· Administer NixOS/Nix: flakes, home-manager, nix-darwin, generations, overlays, disko. Triggers: 'nixos', 'nix', 'flake', 'home-manager', 'configuration.nix', 'nixos-rebuild'. Not for other distros.
Instalación
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
· Administer NixOS/Nix: flakes, home-manager, nix-darwin, generations, overlays, disko. Triggers: 'nixos', 'nix', 'flake', 'home-manager', 'configuration.nix', 'nixos-rebuild'. Not for other distros.
license
MIT
compatibility
Requires NixOS, or Nix/Determinate Nix/Lix on Linux/macOS/WSL
Administer NixOS without falling back into imperative distro muscle memory. NixOS is
declarative, functional, and atomic: the system is a value computed from a configuration,
every change becomes a new immutable generation in /nix/store, and rollbacks are a
bootloader entry away. This skill keeps that model intact, then layers in the practical
stack: channels vs flakes, nixos-rebuild vs nix CLI, home-manager, nix-darwin, store
hygiene, overlays, module writing, secrets, and the Determinate Nix and Lix lanes.
The places NixOS breaks are NixOS-shaped: channel drift, flake input staleness, garbage
collection that nukes a needed derivation, overlays fighting, nix-env -i poisoning the
user profile, hardware modules missing, or people treating /etc/nixos/configuration.nix
like a normal Linux config file.
Why people run it. Atomic upgrades and rollbacks, bit-for-bit reproducible systems,
disposable dev shells, fleet-wide configuration without a separate config-management tool,
and a single language for a workstation, a server, a container image, a NixOS VM, and a
macOS laptop via nix-darwin.
Versions worth pinning (verified June 2026):
Pin versions only when they shape compatibility or troubleshooting. For ordinary package
work, trust the live channel or flake lock over a stale table.
Component
Version or date
Why it matters
NixOS stable
26.05 "Yarara" (May 2026)
current stable, released 2026-05-30, maintained until 2026-12-31
Lix lane: fork-specific behavior, coexistence, and migration notes
Integration with Docker, Kubernetes, and CI: nix build, image outputs, cachix, attic
When NOT to use
Arch or CachyOS administration - use arch-btw
Debian, Ubuntu, Mint, or Pop!_OS administration - use debian-ubuntu
Fedora, RHEL, CentOS Stream, Rocky, or Alma administration - use rhel-fedora
Kali Linux and offensive-tool distros - use kali-linux
Shell syntax, quoting, or portability outside Nix expressions - use command-prompt
Docker, Podman, image builds, or container runtime issues - use docker
Kubernetes cluster or manifest work - use kubernetes
Fleet-wide non-Nix Linux configuration via playbooks - use ansible
Terraform or OpenTofu infrastructure code - use terraform
CI/CD pipeline design for Nix-based builds (cachix push, build farm, pipeline stages) - use ci-cd
Offensive or privesc testing - use lockpick
Defensive hardening and vuln review - use security-audit
OPNsense or pfSense appliance work - use firewall-appliance
AI Self-Check
Before returning NixOS or Nix commands, verify:
Lane identified: NixOS install, Nix on non-NixOS Linux, Nix on macOS (nix-darwin or plain Nix), WSL, Determinate Nix, or Lix. Advice diverges fast.
Channels vs flakes decided: confirm which the user has before prescribing nix-channel, nixos-rebuild --flake, or nix flake update. Mixing without intent creates channel-lock drift.
Flake status is current: flakes remain nominally experimental on upstream Nix but are enabled by default on Determinate Nix; recommend enabling experimental-features = nix-command flakes where the user is already using flakes.
nix-env -i is not the answer: installing into the per-user profile hides state from configuration.nix and breaks reproducibility. Use declarative environment.systemPackages, home.packages, or an ad-hoc nix shell instead.
No partial upgrade advice: on flakes-based systems, do not bump a single input without running nixos-rebuild --flake after; on channels, do not change only nixos without updating dependent channels too.
Rebuild verb is intentional: switch, test, boot, dry-activate, build-vm, and build differ. test does not persist the boot entry; boot does not activate now; switch does both.
Known-good generation preserved: never remove the last known-good generation, and never nix-collect-garbage -d on a system that just booted a new generation without verifying the new one survives a reboot.
GC roots respected: dev shells, direnv caches, and CI artifacts often hold GC roots. Do not recommend aggressive GC without checking nix-store --gc --print-roots first.
Unfree / insecure gates named explicitly: set nixpkgs.config.allowUnfree = true; or allowUnfreePredicate, and list insecure packages under permittedInsecurePackages. Do not default to NIXPKGS_ALLOW_UNFREE=1 as the permanent answer.
Hardware module present: for fresh installs, hardware-configuration.nix must be regenerated with nixos-generate-config and not hand-edited for filesystem UUIDs. For laptops, check nixos-hardware profile.
Kernel and initrd coherence: boot.kernelPackages, initrd modules, filesystems, and bootloader agree. Do not casually swap kernels on a system with ZFS, NVIDIA, or custom out-of-tree modules.
Module fields real: options named in advice exist in the version of nixpkgs the user has. options graveyards drift between 24.05, 24.11, 25.05, 25.11, and 26.05 - verify against the nixpkgs tag the user pinned.
Secrets not put in the store: anything under ./secret.age, ./sops.yaml, or similar must be decrypted at activation time by sops-nix or agenix, not embedded directly in a Nix string that ends up world-readable in /nix/store.
disko / impermanence claims match the install: declarative disk layouts change the recovery story. Confirm partition, filesystem, and subvolume layout before prescribing rollback or wipe steps.
home-manager mode identified: standalone, NixOS module, or nix-darwin module. home-manager switch vs nixos-rebuild switch vs darwin-rebuild switch is not interchangeable.
Overlay placement sane: overlays belong in nixpkgs.overlays (NixOS) or as a flake input overlay. Do not recommend global ~/.config/nixpkgs/overlays.nix on a flakes system where that path is often ignored.
Determinate / Lix advice scoped: Determinate's determinate-nixd and Lix's CLI diverge from upstream in subtle places. Name the lane before suggesting daemon or CLI flags.
Diagnostic errors are not silenced: do not hide useful output with 2>/dev/null when the error text is the evidence. Use 2>&1 || true when gathering.
Version pins justified: if a pinned system.stateVersion is suggested, explain why; do not change stateVersion on an existing system casually - it controls migration semantics.
Current source checked: dated versions, CLI flags, API names, and support windows are verified against primary docs before repeating them
Hidden state identified: local config, credentials, caches, contexts, branches, cluster targets, or previous runs are made explicit before acting
Verification is real: final checks exercise the actual runtime, parser, service, or integration point instead of only linting prose or happy paths
Routing overlap checked: overlapping skills, trigger terms, and "When NOT to use" boundaries are checked before returning guidance
Spec claims verified: claims about tool behavior, output contracts, or repo conventions are checked against current docs, scripts, or skill files
When a problem looks "flake-only," compare one clean baseline:
delete flake.lock and re-lock, or
roll one input back to its previous rev via nix flake lock --override-input, or
build the same output on another machine with the same flake.lock to isolate hardware vs config.
Default Decisions
Declarative first.nix-env -i, nix profile install, and one-off nixpkgs.config tweaks are escape hatches, not workflows. If it survives across rebuilds, it belongs in the config.
Flakes when the user already has them. Do not migrate users off channels mid-troubleshoot. Do not migrate users onto flakes without naming tradeoffs (still experimental upstream, lockfile commits become a habit, registry overrides differ).
Generations are the rollback. Before debugging, confirm the previous generation boots. That is cheaper than chasing ghosts.
Store hygiene is boring and scheduled. Enable nix.gc.automatic and nix.settings.auto-optimise-store = true; rather than manual sweeps.
home-manager has three modes. Standalone, NixOS module, nix-darwin module. Pick one per host and stay there.
nix-darwin is opinionated. macOS system settings, LaunchDaemons, and Homebrew coexistence are what it owns. Do not treat it like NixOS with a different kernel.
Disko and impermanence are declarative recovery. They shine on fresh installs and nixos-anywhere deploys; retrofitting them onto a live system is a different, harder problem.
Secrets never go in the store. Use sops-nix or agenix with activation-time decryption.
Pick Determinate or Lix intentionally. Both are fine; both add behavior that diverges from upstream Nix in small but real ways. Name the lane.
Kernel changes are cross-layer. ZFS, NVIDIA, hardened kernel, and custom initrd modules all interact. Do not swap boot.kernelPackages casually.
Quick Triage Checklist
Symptom
First checks
nixos-rebuild evaluation error
--show-trace, check option name against the current nixpkgs tag, check imports paths
Build fails mid-derivation
--print-build-logs, check sandbox violations, check unfree or insecure gates
Boot drops to emergency shell
previous generation from bootloader menu, check hardware-configuration.nix, LUKS, kernel modules
Flake input won't update
nix flake update <name> (the nix flake lock --update-input form is deprecated on Nix 2.30+), check inputs.<x>.follows, check registry override
references/gotchas-and-special-situations.md - recurring NixOS and Nix failure patterns and edge cases
Output Contract
See references/output-contract.md for the full contract.
Skill name: NIXOS-BTW
Deliverable bucket:audits
Mode: conditional. When invoked to analyze, review, audit, or improve existing repo content, emit the full contract - boxed inline header, body summary inline plus per-finding detail in the deliverable file, boxed conclusion, conclusion table - and write the deliverable to docs/local/audits/nixos-btw/<YYYY-MM-DD>-<slug>.md. When invoked to answer a question, teach a concept, build a new artifact, or generate content, respond freely without the contract.
Severity scale:P0 | P1 | P2 | P3 | info (see shared contract; only used in audit/review mode).
Related Skills
arch-btw - Arch and CachyOS administration. Use it when the host is Arch-family and Nix is a side tool, not the system.
debian-ubuntu - Debian-family administration. Use it when Nix runs on Debian/Ubuntu as a user-level package manager only.
rhel-fedora - RHEL-family administration. Use it when Nix runs on Fedora/RHEL as a user-level package manager only.
kali-linux - Kali distro workflow. Use it for Kali, not for Nix inside Kali.
command-prompt - shell syntax, aliases, and one-liners outside Nix expressions.
docker - container runtime and image concerns. This skill builds images with dockerTools; docker runs them.
kubernetes - cluster workloads once the build output leaves Nix.
ansible - fleet config management when Nix is not the chosen tool for the job.
terraform - IaC for cloud resources that host NixOS VMs; this skill owns the guest.
security-audit - defensive review of a Nix-built artifact.
ci-cd - pipeline design when the CI side of a Nix build (cachix push, remote builders, pipeline stages) is the primary concern.
lockpick - offensive and privesc testing; this skill covers NixOS administration, not exploitation.
firewall-appliance - OPNsense/pfSense appliance work; this skill covers NixOS-based hosts, not BSD appliances.
update-docs - sync docs after substantial module or flake restructuring.
Rules
Identify the Nix lane before prescribing commands. NixOS vs Nix-on-host, channels vs flakes, Determinate vs upstream vs Lix, standalone vs module home-manager - all change the answer.
Declarative beats imperative. If the fix is nix-env -i, reach for environment.systemPackages, home.packages, or nix shell instead. Hidden profile state is a footgun.
Know the rebuild verb.switch, test, boot, dry-activate, build-vm, and build are not interchangeable. test does not persist across reboot; boot does not activate now.
Preserve a known-good generation. Never GC aggressively right after a rebuild. Boot the new generation twice before pruning.
Flakes are intentional. Enable nix-command flakes where the user already uses them; do not push migration during troubleshooting.
GC roots are real state. Dev shells, direnv caches, and CI pins hold them. Check before mass deletion.
Secrets never in the store. Use sops-nix or agenix with activation-time decryption; anything else ends up world-readable in /nix/store.
Module options must exist in the user's nixpkgs tag. 24.05/24.11/25.05/25.11/26.05 drift is real; confirm with nix repl or the options search before recommending.
Overlays compose, not mutate.final: prev: { ... } scope. Do not recommend global profile-level overlays on flake systems.
Kernel and initrd agree. Do not flip boot.kernelPackages on ZFS, NVIDIA, or custom-module systems without a fallback.
Do not touch system.stateVersion casually. It controls migration semantics and is not a "version bump" field.
Disko and impermanence are install-time decisions. Retrofit is a different, harder conversation.
home-manager mode is sticky. Pick standalone, NixOS module, or darwin module per host and stay there.
Determinate and Lix diverge at the edges. Name the lane before suggesting daemon or CLI flags.
Reach for common Nix failure patterns before exotic explanations. Channel/flake mixing, stale lock, overlay collision, option drift, GC of an active dev shell, and unfree/insecure gates explain a large share of the chaos.
