Diego’s Dotfiles

My macOS setup using Nix (nix-darwin + Home Manager) + Homebrew. Clean, modular, and pragmatic.

History

These dotfiles have been around since 20xx with thousands of commits over 20+ years*. Recently did a fresh start to clean things up and remove legacy stuff.

Quick Start

Prerequisites: macOS with Apple Silicon, just command runner

# Install just (if not already installed)
brew install just

# Clone the repo
git clone git@github.com:d1egoaz/dotfiles.git ~/dotfiles
cd ~/dotfiles

# Install Nix (Determinate Systems installer with flakes enabled)
just install-nix

# Install nix-darwin (first time setup)
just install-darwin

# Apply configuration (auto-detects your machine based on username)
just switch

Note: Uses nixpkgs 25.11-darwin (stable) for reliability — avoiding constant updates for basic commands.

My Machines

• office-mbp – Office MacBook Pro (user: diego.alvarez)
• personal-mbp — Personal MacBook Air M3 (user: diego)
• personal-mini — Personal Mac Mini M4 (user: diegoalvarez)

All machines use Apple Silicon (aarch64-darwin) and auto-detect based on username.

Key Features

• Shell: Fish & Zsh with Starship prompt
• Terminal: Ghostty, WezTerm
• Editor: Emacs (built from Nix), with custom wrapper
• Window Management: AeroSpace tiling window manager
• Status Bar: SketchyBar with custom plugins
• CLI Tools: ripgrep, fd, bat, jq, yq, eza, and many more
• Dev Tools: Git with SSH signing (via 1Password), GitHub CLI, Docker, kubectl
• Secrets: 1Password CLI for on-demand secret access
• AI Tools: Claude Code with custom agents

Common Commands

just switch        # Apply changes (uses nh if available)
just update        # Update flake inputs
just fmt           # Format Nix code
just check         # Validate configuration
just lint          # Format and check (combines fmt + check)
just gc            # Clean up old generations
just brew          # Update and upgrade Homebrew apps
just dry-run       # Preview changes without applying
just --list        # See all available commands

How It Works

Profiles

Define what gets installed on each machine:

• profiles/base.nix — Shared across all machines
• profiles/office.nix — Work-specific stuff
• profiles/personal.nix — Personal machines

Home Manager

Manages user environment:

• Packages organized in home-manager/packages.nix
• App configs in home-manager/config/
• Mix of Nix modules and real config files for flexibility

Direct config editing (hybrid approach):

Some configs are symlinked directly from the repo for live editing without rebuilds:

• config/sketchybar/ → ~/.config/sketchybar
• config/wezterm/ → ~/.config/wezterm
• config/ghostty/ → ~/.config/ghostty
• config/aerospace/ → ~/.config/aerospace

Edit these directly and changes take effect immediately!

System Config

macOS-specific settings live in systems/darwin/

Custom Scripts

Custom utility scripts in bin/files/ are automatically symlinked to ~/.local/bin/ via Nix:

• Emacs diff tools: ediff, ediff3 — Git merge/diff wrappers
• Kubernetes shortcuts: k, kc, kn, kk, kstern, ktmux — kubectl helpers
• GitHub: pr-approve — PR approval helper

AWS helpers (awsprofile) are sourced directly by Fish config as shell functions.

Secrets

Secrets follow an on-demand model — nothing is exported into every shell at startup.

• 1Password CLI is the source of truth for raw secrets. Fish exposes on-demand aliases (op-cursor, and op-homebrew on office machines); just brew / just update read the Homebrew GitHub token directly from 1Password when needed.
• =op-env-cache= caches 1Password reads on disk (0600, default 8h TTL) for hot paths like the Alfred LLM workflows. The op:// item references it resolves live encrypted in secrets/op-env-cache.yaml under op_env_cache_specs.
• SOPS (age) encrypts secrets/*.yaml; the age key lives at ~/Library/Application Support/sops/age/keys.txt and is backed up in 1Password. Work-only ignored files (Codex work profile, hooks, rules, skills) are persisted as encrypted local_state entries in secrets/local-state.yaml and restored by just switch on office machines; push local edits back with just local-state-sync.

Prerequisites:

brew install 1password-cli

Sign in to 1Password:

eval (op signin)

Adding Stuff

Packages

User packages (installed in home directory):

• Add to relevant profile: nix/profiles/base.nix, nix/profiles/office.nix, or nix/profiles/personal.nix
• Packages are organized in hmPackages list

System packages (available system-wide):

• Add to darwinPackages in the profile files

Config Files

Two approaches:

1. Nix modules — Configure under home-manager/config/programs.nix or app-specific modules
   • Example: programs.git, programs.zsh, programs.bat
   • Managed by Home Manager, changes require just switch
2. Direct files — Drop configs in config/<app>/ and link in home-manager/config/xdg.nix
   • Example: config/sketchybar/, config/wezterm/, config/ghostty/
   • Symlinked directly, changes take effect immediately
   • Use config.lib.file.mkOutOfStoreSymlink for live editing

GUI Apps (via Homebrew)

Add to Brewfile (shared across machines) or Brewfile.<host> (machine-specific):

• Brewfile — Shared apps
• Brewfile.office-mbp — Office machine only
• Brewfile.personal-mbp — Personal MBP only
• Brewfile.personal-mini — Personal Mini only

Then run:

just brew

Troubleshooting

# Build failing? Check and format
just check          # or: cd nix && nix flake check
just fmt            # or: cd nix && nix fmt
just lint           # runs both fmt + check

# Preview changes before applying
just dry-run

# Need to rollback?
darwin-rebuild --rollback

# Or jump to a specific generation
darwin-rebuild --list-generations
darwin-rebuild --switch-generation 23

# Clean up old generations
just gc

# Brew app not showing up in Applications?
brew reinstall --cask <app>

# Secrets not loading?
op whoami  # Check if authenticated
eval (op signin)  # Sign in if needed

Why This Setup?

nix-darwin + Home Manager give you:

• Declarative system configuration
• Easy rollbacks when things break
• Reproducible setup across machines

+ Homebrew for:

• GUI apps that work better through Brew
• Things that need macOS-native integration
• Pragmatic balance between purity and practicality