Matthew Bessette
165 lines
3.9 KiB
Nix
165 lines
3.9 KiB
Nix
{ pkgs
|
|
, lib
|
|
, ...
|
|
}:
|
|
let
|
|
ansibleRequired = {
|
|
taps = [
|
|
"fwdcloudsec/granted" # aws sso utility
|
|
"felipeelias/tap" # claude-statusline
|
|
"f1bonacc1/tap" # process-compose
|
|
"oven-sh/bun" # bun
|
|
"sst/tap" # opencode
|
|
];
|
|
brews = [
|
|
"allure"
|
|
"aws-sso-util"
|
|
"awscli"
|
|
"ccusage"
|
|
"fd"
|
|
"f1bonacc1/tap/process-compose"
|
|
"felipeelias/tap/claude-statusline"
|
|
"oven-sh/bun/bun"
|
|
"fwdcloudsec/granted/granted"
|
|
"gdal"
|
|
"gh"
|
|
"jq"
|
|
"maven"
|
|
"rg"
|
|
"snyk-cli"
|
|
"sst/tap/opencode"
|
|
"ldcli"
|
|
|
|
## Excluded intentionally
|
|
# "libpq@17"
|
|
# "node@22"
|
|
];
|
|
casks = [
|
|
"1password-cli"
|
|
"aws-vpn-client"
|
|
"chromedriver"
|
|
"claude-code" # stable channel; playbook can opt into claude-code@latest
|
|
"copilot-cli"
|
|
"docker-desktop"
|
|
"expo-orbit"
|
|
"zulu@17"
|
|
"ngrok"
|
|
|
|
## Excluded intentionally
|
|
# "visual-studio-code" # app installed by brew; home-manager owns settings + extensions
|
|
# "jetbrains-toolbox"
|
|
];
|
|
};
|
|
in
|
|
{
|
|
ids.gids.nixbld = 350;
|
|
security.pam.services.sudo_local.touchIdAuth = true;
|
|
|
|
# Set vim as default editor
|
|
environment.variables.EDITOR = "vim";
|
|
environment.variables.VISUAL = "vim";
|
|
environment.variables.GIT_EDITOR = "vim";
|
|
environment.variables.HOMEBREW_NO_ANALYTICS = "1";
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
vim
|
|
git
|
|
wget
|
|
curl
|
|
python3
|
|
postgresql_17
|
|
home-manager
|
|
ttyd
|
|
xcodes
|
|
xz
|
|
# node 22 pinned to the exact version cleo-app requires (nixpkgs-nodejs in flake.nix)
|
|
pinnedNode.nodejs_22
|
|
pinnedNode.yarn
|
|
];
|
|
|
|
# Add Homebrew to PATH
|
|
environment.systemPath = [
|
|
"/opt/homebrew/bin"
|
|
"/opt/homebrew/sbin"
|
|
"/Users/matthew.bessette/.local/bin"
|
|
];
|
|
|
|
system.primaryUser = "matthew.bessette";
|
|
users.users."matthew.bessette" = {
|
|
name = "matthew.bessette";
|
|
home = "/Users/matthew.bessette";
|
|
};
|
|
|
|
services.openssh = {
|
|
enable = true;
|
|
extraConfig = ''
|
|
StrictModes no
|
|
# Deny everyone by default unless they match the subnet rule
|
|
Match Address !192.168.0.0/16
|
|
DenyUsers *
|
|
'';
|
|
};
|
|
|
|
# Homebrew for Casks and specific binaries
|
|
# In a nix-darwin setup, Homebrew packages are not actually stored inside the Nix store.
|
|
# Instead, nix-darwin acts as a manager that triggers the standard Homebrew installation
|
|
# process on your macOS system.
|
|
homebrew = {
|
|
enable = true;
|
|
onActivation.cleanup = "uninstall";
|
|
onActivation.autoUpdate = true;
|
|
onActivation.upgrade = true;
|
|
# global.autoUpdate = true;
|
|
# Each list is (ansible-managed set) ++ (nix-only extras), deduped. With
|
|
# cleanup = "uninstall" above, anything NOT listed here gets removed on
|
|
# activation — so ansibleRequired must be merged in or nix would clobber it.
|
|
taps = lib.unique (
|
|
ansibleRequired.taps
|
|
++ [
|
|
# nix-only taps go here
|
|
]
|
|
);
|
|
brews = lib.unique (
|
|
ansibleRequired.brews
|
|
++ [
|
|
"biome"
|
|
"jira-cli"
|
|
"treehouse"
|
|
]
|
|
);
|
|
# visual-studio-code is installed by Homebrew (in ansibleRequired.casks) so
|
|
# Homebrew owns the .app; home-manager (cleo.home.nix) owns settings +
|
|
# extensions only (programs.vscode with package = null) — no second copy.
|
|
casks = lib.unique (
|
|
ansibleRequired.casks
|
|
++ [
|
|
"android-commandlinetools"
|
|
"android-platform-tools"
|
|
"bruno"
|
|
"claude"
|
|
"figma"
|
|
"super-productivity"
|
|
"kopiaui"
|
|
"libreoffice"
|
|
"obsidian"
|
|
"postico"
|
|
"sublime-text"
|
|
"spotify"
|
|
"yubico-yubikey-manager"
|
|
"zoom"
|
|
]
|
|
);
|
|
|
|
masApps = {
|
|
BetterSnapTool = 417375580;
|
|
HiddenBar = 1452453066;
|
|
# "Jamf Trust" = 1608041266;
|
|
MeetingBar = 1518425043;
|
|
Wireguard = 1451685025;
|
|
};
|
|
};
|
|
|
|
nix.settings.experimental-features = "nix-command flakes";
|
|
system.stateVersion = 4;
|
|
}
|