mac

AGENTS.md

@@ -39,6 +39,8 @@ Prefer the following placements:
 | ---------------------------------------------------- | ------------------------------------------------------- |
 | Nix settings shared by every system host             | `modules/systems/nix/common.nix`                        |
 | NixOS-only boot configuration                        | `modules/systems/boot/.../nixos.nix`                    |
+| macOS Dock defaults                                  | `modules/systems/dock/darwin.nix`                       |
+| macOS trackpad defaults                              | `modules/systems/trackpad/darwin.nix`                   |
 | Ghostty-specific configuration                       | `modules/applications/ghostty/`                         |
 | niri-specific configuration                          | `modules/applications/niri/`                            |
 | Desktop applications shared by GNOME and niri        | `modules/profiles/interface/linux-desktop/meta.nix`     |
@@ -327,6 +329,7 @@ modules/profiles/
 ├── base/
 ├── interface/
 │   ├── cli/
+│   ├── macos/
 │   ├── linux-desktop/
 │   ├── gnome/
 │   └── niri/
@@ -363,10 +366,10 @@ The profile layers have these responsibilities:
   includes only `systems.nix`; optional secrets, interface, hardware, and
   workloads do not belong there.
 - `interface` describes how the host is operated. `interface.cli` is shared by
-  NixOS and macOS and includes `tio`. `interface.linux-desktop` owns the common
+  NixOS and macOS and includes `tio`. `interface.macos` owns the macOS Dock and
-  GNOME/niri desktop selection, including Ghostty, Nautilus, and Vicinae. GNOME
+  trackpad defaults. `interface.linux-desktop` owns the common GNOME/niri
-  and niri remain independently selectable and do not imply CLI or personal
+  desktop selection, including Ghostty, Nautilus, and Vicinae. GNOME and niri
-  workloads.
+  remain independently selectable and do not imply CLI or personal workloads.
 - `platform` describes NixOS foundations and physical or virtual form factors.
   macOS does not need an empty symmetric platform profile.
 - `workload` describes optional host uses. `workload.development` and
@@ -387,7 +390,8 @@ Homebrew casks in `darwin.nix`. Guard a Linux-only Home Manager package with the
 host platform when the same unit also has a Darwin implementation.
 
 An explicitly OS-specific profile is appropriate when the composition itself is
-OS-specific, such as `interface.linux-desktop`, `platform.nixos`, or a NixOS
+OS-specific, such as `interface.macos`, `interface.linux-desktop`,
+`platform.nixos`, or a NixOS
 subnet-router. Do not create an OS suffix for a thin package difference that the
 owning application unit can express.
 
@@ -503,6 +507,7 @@ A host registry may use a specification like this:
     profiles = [
       "base"
       "interface.cli"
+      "interface.macos"
       "security.fingerprint"
       "workload.development"
       "workload.personal"
@@ -513,9 +518,9 @@ A host registry may use a specification like this:
 
 The current role assignment is intentional: x1g9 is a full NixOS desktop with
 niri, GNOME, ly, the shared Linux desktop applications, and the personal
-workload. m2 is the daily-use macOS development and personal machine. Keep the
+workload. m2 is the daily-use macOS development and personal machine with the
-desktop sessions independently selectable, and keep m2's development and
+macOS interface defaults. Keep the desktop sessions independently selectable,
-personal profiles usable on Darwin.
+and keep m2's development and personal profiles usable on Darwin.
 
 Treat entries in `profiles` and the exceptional `applications` field as IDs
 relative to their respective category roots. Add the category prefixes during

hosts/default.nix

@@ -25,6 +25,7 @@
     profiles = [
       "base"
       "interface.cli"
+      "interface.macos"
       "security.fingerprint"
       "workload.development"
       "workload.personal"

modules/profiles/README.md

@@ -24,6 +24,7 @@ when removing it from any supported host would make that host invalid.
 | ------------------------------------ | ------------------------------------- |
 | `base`                               | NixOS, macOS                          |
 | `interface.cli`                      | NixOS, macOS with Home Manager        |
+| `interface.macos`                    | macOS                                 |
 | `interface.linux-desktop`            | NixOS with Home Manager               |
 | `interface.gnome`                    | NixOS with Home Manager               |
 | `interface.niri`                     | NixOS with Home Manager               |
@@ -46,9 +47,9 @@ when removing it from any supported host would make that host invalid.
 Select independent concerns independently in `hosts/default.nix`. For example,
 a NixOS desktop can combine `interface.gnome` and `interface.niri` to provide
 both sessions while sharing `interface.linux-desktop`; niri supplies ly. A
-daily-use macOS development machine can add `workload.development` and
+daily-use macOS development machine can combine `interface.macos`,
-`workload.personal`. Hardware support does not implicitly select an interface
+`workload.development`, and `workload.personal`. Hardware support does not
-or workload.
+implicitly select an interface or workload.
 
 `security.tpm-storage` deliberately does not own a disk identifier. A host that
 selects it must define `boot.initrd.luks.devices.cryptroot.device` in its

modules/profiles/interface/macos/meta.nix

@@ -0,0 +1,8 @@
+{
+  description = "macOS graphical interface defaults";
+
+  includes = [
+    "systems.dock"
+    "systems.trackpad"
+  ];
+}

modules/systems/dock/darwin.nix

@@ -0,0 +1,26 @@
+{
+  lib,
+  primaryUser,
+  ...
+}:
+{
+  system.defaults.dock = {
+    # Finder and Trash are managed by macOS and do not belong in this list.
+    persistent-apps = [
+      "/Applications/Google Chrome.app"
+      "/Users/${primaryUser}/Applications/Home Manager Apps/Zed.app"
+      "/Users/${primaryUser}/Applications/Home Manager Apps/Visual Studio Code.app"
+      "/Applications/Slack.app"
+      "/Applications/Vesktop.app"
+      "/Applications/Ghostty.app"
+    ];
+    persistent-others = [ ];
+    show-recents = false;
+  };
+
+  # Homebrew installs casks after defaults are written. Refresh the Dock only
+  # after both Homebrew and Home Manager have finished activating.
+  system.activationScripts.postActivation.text = lib.mkAfter ''
+    run sudo --user=${lib.escapeShellArg primaryUser} /usr/bin/killall Dock >/dev/null 2>&1 || true
+  '';
+}

modules/systems/trackpad/darwin.nix

@@ -0,0 +1,7 @@
+{
+  system.defaults.trackpad = {
+    Clicking = true;
+    TrackpadRightClick = true;
+    TrackpadCornerSecondaryClick = 0;
+  };
+}

modules/users/moons/darwin.nix

@@ -11,18 +11,4 @@
       primaryUser
     ];
   };
-
-  system.defaults.dock = {
-    # Finder and Trash are managed by macOS and do not belong in this list.
-    persistent-apps = [
-      "/Applications/Google Chrome.app"
-      "/Applications/Zed.app"
-      "/Applications/Visual Studio Code.app"
-      "/Applications/Slack.app"
-      "/Applications/Vesktop.app"
-      "/Applications/Ghostty.app"
-    ];
-    persistent-others = [ ];
-    show-recents = false;
-  };
 }