Nixmac
Nix-darwin that speaks plain English
233 followers
Nix-darwin that speaks plain English
233 followers
nixmac turns your Mac into a reproducible, version-controlled system. Describe what you want in plain English — it writes the Nix, builds it, and applies it safely.
Nixmac
@cooper_maruyama Thanks for the response! I'm particularly interested in how Nixmac handles Python development environments. Does it integrate with tools like `pyenv` or `poetry`? I'd be happy to contribute to that area if there's room for collaboration.
Foyer
The hard part of nix-darwin isn't writing the initial config, it's understanding why a rebuild failed three weeks later when you've forgotten what you changed and the error message is a wall of Nix evaluation trace. Curious whether Nixmac helps with that debugging side, or whether it's mostly focused on the generation step. Also wondering how it handles the gap between what someone asks for in plain English and what's actually available in nixpkgs or the darwin module set, since a lot of the friction in practice comes from options that exist in theory but have subtle constraints you only discover by reading the source.
Nixmac
@fberrez1 We do things like bundling the nixos options doc and even a custom tool that's specifically for parsing the nixos options. Nix also just happens to be very LLM-friendly, which is why it's able to one-shot even quite complex prompts, whereas if an LLM was asked to do the same thing by driving a computer and a terminal, it may fail and/or use a lot more tokens.
Also, Nix is unique in that you can `nix eval` or `nix build` and sort of get an idea if the proposed change will be successful - we do that in the background to increase the probability that the proposed change will work.
The plain-English → generated Nix → safe-apply loop is the right shape for the people Nix usually scares off, but the safety hinges on what I can see before it runs. Does it show the generated Nix diff for review before applying, and is each apply a rollbackable nix-darwin generation I can revert if a vague request compiles to the wrong thing? Curious how it handles an ambiguous request — ask to clarify, or guess and let me roll back?
Nixmac
@hi_i_am_mimo Of course! I'm a heavy nix user myself, and one of the "not-optional" constraints we give ourselves is that it should never feel like it "gets in the way" to Nix natives.
Appreciate that philosophy, that is exactly the bar. But concretely on the safety mechanics: before Nixmac applies, do I see the generated Nix diff to eyeball it, and is each apply a normal nix-darwin generation I can darwin-rebuild --rollback if a vague prompt compiled to the wrong thing? That review-then-rollback loop is what would make me trust it with a real config.
Nixmac
@hi_i_am_mimo Yes, you see the diff. Basically there's 3 stages:
Prompt
Review: At this point a `nix build` has been done to ensure it will build. You see the diff, and click "preview" to apply it
Commit: If you are good with the change, commit it with the autogenerated commit message or write your own.
So at step 2, you essentially have a staged diff that builds successfully, but has not yet been applied/committed and shows a full diff
@cooper_maruyama The nix build passing before you ever see the diff is the right ordering — reviewing a diff that does not build is wasted attention. On the Review stage, is that build run against your whole flake/config so it catches downstream breakage, or just the touched derivation? On a real machine config the scary failures are usually the module that broke three hops away, not the one you edited.
I run a laptop plus a Mac mini I use for local model work, and config drift between the two is exactly the kind of thing Nix is supposed to solve but plain-English descriptions make me wonder about. If I describe a setup in English on one machine, is the generated config meant to be portable to a second machine as-is, or does Nixmac bake in host-specific assumptions (hardware, installed apps) that I'd need to redo per machine? Basically: is the "plain English" step a one-time per-machine thing, or does it produce something closer to a shared base config with per-host overrides layered on top?
Nixmac
@galdayan the configuration will normally be portable for the most part. for many of the apps, Nix (and thus nixmac) can take care of the installation itself, so on the new machine you don't have to worry about whether the app is installed, it will install it for you if not present yet. the shared config with per-host tweaks is something that you can achieve with the tool as well; the same repository can contain different configurations, and you can switch between those. you can instruct the code to share code between those configurations, but also have some overrides per machine if you want.
@arximboldi that's the answer I was hoping for honestly, one repo with per-host overrides is a much better model than copy-pasting config between machines. going to actually try this on the mac mini setup
Curious how it handles apps you download outside of Homebrew or the App Store, like random .dmg utilities, can Nixmac pick those up or do you have to manually add them to the config?
Nixmac
@sevilmoolkghgs If it's not on homebrew or supported by home-manager / nix-darwin, in my experience it tends to write a script that gets called on activation that tries to install it. For example, it might find a link to the dmg somewhere. I'd assume this is what most agents would do, so maybe Nixmac is not the ideal tool for something like this
ChatWebby AI
Since nix-darwin setups often need to manage secrets like SSH keys or API tokens, does Nixmac integrate with something like agenix or sops-nix, or is that left entirely up to the user?
Nixmac
@zain_sheikh so far it's up to the user, but it's something that is in our backlog. @cooper_maruyama spends a lot of time thinking about secrets and has IMHO very good takes on them.
Nixmac
@zain_sheikh @arximboldi 100% This is probably going to have a first-class UI very soon. Figuring out agenix took me longer than I care to admit when I first started using nix. Now, age-encrypted secrets (or SOPS) is the default for all our repos. I've spent a LOT of time with them now and most likely the first version will use sops-nix since it has first-class support for templating (rendering secrets into generated files without exposing them in the store) and sops-nix is more actively maintained. We'll probably have some support for agenix as well since it's so prevalent in the space
nix-darwin is one of those things i keep hearing is worth it but never actually get around to learning because the config syntax scares me off every time. this is the first "plain english to nix" pitch that's made me want to actually try it instead of just bookmarking it. since it applies changes for you, does it keep the old generation easily reachable if a plain english request builds something you didn't actually want, or do you have to know nix well enough to roll back yourself
Nixmac
@omri_ben_shoham1 rolling back is directly integrated in the UI :) And tracking of all your changes via Git so you never lose anything.
oh that's the piece that was missing for me. if it's already tracked in git under the hood then the plain english layer feels a lot safer to actually let loose on a real config instead of just admiring it from the launch post
Nixmac
@omri_ben_shoham1 Yep, this started out as a CLI tool I developed inside my own personal nix-darwin repo, so you will definitely feel at home
Nice, dogfooding it on your own setup first is a good sign. Curious how much of the plain-English layer you had to rework once other people's configs started hitting it vs just your own.