nixos/modules/system/nix/default.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

{ config, pkgs, lib, inputs, ... }:

{
  # Nix itself: enable the flake + nix-command features this config relies on.
  nix.settings.experimental-features = [ "nix-command" "flakes" ];
  nixpkgs.config = {
    allowUnfree = true;
    permittedInsecurePackages = [
      "electron-39.8.10"
    ];
  };

  # Automatic garbage collection — drop builds older than a week.
  nix.gc = {
    automatic = true;
    dates = "weekly";
    options = "--delete-older-than 7d";
  };

  # envfs is the modern replacement for nix-ld: it mounts a FUSE filesystem
  # on /usr/bin and /bin that resolves shebangs (e.g. #!/usr/bin/env) to the
  # executables on the caller's PATH. It supersedes programs.nix-ld entirely.
  services.envfs.enable = true;
  security.polkit.enable = true;

  environment.variables = {
    SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
    NIX_SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
  };
}