Rebuilt my workspace machine on NixOS today. Wanted native Linux instead of juggling WSL or fighting macOS quirks, and I wanted the whole setup to live in one file instead of a pile of installs I'd forget how I made.

That file is the actual system. Every package, every service, every shell shortcut is code in configuration.nix, tracked in git. Rebuild reads it and the machine either matches the file or it doesn't build. No drift, no wondering how I set something up six months ago.

Had Dozer, my sysadmin agent, walk me through the parts that would've eaten an afternoon otherwise: KDE Plasma, OBS with a virtual cam and background blur for calls, Stream Deck udev rules, Zoom and Teams, the Cornell VPN client, weekly auto-updates on a timer.

Today's piece was two Claude Code shortcuts, claude-work and claude-pro, so I can switch between the Cornell gateway and my personal account with one word. The trick was keeping the Cornell token out of configuration.nix entirely, since anything in that file lands in the Nix store, and the store is world-readable no matter how private the repo is. The token lives in a locked-down file outside the store; the config just points at it.

One machine, one file, and an agent that knows where the tricky parts are.