macs: modularize
This aligns the config with the linux builders and makes it more pleasant to interact with, at least for me.
Martin Weinelt committed
May 14, 2026 at 03:15 UTC
1e32b7dc5877735348eea516b86bbfcb73b2e3c6
16 files changed
+167
-124
macs/bootstrap.nix
new
+9
@@ -0,0 +1,9 @@
1
+{
2
+ imports = [
3
+ ./common/nix.nix
4
+ ./common/node-exporter.nix
5
+ ./common/shells.nix
6
+ ./common/ssh.nix
7
+ ./common/tools.nix
8
+ ];
9
+}
macs/common.nix
deleted
-6
@@ -1,6 +0,0 @@
1
-{
2
- imports = [
3
- ./hydra-queue-builder.nix
4
- ./minimal.nix
5
- ];
6
-}
macs/common/hydra-queue-builder.nix
renamed
macs/common/nix.nix
new
+34
@@ -0,0 +1,34 @@
1
+{
2
+ config,
3
+ ...
4
+}:
5
+
6
+{
7
+ environment.systemPackages = [
8
+ config.nix.package
9
+ ];
10
+
11
+ nix = {
12
+ settings = {
13
+ extra-experimental-features = [
14
+ "nix-command"
15
+ "flakes"
16
+ ];
17
+ max-silent-time = 7200; # 2h
18
+ timeout = 43200; # 12h
19
+ };
20
+ gc = {
21
+ automatic = true;
22
+ interval = [
23
+ {
24
+ Minute = 15;
25
+ }
26
+ {
27
+ Minute = 45;
28
+ }
29
+ ];
30
+ # ensure up to 100G free space every half hour
31
+ options = "--max-freed $(df -k /nix/store | awk 'NR==2 {available=$4; required=100*1024*1024; to_free=required-available; printf \"%.0d\", to_free*1024}')";
32
+ };
33
+ };
34
+}
macs/common/node-exporter.nix
new
+11
@@ -0,0 +1,11 @@
1
+{
2
+ lib,
3
+ ...
4
+}:
5
+
6
+{
7
+ services.prometheus.exporters.node.enable = true;
8
+
9
+ # https://github.com/LnL7/nix-darwin/issues/1256
10
+ users.users._prometheus-node-exporter.home = lib.mkForce "/private/var/lib/prometheus-node-exporter";
11
+}
macs/common/shells.nix
new
+12
@@ -0,0 +1,12 @@
1
+{
2
+ programs = {
3
+ zsh = {
4
+ enable = true;
5
+ enableCompletion = false;
6
+ };
7
+ bash = {
8
+ enable = true;
9
+ completion.enable = true;
10
+ };
11
+ };
12
+}
macs/common/spotlight.nix
new
+9
@@ -0,0 +1,9 @@
1
+{
2
+ # Disable spotlight indexing
3
+ system.activationScripts.postActivation.text = ''
4
+ printf "disabling spotlight indexing... "
5
+ mdutil -i off -d / &> /dev/null
6
+ mdutil -E / &> /dev/null
7
+ echo "ok"
8
+ '';
9
+}
macs/common/ssh.nix
new
+29
@@ -0,0 +1,29 @@
1
+{
2
+ config,
3
+ lib,
4
+ pkgs,
5
+ ...
6
+}:
7
+
8
+let
9
+ sshKeys = {
10
+ hydra-queue-runner = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOdxl6gDS7h3oeBBja2RSBxeS51Kp44av8OAJPPJwuU/ hydra-queue-runner@rhea";
11
+ };
12
+
13
+ environment = lib.concatStringsSep " " [
14
+ "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
15
+ ];
16
+
17
+ authorizedNixStoreKey =
18
+ key:
19
+ "command=\"${environment} ${config.nix.package}/bin/nix-store --serve --store daemon --write\" ${key}";
20
+in
21
+
22
+{
23
+ services.openssh.enable = true;
24
+
25
+ users.users.root.openssh.authorizedKeys.keys = [
26
+ (authorizedNixStoreKey sshKeys.hydra-queue-runner)
27
+ ]
28
+ ++ (import ../keys.nix).ssh.groups.infra-core;
29
+}
macs/common/tools.nix
new
+11
@@ -0,0 +1,11 @@
1
+{
2
+ pkgs,
3
+ ...
4
+}:
5
+
6
+{
7
+ environment.systemPackages = with pkgs; [
8
+ htop
9
+ nix-top
10
+ ];
11
+}
macs/common/workarounds.nix
new
+35
@@ -0,0 +1,35 @@
1
+{
2
+ # Prune the Rosetta JIT bytecode cache
3
+ # Probably purges more than that, see
4
+ # https://github.com/nix-darwin/nix-darwin/pull/1165#issuecomment-2477157627
5
+ launchd.daemons.rosetta2-gc = {
6
+ script = ''
7
+ date
8
+ exec /System/Library/Filesystems/apfs.fs/Contents/Resources/apfs.util -P -minsize 0 /System/Volumes/Data
9
+ '';
10
+ serviceConfig.StartInterval = 3600 * 2;
11
+ serviceConfig.RunAtLoad = true;
12
+ serviceConfig.StandardErrorPath = "/var/log/rosetta2-gc.log";
13
+ serviceConfig.StandardOutPath = "/var/log/rosetta2-gc.log";
14
+ };
15
+
16
+ # MacOS stores extensive logs in /var/db/uuidtext, which cause high disk usage
17
+ # Manually: find /var/db/uuidtext -type f -mtime +7 -delete
18
+ launchd.daemons.log-erase = {
19
+ script = ''
20
+ date
21
+ log erase --all
22
+ '';
23
+ serviceConfig.StartInterval = 3600 * 24;
24
+ serviceConfig.StandardErrorPath = "/var/log/uuidtext-gc.log";
25
+ serviceConfig.StandardOutPath = "/var/log/uuidtext-gc.log";
26
+ };
27
+
28
+ # Regularly kill fseventsd to reclaim excessively leaked memory/swap
29
+ launchd.daemons.fseventsd-reclaim = {
30
+ script = ''
31
+ killall -9 fseventsd
32
+ '';
33
+ serviceConfig.StartInterval = 3600;
34
+ };
35
+}
macs/flake-module.nix
+2
@@ -19,6 +19,8 @@
19
# the name that propagates into the MDM
20
computerName = hostname;
21
};
22
+
23
+ system.stateVersion = 5;
24
}
25
entrypoint
26
];
macs/minimal.nix
deleted
-115
@@ -1,115 +0,0 @@
1
-# used with https://github.com/DeterminateSystems/macos-ephemeral
2
-{
3
- config,
4
- lib,
5
- pkgs,
6
- ...
7
-}:
8
-
9
-let
10
- sshKeys = {
11
- hydra-queue-runner = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOdxl6gDS7h3oeBBja2RSBxeS51Kp44av8OAJPPJwuU/ hydra-queue-runner@rhea";
12
- };
13
- environment = lib.concatStringsSep " " [
14
- "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
15
- ];
16
-
17
- authorizedNixStoreKey =
18
- key:
19
- "command=\"${environment} ${config.nix.package}/bin/nix-store --serve --store daemon --write\" ${key}";
20
-in
21
-
22
-{
23
- environment.darwinConfig = "/nix/home/darwin-config/macs/nix-darwin.nix";
24
- environment.systemPackages = [
25
- config.nix.package
26
- pkgs.nix-top
27
- ];
28
-
29
- system.stateVersion = 5;
30
-
31
- programs = {
32
- zsh = {
33
- enable = true;
34
- enableCompletion = false;
35
- };
36
- bash = {
37
- enable = true;
38
- completion.enable = true;
39
- };
40
- };
41
-
42
- nix = {
43
- settings = {
44
- extra-experimental-features = [
45
- "nix-command"
46
- "flakes"
47
- ];
48
- max-silent-time = 7200; # 2h
49
- timeout = 43200; # 12h
50
- };
51
- gc = {
52
- automatic = true;
53
- interval = [
54
- {
55
- Minute = 15;
56
- }
57
- {
58
- Minute = 45;
59
- }
60
- ];
61
- # ensure up to 100G free space every half hour
62
- options = "--max-freed $(df -k /nix/store | awk 'NR==2 {available=$4; required=100*1024*1024; to_free=required-available; printf \"%.0d\", to_free*1024}')";
63
- };
64
- };
65
-
66
- services.openssh.enable = true;
67
-
68
- users.users.root.openssh.authorizedKeys.keys = [
69
- (authorizedNixStoreKey sshKeys.hydra-queue-runner)
70
- ]
71
- ++ (import ../keys.nix).ssh.groups.infra-core;
72
-
73
- system.activationScripts.postActivation.text = ''
74
- printf "disabling spotlight indexing... "
75
- mdutil -i off -d / &> /dev/null
76
- mdutil -E / &> /dev/null
77
- echo "ok"
78
- '';
79
-
80
- services.prometheus.exporters.node.enable = true;
81
-
82
- # https://github.com/LnL7/nix-darwin/issues/1256
83
- users.users._prometheus-node-exporter.home = lib.mkForce "/private/var/lib/prometheus-node-exporter";
84
-
85
- launchd.daemons.rosetta2-gc = {
86
- script = ''
87
- date
88
- exec /System/Library/Filesystems/apfs.fs/Contents/Resources/apfs.util -P -minsize 0 /System/Volumes/Data
89
- '';
90
- serviceConfig.StartInterval = 3600 * 2;
91
- serviceConfig.RunAtLoad = true;
92
- serviceConfig.StandardErrorPath = "/var/log/rosetta2-gc.log";
93
- serviceConfig.StandardOutPath = "/var/log/rosetta2-gc.log";
94
- };
95
-
96
- # MacOS stores extensive logs in /var/db/uuidtext, which cause high disk usage
97
- # Manually: find /var/db/uuidtext -type f -mtime +7 -delete
98
- launchd.daemons.log-erase = {
99
- script = ''
100
- date
101
- log erase --all
102
- '';
103
- serviceConfig.StartInterval = 3600 * 24;
104
- serviceConfig.StandardErrorPath = "/var/log/uuidtext-gc.log";
105
- serviceConfig.StandardOutPath = "/var/log/uuidtext-gc.log";
106
- };
107
-
108
- # Regularly kill fseventsd to reclaim excessively leaked memory/swap
109
- launchd.daemons.fseventsd-reclaim = {
110
- script = ''
111
- killall -9 fseventsd
112
- '';
113
- serviceConfig.StartInterval = 3600;
114
- };
115
-}
macs/production.nix
new
+12
@@ -0,0 +1,12 @@
1
+{
2
+ imports = [
3
+ ./common/hydra-queue-builder.nix
4
+ ./common/nix.nix
5
+ ./common/node-exporter.nix
6
+ ./common/shells.nix
7
+ ./common/spotlight.nix
8
+ ./common/ssh.nix
9
+ ./common/tools.nix
10
+ ./common/workarounds.nix
11
+ ];
12
+}
macs/profiles/bootstrap.nix
+1
-1
@@ -1,5 +1,5 @@
1
{
2
imports = [
3
- ../minimal.nix
3
+ ../bootstrap.nix
4
];
5
}
macs/profiles/m1.nix
+1
-1
@@ -1,6 +1,6 @@
1
{
2
imports = [
3
- ../common.nix
3
+ ../production.nix
4
];
5
6
# 8 Cores, 16 GB RAM, 256 GB Disk
macs/profiles/m2.large.nix
+1
-1
@@ -1,6 +1,6 @@
1
{
2
imports = [
3
- ../common.nix
3
+ ../production.nix
4
];
5
6
# 8 Cores, 24 GB RAM, 1 TB Disk