nixfiles/hosts/Darwin/README.md

macOS (nix-darwin) — lyrathorpe-mac

Flake host: lyrathorpe-mac (aarch64-darwin). Apple Silicon Mac managed by nix-darwin from this same flake. Built via mkDarwinHost (single-user — macOS owns the account; identity still comes from the registry). Files: configuration.nix.

What this host is

A macOS workstation. The interactive user environment (shell, git, editor, Claude) is the shared ../../home bundle — the same modules the Linux hosts use — so the terminal experience matches. The Linux-only desktop.nix/sway.nix are intentionally left out. This host config covers the macOS-specific layer: system packages, Homebrew, and macOS UI defaults.

Package sourcing

• nixpkgs (environment.systemPackages) for CLI tooling and libraries.
• Homebrew, owned declaratively by nix-homebrew (Rosetta enabled for x86_64 formulae). The brews/casks lists are authoritative: onActivation.cleanup = "zap" uninstalls anything not declared. GUI apps are casks (nixpkgs darwin GUI support is unreliable); a few version-pinned toolchains and the PWA host stay on brew for continuity.
• Mac App Store apps are not declarative: nix-darwin 26.05 runs activation as root, and mas cannot reach the App Store session from root. Install them by hand with mas install <id> from a GUI Terminal (the mas CLI is in environment.systemPackages).

macOS integration

• security.pam.services.sudo_local — Touch ID for sudo (and darwin-rebuild's sudo prompt), kept in sudo_local so it survives OS updates. reattach pulls in pam_reattach so Touch ID works inside tmux (which the terminals auto-start).
• system.defaults — declarative dock / finder / global / trackpad preferences, applied on activation and reversible. This is the main reason to run nix-darwin beyond package management.
• The JetBrainsMono Nerd Font is installed to /Library/Fonts; set it in iTerm2 (Settings → Profiles → Text → Font) so the tmux statusline glyphs render.

stateVersion

system.stateVersion = 5 (the nix-darwin state version, an integer — not a NixOS release string). Read darwin-rebuild changelog before changing it.

Apply

darwin-rebuild switch --flake .#lyrathorpe-mac