Work MacBook (M4)#

This is the current work laptop (flake host work-laptop-m4), a 14” MacBook Pro with M4 Pro (Apple model A3401, aarch64-darwin) managed with nix-darwin. It replaces the retired work-laptop (A2338, 13” M1 — see the decommission log). The primary user is bcraton. It lives at the Lafayette site and connects over the FalseBlue (gensokyo) Wi-Fi network and Tailscale.

The configuration mirrors the previous work laptop: it imports the bcraton user with the minimal Darwin home profile, enables the Nix development shell (tsunaminoai.nix.dev) with unfree packages allowed, remaps Caps Lock to Escape, and manages a small set of Homebrew CLI packages (ca-certificates, openssl@3, podman). Borg backups are enabled. It is not a Nix remote builder (the builds block is left disabled).

This is a Jamf-managed device. bcraton has root and uses Nix to own the developer / productivity layer while Jamf keeps the security & compliance posture — see Managing a Mac with Nix (and Jamf) for how the two coexist and for the first-boot bring-up steps.

Per-machine values#

A few values are specific to this physical machine and are set during first boot (see the onboarding guide):

  • networking.hostName — follows the MacBook-Pro-<serial4> convention.
  • ids.uids.nixbld / ids.gids.nixbld — reconciled with the IDs the Determinate installer actually created on this machine.
  • tsunaminoai.borg.repo — a fresh BorgWarehouse repo id from just borg-generate-secrets.
  • SOPS host age key — derived from this machine’s SSH host key and added to .sops.yaml.
  • Ollama — this machine is the primary LLM inference host.
  • Mac Onboarding — how its nix-darwin setup is bootstrapped.