A Nix-flake-powered personal workstation setup for Unix machines.

This repository is the single source of truth for most of my system configuration: operating system settings, packages, shell, editor, terminal, automation, mail, and day-to-day development tooling. The main target is Apple Silicon macOS using nix-darwin + Home Manager, with an experimental NixOS host as well.

It is a personal setup first, but the structure is meant to stay reusable: hosts are composed from small feature modules, app configs live in config/, and new machines can be bootstrapped with a single nix run command.

Font is Pragmata Pro, theme is my own fork of vim-colors-plain, Terminal is Ghostty.

The repo is split between reusable Nix modules in nix/ and checked-in application configuration in config/. In practice it manages:

These are the targets currently represented in the flake:

If you do not pass a host during bootstrap, the scripts default to $(hostname -s).

The repo is organized around a small number of top-level directories:

Inside nix/, the interesting pieces are:

The overall pattern is simple: a host declares a list of features such as shell, git, vim, mail, or ai, and the flake wires in the matching system and Home Manager modules automatically.

I use the new Nix installer:

curl --proto '=https' --tlsv1.2 -sSfL https://artifacts.nixos.org/nix-installer | sh -s -- install

This setup installs Pragmata Pro through a custom Nix package that uses requireFile. If you own the font, add the archive to the Nix store before the first rebuild:

nix-store --add-fixed sha256 /path/to/PragmataPro<version>.zip

If you do not use Pragmata Pro, remove or replace pkgs.pragmatapro in the flake before bootstrapping.

Run the repo directly from GitHub:

nix --experimental-features 'nix-command flakes' run 'github:ahmedelgabri/dotfiles' -- <host>

In my setup the host is usually the machine hostname. If omitted, it falls back to $(hostname -s).

Examples:

# macOS hosts
nix --experimental-features 'nix-command flakes' run 'github:ahmedelgabri/dotfiles' -- rocket
nix --experimental-features 'nix-command flakes' run 'github:ahmedelgabri/dotfiles' -- alcantara

# NixOS host
nix --experimental-features 'nix-command flakes' run 'github:ahmedelgabri/dotfiles' -- nixos

On the first run, the bootstrap app:

Platform-specific behavior:

Once the repo is cloned locally, rebuild from ~/.dotfiles.

cd ~/.dotfiles
nixup   # helper for `nix flake update`
nixsw   # helper for `darwin-rebuild switch --flake .`

Equivalent manual command:

darwin-rebuild switch --flake ~/.dotfiles#<host>

cd ~/.dotfiles
nixup   # optional helper for `nix flake update`
sudo nixos-rebuild switch --flake .#nixos

I still use Homebrew mainly for GUI apps.

Nix and/or Home Manager support for GUI applications on macOS is still a bit awkward, especially around symlinking into Applications/. Homebrew is still managed declaratively here, but it is installed and controlled through nix-homebrew rather than manually.

Not everything belongs in Git. This repo intentionally keeps some values outside of the tracked tree and loads them from a host-specific location.

Home Manager sets a per-host config directory under ${XDG_DATA_HOME}, and in my shell that path is exposed as $HOST_CONFIGS.

In practice this usually means something like:

$HOST_CONFIGS = ~/.local/share/<host>

Useful files to create there:

If you want GitHub to show commits as Verified, the email on the commit, the email on GitHub, and the email attached to the public key all need to match.

Also remember to:

• generate SSH keys
• import or create your GPG keys
• upload the public GPG key to GitHub if you use commit signing

This repo includes agenix, but I do not use it as the source of truth for important secrets.

The rough rule here is:

• truly sensitive credentials are generated or imported per machine and stored in pass
• agenix is used only for lower-risk private files that I still want to keep out of the public repo

Mail is one of the more opinionated parts of this setup.

The stack looks like this:

The mail module currently has service defaults for:

It also supports two modes:

When local accounts are enabled, synchronization runs automatically:

The timer runs every 2 minutes in this setup.

Each account needs authentication for IMAP and SMTP. Some services also need extra credentials for JMAP or CardDAV.

Passwords are read from pass. For an account named Foo, the module expects entries under the lowercased account name:

With two-factor authentication enabled, use an app-specific password where needed.

This repo also exports a few project templates from templates/.

Use them like this:

nix flake init --template 'github:ahmedelgabri/dotfiles#<template name>'

or:

nix flake init --template 'github:ahmedelgabri/dotfiles#<template name>' ./my-project

-t can be used as a shorthand for --template.

Available templates:

The flake also exposes a few outputs that are useful when editing the dotfiles repo itself: