1+ {
2+ description = "Joey's darwin (pollen) system" ;
3+
4+ inputs = {
5+ # Package sets
6+ nixpkgs . url = "github:nixos/nixpkgs/nixpkgs-21.11-darwin" ;
7+ nixpkgs-unstable . url = github:NixOS/nixpkgs/nixpkgs-unstable ;
8+
9+ # Environment/system management
10+ darwin . url = "github:lnl7/nix-darwin/master" ;
11+ darwin . inputs . nixpkgs . follows = "nixpkgs-unstable" ;
12+ home-manager . url = "github:nix-community/home-manager" ;
13+ home-manager . inputs . nixpkgs . follows = "nixpkgs-unstable" ;
14+
15+ # Other sources
16+ comma = { url = github:nix-community/comma ; flake = false ; } ;
17+
18+ } ;
19+
20+ outputs = { self , darwin , nixpkgs , home-manager , ... } @inputs :
21+ let
22+
23+ inherit ( darwin . lib ) darwinSystem ;
24+ inherit ( inputs . nixpkgs-unstable . lib ) attrValues makeOverridable optionalAttrs singleton ;
25+
26+ # Configuration for `nixpkgs`
27+ nixpkgsConfig = {
28+ config = { allowUnfree = true ; } ;
29+ overlays = attrValues self . overlays ++ singleton (
30+ # Sub in x86 version of packages that don't build on Apple Silicon yet
31+ final : prev : ( optionalAttrs ( prev . stdenv . system == "aarch64-darwin" ) {
32+ inherit ( final . pkgs-x86 )
33+ idris2
34+ nix-index
35+ niv
36+ purescript ;
37+ } )
38+ ) ;
39+ } ;
40+ in
41+ {
42+ # My `nix-darwin` configs
43+
44+ darwinConfigurations = rec {
45+ j-one = darwinSystem {
46+ system = "aarch64-darwin" ;
47+ modules = attrValues self . darwinModules ++ [
48+ # Main `nix-darwin` config
49+ ./configuration.nix
50+ # `home-manager` module
51+ home-manager . darwinModules . home-manager
52+ {
53+ nixpkgs = nixpkgsConfig ;
54+ # `home-manager` config
55+ home-manager . useGlobalPkgs = true ;
56+ home-manager . useUserPackages = true ;
57+ home-manager . users . joey = import ./home.nix ;
58+ }
59+ ] ;
60+ } ;
61+ } ;
62+
63+ # Overlays --------------------------------------------------------------- {{{
64+
65+ overlays = {
66+ # Overlays to add various packages into package set
67+ comma = final : prev : {
68+ comma = import inputs . comma { inherit ( prev ) pkgs ; } ;
69+ } ;
70+
71+ # Overlay useful on Macs with Apple Silicon
72+ apple-silicon = final : prev : optionalAttrs ( prev . stdenv . system == "aarch64-darwin" ) {
73+ # Add access to x86 packages system is running Apple Silicon
74+ pkgs-x86 = import inputs . nixpkgs-unstable {
75+ system = "x86_64-darwin" ;
76+ inherit ( nixpkgsConfig ) config ;
77+ } ;
78+ } ;
79+ } ;
80+
81+ # My `nix-darwin` modules that are pending upstream, or patched versions waiting on upstream
82+ # fixes.
83+ darwinModules = {
84+ programs-nix-index =
85+ # Additional configuration for `nix-index` to enable `command-not-found` functionality with Fish.
86+ { config , lib , pkgs , ... } :
87+
88+ {
89+ config = lib . mkIf config . programs . nix-index . enable {
90+ programs . fish . interactiveShellInit = ''
91+ function __fish_command_not_found_handler --on-event="fish_command_not_found"
92+ ${ if config . programs . fish . useBabelfish then ''
93+ command_not_found_handle $argv
94+ '' else ''
95+ ${ pkgs . bashInteractive } /bin/bash -c \
96+ "source ${ config . programs . nix-index . package } /etc/profile.d/command-not-found.sh; command_not_found_handle $argv"
97+ '' }
98+ end
99+ '' ;
100+ } ;
101+ } ;
102+ security-pam =
103+ # Upstream PR: https://github.com/LnL7/nix-darwin/pull/228
104+ { config , lib , pkgs , ... } :
105+
106+ with lib ;
107+
108+ let
109+ cfg = config . security . pam ;
110+
111+ # Implementation Notes
112+ #
113+ # We don't use `environment.etc` because this would require that the user manually delete
114+ # `/etc/pam.d/sudo` which seems unwise given that applying the nix-darwin configuration requires
115+ # sudo. We also can't use `system.patchs` since it only runs once, and so won't patch in the
116+ # changes again after OS updates (which remove modifications to this file).
117+ #
118+ # As such, we resort to line addition/deletion in place using `sed`. We add a comment to the
119+ # added line that includes the name of the option, to make it easier to identify the line that
120+ # should be deleted when the option is disabled.
121+ mkSudoTouchIdAuthScript = isEnabled :
122+ let
123+ file = "/etc/pam.d/sudo" ;
124+ option = "security.pam.enableSudoTouchIdAuth" ;
125+ in ''
126+ ${ if isEnabled then ''
127+ # Enable sudo Touch ID authentication, if not already enabled
128+ if ! grep 'pam_tid.so' ${ file } > /dev/null; then
129+ sed -i "" '2i\
130+ auth sufficient pam_tid.so # nix-darwin: ${ option }
131+ ' ${ file }
132+ fi
133+ '' else ''
134+ # Disable sudo Touch ID authentication, if added by nix-darwin
135+ if grep '${ option } ' ${ file } > /dev/null; then
136+ sed -i "" '/${ option } /d' ${ file }
137+ fi
138+ '' }
139+ '' ;
140+ in
141+
142+ {
143+ options = {
144+ security . pam . enableSudoTouchIdAuth = mkEnableOption ''
145+ Enable sudo authentication with Touch ID
146+ When enabled, this option adds the following line to /etc/pam.d/sudo:
147+ auth sufficient pam_tid.so
148+ (Note that macOS resets this file when doing a system update. As such, sudo
149+ authentication with Touch ID won't work after a system update until the nix-darwin
150+ configuration is reapplied.)
151+ '' ;
152+ } ;
153+
154+ config = {
155+ system . activationScripts . extraActivation . text = ''
156+ # PAM settings
157+ echo >&2 "setting up pam..."
158+ ${ mkSudoTouchIdAuthScript cfg . enableSudoTouchIdAuth }
159+ '' ;
160+ } ;
161+ } ;
162+ } ;
163+ } ;
164+ }
0 commit comments