Find all enabled-by-default options of a NixOS configuration

audit.nix

# Run this via 
# nix build -f ./audit.nix --arg flakePath 'toString ./.' --argstr hostname THEHOST
{ pkgs ? import <nixpkgs> { }
, flakePath ? toString ./.
, hostname
}:

let
  inherit (pkgs) lib;
  flake = builtins.getFlake flakePath;
  origHostOptions = flake.nixosConfigurations.${hostname}.options;
  hostOptions = lib.recursiveUpdate origHostOptions {
    # idk this can't evaluate for some reason
    hardware.nvidia.gsp = null;
  };

  checkedEval = v:
    let
      ret = builtins.tryEval v;
    in
    if ret.success then ret.value else false;

  enabledByDefault = lib.attrsets.filterAttrsRecursive
    (_: v: !(v ? _type) || (v._type == "option" && v.type.name == "bool" && (checkedEval (v.default or false)) == true))
    hostOptions;

  locations = lib.mapAttrsRecursive
    (path: value: if (lib.last path == "loc") then lib.concatStringsSep "." value else null)
    enabledByDefault;

  filteredLocations = lib.filterAttrsRecursive
    (n: v: v != { } && v != null)
    locations;

  json = builtins.toJSON filteredLocations;
in
pkgs.runCommand "defaultEnabledOptions" { } ''
  echo ${lib.escapeShellArg json} | ${pkgs.jq}/bin/jq -r '.. | .loc? | values' >$out
''