Skip to content

feat(nix): enhance unfree package configuration in home-manager and NixOS #321

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shunkakinoki merged 3 commits into from
Nov 8, 2025
Merged

feat(nix): enhance unfree package configuration in home-manager and NixOS #321

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4779941
feat(nix): enhance unfree package configuration in home-manager and N…
shunkakinoki Nov 8, 2025
b41455e
fix(makefile): update NixOS build command for improved configuration
shunkakinoki Nov 8, 2025
81f9b7b
feat(e2e): add disk space cleanup step for Ubuntu runners
shunkakinoki Nov 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions .github/workflows/e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,17 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@v5
- name: Free Disk Space (Ubuntu)
if: runner.os == 'Linux'
uses: jlumbroso/free-disk-space@main
with:
tool-cache: false
android: true
dotnet: true
haskell: true
large-packages: true
docker-images: true
swap-storage: true
- name: KVM Linux Virtualization
if: runner.os == 'Linux'
run: |
Expand Down
2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,7 +211,7 @@ nix-build: nix-connect
if [ "$(OS)" = "Darwin" ]; then \
$(NIX_ALLOW_UNFREE) $(NIX_EXEC) build .#$(NIX_CONFIG_TYPE).runner.system $(NIX_FLAGS) --impure --no-update-lock-file --show-trace; \
elif [ "$(NIX_CONFIG_TYPE)" = "nixosConfigurations" ]; then \
$(NIX_ALLOW_UNFREE) $(NIX_EXEC) run $(NIX_FLAGS) nixpkgs#nixos-rebuild -- build --flake .#runner --impure --no-update-lock-file; \
$(NIX_ALLOW_UNFREE) $(NIX_EXEC) build .#nixosConfigurations.runner.config.system.build.toplevel $(NIX_FLAGS) --impure --no-update-lock-file --show-trace; \
elif [ "$(NIX_CONFIG_TYPE)" = "homeConfigurations" ]; then \
$(NIX_ALLOW_UNFREE) $(NIX_EXEC) build .#$(NIX_CONFIG_TYPE)."$(NIX_USERNAME)@$(NIX_SYSTEM)".activationPackage $(NIX_FLAGS) --impure --no-update-lock-file --show-trace; \
else \
Expand Down
16 changes: 10 additions & 6 deletions home-manager/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,12 +31,16 @@ in
inputs.agenix.homeManagerModules.default
];

nixpkgs.config.allowUnfreePredicate =
pkg:
builtins.elem (lib.getName pkg) [
"claude-code"
"qwen-code"
];
nixpkgs.config = {
allowUnfree = true;

@mesa-dot-dev mesa-dot-dev Bot Nov 8, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Medium

Setting allowUnfree = true here is redundant and contradictory with the allowUnfreePredicate below. When using a predicate to restrict unfree packages to a specific allowlist, you don't need (and shouldn't use) allowUnfree = true. The predicate already enables unfree packages for those matching the condition. More critically, since hosts/nixos/default.nix now passes a pkgs instance configured with global allowUnfree = true (line 12), this home-manager predicate won't effectively restrict packages from that shared pkgs instance.

Agent: 🏛 Architecture • Fix in Cursor

@cubic-dev-ai cubic-dev-ai Bot Nov 8, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Configuring allowUnfree = true alongside allowUnfreePredicate is contradictory: allowUnfree = true permits all unfree packages and makes the predicate ineffective. Choose one path—either allow all unfree packages or remove allowUnfree to enforce the predicate.

Prompt for AI agents 
Address the following comment on home-manager/default.nix at line 35:

<comment>Configuring allowUnfree = true alongside allowUnfreePredicate is contradictory: allowUnfree = true permits all unfree packages and makes the predicate ineffective. Choose one path—either allow all unfree packages or remove allowUnfree to enforce the predicate.</comment>

<file context>
@@ -31,12 +31,16 @@ in
-      &quot;qwen-code&quot;
-    ];
+  nixpkgs.config = {
+    allowUnfree = true;
+    allowUnfreePredicate =
+      pkg:
</file context>
Fix with Cubic

allowUnfreePredicate =
pkg:
builtins.elem (lib.getName pkg) [
"claude-code"
"qwen-code"
"crush"
];

@cursor cursor Bot Nov 8, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Conflicting Unfree Settings Allow All Packages

Setting allowUnfree = true allows all unfree packages, which makes the allowUnfreePredicate restriction ineffective. The predicate is intended to limit unfree packages to only "claude-code", "qwen-code", and "crush", but allowUnfree = true overrides this restriction and permits any unfree package. Either remove allowUnfree = true to enforce the predicate's restrictions, or remove allowUnfreePredicate if all unfree packages should be allowed.

Fix in Cursor Fix in Web

Comment on lines +35 to +42

@gemini-code-assist gemini-code-assist Bot Nov 8, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The allowUnfreePredicate option is deprecated. It's recommended to use allowUnfree with a predicate function instead. Also, setting allowUnfree = true allows all unfree packages, which makes the predicate on the following lines redundant and may not be your intention.

To allow only the specified list of unfree packages, you can define allowUnfree as a predicate function directly. This is the modern and recommended approach in Nixpkgs.

    allowUnfree = pkg:
      builtins.elem (lib.getName pkg) [
        "claude-code"
        "qwen-code"
        "crush"
      ];

};
Comment on lines +34 to +43

Copilot AI Nov 8, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Setting both allowUnfree = true and allowUnfreePredicate creates a logical inconsistency. When allowUnfree = true is set, it allows ALL unfree packages, making the allowUnfreePredicate function ineffective.

If you want to restrict unfree packages to only the listed ones ("claude-code", "qwen-code", "crush"), you should remove allowUnfree = true and keep only the predicate. If you want to allow all unfree packages, you should remove the predicate and keep only allowUnfree = true.

Copilot uses AI. Check for mistakes.
Comment on lines +34 to +43

@coderabbitai coderabbitai Bot Nov 8, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Remove redundant configuration: allowUnfree = true makes the predicate unnecessary.

Setting allowUnfree = true allows ALL unfree packages, which makes the allowUnfreePredicate redundant and creates logical confusion. The predicate is typically used to selectively allow specific unfree packages when allowUnfree is not set or is false.

Choose one approach:

Option 1 (Recommended): Allow all unfree packages

 nixpkgs.config = {
   allowUnfree = true;
-  allowUnfreePredicate =
-    pkg:
-    builtins.elem (lib.getName pkg) [
-      "claude-code"
-      "qwen-code"
-      "crush"
-    ];
 };

Option 2: Selectively allow only specific unfree packages

 nixpkgs.config = {
-  allowUnfree = true;
   allowUnfreePredicate =
     pkg:
     builtins.elem (lib.getName pkg) [
       "claude-code"
       "qwen-code"
       "crush"
     ];
 };
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
nixpkgs.config = {
allowUnfree = true;
allowUnfreePredicate =
pkg:
builtins.elem (lib.getName pkg) [
"claude-code"
"qwen-code"
"crush"
];
};
nixpkgs.config = {
allowUnfree = true;
};
🤖 Prompt for AI Agents 
In home-manager/default.nix around lines 34 to 43, remove the redundancy between
allowUnfree and allowUnfreePredicate: either (A) keep allowUnfree = true and
delete the entire allowUnfreePredicate block so all unfree packages are allowed,
or (B) set allowUnfree = false (or remove it) and keep the allowUnfreePredicate
array to selectively allow "claude-code", "qwen-code", and "crush"; apply one of
these two options and ensure the resulting nixpkgs.config is syntactically
valid.


home.username = username;
home.homeDirectory = lib.mkIf pkgs.stdenv.isLinux "/home/${username}";
Expand Down
8 changes: 5 additions & 3 deletions hosts/nixos/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,10 @@
let
inherit (inputs) nixpkgs home-manager;
system = "x86_64-linux";
pkgs = nixpkgs.legacyPackages.${system};
pkgs = import nixpkgs {
inherit system;
config.allowUnfree = true;

@mesa-dot-dev mesa-dot-dev Bot Nov 8, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Medium

This global allowUnfree = true configuration conflicts with the restrictive allowUnfreePredicate defined in home-manager/default.nix (lines 36-42). Since this pkgs instance is passed to home-manager (line 123), the predicate becomes ineffective. Consider moving the predicate here instead:

pkgs = import nixpkgs {
  inherit system;
  config.allowUnfreePredicate = pkg:
    builtins.elem (lib.getName pkg) [
      "claude-code" "qwen-code" "crush"
    ];
};

This ensures consistent unfree package restrictions across both NixOS and home-manager.

Agent: 🏛 Architecture • Fix in Cursor

};
configuration =
{ config, lib, ... }:
{
Expand Down Expand Up @@ -104,7 +107,6 @@ nixpkgs.lib.nixosSystem {
fsType = "ext4";
};

nixpkgs.config.allowUnfree = true;
nixpkgs.pkgs = pkgs;

fonts.packages = with pkgs; [
Expand All @@ -118,7 +120,7 @@ nixpkgs.lib.nixosSystem {
home-manager.users."${username}" = import ../../home-manager {
inherit inputs username system;
lib = nixpkgs.lib;
pkgs = nixpkgs.legacyPackages.${system};
pkgs = pkgs;
config = { };
};
}
Expand Down
Loading