Skip to content

feat: 新規マシンでも nix-darwin セットアップが通るようにする #1004

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
keito4 merged 5 commits into from
Jul 23, 2026
Merged

feat: 新規マシンでも nix-darwin セットアップが通るようにする #1004

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
cdb2243
feat: 新規マシンでも nix-darwin セットアップが通るようにする
keito4 Jul 23, 2026
687eb12
fix: enforceKanaryCapsControl を linkGeneration の後に実行する
keito4 Jul 23, 2026
7efedf0
feat: ~/.local/bin を PATH に追加
keito4 Jul 23, 2026
7b88e04
feat: nix 設定の CI 検証と macOS 新規マシンセットアップガイドを追加
keito4 Jul 23, 2026
a577c60
chore: setup-claude 実行で同期された mattpocock-skills プラグイン設定を反映
keito4 Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 40 additions & 20 deletions nix/flake.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,29 +24,49 @@
}:
let
system = "aarch64-darwin";
username = "keito";
hostname = "keitonoMacBook-Pro";
configRoot = ../.;
in
{
darwinConfigurations.${hostname} = nix-darwin.lib.darwinSystem {
inherit system;
modules = [
./hosts/darwin

home-manager.darwinModules.home-manager
{
home-manager = {
useGlobalPkgs = true;
useUserPackages = true;
backupFileExtension = "before-home-manager";
extraSpecialArgs = {
inherit configRoot;
mkDarwin =
{
hostname,
username,
# Determinate Nix はデーモンを自前管理するため nix-darwin の Nix 管理と衝突する
determinateNix ? false,
}:
nix-darwin.lib.darwinSystem {
inherit system;
specialArgs = {
inherit username determinateNix;
};
modules = [
./hosts/darwin

home-manager.darwinModules.home-manager
{
home-manager = {
useGlobalPkgs = true;
useUserPackages = true;
backupFileExtension = "before-home-manager";
extraSpecialArgs = {
inherit configRoot username;
};
users.${username} = import ./home;
};
users.${username} = import ./home;
};
}
];
}
];
};
in
{
darwinConfigurations = {
"keitonoMacBook-Pro" = mkDarwin {
hostname = "keitonoMacBook-Pro";
username = "keito";
};
"oykotnoMacBook-Air" = mkDarwin {
hostname = "oykotnoMacBook-Air";
username = "oykot";
determinateNix = true;
Comment on lines +65 to +68

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Add an ADR for the new Darwin host model

This adds a second Darwin configuration with a Determinate Nix mode, which is a non-trivial architecture change to the macOS environment. I searched docs/adr and found no ADR covering the multi-host/Determinate decision, so future agents and reviewers will not have the context the repository requires before implementation; please add an ADR with the context, decision, and consequences.

Useful? React with 👍 / 👎.

};
};

# nix fmt
Expand Down
11 changes: 8 additions & 3 deletions nix/home/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
{ pkgs, lib, ... }:
{
pkgs,
lib,
username,
...
}:

{
imports = [
Expand All @@ -14,8 +19,8 @@

home = {
stateVersion = "24.11";
username = "keito";
homeDirectory = lib.mkForce "/Users/keito";
inherit username;
homeDirectory = lib.mkForce "/Users/${username}";
};

# Let home-manager manage itself
Expand Down
2 changes: 1 addition & 1 deletion nix/home/dotfiles.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ let
# 組織情報を含む設定は keito4/private-config（別リポジトリ・非公開）で管理し、
# ローカルチェックアウトを out-of-store symlink で参照する（編集は rebuild 不要で即反映）
privateConfig = path: {
source = config.lib.file.mkOutOfStoreSymlink "/Users/keito/develop/github.com/keito4/private-config/${path}";
source = config.lib.file.mkOutOfStoreSymlink "${config.home.homeDirectory}/develop/github.com/keito4/private-config/${path}";
force = true;
};
in
Expand Down
1 change: 1 addition & 0 deletions nix/home/packages.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
awscli2
aws-sam-cli
azure-cli
google-cloud-sdk
kubernetes-helm
sops
terraform
Expand Down
71 changes: 42 additions & 29 deletions nix/hosts/darwin/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
{ pkgs, ... }:
{
pkgs,
username,
determinateNix,
...
}:

{
imports = [
Expand All @@ -7,29 +12,37 @@
];

# Nix settings
nix = {
settings = {
experimental-features = [
"nix-command"
"flakes"
];
# Trusted users for remote builds
trusted-users = [
"root"
"keito"
];
};
# Garbage collection
gc = {
automatic = true;
interval = {
Weekday = 0;
Hour = 2;
Minute = 0;
# Determinate Nix 環境では nix-darwin による Nix 管理を無効化する
# （experimental-features や GC は Determinate 側が管理）
nix =
if determinateNix then
{
enable = false;
}
else
{
settings = {
experimental-features = [
"nix-command"
"flakes"
];
# Trusted users for remote builds
trusted-users = [
"root"
username
];
};
# Garbage collection
gc = {
automatic = true;
interval = {
Weekday = 0;
Hour = 2;
Minute = 0;
};
options = "--delete-older-than 30d";
};
};
options = "--delete-older-than 30d";
};
};

# System packages (available to all users)
environment.systemPackages = with pkgs; [
Expand All @@ -44,7 +57,7 @@
stateVersion = 6;

# Primary user (required for homebrew, system.defaults, etc.)
primaryUser = "keito";
primaryUser = username;

defaults = {
# Dock
Expand Down Expand Up @@ -191,8 +204,8 @@
services.skhd = {
enable = true;
skhdConfig = ''
ctrl + shift - j : /Users/keito/.local/bin/send-ime-key kana
ctrl + shift - 0x29 : /Users/keito/.local/bin/send-ime-key eisuu
ctrl + shift - j : /Users/${username}/.local/bin/send-ime-key kana
ctrl + shift - 0x29 : /Users/${username}/.local/bin/send-ime-key eisuu
'';
};

Expand All @@ -209,11 +222,11 @@
];
RunAtLoad = true;
KeepAlive = true;
StandardOutPath = "/Users/keito/Library/Logs/agent-deck-web.log";
StandardErrorPath = "/Users/keito/Library/Logs/agent-deck-web.err.log";
StandardOutPath = "/Users/${username}/Library/Logs/agent-deck-web.log";
StandardErrorPath = "/Users/${username}/Library/Logs/agent-deck-web.err.log";
EnvironmentVariables = {
# claude/codex (~/.local/bin, ~/.bin)・node/gh (nix profile)・agent-deck (homebrew) を解決できる PATH
PATH = "/Users/keito/.local/bin:/Users/keito/.bin:/opt/homebrew/bin:/etc/profiles/per-user/keito/bin:/run/current-system/sw/bin:/usr/local/bin:/usr/bin:/bin";
PATH = "/Users/${username}/.local/bin:/Users/${username}/.bin:/opt/homebrew/bin:/etc/profiles/per-user/${username}/bin:/run/current-system/sw/bin:/usr/local/bin:/usr/bin:/bin";
};
};
};
Expand Down
39 changes: 28 additions & 11 deletions nix/modules/homebrew.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,29 @@
{ ... }:
{ config, lib, ... }:

let
# brew trust（Homebrew 6+）にも渡すため let で束ねる
taps = [
"1password/tap"
"asheshgoplani/tap"
"koekeishiya/formulae"
"nikitabobko/tap"
"supabase/tap"
"ynqa/tap"
"yukiarrr/tap"
];
in
{
# Homebrew 6+ はサードパーティ tap を明示的に信頼しないと formula/cask を
# 読み込まない（新規マシンで brew bundle が失敗する）。trust.json は
# ユーザー単位の設定なので primaryUser として事前に登録する。
system.activationScripts.preActivation.text = ''
if [ -x /opt/homebrew/bin/brew ] && sudo -u ${config.system.primaryUser} -H /opt/homebrew/bin/brew trust --help >/dev/null 2>&1; then
${lib.concatMapStringsSep "\n " (
tap: ''sudo -u ${config.system.primaryUser} -H /opt/homebrew/bin/brew trust "${tap}" || true''
) taps}
Comment on lines +19 to +23

@coderabbitai coderabbitai Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Do not suppress tap-trust failures.

Line 22 masks every brew trust error even though Lines 16-18 identify trust as required before Homebrew activation. This can still make darwin-rebuild switch fail later, while hiding the actionable cause. Let the activation fail, or collect failed taps and exit nonzero.

Proposed fix 
-        tap: ''sudo -u ${config.system.primaryUser} -H /opt/homebrew/bin/brew trust "${tap}" || true''
+        tap: ''sudo -u ${config.system.primaryUser} -H /opt/homebrew/bin/brew trust "${tap}"''
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
system.activationScripts.preActivation.text = ''
if [ -x /opt/homebrew/bin/brew ] && sudo -u ${config.system.primaryUser} -H /opt/homebrew/bin/brew trust --help >/dev/null 2>&1; then
${lib.concatMapStringsSep "\n " (
tap: ''sudo -u ${config.system.primaryUser} -H /opt/homebrew/bin/brew trust "${tap}" || true''
) taps}
system.activationScripts.preActivation.text = ''
if [ -x /opt/homebrew/bin/brew ] && sudo -u ${config.system.primaryUser} -H /opt/homebrew/bin/brew trust --help >/dev/null 2>&1; then
${lib.concatMapStringsSep "\n " (
tap: ''sudo -u ${config.system.primaryUser} -H /opt/homebrew/bin/brew trust "${tap}"''
) taps}
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@nix/modules/homebrew.nix` around lines 19 - 23, Remove the `|| true` failure
suppression from the `brew trust` command generated by
`system.activationScripts.preActivation.text`. Ensure each required tap trust
failure causes activation to exit nonzero, while preserving the existing user,
Homebrew path, and tap iteration behavior.

fi
'';

homebrew = {
enable = true;

Expand All @@ -11,19 +34,12 @@
};

# === Taps ===
taps = [
"1password/tap"
"asheshgoplani/tap"
"koekeishiya/formulae"
"nikitabobko/tap"
"supabase/tap"
"ynqa/tap"
"yukiarrr/tap"
];
inherit taps;

# === Formulae (Nix にないもの / tap 依存 / macOS 固有) ===
brews = [
"asheshgoplani/tap/agent-deck" # Agent Deck CLI
"bash" # bash 4+ (setup-claude.sh や typeset -g を使うスクリプトが必要。macOS 標準は 3.2)
"cliclick" # macOS automation
"mas" # Mac App Store CLI
"pinentry-mac" # GPG pinentry for macOS
Expand All @@ -42,12 +58,13 @@
"1password-cli"

# Development Tools
# gcloud は nixpkgs の google-cloud-sdk で管理（cask の postinstall が
# virtualenv コマンドを要求し、新規マシンで失敗するため）
"android-studio"
"cursor"
"dotnet-sdk"
"elgato-stream-deck"
"flutter"
"gcloud-cli"
"ngrok"
"orbstack"
"tableplus"
Expand Down
4 changes: 2 additions & 2 deletions test/nix-darwin-config.test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,8 +168,8 @@ describe('nix-darwin and home-manager macOS configuration', () => {
expect(darwinHost).toContain('enable = true;');
expect(darwinHost).toContain('ctrl + shift - j');
expect(darwinHost).toContain('ctrl + shift - 0x29');
expect(darwinHost).toContain('/Users/keito/.local/bin/send-ime-key kana');
expect(darwinHost).toContain('/Users/keito/.local/bin/send-ime-key eisuu');
expect(darwinHost).toContain('/Users/${username}/.local/bin/send-ime-key kana');
expect(darwinHost).toContain('/Users/${username}/.local/bin/send-ime-key eisuu');
});

test('cmux terminal config leaves IME shortcuts to skhd', () => {
Expand Down
Loading