init

system/nix/default.nix

@@ -0,0 +1,35 @@
+{
+  config,
+  pkgs,
+  inputs,
+  lib,
+  ...
+}: {
+  imports = [
+    ./nixpkgs.nix
+    ./substituters.nix
+  ];
+
+  # git is needed for flakes
+  environment.systemPackages = [pkgs.git];
+
+  nix = {
+    # pin the registry to avoid downloading and evaling a new nixpkgs version every time
+    registry = lib.mapAttrs (_: v: {flake = v;}) inputs;
+
+    # set the path for channels compat
+    nixPath = lib.mapAttrsToList (key: _: "${key}=flake:${key}") config.nix.registry;
+
+    settings = {
+      auto-optimise-store = true;
+      builders-use-substitutes = true;
+      experimental-features = ["flakes" "nix-command"];
+
+      # for direnv GC roots
+      keep-outputs = true;
+      keep-derivations = true;
+
+      trusted-users = ["root" "@wheel"];
+    };
+  };
+}

system/nix/nixpkgs.nix

@@ -0,0 +1,6 @@
+{self, ...}: {
+  nixpkgs = {
+    config.allowUnfree = true;
+    config.permittedInsecurePackages = [];
+  };
+}

system/nix/substituters.nix

@@ -0,0 +1,16 @@
+{
+  nix.settings = {
+    substituters = [
+      # high priority since it's almost always used
+      "https://cache.nixos.org?priority=10"
+      "https://nix-community.cachix.org"
+      "https://nix-gaming.cachix.org"
+    ];
+
+    trusted-public-keys = [
+      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+      "nix-gaming.cachix.org-1:nbjlureqMbRAxR1gJ/f3hxemL9svXaZF/Ees8vCUUs4="
+    ];
+  };
+}