It's system-wide (unless home-manager is involved).
They're a part of the immutable install, whose components reside in /nix/store and are symlinked to /etc.
Example from my computer:
$ realpath /etc/sddm.conf
/nix/store/slkq2k8vc4rx4ag55zf8ssl7qd9ry49v-sddm.conf
By having the right configuration file there as part of the package's options, like:
globalProgram.doFoo = true; or something like
globalProgram.extraConfig = "barCount=4567";
In the case of NixOS at least, 'immutable' doesn't mean you can't change the system at all.
It just means you cannot change the currently installed set of packages and services (generation in NixOS parlance); all you can do is create new ones and delete old ones.
Basically every update might as well be a complete reinstall of /usr, /etc and whatnot if you compare it to traditional distros.
My experience of pacman (same point goes for most package managers) was a pacman -Syu freezing my PC completely, and when that happened, pacman went into a broken state and had to be sorted out manually.
This and a couple other reasons is why I can't be bothered with mutating distros in general anymore.
Ansible isn't a good solution for reproducibility, since when you remove something from the playbook and redeploy, that old state will still be active.