Current nixpkgs deferred nixpkgs.config breaks generated NixOS hosts

Summary

Current nixpkgs breaks Snowfall-generated NixOS configurations because Snowfall still pins a flake-utils-plus host wrapper whose nixpkgs.config detection is incompatible with the option's current deferred-module semantics.

This is related to, but distinct from, #24 and #73. Those reports involved user modules explicitly setting nixpkgs.config. In this case the failure occurs on a host that has no host-level nixpkgs.config definition.

Versions

• Snowfall Lib: 6ee3542cb459ca4b038cfe50ceb8797f05cdabad (current main when reproduced)
• Snowfall's pinned flake-utils-plus: 3542fe9126dc492e53ddd252bb0260fe035f2c0f
• nixpkgs: f13ff45afd1bb73e640eaa08a7066dbed07e3238 from nixos-unstable

Reproduction

A normal Snowfall configuration with channel configuration is sufficient:

lib.mkFlake {
  channels-config.allowUnfree = true;
  # regular discovered systems/modules
}

Then evaluate a discovered NixOS host which does not define nixpkgs.config itself:

$ nix eval '.#nixosConfigurations.ceres.config.system.build.toplevel.drvPath'
error:
Failed assertions:
- Your system configures nixpkgs with an externally created instance.
  `nixpkgs.config` options should be passed when creating the instance instead.

Defined in:
  - .../flake.nix

Cause

Snowfall maps channels-config to flake-utils-plus' channelsConfig, which is correct. The problem is in the pinned flake-utils-plus host builder.

It pre-evaluates the host and tests:

hostConfig.nixpkgs.config == { }

Current nixpkgs declares nixpkgs.config as a deferredModuleWith option and applies it as:

apply = _: finalPkgs.config;

Therefore reading hostConfig.nixpkgs.config returns the fully applied pkgs.config, not the raw module definitions. The empty-config check is no longer valid and the wrapper takes its re-import path even when the host did not configure the option.

The wrapper then defines both:

nixpkgs.pkgs = ...;
nixpkgs.config = lib.mkForce { };

Current nixpkgs rejects any non-default definition of nixpkgs.config when nixpkgs.pkgs is externally supplied, including an explicitly forced empty value.

Tested workaround / fix direction

I tested overriding Snowfall's transitive flake-utils-plus input with a compatibility version that:

1. Keeps the raw channel configuration and overlay list when importing each channel.
2. Stops pre-evaluating and reading the applied hostConfig.nixpkgs.config value.
3. Does not define external nixpkgs.pkgs for NixOS hosts.
4. Supplies the raw channel config and overlays as ordinary nixpkgs.config and nixpkgs.overlays module definitions, allowing NixOS to construct the package set.

With that change, three active hosts evaluate, including one with a host-specific permittedInsecurePackages value. Home Manager still uses global packages and the configured overlays remain active.

Simply overriding to flake-utils-plus v1.6.0 did not help because the relevant host wrapper is still present there.

Would you be open to updating the transitive dependency once flake-utils-plus fixes this, or carrying a compatibility patch in Snowfall in the meantime?

Related upstream issues: gytis-ivaskevicius/flake-utils-plus#136 and gytis-ivaskevicius/flake-utils-plus#142.

Tracking

The corresponding flake-utils-plus report is gytis-ivaskevicius/flake-utils-plus#162. The underlying wrapper fix belongs there; this issue tracks updating or patching Snowfall's transitive dependency.

Start with flake.nix and the mkFlake channel configuration, then reproduce the failure with the provided nix eval command. Check the pinned flake-utils-plus host wrapper and upstream issue #162; done means Snowfall evaluates the affected NixOS hosts without the deferred nixpkgs.config assertion after an upstream update or compatibility patch.