Show HN: An AUI for Nix-Darwin NixMC, a native macOS app for managing nix-darwin configurations, allows users to describe desired changes in plain English and apply them via Claude Code or Codex CLI. The app validates configurations, shows diffs before activation, and supports team-shared recipe catalogs and declarative Mac hardening. Manage your Mac by describing the change you want. NixMC is a native macOS app for managing a nix-darwin configuration with Claude Code or Codex CLI. Ask it to install an app, change a macOS setting, configure your shell, enable a service, or update your packages. nixmc prepares the edit, validates the configuration, and shows you the diff before anything is applied. My Team turns a Git repository of Markdown recipes into a shared, curated catalog for everyone on the team. Connect it once in the app and nixmc fetches the latest recipes without mixing them into your personal configuration repo. NixMC started as a way to share useful Mac configuration with coworkers without asking everyone to give up the aliases, tools, and muscle memory that make their own setup work. Recipes turn a configuration into searchable, living documentation: you can find what an alias does, reuse a proven choice, or adapt it to a different workflow. Updates are isolated into reviewable proposals, so keeping a workstation current never quietly changes the configuration you rely on every day. - Plain-English changes to apps, tools, services, fonts, shell, and macOS settings - Build validation and a complete diff before activation - Claude Code and Codex CLI support with a selectable preferred agent My Team: a separately managed Git-backed recipe catalog your whole team can share- Git-backed history with inspect and rollback actions - Plain-English guides generated from the configuration currently in use - Source-backed recipes with Nix and shell examples for common macOS changes - Pareto Security recommended-posture recipe for declarative Mac hardening - Replacement Mac recipe to capture and reproduce a setup on a new machine - Background flake-update proposals that wait for your approval | Area | What you get | |---|---| | Apps & CLI tools | Add or remove Homebrew casks and formulae from one package browser | | macOS configuration | Manage defaults, fonts, services, security, and system behavior | | Mac security | Apply Pareto Security's recommended posture without weakening macOS protections | | New Mac setup | Use the Replacement Mac recipe to capture a setup and reproduce it on the next Mac | | Agent workflow | Describe a result and let the selected coding agent prepare the edit | | My Team | Fetch a hand-curated Git repository of shared recipes, refreshed hourly and on demand | | Review & apply | Format, build, inspect the diff, then activate with administrator approval | | Configuration guide | Browse a readable explanation of what each configuration area does today | | Updates | Check flake inputs automatically and review isolated update proposals | | History | Inspect applied changes and roll back an earlier Git commit | | Appearance | Choose light, dark, or system appearance and a preferred accent palette | - Describe the result you want or choose a recipe. - The selected agent edits the configuration repository. - nixmc formats and builds the configuration. - Review the generated diff and build output. - Apply the change; nixmc activates it and records it in Git. The agent runs non-interactively with permission to edit the configuration. Always review the proposed diff before applying it. macOS hardening is easy to get wrong when settings are spread across System Settings, command-line tools, and undocumented defaults. Choose Pareto Security recommended posture from the Security & Secrets recipes to apply the core recommendations declaratively: firewall and stealth mode, screen locking, software updates, AirDrop discovery, and the security-sensitive sharing services. The recipe keeps macOS protections intact, includes the Pareto Security cask, and leaves any change visible in the normal build-and-diff review before it is applied. Your configuration is a Git repository, so it can travel with you. Use the Replacement Mac recipe to capture non-default macOS settings, Homebrew apps, shell tools, and launch agents in the flake. On the new Mac, clone that same repository during first run, build it, review the diff, and apply it to recreate the setup you chose—without having to remember every preference or rebuild it from one-off setup commands. - People who want the reproducibility of nix-darwin without editing every Nix option by hand - Mac users who prefer reviewing a concrete diff over running one-off setup commands - Existing Nix users who want a focused interface for daily configuration changes - macOS 14 or newer - An administrator account on the Mac Claude Code https://code.claude.com/docs available on your shell path, or Codex CLI https://developers.openai.com/codex/cli/ installed at ~/.local/bin/codex - The selected coding agent signed in before nixmc is opened Install Nix yourself before first use. NixMC links to Determinate's graphical installer for the familiar roughly five-minute macOS setup, but never downloads or runs an installer on your behalf. It uses the agent CLI already installed on the Mac, so no AI API key is entered into NixMC. Check Releases https://github.com/dz0ny/nixmc/releases for a signed nixmc.dmg . Open the disk image and move nixmc.app to Applications. If no signed release is listed, build the current version locally: git clone https://github.com/dz0ny/nixmc.git cd nixmc make app open dist/nixmc.app - If prompted, install Nix with the linked graphical installer, then return to NixMC and choose Check Again . - Create the initial nix-darwin configuration, or clone an existing remote dotfiles repository that contains flake.nix . - Open Settings General and choose Claude Code or Codex CLI. - Describe a change in the message field or choose a recipe. - Review the diff and build result, then select Apply . Initial setup asks for administrator approval to create the canonical /etc/nix-darwin link. Applying system changes also requires administrator approval. Creating a configuration starts from nixmc's small nix-darwin + Home Manager template. It tracks nixpkgs-unstable intentionally: a Mac workstation needs current applications, developer tools, and macOS support more often than a long-lived server does. This does not make each build unpinned—the generated flake.lock records the exact revisions in use, so a known configuration can always be reproduced. nix-darwin and Home Manager follow that same pinned nixpkgs revision. nixmc updates those pins as a reviewable change. When automatic update checks are enabled or when you check manually , it creates an isolated Git worktree, runs nix flake update , commits the resulting lock-file change, and verifies it with darwin-rebuild build . It then presents the diff as an update proposal. Choosing Stage for review stages that proposal in your configuration repository; you still review the diff and use Build & Apply to activate it. Dismissing a proposal leaves your live configuration untouched. There is one supported source of configuration: the single Git-backed flake that nixmc manages. New configurations live at ~/.config/nixmc/darwin , with /etc/nix-darwin linked to it; if you already have a flake at /etc/nix-darwin , nixmc uses that repository instead. Make system, user, and Homebrew changes in this one repository through nixmc so the build, diff, history, rollback, and update workflow all describe the same machine. Do not maintain a second nix-darwin configuration alongside it. | Permission | Why it is needed | |---|---| | Administrator approval | Create /etc/nix-darwin and activate system changes | | App Management | Allow Homebrew to update managed app bundles in /Applications | If apply fails with Operation not permitted while processing an app bundle, open System Settings Privacy & Security App Management , allow nixmc, then apply again. The Git-backed configuration lives at: ~/.config/nixmc/darwin Homebrew packages are declared in: ~/.config/nixmc/darwin/.nixmc/homebrew/data.json Applied changes are committed automatically so the History section can show diffs and roll back earlier changes. Open My Team in the sidebar and paste a GitHub repository URL. nixmc keeps an independent shallow checkout at ~/.nixmc/team-recipes , fetches it hourly, and refreshes it when the page is opened. This catalog is intentionally kept outside ~/.config/nixmc/darwin , so team recipe updates never alter your configuration history. Put recipe Markdown anywhere in that repository. Use descriptive file names and include title , section , and summary front matter; the app discovers files recursively and groups all of them under My Team . Start from the example recipe https://github.com/dz0ny/nixmc/blob/main/Sources/nixmc/Resources/recipes/ai-agents/codex.md . A root-level GUIDE.md is also supported. nixmc displays that team-authored guide verbatim in the My Team Guide tab and includes it in global search. Built-in recipes live under Sources/nixmc/Resources/recipes/