbin:/sbin";
+
 in
 
 {
@@ -40,7 +66,9 @@ in
       #! ${stdenv.shell}
       set -e
       set -o pipefail
-      export PATH="${pkgs.gnugrep}/bin:${pkgs.coreutils}/bin:@out@/sw/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+
+      PATH="${activationPath}"
+      export PATH
 
       systemConfig=@out@
 
@@ -81,7 +109,9 @@ in
       ln -sfn "$(readlink -f "$systemConfig")" /run/current-system
 
       # Prevent the current configuration from being garbage-collected.
-      ln -sfn /run/current-system /nix/var/nix/gcroots/current-system
+      if [[ -d /nix/var/nix/gcroots ]]; then
+        ln -sfn /run/current-system /nix/var/nix/gcroots/current-system
+      fi
 
       exit $_status
     '';
@@ -91,7 +121,9 @@ in
       #! ${stdenv.shell}
       set -e
       set -o pipefail
-      export PATH="${pkgs.gnugrep}/bin:${pkgs.coreutils}/bin:@out@/sw/bin:/usr/bin:/bin"
+
+      PATH="${activationPath}"
+      export PATH
 
       systemConfig=@out@
 

modules/system/checks.nix

@@ -31,6 +31,23 @@ let
     fi
   '';
 
+  determinate = ''
+    if [[ -e /usr/local/bin/determinate-nixd ]]; then
+      printf >&2 '\e[1;31merror: Determinate detected, aborting activation\e[0m\n'
+      printf >&2 'Determinate uses its own daemon to manage the Nix installation that\n'
+      printf >&2 'conflicts with nix-darwin’s native Nix management.\n'
+      printf >&2 '\n'
+      printf >&2 'To turn off nix-darwin’s management of the Nix installation, set:\n'
+      printf >&2 '\n'
+      printf >&2 '    nix.enable = false;\n'
+      printf >&2 '\n'
+      printf >&2 'This will allow you to use nix-darwin with Determinate. Some nix-darwin\n'
+      printf >&2 'functionality that relies on managing the Nix installation, like the\n'
+      printf >&2 '`nix.*` options to adjust Nix settings or configure a Linux builder,\n'
+      printf >&2 'will be unavailable.\n'
+      exit 2
+    fi
+  '';
 
   oldBuildUsers = ''
     if dscl . -list /Users | grep -q '^nixbld'; then
@@ -118,7 +135,6 @@ let
         printf >&2 'Possible causes include setting up a new Nix installation with an\n'
         printf >&2 'existing nix-darwin configuration, setting up a new nix-darwin\n'
         printf >&2 'installation with an existing Nix installation, or manually increasing\n'
-        # shellcheck disable=SC2016
         printf >&2 'your `system.stateVersion` setting.\n'
         printf >&2 '\n'
         printf >&2 'You can set the configured group ID to match the actual value:\n'
@@ -139,7 +155,6 @@ let
       printf >&2 '\n'
       printf >&2 '    services.nix-daemon.enable = false;\n'
       printf >&2 '\n'
-      # shellcheck disable=SC2016
       printf >&2 'and remove `nix.useDaemon` from your configuration if it is present.\n'
       printf >&2 '\n'
       exit 2
@@ -211,7 +226,7 @@ let
     if ! test -e "$darwinPath"; then
         echo "error: Changed <darwin> but target does not exist, aborting activation" >&2
         echo "Add the darwin repo as a channel or set nix.nixPath:" >&2
-        echo "$ sudo nix-channel --add https://github.com/LnL7/nix-darwin/archive/master.tar.gz darwin" >&2
+        echo "$ sudo nix-channel --add https://github.com/nix-darwin/nix-darwin/archive/master.tar.gz darwin" >&2
         echo "$ sudo nix-channel --update" >&2
         echo >&2
         echo "or set" >&2
@@ -279,7 +294,6 @@ let
     if [[ -d /etc/ssh/authorized_keys.d ]]; then
         printf >&2 '\e[1;31merror: /etc/ssh/authorized_keys.d exists, aborting activation\e[0m\n'
         printf >&2 'SECURITY NOTICE: The previous implementation of the\n'
-        # shellcheck disable=SC2016
         printf >&2 '`users.users.<name>.openssh.authorizedKeys.*` options would not delete\n'
         printf >&2 'authorized keys files when the setting for a given user was removed.\n'
         printf >&2 '\n'
@@ -302,7 +316,6 @@ let
         echo "Homebrew doesn't seem to be installed. Please install homebrew separately." >&2
         echo "You can install homebrew using the following command:" >&2
         echo >&2
-        # shellcheck disable=SC2016
         echo '    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"' >&2
         echo >&2
         exit 2
@@ -323,21 +336,22 @@ in
   options = {
     system.checks.verifyNixPath = mkOption {
       type = types.bool;
-      default = true;
+      default = config.nix.enable;
       description = "Whether to run the NIX_PATH validation checks.";
     };
 
     system.checks.verifyNixChannels = mkOption {
       type = types.bool;
-      default = config.nix.channel.enable;
+      default = config.nix.enable && config.nix.channel.enable;
       description = "Whether to run the nix-channels validation checks.";
     };
 
     system.checks.verifyBuildUsers = mkOption {
       type = types.bool;
       default =
-        (config.nix.useDaemon && !(config.nix.settings.auto-allocate-uids or false))
+        config.nix.enable &&
-        || config.nix.configureBuildUsers;
+        ((config.nix.useDaemon && !(config.nix.settings.auto-allocate-uids or false))
+          || config.nix.configureBuildUsers);
       description = "Whether to run the Nix build users validation checks.";
     };
 
@@ -353,11 +367,12 @@ in
     system.checks.text = mkMerge [
       darwinChanges
       runLink
+      (mkIf config.nix.enable determinate)
       (mkIf (cfg.verifyBuildUsers && !config.nix.configureBuildUsers) oldBuildUsers)
       (mkIf cfg.verifyBuildUsers buildUsers)
       (mkIf cfg.verifyBuildUsers preSequoiaBuildUsers)
       (mkIf config.nix.configureBuildUsers buildGroupID)
-      nixDaemon
+      (mkIf config.nix.enable nixDaemon)
       nixStore
       (mkIf (config.nix.gc.automatic && config.nix.gc.user == null) nixGarbageCollector)
       (mkIf (config.nix.optimise.automatic && config.nix.optimise.user == null) nixStoreOptimiser)

modules/system/default.nix

@@ -135,7 +135,10 @@ in
         chmod u+x $out/activate-user
         unset activationUserScript
 
-        shellcheck $out/activate $out/activate-user
+        # We exclude the warnings for `…` in single‐quote strings and
+        # non‐ASCII quotation marks as they are noisy and lead to a lot
+        # of false positives in our user‐facing output:
+        shellcheck --exclude=SC2016,SC1112 $out/activate $out/activate-user
 
         echo -n "$systemConfig" > $out/systemConfig
 

modules/system/defaults/WindowManager.nix

@@ -56,11 +56,36 @@ with lib;
         Hide items in Stage Manager.
       '';
     };
+
+    system.defaults.WindowManager.EnableTilingByEdgeDrag = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Enable dragging windows to screen edges to tile them. The default is true.
+      '';
+    };
+
+    system.defaults.WindowManager.EnableTopTilingByEdgeDrag = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Enable dragging windows to the menu bar to fill the screen. The default is true.
+      '';
+    };
+
+    system.defaults.WindowManager.EnableTilingOptionAccelerator = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Enable holding alt to tile windows. The default is true.
+      '';
+    };
+
     system.defaults.WindowManager.EnableTiledWindowMargins = mkOption {
       type = types.nullOr types.bool;
       default = null;
       description = ''
-        Enable Window Margins. The default is true.
+        Enable window margins when tiling windows. The default is true.
       '';
     };
 

modules/users/default.nix

@@ -149,7 +149,6 @@ in
         if ! sudo dscl . -change /Users/nobody NFSHomeDirectory "$homeDirectory" "$homeDirectory" &> /dev/null; then
           if [[ -n "$SSH_CONNECTION" ]]; then
             printf >&2 '\e[1;31merror: users cannot be %s over SSH without Full Disk Access, aborting activation\e[0m\n' "$2"
-            # shellcheck disable=SC2016
             printf >&2 'The user %s could not be %s as `darwin-rebuild` was not executed with Full Disk Access over SSH.\n' "$1" "$2"
             printf >&2 'You can either:\n'
             printf >&2 '\n'
@@ -157,7 +156,6 @@ in
             printf >&2 '\n'
             printf >&2 'or\n'
             printf >&2 '\n'
-            # shellcheck disable=SC2016
             printf >&2 '  run `darwin-rebuild` in a graphical session.\n'
             printf >&2 '\n'
             printf >&2 'The option "Allow full disk access for remote users" can be found by\n'
@@ -171,11 +169,9 @@ in
 
             if ! sudo dscl . -change /Users/nobody NFSHomeDirectory "$homeDirectory" "$homeDirectory" &> /dev/null; then
               printf >&2 '\e[1;31merror: permission denied when trying to %s user %s, aborting activation\e[0m\n' "$2" "$1"
-              # shellcheck disable=SC2016
               printf >&2 '`darwin-rebuild` requires permissions to administrate your computer,\n'
               printf >&2 'please accept the dialog that pops up.\n'
               printf >&2 '\n'
-              # shellcheck disable=SC2016
               printf >&2 'If you do not wish to be prompted every time `darwin-rebuild updates your users,\n'
               printf >&2 'you can grant Full Disk Access to your terminal emulator in System Settings.\n'
               printf >&2 '\n'
@@ -224,7 +220,6 @@ in
           if [ "$u" -gt 501 ]; then
             # TODO: add `darwin.primaryUser` as well
             if [[ ${name} == "$USER" ]]; then
-              # shellcheck disable=SC2016
               printf >&2 '\e[1;31merror: refusing to delete the user calling `darwin-rebuild` (%s), aborting activation\e[0m\n', ${name}
               exit 1
             fi

pkgs/darwin-uninstaller/configuration.nix

@@ -12,8 +12,8 @@ with lib;
   launchd.daemons = mkForce {};
   launchd.user.agents = mkForce {};
 
-  # Don't try to reload `nix-daemon`
+  # Restore any unmanaged `nix-daemon`.
-  nix.useDaemon = mkForce false;
+  nix.enable = false;
 
   system.activationScripts.postUserActivation.text = mkAfter ''
     if [[ -L ~/.nix-defexpr/channels/darwin ]]; then
@@ -30,14 +30,6 @@ with lib;
         rm /etc/static
     fi
 
-    # If the Nix Store is owned by root then we're on a multi-user system
-    if [[ -O /nix/store ]]; then
-        if [[ -e /nix/var/nix/profiles/default/Library/LaunchDaemons/org.nixos.nix-daemon.plist ]]; then
-            sudo cp /nix/var/nix/profiles/default/Library/LaunchDaemons/org.nixos.nix-daemon.plist /Library/LaunchDaemons/org.nixos.nix-daemon.plist
-            sudo launchctl load -w /Library/LaunchDaemons/org.nixos.nix-daemon.plist
-        fi
-    fi
-
     # grep will return 1 when no lines matched which makes this line fail with `set -eo pipefail`
     dscl . -list /Users UserShell | { grep "\s/run/" || true; } | awk '{print $1}' | while read -r user; do
       shell=$(dscl . -read /Users/"$user" UserShell)

pkgs/darwin-uninstaller/default.nix

@@ -31,8 +31,11 @@ in writeShellApplication {
     echo >&2 "    - remove /Applications/Nix Apps symlink"
     echo >&2 "    - cleanup static /etc files"
     echo >&2 "    - disable and remove all launchd services managed by nix-darwin"
-    if [[ $(stat -f '%Su' /nix/store) == "root" ]]; then
+    if [[
-      echo >&2 "    - restore nix-daemon service from nix installer as this is a multi-user install"
+      -e /run/current-system/Library/LaunchDaemons/org.nixos.nix-daemon.plist
+      && -e /nix/var/nix/profiles/default/Library/LaunchDaemons/org.nixos.nix-daemon.plist
+    ]]; then
+      echo >&2 "    - restore nix-daemon service from the Nix installer"
     fi
     echo >&2
 
@@ -88,7 +91,7 @@ in writeShellApplication {
         launchctl print system/org.nixos.nix-daemon
         pgrep -l nix-daemon
         test -e /Library/LaunchDaemons/org.nixos.nix-daemon.plist
-        [[ "$(shasum -a 256 /Library/LaunchDaemons/org.nixos.nix-daemon.plist | awk '{print $1}')" == "$(shasum -a 256 /Library/LaunchDaemons/org.nixos.nix-daemon.plist | awk '{print $1}')" ]]
+        [[ "$(shasum -a 256 /Library/LaunchDaemons/org.nixos.nix-daemon.plist | awk '{print $1}')" == "$(shasum -a 256 /nix/var/nix/profiles/default/Library/LaunchDaemons/org.nixos.nix-daemon.plist | awk '{print $1}')" ]]
         nix-store --store daemon -q --hash ${stdenv.shell}
       fi
       echo >&2 ok

release.nix

@@ -88,6 +88,7 @@ in {
   tests.launchd-setenv = makeTest ./tests/launchd-setenv.nix;
   tests.networking-hostname = makeTest ./tests/networking-hostname.nix;
   tests.networking-networkservices = makeTest ./tests/networking-networkservices.nix;
+  tests.nix-enable = makeTest ./tests/nix-enable.nix;
   tests.nixpkgs-overlays = makeTest ./tests/nixpkgs-overlays.nix;
   tests.programs-ssh = makeTest ./tests/programs-ssh.nix;
   tests.programs-tmux = makeTest ./tests/programs-tmux.nix;

tests/fixtures/system-defaults-write/activate-user.txt

@@ -524,6 +524,21 @@ defaults write com.apple.WindowManager 'EnableTiledWindowMargins' $'<?xml versio
 <plist version="1.0">
 <true/>
 </plist>'
+defaults write com.apple.WindowManager 'EnableTilingByEdgeDrag' $'<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<true/>
+</plist>'
+defaults write com.apple.WindowManager 'EnableTilingOptionAccelerator' $'<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<true/>
+</plist>'
+defaults write com.apple.WindowManager 'EnableTopTilingByEdgeDrag' $'<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<true/>
+</plist>'
 defaults write com.apple.WindowManager 'GloballyEnabled' $'<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">

tests/nix-enable.nix

@@ -0,0 +1,16 @@
+{ config, ... }:
+
+{
+  nix.enable = false;
+
+  test = ''
+    printf >&2 'checking for unexpected Nix binary in /sw/bin\n'
+    [[ -e ${config.out}/sw/bin/nix-env ]] && exit 1
+
+    printf >&2 'checking for unexpected nix-daemon plist in /Library/LaunchDaemons\n'
+    [[ -e ${config.out}/Library/LaunchDaemons/org.nixos.nix-daemon.plist ]] && exit 1
+
+    printf >&2 'checking for late‐bound Nix lookup in /activate\n'
+    grep nixEnvPath= ${config.out}/activate
+  '';
+}

tests/system-defaults-write.nix

@@ -96,6 +96,9 @@
   system.defaults.WindowManager.AppWindowGroupingBehavior = true;
   system.defaults.WindowManager.StandardHideDesktopIcons = false;
   system.defaults.WindowManager.HideDesktop = false;
+  system.defaults.WindowManager.EnableTilingByEdgeDrag = true;
+  system.defaults.WindowManager.EnableTopTilingByEdgeDrag = true;
+  system.defaults.WindowManager.EnableTilingOptionAccelerator = true;
   system.defaults.WindowManager.EnableTiledWindowMargins = true;
   system.defaults.WindowManager.StandardHideWidgets = true;
   system.defaults.WindowManager.StageManagerHideWidgets = true;

version.json

@@ -1,4 +1,4 @@
 {
-  "release": "25.05",
+  "release": "24.11",
-  "isReleaseBranch": false
+  "isReleaseBranch": true
 }