{"slug": "show-hn-an-aui-for-nix-darwin", "title": "Show HN: An AUI for Nix-Darwin", "summary": "NixMC, a native macOS app for managing nix-darwin configurations, allows users to describe desired changes in plain English and apply them via Claude Code or Codex CLI. The app validates configurations, shows diffs before activation, and supports team-shared recipe catalogs and declarative Mac hardening.", "body_md": "Manage your Mac by describing the change you want.\n\nNixMC is a native macOS app for managing a nix-darwin configuration with Claude Code or Codex CLI. Ask it to install an app, change a macOS setting, configure your shell, enable a service, or update your packages. nixmc prepares the edit, validates the configuration, and shows you the diff before anything is applied.\n\n**My Team** turns a Git repository of Markdown recipes into a shared, curated\ncatalog for everyone on the team. Connect it once in the app and nixmc fetches\nthe latest recipes without mixing them into your personal configuration repo.\n\nNixMC started as a way to share useful Mac configuration with coworkers without asking everyone to give up the aliases, tools, and muscle memory that make their own setup work. Recipes turn a configuration into searchable, living documentation: you can find what an alias does, reuse a proven choice, or adapt it to a different workflow. Updates are isolated into reviewable proposals, so keeping a workstation current never quietly changes the configuration you rely on every day.\n\n- Plain-English changes to apps, tools, services, fonts, shell, and macOS settings\n- Build validation and a complete diff before activation\n- Claude Code and Codex CLI support with a selectable preferred agent\n**My Team:** a separately managed Git-backed recipe catalog your whole team can share- Git-backed history with inspect and rollback actions\n- Plain-English guides generated from the configuration currently in use\n- Source-backed recipes with Nix and shell examples for common macOS changes\n- Pareto Security recommended-posture recipe for declarative Mac hardening\n- Replacement Mac recipe to capture and reproduce a setup on a new machine\n- Background flake-update proposals that wait for your approval\n\n| Area | What you get |\n|---|---|\n| Apps & CLI tools | Add or remove Homebrew casks and formulae from one package browser |\n| macOS configuration | Manage defaults, fonts, services, security, and system behavior |\n| Mac security | Apply Pareto Security's recommended posture without weakening macOS protections |\n| New Mac setup | Use the Replacement Mac recipe to capture a setup and reproduce it on the next Mac |\n| Agent workflow | Describe a result and let the selected coding agent prepare the edit |\n| My Team | Fetch a hand-curated Git repository of shared recipes, refreshed hourly and on demand |\n| Review & apply | Format, build, inspect the diff, then activate with administrator approval |\n| Configuration guide | Browse a readable explanation of what each configuration area does today |\n| Updates | Check flake inputs automatically and review isolated update proposals |\n| History | Inspect applied changes and roll back an earlier Git commit |\n| Appearance | Choose light, dark, or system appearance and a preferred accent palette |\n\n- Describe the result you want or choose a recipe.\n- The selected agent edits the configuration repository.\n- nixmc formats and builds the configuration.\n- Review the generated diff and build output.\n- Apply the change; nixmc activates it and records it in Git.\n\nThe agent runs non-interactively with permission to edit the configuration. Always review the proposed diff before applying it.\n\nmacOS hardening is easy to get wrong when settings are spread across System\nSettings, command-line tools, and undocumented defaults. Choose **Pareto\nSecurity recommended posture** from the Security & Secrets recipes to apply the\ncore recommendations declaratively: firewall and stealth mode, screen locking,\nsoftware updates, AirDrop discovery, and the security-sensitive sharing\nservices. The recipe keeps macOS protections intact, includes the Pareto\nSecurity cask, and leaves any change visible in the normal build-and-diff\nreview before it is applied.\n\nYour configuration is a Git repository, so it can travel with you. Use the\n**Replacement Mac** recipe to capture non-default macOS settings, Homebrew\napps, shell tools, and launch agents in the flake. On the new Mac, clone that\nsame repository during first run, build it, review the diff, and apply it to\nrecreate the setup you chose—without having to remember every preference or\nrebuild it from one-off setup commands.\n\n- People who want the reproducibility of nix-darwin without editing every Nix option by hand\n- Mac users who prefer reviewing a concrete diff over running one-off setup commands\n- Existing Nix users who want a focused interface for daily configuration changes\n\n- macOS 14 or newer\n- An administrator account on the Mac\n[Claude Code](https://code.claude.com/docs)available on your shell path, or[Codex CLI](https://developers.openai.com/codex/cli/)installed at`~/.local/bin/codex`\n\n- The selected coding agent signed in before nixmc is opened\n\nInstall Nix yourself before first use. NixMC links to Determinate's graphical installer for the familiar roughly five-minute macOS setup, but never downloads or runs an installer on your behalf. It uses the agent CLI already installed on the Mac, so no AI API key is entered into NixMC.\n\nCheck [Releases](https://github.com/dz0ny/nixmc/releases) for a signed\n`nixmc.dmg`\n\n. Open the disk image and move `nixmc.app`\n\nto Applications.\n\nIf no signed release is listed, build the current version locally:\n\n```\ngit clone https://github.com/dz0ny/nixmc.git\ncd nixmc\nmake app\nopen dist/nixmc.app\n```\n\n- If prompted, install Nix with the linked graphical installer, then return to NixMC and choose\n**Check Again**. - Create the initial nix-darwin configuration, or clone an existing remote dotfiles repository that contains\n`flake.nix`\n\n. - Open\n**Settings > General** and choose Claude Code or Codex CLI. - Describe a change in the message field or choose a recipe.\n- Review the diff and build result, then select\n**Apply**.\n\nInitial setup asks for administrator approval to create the canonical\n`/etc/nix-darwin`\n\nlink. Applying system changes also requires administrator\napproval.\n\nCreating a configuration starts from nixmc's small nix-darwin + Home Manager\ntemplate. It tracks `nixpkgs-unstable`\n\nintentionally: a Mac workstation needs\ncurrent applications, developer tools, and macOS support more often than a\nlong-lived server does. This does not make each build unpinned—the generated\n`flake.lock`\n\nrecords the exact revisions in use, so a known configuration can\nalways be reproduced. `nix-darwin`\n\nand Home Manager follow that same pinned\n`nixpkgs`\n\nrevision.\n\nnixmc updates those pins as a reviewable change. When automatic update checks\nare enabled (or when you check manually), it creates an isolated Git worktree,\nruns `nix flake update`\n\n, commits the resulting lock-file change, and verifies\nit with `darwin-rebuild build`\n\n. It then presents the diff as an update proposal.\nChoosing **Stage for review** stages that proposal in your configuration repository; you\nstill review the diff and use **Build & Apply** to activate it. Dismissing a\nproposal leaves your live configuration untouched.\n\nThere is one supported source of configuration: the single Git-backed flake\nthat nixmc manages. New configurations live at `~/.config/nixmc/darwin`\n\n, with\n`/etc/nix-darwin`\n\nlinked to it; if you already have a flake at\n`/etc/nix-darwin`\n\n, nixmc uses that repository instead. Make system, user, and\nHomebrew changes in this one repository through nixmc so the build, diff,\nhistory, rollback, and update workflow all describe the same machine. Do not\nmaintain a second nix-darwin configuration alongside it.\n\n| Permission | Why it is needed |\n|---|---|\n| Administrator approval | Create `/etc/nix-darwin` and activate system changes |\n| App Management | Allow Homebrew to update managed app bundles in `/Applications` |\n\nIf apply fails with `Operation not permitted`\n\nwhile processing an app bundle,\nopen **System Settings > Privacy & Security > App Management**, allow nixmc,\nthen apply again.\n\nThe Git-backed configuration lives at:\n\n```\n~/.config/nixmc/darwin\n```\n\nHomebrew packages are declared in:\n\n```\n~/.config/nixmc/darwin/.nixmc/homebrew/data.json\n```\n\nApplied changes are committed automatically so the History section can show diffs and roll back earlier changes.\n\nOpen **My Team** in the sidebar and paste a GitHub repository URL. nixmc keeps\nan independent shallow checkout at `~/.nixmc/team-recipes`\n\n, fetches it hourly,\nand refreshes it when the page is opened. This catalog is intentionally kept\noutside `~/.config/nixmc/darwin`\n\n, so team recipe updates never alter your\nconfiguration history.\n\nPut recipe Markdown anywhere in that repository. Use descriptive file names\nand include `title`\n\n, `section`\n\n, and `summary`\n\nfront matter; the app discovers\nfiles recursively and groups all of them under **My Team**. Start from the\n[example recipe](https://github.com/dz0ny/nixmc/blob/main/Sources/nixmc/Resources/recipes/ai-agents/codex.md).\n\nA root-level `GUIDE.md`\n\nis also supported. nixmc displays that team-authored\nguide verbatim in the **My Team > Guide** tab and includes it in global search.\n\nBuilt-in recipes live under\n`Sources/nixmc/Resources/recipes/<section>/<title>.md`\n\n. They are bundled with\nthe app and grouped by the same areas shown in the sidebar. The front matter\ndrives the UI; the Markdown body is passed to the selected agent and may contain\nexact Nix snippets, shell commands, or a focused diff.\n\nRecipe pull requests are welcome in\n[the recipes folder](https://github.com/dz0ny/nixmc/tree/main/Sources/nixmc/Resources/recipes),\nespecially for well-tested macOS, nix-darwin, and Home Manager workflows with a\nsource link and a concise guide section.\n\n```\n---\nid: touch-id-sudo\ntitle: Enable Touch ID for sudo\nsection: Security & Secrets\nsymbol: touchid\nsummary: Add the supported PAM rule for Touch ID authentication in Terminal.\nfeatured: true\nsource: https://github.com/nix-darwin/nix-darwin\n---\n\n``` nix\nsecurity.pam.services.sudo_local.touchIdAuth = true;\n", "url": "https://wpnews.pro/news/show-hn-an-aui-for-nix-darwin", "canonical_source": "https://github.com/dz0ny/nixmc", "published_at": "2026-07-15 13:12:44+00:00", "updated_at": "2026-07-15 13:17:56.009740+00:00", "lang": "en", "topics": ["developer-tools", "ai-tools", "ai-agents"], "entities": ["NixMC", "Claude Code", "Codex CLI", "Pareto Security", "Homebrew", "Git"], "alternates": {"html": "https://wpnews.pro/news/show-hn-an-aui-for-nix-darwin", "markdown": "https://wpnews.pro/news/show-hn-an-aui-for-nix-darwin.md", "text": "https://wpnews.pro/news/show-hn-an-aui-for-nix-darwin.txt", "jsonld": "https://wpnews.pro/news/show-hn-an-aui-for-nix-darwin.jsonld"}}