Skip to content
Back to skills

Nix Health

DSecurity

Use this when diagnosing or fixing a user's Nix installation — checks flakes, version, caches, max-jobs, direnv, rosetta, trusted-users, and shell config

  • 11 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added October 6, 2026
toolspythonrustgoshellbashgit

Works with

  • terminal

Security analysis

D50/100
  • criticalModifies startup scripts or system services for persistence
  • criticalModifies startup scripts or system services for persistence
  • criticalModifies startup scripts or system services for persistence
  • criticalSends environment variables or credentials to an external URL

Pro shows the line behind each finding and how to fix it

Scanned October 6, 2026

npx -y skills add juspay/skills --skill nix-health --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Nix Health?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Nix Health
[![Security: D — Skills Directory](https://www.skillsdirectory.com/api/skills/juspay-nix-health/badge)](https://www.skillsdirectory.com/skills/juspay-nix-health)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: nix-health
description: Use this when diagnosing or fixing a user's Nix installation — checks flakes, version, caches, max-jobs, direnv, rosetta, trusted-users, and shell config
---

# Nix Health Checks

Run these checks to diagnose problems with a Nix installation. For each failing check, report the issue and suggestion to the user.

## 1. Nix Installer

Identify which installer was used:
```sh
# NixOS/nix-installer and Determinate Nix both leave a receipt:
cat /nix/receipt.json 2>/dev/null | python3 -c "import sys,json; print(json.load(sys.stdin).get('version','unknown'))" 2>/dev/null

# On macOS, check launchd service names:
ls /Library/LaunchDaemons/*nix* /Library/LaunchDaemons/*determinate* 2>/dev/null

# On Linux, check systemd:
systemctl list-units '*nix*' '*determinate*' --no-pager 2>/dev/null

# Check for determinate-nixd (Determinate Nix specific):
which determinate-nixd 2>/dev/null
```

- If `determinate-nixd` exists or `systems.determinate.*` services are present → ⚠️ **Determinate Nix** detected (proprietary fork). **Suggestion**: Switch to the official installer or [NixOS/nix-installer](https://github.com/NixOS/nix-installer) for a fully open-source Nix. See https://nixos.org/download/
- If `/nix/receipt.json` exists but no `determinate-nixd` → ℹ️ **[NixOS/nix-installer](https://github.com/NixOS/nix-installer)** (community, formerly DeterminateSystems/nix-installer)
- If no receipt and `org.nixos.nix-daemon` (macOS) or `nix-daemon.service` (Linux) → ℹ️ **Official** installer

## 2. Flakes Enabled

```sh
nix config show 2>/dev/null | grep '^experimental-features'
```

Value must contain both `flakes` and `nix-command`. If missing:
- **Suggestion**: See https://nixos.wiki/wiki/Flakes#Enable_flakes

## 3. Nix Version

```sh
nix --version
```

Version must be ≥ 2.16.0. If older:
- **Suggestion**: See https://nixos.asia/en/howto/nix-package

## 4. Max Jobs

```sh
nix config show 2>/dev/null | grep '^max-jobs'
```

Value must be > 1 (ideally `auto`). If set to 1:
- **Suggestion**: Set `max-jobs = auto` in `/etc/nix/nix.conf` (Linux) or `~/.config/nix/nix.conf` (macOS without nix-darwin). On NixOS use `nix.settings.max-jobs = "auto"`. On nix-darwin use the same option.

## 5. Caches

```sh
nix config show 2>/dev/null | grep '^substituters'
```

Must include `https://cache.nixos.org`. Also check for project-specific caches defined in:
- `nixConfig.extra-substituters` in the project's `flake.nix`
- `cache.url` in the project's `vira.hs` (Vira CI config)

If any required caches are missing from the user's substituters:
- **Suggestion**: Add missing caches to nix.conf `substituters`. For Cachix caches run `nix run nixpkgs#cachix use <name>`.

## 6. Trusted Users

```sh
nix config show 2>/dev/null | grep '^trusted-users'
whoami
```

The current user (or a group they belong to, or `*`) should appear in `trusted-users`. If missing:
- On NixOS: `nix.settings.trusted-users = [ "root" "<user>" ];`
- Otherwise: add `trusted-users = root <user>` to `/etc/nix/nix.conf` and restart the daemon (`sudo pkill nix-daemon`)

## 7. Direnv

```sh
which direnv 2>/dev/null && readlink -f "$(which direnv)"
```

Direnv should be installed and its resolved path should be inside `/nix/store/`. If not installed or installed outside Nix:
- **Suggestion**: Install direnv via Nix (home-manager). See https://github.com/juspay/nixos-unified-template

## 8. Rosetta (macOS only)

Only check on Apple Silicon Macs:
```sh
sysctl -n sysctl.proc_translated 2>/dev/null
```

If the value is `1`, Nix is running under Rosetta emulation which slows builds:
- **Suggestion**: Disable Rosetta for your terminal (Finder → Get Info → uncheck "Open using Rosetta"). Uninstall and reinstall Nix for `aarch64-darwin`. See https://nixos.asia/en/install

## 9. Homebrew (macOS only)

```sh
which brew 2>/dev/null
```

If Homebrew is installed, flag as ⚠️ — it can interfere with Nix environments (e.g. conflicting library paths, shadowed binaries).
- **Suggestion**: Prefer managing packages with Nix for better reproducibility. See https://nixos.asia/en/nix-first. Inventory existing packages with `brew list`, install equivalents via Nix, then consider removing Homebrew.

## 10. Shell Dotfiles

Check if shell config files are managed by Nix (symlinked into `/nix/store`):
```sh
# For zsh:
ls -la ~/.zshrc ~/.zshenv ~/.zprofile ~/.zlogin ~/.zlogout 2>/dev/null
# For bash:
ls -la ~/.bashrc ~/.bash_profile ~/.profile 2>/dev/null
```

Any dotfile whose resolved path is **not** under `/nix/store/` is unmanaged — flag it as ⚠️.
- **Suggestion**: Use home-manager to manage shell configuration. See https://github.com/juspay/nixos-unified-template

## Reporting

Present results as a table with columns: Check, Status (✅/❌/⚠️), Details, and Suggestion (if failing). Mark checks that don't apply to the current OS as skipped.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…