From ab54d67c2a00e109d6c559b3737e9ec7e7bbc270 Mon Sep 17 00:00:00 2001
From: Kai Hoewelmeyer <kai@hoewelmeyer.eu>
Date: Sat, 9 Nov 2024 21:36:54 +0100
Subject: [PATCH] feat: use nix across platforms

Fixes #792, #778

topic:nixpkgs
---
 .github/workflows/test.yml        |  6 +--
 Makefile                          | 16 ++++++++
 alacritty/install.sh              | 12 +-----
 alacritty/test.sh                 |  8 ++++
 ccache/install.sh                 | 15 --------
 ccache/test.sh                    |  8 ++++
 clangd/install.sh                 | 23 -----------
 clangd/path.zsh                   |  1 -
 clangd/test.sh                    | 10 +++--
 cmake/install.sh                  | 28 --------------
 cmake/test.sh                     | 10 +++--
 colors/install.sh                 |  5 ---
 common/apt.sh                     |  5 ---
 common/brew.sh                    | 42 --------------------
 common/download.sh                | 36 -----------------
 common/python.sh                  | 27 ++++---------
 ctags/install.sh                  | 12 ------
 ctags/test.sh                     |  8 ++++
 efm/install.sh                    | 28 --------------
 efm/path.zsh                      |  2 -
 efm/test.sh                       |  4 +-
 flake.lock                        | 64 +++++++++++++++++++++++++++++++
 flake.nix                         | 30 +++++++++++++++
 fzf/bootstrap.zsh                 |  5 ++-
 fzf/install.sh                    | 28 --------------
 fzf/test.sh                       | 11 ++++++
 gdb/install.sh                    |  4 +-
 gdb/test.sh                       |  8 ++++
 git/install.sh                    | 14 -------
 git/test.sh                       |  8 ++++
 home.nix                          | 43 +++++++++++++++++++++
 homebrew/install.sh               | 29 --------------
 ninja/install.sh                  | 13 -------
 ninja/test.sh                     |  8 ++++
 nix/config--nix--nix.conf.symlink |  1 +
 nvim/install.sh                   | 33 +---------------
 nvim/path.zsh                     |  1 -
 nvim/test.sh                      |  8 +++-
 ripgrep/install.sh                | 22 -----------
 rust/install.sh                   | 22 ++---------
 script/check_for_upgrade.sh       |  2 +-
 script/ci.sh                      |  5 +--
 script/install                    | 20 ++++++----
 script/test                       |  7 ++++
 script/versions.sh                | 20 +++++-----
 shellcheck/install.sh             | 28 --------------
 shellcheck/path.zsh               |  1 -
 shellcheck/test.sh                |  4 +-
 system/install.sh                 | 16 --------
 system/test.sh                    | 19 +++++----
 tmux/install.sh                   | 13 -------
 virtualenvwrapper/install.sh      | 16 --------
 virtualenvwrapper/workon.zsh      | 16 +++-----
 zsh/install.sh                    | 14 -------
 zsh/test.sh                       |  8 ++++
 zsh/zshrc.symlink                 |  9 ++---
 56 files changed, 319 insertions(+), 537 deletions(-)
 create mode 100644 Makefile
 delete mode 100755 ccache/install.sh
 delete mode 100755 clangd/install.sh
 delete mode 100644 clangd/path.zsh
 delete mode 100755 cmake/install.sh
 delete mode 100644 common/brew.sh
 delete mode 100644 common/download.sh
 delete mode 100755 ctags/install.sh
 delete mode 100755 efm/install.sh
 delete mode 100644 efm/path.zsh
 create mode 100644 flake.lock
 create mode 100644 flake.nix
 delete mode 100755 fzf/install.sh
 delete mode 100755 git/install.sh
 create mode 100644 home.nix
 delete mode 100755 homebrew/install.sh
 delete mode 100755 ninja/install.sh
 create mode 100644 nix/config--nix--nix.conf.symlink
 delete mode 100644 nvim/path.zsh
 delete mode 100755 ripgrep/install.sh
 delete mode 100755 shellcheck/install.sh
 delete mode 100644 shellcheck/path.zsh
 delete mode 100755 system/install.sh
 delete mode 100755 tmux/install.sh
 delete mode 100755 virtualenvwrapper/install.sh

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0d4b6206aa..bb310f98f6 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -63,14 +63,12 @@ jobs:
         run: |
           env
           export XDG_CONFIG_HOME=~/.config
-          # Don't care about outdated, broken linkages on CI.
-          # Otherwise, this might update node or php.
-          export HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK=1
-          export HOMEBREW_NO_INSTALL_CLEANUP=1
           # Make `infocmp` for nvim healthcheck succeed
           export TERM=dumb
           # Ignore potentially insecure directories on GitHub actions runner.
           export ZSH_DISABLE_COMPFIX=true
+          # Do not rate limit with public / untrusted access bucket
+          export NIX_CONFIG="access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}"
           cd .dotfiles/
           ./script/ci.sh
       - name: Rename versions report
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000000..ba44586bb5
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,16 @@
+.PHONY: update clean
+ 
+update:
+	nix run home-manager/release-24.05 -- --impure switch --flake .#myprofile
+
+clean:
+	nix-collect-garbage -d
+
+closuresize-all:
+	nix path-info -S /Users/kaihowl/.nix-profile/ -r | sort -n -k2
+
+closuresize-single:
+	nix path-info -S /Users/kaihowl/.nix-profile/
+
+print-dependencies:
+	nix-store --query ~/.nix-profile --graph | dot -Tpdf -o out.pdf && open out.pdf
diff --git a/alacritty/install.sh b/alacritty/install.sh
index a8d30779be..ebc3bb1ef1 100755
--- a/alacritty/install.sh
+++ b/alacritty/install.sh
@@ -1,15 +1,7 @@
 #!/bin/bash
 set -e
 
-SCRIPT_DIR=$(unset CDPATH; cd "$(dirname "$0")" > /dev/null; pwd -P)
-
 if [ "$(uname)" == "Darwin" ]; then
-  source "${SCRIPT_DIR}/../common/brew.sh"
-  brew_install alacritty
-elif [[ "$(lsb_release -i)" == *"Ubuntu"* ]]; then
-  sudo snap remove alacritty || true
-  source "${SCRIPT_DIR}/../common/apt.sh"
-  apt_add_repo alacritty https://ppa.launchpadcontent.net/aslatter/ppa/ubuntu ::codename:: 3a160895cc2ce253085d08a552b24df7d43b5377
-  apt_install alacritty
+  # Actual copy needed, otherwise Spotlight will not show the app
+  sudo cp -rf ~/.nix-profile/Applications/Alacritty.app /Applications/
 fi
-
diff --git a/alacritty/test.sh b/alacritty/test.sh
index e8d7db9cd7..071ad08843 100755
--- a/alacritty/test.sh
+++ b/alacritty/test.sh
@@ -5,5 +5,13 @@ set -e
 echo "Check if alacritty is installed"
 which alacritty
 
+echo "Check if alacritty is nix controlled"
+actual_path=$(realpath "$(which alacritty)")
+if [[ "${actual_path}" != /nix/store/* ]]; then
+  echo "Actual Path: $actual_path"
+  echo Expected alacritty to be managed by nix
+  exit 1
+fi
+
 echo "Check if alacritty is runnable"
 alacritty --version
diff --git a/ccache/install.sh b/ccache/install.sh
deleted file mode 100755
index 8e97228d12..0000000000
--- a/ccache/install.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/bin/bash
-set -e
-
-SCRIPT_DIR=$(unset CDPATH; cd "$(dirname "$0")" > /dev/null; pwd -P)
-
-if [ "$(uname)" == "Darwin" ]; then
-  source "${SCRIPT_DIR}/../common/brew.sh"
-  brew_install ccache
-elif [[ "$(lsb_release -i)" == *"Ubuntu"* ]]; then
-  # Installing build-essential to have a working compiler for the test.sh
-  # Not necessary on macOS as a full llvm is installed
-  source "${SCRIPT_DIR}/../common/apt.sh"
-  apt_install ccache build-essential
-fi
-
diff --git a/ccache/test.sh b/ccache/test.sh
index 56b1dc7006..80800bc0ec 100755
--- a/ccache/test.sh
+++ b/ccache/test.sh
@@ -4,6 +4,14 @@ set -e
 echo "Check if ccache is available"
 which ccache
 
+echo "Check if ccache is nix controlled"
+actual_path=$(realpath "$(which ccache)")
+if [[ "${actual_path}" != /nix/store/* ]]; then
+  echo "Actual Path: $actual_path"
+  echo Expected ccache to be managed by nix
+  exit 1
+fi
+
 echo "Check if ccache is runnable"
 ccache --version
 
diff --git a/clangd/install.sh b/clangd/install.sh
deleted file mode 100755
index 9b497b225b..0000000000
--- a/clangd/install.sh
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/bin/bash
-set -e
-
-SCRIPT_DIR=$(unset CDPATH; cd "$(dirname "$0")" > /dev/null; pwd -P)
-
-if [ "$(uname)" == "Darwin" ]; then
-  version=17.0.3
-  download_url="https://github.com/clangd/clangd/releases/download/${version}/clangd-mac-${version}.zip"
-  expect_hash="7c311297ad28dd516ebcc3f902652cb729bbe34840806d2d5b1bebed1a9bba17"
-
-  file_name=clangd-mac-${version}.zip
-
-  source "${SCRIPT_DIR}/../common/download.sh"
-  cache_file "$file_name" "$download_url" "$expect_hash"
-
-  mkdir -p ~/.clangd
-  # TODO(kaihowl) unpacking a zip with `tar` is "weird"
-  tar -C ~/.clangd --extract -z -f "$(cache_path "${file_name}")" --strip-components 1
-elif [[ "$(lsb_release -i)" == *"Ubuntu"* ]]; then
-  source "${SCRIPT_DIR}/../common/apt.sh"
-  apt_add_repo llvm https://apt.llvm.org/::codename:: llvm-toolchain-::codename:: 6084F3CF814B57C1CF12EFD515CF4D18AF4F7421
-  apt_install clangd
-fi
diff --git a/clangd/path.zsh b/clangd/path.zsh
deleted file mode 100644
index 7a2f4659ca..0000000000
--- a/clangd/path.zsh
+++ /dev/null
@@ -1 +0,0 @@
-export PATH=~/.clangd/bin:$PATH
diff --git a/clangd/test.sh b/clangd/test.sh
index 285a1361f7..3421442cb9 100755
--- a/clangd/test.sh
+++ b/clangd/test.sh
@@ -10,8 +10,10 @@ clangd --version
 echo "Check that clangd can be started"
 clangd --help > /dev/null
 
-echo "Check that clangd is installed from llvm apt repo (Ubuntu-only)"
-if [[ "$(lsb_release -i)" == *"Ubuntu"* ]]; then
-  apt-cache policy clangd
-  apt-cache policy clangd | grep -F '**' -A1 | grep -F apt.llvm.org
+echo "Check that clangd is nix managed"
+actual_path=$(realpath "$(which clangd)")
+if [[ "${actual_path}" != /nix/store/* ]]; then
+  echo "Actual Path: $actual_path"
+  echo Expected clangd to be managed by nix
+  exit 1
 fi
diff --git a/cmake/install.sh b/cmake/install.sh
deleted file mode 100755
index 3a42b7c634..0000000000
--- a/cmake/install.sh
+++ /dev/null
@@ -1,28 +0,0 @@
-#!/bin/bash
-set -e
-
-set -o pipefail
-
-SCRIPT_DIR=$(unset CDPATH; cd "$(dirname "$0")" > /dev/null; pwd -P)
-
-if [ "$(uname)" == "Darwin" ]; then
-  source "${SCRIPT_DIR}/../common/brew.sh"
-  brew_install cmake
-elif [[ "$(lsb_release -i)" == *"Ubuntu"* ]]; then
-  # install latest
-  source "${SCRIPT_DIR}/../common/apt.sh"
-  # bootstrap automatic key rotation
-  if ! [[ -f /usr/share/keyrings/kitware-archive-keyring.gpg ]]; then
-    apt_install wget
-    list_name=/etc/apt/sources.list.d/temp_kitware.list
-    trap 'sudo rm -rf $list_name' EXIT
-    wget -O - https://apt.kitware.com/keys/kitware-archive-latest.asc 2>/dev/null | gpg --dearmor - | sudo tee /usr/share/keyrings/kitware-archive-keyring.gpg >/dev/null
-    echo "deb [signed-by=/usr/share/keyrings/kitware-archive-keyring.gpg] https://apt.kitware.com/ubuntu/ $(lsb_release -c -s) main" | sudo tee "$list_name" >/dev/null
-    sudo apt-get update
-    sudo rm -rf /usr/share/keyrings/kitware-archive-keyring.gpg
-    apt_install kitware-archive-keyring
-    sudo rm -rf "$list_name"
-  fi
-  apt_add_repo_with_keyfile kitware https://apt.kitware.com/ubuntu ::codename:: /usr/share/keyrings/kitware-archive-keyring.gpg
-  apt_install cmake
-fi
diff --git a/cmake/test.sh b/cmake/test.sh
index b48c16ba93..6620333630 100755
--- a/cmake/test.sh
+++ b/cmake/test.sh
@@ -4,8 +4,10 @@ set -e
 echo "Check if cmake is available"
 which cmake
 
-echo "Check that cmake is installed from llvm apt repo (Ubuntu-only)"
-if [[ "$(lsb_release -i)" == *"Ubuntu"* ]]; then
-  apt-cache policy cmake
-  apt-cache policy cmake | grep -F '**' -A1 | grep -F apt.kitware.com
+echo "Check if cmake is nix controlled"
+actual_path=$(realpath "$(which cmake)")
+if [[ "${actual_path}" != /nix/store/* ]]; then
+  echo "Actual Path: $actual_path"
+  echo Expected cmake to be managed by nix
+  exit 1
 fi
diff --git a/colors/install.sh b/colors/install.sh
index d8bcb48c98..9cf1ad9261 100755
--- a/colors/install.sh
+++ b/colors/install.sh
@@ -3,9 +3,4 @@ set -e
 
 SCRIPT_DIR=$(unset CDPATH; cd "$(dirname "$0")" > /dev/null; pwd -P)
 
-# Depends on an installed zsh for using zparseopts in change-color
-if ! command -v zsh > /dev/null; then
-  "${SCRIPT_DIR}/../zsh/install.sh"
-fi
-
 "${SCRIPT_DIR}/../colors/bin/change-color"
diff --git a/common/apt.sh b/common/apt.sh
index 091f354353..c2b9c894e4 100644
--- a/common/apt.sh
+++ b/common/apt.sh
@@ -19,11 +19,6 @@ function apt_install() {
   sudo apt-get -o DPkg::Lock::Timeout=-1 install --upgrade -y "$@"
 }
 
-function apt_remove() {
-  wait_for_apt
-  sudo apt-get remove -y "$@"
-}
-
 function apt_add_repo_with_keyfile() {
   local name
   name=$1
diff --git a/common/brew.sh b/common/brew.sh
deleted file mode 100644
index 6490e5a0cd..0000000000
--- a/common/brew.sh
+++ /dev/null
@@ -1,42 +0,0 @@
-#!/bin/bash
-set -e
-
-if [[ "$(/usr/bin/uname -m)" == "arm64" ]]; then
-  # On ARM macOS, this script installs to /opt/homebrew only
-  HOMEBREW_PREFIX="/opt/homebrew"
-else
-  # On Intel macOS, this script installs to /usr/local only
-  HOMEBREW_PREFIX="/usr/local"
-fi
-
-function ensure_brew_installed() {
-  BREW_BIN=$HOMEBREW_PREFIX/bin/brew
-  eval "$($BREW_BIN shellenv)" || true
-  if test ! "$(which brew)"
-  then
-    echo "  Installing Homebrew for you."
-    bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
-  fi
-  eval "$($BREW_BIN shellenv)"
-}
-
-function brew_install() {
-  ensure_brew_installed
-
-  # Use last argv as name
-  # TODO This does not work if formulae / casks are supplied inter-mixed.
-  for name in "$@"; do :; done
-
-  if brew list --cask "$name" > /dev/null 2>&1; then
-    # name is CASK and it is installed
-    brew upgrade "$name"
-  else
-    # Install (FORMULA or CASK) or upgrade (only FORMULA) if already installed (this is done by `install` if HOMEBREW_NO_INSTALL_UPGRADE is not set)
-    brew install "$@"
-  fi
-}
-
-function brew_remove() {
-  ensure_brew_installed
-  brew remove -f "$@"
-}
diff --git a/common/download.sh b/common/download.sh
deleted file mode 100644
index f52d573ee0..0000000000
--- a/common/download.sh
+++ /dev/null
@@ -1,36 +0,0 @@
-#!/bin/bash
-set -e
-
-cachedir=~/.dotfile-binary-cache
-
-mkdir -p "${cachedir}"
-
-# Download file from url and store under name in cache if not yet present.
-# Verify integrity with sha256 sum
-function cache_file() {
-  file_name=$1
-  file_url=$2
-  file_hash=$3
-
-  cache_file=$(cache_path "${file_name}")
-
-  if ! [ -f "${cache_file}" ]; then
-    curl -Lo "${cache_file}" "${file_url}"
-  else
-    echo File already exists, skipping download.
-  fi
-
-  actual_hash="$(shasum -a 256 "$(cache_path "${file_name}")" | cut -d' ' -f 1)"
-  if [[ "$file_hash" != "$actual_hash" ]]; then
-    echo "shasum mismatch for ${file_name}. Aborting."
-    echo "Expected $file_hash."
-    echo "Got $actual_hash."
-    exit 1
-  fi
-}
-
-# Return the path of the cached file
-function cache_path() {
-  filename=$1
-  echo "${cachedir}/${filename}"
-}
diff --git a/common/python.sh b/common/python.sh
index 46ca399664..720f5b3005 100644
--- a/common/python.sh
+++ b/common/python.sh
@@ -2,27 +2,11 @@
 
 set -e
 
-function ensure_python_installed() {
-  local script_dir
-  script_dir=$(unset CDPATH; cd "$(dirname "${BASH_SOURCE[0]}")" > /dev/null; pwd -P)
-  if [[ "$(uname)" == "Linux" && "$(lsb_release -i)" == *"Ubuntu"* ]]; then
-    source "${script_dir}/apt.sh"
-    # venv is needed as Ubuntu 22.04 otherwise has no ensurepip and venv fails.
-    # Install all of these packages as a sane baseline.
-    apt_install --no-install-recommends python3-pip python3-dev python3-venv
-  else
-    # The apple xcode python is broken. Use brew's python version instead.
-    source "${script_dir}/brew.sh"
-    brew_install python
-  fi
-}
-
 function install_in_named_virtualenv() {
   local venvname
   venvname=$1
   shift
 
-  ensure_python_installed
   # Using venv instead of virtualenv as homebrews virtualenv is completely
   # separate from its python. I.e., it is not installed as a site package.
   # Installing virtualenv globally defeats the purpose of having venvs in the
@@ -30,10 +14,15 @@ function install_in_named_virtualenv() {
   # Major difference, it does not seed wheel (needed by pynvim) into the
   # virtualenv. This is done manually including an upgrade of pip and
   # setuptools.
-  python3 -m venv "$HOME/.virtualenvs/$venvname"
+  python3Binary=$HOME/.virtualenvs/$venvname/bin/python3 
+  if [[ -f $python3Binary ]] && ! [[ $(realpath "$python3Binary") == /nix/store/* ]]; then
+      echo "Delete pre-nix-era venv, start fresh"
+      rm -rf "$HOME/.virtualenvs/$venvname/"
+  fi
+  ~/.nix-profile/bin/python3 -m venv "$HOME/.virtualenvs/$venvname"
   # Must run independently as wheel is a non-declared dependency of some packages.
-  "$HOME/.virtualenvs/$venvname/bin/python3" -m pip install --upgrade pip setuptools wheel
-  "$HOME/.virtualenvs/$venvname/bin/python3" -m pip install --upgrade "$*"
+  "$python3Binary" -m pip install --upgrade pip setuptools wheel
+  "$python3Binary" -m pip install --upgrade "$*"
 }
 
 function install_in_nvim_virtualenv() {
diff --git a/ctags/install.sh b/ctags/install.sh
deleted file mode 100755
index 3b457e9aa2..0000000000
--- a/ctags/install.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/bin/bash
-set -e
-
-SCRIPT_DIR=$(unset CDPATH; cd "$(dirname "$0")" > /dev/null; pwd -P)
-
-if [ "$(uname)" == "Darwin" ]; then
-  source "${SCRIPT_DIR}/../common/brew.sh"
-  brew_install universal-ctags
-elif [[ "$(lsb_release -i)" == *"Ubuntu"* ]]; then
-  source "${SCRIPT_DIR}/../common/apt.sh"
-  apt_install --no-install-recommends universal-ctags
-fi
diff --git a/ctags/test.sh b/ctags/test.sh
index 68d854e593..890184b2c6 100755
--- a/ctags/test.sh
+++ b/ctags/test.sh
@@ -4,5 +4,13 @@ set -e
 echo "Check if (universal-)ctags is available"
 which ctags
 
+echo "Check if ctags is nix controlled"
+actual_path=$(realpath "$(which ctags)")
+if [[ "${actual_path}" != /nix/store/* ]]; then
+  echo "Actual Path: $actual_path"
+  echo Expected ctags to be managed by nix
+  exit 1
+fi
+
 echo "Check if ctags is runnable"
 ctags --version
diff --git a/efm/install.sh b/efm/install.sh
deleted file mode 100755
index cd9f5603b3..0000000000
--- a/efm/install.sh
+++ /dev/null
@@ -1,28 +0,0 @@
-#!/bin/bash
-set -e
-
-SCRIPT_DIR=$(unset CDPATH; cd "$(dirname "$0")" > /dev/null; pwd -P)
-
-version=0.0.50
-
-if [ "$(uname -s)" = "Darwin" ]; then
-  if [ "$(uname -m)" = "arm64" ]; then
-    download_url="https://github.com/mattn/efm-langserver/releases/download/v${version}/efm-langserver_v${version}_darwin_arm64.zip"
-    expect_hash="97bb371ff716faeaecb8fa0d4b108068a015e5ca4a9fc6ae43dc44900ff39248"
-  else
-    download_url="https://github.com/mattn/efm-langserver/releases/download/v${version}/efm-langserver_v${version}_darwin_amd64.zip"
-    expect_hash="1d859101e727493c7180cd39d22f65061148e469468529f7498e8a638fc9664c"
-  fi
-elif [[ "$(lsb_release -i)" == *"Ubuntu"* ]]; then
-  download_url="https://github.com/mattn/efm-langserver/releases/download/v${version}/efm-langserver_v${version}_linux_amd64.tar.gz"
-  expect_hash="089689a97b072475cc64d0ce2e4a0472421861c79f4e873d91793a8db1a2eee9"
-fi
-
-file_name=efm-langserver-${version}.tar.gz
-
-source "${SCRIPT_DIR}/../common/download.sh"
-cache_file "$file_name" "$download_url" "$expect_hash"
-
-mkdir -p ~/.efm
-tar -C ~/.efm --extract -z -f "$(cache_path "${file_name}")" --strip-components 1
-
diff --git a/efm/path.zsh b/efm/path.zsh
deleted file mode 100644
index 9a50fb0a12..0000000000
--- a/efm/path.zsh
+++ /dev/null
@@ -1,2 +0,0 @@
-export PATH=~/.efm:$PATH
-
diff --git a/efm/test.sh b/efm/test.sh
index ce8c1c1f4a..fe1c62f8c7 100755
--- a/efm/test.sh
+++ b/efm/test.sh
@@ -9,9 +9,9 @@ efm-langserver -v
 
 echo "Check if efm-langserver is user-installed one"
 actual_path=$(realpath "$(which efm-langserver)")
-if [[ "${actual_path}" != $(realpath ~/.efm/)* ]]; then
+if [[ ${actual_path} != /nix/store/* ]]; then
   echo "Actual Path: $actual_path"
-  echo Expected to be in ~/.efm/ instead
+  echo Expected to be managed by nix
   exit 1
 fi
 
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000000..10a6739c3c
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,64 @@
+{
+  "nodes": {
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1726989464,
+        "narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "release-24.05",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "nixpkg-unstable": {
+      "locked": {
+        "lastModified": 1728538411,
+        "narHash": "sha256-f0SBJz1eZ2yOuKUr5CA9BHULGXVSn6miBuUWdTyhUhU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b69de56fac8c2b6f8fd27f2eca01dcda8e0a4221",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-unstable",
+        "type": "indirect"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1730327045,
+        "narHash": "sha256-xKel5kd1AbExymxoIfQ7pgcX6hjw9jCgbiBjiUfSVJ8=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "080166c15633801df010977d9d7474b4a6c549d7",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-24.05",
+        "type": "indirect"
+      }
+    },
+    "root": {
+      "inputs": {
+        "home-manager": "home-manager",
+        "nixpkg-unstable": "nixpkg-unstable",
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000000..0d2562732f
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,30 @@
+{
+  description = "My home manager configuration";
+
+  inputs = {
+    nixpkgs.url = "nixpkgs/nixos-24.05";
+
+    nixpkg-unstable.url = "nixpkgs/nixos-unstable";
+
+    home-manager = {
+      url = "github:nix-community/home-manager/release-24.05";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs = { nixpkgs, home-manager, nixpkg-unstable, ... }:
+    let
+      lib = nixpkgs.lib;
+      system = builtins.currentSystem;
+      pkgs = import nixpkgs { inherit system; };
+      pkgs-unstable = import nixpkg-unstable { inherit system; };
+    in {
+      homeConfigurations = {
+        myprofile = home-manager.lib.homeManagerConfiguration {
+          inherit pkgs;
+          extraSpecialArgs = {inherit pkgs-unstable;};
+          modules = [ ./home.nix ];
+        };
+      };
+    };
+}
diff --git a/fzf/bootstrap.zsh b/fzf/bootstrap.zsh
index 15104b1936..701b1600c0 100644
--- a/fzf/bootstrap.zsh
+++ b/fzf/bootstrap.zsh
@@ -1,2 +1,3 @@
-# shellcheck disable=SC1090
-[ -f ~/.fzf.zsh ] && source ~/.fzf.zsh
+# shellcheck disable=all
+[ -f ~/.nix-profile/share/fzf/completion.zsh ] && source ~/.nix-profile/share/fzf/completion.zsh
+[ -f ~/.nix-profile/share/fzf/key-bindings.zsh ] && source ~/.nix-profile/share/fzf/key-bindings.zsh
diff --git a/fzf/install.sh b/fzf/install.sh
deleted file mode 100755
index d1afc0b9eb..0000000000
--- a/fzf/install.sh
+++ /dev/null
@@ -1,28 +0,0 @@
-#!/bin/bash
-set -e
-
-SCRIPT_DIR=$(unset CDPATH; cd "$(dirname "$0")" > /dev/null; pwd -P)
-
-if ! which zsh; then
-  printf '\033[0;31m%s\033[0m\n' 'Please install zsh first.'
-  exit 1
-fi
-
-if [ "$(uname)" == "Darwin" ]; then
-  source "${SCRIPT_DIR}/../common/brew.sh"
-  if ! which curl > /dev/null; then
-    brew_install curl
-  fi
-  if ! which wget > /dev/null; then
-    brew_install wget
-  fi
-elif [[ "$(lsb_release -i)" == *"Ubuntu"* ]]; then
-  source "${SCRIPT_DIR}/../common/apt.sh"
-  apt_install wget curl git
-fi
-
-if [ ! -d ~/.fzf ]; then
-  git clone --depth 1 https://github.com/junegunn/fzf.git ~/.fzf
-fi
-(cd ~/.fzf && git pull --rebase)
-~/.fzf/install --key-bindings --completion --no-update-rc --no-bash --no-fish
diff --git a/fzf/test.sh b/fzf/test.sh
index 62a8f33d62..9805be1770 100755
--- a/fzf/test.sh
+++ b/fzf/test.sh
@@ -4,8 +4,19 @@ set -e
 echo "Checking whether fzf is on path"
 which fzf
 
+echo "Check if fzf is nix controlled"
+actual_path=$(realpath "$(which fzf)")
+if [[ "${actual_path}" != /nix/store/* ]]; then
+  echo "Actual Path: $actual_path"
+  echo Expected fzf to be managed by nix
+  exit 1
+fi
+
 echo "Check if fzf is runnable"
 fzf --version
 
+echo "Check that ctrl-t is registered for fzf"
+bindkey | grep -i '"\^T".*fzf'
+
 echo "Check that ctrl-xo is registered"
 bindkey | grep -i '\^X\^O'
diff --git a/gdb/install.sh b/gdb/install.sh
index 37ac2bc7b5..5771711220 100755
--- a/gdb/install.sh
+++ b/gdb/install.sh
@@ -10,9 +10,9 @@ if [[ "$(lsb_release -i 2> /dev/null)" == *"Ubuntu"* ]]; then
   codename=$(lsb_release -cs)
   apt_add_repo ubuntu-toolchain-test https://ppa.launchpadcontent.net/ubuntu-toolchain-r/test/ubuntu ::codename:: 60C317803A41BA51845E371A1E9377A2BA9EF27F
   if [[ "$codename" == *"focal"* ]]; then
-    apt_install clang gdb libstdc++6-10-dbg
+    apt_install clang libstdc++6-10-dbg
   elif [[ "$codename" == *"jammy"* ]]; then
-    apt_install clang gdb libstdc++6-12-dbg
+    apt_install clang libstdc++6-12-dbg
   else
     echo "Unsupported Ubuntu version $codename"
     echo "Maybe the following command will point to the correct version"
diff --git a/gdb/test.sh b/gdb/test.sh
index 9e0993f502..e342f56b07 100755
--- a/gdb/test.sh
+++ b/gdb/test.sh
@@ -6,6 +6,14 @@ if [ "$(uname)" == "Darwin" ]; then
   exit 0
 fi
 
+echo "Check if gdb is nix controlled"
+actual_path=$(realpath "$(which gdb)")
+if [[ "${actual_path}" != /nix/store/* ]]; then
+  echo "Actual Path: $actual_path"
+  echo Expected gdb to be managed by nix
+  exit 1
+fi
+
 # Example output:
 #   GNU gdb (Ubuntu 10.2-0ubuntu1~20.04~1) 10.2
 version=$(gdb --version | awk 'NR==1 {print $(NF)}')
diff --git a/git/install.sh b/git/install.sh
deleted file mode 100755
index f3d1a63dff..0000000000
--- a/git/install.sh
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/bin/bash
-set -e
-
-SCRIPT_DIR=$(unset CDPATH; cd "$(dirname "$0")" > /dev/null; pwd -P)
-
-if [ "$(uname)" == "Darwin" ]; then
-  source "${SCRIPT_DIR}/../common/brew.sh"
-  # Use --overwrite due to #347, linking of git on GH Actions
-  brew_install --overwrite git
-elif [[ "$(lsb_release -i)" == *"Ubuntu"* ]]; then
-  source "${SCRIPT_DIR}/../common/apt.sh"
-  apt_add_repo git-core https://ppa.launchpadcontent.net/git-core/ppa/ubuntu ::codename:: E1DD270288B4E6030699E45FA1715D88E1DF1F24
-  apt_install git
-fi
diff --git a/git/test.sh b/git/test.sh
index 8e4d112c2f..2dfd2ac22c 100755
--- a/git/test.sh
+++ b/git/test.sh
@@ -7,6 +7,14 @@ which git
 echo "Check if git is runnable"
 git --version
 
+echo "Check if git is nix controlled"
+actual_path=$(realpath "$(which git)")
+if [[ "${actual_path}" != /nix/store/* ]]; then
+  echo "Actual Path: $actual_path"
+  echo Expected git to be managed by nix
+  exit 1
+fi
+
 echo "Ensure git is >= 2.34.0 to support ssh signing"
 git --version
 version=$(git --version 2>&1 | cut -d' ' -f3)
diff --git a/home.nix b/home.nix
new file mode 100644
index 0000000000..96fbf153cc
--- /dev/null
+++ b/home.nix
@@ -0,0 +1,43 @@
+{ lib, pkgs, pkgs-unstable, ... }:
+{
+  home = {
+    packages = with pkgs; [
+      alacritty
+      ccache
+      clang-tools
+      cmake
+      universal-ctags
+      efm-langserver
+      fzf
+      git
+      ninja
+      neovim-unwrapped
+      ripgrep
+      rustup
+      shellcheck
+      tmux
+      zsh expect
+      python3
+      python3Packages.virtualenv
+      python3Packages.virtualenvwrapper
+      python3Packages.pip
+      # support tooling
+      tree jq htop
+      pkgs-unstable.ncdu
+      flock
+      # Assumed to be present for Conan tooling
+      automake libtool pkg-config
+    ]
+    ++ (lib.optional pkgs.stdenv.isLinux gdb)
+    # TODO(kaihowl) Double check if reattach-to-user-namespace is still needed
+    # ++ (lib.optionals pkgs.stdenv.isDarwin [reattach-to-user-namespace coreutils])
+    ;
+
+    # This actually needs to be your username
+    # TODO(kaihowl) remove impurity again?
+    username = builtins.getEnv "USER";
+    homeDirectory = /. + (builtins.getEnv "HOME");
+
+    stateVersion = "24.05";
+  };
+}
diff --git a/homebrew/install.sh b/homebrew/install.sh
deleted file mode 100755
index 95125bc260..0000000000
--- a/homebrew/install.sh
+++ /dev/null
@@ -1,29 +0,0 @@
-#!/bin/bash
-set -eu
-#
-# Homebrew
-#
-# This installs some of the common dependencies needed (or at least desired)
-# using Homebrew.
-
-SCRIPT_DIR=$(unset CDPATH; cd "$(dirname "$0")" > /dev/null; pwd -P)
-
-# If not OSX, just exit cleanly
-if [ "$(uname -s)" != "Darwin" ]; then
-  exit 0
-fi
-
-source "${SCRIPT_DIR}/../common/brew.sh"
-
-if ! grep "brew shellenv" ~/.zprofile; then
-  echo "eval \"\$($HOMEBREW_PREFIX/bin/brew shellenv)\"" >> ~/.zprofile
-fi
-
-# Install homebrew packages
-brew_install coreutils
-
-brew_install flock
-
-# Install reattach-to-user-namespace
-# This makes sure that tmux + vim is able to use the system clipboard
-brew_install reattach-to-user-namespace
diff --git a/ninja/install.sh b/ninja/install.sh
deleted file mode 100755
index c6742640ad..0000000000
--- a/ninja/install.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/bin/bash
-set -e
-
-SCRIPT_DIR=$(unset CDPATH; cd "$(dirname "$0")" > /dev/null; pwd -P)
-
-if [ "$(uname)" == "Darwin" ]; then
-  source "${SCRIPT_DIR}/../common/brew.sh"
-  brew_install ninja
-elif [[ "$(lsb_release -i)" == *"Ubuntu"* ]]; then
-  source "${SCRIPT_DIR}/../common/apt.sh"
-  apt_install --no-install-recommends ninja-build
-fi
-
diff --git a/ninja/test.sh b/ninja/test.sh
index 19305ef9d7..d810cc2756 100755
--- a/ninja/test.sh
+++ b/ninja/test.sh
@@ -4,5 +4,13 @@ set -e
 echo "Check if ninja is available"
 which ninja
 
+echo "Check if ninja is nix controlled"
+actual_path=$(realpath "$(which ninja)")
+if [[ "${actual_path}" != /nix/store/* ]]; then
+  echo "Actual Path: $actual_path"
+  echo Expected ninja to be managed by nix
+  exit 1
+fi
+
 echo "Check if ninja is runnable"
 ninja --version
diff --git a/nix/config--nix--nix.conf.symlink b/nix/config--nix--nix.conf.symlink
new file mode 100644
index 0000000000..c7d7291eb0
--- /dev/null
+++ b/nix/config--nix--nix.conf.symlink
@@ -0,0 +1 @@
+experimental-features = nix-command flakes
diff --git a/nvim/install.sh b/nvim/install.sh
index 4eb9c92aa0..ba59b290f0 100755
--- a/nvim/install.sh
+++ b/nvim/install.sh
@@ -1,37 +1,6 @@
 #!/bin/bash
 set -e
 
-SCRIPT_DIR=$(unset CDPATH; cd "$(dirname "$0")" > /dev/null; pwd -P)
-
-version=0.10.1
-
-if [ "$(uname -s)" = "Darwin" ]; then
-  if [ "$(uname -m)" = "arm64" ]; then
-    download_url="https://github.com/neovim/neovim/releases/download/v${version}/nvim-macos-arm64.tar.gz"
-    expect_hash="4b322a8da38f0bbdcdcc9a2b224a7b5267f0b1610b7345cb880d803e03bb860b"
-  else
-    download_url="https://github.com/neovim/neovim/releases/download/v${version}/nvim-macos-x86_64.tar.gz"
-    expect_hash="dd88c86164e6fb34ee364c4a2b42c6a1832890003ae7c9c733032697d92cf7a6"
-  fi
-elif [[ "$(lsb_release -i)" == *"Ubuntu"* ]]; then
-  download_url="https://github.com/neovim/neovim/releases/download/v${version}/nvim-linux64.tar.gz"
-  expect_hash="4867de01a17f6083f902f8aa5215b40b0ed3a36e83cc0293de3f11708f1f9793"
-fi
-
-file_name=nvim-${version}.tar.gz
-
-source "${SCRIPT_DIR}/../common/download.sh"
-cache_file "$file_name" "$download_url" "$expect_hash"
-
-# Ensure a clean install with no left behind files
-rm -rf ~/.nvim
-mkdir -p ~/.nvim
-tar -C ~/.nvim --extract -z -f "$(cache_path "${file_name}")" --strip-components 1
-
-# Make freshly installed nvim available in path
-script_dir=$(dirname "$0")
-. "${script_dir}/path.zsh"
-
 # update packages in Plug
 # install plug if not already installed
 plug_dir="${XDG_DATA_HOME:-$HOME/.local/share}"/nvim/site/autoload/plug.vim
@@ -39,4 +8,4 @@ if [ ! -d "$plug_dir" ]; then
   curl -fLo "${plug_dir}" --create-dirs https://raw.githubusercontent.com/junegunn/vim-plug/master/plug.vim
 fi
 
-nvim -u NONE --headless -c 'let g:first_time_startup=1' -c 'source ~/.config/nvim/init.vim' +PlugUpgrade '+PlugClean!' '+PlugUpdate!' +qall
+~/.nix-profile/bin/nvim -u NONE --headless -c 'let g:first_time_startup=1' -c 'source ~/.config/nvim/init.vim' +PlugUpgrade '+PlugClean!' '+PlugUpdate!' +qall
diff --git a/nvim/path.zsh b/nvim/path.zsh
deleted file mode 100644
index d2baf11960..0000000000
--- a/nvim/path.zsh
+++ /dev/null
@@ -1 +0,0 @@
-export PATH=~/.nvim/bin:$PATH
diff --git a/nvim/test.sh b/nvim/test.sh
index 6ab791b214..3b1507a3a6 100755
--- a/nvim/test.sh
+++ b/nvim/test.sh
@@ -10,11 +10,15 @@ nvim --version
 echo "Check if vim alias is set"
 which vim
 
+echo "Check if efm is available"
+which efm-langserver
+efm-langserver -v
+
 echo "Check if nvim is user-installed one"
 actual_path=$(realpath "$(which nvim)")
-if [[ "${actual_path}" != $(realpath ~/.nvim/bin)* ]]; then
+if [[ "${actual_path}" != /nix/store/* ]]; then
   echo "Actual Path: $actual_path"
-  echo Expected to be in ~/.nvim/bin instead
+  echo Expected nvim to be managed by nix
   exit 1
 fi
 
diff --git a/ripgrep/install.sh b/ripgrep/install.sh
deleted file mode 100755
index a79ad73b72..0000000000
--- a/ripgrep/install.sh
+++ /dev/null
@@ -1,22 +0,0 @@
-#!/bin/bash
-set -e
-
-SCRIPT_DIR=$(unset CDPATH; cd "$(dirname "$0")" > /dev/null; pwd -P)
-
-if [ "$(uname)" == "Darwin" ]; then
-  source "${SCRIPT_DIR}/../common/brew.sh"
-  brew_install ripgrep
-elif [[ "$(lsb_release -i)" == *"Ubuntu"* ]]; then
-  source "${SCRIPT_DIR}/../common/apt.sh"
-  apt_install curl
-
-  source "${SCRIPT_DIR}/../common/download.sh"
-
-  version=14.1.1
-  file_name=ripgrep_${version}
-  download_url=https://github.com/BurntSushi/ripgrep/releases/download/${version}/ripgrep_${version}-1_amd64.deb
-  expect_hash="2f0c732ef166b4f7be7190d4012d60b3f8467bdd6f795c0598817bd2ac1706ae"
-
-  cache_file "$file_name" "$download_url" "$expect_hash"
-  sudo dpkg -i "$(cache_path "${file_name}")"
-fi
diff --git a/rust/install.sh b/rust/install.sh
index 69851389f4..43b4a51506 100755
--- a/rust/install.sh
+++ b/rust/install.sh
@@ -1,22 +1,8 @@
 #!/bin/bash
 set -e
 
-SCRIPT_DIR=$(unset CDPATH; cd "$(dirname "$0")" > /dev/null; pwd -P)
-
-version=4
-download_url="https://sh.rustup.rs"
-# Compare with https://github.com/rust-lang/rustup/blob/master/rustup-init.sh
-expect_hash="32a680a84cf76014915b3f8aa44e3e40731f3af92cd45eb0fcc6264fd257c428"
-
-file_name=rustup-sh-${version}
-
-source "${SCRIPT_DIR}/../common/download.sh"
-cache_file "$file_name" "$download_url" "$expect_hash"
-
-rustupinit="$(cache_path "${file_name}")"
-chmod +x "${rustupinit}"
-"${rustupinit}" -y --verbose --component rust-analyzer
-# shellcheck disable=SC1091
-source "$HOME/.cargo/env"
-ln -sf "$(rustup which rust-analyzer)" "$HOME/.cargo/bin/"
+PATH=~/.nix-profile/bin/:$PATH
 
+rustup update
+rustup default stable
+rustup component add rust-analyzer
diff --git a/script/check_for_upgrade.sh b/script/check_for_upgrade.sh
index aa3d975375..6d0b06c53b 100755
--- a/script/check_for_upgrade.sh
+++ b/script/check_for_upgrade.sh
@@ -13,7 +13,7 @@ function _update_dots_update() {
 }
 
 function _upgrade_dots() {
-  /usr/bin/env DOTS="$DOTS" /bin/zsh -c "flock -E 250 -n '$DOTS/script/upgrade.sh.lock' -c '$DOTS/script/upgrade.sh'"
+  /usr/bin/env DOTS="$DOTS" zsh -c "flock -E 250 -n '$DOTS/script/upgrade.sh.lock' -c '$DOTS/script/upgrade.sh'"
   if [ $? -eq 250 ]; then
     printf '\033[0;93m%s\033[0m\n' 'Upgrade already running. Skipping this invocation.'
     return 1
diff --git a/script/ci.sh b/script/ci.sh
index 269d99a589..733b5688b7 100755
--- a/script/ci.sh
+++ b/script/ci.sh
@@ -48,9 +48,8 @@ TEST_END=$(date +%s)
 TEST_DURATION=$((TEST_END - TEST_START))
 add_measurement test $TEST_DURATION
 
-source nvim/path.zsh
-run_measurement nvim nvim +qall
-run_measurement zsh zsh -i -c 'exit'
+run_measurement nvim ~/.nix-profile/bin/nvim +qall
+run_measurement zsh ~/.nix-profile/bin/zsh -i -c 'exit'
 
 CI_END=$(date +%s)
 CI_DURATION=$((CI_END - CI_START))
diff --git a/script/install b/script/install
index 2b5096694d..cbaa2419c0 100755
--- a/script/install
+++ b/script/install
@@ -30,19 +30,25 @@ trap restore_selinux EXIT
 
 source common/perf_stubs.sh
 
-if [[ "$(uname)" == "Linux" && "$(lsb_release -i)" == *"Ubuntu"* ]]; then
-  source common/apt.sh
-  apt_update
-fi
-
 if [[ "$(uname)" == *"Darwin"* ]] && [[ "$(xcode-select -p)" == *"CommandLineTools"* ]]; then
   # Full XCode is for example needed to compile pynvim's greenlet
   printf "Running \e[32mFull XCode install needed\e[0m"
   exit 1
 fi
 
-# No explicit update for homebrew, there are enough update and cleanup
-# invocations automatically after a certain time has passed.
+if ! [ -f /nix/var/nix/profiles/default/bin/nix ]; then
+  curl -L https://nixos.org/nix/install | sh -s -- --daemon
+fi
+
+# Instantiate the home-manager flake
+# TODO(kaihowl) remove impurity again
+bash -il -c 'nix run home-manager/release-24.05 -- --impure switch --flake .#myprofile'
+# This will make the nix-env invocations in the install files fail
+
+if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ]; then
+  # shellcheck disable=SC1090,SC1091
+  . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
+fi
 
 # find the installers and run them iteratively
 # Run zsh install first
diff --git a/script/test b/script/test
index c55077ceb5..b4f80621d4 100755
--- a/script/test
+++ b/script/test
@@ -4,6 +4,13 @@
 
 cd "$(dirname "$0")"/.. || exit 1
 
+# Needed to bring the correct PATH in place such that the /usr/bin/env shebang
+# for the test scripts finds a working zsh
+if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ]; then
+  # shellcheck disable=SC1090,SC1091
+  . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
+fi
+
 # find all test scripts and run them
 tests=()
 while IFS= read -r -d '' test; do
diff --git a/script/versions.sh b/script/versions.sh
index 894126129e..6edd2be1df 100755
--- a/script/versions.sh
+++ b/script/versions.sh
@@ -1,6 +1,4 @@
-#!/bin/zsh -i
-set -eu
-set -o pipefail
+#!/bin/bash
 
 if [ $# != 1 ]; then
   echo Missing output file argument
@@ -12,13 +10,12 @@ echo "output to $output_file"
 
 echo "" > "$output_file"
 
-if [[ "$(uname)" == "Darwin" ]]; then
-  echo "brew installed:" >> "$output_file"
-  brew info --installed --json | jq '.[] | .name + "@" + .installed[0].version' | tee -a "$output_file"
-elif [[ "$(lsb_release -i)" == *"Ubuntu"* ]]; then
-  echo "apt installed:" >> "$output_file"
-  # Not using `apt list --installed` as apt does not have a stable interface
-  dpkg-query --show | tee -a "$output_file"
+# TODO use nix-env reporting
+
+# Need to have proper PATH
+if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ]; then
+  # shellcheck disable=SC1091
+  . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
 fi
 
 tmp_file=$(mktemp)
@@ -27,4 +24,5 @@ nvim --headless "+PlugSnapshot! $tmp_file" +qall
 
 { echo "nvim plugins installed:"; cat "$tmp_file"; } >> "$output_file"
 
-{ echo "pip packages installed:"; python3 -m pip list; } >> "$output_file"
+# TODO(kaihowl) not needed on generic python, maybe for the virtualenvs created?
+# { echo "pip packages installed:"; python3 -m pip list; } >> "$output_file"
diff --git a/shellcheck/install.sh b/shellcheck/install.sh
deleted file mode 100755
index 3f78760a93..0000000000
--- a/shellcheck/install.sh
+++ /dev/null
@@ -1,28 +0,0 @@
-#!/bin/bash
-set -e
-
-SCRIPT_DIR=$(unset CDPATH; cd "$(dirname "$0")" > /dev/null; pwd -P)
-
-version=0.10.0
-
-if [ "$(uname -s)" = "Darwin" ]; then
-  if [ "$(uname -m)" = "arm64" ]; then
-    download_url="https://github.com/koalaman/shellcheck/releases/download/v${version}/shellcheck-v${version}.darwin.aarch64.tar.xz"
-    expect_hash="bbd2f14826328eee7679da7221f2bc3afb011f6a928b848c80c321f6046ddf81"
-  else
-    download_url="https://github.com/koalaman/shellcheck/releases/download/v${version}/shellcheck-v${version}.darwin.x86_64.tar.xz"
-    expect_hash="ef27684f23279d112d8ad84e0823642e43f838993bbb8c0963db9b58a90464c2"
-  fi
-elif [[ "$(lsb_release -i)" == *"Ubuntu"* ]]; then
-  download_url="https://github.com/koalaman/shellcheck/releases/download/v${version}/shellcheck-v${version}.linux.x86_64.tar.xz"
-  expect_hash="6c881ab0698e4e6ea235245f22832860544f17ba386442fe7e9d629f8cbedf87"
-fi
-
-file_name=shellcheck-v${version}.tar.xz
-
-source "${SCRIPT_DIR}/../common/download.sh"
-cache_file "$file_name" "$download_url" "$expect_hash"
-
-mkdir -p ~/.shellcheck
-tar -C ~/.shellcheck --extract -J -f "$(cache_path "${file_name}")" --strip-components 1
-
diff --git a/shellcheck/path.zsh b/shellcheck/path.zsh
deleted file mode 100644
index c86c1940ed..0000000000
--- a/shellcheck/path.zsh
+++ /dev/null
@@ -1 +0,0 @@
-export PATH=~/.shellcheck:$PATH
diff --git a/shellcheck/test.sh b/shellcheck/test.sh
index b53fd13a24..29ec48ea9b 100755
--- a/shellcheck/test.sh
+++ b/shellcheck/test.sh
@@ -9,8 +9,8 @@ shellcheck --version
 
 echo "Check if shellcheck is user-installed one"
 actual_path=$(realpath "$(which shellcheck)")
-if [[ "${actual_path}" != $(realpath ~/.shellcheck/)* ]]; then
+if [[ "${actual_path}" != /nix/store/* ]]; then
   echo "Actual Path: $actual_path"
-  echo Expected to be in ~/.shellcheck/ instead
+  echo Expected shellcheck to be managed by nix
   exit 1
 fi
diff --git a/system/install.sh b/system/install.sh
deleted file mode 100755
index ea64fae907..0000000000
--- a/system/install.sh
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/bin/bash
-set -e
-
-SCRIPT_DIR=$(unset CDPATH; cd "$(dirname "$0")" > /dev/null; pwd -P)
-
-if [ "$(uname -s)" = "Darwin" ]; then
-  source "${SCRIPT_DIR}/../common/brew.sh"
-  brew_install tree jq htop automake libtool pkg-config
-  source "${SCRIPT_DIR}/../common/utilities.sh"
-  if ! version_less_than "$(darwin_version)" 11.0.0 ; then
-    brew_install ncdu
-  fi
-elif [[ "$(lsb_release -i)" == *"Ubuntu"* ]]; then
-  source "${SCRIPT_DIR}/../common/apt.sh"
-  apt_install ncdu tree jq htop automake libtool pkg-config
-fi
diff --git a/system/test.sh b/system/test.sh
index 9574db2aec..04fc3bc0dc 100755
--- a/system/test.sh
+++ b/system/test.sh
@@ -1,14 +1,11 @@
 #!/usr/bin/env -S zsh -il
 set -e
 
-source "$DOTS/common/utilities.sh"
-if [ "$(uname)" != "Darwin" ] || ! version_less_than "$(darwin_version)" 11.0.0 ; then
-  echo "Check if ncdu is available"
-  which ncdu
+echo "Check if ncdu is available"
+which ncdu
 
-  echo "Check if ncdu is runnable"
-  ncdu --version
-fi
+echo "Check if ncdu is runnable"
+ncdu --version
 
 echo "Check if tree is available"
 which tree
@@ -27,3 +24,11 @@ which htop
 
 echo "Check if htop is runnable"
 htop --version
+
+echo "Check if python3 is nix controlled"
+actual_path=$(realpath "$(which python3)")
+if [[ "${actual_path}" != /nix/store/* ]]; then
+  echo "Actual Path: $actual_path"
+  echo Expected python3 to be managed by nix
+  exit 1
+fi
diff --git a/tmux/install.sh b/tmux/install.sh
deleted file mode 100755
index cb7bf35950..0000000000
--- a/tmux/install.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/bin/bash
-set -e
-
-SCRIPT_DIR=$(unset CDPATH; cd "$(dirname "$0")" > /dev/null; pwd -P)
-
-if [ "$(uname)" == "Darwin" ]; then
-  source "${SCRIPT_DIR}/../common/brew.sh"
-  brew_install tmux
-  rm -rf ~/.terminfo/74/tmux-256color
-elif [[ "$(lsb_release -i)" == *"Ubuntu"* ]]; then
-  source "${SCRIPT_DIR}/../common/apt.sh"
-  apt_install tmux
-fi
diff --git a/virtualenvwrapper/install.sh b/virtualenvwrapper/install.sh
deleted file mode 100755
index 7fb151a291..0000000000
--- a/virtualenvwrapper/install.sh
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/bin/bash
-set -e
-
-SCRIPT_DIR=$(unset CDPATH; cd "$(dirname "$0")" > /dev/null; pwd -P)
-
-if [ "$(uname -s)" = "Darwin" ]; then
-  source "${SCRIPT_DIR}/../common/brew.sh"
-  brew_install virtualenvwrapper
-elif [[ "$(lsb_release -i)" == *"Ubuntu"* ]]; then
-  source "${SCRIPT_DIR}/../common/apt.sh"
-  apt_install python3-virtualenvwrapper
-fi
-
-source "${SCRIPT_DIR}/../common/utilities.sh"
-# Using "sudo which" to bypass any user PATH prefixed python versions
-sed_replace_in_file ~/.zprofile "^export VIRTUALENVWRAPPER_PYTHON.*$" "export VIRTUALENVWRAPPER_PYTHON=$(sudo which python3)"
diff --git a/virtualenvwrapper/workon.zsh b/virtualenvwrapper/workon.zsh
index 25bab8d376..5623006b05 100644
--- a/virtualenvwrapper/workon.zsh
+++ b/virtualenvwrapper/workon.zsh
@@ -1,18 +1,14 @@
 export WORKON_HOME=$HOME/.virtualenvs
 export PROJECT_HOME=$HOME/Devel
-# Missing expansion of VIRTUALENVWRAPPER_PYTHON
-# This needs to be specific to each platform, i.e., where python3 sits.
-# Set this instead in your .zprofile if not set by install.sh automatically.
+# Set explicitly, even if we expect this python3 to be the first python3 on the PATH already
+export VIRTUALENVWRAPPER_PYTHON=$HOME/.nix-profile/bin/python3
+export VIRTUALENVWRAPPER_VIRTUALENV=$HOME/.nix-profile/bin/virtualenv
 
-macos_virtualenv_scripts=$HOMEBREW_PREFIX/bin
-ubuntu_virtualenv_scripts=/usr/share/virtualenvwrapper
+nix_virtualenv_scripts=~/.nix-profile/bin
 lazy_wrapper=virtualenvwrapper_lazy.sh
-if [ -f "${macos_virtualenv_scripts}/${lazy_wrapper}" ]; then
+if [ -f "${nix_virtualenv_scripts}/${lazy_wrapper}" ]; then
   # shellcheck disable=SC1090
-  source "${macos_virtualenv_scripts}/${lazy_wrapper}"
-elif [ -f "${ubuntu_virtualenv_scripts}/${lazy_wrapper}" ]; then
-  # shellcheck disable=SC1090
-  source "${ubuntu_virtualenv_scripts}/${lazy_wrapper}"
+  source "${nix_virtualenv_scripts}/${lazy_wrapper}"
 else
   echo -e "Could not find virtualenvwrapper_lazy"
 fi
diff --git a/zsh/install.sh b/zsh/install.sh
index c0efc206c4..0fc56f0d55 100755
--- a/zsh/install.sh
+++ b/zsh/install.sh
@@ -5,19 +5,6 @@ SCRIPT_DIR=$(unset CDPATH; cd "$(dirname "$0")" > /dev/null; pwd -P)
 
 cd "$(dirname "$0")"
 
-if [ "$(uname -s)" = "Darwin" ]; then
-  source "${SCRIPT_DIR}/../common/brew.sh"
-  brew_install zsh
-elif [[ "$(lsb_release -i)" == *"Ubuntu"* ]]; then
-  source "${SCRIPT_DIR}/../common/apt.sh"
-  # Install 'expect' for testing
-  apt_install zsh expect
-fi
-
-if ! command -v git > /dev/null; then
-  "${SCRIPT_DIR}/../git/install.sh"
-fi
-
 if [ ! -d ~/.powerlevel10k ]; then
   git clone https://github.com/romkatv/powerlevel10k.git ~/.powerlevel10k --depth=1
 fi
@@ -43,7 +30,6 @@ if [ ! -d ~/.zsh-z ]; then
 fi
 (cd ~/.zsh-z && git pull --rebase)
 
-
 # Replace `chsh` with a fail-safe profile/exec dance:
 # When /bin/sh -> /bin/bash or /bin/zsh are the default shells on the system,
 # starting a login shell with source ~/.bash_profile or ~/.zprofile respectively.
diff --git a/zsh/test.sh b/zsh/test.sh
index 20fb7dae4d..f59e09af3e 100755
--- a/zsh/test.sh
+++ b/zsh/test.sh
@@ -1,6 +1,14 @@
 #!/usr/bin/env -S zsh -il
 set -e
 
+echo "Check if zsh is nix controlled"
+actual_path=$(realpath "$(which zsh)")
+if [[ "${actual_path}" != /nix/store/* ]]; then
+  echo "Actual Path: $actual_path"
+  echo Expected zsh to be managed by nix
+  exit 1
+fi
+
 echo "Test that start up and basic user input to shell work without errors"
 # This was added after a faulty linter change led to printing the following on all key presses
 # sh:1: url-quote-magic: function definition file not found
diff --git a/zsh/zshrc.symlink b/zsh/zshrc.symlink
index e171f645c5..4c05a752d1 100644
--- a/zsh/zshrc.symlink
+++ b/zsh/zshrc.symlink
@@ -12,6 +12,10 @@ fi
 
 fpath=($DOTS/zsh $fpath)
 
+if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ]; then
+  . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
+fi
+
 autoload -U start-ssh-and-add-identity
 start-ssh-and-add-identity
 
@@ -33,11 +37,6 @@ if [[ -r "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh" ]]
   source "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh"
 fi
 
-# Cache the brew prefix for other tools to pick up
-if [[ -z $BREW_PREFIX ]] && which brew &> /dev/null; then
-  export BREW_PREFIX=$(brew --prefix)
-fi
-
 # Emacs keybindings
 bindkey -e