my (very abridged) nix-darwin config

cronjobs.nix

{ pkgs, ... }:
{
  # https://launchd.info
  launchd.user.agents.zhistory-backup = {
    script = ''
      mkdir -p ~/.zhistory-backups
      cp ~/.zhistory ~/.zhistory-backups/.zhistory-$(date '+%Y%m%d%H%M%S')
    '';
    serviceConfig = {
      Label = "io.radex.zhistory-backup";
      RunAtLoad = false;
      StartCalendarInterval = [ { Hour = 16; Minute = 08; } ];
      StandardInPath = "/tmp/zhistory-backup.stdin";
      StandardOutPath = "/tmp/zhistory-backup.stdout";
      StandardErrorPath = "/tmp/zhistory-backup.stderr";
      Nice = 10;
    };
  };
  launchd.user.agents.npm-cache-verify = {
    command = "${pkgs.nodejs_24}/bin/npm cache verify";
    serviceConfig = {
      Label = "io.radex.npm-cache-verify";
      RunAtLoad = false;
      StartCalendarInterval = [ { Hour = 19; Minute = 14; } ];
      StandardInPath = "/tmp/npm-cache-verify.stdin";
      StandardOutPath = "/tmp/npm-cache-verify.stdout";
      StandardErrorPath = "/tmp/npm-cache-verify.stderr";
      Nice = 10;
    };
  };
}

defaults.nix

{ ... }:
{
  system.defaults = {
    NSGlobalDomain = {
      InitialKeyRepeat = 13; # fast
      KeyRepeat = 2;
    };
    finder = {
      AppleShowAllFiles = true;
      ShowStatusBar = true;
      ShowPathbar = true;
      FXRemoveOldTrashItems = true; # remove trash after 30d
      AppleShowAllExtensions = true;
      FXPreferredViewStyle = "clmv"; # columns
      FXEnableExtensionChangeWarning = false;
      _FXSortFoldersFirst = true;
      FXDefaultSearchScope = "SCcf"; # current folder by default
    };
  };
  system.defaults.CustomUserPreferences = {
    NSGlobalDomain = {
      WebKitDeveloperExtras = true; # always allow web inspector
    };
    # using defaults.CustomUserPreferences."com.apple.dock" instead of defaults.dock
    # to avoid killing dock on every darwin switch
    "com.apple.dock" = {
      autohide = true;
      tilesize = 72;
      magnification = true;
      largesize = 128;
      autohide-delay = 0.0;
      autohide-time-modifier = 0.3;
      show-recents = false;
    };
    "com.apple.desktopservices" = {
      # Avoid creating .DS_Store files on network or USB volumes
      DSDontWriteNetworkStores = true;
      DSDontWriteUSBStores = true;
    };
    "com.apple.screencapture" = {
      location = "~/Downloads";
    };
    "com.apple.Safari" = {
      UniversalSearchEnabled = false; # don't search send queries to apple
      SuppressSearchSuggestions = true;
      WebKitTabToLinksPreferenceKey = true; # tab to highlight
      ShowFullURLInSmartSearchField = true;
      AutoOpenSafeDownloads = false; # security
      IncludeInternalDebugMenu = true;
      IncludeDevelopMenu = true;
      WebKitDeveloperExtrasEnabledPreferenceKey = true;
    };
    "com.apple.mail" = {
      DisableInlineAttachmentViewing = true; # just icons
    };
    "com.apple.AdLib" = {
      allowApplePersonalizedAdvertising = false;
    };
    "com.apple.SoftwareUpdate" = {
      AutomaticCheckEnabled = true;
      ScheduleFrequency = 1; # daily
      AutomaticDownload = 1; # bg download
      CriticalUpdateInstall = 1; # security updates
    };
    "com.apple.TimeMachine".DoNotOfferNewDisksForBackup = true;
    "com.apple.ImageCapture".disableHotPlug = true;
  };
}

homebrew.nix

{ ... }:
{
  homebrew = {
    enable = true;
    onActivation.cleanup = "uninstall"; # force all homebrew usage to be via nix
    taps = [
      "riscv-software-src/riscv"
    ];
    brews = [
      "weasyprint"
      "pyenv"
      "n"
      "mas"
      "riscv-software-src/riscv/riscv-tools"
    ];
    # NOTE: macOS GUI apps shall be managed via casks, not nix, even where available (arq, 1p)
    # Rationale: 1) casks are more up to date; 2) casks have uninstall/zap logic, nix does not
    casks = [
      "discord"
      "firefox"
      "google-chrome"
      "rectangle"
      "1password"
      "alfred@4"
      "karabiner-elements"
      "libreoffice"
      # --- system administration
      "iterm2"
      "winbox"
      "archaeology" # inspect plist/x.509/apple-proprietary formats
      "arq"
      "balenaetcher"
      "daisydisk" # would be nice to replace with TUI, but `dua` seems much slower
      "ukelele"
      # --- work
      "selfcontrol"
      "nozbe"
      "slack"
      # --- manufacturing
      "prusaslicer"
      "bambu-studio"
      # "lightburn" # need specific version for licensing reasons
      # --- development
      "fork"
      "pgadmin4" # is shit, try a TUI instead? https://github.com/jorgerojas26/lazysql https://github.com/TaKO8Ki/gobang
      "dash@6"
      # --- electronics
      "kicad"
      "saleae-logic"
      # --- image/video
      "imageoptim"
      "imagealpha"
      "handbrake-app"
    ];
    caskArgs = {
      no_quarantine = true;
    };
    masApps = {
      "iA Writer" = 775737590;
      "Keynote" = 409183694;
      "Numbers" = 409203825;
      "Pages" = 409201541;
      "Sip" = 507257563;
      "Soulver 2" = 413965349;
      "Tailscale" = 1475387142; # TODO: move to cask/nix?
    };
  };
}

symlinks.nix

{ pkgs, lib, config, ... }:
{
  # systemd.tmpfiles for the poor
  # also, I want to manage some config outside nix because I'm lazy / don't wanna convert syntax
  # just for the sake of nixification / easier to make some changes without system rebuild (and I
  # can use git for rollbacks if needed)
  system.activationScripts.configSymlinks.text = let
    home = "/Users/radex";
    repo = "${home}/warzywa";

    # [source target] pairs
    symlinks = [
      ["${repo}/config/git/gitconfig" "${home}/.gitconfig"]
      ["${repo}/config/ssh-config" "${home}/.ssh/config"]
    ];

    mkSymlinkCmd = link: let
      source = builtins.elemAt link 0;
      target = builtins.elemAt link 1;
    in ''
      if [ -L "${target}" ]; then
        rm "${target}"
      elif [ -e "${target}" ]; then
        echo "symlinks: backing up existing file at ${target}..."
        mv "${target}" "${target}.backup-$(date +%Y%m%d-%H%M%S)"
      fi
      echo "create symlinks ${source} -> ${target}"
      mkdir -p "$(dirname "${target}")"
      ln -sfn "${source}" "${target}"
    '';

  in ''
    ${builtins.concatStringsSep "\n" (map mkSymlinkCmd symlinks)}
  '';

  system.activationScripts.extraActivation.text = lib.mkAfter ''
    ${config.system.activationScripts.configSymlinks.text}
  '';
}