style: alejandra $(fd -e nix)

.gitignore

@@ -6,3 +6,4 @@
 .terraform
 .DS_Store
 .envrc.conf
+.idea

ci/flake-cron.nix

@@ -45,7 +45,7 @@ in {
           cron = "0 0 * * *";
         }
       ];
-      workflow_dispatch = { };
+      workflow_dispatch = {};
     };
   };
 
@@ -65,7 +65,7 @@ in {
         displayName = "flake update build";
         environment = ["CACHIX_SIGNING_KEY" "GITHUB_REF"];
         command = let
-          filteredHosts = [ "hakurei" "reimu" "aya" "tei" "litterbox" "mediabox" ];
+          filteredHosts = ["hakurei" "reimu" "aya" "tei" "litterbox" "mediabox"];
           gcBetweenHosts = false;
           nodeBuildString = concatMapStringsSep " && " (node: "nix build --show-trace -Lf . nixosConfigurations.${node}.config.system.build.toplevel -o result-${node}" + optionalString gcBetweenHosts " && nix-collect-garbage -d") filteredHosts;
           hostPath = builtins.getEnv "PATH";

docs/derivation.nix

@@ -12,17 +12,19 @@
       (hasSuffix ".adoc" path || baseNameOf path == "docinfo.html")
       || type == "directory";
   };
-in stdenvNoCC.mkDerivation {
+in
+  stdenvNoCC.mkDerivation {
     pname = "genso-docs";
     version = "dev";
     inherit src;
 
     ASCIIDOCTOR_OPTS = [
-    "-a" "docinfo=shared"
+      "-a"
+      "docinfo=shared"
     ];
 
-  nativeBuildInputs = [ asciidoctor ];
+    nativeBuildInputs = [asciidoctor];
-  passAsFile = [ "buildCommand" ];
+    passAsFile = ["buildCommand"];
     buildCommand = ''
       install -d "$out"
       ASCIIDOCTOR_SRCS=(
@@ -34,4 +36,4 @@ in stdenvNoCC.mkDerivation {
         -a inc="$src/_inc/" \
         -b html -R "$src" -D "$out" "''${ASCIIDOCTOR_SRCS[@]}"
     '';
-}
+  }

generate.nix

@@ -10,16 +10,15 @@
   templateUsers = filterAttrs (_: userIs "peeps") templateSystem.config.users.users;
   mkNodeUsers = users: let
     nodeUsers = mapAttrsToList (_: mkNodeUser) templateUsers;
-  in sortOn (user: user.uid) nodeUsers;
+  in
+    sortOn (user: user.uid) nodeUsers;
   mkNodeUser = user: {
     inherit (user) name uid;
     authorizedKeys = user.openssh.authorizedKeys.keys;
   };
-  mkNode = {
+  mkNode = {name}: {
-    name,
-  }: {
     users = mkNodeUsers templateUsers;
   };
 in {
-  reisen = mkNode { name = "reisen"; };
+  reisen = mkNode {name = "reisen";};
 }

modules/nixos/access.nix

@@ -11,7 +11,7 @@
   inherit (config.services) tailscale;
   inherit (config) networking;
   cfg = config.networking.access;
-  cidrModule = { config, ... }: {
+  cidrModule = {config, ...}: {
     options = with lib.types; {
       all = mkOption {
         type = listOf str;
@@ -19,11 +19,11 @@
       };
       v4 = mkOption {
         type = listOf str;
-        default = [ ];
+        default = [];
       };
       v6 = mkOption {
         type = listOf str;
-        default = [ ];
+        default = [];
       };
     };
     config.all = mkOptionDefault (
@@ -35,10 +35,12 @@ in {
   options.networking.access = with lib.types; {
     cidrForNetwork = mkOption {
       type = attrsOf (submodule cidrModule);
-      default = { };
+      default = {};
     };
     localaddrs = {
-      enable = mkEnableOption "localaddrs" // {
+      enable =
+        mkEnableOption "localaddrs"
+        // {
           default = networking.firewall.interfaces.local.nftables.enable;
         };
       stateDir = mkOption {
@@ -88,7 +90,8 @@ in {
     localaddrs = {
       nftablesInclude = mkBefore (''
           define localrange6 = 2001:568::/29
-      '' + optionalString cfg.localaddrs.enable ''
+        ''
+        + optionalString cfg.localaddrs.enable ''
           include "${cfg.localaddrs.stateDir}/*.nft"
         '');
       reloadScript = let
@@ -101,7 +104,7 @@ in {
     };
     moduleArgAttrs = {
       inherit (cfg) cidrForNetwork localaddrs;
-      mkSnakeOil = pkgs.callPackage ../../packages/snakeoil.nix { };
+      mkSnakeOil = pkgs.callPackage ../../packages/snakeoil.nix {};
     };
   };
 
@@ -111,7 +114,8 @@ in {
       interfaces.local = {
         nftables.conditions = [
           "ip saddr { ${concatStringsSep ", " cfg.cidrForNetwork.local.v4} }"
-          (mkIf networking.enableIPv6
+          (
+            mkIf networking.enableIPv6
             "ip6 saddr { $localrange6, ${concatStringsSep ", " cfg.cidrForNetwork.local.v6} }"
           )
         ];
@@ -169,12 +173,12 @@ in {
   in {
     localaddrs = mkIf cfg.localaddrs.enable {
       unitConfig = {
-        After = [ "network-online.target" ];
+        After = ["network-online.target"];
       };
       serviceConfig = rec {
         StateDirectory = "localaddrs";
         ExecStart = mkMerge [
-          [ "${localaddrs}" ]
+          ["${localaddrs}"]
           (mkIf networking.nftables.enable (mkAfter [
             "${localaddrs-nftables}"
           ]))
@@ -188,7 +192,7 @@ in {
       };
     };
     nftables = mkIf (networking.nftables.enable && cfg.localaddrs.enable) rec {
-      wants = [ "localaddrs.service" ];
+      wants = ["localaddrs.service"];
       serviceConfig = {
         ExecReload = mkBefore [
           "+${cfg.localaddrs.reloadScript}"
@@ -196,7 +200,7 @@ in {
       };
     };
     nginx = mkIf (config.services.nginx.enable && cfg.localaddrs.enable) rec {
-      wants = [ "localaddrs.service" ];
+      wants = ["localaddrs.service"];
       after = wants;
       serviceConfig = {
         ExecReload = mkBefore [

modules/nixos/cloudflared.nix

@@ -1,48 +1,62 @@
-{ pkgs, config, utils, lib, ... }: let
+{
+  pkgs,
+  config,
+  utils,
+  lib,
+  ...
+}: let
   inherit (lib.attrsets) mapAttrsToList mapAttrs' nameValuePair filterAttrsRecursive;
   inherit (lib.lists) singleton;
   inherit (lib.modules) mkIf mkMerge mkForce;
   inherit (lib.options) mkOption mkEnableOption;
   cfg = config.services.cloudflared;
-  settingsFormat = pkgs.formats.json { };
+  settingsFormat = pkgs.formats.json {};
 in {
   options.services.cloudflared = with lib.types; {
     tunnels = let
-      tunnelModule = { config, ... }: {
+      tunnelModule = {config, ...}: {
         options = {
           extraTunnel = {
-            enable = mkEnableOption "extra tunnels" // {
+            enable =
-              default = config.extraTunnel.ingress != { };
+              mkEnableOption "extra tunnels"
+              // {
+                default = config.extraTunnel.ingress != {};
               };
             ingress = mkOption {
               inherit (settingsFormat) type;
-              default = { };
+              default = {};
             };
           };
         };
       };
-    in mkOption {
+    in
+      mkOption {
         type = attrsOf (submodule tunnelModule);
       };
   };
   config.systemd.services = let
-    filterConfig = filterAttrsRecursive (_: v: ! builtins.elem v [ null [ ] { } ]);
+    filterConfig = filterAttrsRecursive (_: v: ! builtins.elem v [null [] {}]);
-    mapIngress = hostname: ingress: {
+    mapIngress = hostname: ingress:
+      {
         inherit hostname;
-    } // filterConfig (filterConfig ingress);
+      }
-  in mkIf cfg.enable (mapAttrs' (uuid: tunnel: let
+      // filterConfig (filterConfig ingress);
+  in
+    mkIf cfg.enable (mapAttrs' (uuid: tunnel: let
       RuntimeDirectory = "cloudflared-tunnel-${uuid}";
       configPath = "/run/${RuntimeDirectory}/config.yml";
       settings = {
         tunnel = uuid;
         credentials-file = tunnel.credentialsFile;
-      ingress = mapAttrsToList mapIngress tunnel.ingress
+        ingress =
+          mapAttrsToList mapIngress tunnel.ingress
           ++ mapAttrsToList mapIngress tunnel.extraTunnel.ingress
-      ++ singleton { service = tunnel.default; };
+          ++ singleton {service = tunnel.default;};
       };
-  in nameValuePair "cloudflared-tunnel-${uuid}" (mkMerge [
+    in
+      nameValuePair "cloudflared-tunnel-${uuid}" (mkMerge [
         {
-      after = mkIf config.services.tailscale.enable [ "tailscale-autoconnect.service" ];
+          after = mkIf config.services.tailscale.enable ["tailscale-autoconnect.service"];
           serviceConfig = {
             RestartSec = 10;
           };
@@ -60,5 +74,6 @@ in {
             ];
           };
         })
-  ])) cfg.tunnels);
+      ]))
+    cfg.tunnels);
 }

modules/nixos/github-runner.nix

@@ -11,7 +11,7 @@
   cfg = config.services.github-runners;
   nixosConfig = config;
   enabledRunners = filterAttrs (_: runner: runner.enable) cfg;
-  runnerModule = { config, ... }: {
+  runnerModule = {config, ...}: {
     options = with lib.types; {
       networkNamespace.name = mkOption {
         type = nullOr str;
@@ -19,7 +19,7 @@
       };
       serviceSettings = mkOption {
         type = unmerged.type;
-        default = { };
+        default = {};
       };
     };
     config = {
@@ -58,8 +58,10 @@ in {
     };
   };
   config = {
-    systemd.services = mapAttrs' (name: runner: nameValuePair "github-runner-${name}" (
+    systemd.services = mapAttrs' (name: runner:
+      nameValuePair "github-runner-${name}" (
         unmerged.merge runner.serviceSettings
-    )) enabledRunners;
+      ))
+    enabledRunners;
   };
 }

modules/nixos/home-assistant.nix

@@ -17,27 +17,41 @@ in {
       default = config.networking.domain;
     };
     homekit = {
-      enable = mkEnableOption "homekit" // {
+      enable =
-        default = cfg.config.homekit or [ ] != [ ];
+        mkEnableOption "homekit"
+        // {
+          default = cfg.config.homekit or [] != [];
         };
-      openFirewall = mkEnableOption "homekit ports" // {
+      openFirewall =
+        mkEnableOption "homekit ports"
+        // {
           default = cfg.openFirewall;
         };
     };
-    googleAssistant.enable = mkEnableOption "Google Assistant" // {
+    googleAssistant.enable =
-      default = cfg.config.google_assistant or { } != { };
+      mkEnableOption "Google Assistant"
+      // {
+        default = cfg.config.google_assistant or {} != {};
       };
-    androidTv.enable = mkEnableOption "Android TV" // {
+    androidTv.enable =
+      mkEnableOption "Android TV"
+      // {
         default = elem "androidtv" cfg.extraComponents;
       };
-    brother.enable = mkEnableOption "brother" // {
+    brother.enable =
+      mkEnableOption "brother"
+      // {
         default = elem "brother" cfg.extraComponents;
       };
     cast = {
-      enable = mkEnableOption "Chromecast" // {
+      enable =
+        mkEnableOption "Chromecast"
+        // {
           default = elem "cast" cfg.extraComponents;
         };
-      openFirewall = mkEnableOption "Chromecast ports" // {
+      openFirewall =
+        mkEnableOption "Chromecast ports"
+        // {
           default = cfg.openFirewall;
         };
     };
@@ -50,7 +64,7 @@ in {
   config = {
     networking.firewall = let
       homekitTcp = mkIf cfg.homekit.enable (
-        map ({ port, ... }: port) cfg.config.homekit or [ ]
+        map ({port, ...}: port) cfg.config.homekit or []
       );
 
       castUdpRanges = mkIf cfg.cast.enable [
@@ -59,7 +73,8 @@ in {
           to = 60999;
         }
       ];
-    in mkIf cfg.enable {
+    in
+      mkIf cfg.enable {
         interfaces.local = {
           allowedTCPPorts = mkIf (!cfg.homekit.openFirewall) homekitTcp;
           allowedUDPPortRanges = mkIf (!cfg.cast.openFirewall) castUdpRanges;
@@ -72,8 +87,9 @@ in {
     services.avahi = mkIf (cfg.enable && cfg.homekit.enable) {
       enable = mkDefault true;
       publish.enable = let
-        homekitNames = map (homekit: toLower homekit.name) cfg.config.homekit or [ ];
+        homekitNames = map (homekit: toLower homekit.name) cfg.config.homekit or [];
-      in mkIf (elem config.networking.hostName homekitNames) false;
+      in
+        mkIf (elem config.networking.hostName homekitNames) false;
     };
 
     systemd.services.home-assistant = mkIf (cfg.enable && cfg.mutableUiConfig) {
@@ -101,7 +117,8 @@ in {
           use_x_forwarded_for = "true";
           trusted_proxies = let
             inherit (config.networking.access) cidrForNetwork;
-          in cidrForNetwork.loopback.all
+          in
+            cidrForNetwork.loopback.all
             ++ cidrForNetwork.local.all
             ++ optionals config.services.tailscale.enable cidrForNetwork.tail.all
             ++ [
@@ -157,30 +174,40 @@ in {
     package = let
       inherit (cfg.package) python;
       # https://github.com/pysnmp/pysnmp/issues/51
-      needsPyasn1pin = if lib.versionOlder python.pkgs.pysnmplib.version "6.0"
+      needsPyasn1pin =
+        if lib.versionOlder python.pkgs.pysnmplib.version "6.0"
         then true
         else lib.warn "pyasn1 pin likely no longer needed" false;
       pyasn1prefix = "${python.pkgs.pysnmp-pyasn1}/${python.sitePackages}";
       home-assistant = pkgs.home-assistant.override {
         packageOverrides = self: super: {
           brother = super.brother.overridePythonAttrs (old: {
-            dontCheckRuntimeDeps = if old.dontCheckRuntimeDeps or false
+            dontCheckRuntimeDeps =
+              if old.dontCheckRuntimeDeps or false
               then lib.warn "brother override no longer needed" true
               else true;
           });
           mpd2 = super.mpd2.overridePythonAttrs (old: {
-            patches = old.patches or [ ] ++ [
+            patches =
+              old.patches
+              or []
+              ++ [
                 ../../packages/mpd2-skip-flaky-test.patch
               ];
-            disabledTests = unique (old.disabledTests or [ ] ++ [
+            disabledTests = unique (old.disabledTests
+              or []
+              ++ [
                 "test_idle_timeout"
               ]);
           });
         };
       };
-    in home-assistant.overrideAttrs (old: {
+    in
+      home-assistant.overrideAttrs (old: {
         makeWrapperArgs = old.makeWrapperArgs ++ optional (cfg.brother.enable && needsPyasn1pin) "--prefix PYTHONPATH : ${pyasn1prefix}";
-      disabledTests = unique (old.disabledTests or [ ] ++ [
+        disabledTests = unique (old.disabledTests
+          or []
+          ++ [
             "test_check_config"
           ]);
       });
@@ -189,14 +216,18 @@ in {
       inherit (lib.lists) head;
       inherit (lib.attrsets) attrNames filterAttrs;
       inherit (config.systemd.services.home-assistant.serviceConfig) ExecStart;
-      isHassDrv = drv: context: hasSuffix "-${cfg.package.name}.drv" drv && context.outputs or [ ] == [ "out" ];
+      isHassDrv = drv: context: hasSuffix "-${cfg.package.name}.drv" drv && context.outputs or [] == ["out"];
       drvs = filterAttrs isHassDrv (builtins.getContext ExecStart);
       isImpure = builtins ? currentSystem;
-    in mkIf cfg.enable (mkOptionDefault (
+    in
-      if isImpure then import (head (attrNames drvs))
+      mkIf cfg.enable (mkOptionDefault (
+        if isImpure
+        then import (head (attrNames drvs))
         else removeSuffix "/bin/hass" (head (splitString " " ExecStart))
       ));
-    extraPackages = python3Packages: with python3Packages; mkMerge [
+    extraPackages = python3Packages:
+      with python3Packages;
+        mkMerge [
           [
             psycopg2
             securetar
@@ -232,8 +263,8 @@ in {
         "google_assistant"
         "google_cloud"
       ])
-      (map ({ platform, ... }: platform) cfg.config.media_player or [ ])
+      (map ({platform, ...}: platform) cfg.config.media_player or [])
-      (map ({ platform, ... }: platform) cfg.config.tts or [ ])
+      (map ({platform, ...}: platform) cfg.config.tts or [])
     ];
   };
 }

modules/nixos/jackett.nix

@@ -1,7 +1,4 @@
-{
+{lib, ...}: let
-  lib,
-  ...
-}: let
   inherit (lib.options) mkOption;
 in {
   options.services.jackett = with lib.types; {

modules/nixos/kanidm.nix

@@ -60,13 +60,14 @@ in {
 
     services.kanidm = {
       server.unencrypted = {
-        domain = mkBefore [ cfg.server.frontend.domain ];
+        domain = mkBefore [cfg.server.frontend.domain];
         package = let
           cert = mkSnakeOil {
             name = "kanidm-cert";
             inherit (cfg.server.unencrypted) domain;
           };
-        in mkOptionDefault cert;
+        in
+          mkOptionDefault cert;
       };
       clientSettings = mkIf cfg.enableServer {
         uri = mkDefault cfg.serverSettings.origin;

modules/nixos/lidarr.nix

@@ -1,7 +1,4 @@
-{
+{lib, ...}: let
-  lib,
-  ...
-}: let
   inherit (lib.options) mkOption;
 in {
   options.services.lidarr = with lib.types; {

modules/nixos/mediatomb.nix

@@ -8,7 +8,7 @@
   inherit (lib.modules) mkIf mkMerge mkDefault mkOptionDefault;
   inherit (lib.lists) singleton;
   cfg = config.services.mediatomb;
-  mediaDirModule = { config, ... }: {
+  mediaDirModule = {config, ...}: {
     options = with lib.types; {
       mountPoint = mkOption {
         type = nullOr str;
@@ -26,14 +26,21 @@
       paths = let
         paths = map (path: "${config.path}/${path}") config.subdirectories;
         path = singleton config.path;
-      in mkOptionDefault (if config.subdirectories != null then paths else path);
+      in
+        mkOptionDefault (
+          if config.subdirectories != null
+          then paths
+          else path
+        );
       recursive = mkDefault true;
       hidden-files = mkDefault false;
     };
   };
 in {
   options.services.mediatomb = with lib.types; {
-    confine = mkEnableOption "containment" // {
+    confine =
+      mkEnableOption "containment"
+      // {
         default = true;
       };
     mediaDirectories = mkOption {
@@ -47,9 +54,13 @@ in {
   };
   config.systemd.services.mediatomb = mkIf cfg.enable {
     confinement.enable = mkIf cfg.confine (mkDefault true);
-    bindsTo = map (dir: mkIf (dir.mountPoint != null)
+    bindsTo =
+      map (
+        dir:
+          mkIf (dir.mountPoint != null)
           "${utils.escapeSystemdPath dir.mountPoint}.mount"
-    ) cfg.mediaDirectories;
+      )
+      cfg.mediaDirectories;
     unitConfig.RequiresMountsFor = mkMerge (
       map (dir: dir.paths) cfg.mediaDirectories
     );

modules/nixos/mosquitto.nix

@@ -8,18 +8,19 @@
 in {
   options.services.mosquitto = with lib.types; {
     listeners = let
-      listenerModule = { ... }: {
+      listenerModule = {...}: {
         options = {
           openFirewall = mkEnableOption "firewall";
         };
       };
-    in mkOption {
+    in
+      mkOption {
         type = listOf (submodule listenerModule);
       };
   };
   config = {
     networking.firewall.allowedTCPPorts = mkIf cfg.enable (mkMerge (
-      map (listener: mkIf listener.openFirewall [ listener.port ]) cfg.listeners
+      map (listener: mkIf listener.openFirewall [listener.port]) cfg.listeners
     ));
   };
 }

modules/nixos/network/namespace.nix

@@ -19,7 +19,12 @@
   enabledNamespaces = filter (ns: ns.enable) (attrValues networking.namespaces);
   ip = "${pkgs.iproute2}/bin/ip";
   ip-n = namespace: "${ip} -n ${escapeShellArg namespace.name}";
-  namespaceInterfaceModule = { config, namespace, name, ... }: {
+  namespaceInterfaceModule = {
+    config,
+    namespace,
+    name,
+    ...
+  }: {
     options = with lib.types; {
       name = mkOption {
         type = str;
@@ -41,8 +46,8 @@
     };
     config = {
       serviceSettings = rec {
-        bindsTo = [ "${namespace.unitName}.service" ];
+        bindsTo = ["${namespace.unitName}.service"];
-        partOf = [ "${namespace.unitName}.target" ];
+        partOf = ["${namespace.unitName}.target"];
         after = bindsTo;
         stopIfChanged = false;
         restartIfChanged = false;
@@ -63,7 +68,11 @@
       };
     };
   };
-  groupModule = { config, namespace, ... }: {
+  groupModule = {
+    config,
+    namespace,
+    ...
+  }: {
     options = with lib.types; {
       id = mkOption {
         type = int;
@@ -78,8 +87,8 @@
     };
     config = {
       serviceSettings = rec {
-        bindsTo = [ "${namespace.unitName}.service" ];
+        bindsTo = ["${namespace.unitName}.service"];
-        partOf = [ "${namespace.unitName}.target" ];
+        partOf = ["${namespace.unitName}.target"];
         after = bindsTo;
         stopIfChanged = false;
         restartIfChanged = false;
@@ -100,15 +109,21 @@
       };
     };
   };
-  namespaceModule = { config, name, ... }: let
+  namespaceModule = {
+    config,
+    name,
+    ...
+  }: let
     linkGroupServices = optional (config.linkGroup != null) "${config.linkGroup.serviceName}.service";
     interfaceServices = mapAttrsToList (_: interface: "${interface.serviceName}.service") config.interfaces;
-    submoduleArgs = { ... }: {
+    submoduleArgs = {...}: {
       config._module.args.namespace = config;
     };
   in {
     options = with lib.types; {
-      enable = mkEnableOption "network namespace" // {
+      enable =
+        mkEnableOption "network namespace"
+        // {
           default = true;
         };
       resolvConf = mkOption {
@@ -186,8 +201,9 @@
             groupModule
             submoduleArgs
           ];
-          idOrModule = coercedTo int (id: { inherit id; }) module;
+          idOrModule = coercedTo int (id: {inherit id;}) module;
-        in nullOr idOrModule;
+        in
+          nullOr idOrModule;
         default = null;
       };
       interfaces = mkOption {
@@ -195,7 +211,7 @@
           namespaceInterfaceModule
           submoduleArgs
         ]);
-        default = { };
+        default = {};
       };
       path = mkOption {
         type = path;
@@ -226,8 +242,8 @@
     };
     config = {
       serviceSettings = {
-        wants = [ "network.target" ];
+        wants = ["network.target"];
-        after = [ "network.target" ];
+        after = ["network.target"];
         stopIfChanged = false;
         restartIfChanged = false;
         serviceConfig = {
@@ -245,12 +261,12 @@
         };
       };
       targetSettings = {
-        wantedBy = [ "multi-user.target" ];
+        wantedBy = ["multi-user.target"];
-        bindsTo = [ "${config.unitName}.service" ];
+        bindsTo = ["${config.unitName}.service"];
         requires = linkGroupServices ++ interfaceServices;
         wants = mkMerge [
-          (mkIf config.dhcpcd.enable [ "${config.dhcpcd.serviceName}.service" ])
+          (mkIf config.dhcpcd.enable ["${config.dhcpcd.serviceName}.service"])
-          (mkIf config.nftables.enable [ "${config.nftables.serviceName}.service" ])
+          (mkIf config.nftables.enable ["${config.nftables.serviceName}.service"])
         ];
       };
       configFiles = {
@@ -312,7 +328,8 @@
           addrs6 = access.cidrForNetwork.local.v6 ++ optionals tailscale.enable access.cidrForNetwork.tail.v6;
           daddr4 = ''{ ${concatStringsSep ", " addrs4} }'';
           daddr6 = ''{ ${concatStringsSep ", " addrs6} }'';
-        in mkIf config.nftables.rejectLocaladdrs (mkMerge [
+        in
+          mkIf config.nftables.rejectLocaladdrs (mkMerge [
             ''ct state { established, related } accept''
             ''
               ip daddr ${daddr4} ip protocol tcp reject with tcp reset
@@ -324,9 +341,9 @@
             '')
           ]);
         serviceSettings = rec {
-          bindsTo = [ "${config.unitName}.service" ];
+          bindsTo = ["${config.unitName}.service"];
-          partOf = [ "${config.unitName}.target" ];
+          partOf = ["${config.unitName}.target"];
-          wants = mkIf config.nftables.rejectLocaladdrs [ "localaddrs.service" ];
+          wants = mkIf config.nftables.rejectLocaladdrs ["localaddrs.service"];
           after = mkMerge [
             bindsTo
             wants
@@ -346,7 +363,7 @@
               "${pkgs.nftables}/bin/nft -f ${config.configPath}/rules.nft"
             ];
             ExecReload = mkMerge [
-              (mkIf config.nftables.rejectLocaladdrs [ "+${access.localaddrs.reloadScript}" ])
+              (mkIf config.nftables.rejectLocaladdrs ["+${access.localaddrs.reloadScript}"])
               [
                 "${pkgs.nftables}/bin/nft flush ruleset"
                 "${pkgs.nftables}/bin/nft -f ${config.configPath}/rules.nft"
@@ -360,10 +377,13 @@
       };
       dhcpcd = {
         serviceSettings = rec {
-          bindsTo = [ "${config.unitName}.service" ];
+          bindsTo = ["${config.unitName}.service"];
-          partOf = [ "${config.unitName}.target" ];
+          partOf = ["${config.unitName}.target"];
           wants = linkGroupServices ++ interfaceServices;
-          after = bindsTo ++ wants ++ [
+          after =
+            bindsTo
+            ++ wants
+            ++ [
               (mkIf config.nftables.enable "${config.nftables.serviceName}.service")
             ];
           stopIfChanged = false;
@@ -407,13 +427,19 @@
       };
     };
   };
-  serviceModule = { config, name, ... }: let
+  serviceModule = {
+    config,
+    name,
+    ...
+  }: let
     cfg = config.networkNamespace;
     hasNs = cfg.name != null;
     ns = networking.namespaces.${cfg.name};
   in {
     options.networkNamespace = with lib.types; {
-      enable = mkEnableOption "netns" // {
+      enable =
+        mkEnableOption "netns"
+        // {
           default = cfg.name != null;
         };
       bindResolvConf = mkOption {
@@ -446,15 +472,13 @@
             path = mkDefault (
               ns.path
             );
-            bindResolvConf = mkDefault (
+            bindResolvConf = mkDefault "${ns.configPath}/resolv.conf";
-              "${ns.configPath}/resolv.conf"
-            );
           })
         ];
       }
       (mkIf cfg.enable rec {
-        wants = mkIf hasNs [ "${ns.unitName}.target" ];
+        wants = mkIf hasNs ["${ns.unitName}.target"];
-        bindsTo = mkIf hasNs [ "${ns.unitName}.service" ];
+        bindsTo = mkIf hasNs ["${ns.unitName}.service"];
         after = mkMerge [
           bindsTo
           (mkIf (hasNs && cfg.afterOnline) [
@@ -475,7 +499,7 @@ in {
   options = with lib.types; {
     networking.namespaces = mkOption {
       type = attrsOf (submodule namespaceModule);
-      default = { };
+      default = {};
     };
     systemd.services = mkOption {
       type = attrsOf (submodule serviceModule);
@@ -483,19 +507,25 @@ in {
   };
   config = {
     systemd = {
-      services = listToAttrs (concatMap (ns:
+      services = listToAttrs (concatMap (
+          ns:
             singleton (nameValuePair ns.unitName (unmerged.merge ns.serviceSettings))
             ++ optional (ns.linkGroup != null) (nameValuePair ns.linkGroup.serviceName (unmerged.merge ns.linkGroup.serviceSettings))
             ++ mapAttrsToList (_: interface: nameValuePair interface.serviceName (unmerged.merge interface.serviceSettings)) ns.interfaces
             ++ optional ns.dhcpcd.enable (nameValuePair ns.dhcpcd.serviceName (unmerged.merge ns.dhcpcd.serviceSettings))
             ++ optional ns.nftables.enable (nameValuePair ns.nftables.serviceName (unmerged.merge ns.nftables.serviceSettings))
-      ) enabledNamespaces);
+        )
-      targets = listToAttrs (map (ns: nameValuePair ns.unitName (
+        enabledNamespaces);
+      targets = listToAttrs (map (ns:
+        nameValuePair ns.unitName (
           unmerged.merge ns.targetSettings
-      )) enabledNamespaces);
+        ))
+      enabledNamespaces);
     };
-    environment.etc = mkMerge (map (ns:
+    environment.etc = mkMerge (map (
+        ns:
           mapAttrs' (name: file: nameValuePair "${ns.configDir}/${name}" (unmerged.merge file)) ns.configFiles
-    ) enabledNamespaces);
+      )
+      enabledNamespaces);
   };
 }

modules/nixos/network/networks.nix

@@ -8,15 +8,19 @@
   inherit (lib.modules) mkIf mkMerge mkOptionDefault;
   inherit (inputs.self.lib.lib) eui64;
   inherit (config) networking services;
-  networkModule = { config, ... }: {
+  networkModule = {config, ...}: {
     options = with lib.types; {
       mdns = {
-        enable = mkEnableOption "SLAAC" // {
+        enable =
+          mkEnableOption "SLAAC"
+          // {
             default = config.matchConfig.Type or null == "ether" && services.resolved.enable;
           };
       };
       slaac = {
-        enable = mkEnableOption "SLAAC" // {
+        enable =
+          mkEnableOption "SLAAC"
+          // {
             default = config.matchConfig.Type or null == "ether" && networking.enableIPv6;
           };
         postfix = mkOption {

modules/nixos/nftables.nix

@@ -1,6 +1,8 @@
-{ lib, config, ... }:
+{
-
+  lib,
-let
+  config,
+  ...
+}: let
   inherit (lib) types;
   inherit (lib.options) mkOption mkEnableOption;
   inherit (lib.modules) mkIf;
@@ -13,9 +15,11 @@ let
   doDocker = config.virtualisation.docker.enable && cfg.generateDockerRules;
 
   mkPorts = cond: ports: ranges: action: let
-    portStrings = (map (range: "${toString range.from}-${toString range.to}") ranges)
+    portStrings =
+      (map (range: "${toString range.from}-${toString range.to}") ranges)
       ++ (map toString ports);
-  in optionalString (portStrings != []) ''
+  in
+    optionalString (portStrings != []) ''
       ${cond} dport { ${concatStringsSep "," portStrings} } ${action}
     '';
 
@@ -39,10 +43,13 @@ let
         ${mkPorts "udp" fwcfg.allowedUDPPorts fwcfg.allowedUDPPortRanges "accept"}
 
         ${
-          concatStringsSep "\n" (mapAttrsToList (name: ifcfg: concatMapStringsSep "\n" (cond:
+      concatStringsSep "\n" (mapAttrsToList (name: ifcfg:
+        concatMapStringsSep "\n" (
+          cond:
             mkPorts "${cond} tcp" ifcfg.allowedTCPPorts ifcfg.allowedTCPPortRanges "accept"
             + mkPorts "${cond} udp" ifcfg.allowedUDPPorts ifcfg.allowedUDPPortRanges "accept"
-          ) (optionals ifcfg.nftables.enable ifcfg.nftables.conditions)) fwcfg.interfaces)
+        ) (optionals ifcfg.nftables.enable ifcfg.nftables.conditions))
+      fwcfg.interfaces)
     }
 
         # DHCPv6
@@ -85,13 +92,22 @@ let
     ''}
     ${cfg.extraConfig}
   '';
-  interfaceModule = { config, name, ... }: {
+  interfaceModule = {
+    config,
+    name,
+    ...
+  }: {
     options = {
       nftables = {
-        enable = mkEnableOption "nftables firewall" // {
+        enable =
+          mkEnableOption "nftables firewall"
+          // {
             default =
-            config.allowedTCPPorts != [ ] || config.allowedTCPPortRanges != [ ]
+              config.allowedTCPPorts
-            || config.allowedUDPPorts != [ ] || config.allowedUDPPortRanges != [ ];
+              != []
+              || config.allowedTCPPortRanges != []
+              || config.allowedUDPPorts != []
+              || config.allowedUDPPortRanges != [];
           };
         conditions = mkOption {
           type = types.listOf types.str;
@@ -100,7 +116,6 @@ let
       };
     };
   };
-
 in {
   options = {
     networking.nftables = {

modules/nixos/nginx/local.nix

@@ -9,7 +9,7 @@
   inherit (lib.lists) optionals;
   inherit (config.services) tailscale;
   inherit (config.networking.access) cidrForNetwork localaddrs;
-  localModule = { config, ... }: {
+  localModule = {config, ...}: {
     options.local = with lib.types; {
       enable = mkOption {
         type = bool;
@@ -37,16 +37,23 @@
           cidrForNetwork.loopback.all
           ++ cidrForNetwork.local.all
           ++ optionals tailscale.enable cidrForNetwork.tail.all;
-        allows = concatMapStringsSep "\n" mkAllow allowAddresses + optionalString localaddrs.enable ''
+        allows =
+          concatMapStringsSep "\n" mkAllow allowAddresses
+          + optionalString localaddrs.enable ''
             include ${localaddrs.stateDir}/*.nginx.conf;
           '';
-      in mkBefore ''
+      in
+        mkBefore ''
           ${allows}
           deny all;
         '';
     };
   };
-  locationModule = { config, virtualHost, ... }: {
+  locationModule = {
+    config,
+    virtualHost,
+    ...
+  }: {
     imports = [
       localModule
     ];
@@ -58,13 +65,13 @@
       emitDenyGlobal = virtualHost.local.emitDenyGlobal;
     };
   };
-  hostModule = { config, ... }: {
+  hostModule = {config, ...}: {
-    imports = [ localModule ];
+    imports = [localModule];
 
     options = with lib.types; {
       locations = mkOption {
         type = attrsOf (submoduleWith {
-          modules = [ locationModule ];
+          modules = [locationModule];
           shorthandOnlyDefinesConfig = true;
           specialArgs = {
             virtualHost = config;
@@ -83,7 +90,7 @@ in {
   options = with lib.types; {
     services.nginx.virtualHosts = mkOption {
       type = attrsOf (submoduleWith {
-        modules = [ hostModule ];
+        modules = [hostModule];
         shorthandOnlyDefinesConfig = true;
         specialArgs = {
           nixosConfig = config;

modules/nixos/nginx/vouch.nix

@@ -2,13 +2,12 @@
   config,
   lib,
   ...
-}:
+}: let
-let
   inherit (lib.options) mkOption mkEnableOption;
   inherit (lib.modules) mkIf mkMerge mkBefore mkDefault;
   inherit (config) networking;
   inherit (config.services) vouch-proxy tailscale;
-  vouchModule = { config, ... }: {
+  vouchModule = {config, ...}: {
     options = with lib.types; {
       vouch = {
         enable = mkEnableOption "vouch auth proxy";
@@ -49,15 +48,20 @@ let
         vouch = mkIf vouch-proxy.enable {
           proxyOrigin = let
             inherit (vouch-proxy.settings.vouch) listen port;
-            host = if listen == "0.0.0.0" || listen == "[::]" then "localhost" else listen;
+            host =
-          in mkDefault "http://${host}:${toString port}";
+              if listen == "0.0.0.0" || listen == "[::]"
+              then "localhost"
+              else listen;
+          in
+            mkDefault "http://${host}:${toString port}";
           authUrl = mkDefault vouch-proxy.authUrl;
           url = mkDefault vouch-proxy.url;
           doubleProxy = mkDefault false;
         };
       }
       {
-        vouch.proxyOrigin = mkIf (tailscale.enable && !vouch-proxy.enable) (mkDefault
+        vouch.proxyOrigin = mkIf (tailscale.enable && !vouch-proxy.enable) (
+          mkDefault
           "http://login.tail.${networking.domain}"
         );
       }
@@ -96,7 +100,8 @@ let
                   set $vouch_url $vouch_scheme://${config.vouch.tailDomain};
                 }
               '';
-            in mkMerge [
+            in
+              mkMerge [
                 (mkBefore ''
                   set $vouch_url ${config.vouch.url};
                   set $vouch_scheme $scheme;

modules/nixos/nginx/websocket.nix

@@ -1,10 +1,7 @@
-{
+{lib, ...}: let
-  lib,
-  ...
-}: let
   inherit (lib.modules) mkIf;
   inherit (lib.options) mkOption mkEnableOption;
-  wsModule = { config, ... }: {
+  wsModule = {config, ...}: {
     options = with lib.types; {
       proxy.websocket.enable = mkEnableOption "websocket proxy";
     };
@@ -16,8 +13,8 @@
       '';
     };
   };
-  hostModule = { config, ... }: {
+  hostModule = {config, ...}: {
-    imports = [ wsModule ];
+    imports = [wsModule];
 
     options = with lib.types; {
       locations = mkOption {

modules/nixos/plex.nix

@@ -1,7 +1,4 @@
-{
+{lib, ...}: let
-  lib,
-  ...
-}: let
   inherit (lib.options) mkOption;
 in {
   options.services.plex = with lib.types; {

modules/nixos/policyrouting.nix

@@ -1,11 +1,12 @@
-{ config, lib, ... }:
+{
-
+  config,
-with lib;
+  lib,
-
+  ...
-let
+}:
+with lib; let
   cfg = config.networking.policyrouting;
 
-  ruleOpts = { ... }: {
+  ruleOpts = {...}: {
     options = {
       prio = mkOption {
         type = types.int;
@@ -15,37 +16,44 @@ let
       };
     };
   };
-
+in {
-in
-{
   options = {
     networking.policyrouting = {
       enable = mkEnableOption "Declarative Policy-Routing";
       rules = mkOption {
         type = with types; listOf (submodule ruleOpts);
-        default = [ ];
+        default = [];
       };
       rules6 = mkOption {
         type = with types; listOf (submodule ruleOpts);
-        default = [ ];
+        default = [];
       };
       rules4 = mkOption {
         type = with types; listOf (submodule ruleOpts);
-        default = [ ];
+        default = [];
       };
     };
   };
 
   config = mkIf cfg.enable {
     networking.policyrouting.rules = [
-      { rule = "lookup main"; prio = 32000; }
+      {
+        rule = "lookup main";
+        prio = 32000;
+      }
     ];
     networking.localCommands = ''
       set -x
       ip -6 rule flush
       ip -4 rule flush
-      ${concatMapStringsSep "\n" ({ prio, rule }: "ip -6 rule add ${rule} prio ${toString prio}") (cfg.rules ++ cfg.rules6)}
+      ${concatMapStringsSep "\n" ({
-      ${concatMapStringsSep "\n" ({ prio, rule }: "ip -4 rule add ${rule} prio ${toString prio}") (cfg.rules ++ cfg.rules4)}
+        prio,
+        rule,
+      }: "ip -6 rule add ${rule} prio ${toString prio}") (cfg.rules ++ cfg.rules6)}
+      ${concatMapStringsSep "\n" ({
+        prio,
+        rule,
+      }: "ip -4 rule add ${rule} prio ${toString prio}") (cfg.rules ++ cfg.rules4)}
     '';
   };
 }

modules/nixos/postgres.nix

@@ -10,19 +10,24 @@
   inherit (config) networking;
   cfg = config.services.postgresql;
   formatHost = host:
-    if hasInfix "/" host then host
+    if hasInfix "/" host
-    else if hasInfix ":" host then "${host}/128"
+    then host
-    else if hasInfix "." host then "${host}/32"
+    else if hasInfix ":" host
+    then "${host}/128"
+    else if hasInfix "." host
+    then "${host}/32"
     else throw "unsupported IP address ${host}";
-  ensureUserModule = { config, ... }: {
+  ensureUserModule = {config, ...}: {
     options = with lib.types; {
       authentication = {
-        enable = mkEnableOption "TCP connections" // {
+        enable =
-          default = config.authentication.hosts != [ ];
+          mkEnableOption "TCP connections"
+          // {
+            default = config.authentication.hosts != [];
           };
         hosts = mkOption {
           type = listOf str;
-          default = [ ];
+          default = [];
         };
         method = mkOption {
           type = str;
@@ -47,13 +52,15 @@
       authentication = {
         hosts = let
           inherit (networking.access) cidrForNetwork;
-        in mkMerge [
+        in
+          mkMerge [
             (mkIf config.authentication.tailscale.allow cidrForNetwork.tail.all)
             (mkIf config.authentication.local.allow (cidrForNetwork.loopback.all ++ cidrForNetwork.local.all))
           ];
         authentication = mkMerge (map (host: ''
             host ${config.authentication.database} ${config.name} ${formatHost host} ${config.authentication.method}
-        '') config.authentication.hosts);
+          '')
+          config.authentication.hosts);
       };
       authentication.database = mkIf config.ensureDBOwnership (
         mkOptionDefault config.name
@@ -70,11 +77,13 @@ in {
     enableTCPIP = mkIf (any (user: user.authentication.enable) cfg.ensureUsers) (
       mkDefault true
     );
-    authentication = mkMerge (map (user:
+    authentication = mkMerge (map (
+        user:
           mkIf user.authentication.enable user.authentication.authentication
-    ) cfg.ensureUsers);
+      )
+      cfg.ensureUsers);
   };
   config.networking.firewall.interfaces.local = mkIf cfg.enable {
-    allowedTCPPorts = mkIf (any (user: user.authentication.local.allow) cfg.ensureUsers) [ cfg.port ];
+    allowedTCPPorts = mkIf (any (user: user.authentication.local.allow) cfg.ensureUsers) [cfg.port];
   };
 }

modules/nixos/prowlarr.nix

@@ -1,7 +1,4 @@
-{
+{lib, ...}: let
-  lib,
-  ...
-}: let
   inherit (lib.options) mkOption;
 in {
   options.services.prowlarr = with lib.types; {

modules/nixos/radarr.nix

@@ -1,7 +1,4 @@
-{
+{lib, ...}: let
-  lib,
-  ...
-}: let
   inherit (lib.options) mkOption;
 in {
   options.services.radarr = with lib.types; {

modules/nixos/readarr.nix

@@ -1,7 +1,4 @@
-{
+{lib, ...}: let
-  lib,
-  ...
-}: let
   inherit (lib.options) mkOption;
 in {
   options.services.readarr = with lib.types; {

modules/nixos/samba.nix

@@ -11,14 +11,17 @@
   inherit (config.services) samba-wsdd;
   cfg = config.services.samba;
   settingValue = value:
-    if builtins.isList value then concatMapStringsSep ", " settingValue value
+    if builtins.isList value
-    else if value == true then "yes"
+    then concatMapStringsSep ", " settingValue value
-    else if value == false then "no"
+    else if value == true
+    then "yes"
+    else if value == false
+    then "no"
     else toString value;
 in {
   options.services.samba = with lib.types; let
-    settingPrimitive = oneOf [ str int bool ];
+    settingPrimitive = oneOf [str int bool];
-    settingType = oneOf [ settingPrimitive (listOf settingPrimitive) ];
+    settingType = oneOf [settingPrimitive (listOf settingPrimitive)];
   in {
     ldap = {
       enable = mkEnableOption "LDAP";
@@ -64,7 +67,11 @@ in {
       };
     };
     idmap = let
-      idmapModule = { config, name, ... }: {
+      idmapModule = {
+        config,
+        name,
+        ...
+      }: {
         options = {
           backend = mkOption {
             type = str;
@@ -89,7 +96,7 @@ in {
           };
           settings = mkOption {
             type = attrsOf settingType;
-            default = { };
+            default = {};
           };
         };
         config = {
@@ -117,7 +124,7 @@ in {
     };
     settings = mkOption {
       type = attrsOf settingType;
-      default = { };
+      default = {};
     };
   };
 
@@ -161,13 +168,14 @@ in {
             "usershare owner only" = mkOptionDefault true;
             "usershare template share" = mkOptionDefault cfg.usershare.templateShare;
             "usershare path" = mkOptionDefault cfg.usershare.path;
-          "usershare prefix allow list" = mkOptionDefault [ cfg.usershare.path ];
+            "usershare prefix allow list" = mkOptionDefault [cfg.usershare.path];
           })
           (mkIf cfg.guest.enable {
             "map to guest" = mkOptionDefault "Bad User";
             "guest account" = mkOptionDefault cfg.guest.user;
           })
-      ] ++ mapAttrsToList (_: idmap: mapAttrs' (key: value: nameValuePair "idmap config ${idmap.domain} : ${key}" (mkOptionDefault value)) idmap.settings) cfg.idmap.domains);
+        ]
+        ++ mapAttrsToList (_: idmap: mapAttrs' (key: value: nameValuePair "idmap config ${idmap.domain} : ${key}" (mkOptionDefault value)) idmap.settings) cfg.idmap.domains);
       extraConfig = mkMerge (mapAttrsToList (key: value: ''${key} = ${settingValue value}'') cfg.settings);
       shares.${cfg.usershare.templateShare} = mkIf cfg.usershare.enable {
         "-valid" = false;
@@ -194,12 +202,12 @@ in {
 
     networking.firewall.interfaces.local = {
       allowedTCPPorts = mkMerge [
-        (mkIf (cfg.enable && !cfg.openFirewall) [ 139 445 ])
+        (mkIf (cfg.enable && !cfg.openFirewall) [139 445])
-        (mkIf (samba-wsdd.enable && !samba-wsdd.openFirewall) [ 5357 ])
+        (mkIf (samba-wsdd.enable && !samba-wsdd.openFirewall) [5357])
       ];
       allowedUDPPorts = mkMerge [
-        (mkIf (cfg.enable && !cfg.openFirewall) [ 137 138 ])
+        (mkIf (cfg.enable && !cfg.openFirewall) [137 138])
-        (mkIf (samba-wsdd.enable && !samba-wsdd.openFirewall) [ 3702 ])
+        (mkIf (samba-wsdd.enable && !samba-wsdd.openFirewall) [3702])
       ];
     };
   };

modules/nixos/sonarr.nix

@@ -1,7 +1,4 @@
-{
+{lib, ...}: let
-  lib,
-  ...
-}: let
   inherit (lib.options) mkOption;
 in {
   options.services.sonarr = with lib.types; {

modules/nixos/steam/account-switch.nix

@@ -76,7 +76,8 @@ in {
         inherit owner;
         inherit (shared) group mode;
       };
-      setupFiles = singleton {
+      setupFiles =
+        singleton {
           ${cfg.rootDir} = toplevel;
           ${cfg.binDir} = toplevel;
           ${cfg.binDir + "/users"} = shared;
@@ -84,11 +85,14 @@ in {
           ${cfg.sharedDataDir} = shared;
           ${cfg.workingDir} = toplevel;
           ${cfg.sharedWorkingDir} = shared;
-      } ++ map (owner: {
+        }
+        ++ map (owner: {
           ${cfg.dataDir + "/${owner}"} = personal owner;
           ${cfg.workingDir + "/${owner}"} = personal owner;
-      }) cfg.users;
+        })
-      userBinFiles = listToAttrs (map (user: nameValuePair "${cfg.binDir}/users/${user}.bat" {
+        cfg.users;
+      userBinFiles = listToAttrs (map (user:
+        nameValuePair "${cfg.binDir}/users/${user}.bat" {
           inherit (toplevel) owner group;
           mode = "0755";
           type = "copy";
@@ -99,7 +103,8 @@ in {
               setx GENSO_STEAM_USER ${user}
             '';
           };
-      }) cfg.users);
+        })
+      cfg.users);
     in {
       enable = mkIf (cfg.enable || cfg.setup) true;
       files = mkMerge [

modules/nixos/steam/beatsaber.nix

@@ -14,7 +14,11 @@
   inherit (lib.meta) getExe;
   inherit (config.services.steam) accountSwitch;
   cfg = config.services.steam.beatsaber;
-  versionModule = { config, name, ... }: {
+  versionModule = {
+    config,
+    name,
+    ...
+  }: {
     options = with lib.types; {
       version = mkOption {
         type = str;
@@ -23,7 +27,8 @@
     };
   };
 
-  mkSharePath = path: mkWinPath (
+  mkSharePath = path:
+    mkWinPath (
       "%GENSO_SMB_SHARED_MOUNT%"
       + "/${accountSwitch.sharePath}"
       + "/${removePrefix (accountSwitch.rootDir + "/") path}"
@@ -102,7 +107,9 @@
 in {
   options.services.steam.beatsaber = with lib.types; {
     enable = mkEnableOption "beatsaber scripts";
-    setup = mkEnableOption "beatsaber data" // {
+    setup =
+      mkEnableOption "beatsaber data"
+      // {
         default = accountSwitch.setup;
       };
     group = mkOption {
@@ -114,7 +121,7 @@ in {
     };
     versions = mkOption {
       type = attrsOf (submodule versionModule);
-      default = { };
+      default = {};
     };
     users = mkOption {
       type = listOf str;
@@ -127,7 +134,7 @@ in {
       bsUsers = filterAttrs (_: userIs cfg.group) config.users.users;
       allVersions = mapAttrsToList (_: version: version.version) cfg.versions;
     in {
-      defaultVersion = mkIf (allVersions != [ ]) (mkOptionDefault (
+      defaultVersion = mkIf (allVersions != []) (mkOptionDefault (
         head allVersions
       ));
       users = mkOptionDefault (
@@ -140,10 +147,12 @@ in {
         mkbeatsabersh
       ];
     };
-    systemd.services = mkIf cfg.setup (listToAttrs (map (user: nameValuePair "steam-setup-beatsaber-${user}" {
+    systemd.services = mkIf cfg.setup (listToAttrs (map (user:
+      nameValuePair "steam-setup-beatsaber-${user}" {
         script = mkMerge (mapAttrsToList (_: version: ''
             ${getExe mkbeatsaber} ${version.version} ${user}
-      '') cfg.versions);
+          '')
+          cfg.versions);
         path = [
           pkgs.coreutils
         ];
@@ -157,7 +166,8 @@ in {
           RemainAfterExit = mkOptionDefault true;
           User = mkOptionDefault user;
         };
-    }) cfg.users));
+      })
+    cfg.users));
     services.tmpfiles = let
       toplevel = {
         owner = mkDefault "admin";
@@ -187,30 +197,42 @@ in {
         "AppData"
         "UserData"
       ];
-      setupFiles = [
+      setupFiles =
+        [
           {
             "${accountSwitch.sharedDataDir}/BeatSaber" = toplevel;
             "${accountSwitch.binDir}/beatsaber" = shared;
           }
           (listToAttrs (
-          map (folder:
+            map (
+              folder:
                 nameValuePair "${accountSwitch.sharedDataDir}/BeatSaber/${folder}" shared
-          ) sharedFolders
+            )
+            sharedFolders
           ))
-      ] ++ concatMap (owner:
+        ]
+        ++ concatMap (
+          owner:
             singleton {
               "${accountSwitch.dataDir}/${owner}/BeatSaber" = personal owner;
               "${accountSwitch.dataDir}/${owner}/BeatSaber/AppData" = personal owner;
               "${accountSwitch.dataDir}/${owner}/BeatSaber/UserData" = personal owner;
-        } ++ mapAttrsToList (_: version: {
+            }
+            ++ mapAttrsToList (_: version: {
               "${accountSwitch.dataDir}/${owner}/BeatSaber/${version.version}" = personal owner;
-        }) cfg.versions
+            })
-      ) accountSwitch.users
+            cfg.versions
+        )
+        accountSwitch.users
         ++ mapAttrsToList (_: version: {
           "${accountSwitch.sharedDataDir}/BeatSaber/${version.version}" = shared;
-      }) cfg.versions;
+        })
-      versionBinFiles = mapAttrs' (_: version: nameValuePair
+        cfg.versions;
-        "${accountSwitch.binDir}/beatsaber/${replaceStrings [ "." ] [ "_" ] version.version}.bat"
+      versionBinFiles =
+        mapAttrs' (
+          _: version:
+            nameValuePair
+            "${accountSwitch.binDir}/beatsaber/${replaceStrings ["."] ["_"] version.version}.bat"
             {
               inherit (bin) owner group mode type;
               src = pkgs.writeTextFile {
@@ -221,8 +243,10 @@ in {
                 '';
               };
             }
-      ) cfg.versions;
+        )
-      binFiles = {
+        cfg.versions;
+      binFiles =
+        {
           "${accountSwitch.binDir}/beatsaber/mount.bat" = {
             inherit (bin) owner group mode type;
             src = pkgs.writeTextFile {
@@ -257,7 +281,8 @@ in {
               executable = true;
             };
           };
-      } // versionBinFiles;
+        }
+        // versionBinFiles;
     in {
       enable = mkIf (cfg.enable || cfg.setup) true;
       files = mkMerge [

modules/nixos/tmpfiles.nix

@@ -18,9 +18,15 @@
   systemdFiles = filter (file: file.systemd.enable) files;
   setupFiles = filter (file: !file.systemd.enable) files;
   bindFiles = filter (file: file.type == "bind") files;
-  fileModule = { config, name, ... }: {
+  fileModule = {
+    config,
+    name,
+    ...
+  }: {
     options = with lib.types; {
-      enable = mkEnableOption "file" // {
+      enable =
+        mkEnableOption "file"
+        // {
           default = true;
         };
       mkdirParent = mkEnableOption "mkdir";
@@ -32,8 +38,11 @@
         default = name;
       };
       type = mkOption {
-        type = enum [ "directory" "symlink" "link" "copy" "bind" ];
+        type = enum ["directory" "symlink" "link" "copy" "bind"];
-        default = if config.src != null then "symlink" else "directory";
+        default =
+          if config.src != null
+          then "symlink"
+          else "directory";
       };
       mode = mkOption {
         type = str;
@@ -71,7 +80,7 @@
     };
     config = let
       acls = concatStringsSep "," config.acls;
-      enableAcls = config.type == "directory" && config.acls != [ ];
+      enableAcls = config.type == "directory" && config.acls != [];
       systemdAclRule = "a+ ${config.path} - - - - ${acls}";
       systemdRule = {
         directory = [
@@ -168,7 +177,7 @@
       systemd = {
         rules = mkMerge [
           systemdRule.${config.type}
-          (mkIf enableAcls [ systemdAclRule ])
+          (mkIf enableAcls [systemdAclRule])
         ];
         mountSettings = mkIf (config.type == "bind") {
           enable = mkDefault config.enable;
@@ -191,16 +200,21 @@
   };
 in {
   options.services.tmpfiles = with lib.types; {
-    enable = mkEnableOption "extended tmpfiles" // {
+    enable =
-      default = cfg.files != { };
+      mkEnableOption "extended tmpfiles"
+      // {
+        default = cfg.files != {};
       };
     user = mkOption {
       type = str;
-      default = if config.proxmoxLXC.privileged or true then "root" else "admin";
+      default =
+        if config.proxmoxLXC.privileged or true
+        then "root"
+        else "admin";
     };
     files = mkOption {
       type = attrsOf (submodule fileModule);
-      default = { };
+      default = {};
     };
   };
   config = {
@@ -209,15 +223,19 @@ in {
         map (file: file.systemd.rules) systemdFiles
       );
       services.tmpfiles = {
-        path = [ pkgs.coreutils pkgs.acl ];
+        path = [pkgs.coreutils pkgs.acl];
         script = mkMerge (
-          [ ''
+          [
+            ''
               EXITCODE=0
-          '' ]
+            ''
+          ]
           ++ map (file: file.setup.script) setupFiles
-          ++ [ ''
+          ++ [
+            ''
               exit $EXITCODE
-          '' ]
+            ''
+          ]
         );
         wantedBy = [
           "sysinit.target"

modules/nixos/users.nix

@@ -13,28 +13,33 @@
   userMatchBlock = user: let
     inherit (user.openssh) matchBlock;
     criteria = mapAttrsToList toSshdCriteria matchBlock.criteria;
-  in mkAfter ''
+  in
+    mkAfter ''
       Match ${concatStringsSep " " criteria}
       ${matchBlock.settingsConfig}
     '';
-  userModule = { config, ... }: let
+  userModule = {config, ...}: let
     toSshdValue = value:
-      if value == true then "yes"
+      if value == true
-      else if value == false then "no"
+      then "yes"
+      else if value == false
+      then "no"
       else toString value;
     toSshdConf = key: value: "${key} ${toSshdValue value}";
   in {
     options = with lib.types; {
       openssh.matchBlock = {
-        enable = mkEnableOption "match block" // {
+        enable =
-          default = config.openssh.matchBlock.settings != { };
+          mkEnableOption "match block"
+          // {
+            default = config.openssh.matchBlock.settings != {};
           };
         criteria = mkOption {
           type = attrsOf str;
         };
         settings = mkOption {
-          type = attrsOf (oneOf [ str path bool int ]);
+          type = attrsOf (oneOf [str path bool int]);
-          default = { };
+          default = {};
         };
         settingsConfig = mkOption {
           type = lines;

modules/nixos/vouch.nix

@@ -5,11 +5,20 @@
   lib,
   ...
 }: let
-  inherit (lib) mkIf mkMerge mkDefault mkOptionDefault mkOption mkEnableOption types
+  inherit
-    getExe;
+    (lib)
+    mkIf
+    mkMerge
+    mkDefault
+    mkOptionDefault
+    mkOption
+    mkEnableOption
+    types
+    getExe
+    ;
   nixosConfig = config;
   cfg = config.services.vouch-proxy;
-  settingsFormat = pkgs.formats.json { };
+  settingsFormat = pkgs.formats.json {};
 in {
   options.services.vouch-proxy = with types; {
     enable = mkEnableOption "vouch";
@@ -35,7 +44,7 @@ in {
     };
     enableSettingsSecrets = mkEnableOption "genJqSecretsReplacementSnippet";
     settings = let
-      settingsModule = { ... }: {
+      settingsModule = {...}: {
         freeformType = settingsFormat.type;
         options = {
           vouch = {
@@ -98,13 +107,14 @@ in {
           };
         };
       };
-    in mkOption {
+    in
+      mkOption {
         type = submodule settingsModule;
-      default = { };
+        default = {};
       };
     extraSettings = mkOption {
       inherit (settingsFormat) type;
-      default = { };
+      default = {};
     };
     settingsPath = mkOption {
       type = path;
@@ -116,10 +126,12 @@ in {
       cfg.settings
       cfg.extraSettings
     ];
-    settingsPath = if cfg.enableSettingsSecrets
+    settingsPath =
+      if cfg.enableSettingsSecrets
       then "/run/vouch-proxy/vouch-config.json"
       else settingsFormat.generate "vouch-config.json" settings;
-  in mkMerge [
+  in
+    mkMerge [
       {
         services.vouch-proxy = {
           settingsPath = mkOptionDefault settingsPath;
@@ -128,14 +140,15 @@ in {
       (mkIf cfg.enable {
         systemd.services.vouch-proxy = {
           description = "Vouch-proxy";
-        after = [ "network.target" ];
+          after = ["network.target"];
-        wantedBy = [ "multi-user.target" ];
+          wantedBy = ["multi-user.target"];
           serviceConfig = {
             ExecStartPre = let
               preprocess = pkgs.writeShellScript "vouch-proxy-prestart" (
                 utils.genJqSecretsReplacementSnippet settings cfg.settingsPath
               );
-          in mkIf cfg.enableSettingsSecrets [
+            in
+              mkIf cfg.enableSettingsSecrets [
                 "${preprocess}"
               ];
             ExecStart = [

nixos/access/freeipa.nix

@@ -3,8 +3,7 @@
   meta,
   lib,
   ...
-}:
+}: let
-let
   inherit (lib.options) mkOption mkEnableOption;
   inherit (lib.modules) mkIf mkMerge mkBefore mkDefault;
   inherit (lib.strings) optionalString concatStringsSep;
@@ -56,7 +55,9 @@ in {
       type = str;
     };
     preread = {
-      enable = mkEnableOption "ssl preread" // {
+      enable =
+        mkEnableOption "ssl preread"
+        // {
           default = true;
         };
       port = mkOption {
@@ -65,7 +66,9 @@ in {
       };
     };
     kerberos = {
-      enable = mkEnableOption "proxy kerberos" // {
+      enable =
+        mkEnableOption "proxy kerberos"
+        // {
           default = true;
         };
       ports = {
@@ -86,7 +89,10 @@ in {
     proxyPass = mkOption {
       type = str;
       default = let
-        scheme = if access.port == 443 then "https" else "http";
+        scheme =
+          if access.port == 443
+          then "https"
+          else "http";
       in "${scheme}://${access.host}:${toString access.port}";
     };
     domain = mkOption {
@@ -130,7 +136,7 @@ in {
         port = mkDefault access.ldapPort;
         useACMEHost = mkDefault access.useACMEHost;
       };
-      resolver.addresses = mkIf access.preread.enable [ "[::1]" "127.0.0.1:5353" ];
+      resolver.addresses = mkIf access.preread.enable ["[::1]" "127.0.0.1:5353"];
       defaultSSLListenPort = mkIf access.preread.enable access.preread.port;
       streamConfig = let
         preread = ''
@@ -174,7 +180,8 @@ in {
             proxy_pass ${access.host}:${toString access.kerberos.ports.kpasswd};
           }
         '';
-      in mkMerge [
+      in
+        mkMerge [
           (mkIf access.preread.enable preread)
           (mkIf access.kerberos.enable kerberos)
         ];
@@ -207,7 +214,7 @@ in {
           local.enable = true;
           inherit locations;
         };
-        ${ldap.domain} = { config, ... }: {
+        ${ldap.domain} = {config, ...}: {
           useACMEHost = mkDefault virtualHosts.${access.domain}.useACMEHost;
           addSSL = mkDefault (config.useACMEHost != null);
           globalRedirect = access.domain;

nixos/access/freepbx.nix

@@ -12,7 +12,9 @@
   freepbx = config.lib.access.systemFor "freepbx";
 in {
   options.services.nginx.access.freepbx = with lib.types; {
-    global.enable = mkEnableOption "global access" // {
+    global.enable =
+      mkEnableOption "global access"
+      // {
         default = access.useACMEHost != null;
       };
     host = mkOption {
@@ -94,7 +96,8 @@ in {
       };
       "${access.domain}@ucp" = {
         serverName = access.domain;
-        listen = concatMap (addr: [
+        listen =
+          concatMap (addr: [
             {
               inherit addr;
               port = access.ucpPort;
@@ -104,7 +107,8 @@ in {
               port = access.ucpSslPort;
               ssl = true;
             })
-        ]) nginx.defaultListenAddresses;
+          ])
+          nginx.defaultListenAddresses;
         proxy.websocket.enable = true;
         local.enable = mkDefault (!access.global.enable);
         addSSL = mkDefault (access.useACMEHost != null);
@@ -116,7 +120,8 @@ in {
         inherit extraConfig;
       };
       ${access.localDomain} = {
-        listen = concatMap (addr: [
+        listen =
+          concatMap (addr: [
             {
               inherit addr;
               port = nginx.defaultHTTPListenPort;
@@ -135,8 +140,9 @@ in {
               port = access.ucpSslPort;
               ssl = true;
             })
-        ]) nginx.defaultListenAddresses;
+          ])
-        serverAliases = mkIf tailscale.enable [ access.tailDomain ];
+          nginx.defaultListenAddresses;
+        serverAliases = mkIf tailscale.enable [access.tailDomain];
         useACMEHost = mkDefault access.useACMEHost;
         addSSL = mkDefault (access.useACMEHost != null);
         kTLS = mkDefault true;
@@ -146,7 +152,7 @@ in {
     };
   };
   config.networking.firewall = let
-    websocketPorts = [ access.ucpPort ] ++ optional (access.useACMEHost != null) access.ucpSslPort;
+    websocketPorts = [access.ucpPort] ++ optional (access.useACMEHost != null) access.ucpSslPort;
   in {
     interfaces.local.allowedTCPPorts = websocketPorts;
     allowedTCPPorts = mkIf access.global.enable websocketPorts;

nixos/access/global.nix

@@ -1,7 +1,4 @@
-{
+{lib, ...}: let
-  lib,
-  ...
-}: let
   inherit (lib.modules) mkDefault;
 in {
   networking = {

nixos/access/invidious.nix

@@ -34,12 +34,14 @@ in {
       url = mkOptionDefault "http://localhost:${toString cfg.port}";
     };
     virtualHosts = let
-      invidiousDomains = [
+      invidiousDomains =
+        [
           access.domain
           access.localDomain
-      ] ++ optional tailscale.enable access.tailDomain;
+        ]
+        ++ optional tailscale.enable access.tailDomain;
       contentSecurityPolicy' = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'; manifest-src 'self'; media-src 'self' blob: https://*.googlevideo.com:443 https://*.youtube.com:443; child-src 'self' blob:; frame-src 'self'; frame-ancestors 'none'";
-      contentSecurityPolicy = replaceStrings [ "'self'" ] [ "'self' ${concatStringsSep " " invidiousDomains}" ] contentSecurityPolicy';
+      contentSecurityPolicy = replaceStrings ["'self'"] ["'self' ${concatStringsSep " " invidiousDomains}"] contentSecurityPolicy';
       extraConfig = ''
         # Some players don't reopen a socket and playback stops totally instead of resuming after an extended pause
         send_timeout 100m;
@@ -56,14 +58,14 @@ in {
         '';
       };
     in {
-      ${access.domain} = { config, ... }: {
+      ${access.domain} = {config, ...}: {
         vouch.enable = true;
         locations."/" = location;
         kTLS = mkDefault true;
         inherit extraConfig;
       };
-      ${access.localDomain} = { config, ... }: {
+      ${access.localDomain} = {config, ...}: {
-        serverAliases = mkIf tailscale.enable [ access.tailDomain ];
+        serverAliases = mkIf tailscale.enable [access.tailDomain];
         local.enable = true;
         locations."/" = mkMerge [
           location

nixos/access/kanidm.nix

@@ -3,8 +3,7 @@
   meta,
   lib,
   ...
-}:
+}: let
-let
   inherit (lib.options) mkOption;
   inherit (lib.modules) mkIf mkMerge mkDefault mkOptionDefault;
   inherit (config) networking;

nixos/access/kitchencam.nix

@@ -64,8 +64,9 @@ in {
           inherit extraConfig;
         };
       };
-      streamListen = { config, ... }: {
+      streamListen = {config, ...}: {
-        listen = concatMap (addr: [
+        listen =
+          concatMap (addr: [
             (mkIf config.addSSL {
               inherit addr;
               port = nginx.defaultSSLListenPort;
@@ -79,24 +80,31 @@ in {
               inherit addr;
               port = access.streamPort;
             }
-        ]) nginx.defaultListenAddresses;
+          ])
+          nginx.defaultListenAddresses;
       };
     in {
-      ${access.domain} = mkMerge [ {
+      ${access.domain} = mkMerge [
+        {
           vouch.enable = true;
           kTLS = mkDefault true;
           inherit (access) useACMEHost;
           addSSL = mkDefault (access.useACMEHost != null);
           inherit locations;
-      } streamListen ];
+        }
-      ${access.localDomain} = mkMerge [ {
+        streamListen
-        serverAliases = mkIf config.services.tailscale.enable [ access.tailDomain ];
+      ];
+      ${access.localDomain} = mkMerge [
+        {
+          serverAliases = mkIf config.services.tailscale.enable [access.tailDomain];
           inherit (virtualHosts.${access.domain}) useACMEHost;
           addSSL = mkDefault addSSL;
           kTLS = mkDefault true;
           local.enable = true;
           inherit locations;
-      } streamListen ];
+        }
+        streamListen
+      ];
     };
   };
   config.networking.firewall.allowedTCPPorts = [

nixos/access/ldap.nix

@@ -2,8 +2,7 @@
   config,
   lib,
   ...
-}:
+}: let
-let
   inherit (lib.options) mkOption mkEnableOption;
   inherit (lib.modules) mkIf mkMerge;
   inherit (lib.strings) concatMapStringsSep optionalString;
@@ -18,7 +17,9 @@ let
       cidrForNetwork.loopback.all
       ++ cidrForNetwork.local.all
       ++ optionals tailscale.enable cidrForNetwork.tail.all;
-    allows = concatMapStringsSep "\n" mkAllow allowAddresses + optionalString localaddrs.enable ''
+    allows =
+      concatMapStringsSep "\n" mkAllow allowAddresses
+      + optionalString localaddrs.enable ''
         include ${localaddrs.stateDir}/*.nginx.conf;
       '';
   in ''
@@ -61,7 +62,8 @@ in {
           proxy_ssl on;
           proxy_ssl_verify off;
         '';
-      in mkIf access.enable (mkMerge [
+      in
+        mkIf access.enable (mkMerge [
           ''
             server {
               listen 0.0.0.0:389;

nixos/access/plex.nix

@@ -70,10 +70,12 @@ in {
       plex-external = mkIf (access.externalPort != null) {
         serverName = mkDefault access.domain;
         default = mkDefault true;
-        listen = map (addr: {
+        listen =
+          map (addr: {
             inherit addr;
             port = access.externalPort;
-        }) nginx.defaultListenAddresses;
+          })
+          nginx.defaultListenAddresses;
         locations."/" = location;
         inherit extraConfig;
       };

nixos/access/proxmox.nix

@@ -14,10 +14,11 @@
   proxyPass = "https://reisen.local.${config.networking.domain}:8006/";
   unencrypted = mkSnakeOil {
     name = "prox-local-cert";
-    domain = singleton "prox.local.${config.networking.domain}"
+    domain =
+      singleton "prox.local.${config.networking.domain}"
       ++ optional tailscale.enable "prox.tail.${config.networking.domain}";
   };
-  sslHost = { config, ... }: {
+  sslHost = {config, ...}: {
     sslCertificate = mkIf (!config.enableACME && config.useACMEHost == null) unencrypted.fullchain;
     sslCertificateKey = mkIf (!config.enableACME && config.useACMEHost == null) unencrypted.key;
   };
@@ -91,7 +92,8 @@ in {
     ${access.domain} = {
       inherit locations extraConfig;
     };
-    ${access.localDomain} = mkMerge [ {
+    ${access.localDomain} = mkMerge [
+      {
         inherit (virtualHosts.${access.domain}) useACMEHost;
         local.enable = mkDefault true;
         forceSSL = mkDefault true;
@@ -99,8 +101,11 @@ in {
           proxy.websocket.enable = true;
           inherit proxyPass extraConfig;
         };
-    } sslHost ];
+      }
-    ${access.tailDomain} = mkIf tailscale.enable (mkMerge [ {
+      sslHost
+    ];
+    ${access.tailDomain} = mkIf tailscale.enable (mkMerge [
+      {
         inherit (virtualHosts.${access.domain}) useACMEHost;
         addSSL = mkDefault true;
         local.enable = mkDefault true;
@@ -108,7 +113,9 @@ in {
           proxy.websocket.enable = true;
           inherit proxyPass extraConfig;
         };
-    } sslHost ]);
+      }
+      sslHost
+    ]);
   };
 
   config.sops.secrets.access-proxmox = {

nixos/access/unifi.nix

@@ -10,7 +10,9 @@
 in {
   options.services.nginx.access.unifi = with lib.types; {
     global = {
-      enable = mkEnableOption "global access" // {
+      enable =
+        mkEnableOption "global access"
+        // {
           default = access.useACMEHost != null;
         };
       management = mkEnableOption "global management port access";
@@ -59,11 +61,13 @@ in {
       };
     in {
       "${access.domain}@management" = mkIf access.global.management {
-        listen = map (addr: {
+        listen =
+          map (addr: {
             inherit addr;
             port = access.managementPort;
             ssl = true;
-        }) nginx.defaultListenAddresses;
+          })
+          nginx.defaultListenAddresses;
         serverName = access.domain;
         default = mkDefault true;
         forceSSL = mkDefault true;
@@ -81,7 +85,7 @@ in {
         inherit locations extraConfig;
       };
       ${access.localDomain} = {
-        serverAliases = mkIf tailscale.enable [ access.tailDomain ];
+        serverAliases = mkIf tailscale.enable [access.tailDomain];
         useACMEHost = mkDefault access.useACMEHost;
         addSSL = mkDefault (access.useACMEHost != null);
         kTLS = mkDefault true;
@@ -91,7 +95,7 @@ in {
     };
   };
   config.networking.firewall = {
-    interfaces.local.allowedTCPPorts = [ access.managementPort ];
+    interfaces.local.allowedTCPPorts = [access.managementPort];
-    allowedTCPPorts = mkIf access.global.management [ access.managementPort ];
+    allowedTCPPorts = mkIf access.global.management [access.managementPort];
   };
 }

nixos/access/vouch.nix

@@ -35,8 +35,12 @@ in {
     access.vouch = mkIf cfg.enable {
       url = let
         inherit (cfg.settings.vouch) listen;
-        host = if listen == "0.0.0.0" || listen == "[::]" then "localhost" else listen;
+        host =
-      in mkOptionDefault "http://${host}:${toString cfg.port}";
+          if listen == "0.0.0.0" || listen == "[::]"
+          then "localhost"
+          else listen;
+      in
+        mkOptionDefault "http://${host}:${toString cfg.port}";
     };
     virtualHosts = let
       locations = {
@@ -46,15 +50,18 @@ in {
             proxy_redirect default;
           '';
         };
-        "/validate" = { config, ... }: {
+        "/validate" = {config, ...}: {
           proxyPass = mkDefault (access.url + "/validate");
           recommendedProxySettings = mkDefault false;
-          extraConfig = if config.local.trusted then ''
+          extraConfig =
+            if config.local.trusted
+            then ''
               if ($http_x_host = ''') {
                 set $http_x_host $host;
               }
               proxy_set_header Host $http_x_host;
-          '' else ''
+            ''
+            else ''
               proxy_set_header Host $host;
             '';
         };

nixos/access/zigbee2mqtt.nix

@@ -2,8 +2,7 @@
   config,
   lib,
   ...
-}:
+}: let
-let
   inherit (lib.options) mkOption;
   inherit (lib.modules) mkIf mkDefault mkOptionDefault;
   cfg = config.services.zigbee2mqtt;
@@ -46,7 +45,7 @@ in {
         locations."/" = location;
       };
       ${access.localDomain} = {
-        serverAliases = mkIf config.services.tailscale.enable [ access.tailDomain ];
+        serverAliases = mkIf config.services.tailscale.enable [access.tailDomain];
         local.enable = true;
         locations."/" = location;
       };

nixos/acme.nix

@@ -8,18 +8,30 @@
   inherit (lib.lists) head optional;
   cfg = config.security.acme;
   mkHash = with builtins; val: substring 0 20 (hashString "sha256" val);
-  mkAccountHash = { server ? null, keyType, email }: mkHash "${toString server} ${keyType} ${email}";
+  mkAccountHash = {
+    server ? null,
+    keyType,
+    email,
+  }:
+    mkHash "${toString server} ${keyType} ${email}";
   mkHost = server: head (splitString "/" (removePrefix "https://" server));
-  mkAccountDir = { server ? null, email, keyType }: concatStringsSep "/" ([
+  mkAccountDir = {
+    server ? null,
+    email,
+    keyType,
+  }:
+    concatStringsSep "/" ([
         accountDirRoot
-    (mkAccountHash { inherit server email keyType; })
+        (mkAccountHash {inherit server email keyType;})
-  ] ++ optional (server != null) (
+      ]
+      ++ optional (server != null) (
         mkHost server
-  ) ++ [
+      )
+      ++ [
         cfg.defaults.email
       ]);
   accountDirRoot = "/var/lib/acme/.lego/accounts";
-  addr = concatStringsSep "@" [ "gensokyo" "arcn.mx" ];
+  addr = concatStringsSep "@" ["gensokyo" "arcn.mx"];
 in {
   security.acme = {
     acceptTerms = true;
@@ -35,16 +47,19 @@ in {
     };
   };
   sops.secrets = let
-    accountDir = mkAccountDir { inherit (cfg.defaults) server email keyType; };
+    accountDir = mkAccountDir {inherit (cfg.defaults) server email keyType;};
     acmeSecret = {
       sopsFile = mkDefault ./secrets/acme.yaml;
       owner = "acme";
       group = "nginx";
     };
   in {
-    acme_account_key = mkMerge [ acmeSecret {
+    acme_account_key = mkMerge [
+      acmeSecret
+      {
         path = accountDir + "/keys/${cfg.defaults.email}.key";
-    } ];
+      }
+    ];
     acme_cloudflare_email = acmeSecret;
     acme_cloudflare_token = acmeSecret;
   };

nixos/avahi.nix

@@ -26,7 +26,7 @@ in {
     daemon = "avahi-daemon.service";
     avahi-daemon-watchdog = pkgs.writeShellScript "avahi-daemon-watchdog" ''
       set -eu
-      export PATH="$PATH:${makeBinPath [ config.systemd.package pkgs.coreutils pkgs.gnugrep ]}"
+      export PATH="$PATH:${makeBinPath [config.systemd.package pkgs.coreutils pkgs.gnugrep]}"
       while read -r line; do
         if [[ $line = *"Host name conflict"* ]]; then
           if systemctl is-active ${daemon} > /dev/null; then
@@ -38,14 +38,15 @@ in {
         fi
       done < <(journalctl -o cat -feu ${daemon} | grep -F 'Host name conflict, retrying with ')
     '';
-  in mkIf (cfg.enable && cfg.publish.enable) {
+  in
+    mkIf (cfg.enable && cfg.publish.enable) {
       avahi-daemon = {
         serviceConfig = {
           inherit RestartSec;
         };
       };
       avahi-daemon-watchdog = {
-      wantedBy = [ daemon ];
+        wantedBy = [daemon];
         serviceConfig = {
           Type = mkOptionDefault "exec";
           ExecStart = [

nixos/base/access.nix

@@ -28,8 +28,7 @@
 
   users.users.root = {
     hashedPassword = "$6$i28yOXoo$/WokLdKds5ZHtJHcuyGrH2WaDQQk/2Pj0xRGLgS8UcmY2oMv3fw2j/85PRpsJJwCB2GBRYRK5LlvdTleHd3mB.";
-    openssh.authorizedKeys.keys = with pkgs.lib;
+    openssh.authorizedKeys.keys = with pkgs.lib; (concatLists (mapAttrsToList
-      (concatLists (mapAttrsToList
       (name: user:
         if elem "wheel" user.extraGroups
         then user.openssh.authorizedKeys.keys

nixos/base/documentation.nix

@@ -1,3 +1,3 @@
-{ config, ... }: {
+{config, ...}: {
   documentation.nixos.enable = false;
 }

nixos/base/kitty.nix

@@ -1,5 +1,7 @@
-{ config, pkgs, ... }:
-
 {
-  environment.systemPackages = [ pkgs.buildPackages.buildPackages.kitty.terminfo ];
+  config,
+  pkgs,
+  ...
+}: {
+  environment.systemPackages = [pkgs.buildPackages.buildPackages.kitty.terminfo];
 }

nixos/base/nix.nix

@@ -1,4 +1,10 @@
-{ config, options, lib, inputs, ... }: let
+{
+  config,
+  options,
+  lib,
+  inputs,
+  ...
+}: let
   inherit (lib.modules) mkIf mkDefault;
   hasSops = options ? sops;
 in {
@@ -25,7 +31,8 @@ in {
         experimental-features = lib.optional (lib.versionAtLeast config.nix.package.version "2.4") "nix-command flakes";
         substituters = [
           "https://gensokyo-infrastructure.cachix.org"
-          "https://arc.cachix.org" "https://kittywitch.cachix.org"
+          "https://arc.cachix.org"
+          "https://kittywitch.cachix.org"
           "https://nix-community.cachix.org"
         ];
         trusted-public-keys = [
@@ -36,7 +43,7 @@ in {
           "ryantrinkle.com-1:JJiAKaRv9mWgpVAz8dwewnZe0AzzEAzPkagE9SP5NWI="
         ];
         auto-optimise-store = true;
-        trusted-users = [ "root" "@wheel" ];
+        trusted-users = ["root" "@wheel"];
       };
       extraOptions = mkIf hasSops ''
         !include ${config.sops.secrets.github-access-token-public.path}
@@ -47,7 +54,11 @@ in {
         options = mkDefault "--delete-older-than 7d";
       };
     };
-    ${if hasSops then "sops" else null}.secrets.github-access-token-public = {
+    ${
+      if hasSops
+      then "sops"
+      else null
+    }.secrets.github-access-token-public = {
       sopsFile = mkDefault ../secrets/nix.yaml;
       group = mkDefault "users";
       mode = mkDefault "0644";

nixos/base/nixpkgs.nix

@@ -1,7 +1,4 @@
-{
+{inputs, ...}: {
-  inputs,
-  ...
-}: {
   nixpkgs = {
     overlays = [
       inputs.arcexprs.overlays.default

nixos/base/packages.nix

@@ -1,11 +1,16 @@
-{ config, lib, pkgs, ... }:
-
 {
-  environment.systemPackages = with pkgs; [
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  environment.systemPackages = with pkgs;
+    [
       neofetch
       smartmontools
       hddtemp
       lm_sensors
       gnupg
-  ] ++ (lib.optional config.programs.gnupg.agent.enable pinentry-curses);
+    ]
+    ++ (lib.optional config.programs.gnupg.agent.enable pinentry-curses);
 }

nixos/base/shell.nix

@@ -1,6 +1,4 @@
-{ config, ... }:
+{config, ...}: {
-
-{
   programs.zsh = {
     enable = true;
     enableCompletion = true;

nixos/base/ssh.nix

@@ -29,7 +29,7 @@ in {
   };
   networking.firewall = {
     allowedTCPPorts = [publicPort];
-    interfaces.local.allowedTCPPorts = [ 22 ];
+    interfaces.local.allowedTCPPorts = [22];
   };
 
   programs.mosh.enable = true;

nixos/base/time.nix

@@ -1,3 +1,3 @@
-{ config, ... }: {
+{config, ...}: {
   services.tzupdate.enable = true;
 }

nixos/base/urxvt.nix

@@ -1,6 +1,4 @@
-{ pkgs, ... }:
+{pkgs, ...}: {
-
-{
   environment.systemPackages = [
     pkgs.buildPackages.rxvt-unicode-unwrapped.terminfo
   ];

nixos/bazarr.nix

@@ -1,12 +1,9 @@
-{
+{lib, ...}: let
-  lib,
-  ...
-}: let
   inherit (lib.modules) mkDefault;
 in {
   services.bazarr = {
     enable = mkDefault true;
     listenPort = mkDefault 6767;
   };
-  users.users.bazarr.extraGroups = [ "kyuuto" ];
+  users.users.bazarr.extraGroups = ["kyuuto"];
 }

nixos/ddclient.nix

@@ -14,26 +14,30 @@ in {
     protocol = mkDefault "cloudflare";
     zone = mkDefault config.networking.domain;
     use = "no";
-    domains = [ ];
+    domains = [];
-    extraConfig = mkMerge [ (mkIf config.networking.enableIPv6 ''
+    extraConfig = mkMerge [
+      (mkIf config.networking.enableIPv6 ''
         usev6=webv6, webv6=https://ipv6.nsupdate.info/myip
-    '') ''
+      '')
+      ''
         usev4=webv4, webv4=https://ipv4.nsupdate.info/myip
         max-interval=1d
-    '' ];
+      ''
+    ];
     passwordFile = config.sops.secrets.dyndns_cloudflare_token.path;
   };
   systemd.services.ddclient = mkIf cfg.enable rec {
-    wants = [ "network-online.target" ];
+    wants = ["network-online.target"];
     after = wants;
-    wantedBy = mkForce [ ];
+    wantedBy = mkForce [];
     serviceConfig = {
       ExecStartPre = let
         inherit (config.systemd.services.ddclient.serviceConfig) RuntimeDirectory;
         prestart-domains = pkgs.writeShellScript "ddclient-prestart-domains" ''
           cat ${config.sops.secrets.dyndns_ddclient_domains.path} >> /run/${RuntimeDirectory}/ddclient.conf
         '';
-      in mkAfter [ "!${prestart-domains}" ];
+      in
+        mkAfter ["!${prestart-domains}"];
       TimeoutStartSec = 90;
       LogFilterPatterns = [
         "~WARNING"

nixos/deluge.nix

@@ -42,28 +42,32 @@ in {
     parent = builtins.dirOf downloadDir;
     hasCompletedSubdir = completedDir != null && hasPrefix parent completedDir;
     completedSubdir = removePrefix parent completedDir;
-    download = if hasCompletedSubdir then {
+    download =
+      if hasCompletedSubdir
+      then {
         path = parent;
         subdirectories = [
           (builtins.baseNameOf downloadDir)
           completedSubdir
         ];
-    } else {
+      }
+      else {
         path = downloadDir;
       };
     completed = {
       path = cfg.config.move_completed_path;
     };
-  in mkIf cfg.enable (mkAfter [
+  in
+    mkIf cfg.enable (mkAfter [
       download
       (mkIf (completedDir != null && !hasCompletedSubdir) completed)
     ]);
   users.users = mkIf cfg.enable (mkMerge [
     {
-      deluge.extraGroups = [ "kyuuto" ];
+      deluge.extraGroups = ["kyuuto"];
     }
     (mkIf mediatomb.enable {
-      ${mediatomb.user}.extraGroups = [ cfg.group ];
+      ${mediatomb.user}.extraGroups = [cfg.group];
     })
   ]);
 }

nixos/github-runner/zone.nix

@@ -14,7 +14,9 @@
   genZoneAttrs = prefix: f: listToAttrs (genZone (i: nameValuePair "${prefix}${toString i}" (f i)));
 in {
   options.services.github-runner-zone = with lib.types; {
-    enable = mkEnableOption "github-runners.zone" // {
+    enable =
+      mkEnableOption "github-runners.zone"
+      // {
         default = true;
       };
     targetName = mkOption {
@@ -64,7 +66,7 @@ in {
         enable = mkDefault true;
         ephemeral = mkDefault cfg.ephemeral;
         replace = mkDefault true;
-        extraLabels = [ "ubuntu-latest" ];
+        extraLabels = ["ubuntu-latest"];
         tokenFile = mkDefault config.sops.secrets.github-runner-gensokyo-zone-token.path;
         url = mkDefault "https://github.com/gensokyo-zone";
         group = mkDefault cfg.group;
@@ -73,9 +75,9 @@ in {
         };
         networkNamespace.name = mkIf (cfg.networkNamespace.name != null) (mkDefault cfg.networkNamespace.name);
         serviceSettings = {
-          wantedBy = [ "${cfg.targetName}.target" ];
+          wantedBy = ["${cfg.targetName}.target"];
           unitConfig = {
-            StopPropagatedFrom = [ "${cfg.targetName}.target" ];
+            StopPropagatedFrom = ["${cfg.targetName}.target"];
           };
         };
         serviceOverrides = mkIf (!cfg.dynamicUser) {
@@ -88,7 +90,8 @@ in {
       };
     };
 
-    services.github-runners = genZoneAttrs cfg.keyPrefix (i: mkMerge [
+    services.github-runners = genZoneAttrs cfg.keyPrefix (i:
+      mkMerge [
         (unmerged.merge cfg.runnerSettings)
         {
           name = mkDefault "${cfg.namePrefix}${toString i}";
@@ -106,13 +109,13 @@ in {
         };
       };
       targets.${cfg.targetName} = {
-        wantedBy = [ "multi-user.target" ];
+        wantedBy = ["multi-user.target"];
       };
     };
 
     users = mkIf cfg.enable {
       groups = mkIf (cfg.group != null) {
-        ${toString cfg.group} = { };
+        ${toString cfg.group} = {};
       };
       users = mkMerge [
         (mkIf (!cfg.dynamicUser) (genZoneAttrs cfg.userPrefix (i: {

nixos/home-assistant.nix

@@ -85,7 +85,8 @@ in {
         ];
         entity_config = {};
       };
-      homekit = [ {
+      homekit = [
+        {
           name = "Tewi";
           port = 21063;
           filter = let
@@ -95,7 +96,8 @@ in {
             include_entities = "!include homekit_include_entities.yaml";
           };
           entity_config = "!include homekit_entity_config.yaml";
-      } ];
+        }
+      ];
       tts = [
         {
           platform = "google_translate";

nixos/invidious.nix

@@ -1,4 +1,8 @@
-{ config, lib, ... }: let
+{
+  config,
+  lib,
+  ...
+}: let
   inherit (lib.modules) mkIf mkDefault mkForce;
   cfg = config.services.invidious;
 in {
@@ -6,12 +10,13 @@ in {
     commonSecret = {
       sopsFile = ./secrets/invidious.yaml;
       owner = "invidious";
-    }; in {
+    };
+  in {
     invidious_db_password = commonSecret;
     invidious_hmac_key = commonSecret;
   };
 
-  networking.firewall.interfaces.local.allowedTCPPorts = [ cfg.port ];
+  networking.firewall.interfaces.local.allowedTCPPorts = [cfg.port];
   users.groups.invidious = {};
   users.users.invidious = {
     isSystemUser = true;

nixos/kyuuto/mount.nix

@@ -34,7 +34,7 @@ in {
     };
     gameLibraries = mkOption {
       type = listOf str;
-      default = [ "PC" ];
+      default = ["PC"];
     };
   };
 
@@ -42,10 +42,19 @@ in {
     kyuuto = {
       gameLibraries = [
         "PC"
-        "Wii" "Gamecube" "N64" "SNES" "NES"
+        "Wii"
-        "NDS" "GBA" "GBC"
+        "Gamecube"
-        "PS3" "PS2" "PS1"
+        "N64"
-        "PSVita" "PSP"
+        "SNES"
+        "NES"
+        "NDS"
+        "GBA"
+        "GBC"
+        "PS3"
+        "PS2"
+        "PS1"
+        "PSVita"
+        "PSP"
         "Genesis"
       ];
     };
@@ -74,7 +83,7 @@ in {
         {
           ${cfg.shareDir} = mkMerge [
             shared
-            { group = "peeps"; }
+            {group = "peeps";}
           ];
           ${cfg.transferDir} = shared;
           ${cfg.libraryDir} = shared;
@@ -108,14 +117,19 @@ in {
     };
 
     users = let
-      mapId = id: if config.proxmoxLXC.privileged or true then 100000 + id else id;
+      mapId = id:
+        if config.proxmoxLXC.privileged or true
+        then 100000 + id
+        else id;
       mkDummyUsers = {
         name,
         group ? name,
-        enable ? !config.services.${serviceName}.enable, serviceName ? name,
+        enable ? !config.services.${serviceName}.enable,
+        serviceName ? name,
         uid ? config.ids.uids.${name},
         gid ? config.ids.gids.${group},
-      }: mkIf enable {
+      }:
+        mkIf enable {
           users.${name} = {
             group = mkIf (group != null) group;
             uid = mapId uid;
@@ -125,11 +139,12 @@ in {
             gid = mapId gid;
           };
         };
-    in mkMerge [
+    in
-      (mkDummyUsers { name = "deluge"; })
+      mkMerge [
-      (mkDummyUsers { name = "radarr"; })
+        (mkDummyUsers {name = "deluge";})
-      (mkDummyUsers { name = "sonarr"; })
+        (mkDummyUsers {name = "radarr";})
-      (mkDummyUsers { name = "lidarr"; })
+        (mkDummyUsers {name = "sonarr";})
+        (mkDummyUsers {name = "lidarr";})
       ];
   };
 }

nixos/kyuuto/nfs.nix

@@ -1,4 +1,3 @@
-
 {
   config,
   lib,

nixos/kyuuto/opl.nix

@@ -10,7 +10,9 @@
   cfg = kyuuto.opl;
 in {
   options.kyuuto.opl = with lib.types; {
-    enable = mkEnableOption "hosting" // {
+    enable =
+      mkEnableOption "hosting"
+      // {
         default = config.services.samba.enable;
       };
     user = mkOption {
@@ -39,9 +41,12 @@ in {
       };
       shares.opl = let
         inherit (config.networking.access) cidrForNetwork;
-        localAddrs = cidrForNetwork.loopback.all ++ cidrForNetwork.local.all
+        localAddrs =
+          cidrForNetwork.loopback.all
+          ++ cidrForNetwork.local.all
           ++ lib.optionals config.services.tailscale.enable cidrForNetwork.tail.all;
-      in mkIf cfg.enable {
+      in
+        mkIf cfg.enable {
           comment = "Kyuuto Media OPL";
           path = cfg.rootDir;
           writeable = true;

nixos/kyuuto/samba.nix

@@ -1,4 +1,3 @@
-
 {
   config,
   lib,
@@ -9,15 +8,19 @@
   inherit (config.networking.access) cidrForNetwork;
   inherit (config) kyuuto;
   cfg = config.services.samba;
-  localAddrs = cidrForNetwork.loopback.all ++ cidrForNetwork.local.all
+  localAddrs =
+    cidrForNetwork.loopback.all
+    ++ cidrForNetwork.local.all
     ++ optionals config.services.tailscale.enable cidrForNetwork.tail.all;
-  guestUsers = mkIf cfg.guest.enable [ cfg.guest.user ];
+  guestUsers = mkIf cfg.guest.enable [cfg.guest.user];
   kyuuto-media = {
     "create mask" = "0664";
     "force directory mode" = "3000";
     "directory mask" = "7775";
   };
-  kyuuto-library = kyuuto-media // {
+  kyuuto-library =
+    kyuuto-media
+    // {
       "acl group control" = true;
     };
 in {
@@ -35,7 +38,7 @@ in {
         public = true;
         "valid users" = mkMerge [
           guestUsers
-          [ "@peeps" ]
+          ["@peeps"]
         ];
         #"guest only" = true;
         "hosts allow" = localAddrs;
@@ -54,10 +57,10 @@ in {
           public = true;
           "valid users" = mkMerge [
             guestUsers
-            [ "@kyuuto-peeps" ]
+            ["@kyuuto-peeps"]
           ];
           "read list" = guestUsers;
-          "write list" = [ "@kyuuto-peeps" ];
+          "write list" = ["@kyuuto-peeps"];
           "hosts allow" = localAddrs;
         }
       ];
@@ -69,7 +72,7 @@ in {
           writeable = true;
           public = false;
           browseable = false;
-          "valid users" = [ "@kyuuto-peeps" ];
+          "valid users" = ["@kyuuto-peeps"];
         }
       ];
       kyuuto-media = mkMerge [
@@ -80,7 +83,7 @@ in {
           writeable = true;
           public = false;
           browseable = false;
-          "valid users" = [ "@kyuuto-peeps" ];
+          "valid users" = ["@kyuuto-peeps"];
         }
       ];
       shared = {
@@ -89,7 +92,7 @@ in {
         writeable = true;
         public = false;
         browseable = false;
-        "valid users" = [ "@peeps" ];
+        "valid users" = ["@peeps"];
         "create mask" = "0775";
         "force create mode" = "0010";
         "force directory mode" = "2000";
@@ -99,7 +102,7 @@ in {
         writeable = true;
         browseable = true;
         public = false;
-        "valid users" = [ "@peeps" ];
+        "valid users" = ["@peeps"];
         "create mask" = "0664";
         "force directory mode" = "5000";
         "directory mask" = "7775";
@@ -108,5 +111,5 @@ in {
   };
 
   # give guest users proper access to the transfer share
-  users.users.guest.extraGroups = [ "kyuuto" ];
+  users.users.guest.extraGroups = ["kyuuto"];
 }

nixos/lidarr.nix

@@ -2,5 +2,5 @@ _: {
   services.lidarr = {
     enable = true;
   };
-  users.users.lidarr.extraGroups = [ "kyuuto" ];
+  users.users.lidarr.extraGroups = ["kyuuto"];
 }

nixos/mediatomb.nix

@@ -12,6 +12,6 @@ in {
     uuid = mkDefault "082fd344-bf69-5b72-a68f-a5a4d88e76b2";
   };
   config.users.users = mkIf cfg.enable {
-    ${cfg.user}.extraGroups = [ "kyuuto" ];
+    ${cfg.user}.extraGroups = ["kyuuto"];
   };
 }

nixos/nfs.nix

@@ -29,9 +29,9 @@ in {
     idmapd.settings = {
       General.Domain = mkDefault config.networking.domain;
       Translation.GSS-Methods = concatStringsSep "," (
-        [ "static" ]
+        ["static"]
         ++ optional enableLdap "umich_ldap"
-        ++ [ "nsswitch" ]
+        ++ ["nsswitch"]
       );
       Static = {
       };

nixos/ombi.nix

@@ -1,7 +1,4 @@
-{
+{lib, ...}: let
-  lib,
-  ...
-}: let
   inherit (lib.modules) mkDefault;
 in {
   services.ombi = {

nixos/plex.nix

@@ -1,4 +1,9 @@
-{config, lib, pkgs, ...}: let
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
   inherit (lib.modules) mkIf mkForce mkDefault;
   inherit (lib.strings) escapeShellArg;
   cfg = config.services.plex;
@@ -21,7 +26,8 @@ in {
           fi
           ${pkgs.coreutils}/bin/ln -sfT ../Cache "$PLEX_DATADIR/Plex Media Server/Cache"
         '';
-      in mkForce [
+      in
+        mkForce [
           ''!${preStartScript}''
         ];
       # KillMode = "mixed" doesn't behave as expected...

nixos/postgres.nix

@@ -8,7 +8,7 @@
 in {
   services.postgresql = {
     enable = mkDefault true;
-    ensureDatabases = ["hass" "invidious" "dex"];
+    ensureDatabases = ["hass" "invidious" "dex" "keycloak"];
     ensureUsers = [
       {
         name = "hass";
@@ -25,6 +25,11 @@ in {
         ensureDBOwnership = true;
         authentication.local.allow = true;
       }
+      {
+        name = "keycloak";
+        ensureDBOwnership = true;
+        authentication.local.allow = true;
+      }
     ];
   };
 

nixos/radarr.nix

@@ -3,5 +3,5 @@ _: {
     enable = true;
   };
 
-  users.users.radarr.extraGroups = [ "kyuuto" ];
+  users.users.radarr.extraGroups = ["kyuuto"];
 }

nixos/readarr.nix

@@ -2,5 +2,5 @@ _: {
   services.readarr = {
     enable = true;
   };
-  users.users.readarr.extraGroups = [ "kyuuto" ];
+  users.users.readarr.extraGroups = ["kyuuto"];
 }

nixos/reisen-ct/filesystem.nix

@@ -1,7 +1,4 @@
-{
+{lib, ...}: let
-  lib,
-  ...
-}: let
   inherit (lib) mkDefault;
 in {
   services.kanidm.serverSettings.db_fs_type = mkDefault "zfs";

nixos/samba.nix

@@ -7,7 +7,7 @@
   inherit (lib.lists) any;
   inherit (lib.strings) hasInfix concatMapStringsSep splitString;
   cfg = config.services.samba;
-  hasIpv4 = any (hasInfix ".") config.systemd.network.networks.eth0.address or [ ];
+  hasIpv4 = any (hasInfix ".") config.systemd.network.networks.eth0.address or [];
 in {
   services.samba = {
     enable = mkDefault true;

nixos/secrets/postgres.yaml

@@ -1,4 +1,4 @@
-postgresql-init: ENC[AES256_GCM,data:fW9g0WKVHTO9blqlEXLJejyQUqC3na/Xh6Il2GNfuX6c2LfRjfFSeour4qt2envtPO+WanGl+ueE1AMck5t02TjqrN4a6DsQpAIGFVE7L4ajp/13Gp308pY4Xu7OKHjkGpzVBATKgLDZkoU8yAkqKZCBEU3d4xegp8pgnsLSpb/LndKiITjhTe2IJOSkIJd9twSsra8JQWRYCW8WjZZ9YOe5nqtU+56b/zb0CxVhhln0jU/3e5s7pfblfou2TnvnFezswjNTIGftNU1wOaxSCA==,iv:hjKNZ4EbPpl5YIcaWJYLKJzxuOmMjL4AtfUeL4vm5QA=,tag:mYcu4cRUnZeLgeISfaxXPQ==,type:str]
+postgresql-init: ENC[AES256_GCM,data:lbkeMv6PZgB7tEl4VbIYX9VUAgJ6Kcj0jLNyyqxJJcVJPjo1lF2d/i5bFnU1/6aJ2T7ftMW4hefYgrnIMdKXxPPfrHftaEMhl9bfJIsuX2I1CXAasZOhpsmg9Wf2cvXuVYIlqTVssg+3EKW0ejCMdX6OfGdAXvBlio1DQs7YrUc+BjDiEuAUAaaYbz67EYY3dpYQixQGl/8G2w7S897uCXpc1oOh6vbGY4Nl+GGQ7B5xrrbYcdATwfGyYlZYSlIv8feDsLv7Rt+w3o4tTAxcz+8qZ7KZ6sIsu/nUoYeqoT9MJ8uRpWccXKcBVAFSEooUIHUEBA/QsGizAXBgzCnyLDvuv3DOquo2xeMg0kWM8zsF1f9YRyUKqQ==,iv:RKIvggRZlPocygabF0iKNBThBRFG5rlzrIvGjjt7s0o=,tag:U/XUDJs5J8lHB9BJ5/0fFA==,type:str]
 sops:
     shamir_threshold: 1
     kms: []
@@ -33,8 +33,8 @@ sops:
             a3l3bUx5NzdqUGd1TEpGY3UvQWt4TU0KB4MAjvI43FaOiGhWTkwPpeMMiAnX4v3L
             rLZDdc/vegF10FKTNJdxdq1E7ccMaV1KwjQkJoOJnWe6teKLjGOFkA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-02-19T03:46:45Z"
+    lastmodified: "2024-03-13T21:46:56Z"
-    mac: ENC[AES256_GCM,data:FMzWnFllHDpgIoDJIKS7aWpUSVNH0+ij0+AIzl3qtjeuzmUUluDtEes6yAR8g/Daq+nxiMRnsse0HfUqZeT0rVVEpqvQB4Wsoq+G9qj8mmEUrHJzjU5rSDWV8uf5F1BsZbvF13VBulh/RWsmWjps+z6vyJ7uM1QjS3hSF2k3hSM=,iv:tpH8XjoTtNzPOOIosObpsvOAzZO7ywK9xjow3xTOJqY=,tag:BTzezbH9zZDZBzy1x+AJ1w==,type:str]
+    mac: ENC[AES256_GCM,data:rEtRHX3PH1B+uoR82lDH3ACKHPbhxy+y7B9YgR6TzPSU4yIaTSqSK51eLJZoUtW6UTl6QDcTrsKDA8lGu9M/Ohfx8ayp6rkX63H/hkl0h6YaQmWDAQoNAAEWqfJ9r8O8tKKpE6qF/rw4c4KpuA5ONufOl9qj1KSgFzz0WHaKtWk=,iv:TUBAe62dmF6FAjZOPaxwzQjWL21TdWQG0YyuXJGgtk8=,tag:dewWivfnZO30Np2gajwLIw==,type:str]
     pgp:
         - created_at: "2024-01-19T19:08:55Z"
           enc: |-

nixos/sonarr.nix

@@ -2,5 +2,5 @@ _: {
   services.sonarr = {
     enable = true;
   };
-  users.users.sonarr.extraGroups = [ "kyuuto" ];
+  users.users.sonarr.extraGroups = ["kyuuto"];
 }

nixos/sops.nix

@@ -1,8 +1,13 @@
-{ lib, inputs,  ... }: with lib; {
+{
+  lib,
+  inputs,
+  ...
+}:
+with lib; {
   imports = [
     inputs.sops-nix.nixosModules.sops
   ];
   sops = {
-    age.sshKeyPaths = mkDefault [ "/etc/ssh/ssh_host_ed25519_key" ];
+    age.sshKeyPaths = mkDefault ["/etc/ssh/ssh_host_ed25519_key"];
   };
 }

nixos/steam/account-switch.nix

@@ -1,7 +1,4 @@
-{
+{lib, ...}: let
-  lib,
-  ...
-}: let
   inherit (lib.modules) mkDefault;
 in {
   services.steam.accountSwitch = {

nixos/steam/beatsaber.nix

@@ -1,15 +1,12 @@
-{
+{lib, ...}: let
-  lib,
-  ...
-}: let
   inherit (lib.modules) mkDefault;
 in {
   services.steam.beatsaber = {
     enable = mkDefault true;
     defaultVersion = mkDefault "1.29.0";
     versions = {
-      "1.29.0" = { };
+      "1.29.0" = {};
-      "1.34.2" = { };
+      "1.34.2" = {};
     };
   };
 }

nixos/syncthing-kat/syncthing.nix

@@ -1,4 +1,4 @@
-{ config, ... }: {
+{config, ...}: {
   services.syncthing = {
     enable = true;
     relay.enable = true;

nixos/systemd2mqtt.nix

@@ -10,7 +10,8 @@ in {
     enable = mkDefault true;
     user = mkDefault "root";
     mqtt = {
-      url = mkDefault (if config.services.mosquitto.enable
+      url = mkDefault (
+        if config.services.mosquitto.enable
         then "tcp://localhost:1883"
         else "tcp://mqtt.local.${config.networking.domain}:1883"
       );

nixos/tautulli.nix

@@ -1,4 +1,8 @@
-{config, lib, ...}: let
+{
+  config,
+  lib,
+  ...
+}: let
   inherit (lib.modules) mkIf mkDefault;
   cfg = config.services.tautulli;
 in {

nixos/users/arc.nix

@@ -1,22 +1,22 @@
-{ config, ... }:
+{config, ...}: {
-
+  users.users.arc = {name, ...}: {
-{
-  users.users.arc = { name, ... }: {
     uid = 8001;
     isNormalUser = true;
     autoSubUidGidRange = false;
     group = name;
     extraGroups = [
-      "users" "peeps"
+      "users"
+      "peeps"
       "kyuuto"
-      "steamaccount" "beatsaber"
+      "steamaccount"
+      "beatsaber"
       "wheel"
     ];
     openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ8Z6briIboxIdedPGObEWB6QEQkvxKvnMW/UVU9t/ac mew-pgp"
     ];
   };
-  users.groups.arc = { name, ... }: {
+  users.groups.arc = {name, ...}: {
     gid = config.users.users.${name}.uid;
   };
 }

nixos/users/connie.nix

@@ -1,17 +1,16 @@
-{ config, ... }:
+{config, ...}: {
-
+  users.users.connieallure = {name, ...}: {
-{
-  users.users.connieallure = { name, ... }: {
     uid = 8003;
     isNormalUser = true;
     autoSubUidGidRange = false;
     group = name;
     extraGroups = [
-      "users" "peeps"
+      "users"
+      "peeps"
       "kyuuto"
     ];
   };
-  users.groups.connieallure = { name, ... }: {
+  users.groups.connieallure = {name, ...}: {
     gid = config.users.users.${name}.uid;
   };
 }

nixos/users/kaosu.nix

@@ -1,18 +1,18 @@
-{ config, ... }:
+{config, ...}: {
-
+  users.users.kaosubaloo = {name, ...}: {
-{
-  users.users.kaosubaloo = { name, ... }: {
     uid = 8002;
     isNormalUser = true;
     autoSubUidGidRange = false;
     group = name;
     extraGroups = [
-      "users" "peeps"
+      "users"
+      "peeps"
       "kyuuto"
-      "steamaccount" "beatsaber"
+      "steamaccount"
+      "beatsaber"
     ];
   };
-  users.groups.kaosubaloo = { name, ... }: {
+  users.groups.kaosubaloo = {name, ...}: {
     gid = config.users.users.${name}.uid;
   };
 }

nixos/users/kat.nix

@@ -1,25 +1,25 @@
-{ config, ... }:
+{config, ...}: {
-
+  users.users.kat = {name, ...}: {
-{
-  users.users.kat = { name, ... }: {
     uid = 8000;
     isNormalUser = true;
     autoSubUidGidRange = false;
     group = name;
     extraGroups = [
-      "users" "peeps"
+      "users"
+      "peeps"
       "kyuuto"
-      "steamaccount" "beatsaber"
+      "steamaccount"
+      "beatsaber"
       "wheel"
     ];
     openssh.authorizedKeys.keys = [
       "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCocjQqiDIvzq+Qu3jkf7FXw5piwtvZ1Mihw9cVjdVcsra3U2c9WYtYrA3rS50N3p00oUqQm9z1KUrvHzdE+03ZCrvaGdrtYVsaeoCuuvw7qxTQRbItTAEsfRcZLQ5c1v/57HNYNEsjVrt8VukMPRXWgl+lmzh37dd9w45cCY1QPi+JXQQ/4i9Vc3aWSe4X6PHOEMSBHxepnxm5VNHm4PObGcVbjBf0OkunMeztd1YYA9sEPyEK3b8IHxDl34e5t6NDLCIDz0N/UgzCxSxoz+YJ0feQuZtud/YLkuQcMxW2dSGvnJ0nYy7SA5DkW1oqcy6CGDndHl5StOlJ1IF9aGh0gGkx5SRrV7HOGvapR60RphKrR5zQbFFka99kvSQgOZqSB3CGDEQGHv8dXKXIFlzX78jjWDOBT67vA/M9BK9FS2iNnBF5x6shJ9SU5IK4ySxq8qvN7Us8emkN3pyO8yqgsSOzzJT1JmWUAx0tZWG/BwKcFBHfceAPQl6pwxx28TM3BTBRYdzPJLTkAy48y6iXW6UYdfAPlShy79IYjQtEThTuIiEzdzgYdros0x3PDniuAP0KOKMgbikr0gRa6zahPjf0qqBnHeLB6nHAfaVzI0aNbhOg2bdOueE1FX0x48sjKqjOpjlIfq4WeZp9REr2YHEsoLFOBfgId5P3BPtpBQ== yubikey5"
-"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDPsu3vNsvBb/G+wALpstD/DnoRZ3fipAs00jtl8rzDuv96RlS7AJr4aNvG6Pt2D9SYn2wVLaiw+76mz2gOycH9/N+VCvL4/0MN9uqj+7XIcxNRo0gHVOblmi2bOXcmGKh3eRwHj1xyDwRxo9WIuBEP2bPpDPz75OXRtEdlTgvky7siSguQxJu03cb0p9hNAYhUoohNXyWW2CjDCLUQVE1+QRVUzsKq3KkPy0cHYgmZC1gRSMQyKpMt72L5tayLz3Tp/zrshucc+QO5IJeZdqMxsNAcvALsysT1J5EqxZoYH9VpWLRhSgVD6Nvn853pycJAlXQxgOCpSD3/v/JbgUe5NE+ci0o7NMy5IiHUv2gQMRIEhwBHlRGwokUPL9upx0lsjaEiPya5xQqqDKRom87xytM778ANS5CuMdQMWg9qVbpHZUHMjA0QmNkjPgq71pUDXHk5L4mZuS8wVjyjnvlw68yIJuHEc8P7QiLcjvRHFS2L9Ck8NRmPDTQXlQi9kk6LmMyu6fdevR/kZL21b+xO1e2DMyxBbNDTot8luppiiL8adgUDMwptpIne7JCWB1o9NFCbXUVgwuCCYBif6pOGSc6bGo1JTAKMflRlcy6Mi3t5H0mR2lj/sCSTWwTlP5FM4aPIq08NvW6PeuK1bFJY9fIgTwVsUnbAKOhmsMt62w== cardno:12 078 454"
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDPsu3vNsvBb/G+wALpstD/DnoRZ3fipAs00jtl8rzDuv96RlS7AJr4aNvG6Pt2D9SYn2wVLaiw+76mz2gOycH9/N+VCvL4/0MN9uqj+7XIcxNRo0gHVOblmi2bOXcmGKh3eRwHj1xyDwRxo9WIuBEP2bPpDPz75OXRtEdlTgvky7siSguQxJu03cb0p9hNAYhUoohNXyWW2CjDCLUQVE1+QRVUzsKq3KkPy0cHYgmZC1gRSMQyKpMt72L5tayLz3Tp/zrshucc+QO5IJeZdqMxsNAcvALsysT1J5EqxZoYH9VpWLRhSgVD6Nvn853pycJAlXQxgOCpSD3/v/JbgUe5NE+ci0o7NMy5IiHUv2gQMRIEhwBHlRGwokUPL9upx0lsjaEiPya5xQqqDKRom87xytM778ANS5CuMdQMWg9qVbpHZUHMjA0QmNkjPgq71pUDXHk5L4mZuS8wVjyjnvlw68yIJuHEc8P7QiLcjvRHFS2L9Ck8NRmPDTQXlQi9kk6LmMyu6fdevR/kZL21b+xO1e2DMyxBbNDTot8luppiiL8adgUDMwptpIne7JCWB1o9NFCbXUVgwuCCYBif6pOGSc6bGo1JTAKMflRlcy6Mi3t5H0mR2lj/sCSTWwTlP5FM4aPIq08NvW6PeuK1bFJY9fIgTwVsUnbAKOhmsMt62w== cardno:12 078 454"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII74JrgGsDQ6r7tD7+k3ykxXV7DpeeFRscPMxrBsDPhz kat@goliath"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDkeBFF4xxZgeURLzNHcvUFxImmkQ3pxXtpj3mtSyHXB kat@koishi"
     ];
   };
-  users.groups.kat = { name, ... }: {
+  users.groups.kat = {name, ...}: {
     gid = config.users.users.${name}.uid;
   };
 }

overlays/default.nix

@@ -1,8 +1,10 @@
-{inputs, system}: {
+{
+  inputs,
+  system,
+}: {
   pkgs = import inputs.nixpkgs {
     inherit system;
-    overlays =
+    overlays = [
-      [
       inputs.deploy-rs.overlay
       inputs.arcexprs.overlays.default
       (final: prev: {

packages/default.nix

@@ -12,7 +12,7 @@
     export NF_CONFIG_ROOT=''${NF_CONFIG_ROOT-${toString ../.}}
   '';
   exportsSsh = ''
-    export PATH="${makeBinPath [ packages.nf-hostname packages.nf-sshopts ]}:$PATH"
+    export PATH="${makeBinPath [packages.nf-hostname packages.nf-sshopts]}:$PATH"
   '';
   exportsFmtNix = ''
     NF_NIX_BLACKLIST_DIRS=(${string.concatMapSep " " string.escapeShellArg fmt.nix.blacklistDirs})
@@ -20,10 +20,15 @@
     NF_NIX_WHITELIST_FILES=(${string.concatMapSep " " string.escapeShellArg fmt.nix.whitelist})
   '';
   output = {
-    inherit (pkgs.buildPackages)
+    inherit
-      terraform tflint
+      (pkgs.buildPackages)
-      alejandra deadnix statix
+      terraform
-      ssh-to-age jq
+      tflint
+      alejandra
+      deadnix
+      statix
+      ssh-to-age
+      jq
       ;
     inherit (inputs.deploy-rs.packages.${system}) deploy-rs;
     nf-deploy = pkgs.writeShellScriptBin "nf-deploy" ''
@@ -52,7 +57,8 @@
         INPUT_INFRA_CT_CONFIG = reisen + "/bin/ct-config.sh";
       };
       inputVars = set.mapToValues (key: path: ''${key}="$(base64 -w0 < ${path})"'') inputAttrs;
-    in pkgs.writeShellScriptBin "nf-setup-node" ''
+    in
+      pkgs.writeShellScriptBin "nf-setup-node" ''
         ${exports}
         NF_SETUP_INPUTS=(
           ${string.intercalate "\n" inputVars}
@@ -65,13 +71,13 @@
     '';
     nf-sshopts = pkgs.writeShellScriptBin "nf-sshopts" ''
       ${exports}
-      export PATH="$PATH:${makeBinPath [ pkgs.jq ]}"
+      export PATH="$PATH:${makeBinPath [pkgs.jq]}"
       source ${../ci/sshopts.sh}
     '';
     nf-sops-keyscan = pkgs.writeShellScriptBin "nf-sops-keyscan" ''
       ${exports}
       ${exportsSsh}
-      export PATH="$PATH:${makeBinPath [ pkgs.ssh-to-age ]}"
+      export PATH="$PATH:${makeBinPath [pkgs.ssh-to-age]}"
       source ${../ci/sops-keyscan.sh}
     '';
     nf-ssh = pkgs.writeShellScriptBin "nf-ssh" ''
@@ -94,39 +100,39 @@
     '';
     nf-generate = pkgs.writeShellScriptBin "nf-generate" ''
       ${exports}
-      export PATH="$PATH:${makeBinPath [ pkgs.jq ]}"
+      export PATH="$PATH:${makeBinPath [pkgs.jq]}"
       source ${../ci/generate.sh}
     '';
     nf-statix = pkgs.writeShellScriptBin "nf-statix" ''
       ${exports}
-      export PATH="${makeBinPath [ packages.statix ]}:$PATH"
+      export PATH="${makeBinPath [packages.statix]}:$PATH"
       source ${../ci/statix.sh}
     '';
     nf-deadnix = pkgs.writeShellScriptBin "nf-deadnix" ''
       ${exports}
       ${exportsFmtNix}
-      export PATH="${makeBinPath [ packages.deadnix pkgs.findutils ]}:$PATH"
+      export PATH="${makeBinPath [packages.deadnix pkgs.findutils]}:$PATH"
       source ${../ci/deadnix.sh}
     '';
     nf-alejandra = pkgs.writeShellScriptBin "nf-alejandra" ''
       ${exports}
       ${exportsFmtNix}
-      export PATH="${makeBinPath [ packages.alejandra ]}:$PATH"
+      export PATH="${makeBinPath [packages.alejandra]}:$PATH"
       source ${../ci/alejandra.sh}
     '';
     nf-lint-tf = pkgs.writeShellScriptBin "nf-lint-tf" ''
       ${exports}
-      export PATH="$PATH:${makeBinPath [ packages.tflint ]}"
+      export PATH="$PATH:${makeBinPath [packages.tflint]}"
       source ${../ci/lint-tf.sh}
     '';
     nf-lint-nix = pkgs.writeShellScriptBin "nf-lint-nix" ''
       ${exports}
-      export PATH="${makeBinPath [ packages.nf-statix packages.nf-deadnix ]}:$PATH"
+      export PATH="${makeBinPath [packages.nf-statix packages.nf-deadnix]}:$PATH"
       source ${../ci/lint-nix.sh}
     '';
     nf-fmt-tf = pkgs.writeShellScriptBin "nf-fmt-tf" ''
       ${exports}
-      export PATH="${makeBinPath [ packages.terraform ]}:$PATH"
+      export PATH="${makeBinPath [packages.terraform]}:$PATH"
       source ${../ci/fmt-tf.sh}
     '';
     nf-fmt-nix = pkgs.writeShellScriptBin "nf-fmt-nix" ''
@@ -144,4 +150,5 @@
       inherit (inputs) self;
     };
   };
-in output
+in
+  output

packages/snakeoil.nix

@@ -5,12 +5,17 @@
 }: let
   inherit (lib.strings) concatStringsSep;
   inherit (lib.lists) toList head;
-in { domain, name }: runCommand name {
+in
+  {
+    domain,
+    name,
+  }:
+    runCommand name {
       domains = concatStringsSep "," (toList domain);
       domain = head (toList domain);
-  nativeBuildInputs = [ buildPackages.minica ];
+      nativeBuildInputs = [buildPackages.minica];
-  outputs = [ "out" "key" "cakey" "ca" "cert" "fullchain" ];
+      outputs = ["out" "key" "cakey" "ca" "cert" "fullchain"];
-} ''
+    } ''
       install -d $out
       minica \
         --ca-key ca.key.pem \
@@ -27,4 +32,4 @@ in { domain, name }: runCommand name {
       ln -s $cakey $out/ca.key.pem
       ln -s $cert $out/cert.pem
       ln -s $ca $out/ca.pem
-''
+    ''