In reply to @delroth:delroth.net
it is niche and an afterthought, the installables syntax in the new nix3 CLI is very tied to flakes, even though you could theoretically split them

# nix flake check --all-systems
Do you want to allow configuration setting 'allow-import-from-derivation' to be set to 'false'?
This may allow the flake to gain root, see the nix.conf manual page (yes/no/No to all) 

... that last line isn't true for this specific setting, right? i assume it's done for all configuration settings, would it be practical to not warn about getting root for known-safe options? (still ask if the user wants it, but the warning about "this may allow the flake to gain root" isn't true for those settings.) (it is true for the trusted-substitutor that tried to add cachix, which i rejected)

error:
       … while checking flake output 'nixosConfigurations'

       … while checking the NixOS configuration 'nixosConfigurations.tailstack'

       … while calling the 'head' builtin
         at /nix/store/syvzk0psc8m51z4024qr4i0kx9k14dqz-source/lib/attrsets.nix:1713:13:
         1712|           if length values == 1 || pred here (elemAt values 1) (head values) then
         1713|             head values
             |             ^
         1714|           else

       (stack trace truncated; use '--show-trace' to show the full trace)

       error: No device specified for mount point ‘/etc/ssh’.