My repeatable Apple Silicon macOS setup, built with Determinate Nix, nix-darwin, Home Manager, Homebrew, and the Mac App Store.
The repository contains the public machine configuration. Private identity,
account metadata, keys, and sync settings are restored from the dedicated
Mac Setup vault in 1Password and never stored in Git.
Before starting:
- finish macOS updates and enable FileVault;
- use the intended local administrator account;
- sign in to the Mac App Store; and
- make sure the required 1Password items are recoverable.
Open Terminal and paste this tested, revision-pinned bootstrap:
revision='037056b40b9633eaa2e3f8b16e52757e90dbe658'
/usr/bin/curl -qfsSL --proto '=https' --tlsv1.2 \
"https://raw.githubusercontent.com/philippgerard/mac-setup/${revision}/setup.sh" \
| /bin/bash -p -s -- --revision "$revision"This requests the Command Line Tools and installs Homebrew and Determinate Nix
when needed, checks out the repository at ~/.config/mac-setup, validates it,
and builds the configuration. It does not activate the build yet.
If macOS opens the Command Line Tools installer, finish it and run the same bootstrap block again.
After the build succeeds and its changes look right:
~/.config/mac-setup/setup.sh --provisionFollow the guided prompts. This activates the system, connects 1Password, restores Git identity, personal Mail and configured DAV services, checks and restores any missing declared S/MIME identities in the login keychain, restores legacy GPG keys and Filen state, and opens the macOS profiles that require approval.
The flow is resumable. If macOS asks for App Management permission, enable the
terminal in System Settings > Privacy & Security > App Management, quit and
reopen Terminal, then run the same --provision command again. The same rule
applies if a profile approval or sign-in is interrupted.
That is the regular fresh-Mac setup.
Provisioning selects only personal-mail by default. To add another saved
account on this Mac, list every account you want:
~/.config/mac-setup/setup.sh --provision -- \
--mail-account personal-mail --mail-account work-mailRun ~/.config/mac-setup/scripts/finish-setup --help for account, vault, and
skip options. See Mail and account setup for profile,
password, Microsoft 365, and migration details.
- macOS defaults, Fish, Git/SSH policy, tmux, Otty, and editable Zed settings
- the pinned CLI and development toolchain
- GUI and Mac App Store applications from the configured profiles
- Filen Menubar and the standalone Filen CLI
- private Git and GPG state, password-free Mail/DAV metadata, and Filen configuration from 1Password
The complete application policy is in the app inventory. App Store and application sign-ins, Apple privacy approvals, browser sessions, private repositories, and other vendor-managed state still require their supported restore flows.
From ~/.config/mac-setup:
# Check the repository and configuration
scripts/validate
# Build without changing the live system
scripts/rebuild build
# Build and activate local changes
scripts/rebuild switch
# Intentionally update pinned Nix inputs and Filen Menubar, then build
scripts/updateHomebrew and Mac App Store application removal is never automatic. Review
scripts/homebrew-dry-run before removing software.
- Clean-install runbook — extended setup, approvals, alternative flows, and interruption recovery
- Mail and account setup — IMAP/DAV, iCloud restrictions, Microsoft 365, MFA, and profile migration
- Private state — 1Password items, Git/GPG identity, SSH hosts, and backup boundaries
- Architecture and bootstrap safety — repository layout, revision pinning, source filtering, and activation design
- Maintenance — updates, Topgrade, Homebrew, and mutable application settings
- Post-install verification — thorough automated and manual checks
- Pre-wipe checklist — required checks before erasing an existing Mac
- Public release safety — PII and Git-history policy