nixos-config

NixOS configuration designed for autonomous AI coding -- declarative system state
that AI agents can reason about, kernel-level sandboxing for safe unattended
execution, and atomic rollbacks when things go wrong.

Why NixOS for AI agents

What this gives you

Autonomous AI coding with isolation

# Launch Claude Code in a sandboxed git worktree with auto-retry loop
./scripts/claude-autonomous.sh my-repo feature/add-auth "implement OAuth2 login"

This creates an isolated worktree, launches Claude with --dangerously-skip-permissions
in tmux, and runs up to 5 iterations with fresh context each pass. Native sandbox
(bubblewrap + seccomp BPF) activates automatically -- spawned processes inherit
the sandbox, no escape via bash -c or subprocess chains.

If something goes wrong: nixos-rebuild switch --rollback. Done.

Multi-machine, one repo

Two helper functions -- mkTechHost and mkBusinessHost -- compose the right
modules for each role:

                     hosts/common/base.nix
                     (bootloader, nix, locale, GNOME, Docker)
                            |
               +------------+------------+
               v                         v
      mkTechHost(...)           mkBusinessHost(...)
               |                         |
    350+ packages, full           ~40 packages, office
    AI toolchain, Fish 60+        + learning-to-code
    abbreviations                 simplified shell

Adding a machine is one line:

my-host = mkTechHost { hostname = "my-host"; username = "me"; };

Business machines deploy remotely via custom live ISO + RustDesk -- the end
user never touches a terminal. See INSTALL.md for the full
walkthrough.

AI toolchain (all as flake inputs)

Every tool pinned, reproducible, and auto-updated via CI:

• Claude Code -- Primary agent (via claude-code-nix)
• Cursor -- AI editor (via code-cursor-nix)
• Antigravity -- Google's agentic IDE (via antigravity-nix)
• Whisper Dictation -- Local speech-to-text (via whisper-dictation)
• ClawNix -- Self-evolving AI agent platform (via clawnix)

Supply chain hardening

8-layer verification built into rebuild-nixos:

./rebuild-nixos --audit          # Export fixed-output derivation manifest
./rebuild-nixos --verify-bootstrap  # Deep reproducibility check (xz, gzip, coreutils)

NPM tools version-pinned in modules/core/npm-versions.nix. Reproducibility
tracked against r13y.com.

Tested and CI'd

Unusual for a dotfiles repo:

• ShellCheck on all shell scripts
• BATS unit tests for rebuild-nixos
• GitHub Actions on every push
• Automated security scanning and dependency updates

Quick start

git clone https://github.com/jacopone/nixos-config.git ~/nixos-config
cd ~/nixos-config

# For an existing NixOS machine with flakes:
./rebuild-nixos

# For a new machine, see the full guide:
# INSTALL.md covers fresh install, Framework 16, remote business deploy

Repository structure

nixos-config/
├── flake.nix                     # Entry point + mkTechHost/mkBusinessHost
├── rebuild-nixos                 # Multi-phase rebuild with safety checks
├── hosts/
│   ├── common/base.nix           # Shared foundation (boot, nix, GNOME, Docker)
│   ├── tech-001/                 # Framework 16 (AMD Ryzen AI + NVIDIA RTX 5070)
│   ├── biz-001/, biz-002/        # Business workstations
│   └── business-template/        # Template for new deployments
├── modules/
│   ├── core/packages.nix         # System packages (350+)
│   ├── business/                 # Business profile (packages, shell, HM)
│   ├── hardware/                 # Framework 16, ThinkPad, MacBook modules
│   └── home-manager/             # Fish, Kitty, Yazi, dev tools
├── overlays/                     # Custom package overlays
├── scripts/                      # claude-autonomous.sh, rebuild helpers
├── tests/bash/                   # BATS unit tests
├── docs/                         # Guides, architecture, tool configs
└── .github/workflows/            # CI: tests, security, dependency updates

Related repositories

License

MIT