Nix Homebrew

https://github.com/zhaofengli/nix-homebrew
Admin
Nix Homebrew manages Homebrew installations on macOS using nix-darwin, enabling declarative...
Tokens:21,765
Snippets:157
Trust Score:9.6
License:MIT
Update:5 days ago
Show doc for...
Tokens:
Raw
### Basic nix-homebrew configuration

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/module-options.md

A standard configuration example for a new installation, including tap definitions and trust settings for formulae, casks, and commands.

```nix
{
  nix-homebrew = {
    enable = true;
    enableRosetta = true;
    user = "yourname";
    taps = {
      "homebrew/homebrew-core" = homebrew-core;
      "homebrew/homebrew-cask" = homebrew-cask;
    };
    mutableTaps = false;
    trust = {
      formulae = [ "user/repo/formula" ];
      casks = [ "user/repo/cask" ];
      commands = [ "user/repo/command" ];
      taps = [ "user/repo" ];
    };
  };
}
```

--------------------------------

### Attach nix-homebrew to nix-darwin configuration

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/flake-outputs.md

Example of consuming the flake and attaching the module to a nix-darwin configuration as shown in the README.md Quick Start.

```nix
{
  inputs = {
    nix-homebrew.url = "github:zhaofengli/nix-homebrew";
    homebrew-core = { url = "github:homebrew/homebrew-core"; flake = false; };
    homebrew-cask = { url = "github:homebrew/homebrew-cask"; flake = false; };
  };
  outputs = { self, nixpkgs, darwin, nix-homebrew, homebrew-core, homebrew-cask, ... }: {
    darwinConfigurations.macbook = {
      modules = [
        nix-homebrew.darwinModules.nix-homebrew
        {
          nix-homebrew = {
            enable = true;
            enableRosetta = true;
            user = "yourname";
            taps = {
              "homebrew/homebrew-core" = homebrew-core;
              "homebrew/homebrew-cask" = homebrew-cask;
            };
            mutableTaps = false;
          };
        }
      ];
    };
  };
}
```

--------------------------------

### Advanced prefix-extended configuration

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/module-options.md

An advanced configuration example demonstrating custom prefixes, environment variables, and manual tap fetching.

```nix
{
  nix-homebrew = {
    enable = true;
    user = "alice";
    group = "staff";
    patchBrew = false;
    extraEnv = { HOMEBREW_NO_ANALYTICS = "1"; };
    prefixes = {
      "/opt/homebrew" = {
        library = "/opt/homebrew/Library";
        taps = {
          "homebrew/homebrew-core" = pkgs.fetchFromGitHub {
            owner = "homebrew"; repo = "homebrew-core"; rev = "x"; hash = "y";
          };
        };
      };
      "/some/prefix" = {
        enable = true;
        prefix = "/some/prefix";
        library = "/some/prefix/Library";
      };
    };
  };
}
```

--------------------------------

### Declarative trust configuration

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/trust-options.md

Example of how to configure trust settings in your nix-homebrew configuration.

```nix
{
  nix-homebrew.trust = {
    formulae = [ "user/repo/formula" ];
    casks = [ "user/repo/cask" ];
    commands = [ "user/repo/command" ];
    # Trust a whole tap only when comfortable with all current and future
    # formulae, casks and external commands from that tap being loaded.
    taps = [ "user/repo" ];
  };
}
```

--------------------------------

### Configure nix-homebrew to migrate existing Homebrew installation

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/README.md

Nix-darwin module configuration for migrating an existing Homebrew installation. Sets enable, enableRosetta, user, and autoMigrate to true.

```nix
{
  output = { self, darwin, nix-homebrew, ... }: {
    darwinConfigurations.macbook = {
      # (...)
      modules = [
        nix-homebrew.darwinModules.nix-homebrew
        {
          nix-homebrew = {
            # Install Homebrew under the default prefix
            enable = true;

            # Apple Silicon Only: Also install Homebrew under the default Intel prefix for Rosetta 2
            enableRosetta = true;

            # User owning the Homebrew prefix
            user = "yourname";

            # Automatically migrate existing Homebrew installations
            autoMigrate = true;
          };
        }
      ];
    };
  };
}
```

--------------------------------

### Configure nix-homebrew for new Homebrew installation

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/README.md

Nix-darwin module configuration for a fresh Homebrew install. Enables Homebrew, optionally enables Rosetta, sets the user, and optionally configures taps, mutableTaps, and trust entries. Note that trust entries are not removed automatically when removed from the lists.

```nix
{
  output = { self, nixpkgs, darwin, nix-homebrew, homebrew-core, homebrew-cask, ... }: {
    darwinConfigurations.macbook = {
      # (...)
      modules = [
        nix-homebrew.darwinModules.nix-homebrew
        {
          nix-homebrew = {
            # Install Homebrew under the default prefix
            enable = true;

            # Apple Silicon Only: Also install Homebrew under the default Intel prefix for Rosetta 2
            enableRosetta = true;

            # User owning the Homebrew prefix
            user = "yourname";

            # Optional: Declarative tap management
            taps = {
              "homebrew/homebrew-core" = homebrew-core;
              "homebrew/homebrew-cask" = homebrew-cask;
            };

            # Optional: Enable fully-declarative tap management
            #
            # With mutableTaps disabled, taps can no longer be added imperatively with `brew tap`.
            mutableTaps = false;

            # Optional: Declarative Homebrew tap trust entries.
            #
            # Note: The trust entries are _not_ removed if you remove them from those lists!
            # Use the `brew untrust` command to remove a trust entry.
            trust = {
              formulae = [ ];
              casks = [ ];
              commands = [ ];
              taps = [ ];
            };
          };
        }
        # Optional: Align homebrew taps config with nix-homebrew
        ({config, ...}: {
          homebrew.taps = builtins.attrNames config.nix-homebrew.taps;
        })
      ];
    };
  };
}
```

--------------------------------

### Unified brew launcher script

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/activation-scripts.md

The brewLauncher script generated by pkgs.writeScriptBin 'brew' and placed in systemPackages. It selects the prefix by architecture using /usr/bin/uname -m. It uses /bin/bash (Bash 3.2) for compatibility with arch -x86_64. If no prefix matches, it prints 'nix-homebrew: No Homebrew installation available for $cur_arch' to stderr and exits 1.

```bash
#!/bin/bash
set -euo pipefail
cur_arch=$(/usr/bin/uname -m)
# (arm64 block, emitted only if prefixes./opt/homebrew.enable)
if [[ "$cur_arch" == "arm64" ]]; then
  exec "${cfg.prefixes.${cfg.defaultArm64Prefix}.prefix}/bin/brew" "$@"
fi
# (x86_64 block, emitted only if prefixes./usr/local.enable)
if [[ "$cur_arch" == "x86_64" ]]; then
  exec "${cfg.prefixes.${cfg.defaultIntelPrefix}.prefix}/bin/brew" "$@"
fi
>&2 echo "nix-homebrew: No Homebrew installation available for $cur_arch"
exit 1
```

--------------------------------

### Add non-standard prefix

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/prefix-options.md

Example of adding an extra non-standard prefix. Note that non-standard prefixes lose most bottle (prebuilt package) support.

```nix
{
  nix-homebrew.prefixes = {
    "/some/prefix" = {
      library = "/some/prefix/Library";
      taps = {
        "homebrew/homebrew-core" = pkgs.fetchFromGitHub {
          owner = "homebrew"; repo = "homebrew-core"; rev = "x"; hash = "y";
        };
      };
    };
  };
}
```

--------------------------------

### Define nix-homebrew.autoMigrate boolean option

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/module-options.md

Defines the `autoMigrate` option as a boolean, defaulting to `false`. When enabled, the activation script deletes existing Homebrew repositories while keeping installed packages, allowing `setupPrefix` to run `nuke-homebrew-repository` instead of aborting.

```nix
autoMigrate = lib.mkOption {
  description = ''
    Whether to allow nix-homebrew to automatically migrate existing Homebrew installations.

    When enabled, the activation script will automatically delete
    Homebrew repositories while keeping installed packages.
  '';
  type = types.bool;
  default = false;
};
```

--------------------------------

### Expected Error Handling

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/nuke-homebrew-repository.md

Examples of error messages triggered by invalid arguments or non-Homebrew directories.

```bash
./result /not/a/homebrew-repo
# stderr: /not/a/homebrew-repo is not a git repository ; exit 1

./result /some/git/repo
# stderr: /some/git/repo does not looks like a Homebrew checkout ; exit 1

./result                    # wrong arg count
# stderr: Usage: nuke-homebrew-repository <homebrew repository> ; exit 1
```

--------------------------------

### Shell Script Header

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/nuke-homebrew-repository.md

The initial setup and argument validation logic within the shell script template.

```bash
#!@runtimeShell@
set -euo pipefail
export PATH="@path@"

if [[ "$#" != "1" ]]; then
  >&2 echo "Usage: $0 <homebrew repository>"
  >&2 echo "This script tries to nuke all tracked files in a Homebrew repository."
  exit 1
fi
```

--------------------------------

### Register activation scripts and brew launcher in nix-darwin

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/activation-scripts.md

Defines the environment.systemPackages and system.activationScripts options in modules/default.nix. The homebrew script is scheduled before nix-darwin's own homebrew activation using lib.mkBefore, and its text is exactly the setup-homebrew script text. The setup-homebrew script prints 'setting up Homebrew prefixes...' to stderr and runs the setupHomebrew shell script.

```nix
environment.systemPackages = [ brewLauncher ];
system.activationScripts = {
  homebrew.text = lib.mkBefore ''
    ${config.system.activationScripts.setup-homebrew.text}
  '';
  setup-homebrew.text = ''
    >&2 echo "setting up Homebrew prefixes..."
    ${setupHomebrew}
  '';
};
```

--------------------------------

### Building and Running the Script

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/nuke-homebrew-repository.md

Commands to build the package and execute it against a Homebrew repository path.

```bash
# Build it
nix build '.#packages.aarch64-darwin.nuke-homebrew-repository'

# Clean an Intel (or Apple Silicon) Homebrew repository, keeping state
./result /usr/local/Homebrew
# or
./result /opt/homebrew
```

--------------------------------

### Build and use helper package

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/flake-outputs.md

Commands to build the nuke-homebrew-repository package and execute the resulting binary.

```bash
nix build '.#packages.aarch64-darwin.nuke-homebrew-repository'
./result /usr/local/Homebrew
```

--------------------------------

### setupHomebrew activation script

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/activation-scripts.md

The top-level activation script that resolves user IDs and group IDs, then executes setupPrefix for each enabled Homebrew prefix.

```bash
set -euo pipefail
source ${./utils.sh}

NIX_HOMEBREW_UID=$(id -u "${cfg.user}" || (error "Failed to get UID of ${cfg.user}"; exit 1))
NIX_HOMEBREW_GID=$(dscl . -read "/Groups/${cfg.group}" | awk '($1 == "PrimaryGroupID:") { print $2 }' || (error "Failed to get GID of ${cfg.group}"; exit 1))

is_in_nix_store() { ... }
is_occupied() { [[ -e "$1" ]] && ([[ ! -L "$1" ]] || ! is_in_nix_store "$1"); }

<setupPrefix for each enabled prefix>

if test -n "${toString cfg.enableRosetta}" && ! pgrep -q oahd; then
  warn "The Intel Homebrew prefix has been set up, but Rosetta isn't installed yet."
  ohai "Run ${tty_bold}softwareupdate --install-rosetta${tty_reset} to install it."
fi
```

--------------------------------

### Running the Test Suite

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/nuke-homebrew-repository.md

Commands to build and execute the internal test suite for the repository.

```bash
nix build --print-out-paths '.#packages.aarch64-darwin.nuke-homebrew-repository.passthru.tests.test-nuke'
cat "$(nix build ... )"
```

--------------------------------

### Define flake metadata in flake.nix

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/flake-outputs.md

This snippet shows the initial configuration of the flake, including the description and the pinned Homebrew source input.

```nix
{
  description = "Homebrew installation manager for nix-darwin";

  inputs = {
    brew-src = {
      url = "github:Homebrew/brew/7.0.4";
      flake = false;
    };
  };
}
```

--------------------------------

### Declare taps with correct homebrew- prefix

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/README.md

When declaring taps, the key must be a unique folder starting with 'homebrew-'. The diff shows changing 'mtslzr/marmaduke-chromium' to 'mtslzr/homebrew-marmaduke-chromium'. The exact GitHub <user>/<repo> should almost always work.

```diff
       nix-homebrew.taps = {
-        "mtslzr/marmaduke-chromium" = inputs.marmaduke-chromium;
+        "mtslzr/homebrew-marmaduke-chromium" = inputs.marmaduke-chromium;
```

--------------------------------

### CLI Usage Syntax

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/nuke-homebrew-repository.md

The command line usage pattern for the nuke-homebrew-repository script.

```text
Usage: nuke-homebrew-repository <homebrew repository>
```

--------------------------------

### prefixType submodule definition in modules/default.nix

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/prefix-options.md

Defines the prefixType submodule with options enable, prefix, library, and taps. The prefix defaults to the attribute name; library has no default in the source; taps defaults to an empty set with an example using fetchFromGitHub.

```nix
prefixType = types.submodule ({ name, ... }: {
  options = {
    enable = lib.mkOption {
      description = ''
        Whether to set up this Homebrew prefix.
      '';
    };
    prefix = lib.mkOption {
      description = ''
        The Homebrew prefix.

        By default, it's `/opt/homebrew` for Apple Silicon Macs and
        `/usr/local` for Intel Macs.
      '';
      type = types.str;
      default = name;
    };
    library = lib.mkOption {
      description = ''
        The Homebrew library.

        By default, it's `/opt/homebrew/Library` for Apple Silicon Macs and
        `/usr/local/Homebrew/Library` for Intel Macs.
      '';
      type = types.str;
    };
    taps = lib.mkOption {
      description = ''
        A set of Nix-managed taps.
      '';
      type = types.attrsOf types.package;
      default = {};
      example = lib.literalExpression ''
        {
          "homebrew/homebrew-core" = pkgs.fetchFromGitHub {
            owner = "homebrew";
            repo = "homebrew-core";
            rev = "...";
            hash = "...";
          };
        }
      '';
    };
  };
});
```

--------------------------------

### Filter enabled prefixes

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/prefix-options.md

Only prefixes with enable = true are activated. setupHomebrew filters via builtins.attrValues cfg.prefixes and keeps those where prefix.enable is true.

```nix
enabledPrefixes = lib.filter (prefix: prefix.enable) (builtins.attrValues cfg.prefixes);
```

--------------------------------

### Inspect and manually run brew activation scripts

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/activation-scripts.md

Commands to inspect the unified and per-prefix brew launchers, and to manually remove trust entries for a tap.

```bash
# Inspect the unified launcher
cat /run/current-system/sw/bin/brew

# Inspect a generated per-prefix brew launcher
cat /opt/homebrew/bin/brew

# Manually run a trust removal (trust entries are not removed declaratively)
brew untrust --tap user/repo
```

--------------------------------

### Define shell integration options

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/module-options.md

Defines three enable options for bash, fish, and zsh integrations, all defaulting to true. When enabled, the corresponding shell init evaluates brew shellenv, silently ignoring failures with 2>/dev/null || true.

```nix
enableBashIntegration = lib.mkEnableOption "homebrew bash integration" // {
  default = true;
};

enableFishIntegration = lib.mkEnableOption "homebrew fish integration" // {
  default = true;
};

enableZshIntegration = lib.mkEnableOption "homebrew zsh integration" // {
  default = true;
};
```

--------------------------------

### Unified brew launcher prefix selection

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/prefix-options.md

The unified brew launcher uses defaultArm64Prefix and defaultIntelPrefix to select the prefix based on uname -m. For arm64 it uses the arm64 prefix, for x86_64 it uses the Intel prefix.

```bash
if [[ "$cur_arch" == "arm64" ]]; then
  exec "${cfg.prefixes.${cfg.defaultArm64Prefix}.prefix}/bin/brew" "$@"
fi
if [[ "$cur_arch" == "x86_64" ]]; then
  exec "${cfg.prefixes.${cfg.defaultIntelPrefix}.prefix}/bin/brew" "$@"
fi
```

--------------------------------

### makeBinBrew Nix function

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/activation-scripts.md

Generates the per-prefix bin/brew executable. It uses pkgs.replaceVarsWith to inject environment variables and configuration settings into a template.

```nix
makeBinBrew = prefix: let
  template = pkgs.writeText "brew.in" (''
    #!/bin/bash
    export HOMEBREW_PREFIX="@prefix@"
    export HOMEBREW_LIBRARY="@library@"
    export HOMEBREW_REPOSITORY="$HOMEBREW_LIBRARY/.homebrew-is-managed-by-nix"
    export HOMEBREW_BREW_FILE="@out@"

    export HOMEBREW_UPDATE_BEFORE="nix"
    export HOMEBREW_UPDATE_AFTER="nix"
  '' + lib.optionalString (!cfg.mutableTaps) ''
    export HOMEBREW_NO_AUTO_UPDATE=1
  '' + lib.optionalString (prefix.taps ? "homebrew/homebrew-core") ''
    export HOMEBREW_NO_INSTALL_FROM_API=1
  '' + (lib.optionalString (cfg.extraEnv != {})
          (lib.concatLines (lib.mapAttrsToList (name: value: "export ${name}=${lib.escapeShellArg value}") cfg.extraEnv)))
     + (builtins.readFile ./brew.tail.sh));
in pkgs.replaceVarsWith {
  name = "brew";
  src = template;
  isExecutable = true;
  dontPatchShebangs = true;
  replacements = {
    out = placeholder "out";
    inherit runtimePath;
    inherit (prefix) prefix library;
  };
};
```

--------------------------------

### Default prefix set in modules/default.nix

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/prefix-options.md

Defines the default prefixes for /opt/homebrew and /usr/local. The enable condition for /opt/homebrew is isAarch64, and for /usr/local it is isx86_64 || enableRosetta. The library paths and taps are set accordingly.

```nix
nix-homebrew.prefixes = {
  "/opt/homebrew" = {
    enable = pkgs.stdenv.hostPlatform.isAarch64;
    library = "/opt/homebrew/Library";
    taps = cfg.taps;
  };
  "/usr/local" = {
    enable = pkgs.stdenv.hostPlatform.isx86_64 || cfg.enableRosetta;
    library = "/usr/local/Homebrew/Library";
    taps = cfg.taps;
  };
};
```

--------------------------------

### nix-homebrew.package option definition

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/module-options.md

Defines the Homebrew package derivation. Defaults to the pinned brew-src input.

```nix
package = lib.mkOption {
  description = ''
    The homebrew package itself.
  '';
  type = types.package;
};
```

--------------------------------

### Define nix-homebrew.group string option with default "admin"

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/module-options.md

Defines the `group` option as a string defaulting to `"admin"`. The group is resolved with `dscl . -read "/Groups/${cfg.group}"` during activation.

```nix
group = lib.mkOption {
  description = ''
    The group owning the Homebrew directories.
  '';
  type = types.str;
  default = "admin";
};
```

--------------------------------

### Define nix-homebrew.user string option (required)

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/module-options.md

Defines the `user` option as a required string with no default. The user's UID is resolved during activation via `id -u` and used for `chown`/`chmod` operations, ownership of `Library`, taps, and running `brew trust` via `sudo -n -u`.

```nix
user = lib.mkOption {
  description = ''
    The user owning the Homebrew directories.
  '';
  type = types.str;
};
```

--------------------------------

### nix-homebrew.enableRosetta option definition

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/module-options.md

Configures a second Homebrew prefix for Rosetta 2. This is only supported on Apple Silicon Macs.

```nix
enableRosetta = lib.mkOption {
  description = ''
    Whether to set up the Homebrew prefix for Rosetta 2.

    This is only supported on Apple Silicon Macs.
  '';
  type = types.bool;
  default = false;
};
```

--------------------------------

### Define nix-homebrew.trust option with submodule for taps, formulae, casks, commands

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/module-options.md

Defines the `trust` option as a submodule with four list options: `taps`, `formulae`, `casks`, and `commands`. Trust entries are added during activation but not removed when removed from these lists; use `brew untrust` to remove them. Refer to upstream documentation at <https://docs.brew.sh/Tap-Trust>.

```nix
trust = lib.mkOption {
  description = ''
    Tap trust entries to be added during activation.

    Note: The trust entries are _not_ removed if you remove them from
    those lists! Use the `brew untrust` command to remove a trust entry.

    Refer to upstream documentations for more information:
    <https://docs.brew.sh/Tap-Trust>
  '';
  type = types.submodule {
    options = {
      taps = /* listOf str, default [] */;
      formulae = /* listOf str, default [] */;
      casks = /* listOf str, default [] */;
      commands = /* listOf str, default [] */;
    };
  };
  default = {};
};
```

--------------------------------

### Define nix-homebrew.prefixes attribute set of prefixType

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/module-options.md

Defines the `prefixes` option as an attribute set of `prefixType`. Sensible defaults are computed for `/opt/homebrew` and `/usr/local` in the `config` section, so usually no configuration is needed.

```nix
prefixes = lib.mkOption {
  description = ''
    A set of Homebrew prefixes to set up.

    Usually you don't need to configure this and sensible
    defaults are already set up.
  '';
  type = types.attrsOf prefixType;
};
```

--------------------------------

### nix-homebrew.trust.commands option definition

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/trust-options.md

Configuration for trusting specific fully-qualified external commands.

```nix
commands = lib.mkOption {
  description = ''
    Fully-qualified external commands to trust.
  '';
  type = types.listOf types.str;
  default = [];
  example = [ "user/repo/command" ];
};
```

--------------------------------

### Combined nix-homebrew configuration

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/configuration.md

Nix configuration enabling nix-homebrew with user 'alice', group 'staff', mutableTaps disabled, extra environment variables for Homebrew, and a tap for homebrew-core. The comments indicate that mutableTaps false sets HOMEBREW_NO_AUTO_UPDATE=1 and the tap sets HOMEBREW_NO_INSTALL_FROM_API=1.

```nix
{
  nix-homebrew = {
    enable = true;
    user = "alice";
    group = "staff";
    mutableTaps = false;          # -> HOMEBREW_NO_AUTO_UPDATE=1
    extraEnv = {
      HOMEBREW_NO_ANALYTICS = "1";
      HOMEBREW_NO_AUTO_UPDATE = "1";
    };
    taps = {
      "homebrew/homebrew-core" = inputs.homebrew-core;   # -> HOMEBREW_NO_INSTALL_FROM_API=1
    };
  };
}
```

--------------------------------

### Configure nix-homebrew trust entries

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/README.md

Nix configuration to add trust entries for non-official taps. Trust entries are not removed automatically when removed from the lists; use `brew untrust` to remove them.

```nix
nix-homebrew.trust = {
  formulae = [ "user/repo/formula" ];
  casks = [ "user/repo/cask" ];
  commands = [ "user/repo/command" ];

  # To quote upstream documentation:
  # > Trust a whole tap only when you are comfortable with all current and
  # > future formulae, casks and external commands from that tap being loaded
  # > by Homebrew.
  taps = [ "user/repo" ];
};
```

--------------------------------

### Define internal nix-homebrew.defaultArm64Prefix option

Source: https://github.com/zhaofengli/nix-homebrew/blob/main/_autodocs/api-reference/module-options.md

Defines the internal `defaultArm64Prefix` option as a string defaulting to `"/opt/homebrew"`. It is used by the unified `brew` launcher to dispatch on `uname -m == arm64`.

```nix
defaultArm64Prefix = lib.mkOption {
  description = ''
    Key of the default Homebrew prefix for ARM64 macOS.
  '';
  internal = true;
  type = types.str;
  default = "/opt/homebrew";
};
```
Tokens:
Raw