Users

Marchyo manages user accounts through the marchyo.users option. Each user gets a system account with associated metadata used by git, applications, and Home Manager.

Basic usage

marchyo.users.myuser = {
  fullname = "Your Name";
  email = "your@email.com";
};

This creates a user account named myuser with the provided name and email configured across git and other applications.

On NixOS, each Marchyo user is created as a normal user with extraGroups = [ "wheel" "networkmanager" ] — sudo access and NetworkManager control out of the box.

Options

Option	Type	Default	Description
marchyo.users.<name>.enable	bool	true	Whether to apply Marchyo configuration to this user
marchyo.users.<name>.name	string	attribute name	The name of the Unix user account (override to decouple it from the attribute name)
marchyo.users.<name>.fullname	string	—	Full name (used in git config and applications)
marchyo.users.<name>.email	string	—	Email address (used in git config and applications)
marchyo.users.<name>.uid	int or null	null	Numeric user id. On NixOS sets users.users.<name>.uid; on macOS opts the user into declarative login-shell management (see below)
marchyo.users.<name>.wakatimeApiKeyFile	path or null	null	Path to a user-readable file containing the WakaTime API key (preferred — see below)
marchyo.users.<name>.wakatimeApiKey	string or null	null	WakaTime API key as a literal string — written verbatim into the world-readable Nix store; prefer wakatimeApiKeyFile

WakaTime API key

When marchyo.tracking.editor.enable is on, a per-user ~/.wakatime.cfg is generated for editor heartbeat tracking. Supply the API key one of two ways:

• wakatimeApiKeyFile (preferred) — a path to a user-readable file (e.g. a sops-nix secret like /run/secrets/wakatime-api-key). The key is read at Home Manager activation time and never enters the Nix store.
• wakatimeApiKey — the key as a literal string. Also exports WAKATIME_API_KEY.

Caution

wakatimeApiKey is written verbatim into the Nix store, which is readable by every local user and process. Use wakatimeApiKeyFile to keep the secret out of the store.

Login shell

Bash (5.x, bashInteractive) is the Marchyo default login shell on every platform.

On NixOS this is set via users.defaultUserShell (overridable with your own value).

On macOS (nix-darwin), changing an account’s shell requires the user to be listed in users.knownUsers with the account’s exact uid — a mismatch aborts activation, so Marchyo does not guess. Provide the uid to opt in (the first macOS user is 501):

marchyo.users.myuser = {
  fullname = "Your Name";
  email = "your@email.com";
  uid = 501; # check with: id -u
};

With the uid set, nix-darwin switches the login shell to bash declaratively. Without it, bash is still registered in /etc/shells, so you can switch once manually:

chsh -s /run/current-system/sw/bin/bash

Multiple users

You can define multiple users:

marchyo.users = {
  alice = {
    fullname = "Alice Smith";
    email = "alice@example.com";
  };
  bob = {
    fullname = "Bob Jones";
    email = "bob@example.com";
  };
};

Disabling a user

To keep a user definition but exclude it from Marchyo configuration:

marchyo.users.myuser = {
  enable = false;
  fullname = "Your Name";
  email = "your@email.com";
};