Reproducible, agent-first personal operating environment for Alex Tyrode. Nix and Home Manager own macOS, Linux, and the NixOS-WSL guest; nix-darwin owns macOS system activation, and native package managers retain macOS and Windows application state.
From a reviewed checkout:
cd ~/nix-dotfiles
./install.sh plan --config alex-x86_64-linux
./install.sh apply --config alex-x86_64-linuxSupported fresh-machine command:
curl -fsSL https://raw.githubusercontent.com/atyrode/dotfiles/main/get.sh | bashThe fetched get.sh clones the repository, lists the registered presets for
the detected platform, and asks which one to install before handing off to the
cloned install.sh. Each choice describes what it installs;
atyrode capabilities list shows the same descriptions per capability later.
Cloning first and running ./install.sh apply --config <host> yourself remains
equivalent.
For portable Linux automation, pass the generic profile for the detected
architecture, for example bash -s -- development-x86_64-linux --yes.
Bootstrap validates explicit names and will not guess between portable, fixed,
desktop, or Mac profiles. It uses explicit
preflight, plan, apply, verify, and rollback phases, verifies a pinned upstream
Nix artifact when Nix is absent, and preserves recoverable transaction
receipts. See Bootstrap.
Native Windows 11, from PowerShell:
irm https://raw.githubusercontent.com/atyrode/dotfiles/main/get.ps1 | iexThat command is plan-only. It resolves main to an exact commit and reports the
native/WSL changes without applying them. After review, run the printed revision:
& ([scriptblock]::Create((irm https://raw.githubusercontent.com/atyrode/dotfiles/main/get.ps1))) -Ref <exact-revision> -ApplyThe bootstrap verifies a pinned NixOS-WSL image, activates
alex-x86_64-linux-wsl, and then reconciles reviewed native packages through
WinGet. If it first enables or updates WSL, follow its reboot instruction and
run the same apply command again.
- Zsh with oh-my-zsh, syntax highlighting, autosuggestions
- zoxide - Smarter
cdcommand - fzf - Fuzzy finder (Ctrl+R for history)
- bat - Better
catwith syntax highlighting - tree - Directory tree viewer
- Git - Pre-configured with useful aliases
- tmux - Terminal multiplexer
- Nix/shell/workflow quality tooling - nixd, nixfmt, ShellCheck, shfmt, and actionlint
- OMP - Pinned coding agent, the
codeprofile generator, agents, and skills - Orca - Pinned cross-platform graphical worktree IDE locally, with
on-demand
orca serveremotely and capability-scoped agent skills - Rio - The pinned cross-platform terminal layer (#278), with one committed
home/rio/config.tomlfor macOS, Linux desktop, and native Windows - mise - Declaratively installed runtime/version manager
- Project-owned runtimes - Python/uv, general JavaScript runtimes, Go, Rust,
and native compilers come from committed dev shells,
mise.toml, or native manifests instead of every host's global profile; Node 24 and Bun are the deliberate agent-tools exceptions for Orca workflows and local review proxies
- btop - Modern system monitor
- dua - Disk usage analyzer
- Docker + docker-compose - Linux clients in the
containerscapability - OrbStack - Docker/Linux runtime on macOS
- dive - Docker image inspector
- fastfetch - Explicit system information command (not a startup side effect)
- Explicit capabilities - ffmpeg (
media), Android tools/scrcpy (mobile), and nmap/socat (security)
- Nix/Home Manager apps - ChatGPT, Lichess, Obsidian, OrbStack, Postman, Prism Launcher, REAPER, Rio, Signal, Spotify, and VLC
- Homebrew casks - Arduino IDE, Bitwarden, Claude Desktop, Codex Desktop, Discord, Display Pilot, Godot, Parsec, PlugData, Sonos, Steam, and Zen Browser Twilight, managed through nix-darwin
- Manual/vendor-managed macOS apps - ROLI Connect, ROLI Dashboard, ROLI Studio Player, and Vital stay outside the declarative setup until they have a stable public installer or package source.
- WinGet packages - Zen Browser Twilight is declared in
windows/packages.nixand reconciled from the managed NixOS-WSL host. - Pinned releases - the Rio terminal installs from the exact GitHub
release recorded in
inventory/rio-windows.json(SHA256-verified, version-locked to the nixpkgs pin), and the committed Rioconfig.tomldeploys beside it. - Application state - Mozilla sign-in, Zen profiles, cookies, sessions, updates, and caches remain owned by Zen/Windows rather than Nix.
Use the packaged atyrode interface, or check these highlights:
atyrode apply --plan # Inspect the exact host, source, and backend
atyrode apply # Activate the recorded host configuration
atyrode doctor host # Validate the managed machine identity
atyrode doctor system # Audit system-owned operational prerequisitescode # Profile generator TUI: type a prompt or turn the facet dials
omp # Mutable user-owned OMP; profile-aware resume, blocked update
omp-managed # Managed-layering launch target: defaults + policy over --config
ompu # Restricted launcher for deliberately untrusted repositoriescode opens a TUI whose facet dials and generated profiles work without local
model services; Ctrl+O optionally classifies the current prompt through the
local Ollama daemon. Enter launches the generated profile for the current
facets through omp-managed — the untouched default combo is a profile like
any other. The m key runs omp-managed on the managed defaults with no
overlay, the u key opens the ompu sandbox, and plain omp is reached by
typing omp directly. The model catalog lives in
omp/models.yml.
OMP, shared skills, and mise are installed by atyrode apply with the rest of
the Home Manager profile. See Agent tools for ownership,
model routing, project skill layout, state ownership, and updates.
git st # git status
git co # git checkout
git br # git branch
git ci # git commitUpdate dotfiles:
cd ~/nix-dotfiles
git pull
atyrode applyUpdate Nix packages:
cd ~/nix-dotfiles
nix flake update
atyrode applyPinned OMP updates have additional hash and integration checks documented in Agent tools.
dotfiles/
├── .github/workflows/ # Native Linux/macOS flake checks
├── agents/ # Generic cross-project skills
├── checks/ # Nix package and integration checks
├── darwin/ # nix-darwin and Homebrew configuration
│ ├── casks.nix # Shared declarative Homebrew cask list
│ └── default.nix # macOS system ownership and activation
├── docs/ # Architecture and maintenance guides
├── flake.nix # Main flake configuration
├── get.ps1 # Plan-first native Windows/NixOS-WSL bootstrap
├── get.sh # Fresh macOS/Linux bootstrap entrypoint
├── install.sh # Phased, transactional bootstrap
├── modules/ # Reusable Home Manager modules
├── nixos/ # Repository-owned NixOS-WSL system module
├── omp/ # Managed config, model catalog, agents, and rules
├── pkgs/ # Pinned custom derivations and wrappers
├── scripts/ # CI, update, and seeding utilities
├── windows/ # Native WinGet package declarations
└── home/ # Home Manager modules
├── default.nix # Main configuration
├── linux-desktop.nix # Optional Linux desktop packages
├── profiles/ # Composable host capability modules
├── zsh.nix # Zsh configuration
├── git.nix # Git configuration
└── shell/ # Thin interactive shell surface
├── cwd.zsh # OSC 7 working-directory metadata
└── startup.zsh # Interactive-only local override hook
The installer detects the current system and selects the matching configuration:
alex-aarch64-darwin
alex-aarch64-linux
alex-x86_64-linux
alex-x86_64-linux-desktopThese outputs are generated from the authoritative host registry and
composable capability modules. Production NixOS servers consume the exported
base + server + agent-tools profile from their infrastructure flake instead
of appearing in this personal host registry. Host IDs are canonical and have no
compatibility aliases. See Hosts and capabilities for the
identity contract and the add/rename/retire workflow.
Portable Home Manager profiles documents the external NixOS interface, one-way infrastructure dependency, server manifest, closure budget, and pin/update workflow.
The atyrode CLI documents deterministic application,
machine-readable capability discovery, and diagnostics.
Package ownership records the checked agent baseline, optional capabilities, project-owned runtimes, harness boundaries, and closure review workflow.
Home Manager and system boundary records which layer owns login shells, the Nix daemon, containers, device access, antivirus, and Homebrew, plus the read-only operational readiness checks.
Shell surface documents the current interactive startup surface, ownership, and verification.
Codex state documents the one-time defaults seed, the managed guidance files, and secret/mutable ownership.
For this Mac, the manual switch command is:
sudo -H nix run .#darwin-rebuild -- switch --flake .#alex-aarch64-darwinatyrode apply uses nix-darwin on macOS and asks for sudo when system
activation is required.
On Linux, the matching configuration still uses Home Manager directly:
HOME_MANAGER_BACKUP_EXT=backup nix run .#home-manager -- switch --flake .#alex-x86_64-linuxFor Linux desktop machines that need Steam, SteamCMD, and VLC:
HOME_MANAGER_BACKUP_EXT=backup nix run .#home-manager -- switch --flake .#alex-x86_64-linux-desktopYou can also set ATYRODE_HOST=alex-x86_64-linux-desktop before running
atyrode apply on a Linux desktop. Successful atyrode apply and
install.sh apply runs record the active configuration so helper commands only
show what applies to the current setup.
Portable Linux bootstrap profiles resolve the invoking user and canonical home
at activation time; no repository edit is needed when the login name changes.
Fixed machine identities remain in hosts/default.nix and deliberately require
their declared user and home. See Hosts and capabilities.
Add the package to its owning module under home/profiles/, update the checked
package inventory, then run atyrode apply.
Edit darwin/casks.nix, then run atyrode apply on macOS. nix-darwin
generates the matching Brewfile; Homebrew Bundle shows any undeclared state and
asks before removing it during activation.
Edit files in home/shell/ - they're organized by category for easy maintenance.
"Path is not tracked by Git" error:
cd ~/nix-dotfiles
git add <file>
atyrode applyNote: Nix flakes require referenced files to be tracked by Git. After adding new files, run git add <file> before atyrode apply.
Nix not found after install:
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
# Or restart your terminalHome Manager switch fails:
# Check if all files are tracked
git status
atyrode applyIf an existing path such as ~/.zshrc would be clobbered, inspect it, preserve
anything still used in ~/.config/zsh/local.zsh, then move the old entrypoint
out of the way. Home Manager refuses to guess whether unmanaged shell startup
code is safe to replace.
macOS Homebrew activation reports undeclared packages:
Homebrew Bundle lists taps, formulae, or casks absent from the generated
Brewfile and aborts without removing them. Review the reported drift, explicitly
uninstall the entries you intend to retire, then rerun atyrode apply. The first
activation may also ask for administrator authentication.
- macOS or Linux with Nix support
- Git, Bash,
curl,tar, and eithersha256sumorshasumfor a fresh machine - Internet connection (for initial install)
Nix will be installed automatically if not present.