8 ms·

Going immutable on macOS, using Nix-Darwin

140 points by weird_trousers 9mo ago

turtleyacht 9mo ago
It would be nice to set up immutable config down to the granularity of a git commit, sharing it as a single file, and be able to reproduce that setup on anyone's machine. Instant onboarding and mirrored production (barring secrets).
- Etheryte 9mo ago
  For me, this is the holy grail. Every time I switch laptops, I lift all my config files and such over, but there's always so many system level configs and other things that you have to go and manually fiddle. On top of that, some apps don't really behave well when you just move config files to e.g. under a different username etc. Would be nice if there was a comprehensive solution to this problem, need to try nix-darwin out.
  - Cu3PO42 9mo ago
    nix-darwin is essentially this. I have a small bootstrap script to install Xcode CLI and Nix, git clone my dotfiles and activate the config. That in turn sets up the system, also installs Homebrew, installs apps from the App store and sets up all my configs. The only thing I need to do after is sign into some accounts.
- FireInsight 9mo ago
  With the caveat of it not being a portable single file, I find custom image-based Linuxes fill this gap perfectly. There's of course Fedora Silverblue / Fedora Bootc with https://universal-blue.org/ https://universal-blue.org/ and https://blue-build.org/ https://blue-build.org/ being good examples. Recent developments have seen the creation of bootc images for non-Fedora distros too, and at this point I've seen quite a few cool arch-bootc custom images, completely customized to the author's desires. See: https://github.com/bootcrew/ https://github.com/bootcrew/, https://github.com/tartaria-dev/tartaria https://github.com/tartaria-dev/tartaria
  - plagiarist 9mo ago
    I thought bootc had an open issue preventing it from working with Arch (or anything other than Fedora). Having working VMs is way further along than I expected anyone to be, this is really cool.
- retatop 9mo ago
  I haven't used Nix yet, but I have done exactly this a number of times with Guix now. I assume Nix has the same capabilities. In Guix you can specify a home configuration that includes packages, configuration files, and running services all in one manifest.scm file. If you want to make sure that it's isolated from whatever else is set up on the system you can launch that manifest in a container with a single extra flag
- undeveloper 9mo ago
  this is basically the purpose of nix flakes, which take in inputs (usually git repositories) and provide outputs (compiled files, docker images, etc). it's a pain to get going, but not tremendously difficult with some googling. It's a lot easier with AI as well.
- Jhsto 9mo ago
  Speaking from the viewpoint of a whole operating system images, the main challenge is that while Nix allows you to create ephemeral environments, many people (myself included) have various hard-coded paths for mounting hard drives. If you want something to be shareable, you have to create a workflow in which the user environment is activated interactively after a tty session is acquired. Same goes for any system services that need persistence -- these have to be configured to be activated at runtime. It's a lot of work for a party-trick. It's probably possible to configure the system such that the log-in needs a FIDO2 key which is also used for LUKS drives, which would be similar to how macOS handles log-ins. But abstracting this such the login works on every machine possible suddenly requires filesystems to be networked, and so on. That being said, we used NixOS images to boot several Windows PCs of my friends into RAM to play Halo 3 multiplayer split-screen. Most of my friends were mainly confused why they could play with any gamepad they had in their shelf. They also left the event with no permanent changes to their PCs.
CraigJPerry 9mo ago
only thing i'd add is mas for mac app store apps you want to ensure are installed but otherwise i run pretty much the same setup. When i install a fresh macos i have two commands to run - install nix using the determinate systems installer, then apply my nix config. It's not quite as streamlined as nixos but good enough. My biggest remaining pain point is dev envs - i've been leaning into adding a flake in each project, so for example i have a single project that's written in scala 2.13, when i cd into that project dir, the correct jvm version, sbt, intellij etc are installed, some useful env vars and shell aliases etc. - that's all great (i haven't felt the need to adopt denenv.sh or flox yet) but i do find myself wanting a devcontainer sandbox workflow more often these days (blame cli coding "agents"), i lean on vscode for that rather than nix so far. In python (where i spend a lot more time) uv loses a lot of value in nix and i don't like that.
exitb 9mo ago
How well does nix-darwin survive macOS updates?
- undeveloper 9mo ago
  Installed nix-darwin on 26.0, on a fresh M4 air. I have updated since updated macos to 26.2 through the normal method, no wacky nix stuff there. no issues. no clue on major version changes, but nix-darwin is essentially the nix config language parsed to then run the necessary set of scripts.
- n8henrie 9mo ago
  I installed on macos14? Maybe 13? And have had minimal trouble since. Comparable to the amount of breakage I regularly had with homebrew.
otikik 9mo ago
I see this: > The consequence is me, spending a few hours debugging my environment instead of writing code. But then I also see this: > I’ve spent a lot of time recently moving my entire workflow into a declarative system using nix. I can see how this can be beneficial for someone who switches systems very often, reinstalls their OS from scratch very often, or just derives a lot of pleasure/peace of mind knowing that their dev env is immutable. I change computers once every 6 years or so, maybe more. To me this looks like exchanging a couple (hypothetical) hours of debugging 6 years in the future by tens of (guaranteed) hours trying to climb up the nix learning cliff. I am happy that it works for the author though, and knowing that it's possible is good in case my particular development circumstances change.
- loveparade 9mo ago
  In the six years you are using your computer, do you ever expect to run into versioning issues and conflicts? Homebrew packages conflicting with local packages, something you compile give needs a different python/ruby/node/rust/whatever version that you have locally installed, you want to quickly try out a new package or upgrade without changing your system but have the option of rolling back safely, need to quickly install a database, want to try out a new shell and shell config but don't brick your system and have the option to roll back, etc. Nix gives you all of that and more for a one-time setup cost. Your argument is correct only if you expect to never change anything on your computer for the 6 years. But if I think about how often I have fought with homebrew or some kind of versioning/path/binary conflicts in the past then the investment in nix has paid off exponentially. It's also about peace of mind like you said. Before nix I sometimes felt anxiety installing or upgrading certain things on my computer. "Will this upgrade break stuff?" - and often it did and I'd have to spend the next few hours debugging. With nix I don't worry about any of that anymore.
  - trinix912 9mo ago
    That's mostly solved with env managers for python/ruby/node/..., takes at most a few minutes to fully set up and learn, and doesn't get constantly broken by macOS updates. Even for things like trying out a new shell you can temporarily move the dotfiles somewhere and restore them back and it still takes less time than converting everything to Nix.
fredrikaverpil 9mo ago
I’m using nix to set up both my dev laptop (macOS) but also my self-hosting/homelab (NixOS). It works really well, and nice to have one way to set stuff up. And they are both synced up with the stuff I want to be mirrored across systems.
zero0529 9mo ago
I did this for a while but MacOS updates broke Nix often enough that I usually would spent some time every week reinstalling it. I still use Nix for dev environments because it is great but Nix still breaks sometimes. I also really wanted to like the declarative homebrew configuration but it also often didn’t work as expected for some configurations and had a lot of leaky abstractions that straight up just broke sometimes. If I ever go back to managing my Mac with nix I would probably just do a home-manager setup and just install most of the applications imperatively. Given this was using an intel based machine around the time when the switch to arm came so a lot of breakage also stemmed from that. I still use nix to handle my homelab. My setup up on my Mac is as follows: - Orbstack - NixOS machine run in orbstack - My whole dev environment is run from this container and is very transportable - GUI apps are installed on my Mac using the App Store or homebrew etc. but I try to reduce the amount of installed applications - if I have to install something that I don’t want to install but have to, I try to do it in a UTM machine.
- qn9n 9mo ago
  I found the Brewfile and a little `setup.sh` to be more than sufficient for getting a new Mac setup.
- sandreas 9mo ago
  Try dra[1] and a simple shell script in your dotfiles that installs / updates everything in $HOME/bin along with extending the $PATH. Works great for most of my tools (exa, zoxide, bat, jq, etc). 1: https://github.com/devmatteini/dra https://github.com/devmatteini/dra
  - zero0529 9mo ago
    I’ll check it out thanks :)
marliechiller 9mo ago
Ive been using nix-darwin for over a year now after using nixos with flakes for a bit. I now have a singular repo with multiple machine configurations. Nixos for my home server, nix darwin on a macbook air and a nix darwin with a work config. This allows me to have common programs on all machines but also overlay some specialised packages and programs in certain environments. After climbing the initial mountain, its been very satisfying and things just work. My work laptop died recently and I was able to be fully up to speed in a fraction of the time it would have taken me otherwise.
undeveloper 9mo ago
Interesting, and good luck to OP. I feel a little clickbaited, cause I was hoping for a port of stateless infra (although it may be of little use on a (dev machine :p) [1] 1: https://grahamc.com/blog/erase-your-darlings/ https://grahamc.com/blog/erase-your-darlings/
KingMob 9mo ago
I tried nix-darwin for half a year, and ran into endless problems: poor docs, huge default disk usage, non-trivial to customize, etc. After 6 months, I eventually went back to a mix of Homebrew and mise, which does most of what I need for <1% of the hassle. I still believe something like nix is the future of building software, I'm just not sure it'll be nix itself.
pjmlp 9mo ago
I see these kind of posts like using Gentoo, cool that some people are having fun, not for me, using computers the mid-80's I have better yaks to shave.
- microtonal 9mo ago
  I am critical as with any technology (see my comment about Nix in another thread here), but Nix is profoundly not using computers the mid-80's way. It is more future technology, where a system is immutable, fully declaratively defined, has atomic updates/rollback, etc. It's the direction things are going, see e.g. macOS sealed system volumes, Fedora Silverblue, etc. It's just that it still has a very large number of sharp edges, not so great documentation, lack of static typing, etc. Nix may not be the tech that replaces everything, but at the very least it is and has been an important exploration vehicle for declarative configuration, immutable systems, etc.
  - pjmlp 9mo ago
    Immutable systems have zero to do with Nix, a common source of inspiration maybe, that is all.
dsfdsfdd 9mo ago
So I will be doing configuraions instead of work. Thanks but no thanks. This is just procrastination.
pedrozieg 9mo ago
A useful way to frame this isn’t “is it worth tens of hours to avoid a future reinstall” but “where do I want my entropy to live”. You’re going to invest time somewhere: either in a slowly-accumulating pile of invisible state (brew, manual configs, random installers) or in a config that you can diff, review and roll back. The former feels free until you hit some cursed PATH/SSL/toolchain issue at 11pm and realize you’ve been paying that tax all along, just in tiny, forgotten increments. I think where Nix shines isn’t “one laptop every 6 years” but when your environment needs to be shared or recreated: multiple machines, a team, or a project with nasty native deps. At that point, nix-darwin + dev shells becomes infrastructure, not a hobby. You don’t have to go all-in on “my whole Mac is Nix” either: keep GUI apps and casual tools imperative, and treat Nix as the source of truth for the stuff that actually blocks you from doing work. That hybrid model matches what the article hints at and tends to give you most of the upside without turning your personal laptop into a second job.
- jorvi 9mo ago
  One of the biggest annoyances I have with doing this with Nix vs another tool is that Nix doesn't natively communicate back state changes so that you can make them reproducible. If I make a git repo, place '~/.config/newsapp.conf' in there and then symlink it back to '~/.config/', if NewsApp introduces a new variable in its settings I am immediately aware because Git will complain about being dirty. However, Nix will happily just nuke that .conf and rebuild whatever is in your configuration, without letting you know about state. Which is ultimately bad for reproducibility. It's a huge blind spot in Nix.
  - karlshea 9mo ago
    I tried getting Nix working a couple of months ago and ditched it because changing some Tower settings updates the global gitconfig (as it should in this circumstance) and Nix would wipe them out. All of it seemed way too annoying compared to just having a dotfiles repo, and if it couldn’t handle the Tower/gitconfig issue I know for sure everything else I was going to run into wasn’t worth it.
    - 9mo ago
JulianWasTaken 9mo ago
I've tried nix-darwin a time or two in the past. Every few years when homebrew makes a "hostile" change and I get upset I consider trying it again (now most recently with changes to gatekeeper). I think I'll get to doing so in the next year or so. But I think just in fairness, the comparison here for flakes should be to Homebrew bundles. My packages are managed in a bundle: https://github.com/Julian/dotfiles/blob/main/Brewfile https://github.com/Julian/dotfiles/blob/main/Brewfile and then locked by a lockfile: https://github.com/Julian/dotfiles/blob/main/Brewfile.lock.json https://github.com/Julian/dotfiles/blob/main/Brewfile.lock.j... and installing is just `brew bundle install`. All native Homebrew functionality. In practice I have never had an issue with non-reproducible builds across my machines (partly because the tendency on macOS is to run the latest versions of things and stay up to date). (But again I do find nix-darwin interesting to try for other reasons.)
- teeray 9mo ago
  > the comparison here for flakes should be to Homebrew bundles. The bundler integration for nix-darwin actually just bakes tightly-controlled Brewfiles. It’s still worthwhile though, since part of the “tightly-controlled” means better cleanup when you remove things.
- chuckadams 9mo ago
  Very nice, I think I'll be moving my "must-have" homebrew packages to a Brewfile. FYI tho, Homebrew no longer supports Brewfile.lock.json (it was always just a log anyway, not a lockfile). https://github.com/Homebrew/homebrew-bundle/pull/1509 https://github.com/Homebrew/homebrew-bundle/pull/1509
  - JulianWasTaken 9mo ago
    Fun, thanks for letting me know, will remove it :) (I'll still stick with "I never really have run into a version issue for things I use Homebrew for, for places where it matters, I have whatever-programming-language-lockfile-for-the-project-I-am-developing" for cases where I need to be sure the setup is reproducible, which is why I've clearly never noticed this file was useless).
bryceneal 9mo ago
I do this too. It's not for everyone. At this point it's easily been positive ROI for me, but that's after about two years now of maintaining my configs through multiple machines and MacOS upgrades. I would recommend it only if this type of thing naturally interests you. I can't imagine powering through the initial learning curve if it felt like a frustrating chore. That said, if having (most of) your machine defined declaratively in a git repository sounds exciting/useful/comfy, then I would encourage you to give it a try. You can start small by just configuring a few programs or options and see how you like it. I wrote more about my experience here where I also link to my configs: https://bryce.is/writing/code/fully-nix-pilled https://bryce.is/writing/code/fully-nix-pilled
ncrmro 9mo ago
The real game changer after I went full nix OS on all my machines and using it on a a few Mac’s is indeed devshells which seemed so annoying to learn but really really are a game changer
kombine 9mo ago
What we should be talking about is how to get rid Apple ecosystem all together.
- Svoka 9mo ago
  You can just not use it at all, there are alternatives. Why do you want to get rid of something which you are not forced to use?
n8henrie 9mo ago
After a decade of homebrew, a few years ago I got tired of their very grumpy maintainers and switched to nix-darwin + home-manager. I've been overall fairly happy, and for tinkerers would recommend giving it a shot. Admittedly I bounced off my first try a year before that. A few of my favorite parts, which I see less represented in this thread so far: - I simultaneously jumped into nixos on several Linux machines (starting with a few Pis for experimentation), and maintaining all of my systems with a single flake and mostly shared code is a dream come true. - no more convoluted dotfile syncing, most of my scripts and aliases and bash config and binaries all sync together - cross-building linux from Darwin -- including integration tests in a vm -- works surprisingly well, this is mostly just nix but nix-darwin has helpers that make this easier - writing system services (launchd) on my Mac then converting them to a headless Linux machine (systemd) is generally very straightforward - prefixing my path with GNU coreutils works well and saves me from many e.g. `sed` quirks, I get expected behavior across OSes - this was always a sore spot in homebrew, either dealing with the `g` prefix on everything (eg `gsed`) or dealing with intermittent breakages when stuff depends on the BSD behavior - I was also able to put nix-darwin on my wife's MacBook and greatly simplify admin / maintenance tasks I do for her - finally, the nix crew is just thirsty for help and contributions, particularly the darwin crowd; I feel like my (minor, occasional) contributions are celebrated, differences of opinion are met with an open mind, it is in general a far departure from the relative hostility of homebrew - on the down side, I have spent far more of my limited time helping contribute to nixpkgs / nix-darwin / home-manager
cmckn 9mo ago
Are folks not using migration assistant when they get a new Mac? I’ve had the “same” macOS install for almost 20 years, across 6 or 7 machines, and it’s fine. I see the value of nix-darwin if you use multiple Macs and change them frequently, but that’s never been me.
- dangus 9mo ago
  Right, these commercial operating systems are designed with a different philosophy that arguably has its own merit. I’m enjoying a Fedora atomic distribution for the eliminating the Linux upgrading issues of the past. But macOS and Windows never really had that problem.
ronef 9mo ago
[Disclaimer: biased Flox/Nix person] There's a lot of reasons to use Nix instead of or WITH Homebrew depending on your exact needs. Where it’s paid off for me (and where I think it actually wins) is when the problem is recreating environments: multiple machines, teammates, CI, nasty native deps, CUDA stacks, etc. At that point you’re choosing where entropy lives: in invisible drift (brew/manual installs) or in a repo you can diff/rollback. Also, you don’t always need to go full “immutable everything.” Really depends on your needs here. Hybrid tends to be another sane path. In certain situations this can get you 80% of the upside without having to rip it all out. So kinda the "good enough" which I've seen a lot of folks do. We (Flox) actually worked on this with Kelsey Hightower a while back - https://bsky.app/profile/kelseyhightower.com/post/3ld2rsccls22u https://bsky.app/profile/kelseyhightower.com/post/3ld2rsccls...
sennalen 9mo ago
Looking in from outside, people going immutable with Nix sure seem to struggle a lot more than people going immutable with disposable containers and Terraform/OpenTofu
- Svoka 9mo ago
  How do you manage macOS desktop apps with those, I am confused. The article is about set up of a personal workspace.
perrygeo 9mo ago
Don't think of nix-darwin as an alternative to homebrew. Por que no los dos? You can run homebrew (declaratively!) via nix-darwin, and I think they complement each other quite well. I stick to nixpkgs for most of the foundational system tools, lsps, build tools - basically anything that works in the terminal and is fully open source. For everything else (zoom, slack, vscode, firefox, etc) I use homebrew packages. The combo gives you options and is a strict superset of what you can do with homebrew or nixpkgs alone. Best of both worlds really. The article I used to help set up, in case this helps anyone: https://davi.sh/blog/2024/01/nix-darwin/ https://davi.sh/blog/2024/01/nix-darwin/
zamalek 9mo ago
When I was forced to use a Mac at work I found that Nix was also just a better (mostly faster) package manager than brew. Even if you're not on the immutable bandwagon it's very worthwhile. As a bonus I was able to achieve some semblance of uniformity across Mac and my Linux desktop with home-manager.

140 points by weird_trousers 9mo ago

It would be nice to set up immutable config down to the granularity of a git commit, sharing it as a single file, and be able to reproduce that setup on anyone's machine. Instant onboarding and mirrored production (barring secrets).

Etheryte 9mo ago
For me, this is the holy grail. Every time I switch laptops, I lift all my config files and such over, but there's always so many system level configs and other things that you have to go and manually fiddle. On top of that, some apps don't really behave well when you just move config files to e.g. under a different username etc. Would be nice if there was a comprehensive solution to this problem, need to try nix-darwin out.
- Cu3PO42 9mo ago
  nix-darwin is essentially this. I have a small bootstrap script to install Xcode CLI and Nix, git clone my dotfiles and activate the config. That in turn sets up the system, also installs Homebrew, installs apps from the App store and sets up all my configs. The only thing I need to do after is sign into some accounts.
FireInsight 9mo ago
With the caveat of it not being a portable single file, I find custom image-based Linuxes fill this gap perfectly. There's of course Fedora Silverblue / Fedora Bootc with https://universal-blue.org/ https://universal-blue.org/ and https://blue-build.org/ https://blue-build.org/ being good examples. Recent developments have seen the creation of bootc images for non-Fedora distros too, and at this point I've seen quite a few cool arch-bootc custom images, completely customized to the author's desires. See: https://github.com/bootcrew/ https://github.com/bootcrew/, https://github.com/tartaria-dev/tartaria https://github.com/tartaria-dev/tartaria
- plagiarist 9mo ago
  I thought bootc had an open issue preventing it from working with Arch (or anything other than Fedora). Having working VMs is way further along than I expected anyone to be, this is really cool.
retatop 9mo ago
I haven't used Nix yet, but I have done exactly this a number of times with Guix now. I assume Nix has the same capabilities. In Guix you can specify a home configuration that includes packages, configuration files, and running services all in one manifest.scm file. If you want to make sure that it's isolated from whatever else is set up on the system you can launch that manifest in a container with a single extra flag
undeveloper 9mo ago
this is basically the purpose of nix flakes, which take in inputs (usually git repositories) and provide outputs (compiled files, docker images, etc). it's a pain to get going, but not tremendously difficult with some googling. It's a lot easier with AI as well.
Jhsto 9mo ago
Speaking from the viewpoint of a whole operating system images, the main challenge is that while Nix allows you to create ephemeral environments, many people (myself included) have various hard-coded paths for mounting hard drives. If you want something to be shareable, you have to create a workflow in which the user environment is activated interactively after a tty session is acquired. Same goes for any system services that need persistence -- these have to be configured to be activated at runtime. It's a lot of work for a party-trick. It's probably possible to configure the system such that the log-in needs a FIDO2 key which is also used for LUKS drives, which would be similar to how macOS handles log-ins. But abstracting this such the login works on every machine possible suddenly requires filesystems to be networked, and so on. That being said, we used NixOS images to boot several Windows PCs of my friends into RAM to play Halo 3 multiplayer split-screen. Most of my friends were mainly confused why they could play with any gamepad they had in their shelf. They also left the event with no permanent changes to their PCs.

CraigJPerry 9mo ago

only thing i'd add is mas for mac app store apps you want to ensure are installed but otherwise i run pretty much the same setup. When i install a fresh macos i have two commands to run - install nix using the determinate systems installer, then apply my nix config. It's not quite as streamlined as nixos but good enough. My biggest remaining pain point is dev envs - i've been leaning into adding a flake in each project, so for example i have a single project that's written in scala 2.13, when i cd into that project dir, the correct jvm version, sbt, intellij etc are installed, some useful env vars and shell aliases etc. - that's all great (i haven't felt the need to adopt denenv.sh or flox yet) but i do find myself wanting a devcontainer sandbox workflow more often these days (blame cli coding "agents"), i lean on vscode for that rather than nix so far. In python (where i spend a lot more time) uv loses a lot of value in nix and i don't like that.

exitb 9mo ago

How well does nix-darwin survive macOS updates?

undeveloper 9mo ago
Installed nix-darwin on 26.0, on a fresh M4 air. I have updated since updated macos to 26.2 through the normal method, no wacky nix stuff there. no issues. no clue on major version changes, but nix-darwin is essentially the nix config language parsed to then run the necessary set of scripts.
n8henrie 9mo ago
I installed on macos14? Maybe 13? And have had minimal trouble since. Comparable to the amount of breakage I regularly had with homebrew.

otikik 9mo ago

I see this: > The consequence is me, spending a few hours debugging my environment instead of writing code. But then I also see this: > I’ve spent a lot of time recently moving my entire workflow into a declarative system using nix. I can see how this can be beneficial for someone who switches systems very often, reinstalls their OS from scratch very often, or just derives a lot of pleasure/peace of mind knowing that their dev env is immutable. I change computers once every 6 years or so, maybe more. To me this looks like exchanging a couple (hypothetical) hours of debugging 6 years in the future by tens of (guaranteed) hours trying to climb up the nix learning cliff. I am happy that it works for the author though, and knowing that it's possible is good in case my particular development circumstances change.

loveparade 9mo ago
In the six years you are using your computer, do you ever expect to run into versioning issues and conflicts? Homebrew packages conflicting with local packages, something you compile give needs a different python/ruby/node/rust/whatever version that you have locally installed, you want to quickly try out a new package or upgrade without changing your system but have the option of rolling back safely, need to quickly install a database, want to try out a new shell and shell config but don't brick your system and have the option to roll back, etc. Nix gives you all of that and more for a one-time setup cost. Your argument is correct only if you expect to never change anything on your computer for the 6 years. But if I think about how often I have fought with homebrew or some kind of versioning/path/binary conflicts in the past then the investment in nix has paid off exponentially. It's also about peace of mind like you said. Before nix I sometimes felt anxiety installing or upgrading certain things on my computer. "Will this upgrade break stuff?" - and often it did and I'd have to spend the next few hours debugging. With nix I don't worry about any of that anymore.
- trinix912 9mo ago
  That's mostly solved with env managers for python/ruby/node/..., takes at most a few minutes to fully set up and learn, and doesn't get constantly broken by macOS updates. Even for things like trying out a new shell you can temporarily move the dotfiles somewhere and restore them back and it still takes less time than converting everything to Nix.

fredrikaverpil 9mo ago

I’m using nix to set up both my dev laptop (macOS) but also my self-hosting/homelab (NixOS). It works really well, and nice to have one way to set stuff up. And they are both synced up with the stuff I want to be mirrored across systems.

zero0529 9mo ago

I did this for a while but MacOS updates broke Nix often enough that I usually would spent some time every week reinstalling it. I still use Nix for dev environments because it is great but Nix still breaks sometimes. I also really wanted to like the declarative homebrew configuration but it also often didn’t work as expected for some configurations and had a lot of leaky abstractions that straight up just broke sometimes. If I ever go back to managing my Mac with nix I would probably just do a home-manager setup and just install most of the applications imperatively. Given this was using an intel based machine around the time when the switch to arm came so a lot of breakage also stemmed from that. I still use nix to handle my homelab. My setup up on my Mac is as follows: - Orbstack - NixOS machine run in orbstack - My whole dev environment is run from this container and is very transportable - GUI apps are installed on my Mac using the App Store or homebrew etc. but I try to reduce the amount of installed applications - if I have to install something that I don’t want to install but have to, I try to do it in a UTM machine.

qn9n 9mo ago
I found the Brewfile and a little `setup.sh` to be more than sufficient for getting a new Mac setup.
sandreas 9mo ago
Try dra[1] and a simple shell script in your dotfiles that installs / updates everything in $HOME/bin along with extending the $PATH. Works great for most of my tools (exa, zoxide, bat, jq, etc). 1: https://github.com/devmatteini/dra https://github.com/devmatteini/dra
- zero0529 9mo ago
  I’ll check it out thanks :)

marliechiller 9mo ago

Ive been using nix-darwin for over a year now after using nixos with flakes for a bit. I now have a singular repo with multiple machine configurations. Nixos for my home server, nix darwin on a macbook air and a nix darwin with a work config. This allows me to have common programs on all machines but also overlay some specialised packages and programs in certain environments. After climbing the initial mountain, its been very satisfying and things just work. My work laptop died recently and I was able to be fully up to speed in a fraction of the time it would have taken me otherwise.

undeveloper 9mo ago

Interesting, and good luck to OP. I feel a little clickbaited, cause I was hoping for a port of stateless infra (although it may be of little use on a (dev machine :p) [1] 1: https://grahamc.com/blog/erase-your-darlings/ https://grahamc.com/blog/erase-your-darlings/

KingMob 9mo ago

I tried nix-darwin for half a year, and ran into endless problems: poor docs, huge default disk usage, non-trivial to customize, etc. After 6 months, I eventually went back to a mix of Homebrew and mise, which does most of what I need for <1% of the hassle. I still believe something like nix is the future of building software, I'm just not sure it'll be nix itself.

pjmlp 9mo ago

I see these kind of posts like using Gentoo, cool that some people are having fun, not for me, using computers the mid-80's I have better yaks to shave.

microtonal 9mo ago
I am critical as with any technology (see my comment about Nix in another thread here), but Nix is profoundly not using computers the mid-80's way. It is more future technology, where a system is immutable, fully declaratively defined, has atomic updates/rollback, etc. It's the direction things are going, see e.g. macOS sealed system volumes, Fedora Silverblue, etc. It's just that it still has a very large number of sharp edges, not so great documentation, lack of static typing, etc. Nix may not be the tech that replaces everything, but at the very least it is and has been an important exploration vehicle for declarative configuration, immutable systems, etc.
- pjmlp 9mo ago
  Immutable systems have zero to do with Nix, a common source of inspiration maybe, that is all.

dsfdsfdd 9mo ago

So I will be doing configuraions instead of work. Thanks but no thanks. This is just procrastination.

pedrozieg 9mo ago

A useful way to frame this isn’t “is it worth tens of hours to avoid a future reinstall” but “where do I want my entropy to live”. You’re going to invest time somewhere: either in a slowly-accumulating pile of invisible state (brew, manual configs, random installers) or in a config that you can diff, review and roll back. The former feels free until you hit some cursed PATH/SSL/toolchain issue at 11pm and realize you’ve been paying that tax all along, just in tiny, forgotten increments. I think where Nix shines isn’t “one laptop every 6 years” but when your environment needs to be shared or recreated: multiple machines, a team, or a project with nasty native deps. At that point, nix-darwin + dev shells becomes infrastructure, not a hobby. You don’t have to go all-in on “my whole Mac is Nix” either: keep GUI apps and casual tools imperative, and treat Nix as the source of truth for the stuff that actually blocks you from doing work. That hybrid model matches what the article hints at and tends to give you most of the upside without turning your personal laptop into a second job.

jorvi 9mo ago
One of the biggest annoyances I have with doing this with Nix vs another tool is that Nix doesn't natively communicate back state changes so that you can make them reproducible. If I make a git repo, place '~/.config/newsapp.conf' in there and then symlink it back to '~/.config/', if NewsApp introduces a new variable in its settings I am immediately aware because Git will complain about being dirty. However, Nix will happily just nuke that .conf and rebuild whatever is in your configuration, without letting you know about state. Which is ultimately bad for reproducibility. It's a huge blind spot in Nix.
- karlshea 9mo ago
  I tried getting Nix working a couple of months ago and ditched it because changing some Tower settings updates the global gitconfig (as it should in this circumstance) and Nix would wipe them out. All of it seemed way too annoying compared to just having a dotfiles repo, and if it couldn’t handle the Tower/gitconfig issue I know for sure everything else I was going to run into wasn’t worth it.
  - 9mo ago

JulianWasTaken 9mo ago

I've tried nix-darwin a time or two in the past. Every few years when homebrew makes a "hostile" change and I get upset I consider trying it again (now most recently with changes to gatekeeper). I think I'll get to doing so in the next year or so. But I think just in fairness, the comparison here for flakes should be to Homebrew bundles. My packages are managed in a bundle: https://github.com/Julian/dotfiles/blob/main/Brewfile https://github.com/Julian/dotfiles/blob/main/Brewfile and then locked by a lockfile: https://github.com/Julian/dotfiles/blob/main/Brewfile.lock.json https://github.com/Julian/dotfiles/blob/main/Brewfile.lock.j... and installing is just `brew bundle install`. All native Homebrew functionality. In practice I have never had an issue with non-reproducible builds across my machines (partly because the tendency on macOS is to run the latest versions of things and stay up to date). (But again I do find nix-darwin interesting to try for other reasons.)

teeray 9mo ago
> the comparison here for flakes should be to Homebrew bundles. The bundler integration for nix-darwin actually just bakes tightly-controlled Brewfiles. It’s still worthwhile though, since part of the “tightly-controlled” means better cleanup when you remove things.
chuckadams 9mo ago
Very nice, I think I'll be moving my "must-have" homebrew packages to a Brewfile. FYI tho, Homebrew no longer supports Brewfile.lock.json (it was always just a log anyway, not a lockfile). https://github.com/Homebrew/homebrew-bundle/pull/1509 https://github.com/Homebrew/homebrew-bundle/pull/1509
- JulianWasTaken 9mo ago
  Fun, thanks for letting me know, will remove it :) (I'll still stick with "I never really have run into a version issue for things I use Homebrew for, for places where it matters, I have whatever-programming-language-lockfile-for-the-project-I-am-developing" for cases where I need to be sure the setup is reproducible, which is why I've clearly never noticed this file was useless).

bryceneal 9mo ago

I do this too. It's not for everyone. At this point it's easily been positive ROI for me, but that's after about two years now of maintaining my configs through multiple machines and MacOS upgrades. I would recommend it only if this type of thing naturally interests you. I can't imagine powering through the initial learning curve if it felt like a frustrating chore. That said, if having (most of) your machine defined declaratively in a git repository sounds exciting/useful/comfy, then I would encourage you to give it a try. You can start small by just configuring a few programs or options and see how you like it. I wrote more about my experience here where I also link to my configs: https://bryce.is/writing/code/fully-nix-pilled https://bryce.is/writing/code/fully-nix-pilled

ncrmro 9mo ago

The real game changer after I went full nix OS on all my machines and using it on a a few Mac’s is indeed devshells which seemed so annoying to learn but really really are a game changer

kombine 9mo ago

What we should be talking about is how to get rid Apple ecosystem all together.

Svoka 9mo ago
You can just not use it at all, there are alternatives. Why do you want to get rid of something which you are not forced to use?

n8henrie 9mo ago

After a decade of homebrew, a few years ago I got tired of their very grumpy maintainers and switched to nix-darwin + home-manager. I've been overall fairly happy, and for tinkerers would recommend giving it a shot. Admittedly I bounced off my first try a year before that. A few of my favorite parts, which I see less represented in this thread so far: - I simultaneously jumped into nixos on several Linux machines (starting with a few Pis for experimentation), and maintaining all of my systems with a single flake and mostly shared code is a dream come true. - no more convoluted dotfile syncing, most of my scripts and aliases and bash config and binaries all sync together - cross-building linux from Darwin -- including integration tests in a vm -- works surprisingly well, this is mostly just nix but nix-darwin has helpers that make this easier - writing system services (launchd) on my Mac then converting them to a headless Linux machine (systemd) is generally very straightforward - prefixing my path with GNU coreutils works well and saves me from many e.g. `sed` quirks, I get expected behavior across OSes - this was always a sore spot in homebrew, either dealing with the `g` prefix on everything (eg `gsed`) or dealing with intermittent breakages when stuff depends on the BSD behavior - I was also able to put nix-darwin on my wife's MacBook and greatly simplify admin / maintenance tasks I do for her - finally, the nix crew is just thirsty for help and contributions, particularly the darwin crowd; I feel like my (minor, occasional) contributions are celebrated, differences of opinion are met with an open mind, it is in general a far departure from the relative hostility of homebrew - on the down side, I have spent far more of my limited time helping contribute to nixpkgs / nix-darwin / home-manager

cmckn 9mo ago

Are folks not using migration assistant when they get a new Mac? I’ve had the “same” macOS install for almost 20 years, across 6 or 7 machines, and it’s fine. I see the value of nix-darwin if you use multiple Macs and change them frequently, but that’s never been me.

dangus 9mo ago
Right, these commercial operating systems are designed with a different philosophy that arguably has its own merit. I’m enjoying a Fedora atomic distribution for the eliminating the Linux upgrading issues of the past. But macOS and Windows never really had that problem.

ronef 9mo ago

[Disclaimer: biased Flox/Nix person] There's a lot of reasons to use Nix instead of or WITH Homebrew depending on your exact needs. Where it’s paid off for me (and where I think it actually wins) is when the problem is recreating environments: multiple machines, teammates, CI, nasty native deps, CUDA stacks, etc. At that point you’re choosing where entropy lives: in invisible drift (brew/manual installs) or in a repo you can diff/rollback. Also, you don’t always need to go full “immutable everything.” Really depends on your needs here. Hybrid tends to be another sane path. In certain situations this can get you 80% of the upside without having to rip it all out. So kinda the "good enough" which I've seen a lot of folks do. We (Flox) actually worked on this with Kelsey Hightower a while back - https://bsky.app/profile/kelseyhightower.com/post/3ld2rsccls22u https://bsky.app/profile/kelseyhightower.com/post/3ld2rsccls...

sennalen 9mo ago

Looking in from outside, people going immutable with Nix sure seem to struggle a lot more than people going immutable with disposable containers and Terraform/OpenTofu

Svoka 9mo ago
How do you manage macOS desktop apps with those, I am confused. The article is about set up of a personal workspace.

perrygeo 9mo ago

Don't think of nix-darwin as an alternative to homebrew. Por que no los dos? You can run homebrew (declaratively!) via nix-darwin, and I think they complement each other quite well. I stick to nixpkgs for most of the foundational system tools, lsps, build tools - basically anything that works in the terminal and is fully open source. For everything else (zoom, slack, vscode, firefox, etc) I use homebrew packages. The combo gives you options and is a strict superset of what you can do with homebrew or nixpkgs alone. Best of both worlds really. The article I used to help set up, in case this helps anyone: https://davi.sh/blog/2024/01/nix-darwin/ https://davi.sh/blog/2024/01/nix-darwin/

zamalek 9mo ago

When I was forced to use a Mac at work I found that Nix was also just a better (mostly faster) package manager than brew. Even if you're not on the immutable bandwagon it's very worthwhile. As a bonus I was able to achieve some semblance of uniformity across Mac and my Linux desktop with home-manager.