How to allow "unfree" packages in Nix, for each situation?: {NixOS, Nix, Nix with Flakes, Nix with Flakes and Home Manager}

Question

I'm trying to enable allow "unfree" packages, either globally or per-package, when using MyNixOS (excellent Flake configuration app for Nix) with Nix Flakes on Mac OS.

When trying to install any unfree package after the following Flake update and Darwin rebuild command:

cd ~/.nix/mynixos-nix-darwin-loader;
nix flake update;
darwin-rebuild switch --show-trace --flake .#name_of_my_config'

I get the following help message, which isn't very helpful because it doesn't consider the Flake scenario:

       error: Package ‘ec2-api-tools-1.7.5.1’ in /nix/store/${hash}-source/pkgs/tools/virtualization/e
c2-api-tools/default.nix:36 has an unfree license (‘amazonsl’), refusing to evaluate.

       a) To temporarily allow unfree packages, you can use an environment variable
          for a single invocation of the nix tools.

            $ export NIXPKGS_ALLOW_UNFREE=1

        Note: For `nix shell`, `nix build`, `nix develop` or any other Nix 2.4+
        (Flake) command, `--impure` must be passed in order to read this
        environment variable.

       b) For `nixos-rebuild` you can set
         { nixpkgs.config.allowUnfree = true; }
       in configuration.nix to override this.

       Alternatively you can configure a predicate to allow specific packages:
         { nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
             "ec2-api-tools"
           ];
         }

       c) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
         { allowUnfree = true; }
       to ~/.config/nixpkgs/config.nix.

Using MyNixOS downloads the following Flake file, and

/nix/store/${hash}-source/homeConfigurations/my_flake_name.nix:

{ inputs, ... }@flakeContext:
let
  homeModule = { config, lib, pkgs, ... }: {
    config = {
      home = {
        packages = [
          ec2-api-tools
          # ... (more packages)
        ];
        stateVersion = "23.11";
      };
      nixpkgs = {
        config = {
          allowUnfree = true;
          # allowUnfreePredicate = (_: true);
          allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
            "ec2-api-tools"
          ];
        };
      };
# ... (the rest of the file)

Which results in a configuration path for the allowUnfreePredicate setting: homeModule.config.nixpkgs.config.allowUnfreePredicate. Does that seem correct?

This configuration seems to make no difference, and installing unfree packages always results in the same error.

Exactly what needs to be done to allow unfree packages in each of these distinct scenarios?

• NixOS
• Nix
• Nix with Flakes
• Nix with Flakes and Home Manager

(Please edit the list or let me know if it doesn't make sense)

The advice from the following web pages didn't seem to apply, or I couldn't figure out how to apply it:

• NixOS Discourse: Allow unfree in flakes
• GitHub: nix-community/home-manager: #2942: bug: Flake config cannot use unfree packages despite nixpkgs.config.allowUnfree = true
• GitHub: nix-community/home-manager: #2720: modules/default.nix: Add useNixpkgsModule parameter
  • Abandoned merge request

Answer 1

For the first two situations, the help text is correct, though I'll explain them below.

For NixOS without Flakes: In either configuration.nix or one of the modules it imports, add these settings to enable unfree packages:

{
  # Either this one, which blanket allows all unfree packages
  nixpkgs.config.allowUnfree = true;
  # Or this one, which takes the package as an argument and allows
  # you to inspect it, either allowlisting by name or by other traits
  # such as licenses.
  nixpkgs.config.allowUnfreePredicate = pkg: true;
}

For plain Nix builds outside of NixOS: Create the file .config/nixpkgs/config.nix if it doesn't exist already, and add one of these to it:

{
  allowUnfree = true;
  allowUnfreePredicate = pkg: true;
}

For Flake builds without Home Manager: Instead of importing pkgs directly, use a let binding to configure it before passing it into your configurations (though see note below):

outputs = { nixpkgs, ... }@attrs: {
  nixosConfigurations = {
    your-hostname = let {
      pkgs = import nixpkgs {
        system = "x86_64-linux"; # whatever your system name is
        config = {
          allowUnfree = true;
          allowUnfreePredicate = _: true;
        };
      };
    in nixpkgs.lib.nixosSystem {
      system = "x86_64-linux"; # whatever your system name is
      specialArgs = attrs // { pkgs = pkgs };
      # ... whatever else you're doing here
    };
  };
};

For Flake builds with Home Manager: Use the setup for packages without Home Manager, but add these configuration lines to Home Manager somewhere in your modules:

{
  home-manager.useGlobalPkgs = true;
  home-manager.useUserPackages = true;
}

This ensures that home-manager will pick up the configuration changes you make to the pkgs module you pass in, rather than try to fetch its own installation.

---

Note that the solution listed under "Flake Builds Without Home Manager" produces the following warning:

evaluation warning: You have set specialArgs.pkgs, which means that options like nixpkgs.config and nixpkgs.overlays will be ignored. If you wish to reuse an already created pkgs, which you know is configured correctly for this NixOS configuration, please import the nixosModules.readOnlyPkgs module from the nixpkgs flake or (modulesPath + "/misc/nixpkgs/read-only.nix"), and set { nixpkgs.pkgs = <your pkgs>; }. This properly disables the ignored options to prevent future surprises.

I have admittedly yet to figure out how to make this work - for me, importing readOnlyPkgs causes evaluation to fail with not knowing what the system parameter is.

Answer 2

If you're getting nixpkgs via a flake input for use with a single project (rather than your whole system):

{
  inputs = {
    flake-utils.url = "github:numtide/flake-utils";
    nixpkgs.url = "github:nixos/nixpkgs?ref=23.11";
  };

  outputs = { self, nixpkgs, flake-utils}:
    flake-utils.lib.eachDefaultSystem (system:
      let
        pkgs = import nixpkgs { 
          inherit system;
          config.allowUnfree = true;  # like this
        };
      in rec {

         # pkgs.someUnfreeThing is referenced somewhere in here

      });
}