From 5e216641248730f40f6c82a160282d8f0685d404 Mon Sep 17 00:00:00 2001
From: "Thomas G. Lopes" <thomasgl@pm.me>
Date: Wed, 8 Apr 2026 00:40:00 +0100
Subject: [PATCH] lix

---
 flake.lock              | 12 ++++++------
 modules/hosts/nixos.nix | 10 ++++++++--
 2 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/flake.lock b/flake.lock
index 688c7fd..17e90c1 100644
--- a/flake.lock
+++ b/flake.lock
@@ -50,11 +50,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772408722,
-        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
+        "lastModified": 1775087534,
+        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
+        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
         "type": "github"
       },
       "original": {
@@ -185,11 +185,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1774106199,
-        "narHash": "sha256-US5Tda2sKmjrg2lNHQL3jRQ6p96cgfWh3J1QBliQ8Ws=",
+        "lastModified": 1775423009,
+        "narHash": "sha256-vPKLpjhIVWdDrfiUM8atW6YkIggCEKdSAlJPzzhkQlw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6c9a78c09ff4d6c21d0319114873508a6ec01655",
+        "rev": "68d8aa3d661f0e6bd5862291b5bb263b2a6595c9",
         "type": "github"
       },
       "original": {
diff --git a/modules/hosts/nixos.nix b/modules/hosts/nixos.nix
index 09e8063..58b4d27 100644
--- a/modules/hosts/nixos.nix
+++ b/modules/hosts/nixos.nix
@@ -161,8 +161,14 @@ in {
     # Allow unfree
     nixpkgs.config.allowUnfree = true;
 
-    # Enable flakes
-    nix.settings.experimental-features = ["nix-command" "flakes"];
+    # Use Lix as the system Nix implementation
+    nix.package = pkgs.lixPackageSets.stable.lix;
+
+    # Enable flakes + restrict who can submit builds to the daemon
+    nix.settings = {
+      experimental-features = ["nix-command" "flakes"];
+      allowed-users = ["root" flakeConfig.username];
+    };
 
     # Auto-unlock gnome-keyring on login
     security.pam.services.login.enableGnomeKeyring = true;