They also have a website with docs: https://nixmultiverse.com/docs/

The website can also be used to search for specific package versions in nixpkgs, to get the nixpkgs revision: https://nixmultiverse.com/

The above feature is similar to: https://lazamar.co.uk/nix-versions/ or https://www.nixhub.io/ , but using this project is a way easier alternative than searching for an pinning revisions.

I'm a relatively new user and I've successfully set up Hyprland with home manager. I wanted to try out Niri though but it's a bit more confusing for me. What's the point of that repo? Does the Niri that's in nixpkgs not work with home manager? Is that repo, and that repo alone, expected if you're using home manager and want to manage Niri with it?

Thanks!

nixos org github

I'm really liking Jujutsu (a.k.a jj) for version control! If you're not familiar, jj is a version control system that interoperates with git. It removes a lot of possible states git can get into, adds much more helpful oopsie recovery, and adds some useful abstractions.

I'm working on setting up my workflow to cover the functionality that I previously got from git hooks. I'm used to using one of my projects, git-format-staged, to automatically format code. Here's an example Nix project config that does that.

(I don't like to set my editor to format on save because that doesn't go well with autosave. Thus hooks.)

I saw that there is discussion on using pre-commit with jj in this thread. That has spawned two projects, jj-pre-push and jj-hooks, that can both run pre-commit - but they run it before pushing to a git remote, not on at commit time, because running a hook on every commit change doesn't work well with jj's model.

I'm trying something different because I want formatting to run earlier than on push. And of course I want my setup to be automated with a Nix devShell!

I thought a natural point to "hook in" would be on bookmark moves. In jj branches are anonymous, but there are named "bookmarks". Bookmarks don't move automatically like git branch pointers - you move them manually. When working with an upstream git repo you get bookmarks that are associated with remote branches - they're similar to local tracking branches in git. When you run jj git push it updates remote branches to the commits the matching bookmarks are on. So I think of bookmarks as my plan for what I'm going to push.

The typical workflow is:

• do some work
• advance a bookmark to the latest commit I'm ready to push
• jj git push does basically what git push does if you set push.default = matching (or if you run git push origin :)

Usually the latest commit in your anonymous branch in jj is the "working copy" which you probably don't want to push. So it's common to advance the bookmark to the most recent "finished" commit: the parent of the working copy. That commit is referenced by the expression @-

All that to say, I'm trying out an alias that automatically advances the "closest" bookmark to @-, and runs jj fix on all of the commits that are now in the bookmark's history that weren't before. (This is a Home Manager config snippet):

# Move closest bookmark to @-, and run jj fix;
programs.jujutsu.settings.aliases.tug = [
  "util"
  "exec"
  "--"
  "bash"
  "-c"
  ''
    set -euo pipefail
    jj fix -s 'heads(::@- & bookmarks())..@- & mutable()' # fix revisions after bookmark, up to and including @-
    jj bookmark move --from 'heads(::@- & bookmarks())' --to '@-'
  ''
  "" # last string becomes $0 -- see jj docs
  # TODO: accept an argument to override @- as the new bookmark target
];

The tug alias has been floating around. My addition is the jj fix command. If I use this alias my changes get automatically formatted before I commit to pushing them.

jj fix is intended specifically for automatic code formatting. Because jj is especially good at editing history, the fix command is good at retroactively formatting commits. It identifies changed files in each of the given commits, and runs their content through formatters via stdio. It's capable of formatting only changed portions of files if you configure formatters to accept line ranges.

Understanding that script requires spending some time learning jj's revset language. The very short version is:

• jj fix -s <expression> runs configured fix tools on the specified commits
• heads(::@- & bookmarks()) is a fancy way of identifying the closest commit with a bookmark on the DAG
• heads(::@- & bookmarks())..@- selects commits after that bookmark, up through @-
• & mutable() filters out commits that have already been pushed to main (in case you're pushing a merge). Commits already in your upstream trunk are considered "immutable" by default

I'd prefer a native hook to be able to run commands on any jj command that moves a bookmark. Maybe someday!

The last step is configuring the formatters that jj fix runs. This is where the real Nix configuration comes in! Formatters are set up in the jj config file. Like with git you have a global config, and also a repo-specific config. Also like with git, jj has a command to programmatically set config values. I set up this devShell to use that command to automatically set up the repo-specific config for my project:

# Set formatters for `jj fix` to use for this repo
{
  perSystem = { lib, pkgs, ... }: {
    devShells.jj-fix =
      let
        # A JSON array is also a valid TOML array, so builtins.toJSON gives us
        # a value literal that `jj config set` will accept for `command` and
        # `patterns`.
        tomlArg = value: lib.escapeShellArg (builtins.toJSON value);
        set-tool-config = tool-name: config: /* bash */ ''
          jj config set --repo fix.tools.${tool-name}.command ${tomlArg config.command}
          jj config set --repo fix.tools.${tool-name}.patterns ${tomlArg config.patterns}
        '';

        # This variable holds the actual configuration for my three formatters
        fix-tools = {
          nixfmt = {
            command = [
              (lib.getExe pkgs.nixfmt)
              "--filename=$path"
            ];
            patterns = [ "glob:'**/*.nix'" ];
          };

          prettier = {
            command = [
              (lib.getExe pkgs.prettier)
              "--stdin-filepath=$path"
            ];
            patterns = [
              ''
                (glob:'**/*.[jt]s' | glob:'**/*.[jt]sx' | glob:'**/*.json' | glob:'**/*.css' | glob:'**/*.md')
                ~ glob:'.expo/types/**' ~ glob:'**/.sqlx/**'
              ''
            ];
          };

          rustfmt = {
            command = [
              (lib.getExe pkgs.rustfmt)
              "--edition=2024"
              "--emit=stdout"
            ];
            patterns = [ "glob:'**/*.rs'" ];
          };
        };
      in
      pkgs.mkShell {
        shellHook = builtins.concatStringsSep "\n" (lib.mapAttrsToList set-tool-config fix-tools);
      };
  };
}
# TODO: Does not automatically remove tools from jj config if they are removed from the devShell

That's my first pass. At some point I might publish a flake-parts module that abstracts out the boilerplate to make this nicer to use.

In theory it's sort of like using git-format-staged. Formatting runs less frequently than with a pre-commit hook. That might mean a higher chance of conflicts. But the jj fix docs make bold claims about never introducing conflicts. We'll see. I'm still experimenting with this setup.

Another possible workflow is hooking into jj new to run fix on the commit that just stopped being the working copy.

The main functionality that's still missing for me is a replacement for the git pre-commit hook that I had that runs cargo prepare sqlx on pre-commit. That command needs to be able to read changed source files, and to output separate files to add to version control. There's an upcoming jj run command that might do the trick.

ive got a surface tablet at work running nixos. it mostly is used to view security cameras.

the machine is fairly low spec and bogs itself down after a coupke days, so id like it to auto reboot at 9am. i work a late shift and often don't leave til around 2am.

i guess we don't use cron anymore? i really don't understand how the systemd timers work... the wiki doesnt really give great details...

systemd.timers."autoreboot" = {

wantedBy = [ "timers.target" ];

timerConfig = {

  OnCalendar="*-*-* 9:00:00";                                     Unit = "autoreboot.service";

};

};

systemd.services."autoreboot" = {

script = ''

set -eu

${pkgs.coreutils}/run/current-system/sw/bin/reboot

'';

serviceConfig = {

Type = "oneshot";

User = "root";

};

};

the systemd target seems to be created, but it reports as dead when i check it...

any advice?

Recently garnix shutdown, which mean trying to rebuild my config while having it as a subsituter just failswith a bad gateway. Issue is, to remove it from my config, i gotta rebuild my config, which obviously fails since it tries to check for garnix. Not sure what to do here

EDIT: I fixed by by "overriding" my nix config, I jsut copied the substituter related entry in the nix.conf geberated by nix, pasted them in ~/.config/nix/nix.conf and removed garnix from those, then just rebuild the config and boom it worked. Just dot forget to then remove those lines from the user nix config

It's these two gems, specifically. I can build them on my local machine, and nix copy them to the server, but building them directly on the server always fails with curl: (6) Could not resolve host: rubygems.org.

(If you want to replicate it: nix build https://codeberg.org/libewa/pages/archive/main.tar.gz.)

Fair warning, I used Claude for a lot of the details. Architecturally, it's my design.

Got NixOS running on my reMarkable Pro Paper Move (codename: chiappa) because when I got this tiny tablet, it was with the goal of replacing my iPad Mini (which I mainly used to read books on anyway) and wanting to use something that ran Linux (I use NixOS on every other machine I touch except my Phone...).

Finally got around to (helping Claude) port NixOS though so now, besides having my config live alongside the rest of my machines, I can boot right into KOReader and not play silly games with Xochitl everytime I reboot. Plus, being my own NixOS config, I can (WIP/testing) load/use other applications with ease.

The details and how to set it up are mostly in the NixOS flake/associated repo over here:

https://github.com/gitman-101111/remarkable-nixos

If you want to use the e-ink bridge/associated tools to port to another OS of your choice (I tried and succeeded in porting to PostmarketOS but they have a strict no generative AI policy), you can use this repo (which the flake also references):

https://github.com/gitman-101111/chiappa

All the hardware works with KOReader with some minor patching. Feel free to play around with different configurations, etc.

Details on the setup and specifics are in the repos.

Lastly, I wouldn't recommend this to people unfamiliar with NixOS or at least some Linux experience. There's a lot of information here on how to essentially brick your device lol. Be careful out there! :)

Pretty much the title. Please bear with me, since I'm sort of a beginner 😅

I am trying to use nixpak to sandbox iamb, but for whatever reason, it doesn't start up and run properly. Here's the relevant section of the config

environment.systemPackages = [
      (mkNixPak {
        config = { pkgs, sloth, ... }: {
          app.package = pkgs.iamb;

          bubblewrap = {
            network = true;
            shareIpc = false;
            dieWithParent = true;

            bind.rw = [
              [
                (sloth.mkdir (sloth.concat' sloth.homeDir "/Downloads/iamb"))
                (sloth.concat' sloth.homeDir "/Downloads")
              ]

              (sloth.mkdir (sloth.concat' sloth.xdgConfigHome "/iamb"))
              (sloth.mkdir (sloth.concat' sloth.xdgDataHome "/iamb"))
              (sloth.mkdir (sloth.concat' sloth.xdgStateHome "/iamb"))
              (sloth.mkdir (sloth.concat' sloth.xdgCacheHome "/iamb"))

            ];

            bind.ro = [
            "/etc"
            "/usr"
            # To mount the systemd resolution stuff and so on
            "/run/systemd"
            ];

            apivfs = {
              proc = true;
              dev = true;
            };

            bind.dev = [
              "/dev"
            ];

            tmpfs = [
              (sloth.mkdir "/tmp/iamb")
            ];

            env = {
                TERMINFO = "${pkgs.kitty}/lib/kitty/terminfo";
            };
          };

        };
      }).config.env
];

The full config can be found here

The following bubblewrap command works as-is on nixos, and doesn't lead to any errors whatsoever:

bwrap --ro-bind /usr /usr \
--ro-bind /etc /etc \
--proc /proc \
--ro-bind /home/innocentzero/.local/state/nix/profile /home/innocentzero/.local/state/nix/profile \
--ro-bind /nix/store /nix/store \
--ro-bind /run/systemd /run/systemd \
--dev /dev \
--tmpfs /tmp \
--unshare-all \
--share-net \
--die-with-parent \
--bind /home/innocentzero/.config/iamb /home/innocentzero/.config/iamb \
--bind /home/innocentzero/.cache/iamb /home/innocentzero/.cache/iamb \
--bind /home/innocentzero/.local/share/iamb /home/innocentzero/.local/share/iamb \
iamb

However, executing the nixpak wrapped iamb produces the following (including the control characters):

^[[?62;4;22;28;52c^[[6;25;11t^[[0n* Logging in for @innocentzer0:cyberia.club...

Any ideas/suggestions? I'm not sure how exactly to get this to work. From what I see in the nixpak module, the generated command should be about the same. Any help is appreciated. Thanks!

This may be an unusual thing but I realised that use nix run a lot instead of putting the package in my nixos configuration. It's often on packages I run at most once every 3 days

Am I the only one that does that?

I need to find out how much garbage can be cleared when 'nix-collect-garbage -d' is run for a personal project but I haven't been able to find any answer about this on documentations and DDG.

I've tried 'du -sh /nix/store' but it would print the size everything in /nix/store however 'nix-collect-garbage -d' does not remove everything when it's executed so that's not gonna work. I've also tried executing "nix-store --gc --print-dead | grep '^/nix*'" ('--print-dead' produces output that which contains store paths that are not live and will not be used, with respect to roots) and then executing "stat -c '%s'" on each path ('stat -c "%s" $file_name' produces output containing the bytes of the concerned file in bytes) however that doesn't seem to work as well for some unknown reason as they all seem to add up to a few kilobytes (despite the actual amount that 'nix-collect-garbage -d' deletes being about 400MB).

I know that the code below is extremely shit but that's because that's not my main project but a separate script solely for trying to find out what I am doing wrong and how I can properly implement this in my main project.

Thanks for any help!

`#!/usr/bin/env bash

tmp() {

declare -a str byt

str=( $(nix-store --gc --print-dead 2>/dev/null | grep '/nix*') )

for garbage in "${str[@]}"; do

    byt+=( $( stat -c '%s' $garbage ) )

done

total=0

for filesize in "${byt[@]}"; do

    total=$(( $total + $filesize ))

done

convertedtotal="$(( ( $total / 1024 ) /1024  ))MB"

echo "$total"

echo "$convertedtotal"

}

tmp`

Some responses from people on other platforms that did not work perfectly:

"I had the same issue a couple months back, i asked claude back then and got: sudo nix-store --gc --print-dead 2>/dev/null | xargs -I{} du -s {} 2>/dev/null | awk '{sum += $1} END {printf "%.2f GB\n", sum/1024/1024}'"

And

"```

bytes=$(

nix-store --gc --print-dead |

xargs du -sb |

awk '{s+=$1} END {print s}'

)

numfmt --to=iec "$bytes"

some like this should work for you"

Both of them had one issue: 

`$ nix-store --gc --print-dead | grep '^/nix*' | xargs du -sh | awk '{ print $1 }'

finding garbage collector roots...

determining live/dead paths...

8.0K

8.0K

8.0K

4.0K

1.6M

1.9M

8.0K

2.3M

8.0K

45M

4.0K

4.0K

8.0K

4.0K

4.0K

4.0K

684K

8.0K

8.0K

4.0K

8.0K

8.0K

7.7M

692K

4.0K

728K

8.0K

8.8M

344K

492K

4.0K

572K

8.0K

1.1M

4.0K

4.0K

8.0K

4.0K

8.0K

36K

8.0K

8.0K

8.0K

4.0K

4.0K

8.0K

# All of that is about 72MB.

$ nix-collect-garbage -d

removing old generations of profile /home/north/.local/state/nix/profiles/home-manager

removing old generations of profile /home/north/.local/state/nix/profiles/profile

finding garbage collector roots...

deleting garbage...

deleting '/nix/store/vdixm6r047a3rw1wx8pqsjh40nl886jj-kate-26.04.2.drv'

deleting '/nix/store/s5i0c135x2x5dz9ah01zxvl3prywqb30-kate-26.04.2.tar.xz.drv'

...

deleting '/nix/store/rivv4fh68mkqnc4v225mflmi3a9damcj-xfconf-4.20.0'

deleting '/nix/store/9nj1k063j54qfxzcm49dspwwl1sxhqs0-libxfce4util-4.20.1'

deleting unused links...

note: hard linking is currently saving 0.0 KiB

46 store paths deleted, 64.8 MiB freed`

Now what's strange is that 'nix-store --gc --print-dead' outputs these 46 paths (which add up to ~72MB) and 'nix-collect-garbage -d' deletes 46 paths but somehow, 64.8 MiB, which is about 68MB, is freed instead of 72MB. I tried to replicate this again and it worked, there's always some amount of inaccuracy. Of course, a few megabytes don't matter but this can create significant inaccuracies on systems with more cache, but this definitely is a lot better.

So I came here while researching for the problems with qt5 theme. So in the archi wiki it says -

3.1 QGtk3Style
This is a platform theme built into qt5-base starting with version 5.7.0 [2] and qt6-base. It can be used to style Qt5 and Qt6 applications according to current GTK3 style. It can be enabled by setting the following environment variable: QT_QPA_PLATFORMTHEME=gtk3. 

I am on nixos and if i set the same envionment variable qt6 apps like pcmanfm-qt, qbittorrent correctly use the same colors as my gtk3 theme, but it seems qt5 apps (like wpa_supplicant_gui, keepassxc, picard) even though in logs they seem to load the plugin, dont theme accordingly and show the default white color. I just want to know is the plugin abandoned? Meaning its no use trying to wait for it to update and be fixed or should i just switch to qtstyleplugins for qt5 apps?

I Can confirm this if i run

QT_DEBUG_PLUGINS=1 QT_QPA_PLATFORMTHEME=gtk3 wpa_gui 2>&1 | grep -i gtk3

and logs show

QFactoryLoader::QFactoryLoader() looking at "/nix/store/64qmp7fap3740hxd2bsnpy10s9ndy5qx-qtbase-5.15.18-bin/lib/qt-5.15.18/plugins/platformthemes/libqgtk3.so"
Found metadata in lib /nix/store/.../libqgtk3.so, metadata=
            "gtk3"
    "className": "QGtk3ThemePlugin",
Got keys from plugin meta data ("gtk3")
loaded library "/nix/store/.../libqgtk3.so"

• Note: The old qt5-styleplugins do work just need to set the variabled to gtk3 instead of gtk2

Side by side comparison

• qbittorrent (qt6 app)

Its using qt6, i can confirm
nix why-depends nixpkgs#qbittorrent nixpkgs#qt6.qtbase
/nix/store/i8r2n73xzlxk7sfchjlkdxajs8jbqbv0-qbittorrent-5.2.1
└───/nix/store/wzvm2pvf98a71v0scgfhmi01lqcxahfr-qtbase-6.11.0

• picard (qt5 app)

Its using qt5, i can confirm
nix why-depends nixpkgs#picard nixpkgs#qt5.qtbase
/nix/store/wzqlnryvnjl95a93fiwwivlbz3ypixk7-picard-2.13.3
└───/nix/store/64qmp7fap3740hxd2bsnpy10s9ndy5qx-qtbase-5.15.18-bin

I can confirm the same behaviour for the other aforementioned apps.

Sorry if this is an ignorant question. I love Nix, but as a user it feels absurd that changing an option from true to false in a home-manager managed config file that then gets transpiled from Nix to TOML, for instance, takes like 10 seconds on a decently modern machine.

In my world that kind of transpilation should be instant. I get that there's more happening behind the scenes than just doing Nix -> TOML, but still. Imagine if the transpilation of config files were instant, so you could have home-manager automagically do the transpilation every time you save the file. That would be awesome, especially for programs that support hot-reloading like Hyprland or Niri.

Is this a Nix issue or a home-manager issue? How much of speedup would it yield to rewrite Nix and/or home-manager in a faster language like Zig or Rust?

"Faust et al." is about to be published as a result of the Akademie AIR residency I did last year at Schmiede.

It's an algorithmic #comic where I drew, by hand, a conversation with a tuned Gemma3 model in Ollama (run locally on my laptop).

Conversation is around power, knowledge, agency and anthropomorphizing A.I.

I used Ollama and @Krita on a @nix machine

https://e.pcloud.link/publink/show?code=XZUxYcZmG8TU5VVQiVJuYnonGYVWuLLv79k

cross-posted from: https://lemy.lol/post/66477718

I've been having trouble rebuilding my system for a few days now. The issue seems to be that a commit to nixpkgs-xr/xrizer added an aarch64 patch. There's been a commit that removes this patch but I can't seem to pull it with nix flake update which makes me think my flake might never have been working properly (although I'm getting the home-manager, stylix and unstable packages I've selected). Could someone please review my flake.nix and tell me if I'm doing something wrong?

{
  description = "Core Flake";

  inputs = {
    # Official NixOS Packages v25.11
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
    home-manager = {
      url = "github:nix-community/home-manager/release-25.11";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    nixpkgs-xr.url = "github:nix-community/nixpkgs-xr";

    unstable = {
      url = "github:NixOS/nixpkgs/nixos-unstable";
    };

    stylix = {
        url =  "github:nix-community/stylix/release-25.11";
        inputs.nixpkgs.follows = "nixpkgs";
        };
  };

  outputs = inputs@ { nixpkgs, nixpkgs-xr, unstable, home-manager, stylix, ... }: {
    nixosConfigurations.nixos = nixpkgs.lib.nixosSystem {
      modules = [
        # Import my existing configuration.nix
        ./configuration.nix

        nixpkgs-xr.nixosModules.nixpkgs-xr

        home-manager.nixosModules.home-manager
        {
          home-manager.useGlobalPkgs = true;
          home-manager.useUserPackages = true;
          home-manager.users.professor = import ./home.nix;
        }

        stylix.nixosModules.stylix

        {
        nixpkgs.overlays = [
          (final: prev: {
            unstable = import unstable {
                inherit (final) config;
                inherit (final.stdenv.hostPlatform) system;
                };
          })

        ];
        }
      ];
    };
  };
}

With Hyprland moving to Lua, I may make the switch to Lua-based configuration for my Hyprland and Neovim based workflow.

I went with nvf over stock Neovim so that I could handle everything in one language (Nix) as much as possible. I have a few Lua snippets, but that's all.

Now with Hyprland making the switch to Lua as well, I've been considering importing dedicated Lua files into my Nix config.

So, what do you do? Write Nix as much as possible? Use Nix to import your Lua/yaml/etc config? Write other languages as snippets in your .nix files?

I'll start. I just discovered this one. It shows asterisks (*********) while you type your sudo password:

security.sudo.extraConfig = # sh
  ''
    Defaults pwfeedback # Make typed password visible as asterisks
  '';

From my own post: cross-posted from: https://lemmy.world/post/47418159

I've just set up bees on my laptop.

• It's been running for 40 minutes now
• I went from 28G to 58G free space on my 2 TB SSD
• Without deleting anything

I'm genuinely amazed.
Idk why, but I thought this was more of a gimmick for some reason, but nah it works well.

Can highly recommend :3

See https://github.com/Zygo/bees for the project if you wanna learn more.

Here's all I did on my system (NixOS), see !nix@programming.dev

1. I put this in my NixOS config:

services.beesd.filesystems.root = {
  spec = "UUID=dfabb360-7fde-4b06-a884-03c8d217d877";
  hashTableSizeMB = 8192;
};

2. I ran this command

cd /etc/nixos && sudo nixos-rebuild switch |& nom
# tho just running sudo nixos-rebuild switch in the correct dir would be sufficient

And it just started giving me more space on my disk :3

PS: it's been 49 minutes now, and I'm at 72G free 🎉
(the CPU has been maxed out the entire time, keep that in mind)

Hey guys, I have a project which I want to cross-compile to windows (because I don't want to install windows on my machine, nor do I plan on developing on windows) and eventually MacOS.

All I really need is to know that it will compile for & run on windows.

This is what I tried, but I'm not sure what the best approach is here. Searching online didn't yield any conclusive results either.

{
  description = "cross-compile dev env";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
  };

  outputs = { nixpkgs, ... }:
    let
      supportedSystems = ["x86_64-linux"];
      eachSystem = fn: nixpkgs.lib.genAttrs supportedSystems (system:
        fn nixpkgs.legacyPackages.${system}
      );
    in
    {
      #1 this is what I tried at first,
      # but it created conflicts in the environment (obviously)
      devShells = eachSystem (pkgs: {
        default = pkgs.mkShell.override { stdenv = pkgs.gcc15.stdenv; } {
          packages = with pkgs; [
            ...
            pkgsCross.mingwW64.buildPackages.gcc15
          ];
        };
      });

      #2 this is probably a better solution?
      devShells = eachSystem (pkgs: let packages = with pkgs; [
        ...
      ]; in {
        default = pkgs.mkShell.override { stdenv = pkgs.gcc15.stdenv; } {
          inherit packages;
        };

        windows = pkgs.pkgsCross.mingwW64.mkShell { 
          inherit packages;
        };
      });
    };
}

The project is just a C program which compiles using a Makefile. I stripped out dependencies etc. from the flake.

You probably already know that Nix Flakes does not recognize files in your project if you do not track them by Git, and if you do not want to add them directly, you can use the --intent-to-add flag:

git add --intent-to-add <file>

This makes Git track the file, but it is not staged. Example:

$ touch file
$ git add --intent-to-add file
$ git status -s file
 A file

So it will not be part of your next commit, but it will be registered to Flakes.

Recently, I was packaging a few NPM packages for my workflow migration. I ran into an issue with pkgs.buildNpmPackage where this section of the package.json was causing an issue (minimized):

{
  "scripts": {
    "copy-python": "mkdir -p lib/python && cp -r python/* lib/python/",
  }
}

Specifically:

> > mkdir -p lib/python && cp -r python/* lib/python/
>
> cp: cannot stat 'python/*': No such file or directory

This confused me because the python directory clearly existed in the root and was tracked by Git:

$ git ls-files python
python/mcp-bridge

When I inspected the type of directory, I saw that it was a submodule, so I assumed that was related:

$ git submodule status
 97f3c0d411065258679ee8d56f270fc5c7fc1a98 python/mcp-bridge (remotes/origin/feat/mcpm-aider)

I first assumed that it wasn't pulled, so I naturally ran:

$ git submodule update --init --recursive

But that didn't resolve the issue. Turns out that Nix Flakes does not copy submodule directories either, even though they are part of Git.

To fix this, you just have to supply the ?submodules=1 attribute:

$ nix run ".?submodules=1"

Obviously, make sure that you use the quotes because your shell may have issues:

$ nix run .?submodules=1
zsh: no matches found: .?submodules=1

If you use nix-direnv for your projects, you can integrate this into your .envrc:

use flake '.?submodules=1'

Hope this helps other people if they happen to be stuck with a situation like this.

I just updated my nixpkgs input and now thenodejs-20.20.2 package (prolly used by another package and idk why) is flagged as insecure, no big deal i just gotta add it to nixpkgs.config.permittedInsecurePackages, which I do:

  nixpkgs.config.permittedInsecurePackages = [
    "nodejs-20.20.2"
    "electron-38.8.4"
  ];

Execpt that it STILL doesn't rebuild and tells me the same error message as when I didn't have added it to the permitted insecure packages

       error: Refusing to evaluate package 'nodejs-20.20.2' in /nix/store/1hb1glkkpl6vjjpfrwzmvjyvhcyqfxfk-source/pkgs/development/web/nodejs/nodejs.nix:689 because it is marked as insecure

       Known issues:
        - This NodeJS release has reached its end of life. See https://nodejs.org/en/about/releases/.

       You can install it anyway by allowing this package, using the
       following methods:

       a) To temporarily allow all insecure packages, you can use an environment
          variable for a single invocation of the nix tools:

            $ export NIXPKGS_ALLOW_INSECURE=1

          Note: When using `nix shell`, `nix build`, `nix develop`, etc with a flake,
                then pass `--impure` in order to allow use of environment variables.

       b) for `nixos-rebuild` you can add ‘nodejs-20.20.2’ to
          `nixpkgs.config.permittedInsecurePackages` in the configuration.nix,
          like so:

            {
              nixpkgs.config.permittedInsecurePackages = [
                "nodejs-20.20.2"
              ];
            }

       c) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
          ‘nodejs-20.20.2’ to `permittedInsecurePackages` in
          ~/.config/nixpkgs/config.nix, like so:

            {
              permittedInsecurePackages = [
                "nodejs-20.20.2"
              ];
            }

not sure what to do when the option to allow insecure packages does not allow insecure packages, weirdly enough tho it works just fine with

There's a bunch of talks happening at 4:30 but are you wondering what to do after them at 5? Consider checking out one of the open spaces.

Starting at 05:00 PM:

Room 102A: @nix
Room 102C: --dangerously-skip-permissions, Safely
S-3: PyCon Running
S-4: CV/Resume Workshop

#PyConUS #PyConUSOpenSpaces #PyConUS2026

A short-ish post by me on how to use SMB3 (not the plumber game) with NixOS.