diff --git a/nixos/access/kitchencam.nix b/nixos/access/kitchencam.nix
index a61115d9..f6bb51b0 100644
--- a/nixos/access/kitchencam.nix
+++ b/nixos/access/kitchencam.nix
@@ -78,7 +78,8 @@ in {
   };
   config.networking.firewall.allowedTCPPorts = let
     inherit (nginx.virtualHosts.kitchencam) listen';
-  in mkIf listen'.stream.enable [
-    listen'.stream.port
-  ];
+  in
+    mkIf listen'.stream.enable [
+      listen'.stream.port
+    ];
 }
diff --git a/nixos/fluidd.nix b/nixos/fluidd.nix
index a5992347..5ee33d33 100644
--- a/nixos/fluidd.nix
+++ b/nixos/fluidd.nix
@@ -1,4 +1,10 @@
-{ config, access, gensokyo-zone, lib, ... }: let
+{
+  config,
+  access,
+  gensokyo-zone,
+  lib,
+  ...
+}: let
   inherit (gensokyo-zone.lib) domain;
   inherit (lib.modules) mkIf mkDefault mkForce;
   inherit (lib.strings) removePrefix;
@@ -11,9 +17,9 @@ in {
       enable = mkDefault true;
       hostName = mkDefault "print.local.${domain}"; # TODO: serverName?
       nginx.locations."/webcam".proxyPass = let
-            inherit (config.services.motion.cameras) printercam;
-            inherit (printercam.settings) camera_id;
-          in "https://kitchen.local.${domain}/${toString camera_id}/stream";
+        inherit (config.services.motion.cameras) printercam;
+        inherit (printercam.settings) camera_id;
+      in "https://kitchen.local.${domain}/${toString camera_id}/stream";
     };
     nginx = mkIf cfg.enable {
       proxied.enable = true;
@@ -22,9 +28,10 @@ in {
           serviceName = "moonraker";
           scheme = "";
         };
-      in mkForce {
-        servers.${moonraker} = { };
-      };
+      in
+        mkForce {
+          servers.${moonraker} = {};
+        };
       virtualHosts = {
         ${cfg.hostName} = {
           enable = false;
@@ -32,7 +39,7 @@ in {
         ${serverName} = {
           # https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-apps/fluidd.nix
           # XXX: non-@ host required for gatus to work
-          serverAliases = [ (removePrefix "@" serverName) ];
+          serverAliases = [(removePrefix "@" serverName)];
           proxied.enable = true;
           # TODO: proxy.upstream = "fluidd-apiserver";
           proxy.url = "http://fluidd-apiserver";
diff --git a/nixos/klipper.nix b/nixos/klipper.nix
index 7f05bb13..dfd9de5b 100644
--- a/nixos/klipper.nix
+++ b/nixos/klipper.nix
@@ -1,4 +1,9 @@
-{ config, gensokyo-zone, lib, ... }: let
+{
+  config,
+  gensokyo-zone,
+  lib,
+  ...
+}: let
   inherit (gensokyo-zone.lib) mkAlmostOptionDefault;
   inherit (lib.modules) mkIf mkDefault;
   inherit (config.services) moonraker octoprint;
diff --git a/nixos/moonraker.nix b/nixos/moonraker.nix
index d0bb197b..28d34d43 100644
--- a/nixos/moonraker.nix
+++ b/nixos/moonraker.nix
@@ -1,16 +1,22 @@
-{ config, access, gensokyo-zone, lib, ... }: let
+{
+  config,
+  access,
+  gensokyo-zone,
+  lib,
+  ...
+}: let
   inherit (lib.modules) mkIf mkDefault;
   inherit (gensokyo-zone.lib) domain;
   inherit (config.services) klipper;
   cfg = config.services.moonraker;
- in {
+in {
   sops.secrets = {
     moonraker_cfg = {
       sopsFile = ./secrets/moonraker.yaml;
       path = "${cfg.stateDir}/config/secrets.conf";
       owner = cfg.user;
     };
-   };
+  };
   services = {
     moonraker = {
       enable = mkDefault true;
@@ -19,9 +25,9 @@
       group = mkDefault klipper.group;
       port = 7125; # it's the default but i'm specifying it anyway
       settings = {
-        "include secrets.conf" = { };
-        octoprint_compat = { };
-        history = { };
+        "include secrets.conf" = {};
+        octoprint_compat = {};
+        history = {};
         "webcam printer" = let
           inherit (config.services.motion.cameras) printercam;
           inherit (printercam.settings) camera_id;
@@ -46,7 +52,7 @@
           trusted_clients =
             access.cidrForNetwork.allLocal.all
             # XXX: only safe when protected behind vouch!
-            ++ [ "0.0.0.0/0" "::/0" ];
+            ++ ["0.0.0.0/0" "::/0"];
         };
         machine = {
           # disable all machine control
diff --git a/nixos/syncthing-kat/syncthing.nix b/nixos/syncthing-kat/syncthing.nix
index 474a91c7..5f595f0f 100644
--- a/nixos/syncthing-kat/syncthing.nix
+++ b/nixos/syncthing-kat/syncthing.nix
@@ -5,5 +5,10 @@
     openDefaultPorts = true;
     dataDir = "/mnt/kyuuto-litterbox";
   };
-  networking.firewall.interfaces.local.allowedTCPPorts = [ 8384 ];
+  networking.firewall.interfaces = let
+    x.allowedTCPPorts = [8384];
+  in {
+    local = x;
+    tail = x;
+  };
 }
diff --git a/packages/klipper.nix b/packages/klipper.nix
index 0c923839..b042e7a6 100644
--- a/packages/klipper.nix
+++ b/packages/klipper.nix
@@ -1,11 +1,11 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, python3
-, unstableGitUpdater
-, makeWrapper
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  python3,
+  unstableGitUpdater,
+  makeWrapper,
 }:
-
 stdenv.mkDerivation rec {
   pname = "klipper";
   version = "0.12.0-unstable-2024-07-05";
@@ -21,11 +21,11 @@ stdenv.mkDerivation rec {
 
   # NB: This is needed for the postBuild step
   nativeBuildInputs = [
-    (python3.withPackages ( p: with p; [ cffi ] ))
+    (python3.withPackages (p: with p; [cffi]))
     makeWrapper
   ];
 
-  buildInputs = [ (python3.withPackages (p: with p; [ can cffi pyserial greenlet jinja2 markupsafe numpy ])) ];
+  buildInputs = [(python3.withPackages (p: with p; [can cffi pyserial greenlet jinja2 markupsafe numpy]))];
 
   # we need to run this to prebuild the chelper.
   postBuild = ''
@@ -76,9 +76,8 @@ stdenv.mkDerivation rec {
     description = "Klipper 3D printer firmware";
     mainProgram = "klippy";
     homepage = "https://github.com/KevinOConnor/klipper";
-    maintainers = with maintainers; [ lovesegfault zhaofengli cab404 ];
+    maintainers = with maintainers; [lovesegfault zhaofengli cab404];
     platforms = platforms.linux;
     license = licenses.gpl3Only;
   };
 }
-
diff --git a/packages/niimprint.nix b/packages/niimprint.nix
index 4ed24dc5..05928571 100644
--- a/packages/niimprint.nix
+++ b/packages/niimprint.nix
@@ -1,43 +1,44 @@
 {
-  buildPythonApplication
-, fetchFromGitHub
-, poetry-core
-, pyserial
-, pillow
-, click
+  buildPythonApplication,
+  fetchFromGitHub,
+  poetry-core,
+  pyserial,
+  pillow,
+  click,
 }: let
   mainProgram = "niimprint";
-in buildPythonApplication {
-  pname = "niimprint";
-  version = "2024_04_05";
+in
+  buildPythonApplication {
+    pname = "niimprint";
+    version = "2024_04_05";
 
-  src = fetchFromGitHub {
-    owner = "AndBondStyle";
-    repo = "niimprint";
-    rev = "be39f68c16a5a7dc1b09bb173700d0ee1ec9cb66";
-    sha256 = "sha256-+YISYchdqeVKrQ0h2cj5Jy2ezMjnQcWCCYm5f95H9dI=";
-  };
+    src = fetchFromGitHub {
+      owner = "AndBondStyle";
+      repo = "niimprint";
+      rev = "be39f68c16a5a7dc1b09bb173700d0ee1ec9cb66";
+      sha256 = "sha256-+YISYchdqeVKrQ0h2cj5Jy2ezMjnQcWCCYm5f95H9dI=";
+    };
 
-  pyproject = true;
+    pyproject = true;
 
-  nativeBuildInputs = [
-    poetry-core
-  ];
+    nativeBuildInputs = [
+      poetry-core
+    ];
 
-  propagatedBuildInputs = [
-    pyserial
-    pillow
-    click
-  ];
+    propagatedBuildInputs = [
+      pyserial
+      pillow
+      click
+    ];
 
-  postInstall = ''
-    install -d $out/bin
-    echo '#!/usr/bin/env python' > $out/bin/${mainProgram}
-    cat niimprint/__main__.py >> $out/bin/${mainProgram}
-    chmod +x $out/bin/${mainProgram}
-  '';
+    postInstall = ''
+      install -d $out/bin
+      echo '#!/usr/bin/env python' > $out/bin/${mainProgram}
+      cat niimprint/__main__.py >> $out/bin/${mainProgram}
+      chmod +x $out/bin/${mainProgram}
+    '';
 
-  meta = {
-    inherit mainProgram;
-  };
-}
+    meta = {
+      inherit mainProgram;
+    };
+  }