I am the kind of person NixOS is built to capture, and it captured me completely. Everything good I’m about to say is the testimony of an addict about his supply. Weight it accordingly.
Post Contents
My Conflict of Interest #
I have a character flaw that I used to dress up as a virtue: I cannot leave a piece of technology alone if it is merely “working”. If some code is functioning at 95% efficiency, a normal person enjoys the 95% and goes outside. I will spend fourteen consecutive hours – destroying my sleep cycle in the process – just to violently squeeze out the remaining 5% (usually breaking three unrelated things along the way).
Stripped of its romantic tinkerer framing, and disregarding the usual sugarcoating of it being a “passion for engineering”, it becomes evident that this is an unhealthy need for total control, and more often than not, an elegant way to avoid doing harder, non-technical things. It is much easier to spend an evening ricing your desktop to pixel-perfection, than to sit with the discomfort of finishing a creative project or, God forbid, socializing.
I call this compulsion the Need to Fix™.
On a standard Linux distribution, the Fix™ has natural boundaries. Eventually, you accumulate so many undocumented changes, hastily-compiled binaries in /usr/local/bin, outdated /etc configs, and collections of shell hacks that the machine becomes a glass house. You are one pacman -Syu from a total system collapse. You back away slowly.
NixOS removes the friction. It takes away the natural brakes that keep your worst habits in check.
I don’t love Nix because it makes me productive. I love it because it provides an unlimited, pure, unadulterated supply of the Fix™.
What This Post Isn’t About #
NixOS provides reproducible builds, declarative syntax, atomic rollbacks, development shells, the whole lot. There are dozens of technical reviews and guides going through these features, written by calm, reasonable people. These features are real. They work exactly as advertised. We will not discuss them here. This review is written by a Specimen.
What Nix Is Supposed to Be #
NixOS is usually advertised as a pristine, mathematical utopia. A better way to manage infrastructure. One in which your system is a pure function: f(config) = system. The Final Linux Distribution You Will Ever Install because it will Cure the Chaos.
“Nix fixes this”, they said. They paint a picture of a DevOps engineer effortlessly pulling their identical environment onto a brand-new laptop, sipping an espresso while a flawless build finishes in ninety seconds. It is presented as an appliance for the hyper-rational and wise. A tool to eliminate waste, save time, and bring order to the universe.
Unfortunately, they’re not wrong.
What Nix Actually Is #
For the individual user, NixOS’ true mechanism is the systematic removal of consequence.
To understand what the tool actually does, look at the timeline of a susceptible host over a two-year period. This is the Nix Ladder of Addiction, where every step is perfectly logical in isolation:
Phase 1: The Honeymoon #
45e6e7fc | 2024-06-12 | Initial commit
ec561909 | 2024-06-14 | Add sops-nix
8a6045d6 | 2024-06-19 | Add git and gpg configs
09b42521 | 2024-06-20 | Add vscode
Innocent. Pure. You are just managing your packages and dotfiles like a civilized person. It feels clean. You feel smart.
“You can declare your secrets, too? That’s cool!”, you say.
Oh, how naive you are.
Phase 2: The Intoxication #
b86f9599 | 2024-07-02 | Add declarative qalculate config
62e062cd | 2024-07-10 | Add declarative obsidian config base
The brain rot sets in. Why manually configure your calculator and notes app when you can inject their settings on boot?
Phase 3: The Cult #
22e0150a | 2024-08-08 | Add custom impermanence module
Less than 2 months in, you decide that state is a sin. You configure your machine to literally wipe its own root partition every time you restart. Anything you wish to persist requires a contract with the configuration devil.
Phase 4: Ascension #
1234d7d4 | 2025-08-09 | Add lanzaboote
1d3a3cc8 | 2025-09-07 | Lobotomize jupiter cpu
eb3c301e | 2025-10-06 | Fuck you nvidia
You decide your boot chain needs to be mathematically verified. For reasons. On any other Linux distribution, manually enrolling custom Secure Boot keys is the point where you start sweating. But someone wrote a Nix module called lanzaboote. You add three lines of code. It just works.
Emboldened by playing God with your bootloader, you start writing derivations to alter your hardware’s behavior at the kernel level. The machine fights back; to no avail.
Phase 5: Escape Velocity #
422ee2df | 2026-02-22 | Upstream patches
ff4387e3 | 2026-06-04 | Add vscode-sops patch
84608b23 | 2026-06-04 | Add some hyprpatches
d91c00f7 | 2026-06-04 | Add LUKS TPM
Your boot process is cryptographically secure, which means you trust your hardware. And if you trust your hardware, typing a decryption password is for peasants. But doing it manually is a stateful sin. Naturally, you must write a systemd service that automatically enrolls your LUKS keys into the TPM on boot.
Then, the hubris truly takes over. You’ve written so many custom derivations to fix microscopic bugs that your ego demands an audience. You start upstreaming your patches. After all, why should your hyper-fixated slop be contained exclusively to your own system?
The End Result #
No single step in this chain is insane. Add LUKS TPM is a highly secure, reasonable cryptographic practice. Each move is the obvious local optimization. But because Nix makes every step incredibly cheap to execute and impossible to accidentally break, there is always exactly one more change.
You look up from your editor at 4:00 AM on a Sunday, blinking through the terminal glare at your 25.000 lines of configuration code spread across 478 files.
Your root partition does not exist. Your dependencies are pinned to specific git hashes. Your laptop is cross-compiling kernels and pushing them to a private cache. Your secrets are cryptographically sealed, and you realize what you’ve done.
Oops. You’ve just invented Gentoo from first principles, dipshit.
The Myth of “It Just Works” #
One of the most common things Nix users say is that once you’ve written your configuration, you’re done. Your system is reproducible. It can be rebuilt years later, exactly as it was. This is true in the same way that a fossil preserves a dead animal.
The internet, however, is a living thing. Software evolves, CVEs are published, APIs change, maintainers disappear, and so on. Your configuration may be reproducible, but the entire world around it will soon not be. Dread it, run from it, the day in which you run nix flake update arrives all the same.
And in that day, Nix absolutely does not just work. It works after you’ve spent three hours reading source code written by a Norwegian wizard in 2019. It works after discovering that there are four different modules implementing the same feature. It works after finding a GitHub issue whose solution is someOption.enable = lib.mkForce false.
It works after learning enough about systemd, TPMs, Secure Boot, flakes, overlays, kernel modules, ELF binaries, and linkers that you’ve accidentally earned a degree. Most people would call this a nightmare. Most people would call this “broken”.
But for the Fixer™, this is the entire point. Nix trickery forces you to understand the stack at a level that no other distribution requires. You come for the Fix™, and you stay because you’ve realized that now you actually know how the entire machine works.
Yes, the system is a dealer. Yes, it feeds your worst impulses. But it’s also a forge. It turns our petty, obsessive need to fiddle with things into legitimate infrastructure. Is it overkill? Absolutely. Is the software world going to collapse if you don’t upstream that one obscure patch for your window manager? Of course not. It’s just one piece of a much larger puzzle.
But the fact remains that when I do Fix™ The™ Thing™, when I force the machine to behave exactly how I want it to, I’m left with a system that is objectively more capable and better understood than if I had just lived with the default.
The Verdict #
NixOS is the only operating system that can convince a person to spend a weekend implementing cryptographically verified calculator settings.
I would highly recommend it.