style: alejandra $(fd -e nix)

modules/nixos/nginx/local.nix

@@ -9,7 +9,7 @@
   inherit (lib.lists) optionals;
   inherit (config.services) tailscale;
   inherit (config.networking.access) cidrForNetwork localaddrs;
-  localModule = { config, ... }: {
+  localModule = {config, ...}: {
     options.local = with lib.types; {
       enable = mkOption {
         type = bool;
@@ -37,16 +37,23 @@
           cidrForNetwork.loopback.all
           ++ cidrForNetwork.local.all
           ++ optionals tailscale.enable cidrForNetwork.tail.all;
-        allows = concatMapStringsSep "\n" mkAllow allowAddresses + optionalString localaddrs.enable ''
-          include ${localaddrs.stateDir}/*.nginx.conf;
+        allows =
+          concatMapStringsSep "\n" mkAllow allowAddresses
+          + optionalString localaddrs.enable ''
+            include ${localaddrs.stateDir}/*.nginx.conf;
+          '';
+      in
+        mkBefore ''
+          ${allows}
+          deny all;
         '';
-      in mkBefore ''
-        ${allows}
-        deny all;
-      '';
     };
   };
-  locationModule = { config, virtualHost, ... }: {
+  locationModule = {
+    config,
+    virtualHost,
+    ...
+  }: {
     imports = [
       localModule
     ];
@@ -58,13 +65,13 @@
       emitDenyGlobal = virtualHost.local.emitDenyGlobal;
     };
   };
-  hostModule = { config, ... }: {
-    imports = [ localModule ];
+  hostModule = {config, ...}: {
+    imports = [localModule];
 
     options = with lib.types; {
       locations = mkOption {
         type = attrsOf (submoduleWith {
-          modules = [ locationModule ];
+          modules = [locationModule];
           shorthandOnlyDefinesConfig = true;
           specialArgs = {
             virtualHost = config;
@@ -83,7 +90,7 @@ in {
   options = with lib.types; {
     services.nginx.virtualHosts = mkOption {
       type = attrsOf (submoduleWith {
-        modules = [ hostModule ];
+        modules = [hostModule];
         shorthandOnlyDefinesConfig = true;
         specialArgs = {
           nixosConfig = config;

modules/nixos/nginx/vouch.nix

@@ -2,13 +2,12 @@
   config,
   lib,
   ...
-}:
-let
+}: let
   inherit (lib.options) mkOption mkEnableOption;
   inherit (lib.modules) mkIf mkMerge mkBefore mkDefault;
   inherit (config) networking;
   inherit (config.services) vouch-proxy tailscale;
-  vouchModule = { config, ... }: {
+  vouchModule = {config, ...}: {
     options = with lib.types; {
       vouch = {
         enable = mkEnableOption "vouch auth proxy";
@@ -49,15 +48,20 @@ let
         vouch = mkIf vouch-proxy.enable {
           proxyOrigin = let
             inherit (vouch-proxy.settings.vouch) listen port;
-            host = if listen == "0.0.0.0" || listen == "[::]" then "localhost" else listen;
-          in mkDefault "http://${host}:${toString port}";
+            host =
+              if listen == "0.0.0.0" || listen == "[::]"
+              then "localhost"
+              else listen;
+          in
+            mkDefault "http://${host}:${toString port}";
           authUrl = mkDefault vouch-proxy.authUrl;
           url = mkDefault vouch-proxy.url;
           doubleProxy = mkDefault false;
         };
       }
       {
-        vouch.proxyOrigin = mkIf (tailscale.enable && !vouch-proxy.enable) (mkDefault
+        vouch.proxyOrigin = mkIf (tailscale.enable && !vouch-proxy.enable) (
+          mkDefault
           "http://login.tail.${networking.domain}"
         );
       }
@@ -96,22 +100,23 @@ let
                   set $vouch_url $vouch_scheme://${config.vouch.tailDomain};
                 }
               '';
-            in mkMerge [
-              (mkBefore ''
-                set $vouch_url ${config.vouch.url};
-                set $vouch_scheme $scheme;
-              '')
-              (mkIf config.local.trusted (mkBefore ''
-                if ($http_x_forwarded_proto) {
-                  set $vouch_scheme $http_x_forwarded_proto;
-                }
-              ''))
-              (mkIf (config.local.enable or false) localVouchUrl)
-              (mkIf (config.local.enable or false && tailscale.enable) tailVouchUrl)
-              ''
-                return 302 $vouch_url/login?url=$vouch_scheme://$http_host$request_uri&vouch-failcount=$auth_resp_failcount&X-Vouch-Token=$auth_resp_jwt&error=$auth_resp_err;
-              ''
-            ];
+            in
+              mkMerge [
+                (mkBefore ''
+                  set $vouch_url ${config.vouch.url};
+                  set $vouch_scheme $scheme;
+                '')
+                (mkIf config.local.trusted (mkBefore ''
+                  if ($http_x_forwarded_proto) {
+                    set $vouch_scheme $http_x_forwarded_proto;
+                  }
+                ''))
+                (mkIf (config.local.enable or false) localVouchUrl)
+                (mkIf (config.local.enable or false && tailscale.enable) tailVouchUrl)
+                ''
+                  return 302 $vouch_url/login?url=$vouch_scheme://$http_host$request_uri&vouch-failcount=$auth_resp_failcount&X-Vouch-Token=$auth_resp_jwt&error=$auth_resp_err;
+                ''
+              ];
           };
           "/validate" = {
             recommendedProxySettings = false;

modules/nixos/nginx/websocket.nix

@@ -1,10 +1,7 @@
-{
-  lib,
-  ...
-}: let
+{lib, ...}: let
   inherit (lib.modules) mkIf;
   inherit (lib.options) mkOption mkEnableOption;
-  wsModule = { config, ... }: {
+  wsModule = {config, ...}: {
     options = with lib.types; {
       proxy.websocket.enable = mkEnableOption "websocket proxy";
     };
@@ -16,8 +13,8 @@
       '';
     };
   };
-  hostModule = { config, ... }: {
-    imports = [ wsModule ];
+  hostModule = {config, ...}: {
+    imports = [wsModule];
 
     options = with lib.types; {
       locations = mkOption {