style: alejandra $(fd -e nix)

2026-02-09 04:19:19 -08:00 · 2024-03-13 15:08:42 -07:00 · 2024-03-13 15:08:42 -07:00 · e63304937d
commit e63304937d
parent 97d9eecd3c
91 changed files with 1422 additions and 1102 deletions
--- a/.gitignore
+++ b/.gitignore
@ -6,3 +6,4 @@
 .terraform
 .DS_Store
 .envrc.conf
+.idea
--- a/ci/flake-cron.nix
+++ b/ci/flake-cron.nix
@ -45,7 +45,7 @@ in {
          cron = "0 0 * * *";
        }
      ];
-      workflow_dispatch = { };
+      workflow_dispatch = {};
    };
  };

@ -65,7 +65,7 @@ in {
        displayName = "flake update build";
        environment = ["CACHIX_SIGNING_KEY" "GITHUB_REF"];
        command = let
-          filteredHosts = [ "hakurei" "reimu" "aya" "tei" "litterbox" "mediabox" ];
+          filteredHosts = ["hakurei" "reimu" "aya" "tei" "litterbox" "mediabox"];
          gcBetweenHosts = false;
          nodeBuildString = concatMapStringsSep " && " (node: "nix build --show-trace -Lf . nixosConfigurations.${node}.config.system.build.toplevel -o result-${node}" + optionalString gcBetweenHosts " && nix-collect-garbage -d") filteredHosts;
          hostPath = builtins.getEnv "PATH";
--- a/docs/derivation.nix
+++ b/docs/derivation.nix
@ -12,17 +12,19 @@
      (hasSuffix ".adoc" path || baseNameOf path == "docinfo.html")
      || type == "directory";
  };
-in stdenvNoCC.mkDerivation {
+in
+  stdenvNoCC.mkDerivation {
    pname = "genso-docs";
    version = "dev";
    inherit src;

    ASCIIDOCTOR_OPTS = [
-    "-a" "docinfo=shared"
+      "-a"
+      "docinfo=shared"
    ];

-  nativeBuildInputs = [ asciidoctor ];
-  passAsFile = [ "buildCommand" ];
+    nativeBuildInputs = [asciidoctor];
+    passAsFile = ["buildCommand"];
    buildCommand = ''
      install -d "$out"
      ASCIIDOCTOR_SRCS=(
@ -34,4 +36,4 @@ in stdenvNoCC.mkDerivation {
        -a inc="$src/_inc/" \
        -b html -R "$src" -D "$out" "''${ASCIIDOCTOR_SRCS[@]}"
    '';
-}
+  }
--- a/generate.nix
+++ b/generate.nix
@ -10,16 +10,15 @@
  templateUsers = filterAttrs (_: userIs "peeps") templateSystem.config.users.users;
  mkNodeUsers = users: let
    nodeUsers = mapAttrsToList (_: mkNodeUser) templateUsers;
-  in sortOn (user: user.uid) nodeUsers;
+  in
+    sortOn (user: user.uid) nodeUsers;
  mkNodeUser = user: {
    inherit (user) name uid;
    authorizedKeys = user.openssh.authorizedKeys.keys;
  };
-  mkNode = {
-    name,
-  }: {
+  mkNode = {name}: {
    users = mkNodeUsers templateUsers;
  };
 in {
-  reisen = mkNode { name = "reisen"; };
+  reisen = mkNode {name = "reisen";};
 }
--- a/modules/nixos/access.nix
+++ b/modules/nixos/access.nix
@ -11,7 +11,7 @@
  inherit (config.services) tailscale;
  inherit (config) networking;
  cfg = config.networking.access;
-  cidrModule = { config, ... }: {
+  cidrModule = {config, ...}: {
    options = with lib.types; {
      all = mkOption {
        type = listOf str;
@ -19,11 +19,11 @@
      };
      v4 = mkOption {
        type = listOf str;
-        default = [ ];
+        default = [];
      };
      v6 = mkOption {
        type = listOf str;
-        default = [ ];
+        default = [];
      };
    };
    config.all = mkOptionDefault (
@ -35,10 +35,12 @@ in {
  options.networking.access = with lib.types; {
    cidrForNetwork = mkOption {
      type = attrsOf (submodule cidrModule);
-      default = { };
+      default = {};
    };
    localaddrs = {
-      enable = mkEnableOption "localaddrs" // {
+      enable =
+        mkEnableOption "localaddrs"
+        // {
          default = networking.firewall.interfaces.local.nftables.enable;
        };
      stateDir = mkOption {
@ -88,7 +90,8 @@ in {
    localaddrs = {
      nftablesInclude = mkBefore (''
          define localrange6 = 2001:568::/29
-      '' + optionalString cfg.localaddrs.enable ''
+        ''
+        + optionalString cfg.localaddrs.enable ''
          include "${cfg.localaddrs.stateDir}/*.nft"
        '');
      reloadScript = let
@ -101,7 +104,7 @@ in {
    };
    moduleArgAttrs = {
      inherit (cfg) cidrForNetwork localaddrs;
-      mkSnakeOil = pkgs.callPackage ../../packages/snakeoil.nix { };
+      mkSnakeOil = pkgs.callPackage ../../packages/snakeoil.nix {};
    };
  };

@ -111,7 +114,8 @@ in {
      interfaces.local = {
        nftables.conditions = [
          "ip saddr { ${concatStringsSep ", " cfg.cidrForNetwork.local.v4} }"
-          (mkIf networking.enableIPv6
+          (
+            mkIf networking.enableIPv6
            "ip6 saddr { $localrange6, ${concatStringsSep ", " cfg.cidrForNetwork.local.v6} }"
          )
        ];
@ -169,12 +173,12 @@ in {
  in {
    localaddrs = mkIf cfg.localaddrs.enable {
      unitConfig = {
-        After = [ "network-online.target" ];
+        After = ["network-online.target"];
      };
      serviceConfig = rec {
        StateDirectory = "localaddrs";
        ExecStart = mkMerge [
-          [ "${localaddrs}" ]
+          ["${localaddrs}"]
          (mkIf networking.nftables.enable (mkAfter [
            "${localaddrs-nftables}"
          ]))
@ -188,7 +192,7 @@ in {
      };
    };
    nftables = mkIf (networking.nftables.enable && cfg.localaddrs.enable) rec {
-      wants = [ "localaddrs.service" ];
+      wants = ["localaddrs.service"];
      serviceConfig = {
        ExecReload = mkBefore [
          "+${cfg.localaddrs.reloadScript}"
@ -196,7 +200,7 @@ in {
      };
    };
    nginx = mkIf (config.services.nginx.enable && cfg.localaddrs.enable) rec {
-      wants = [ "localaddrs.service" ];
+      wants = ["localaddrs.service"];
      after = wants;
      serviceConfig = {
        ExecReload = mkBefore [
--- a/modules/nixos/cloudflared.nix
+++ b/modules/nixos/cloudflared.nix
@ -1,48 +1,62 @@
-{ pkgs, config, utils, lib, ... }: let
+{
+  pkgs,
+  config,
+  utils,
+  lib,
+  ...
+}: let
  inherit (lib.attrsets) mapAttrsToList mapAttrs' nameValuePair filterAttrsRecursive;
  inherit (lib.lists) singleton;
  inherit (lib.modules) mkIf mkMerge mkForce;
  inherit (lib.options) mkOption mkEnableOption;
  cfg = config.services.cloudflared;
-  settingsFormat = pkgs.formats.json { };
+  settingsFormat = pkgs.formats.json {};
 in {
  options.services.cloudflared = with lib.types; {
    tunnels = let
-      tunnelModule = { config, ... }: {
+      tunnelModule = {config, ...}: {
        options = {
          extraTunnel = {
-            enable = mkEnableOption "extra tunnels" // {
-              default = config.extraTunnel.ingress != { };
+            enable =
+              mkEnableOption "extra tunnels"
+              // {
+                default = config.extraTunnel.ingress != {};
              };
            ingress = mkOption {
              inherit (settingsFormat) type;
-              default = { };
+              default = {};
            };
          };
        };
      };
-    in mkOption {
+    in
+      mkOption {
        type = attrsOf (submodule tunnelModule);
      };
  };
  config.systemd.services = let
-    filterConfig = filterAttrsRecursive (_: v: ! builtins.elem v [ null [ ] { } ]);
-    mapIngress = hostname: ingress: {
+    filterConfig = filterAttrsRecursive (_: v: ! builtins.elem v [null [] {}]);
+    mapIngress = hostname: ingress:
+      {
        inherit hostname;
-    } // filterConfig (filterConfig ingress);
-  in mkIf cfg.enable (mapAttrs' (uuid: tunnel: let
+      }
+      // filterConfig (filterConfig ingress);
+  in
+    mkIf cfg.enable (mapAttrs' (uuid: tunnel: let
      RuntimeDirectory = "cloudflared-tunnel-${uuid}";
      configPath = "/run/${RuntimeDirectory}/config.yml";
      settings = {
        tunnel = uuid;
        credentials-file = tunnel.credentialsFile;
-      ingress = mapAttrsToList mapIngress tunnel.ingress
+        ingress =
+          mapAttrsToList mapIngress tunnel.ingress
          ++ mapAttrsToList mapIngress tunnel.extraTunnel.ingress
-      ++ singleton { service = tunnel.default; };
+          ++ singleton {service = tunnel.default;};
      };
-  in nameValuePair "cloudflared-tunnel-${uuid}" (mkMerge [
+    in
+      nameValuePair "cloudflared-tunnel-${uuid}" (mkMerge [
        {
-      after = mkIf config.services.tailscale.enable [ "tailscale-autoconnect.service" ];
+          after = mkIf config.services.tailscale.enable ["tailscale-autoconnect.service"];
          serviceConfig = {
            RestartSec = 10;
          };
@ -60,5 +74,6 @@ in {
            ];
          };
        })
-  ])) cfg.tunnels);
+      ]))
+    cfg.tunnels);
 }
--- a/modules/nixos/github-runner.nix
+++ b/modules/nixos/github-runner.nix
@ -11,7 +11,7 @@
  cfg = config.services.github-runners;
  nixosConfig = config;
  enabledRunners = filterAttrs (_: runner: runner.enable) cfg;
-  runnerModule = { config, ... }: {
+  runnerModule = {config, ...}: {
    options = with lib.types; {
      networkNamespace.name = mkOption {
        type = nullOr str;
@ -19,7 +19,7 @@
      };
      serviceSettings = mkOption {
        type = unmerged.type;
-        default = { };
+        default = {};
      };
    };
    config = {
@ -58,8 +58,10 @@ in {
    };
  };
  config = {
-    systemd.services = mapAttrs' (name: runner: nameValuePair "github-runner-${name}" (
+    systemd.services = mapAttrs' (name: runner:
+      nameValuePair "github-runner-${name}" (
        unmerged.merge runner.serviceSettings
-    )) enabledRunners;
+      ))
+    enabledRunners;
  };
 }
--- a/modules/nixos/home-assistant.nix
+++ b/modules/nixos/home-assistant.nix
@ -17,27 +17,41 @@ in {
      default = config.networking.domain;
    };
    homekit = {
-      enable = mkEnableOption "homekit" // {
-        default = cfg.config.homekit or [ ] != [ ];
+      enable =
+        mkEnableOption "homekit"
+        // {
+          default = cfg.config.homekit or [] != [];
        };
-      openFirewall = mkEnableOption "homekit ports" // {
+      openFirewall =
+        mkEnableOption "homekit ports"
+        // {
          default = cfg.openFirewall;
        };
    };
-    googleAssistant.enable = mkEnableOption "Google Assistant" // {
-      default = cfg.config.google_assistant or { } != { };
+    googleAssistant.enable =
+      mkEnableOption "Google Assistant"
+      // {
+        default = cfg.config.google_assistant or {} != {};
      };
-    androidTv.enable = mkEnableOption "Android TV" // {
+    androidTv.enable =
+      mkEnableOption "Android TV"
+      // {
        default = elem "androidtv" cfg.extraComponents;
      };
-    brother.enable = mkEnableOption "brother" // {
+    brother.enable =
+      mkEnableOption "brother"
+      // {
        default = elem "brother" cfg.extraComponents;
      };
    cast = {
-      enable = mkEnableOption "Chromecast" // {
+      enable =
+        mkEnableOption "Chromecast"
+        // {
          default = elem "cast" cfg.extraComponents;
        };
-      openFirewall = mkEnableOption "Chromecast ports" // {
+      openFirewall =
+        mkEnableOption "Chromecast ports"
+        // {
          default = cfg.openFirewall;
        };
    };
@ -50,7 +64,7 @@ in {
  config = {
    networking.firewall = let
      homekitTcp = mkIf cfg.homekit.enable (
-        map ({ port, ... }: port) cfg.config.homekit or [ ]
+        map ({port, ...}: port) cfg.config.homekit or []
      );

      castUdpRanges = mkIf cfg.cast.enable [
@ -59,7 +73,8 @@ in {
          to = 60999;
        }
      ];
-    in mkIf cfg.enable {
+    in
+      mkIf cfg.enable {
        interfaces.local = {
          allowedTCPPorts = mkIf (!cfg.homekit.openFirewall) homekitTcp;
          allowedUDPPortRanges = mkIf (!cfg.cast.openFirewall) castUdpRanges;
@ -72,8 +87,9 @@ in {
    services.avahi = mkIf (cfg.enable && cfg.homekit.enable) {
      enable = mkDefault true;
      publish.enable = let
-        homekitNames = map (homekit: toLower homekit.name) cfg.config.homekit or [ ];
-      in mkIf (elem config.networking.hostName homekitNames) false;
+        homekitNames = map (homekit: toLower homekit.name) cfg.config.homekit or [];
+      in
+        mkIf (elem config.networking.hostName homekitNames) false;
    };

    systemd.services.home-assistant = mkIf (cfg.enable && cfg.mutableUiConfig) {
@ -101,7 +117,8 @@ in {
          use_x_forwarded_for = "true";
          trusted_proxies = let
            inherit (config.networking.access) cidrForNetwork;
-          in cidrForNetwork.loopback.all
+          in
+            cidrForNetwork.loopback.all
            ++ cidrForNetwork.local.all
            ++ optionals config.services.tailscale.enable cidrForNetwork.tail.all
            ++ [
@ -157,30 +174,40 @@ in {
    package = let
      inherit (cfg.package) python;
      # https://github.com/pysnmp/pysnmp/issues/51
-      needsPyasn1pin = if lib.versionOlder python.pkgs.pysnmplib.version "6.0"
+      needsPyasn1pin =
+        if lib.versionOlder python.pkgs.pysnmplib.version "6.0"
        then true
        else lib.warn "pyasn1 pin likely no longer needed" false;
      pyasn1prefix = "${python.pkgs.pysnmp-pyasn1}/${python.sitePackages}";
      home-assistant = pkgs.home-assistant.override {
        packageOverrides = self: super: {
          brother = super.brother.overridePythonAttrs (old: {
-            dontCheckRuntimeDeps = if old.dontCheckRuntimeDeps or false
+            dontCheckRuntimeDeps =
+              if old.dontCheckRuntimeDeps or false
              then lib.warn "brother override no longer needed" true
              else true;
          });
          mpd2 = super.mpd2.overridePythonAttrs (old: {
-            patches = old.patches or [ ] ++ [
+            patches =
+              old.patches
+              or []
+              ++ [
                ../../packages/mpd2-skip-flaky-test.patch
              ];
-            disabledTests = unique (old.disabledTests or [ ] ++ [
+            disabledTests = unique (old.disabledTests
+              or []
+              ++ [
                "test_idle_timeout"
              ]);
          });
        };
      };
-    in home-assistant.overrideAttrs (old: {
+    in
+      home-assistant.overrideAttrs (old: {
        makeWrapperArgs = old.makeWrapperArgs ++ optional (cfg.brother.enable && needsPyasn1pin) "--prefix PYTHONPATH : ${pyasn1prefix}";
-      disabledTests = unique (old.disabledTests or [ ] ++ [
+        disabledTests = unique (old.disabledTests
+          or []
+          ++ [
            "test_check_config"
          ]);
      });
@ -189,14 +216,18 @@ in {
      inherit (lib.lists) head;
      inherit (lib.attrsets) attrNames filterAttrs;
      inherit (config.systemd.services.home-assistant.serviceConfig) ExecStart;
-      isHassDrv = drv: context: hasSuffix "-${cfg.package.name}.drv" drv && context.outputs or [ ] == [ "out" ];
+      isHassDrv = drv: context: hasSuffix "-${cfg.package.name}.drv" drv && context.outputs or [] == ["out"];
      drvs = filterAttrs isHassDrv (builtins.getContext ExecStart);
      isImpure = builtins ? currentSystem;
-    in mkIf cfg.enable (mkOptionDefault (
-      if isImpure then import (head (attrNames drvs))
+    in
+      mkIf cfg.enable (mkOptionDefault (
+        if isImpure
+        then import (head (attrNames drvs))
        else removeSuffix "/bin/hass" (head (splitString " " ExecStart))
      ));
-    extraPackages = python3Packages: with python3Packages; mkMerge [
+    extraPackages = python3Packages:
+      with python3Packages;
+        mkMerge [
          [
            psycopg2
            securetar
@ -232,8 +263,8 @@ in {
        "google_assistant"
        "google_cloud"
      ])
-      (map ({ platform, ... }: platform) cfg.config.media_player or [ ])
-      (map ({ platform, ... }: platform) cfg.config.tts or [ ])
+      (map ({platform, ...}: platform) cfg.config.media_player or [])
+      (map ({platform, ...}: platform) cfg.config.tts or [])
    ];
  };
 }
--- a/modules/nixos/jackett.nix
+++ b/modules/nixos/jackett.nix
@ -1,7 +1,4 @@
-{
-  lib,
-  ...
-}: let
+{lib, ...}: let
  inherit (lib.options) mkOption;
 in {
  options.services.jackett = with lib.types; {
--- a/modules/nixos/kanidm.nix
+++ b/modules/nixos/kanidm.nix
@ -60,13 +60,14 @@ in {

    services.kanidm = {
      server.unencrypted = {
-        domain = mkBefore [ cfg.server.frontend.domain ];
+        domain = mkBefore [cfg.server.frontend.domain];
        package = let
          cert = mkSnakeOil {
            name = "kanidm-cert";
            inherit (cfg.server.unencrypted) domain;
          };
-        in mkOptionDefault cert;
+        in
+          mkOptionDefault cert;
      };
      clientSettings = mkIf cfg.enableServer {
        uri = mkDefault cfg.serverSettings.origin;
--- a/modules/nixos/lidarr.nix
+++ b/modules/nixos/lidarr.nix
@ -1,7 +1,4 @@
-{
-  lib,
-  ...
-}: let
+{lib, ...}: let
  inherit (lib.options) mkOption;
 in {
  options.services.lidarr = with lib.types; {
--- a/modules/nixos/mediatomb.nix
+++ b/modules/nixos/mediatomb.nix
@ -8,7 +8,7 @@
  inherit (lib.modules) mkIf mkMerge mkDefault mkOptionDefault;
  inherit (lib.lists) singleton;
  cfg = config.services.mediatomb;
-  mediaDirModule = { config, ... }: {
+  mediaDirModule = {config, ...}: {
    options = with lib.types; {
      mountPoint = mkOption {
        type = nullOr str;
@ -26,14 +26,21 @@
      paths = let
        paths = map (path: "${config.path}/${path}") config.subdirectories;
        path = singleton config.path;
-      in mkOptionDefault (if config.subdirectories != null then paths else path);
+      in
+        mkOptionDefault (
+          if config.subdirectories != null
+          then paths
+          else path
+        );
      recursive = mkDefault true;
      hidden-files = mkDefault false;
    };
  };
 in {
  options.services.mediatomb = with lib.types; {
-    confine = mkEnableOption "containment" // {
+    confine =
+      mkEnableOption "containment"
+      // {
        default = true;
      };
    mediaDirectories = mkOption {
@ -47,9 +54,13 @@ in {
  };
  config.systemd.services.mediatomb = mkIf cfg.enable {
    confinement.enable = mkIf cfg.confine (mkDefault true);
-    bindsTo = map (dir: mkIf (dir.mountPoint != null)
+    bindsTo =
+      map (
+        dir:
+          mkIf (dir.mountPoint != null)
          "${utils.escapeSystemdPath dir.mountPoint}.mount"
-    ) cfg.mediaDirectories;
+      )
+      cfg.mediaDirectories;
    unitConfig.RequiresMountsFor = mkMerge (
      map (dir: dir.paths) cfg.mediaDirectories
    );
--- a/modules/nixos/mosquitto.nix
+++ b/modules/nixos/mosquitto.nix
@ -8,18 +8,19 @@
 in {
  options.services.mosquitto = with lib.types; {
    listeners = let
-      listenerModule = { ... }: {
+      listenerModule = {...}: {
        options = {
          openFirewall = mkEnableOption "firewall";
        };
      };
-    in mkOption {
+    in
+      mkOption {
        type = listOf (submodule listenerModule);
      };
  };
  config = {
    networking.firewall.allowedTCPPorts = mkIf cfg.enable (mkMerge (
-      map (listener: mkIf listener.openFirewall [ listener.port ]) cfg.listeners
+      map (listener: mkIf listener.openFirewall [listener.port]) cfg.listeners
    ));
  };
 }
--- a/modules/nixos/network/namespace.nix
+++ b/modules/nixos/network/namespace.nix
@ -19,7 +19,12 @@
  enabledNamespaces = filter (ns: ns.enable) (attrValues networking.namespaces);
  ip = "${pkgs.iproute2}/bin/ip";
  ip-n = namespace: "${ip} -n ${escapeShellArg namespace.name}";
-  namespaceInterfaceModule = { config, namespace, name, ... }: {
+  namespaceInterfaceModule = {
+    config,
+    namespace,
+    name,
+    ...
+  }: {
    options = with lib.types; {
      name = mkOption {
        type = str;
@ -41,8 +46,8 @@
    };
    config = {
      serviceSettings = rec {
-        bindsTo = [ "${namespace.unitName}.service" ];
-        partOf = [ "${namespace.unitName}.target" ];
+        bindsTo = ["${namespace.unitName}.service"];
+        partOf = ["${namespace.unitName}.target"];
        after = bindsTo;
        stopIfChanged = false;
        restartIfChanged = false;
@ -63,7 +68,11 @@
      };
    };
  };
-  groupModule = { config, namespace, ... }: {
+  groupModule = {
+    config,
+    namespace,
+    ...
+  }: {
    options = with lib.types; {
      id = mkOption {
        type = int;
@ -78,8 +87,8 @@
    };
    config = {
      serviceSettings = rec {
-        bindsTo = [ "${namespace.unitName}.service" ];
-        partOf = [ "${namespace.unitName}.target" ];
+        bindsTo = ["${namespace.unitName}.service"];
+        partOf = ["${namespace.unitName}.target"];
        after = bindsTo;
        stopIfChanged = false;
        restartIfChanged = false;
@ -100,15 +109,21 @@
      };
    };
  };
-  namespaceModule = { config, name, ... }: let
+  namespaceModule = {
+    config,
+    name,
+    ...
+  }: let
    linkGroupServices = optional (config.linkGroup != null) "${config.linkGroup.serviceName}.service";
    interfaceServices = mapAttrsToList (_: interface: "${interface.serviceName}.service") config.interfaces;
-    submoduleArgs = { ... }: {
+    submoduleArgs = {...}: {
      config._module.args.namespace = config;
    };
  in {
    options = with lib.types; {
-      enable = mkEnableOption "network namespace" // {
+      enable =
+        mkEnableOption "network namespace"
+        // {
          default = true;
        };
      resolvConf = mkOption {
@ -186,8 +201,9 @@
            groupModule
            submoduleArgs
          ];
-          idOrModule = coercedTo int (id: { inherit id; }) module;
-        in nullOr idOrModule;
+          idOrModule = coercedTo int (id: {inherit id;}) module;
+        in
+          nullOr idOrModule;
        default = null;
      };
      interfaces = mkOption {
@ -195,7 +211,7 @@
          namespaceInterfaceModule
          submoduleArgs
        ]);
-        default = { };
+        default = {};
      };
      path = mkOption {
        type = path;
@ -226,8 +242,8 @@
    };
    config = {
      serviceSettings = {
-        wants = [ "network.target" ];
-        after = [ "network.target" ];
+        wants = ["network.target"];
+        after = ["network.target"];
        stopIfChanged = false;
        restartIfChanged = false;
        serviceConfig = {
@ -245,12 +261,12 @@
        };
      };
      targetSettings = {
-        wantedBy = [ "multi-user.target" ];
-        bindsTo = [ "${config.unitName}.service" ];
+        wantedBy = ["multi-user.target"];
+        bindsTo = ["${config.unitName}.service"];
        requires = linkGroupServices ++ interfaceServices;
        wants = mkMerge [
-          (mkIf config.dhcpcd.enable [ "${config.dhcpcd.serviceName}.service" ])
-          (mkIf config.nftables.enable [ "${config.nftables.serviceName}.service" ])
+          (mkIf config.dhcpcd.enable ["${config.dhcpcd.serviceName}.service"])
+          (mkIf config.nftables.enable ["${config.nftables.serviceName}.service"])
        ];
      };
      configFiles = {
@ -312,7 +328,8 @@
          addrs6 = access.cidrForNetwork.local.v6 ++ optionals tailscale.enable access.cidrForNetwork.tail.v6;
          daddr4 = ''{ ${concatStringsSep ", " addrs4} }'';
          daddr6 = ''{ ${concatStringsSep ", " addrs6} }'';
-        in mkIf config.nftables.rejectLocaladdrs (mkMerge [
+        in
+          mkIf config.nftables.rejectLocaladdrs (mkMerge [
            ''ct state { established, related } accept''
            ''
              ip daddr ${daddr4} ip protocol tcp reject with tcp reset
@ -324,9 +341,9 @@
            '')
          ]);
        serviceSettings = rec {
-          bindsTo = [ "${config.unitName}.service" ];
-          partOf = [ "${config.unitName}.target" ];
-          wants = mkIf config.nftables.rejectLocaladdrs [ "localaddrs.service" ];
+          bindsTo = ["${config.unitName}.service"];
+          partOf = ["${config.unitName}.target"];
+          wants = mkIf config.nftables.rejectLocaladdrs ["localaddrs.service"];
          after = mkMerge [
            bindsTo
            wants
@ -346,7 +363,7 @@
              "${pkgs.nftables}/bin/nft -f ${config.configPath}/rules.nft"
            ];
            ExecReload = mkMerge [
-              (mkIf config.nftables.rejectLocaladdrs [ "+${access.localaddrs.reloadScript}" ])
+              (mkIf config.nftables.rejectLocaladdrs ["+${access.localaddrs.reloadScript}"])
              [
                "${pkgs.nftables}/bin/nft flush ruleset"
                "${pkgs.nftables}/bin/nft -f ${config.configPath}/rules.nft"
@ -360,10 +377,13 @@
      };
      dhcpcd = {
        serviceSettings = rec {
-          bindsTo = [ "${config.unitName}.service" ];
-          partOf = [ "${config.unitName}.target" ];
+          bindsTo = ["${config.unitName}.service"];
+          partOf = ["${config.unitName}.target"];
          wants = linkGroupServices ++ interfaceServices;
-          after = bindsTo ++ wants ++ [
+          after =
+            bindsTo
+            ++ wants
+            ++ [
              (mkIf config.nftables.enable "${config.nftables.serviceName}.service")
            ];
          stopIfChanged = false;
@ -407,13 +427,19 @@
      };
    };
  };
-  serviceModule = { config, name, ... }: let
+  serviceModule = {
+    config,
+    name,
+    ...
+  }: let
    cfg = config.networkNamespace;
    hasNs = cfg.name != null;
    ns = networking.namespaces.${cfg.name};
  in {
    options.networkNamespace = with lib.types; {
-      enable = mkEnableOption "netns" // {
+      enable =
+        mkEnableOption "netns"
+        // {
          default = cfg.name != null;
        };
      bindResolvConf = mkOption {
@ -446,15 +472,13 @@
            path = mkDefault (
              ns.path
            );
-            bindResolvConf = mkDefault (
-              "${ns.configPath}/resolv.conf"
-            );
+            bindResolvConf = mkDefault "${ns.configPath}/resolv.conf";
          })
        ];
      }
      (mkIf cfg.enable rec {
-        wants = mkIf hasNs [ "${ns.unitName}.target" ];
-        bindsTo = mkIf hasNs [ "${ns.unitName}.service" ];
+        wants = mkIf hasNs ["${ns.unitName}.target"];
+        bindsTo = mkIf hasNs ["${ns.unitName}.service"];
        after = mkMerge [
          bindsTo
          (mkIf (hasNs && cfg.afterOnline) [
@ -475,7 +499,7 @@ in {
  options = with lib.types; {
    networking.namespaces = mkOption {
      type = attrsOf (submodule namespaceModule);
-      default = { };
+      default = {};
    };
    systemd.services = mkOption {
      type = attrsOf (submodule serviceModule);
@ -483,19 +507,25 @@ in {
  };
  config = {
    systemd = {
-      services = listToAttrs (concatMap (ns:
+      services = listToAttrs (concatMap (
+          ns:
            singleton (nameValuePair ns.unitName (unmerged.merge ns.serviceSettings))
            ++ optional (ns.linkGroup != null) (nameValuePair ns.linkGroup.serviceName (unmerged.merge ns.linkGroup.serviceSettings))
            ++ mapAttrsToList (_: interface: nameValuePair interface.serviceName (unmerged.merge interface.serviceSettings)) ns.interfaces
            ++ optional ns.dhcpcd.enable (nameValuePair ns.dhcpcd.serviceName (unmerged.merge ns.dhcpcd.serviceSettings))
            ++ optional ns.nftables.enable (nameValuePair ns.nftables.serviceName (unmerged.merge ns.nftables.serviceSettings))
-      ) enabledNamespaces);
-      targets = listToAttrs (map (ns: nameValuePair ns.unitName (
+        )
+        enabledNamespaces);
+      targets = listToAttrs (map (ns:
+        nameValuePair ns.unitName (
          unmerged.merge ns.targetSettings
-      )) enabledNamespaces);
+        ))
+      enabledNamespaces);
    };
-    environment.etc = mkMerge (map (ns:
+    environment.etc = mkMerge (map (
+        ns:
          mapAttrs' (name: file: nameValuePair "${ns.configDir}/${name}" (unmerged.merge file)) ns.configFiles
-    ) enabledNamespaces);
+      )
+      enabledNamespaces);
  };
 }
--- a/modules/nixos/network/networks.nix
+++ b/modules/nixos/network/networks.nix
@ -8,15 +8,19 @@
  inherit (lib.modules) mkIf mkMerge mkOptionDefault;
  inherit (inputs.self.lib.lib) eui64;
  inherit (config) networking services;
-  networkModule = { config, ... }: {
+  networkModule = {config, ...}: {
    options = with lib.types; {
      mdns = {
-        enable = mkEnableOption "SLAAC" // {
+        enable =
+          mkEnableOption "SLAAC"
+          // {
            default = config.matchConfig.Type or null == "ether" && services.resolved.enable;
          };
      };
      slaac = {
-        enable = mkEnableOption "SLAAC" // {
+        enable =
+          mkEnableOption "SLAAC"
+          // {
            default = config.matchConfig.Type or null == "ether" && networking.enableIPv6;
          };
        postfix = mkOption {
--- a/modules/nixos/nftables.nix
+++ b/modules/nixos/nftables.nix
@ -1,6 +1,8 @@
-{ lib, config, ... }:
-
-let
+{
+  lib,
+  config,
+  ...
+}: let
  inherit (lib) types;
  inherit (lib.options) mkOption mkEnableOption;
  inherit (lib.modules) mkIf;
@ -13,9 +15,11 @@ let
  doDocker = config.virtualisation.docker.enable && cfg.generateDockerRules;

  mkPorts = cond: ports: ranges: action: let
-    portStrings = (map (range: "${toString range.from}-${toString range.to}") ranges)
+    portStrings =
+      (map (range: "${toString range.from}-${toString range.to}") ranges)
      ++ (map toString ports);
-  in optionalString (portStrings != []) ''
+  in
+    optionalString (portStrings != []) ''
      ${cond} dport { ${concatStringsSep "," portStrings} } ${action}
    '';

@ -39,10 +43,13 @@ let
        ${mkPorts "udp" fwcfg.allowedUDPPorts fwcfg.allowedUDPPortRanges "accept"}

        ${
-          concatStringsSep "\n" (mapAttrsToList (name: ifcfg: concatMapStringsSep "\n" (cond:
+      concatStringsSep "\n" (mapAttrsToList (name: ifcfg:
+        concatMapStringsSep "\n" (
+          cond:
            mkPorts "${cond} tcp" ifcfg.allowedTCPPorts ifcfg.allowedTCPPortRanges "accept"
            + mkPorts "${cond} udp" ifcfg.allowedUDPPorts ifcfg.allowedUDPPortRanges "accept"
-          ) (optionals ifcfg.nftables.enable ifcfg.nftables.conditions)) fwcfg.interfaces)
+        ) (optionals ifcfg.nftables.enable ifcfg.nftables.conditions))
+      fwcfg.interfaces)
    }

        # DHCPv6
@ -85,13 +92,22 @@ let
    ''}
    ${cfg.extraConfig}
  '';
-  interfaceModule = { config, name, ... }: {
+  interfaceModule = {
+    config,
+    name,
+    ...
+  }: {
    options = {
      nftables = {
-        enable = mkEnableOption "nftables firewall" // {
+        enable =
+          mkEnableOption "nftables firewall"
+          // {
            default =
-            config.allowedTCPPorts != [ ] || config.allowedTCPPortRanges != [ ]
-            || config.allowedUDPPorts != [ ] || config.allowedUDPPortRanges != [ ];
+              config.allowedTCPPorts
+              != []
+              || config.allowedTCPPortRanges != []
+              || config.allowedUDPPorts != []
+              || config.allowedUDPPortRanges != [];
          };
        conditions = mkOption {
          type = types.listOf types.str;
@ -100,7 +116,6 @@ let
      };
    };
  };
-
 in {
  options = {
    networking.nftables = {
--- a/modules/nixos/nginx/local.nix
+++ b/modules/nixos/nginx/local.nix
@ -9,7 +9,7 @@
  inherit (lib.lists) optionals;
  inherit (config.services) tailscale;
  inherit (config.networking.access) cidrForNetwork localaddrs;
-  localModule = { config, ... }: {
+  localModule = {config, ...}: {
    options.local = with lib.types; {
      enable = mkOption {
        type = bool;
@ -37,16 +37,23 @@
          cidrForNetwork.loopback.all
          ++ cidrForNetwork.local.all
          ++ optionals tailscale.enable cidrForNetwork.tail.all;
-        allows = concatMapStringsSep "\n" mkAllow allowAddresses + optionalString localaddrs.enable ''
+        allows =
+          concatMapStringsSep "\n" mkAllow allowAddresses
+          + optionalString localaddrs.enable ''
            include ${localaddrs.stateDir}/*.nginx.conf;
          '';
-      in mkBefore ''
+      in
+        mkBefore ''
          ${allows}
          deny all;
        '';
    };
  };
-  locationModule = { config, virtualHost, ... }: {
+  locationModule = {
+    config,
+    virtualHost,
+    ...
+  }: {
    imports = [
      localModule
    ];
@ -58,13 +65,13 @@
      emitDenyGlobal = virtualHost.local.emitDenyGlobal;
    };
  };
-  hostModule = { config, ... }: {
-    imports = [ localModule ];
+  hostModule = {config, ...}: {
+    imports = [localModule];

    options = with lib.types; {
      locations = mkOption {
        type = attrsOf (submoduleWith {
-          modules = [ locationModule ];
+          modules = [locationModule];
          shorthandOnlyDefinesConfig = true;
          specialArgs = {
            virtualHost = config;
@ -83,7 +90,7 @@ in {
  options = with lib.types; {
    services.nginx.virtualHosts = mkOption {
      type = attrsOf (submoduleWith {
-        modules = [ hostModule ];
+        modules = [hostModule];
        shorthandOnlyDefinesConfig = true;
        specialArgs = {
          nixosConfig = config;
--- a/modules/nixos/nginx/vouch.nix
+++ b/modules/nixos/nginx/vouch.nix
@ -2,13 +2,12 @@
  config,
  lib,
  ...
-}:
-let
+}: let
  inherit (lib.options) mkOption mkEnableOption;
  inherit (lib.modules) mkIf mkMerge mkBefore mkDefault;
  inherit (config) networking;
  inherit (config.services) vouch-proxy tailscale;
-  vouchModule = { config, ... }: {
+  vouchModule = {config, ...}: {
    options = with lib.types; {
      vouch = {
        enable = mkEnableOption "vouch auth proxy";
@ -49,15 +48,20 @@ let
        vouch = mkIf vouch-proxy.enable {
          proxyOrigin = let
            inherit (vouch-proxy.settings.vouch) listen port;
-            host = if listen == "0.0.0.0" || listen == "[::]" then "localhost" else listen;
-          in mkDefault "http://${host}:${toString port}";
+            host =
+              if listen == "0.0.0.0" || listen == "[::]"
+              then "localhost"
+              else listen;
+          in
+            mkDefault "http://${host}:${toString port}";
          authUrl = mkDefault vouch-proxy.authUrl;
          url = mkDefault vouch-proxy.url;
          doubleProxy = mkDefault false;
        };
      }
      {
-        vouch.proxyOrigin = mkIf (tailscale.enable && !vouch-proxy.enable) (mkDefault
+        vouch.proxyOrigin = mkIf (tailscale.enable && !vouch-proxy.enable) (
+          mkDefault
          "http://login.tail.${networking.domain}"
        );
      }
@ -96,7 +100,8 @@ let
                  set $vouch_url $vouch_scheme://${config.vouch.tailDomain};
                }
              '';
-            in mkMerge [
+            in
+              mkMerge [
                (mkBefore ''
                  set $vouch_url ${config.vouch.url};
                  set $vouch_scheme $scheme;
--- a/modules/nixos/nginx/websocket.nix
+++ b/modules/nixos/nginx/websocket.nix
@ -1,10 +1,7 @@
-{
-  lib,
-  ...
-}: let
+{lib, ...}: let
  inherit (lib.modules) mkIf;
  inherit (lib.options) mkOption mkEnableOption;
-  wsModule = { config, ... }: {
+  wsModule = {config, ...}: {
    options = with lib.types; {
      proxy.websocket.enable = mkEnableOption "websocket proxy";
    };
@ -16,8 +13,8 @@
      '';
    };
  };
-  hostModule = { config, ... }: {
-    imports = [ wsModule ];
+  hostModule = {config, ...}: {
+    imports = [wsModule];

    options = with lib.types; {
      locations = mkOption {
--- a/modules/nixos/plex.nix
+++ b/modules/nixos/plex.nix
@ -1,7 +1,4 @@
-{
-  lib,
-  ...
-}: let
+{lib, ...}: let
  inherit (lib.options) mkOption;
 in {
  options.services.plex = with lib.types; {
--- a/modules/nixos/policyrouting.nix
+++ b/modules/nixos/policyrouting.nix
@ -1,11 +1,12 @@
-{ config, lib, ... }:
-
-with lib;
-
-let
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
  cfg = config.networking.policyrouting;

-  ruleOpts = { ... }: {
+  ruleOpts = {...}: {
    options = {
      prio = mkOption {
        type = types.int;
@ -15,37 +16,44 @@ let
      };
    };
  };
-
-in
-{
+in {
  options = {
    networking.policyrouting = {
      enable = mkEnableOption "Declarative Policy-Routing";
      rules = mkOption {
        type = with types; listOf (submodule ruleOpts);
-        default = [ ];
+        default = [];
      };
      rules6 = mkOption {
        type = with types; listOf (submodule ruleOpts);
-        default = [ ];
+        default = [];
      };
      rules4 = mkOption {
        type = with types; listOf (submodule ruleOpts);
-        default = [ ];
+        default = [];
      };
    };
  };

  config = mkIf cfg.enable {
    networking.policyrouting.rules = [
-      { rule = "lookup main"; prio = 32000; }
+      {
+        rule = "lookup main";
+        prio = 32000;
+      }
    ];
    networking.localCommands = ''
      set -x
      ip -6 rule flush
      ip -4 rule flush
-      ${concatMapStringsSep "\n" ({ prio, rule }: "ip -6 rule add ${rule} prio ${toString prio}") (cfg.rules ++ cfg.rules6)}
-      ${concatMapStringsSep "\n" ({ prio, rule }: "ip -4 rule add ${rule} prio ${toString prio}") (cfg.rules ++ cfg.rules4)}
+      ${concatMapStringsSep "\n" ({
+        prio,
+        rule,
+      }: "ip -6 rule add ${rule} prio ${toString prio}") (cfg.rules ++ cfg.rules6)}
+      ${concatMapStringsSep "\n" ({
+        prio,
+        rule,
+      }: "ip -4 rule add ${rule} prio ${toString prio}") (cfg.rules ++ cfg.rules4)}
    '';
  };
 }
--- a/modules/nixos/postgres.nix
+++ b/modules/nixos/postgres.nix
@ -10,19 +10,24 @@
  inherit (config) networking;
  cfg = config.services.postgresql;
  formatHost = host:
-    if hasInfix "/" host then host
-    else if hasInfix ":" host then "${host}/128"
-    else if hasInfix "." host then "${host}/32"
+    if hasInfix "/" host
+    then host
+    else if hasInfix ":" host
+    then "${host}/128"
+    else if hasInfix "." host
+    then "${host}/32"
    else throw "unsupported IP address ${host}";
-  ensureUserModule = { config, ... }: {
+  ensureUserModule = {config, ...}: {
    options = with lib.types; {
      authentication = {
-        enable = mkEnableOption "TCP connections" // {
-          default = config.authentication.hosts != [ ];
+        enable =
+          mkEnableOption "TCP connections"
+          // {
+            default = config.authentication.hosts != [];
          };
        hosts = mkOption {
          type = listOf str;
-          default = [ ];
+          default = [];
        };
        method = mkOption {
          type = str;
@ -47,13 +52,15 @@
      authentication = {
        hosts = let
          inherit (networking.access) cidrForNetwork;
-        in mkMerge [
+        in
+          mkMerge [
            (mkIf config.authentication.tailscale.allow cidrForNetwork.tail.all)
            (mkIf config.authentication.local.allow (cidrForNetwork.loopback.all ++ cidrForNetwork.local.all))
          ];
        authentication = mkMerge (map (host: ''
            host ${config.authentication.database} ${config.name} ${formatHost host} ${config.authentication.method}
-        '') config.authentication.hosts);
+          '')
+          config.authentication.hosts);
      };
      authentication.database = mkIf config.ensureDBOwnership (
        mkOptionDefault config.name
@ -70,11 +77,13 @@ in {
    enableTCPIP = mkIf (any (user: user.authentication.enable) cfg.ensureUsers) (
      mkDefault true
    );
-    authentication = mkMerge (map (user:
+    authentication = mkMerge (map (
+        user:
          mkIf user.authentication.enable user.authentication.authentication
-    ) cfg.ensureUsers);
+      )
+      cfg.ensureUsers);
  };
  config.networking.firewall.interfaces.local = mkIf cfg.enable {
-    allowedTCPPorts = mkIf (any (user: user.authentication.local.allow) cfg.ensureUsers) [ cfg.port ];
+    allowedTCPPorts = mkIf (any (user: user.authentication.local.allow) cfg.ensureUsers) [cfg.port];
  };
 }
--- a/modules/nixos/prowlarr.nix
+++ b/modules/nixos/prowlarr.nix
@ -1,7 +1,4 @@
-{
-  lib,
-  ...
-}: let
+{lib, ...}: let
  inherit (lib.options) mkOption;
 in {
  options.services.prowlarr = with lib.types; {
--- a/modules/nixos/radarr.nix
+++ b/modules/nixos/radarr.nix
@ -1,7 +1,4 @@
-{
-  lib,
-  ...
-}: let
+{lib, ...}: let
  inherit (lib.options) mkOption;
 in {
  options.services.radarr = with lib.types; {
--- a/modules/nixos/readarr.nix
+++ b/modules/nixos/readarr.nix
@ -1,7 +1,4 @@
-{
-  lib,
-  ...
-}: let
+{lib, ...}: let
  inherit (lib.options) mkOption;
 in {
  options.services.readarr = with lib.types; {
--- a/modules/nixos/samba.nix
+++ b/modules/nixos/samba.nix
@ -11,14 +11,17 @@
  inherit (config.services) samba-wsdd;
  cfg = config.services.samba;
  settingValue = value:
-    if builtins.isList value then concatMapStringsSep ", " settingValue value
-    else if value == true then "yes"
-    else if value == false then "no"
+    if builtins.isList value
+    then concatMapStringsSep ", " settingValue value
+    else if value == true
+    then "yes"
+    else if value == false
+    then "no"
    else toString value;
 in {
  options.services.samba = with lib.types; let
-    settingPrimitive = oneOf [ str int bool ];
-    settingType = oneOf [ settingPrimitive (listOf settingPrimitive) ];
+    settingPrimitive = oneOf [str int bool];
+    settingType = oneOf [settingPrimitive (listOf settingPrimitive)];
  in {
    ldap = {
      enable = mkEnableOption "LDAP";
@ -64,7 +67,11 @@ in {
      };
    };
    idmap = let
-      idmapModule = { config, name, ... }: {
+      idmapModule = {
+        config,
+        name,
+        ...
+      }: {
        options = {
          backend = mkOption {
            type = str;
@ -89,7 +96,7 @@ in {
          };
          settings = mkOption {
            type = attrsOf settingType;
-            default = { };
+            default = {};
          };
        };
        config = {
@ -117,7 +124,7 @@ in {
    };
    settings = mkOption {
      type = attrsOf settingType;
-      default = { };
+      default = {};
    };
  };

@ -161,13 +168,14 @@ in {
            "usershare owner only" = mkOptionDefault true;
            "usershare template share" = mkOptionDefault cfg.usershare.templateShare;
            "usershare path" = mkOptionDefault cfg.usershare.path;
-          "usershare prefix allow list" = mkOptionDefault [ cfg.usershare.path ];
+            "usershare prefix allow list" = mkOptionDefault [cfg.usershare.path];
          })
          (mkIf cfg.guest.enable {
            "map to guest" = mkOptionDefault "Bad User";
            "guest account" = mkOptionDefault cfg.guest.user;
          })
-      ] ++ mapAttrsToList (_: idmap: mapAttrs' (key: value: nameValuePair "idmap config ${idmap.domain} : ${key}" (mkOptionDefault value)) idmap.settings) cfg.idmap.domains);
+        ]
+        ++ mapAttrsToList (_: idmap: mapAttrs' (key: value: nameValuePair "idmap config ${idmap.domain} : ${key}" (mkOptionDefault value)) idmap.settings) cfg.idmap.domains);
      extraConfig = mkMerge (mapAttrsToList (key: value: ''${key} = ${settingValue value}'') cfg.settings);
      shares.${cfg.usershare.templateShare} = mkIf cfg.usershare.enable {
        "-valid" = false;
@ -194,12 +202,12 @@ in {

    networking.firewall.interfaces.local = {
      allowedTCPPorts = mkMerge [
-        (mkIf (cfg.enable && !cfg.openFirewall) [ 139 445 ])
-        (mkIf (samba-wsdd.enable && !samba-wsdd.openFirewall) [ 5357 ])
+        (mkIf (cfg.enable && !cfg.openFirewall) [139 445])
+        (mkIf (samba-wsdd.enable && !samba-wsdd.openFirewall) [5357])
      ];
      allowedUDPPorts = mkMerge [
-        (mkIf (cfg.enable && !cfg.openFirewall) [ 137 138 ])
-        (mkIf (samba-wsdd.enable && !samba-wsdd.openFirewall) [ 3702 ])
+        (mkIf (cfg.enable && !cfg.openFirewall) [137 138])
+        (mkIf (samba-wsdd.enable && !samba-wsdd.openFirewall) [3702])
      ];
    };
  };
--- a/modules/nixos/sonarr.nix
+++ b/modules/nixos/sonarr.nix
@ -1,7 +1,4 @@
-{
-  lib,
-  ...
-}: let
+{lib, ...}: let
  inherit (lib.options) mkOption;
 in {
  options.services.sonarr = with lib.types; {
--- a/modules/nixos/steam/account-switch.nix
+++ b/modules/nixos/steam/account-switch.nix
@ -76,7 +76,8 @@ in {
        inherit owner;
        inherit (shared) group mode;
      };
-      setupFiles = singleton {
+      setupFiles =
+        singleton {
          ${cfg.rootDir} = toplevel;
          ${cfg.binDir} = toplevel;
          ${cfg.binDir + "/users"} = shared;
@ -84,11 +85,14 @@ in {
          ${cfg.sharedDataDir} = shared;
          ${cfg.workingDir} = toplevel;
          ${cfg.sharedWorkingDir} = shared;
-      } ++ map (owner: {
+        }
+        ++ map (owner: {
          ${cfg.dataDir + "/${owner}"} = personal owner;
          ${cfg.workingDir + "/${owner}"} = personal owner;
-      }) cfg.users;
-      userBinFiles = listToAttrs (map (user: nameValuePair "${cfg.binDir}/users/${user}.bat" {
+        })
+        cfg.users;
+      userBinFiles = listToAttrs (map (user:
+        nameValuePair "${cfg.binDir}/users/${user}.bat" {
          inherit (toplevel) owner group;
          mode = "0755";
          type = "copy";
@ -99,7 +103,8 @@ in {
              setx GENSO_STEAM_USER ${user}
            '';
          };
-      }) cfg.users);
+        })
+      cfg.users);
    in {
      enable = mkIf (cfg.enable || cfg.setup) true;
      files = mkMerge [
--- a/modules/nixos/steam/beatsaber.nix
+++ b/modules/nixos/steam/beatsaber.nix
@ -14,7 +14,11 @@
  inherit (lib.meta) getExe;
  inherit (config.services.steam) accountSwitch;
  cfg = config.services.steam.beatsaber;
-  versionModule = { config, name, ... }: {
+  versionModule = {
+    config,
+    name,
+    ...
+  }: {
    options = with lib.types; {
      version = mkOption {
        type = str;
@ -23,7 +27,8 @@
    };
  };

-  mkSharePath = path: mkWinPath (
+  mkSharePath = path:
+    mkWinPath (
      "%GENSO_SMB_SHARED_MOUNT%"
      + "/${accountSwitch.sharePath}"
      + "/${removePrefix (accountSwitch.rootDir + "/") path}"
@ -102,7 +107,9 @@
 in {
  options.services.steam.beatsaber = with lib.types; {
    enable = mkEnableOption "beatsaber scripts";
-    setup = mkEnableOption "beatsaber data" // {
+    setup =
+      mkEnableOption "beatsaber data"
+      // {
        default = accountSwitch.setup;
      };
    group = mkOption {
@ -114,7 +121,7 @@ in {
    };
    versions = mkOption {
      type = attrsOf (submodule versionModule);
-      default = { };
+      default = {};
    };
    users = mkOption {
      type = listOf str;
@ -127,7 +134,7 @@ in {
      bsUsers = filterAttrs (_: userIs cfg.group) config.users.users;
      allVersions = mapAttrsToList (_: version: version.version) cfg.versions;
    in {
-      defaultVersion = mkIf (allVersions != [ ]) (mkOptionDefault (
+      defaultVersion = mkIf (allVersions != []) (mkOptionDefault (
        head allVersions
      ));
      users = mkOptionDefault (
@ -140,10 +147,12 @@ in {
        mkbeatsabersh
      ];
    };
-    systemd.services = mkIf cfg.setup (listToAttrs (map (user: nameValuePair "steam-setup-beatsaber-${user}" {
+    systemd.services = mkIf cfg.setup (listToAttrs (map (user:
+      nameValuePair "steam-setup-beatsaber-${user}" {
        script = mkMerge (mapAttrsToList (_: version: ''
            ${getExe mkbeatsaber} ${version.version} ${user}
-      '') cfg.versions);
+          '')
+          cfg.versions);
        path = [
          pkgs.coreutils
        ];
@ -157,7 +166,8 @@ in {
          RemainAfterExit = mkOptionDefault true;
          User = mkOptionDefault user;
        };
-    }) cfg.users));
+      })
+    cfg.users));
    services.tmpfiles = let
      toplevel = {
        owner = mkDefault "admin";
@ -187,30 +197,42 @@ in {
        "AppData"
        "UserData"
      ];
-      setupFiles = [
+      setupFiles =
+        [
          {
            "${accountSwitch.sharedDataDir}/BeatSaber" = toplevel;
            "${accountSwitch.binDir}/beatsaber" = shared;
          }
          (listToAttrs (
-          map (folder:
+            map (
+              folder:
                nameValuePair "${accountSwitch.sharedDataDir}/BeatSaber/${folder}" shared
-          ) sharedFolders
+            )
+            sharedFolders
          ))
-      ] ++ concatMap (owner:
+        ]
+        ++ concatMap (
+          owner:
            singleton {
              "${accountSwitch.dataDir}/${owner}/BeatSaber" = personal owner;
              "${accountSwitch.dataDir}/${owner}/BeatSaber/AppData" = personal owner;
              "${accountSwitch.dataDir}/${owner}/BeatSaber/UserData" = personal owner;
-        } ++ mapAttrsToList (_: version: {
+            }
+            ++ mapAttrsToList (_: version: {
              "${accountSwitch.dataDir}/${owner}/BeatSaber/${version.version}" = personal owner;
-        }) cfg.versions
-      ) accountSwitch.users
+            })
+            cfg.versions
+        )
+        accountSwitch.users
        ++ mapAttrsToList (_: version: {
          "${accountSwitch.sharedDataDir}/BeatSaber/${version.version}" = shared;
-      }) cfg.versions;
-      versionBinFiles = mapAttrs' (_: version: nameValuePair
-        "${accountSwitch.binDir}/beatsaber/${replaceStrings [ "." ] [ "_" ] version.version}.bat"
+        })
+        cfg.versions;
+      versionBinFiles =
+        mapAttrs' (
+          _: version:
+            nameValuePair
+            "${accountSwitch.binDir}/beatsaber/${replaceStrings ["."] ["_"] version.version}.bat"
            {
              inherit (bin) owner group mode type;
              src = pkgs.writeTextFile {
@ -221,8 +243,10 @@ in {
                '';
              };
            }
-      ) cfg.versions;
-      binFiles = {
+        )
+        cfg.versions;
+      binFiles =
+        {
          "${accountSwitch.binDir}/beatsaber/mount.bat" = {
            inherit (bin) owner group mode type;
            src = pkgs.writeTextFile {
@ -257,7 +281,8 @@ in {
              executable = true;
            };
          };
-      } // versionBinFiles;
+        }
+        // versionBinFiles;
    in {
      enable = mkIf (cfg.enable || cfg.setup) true;
      files = mkMerge [
--- a/modules/nixos/tmpfiles.nix
+++ b/modules/nixos/tmpfiles.nix
@ -18,9 +18,15 @@
  systemdFiles = filter (file: file.systemd.enable) files;
  setupFiles = filter (file: !file.systemd.enable) files;
  bindFiles = filter (file: file.type == "bind") files;
-  fileModule = { config, name, ... }: {
+  fileModule = {
+    config,
+    name,
+    ...
+  }: {
    options = with lib.types; {
-      enable = mkEnableOption "file" // {
+      enable =
+        mkEnableOption "file"
+        // {
          default = true;
        };
      mkdirParent = mkEnableOption "mkdir";
@ -32,8 +38,11 @@
        default = name;
      };
      type = mkOption {
-        type = enum [ "directory" "symlink" "link" "copy" "bind" ];
-        default = if config.src != null then "symlink" else "directory";
+        type = enum ["directory" "symlink" "link" "copy" "bind"];
+        default =
+          if config.src != null
+          then "symlink"
+          else "directory";
      };
      mode = mkOption {
        type = str;
@ -71,7 +80,7 @@
    };
    config = let
      acls = concatStringsSep "," config.acls;
-      enableAcls = config.type == "directory" && config.acls != [ ];
+      enableAcls = config.type == "directory" && config.acls != [];
      systemdAclRule = "a+ ${config.path} - - - - ${acls}";
      systemdRule = {
        directory = [
@ -168,7 +177,7 @@
      systemd = {
        rules = mkMerge [
          systemdRule.${config.type}
-          (mkIf enableAcls [ systemdAclRule ])
+          (mkIf enableAcls [systemdAclRule])
        ];
        mountSettings = mkIf (config.type == "bind") {
          enable = mkDefault config.enable;
@ -191,16 +200,21 @@
  };
 in {
  options.services.tmpfiles = with lib.types; {
-    enable = mkEnableOption "extended tmpfiles" // {
-      default = cfg.files != { };
+    enable =
+      mkEnableOption "extended tmpfiles"
+      // {
+        default = cfg.files != {};
      };
    user = mkOption {
      type = str;
-      default = if config.proxmoxLXC.privileged or true then "root" else "admin";
+      default =
+        if config.proxmoxLXC.privileged or true
+        then "root"
+        else "admin";
    };
    files = mkOption {
      type = attrsOf (submodule fileModule);
-      default = { };
+      default = {};
    };
  };
  config = {
@ -209,15 +223,19 @@ in {
        map (file: file.systemd.rules) systemdFiles
      );
      services.tmpfiles = {
-        path = [ pkgs.coreutils pkgs.acl ];
+        path = [pkgs.coreutils pkgs.acl];
        script = mkMerge (
-          [ ''
+          [
+            ''
              EXITCODE=0
-          '' ]
+            ''
+          ]
          ++ map (file: file.setup.script) setupFiles
-          ++ [ ''
+          ++ [
+            ''
              exit $EXITCODE
-          '' ]
+            ''
+          ]
        );
        wantedBy = [
          "sysinit.target"
--- a/modules/nixos/users.nix
+++ b/modules/nixos/users.nix
@ -13,28 +13,33 @@
  userMatchBlock = user: let
    inherit (user.openssh) matchBlock;
    criteria = mapAttrsToList toSshdCriteria matchBlock.criteria;
-  in mkAfter ''
+  in
+    mkAfter ''
      Match ${concatStringsSep " " criteria}
      ${matchBlock.settingsConfig}
    '';
-  userModule = { config, ... }: let
+  userModule = {config, ...}: let
    toSshdValue = value:
-      if value == true then "yes"
-      else if value == false then "no"
+      if value == true
+      then "yes"
+      else if value == false
+      then "no"
      else toString value;
    toSshdConf = key: value: "${key} ${toSshdValue value}";
  in {
    options = with lib.types; {
      openssh.matchBlock = {
-        enable = mkEnableOption "match block" // {
-          default = config.openssh.matchBlock.settings != { };
+        enable =
+          mkEnableOption "match block"
+          // {
+            default = config.openssh.matchBlock.settings != {};
          };
        criteria = mkOption {
          type = attrsOf str;
        };
        settings = mkOption {
-          type = attrsOf (oneOf [ str path bool int ]);
-          default = { };
+          type = attrsOf (oneOf [str path bool int]);
+          default = {};
        };
        settingsConfig = mkOption {
          type = lines;
--- a/modules/nixos/vouch.nix
+++ b/modules/nixos/vouch.nix
@ -5,11 +5,20 @@
  lib,
  ...
 }: let
-  inherit (lib) mkIf mkMerge mkDefault mkOptionDefault mkOption mkEnableOption types
-    getExe;
+  inherit
+    (lib)
+    mkIf
+    mkMerge
+    mkDefault
+    mkOptionDefault
+    mkOption
+    mkEnableOption
+    types
+    getExe
+    ;
  nixosConfig = config;
  cfg = config.services.vouch-proxy;
-  settingsFormat = pkgs.formats.json { };
+  settingsFormat = pkgs.formats.json {};
 in {
  options.services.vouch-proxy = with types; {
    enable = mkEnableOption "vouch";
@ -35,7 +44,7 @@ in {
    };
    enableSettingsSecrets = mkEnableOption "genJqSecretsReplacementSnippet";
    settings = let
-      settingsModule = { ... }: {
+      settingsModule = {...}: {
        freeformType = settingsFormat.type;
        options = {
          vouch = {
@ -98,13 +107,14 @@ in {
          };
        };
      };
-    in mkOption {
+    in
+      mkOption {
        type = submodule settingsModule;
-      default = { };
+        default = {};
      };
    extraSettings = mkOption {
      inherit (settingsFormat) type;
-      default = { };
+      default = {};
    };
    settingsPath = mkOption {
      type = path;
@ -116,10 +126,12 @@ in {
      cfg.settings
      cfg.extraSettings
    ];
-    settingsPath = if cfg.enableSettingsSecrets
+    settingsPath =
+      if cfg.enableSettingsSecrets
      then "/run/vouch-proxy/vouch-config.json"
      else settingsFormat.generate "vouch-config.json" settings;
-  in mkMerge [
+  in
+    mkMerge [
      {
        services.vouch-proxy = {
          settingsPath = mkOptionDefault settingsPath;
@ -128,14 +140,15 @@ in {
      (mkIf cfg.enable {
        systemd.services.vouch-proxy = {
          description = "Vouch-proxy";
-        after = [ "network.target" ];
-        wantedBy = [ "multi-user.target" ];
+          after = ["network.target"];
+          wantedBy = ["multi-user.target"];
          serviceConfig = {
            ExecStartPre = let
              preprocess = pkgs.writeShellScript "vouch-proxy-prestart" (
                utils.genJqSecretsReplacementSnippet settings cfg.settingsPath
              );
-          in mkIf cfg.enableSettingsSecrets [
+            in
+              mkIf cfg.enableSettingsSecrets [
                "${preprocess}"
              ];
            ExecStart = [
--- a/nixos/access/freeipa.nix
+++ b/nixos/access/freeipa.nix
@ -3,8 +3,7 @@
  meta,
  lib,
  ...
-}:
-let
+}: let
  inherit (lib.options) mkOption mkEnableOption;
  inherit (lib.modules) mkIf mkMerge mkBefore mkDefault;
  inherit (lib.strings) optionalString concatStringsSep;
@ -56,7 +55,9 @@ in {
      type = str;
    };
    preread = {
-      enable = mkEnableOption "ssl preread" // {
+      enable =
+        mkEnableOption "ssl preread"
+        // {
          default = true;
        };
      port = mkOption {
@ -65,7 +66,9 @@ in {
      };
    };
    kerberos = {
-      enable = mkEnableOption "proxy kerberos" // {
+      enable =
+        mkEnableOption "proxy kerberos"
+        // {
          default = true;
        };
      ports = {
@ -86,7 +89,10 @@ in {
    proxyPass = mkOption {
      type = str;
      default = let
-        scheme = if access.port == 443 then "https" else "http";
+        scheme =
+          if access.port == 443
+          then "https"
+          else "http";
      in "${scheme}://${access.host}:${toString access.port}";
    };
    domain = mkOption {
@ -130,7 +136,7 @@ in {
        port = mkDefault access.ldapPort;
        useACMEHost = mkDefault access.useACMEHost;
      };
-      resolver.addresses = mkIf access.preread.enable [ "[::1]" "127.0.0.1:5353" ];
+      resolver.addresses = mkIf access.preread.enable ["[::1]" "127.0.0.1:5353"];
      defaultSSLListenPort = mkIf access.preread.enable access.preread.port;
      streamConfig = let
        preread = ''
@ -174,7 +180,8 @@ in {
            proxy_pass ${access.host}:${toString access.kerberos.ports.kpasswd};
          }
        '';
-      in mkMerge [
+      in
+        mkMerge [
          (mkIf access.preread.enable preread)
          (mkIf access.kerberos.enable kerberos)
        ];
@ -207,7 +214,7 @@ in {
          local.enable = true;
          inherit locations;
        };
-        ${ldap.domain} = { config, ... }: {
+        ${ldap.domain} = {config, ...}: {
          useACMEHost = mkDefault virtualHosts.${access.domain}.useACMEHost;
          addSSL = mkDefault (config.useACMEHost != null);
          globalRedirect = access.domain;
--- a/nixos/access/freepbx.nix
+++ b/nixos/access/freepbx.nix
@ -12,7 +12,9 @@
  freepbx = config.lib.access.systemFor "freepbx";
 in {
  options.services.nginx.access.freepbx = with lib.types; {
-    global.enable = mkEnableOption "global access" // {
+    global.enable =
+      mkEnableOption "global access"
+      // {
        default = access.useACMEHost != null;
      };
    host = mkOption {
@ -94,7 +96,8 @@ in {
      };
      "${access.domain}@ucp" = {
        serverName = access.domain;
-        listen = concatMap (addr: [
+        listen =
+          concatMap (addr: [
            {
              inherit addr;
              port = access.ucpPort;
@ -104,7 +107,8 @@ in {
              port = access.ucpSslPort;
              ssl = true;
            })
-        ]) nginx.defaultListenAddresses;
+          ])
+          nginx.defaultListenAddresses;
        proxy.websocket.enable = true;
        local.enable = mkDefault (!access.global.enable);
        addSSL = mkDefault (access.useACMEHost != null);
@ -116,7 +120,8 @@ in {
        inherit extraConfig;
      };
      ${access.localDomain} = {
-        listen = concatMap (addr: [
+        listen =
+          concatMap (addr: [
            {
              inherit addr;
              port = nginx.defaultHTTPListenPort;
@ -135,8 +140,9 @@ in {
              port = access.ucpSslPort;
              ssl = true;
            })
-        ]) nginx.defaultListenAddresses;
-        serverAliases = mkIf tailscale.enable [ access.tailDomain ];
+          ])
+          nginx.defaultListenAddresses;
+        serverAliases = mkIf tailscale.enable [access.tailDomain];
        useACMEHost = mkDefault access.useACMEHost;
        addSSL = mkDefault (access.useACMEHost != null);
        kTLS = mkDefault true;
@ -146,7 +152,7 @@ in {
    };
  };
  config.networking.firewall = let
-    websocketPorts = [ access.ucpPort ] ++ optional (access.useACMEHost != null) access.ucpSslPort;
+    websocketPorts = [access.ucpPort] ++ optional (access.useACMEHost != null) access.ucpSslPort;
  in {
    interfaces.local.allowedTCPPorts = websocketPorts;
    allowedTCPPorts = mkIf access.global.enable websocketPorts;
--- a/nixos/access/global.nix
+++ b/nixos/access/global.nix
@ -1,7 +1,4 @@
-{
-  lib,
-  ...
-}: let
+{lib, ...}: let
  inherit (lib.modules) mkDefault;
 in {
  networking = {
--- a/nixos/access/invidious.nix
+++ b/nixos/access/invidious.nix
@ -34,12 +34,14 @@ in {
      url = mkOptionDefault "http://localhost:${toString cfg.port}";
    };
    virtualHosts = let
-      invidiousDomains = [
+      invidiousDomains =
+        [
          access.domain
          access.localDomain
-      ] ++ optional tailscale.enable access.tailDomain;
+        ]
+        ++ optional tailscale.enable access.tailDomain;
      contentSecurityPolicy' = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'; manifest-src 'self'; media-src 'self' blob: https://*.googlevideo.com:443 https://*.youtube.com:443; child-src 'self' blob:; frame-src 'self'; frame-ancestors 'none'";
-      contentSecurityPolicy = replaceStrings [ "'self'" ] [ "'self' ${concatStringsSep " " invidiousDomains}" ] contentSecurityPolicy';
+      contentSecurityPolicy = replaceStrings ["'self'"] ["'self' ${concatStringsSep " " invidiousDomains}"] contentSecurityPolicy';
      extraConfig = ''
        # Some players don't reopen a socket and playback stops totally instead of resuming after an extended pause
        send_timeout 100m;
@ -56,14 +58,14 @@ in {
        '';
      };
    in {
-      ${access.domain} = { config, ... }: {
+      ${access.domain} = {config, ...}: {
        vouch.enable = true;
        locations."/" = location;
        kTLS = mkDefault true;
        inherit extraConfig;
      };
-      ${access.localDomain} = { config, ... }: {
-        serverAliases = mkIf tailscale.enable [ access.tailDomain ];
+      ${access.localDomain} = {config, ...}: {
+        serverAliases = mkIf tailscale.enable [access.tailDomain];
        local.enable = true;
        locations."/" = mkMerge [
          location
--- a/nixos/access/kanidm.nix
+++ b/nixos/access/kanidm.nix
@ -3,8 +3,7 @@
  meta,
  lib,
  ...
-}:
-let
+}: let
  inherit (lib.options) mkOption;
  inherit (lib.modules) mkIf mkMerge mkDefault mkOptionDefault;
  inherit (config) networking;
--- a/nixos/access/kitchencam.nix
+++ b/nixos/access/kitchencam.nix
@ -64,8 +64,9 @@ in {
          inherit extraConfig;
        };
      };
-      streamListen = { config, ... }: {
-        listen = concatMap (addr: [
+      streamListen = {config, ...}: {
+        listen =
+          concatMap (addr: [
            (mkIf config.addSSL {
              inherit addr;
              port = nginx.defaultSSLListenPort;
@ -79,24 +80,31 @@ in {
              inherit addr;
              port = access.streamPort;
            }
-        ]) nginx.defaultListenAddresses;
+          ])
+          nginx.defaultListenAddresses;
      };
    in {
-      ${access.domain} = mkMerge [ {
+      ${access.domain} = mkMerge [
+        {
          vouch.enable = true;
          kTLS = mkDefault true;
          inherit (access) useACMEHost;
          addSSL = mkDefault (access.useACMEHost != null);
          inherit locations;
-      } streamListen ];
-      ${access.localDomain} = mkMerge [ {
-        serverAliases = mkIf config.services.tailscale.enable [ access.tailDomain ];
+        }
+        streamListen
+      ];
+      ${access.localDomain} = mkMerge [
+        {
+          serverAliases = mkIf config.services.tailscale.enable [access.tailDomain];
          inherit (virtualHosts.${access.domain}) useACMEHost;
          addSSL = mkDefault addSSL;
          kTLS = mkDefault true;
          local.enable = true;
          inherit locations;
-      } streamListen ];
+        }
+        streamListen
+      ];
    };
  };
  config.networking.firewall.allowedTCPPorts = [
--- a/nixos/access/ldap.nix
+++ b/nixos/access/ldap.nix
@ -2,8 +2,7 @@
  config,
  lib,
  ...
-}:
-let
+}: let
  inherit (lib.options) mkOption mkEnableOption;
  inherit (lib.modules) mkIf mkMerge;
  inherit (lib.strings) concatMapStringsSep optionalString;
@ -18,7 +17,9 @@ let
      cidrForNetwork.loopback.all
      ++ cidrForNetwork.local.all
      ++ optionals tailscale.enable cidrForNetwork.tail.all;
-    allows = concatMapStringsSep "\n" mkAllow allowAddresses + optionalString localaddrs.enable ''
+    allows =
+      concatMapStringsSep "\n" mkAllow allowAddresses
+      + optionalString localaddrs.enable ''
        include ${localaddrs.stateDir}/*.nginx.conf;
      '';
  in ''
@ -61,7 +62,8 @@ in {
          proxy_ssl on;
          proxy_ssl_verify off;
        '';
-      in mkIf access.enable (mkMerge [
+      in
+        mkIf access.enable (mkMerge [
          ''
            server {
              listen 0.0.0.0:389;
--- a/nixos/access/plex.nix
+++ b/nixos/access/plex.nix
@ -70,10 +70,12 @@ in {
      plex-external = mkIf (access.externalPort != null) {
        serverName = mkDefault access.domain;
        default = mkDefault true;
-        listen = map (addr: {
+        listen =
+          map (addr: {
            inherit addr;
            port = access.externalPort;
-        }) nginx.defaultListenAddresses;
+          })
+          nginx.defaultListenAddresses;
        locations."/" = location;
        inherit extraConfig;
      };
--- a/nixos/access/proxmox.nix
+++ b/nixos/access/proxmox.nix
@ -14,10 +14,11 @@
  proxyPass = "https://reisen.local.${config.networking.domain}:8006/";
  unencrypted = mkSnakeOil {
    name = "prox-local-cert";
-    domain = singleton "prox.local.${config.networking.domain}"
+    domain =
+      singleton "prox.local.${config.networking.domain}"
      ++ optional tailscale.enable "prox.tail.${config.networking.domain}";
  };
-  sslHost = { config, ... }: {
+  sslHost = {config, ...}: {
    sslCertificate = mkIf (!config.enableACME && config.useACMEHost == null) unencrypted.fullchain;
    sslCertificateKey = mkIf (!config.enableACME && config.useACMEHost == null) unencrypted.key;
  };
@ -91,7 +92,8 @@ in {
    ${access.domain} = {
      inherit locations extraConfig;
    };
-    ${access.localDomain} = mkMerge [ {
+    ${access.localDomain} = mkMerge [
+      {
        inherit (virtualHosts.${access.domain}) useACMEHost;
        local.enable = mkDefault true;
        forceSSL = mkDefault true;
@ -99,8 +101,11 @@ in {
          proxy.websocket.enable = true;
          inherit proxyPass extraConfig;
        };
-    } sslHost ];
-    ${access.tailDomain} = mkIf tailscale.enable (mkMerge [ {
+      }
+      sslHost
+    ];
+    ${access.tailDomain} = mkIf tailscale.enable (mkMerge [
+      {
        inherit (virtualHosts.${access.domain}) useACMEHost;
        addSSL = mkDefault true;
        local.enable = mkDefault true;
@ -108,7 +113,9 @@ in {
          proxy.websocket.enable = true;
          inherit proxyPass extraConfig;
        };
-    } sslHost ]);
+      }
+      sslHost
+    ]);
  };

  config.sops.secrets.access-proxmox = {
--- a/nixos/access/unifi.nix
+++ b/nixos/access/unifi.nix
@ -10,7 +10,9 @@
 in {
  options.services.nginx.access.unifi = with lib.types; {
    global = {
-      enable = mkEnableOption "global access" // {
+      enable =
+        mkEnableOption "global access"
+        // {
          default = access.useACMEHost != null;
        };
      management = mkEnableOption "global management port access";
@ -59,11 +61,13 @@ in {
      };
    in {
      "${access.domain}@management" = mkIf access.global.management {
-        listen = map (addr: {
+        listen =
+          map (addr: {
            inherit addr;
            port = access.managementPort;
            ssl = true;
-        }) nginx.defaultListenAddresses;
+          })
+          nginx.defaultListenAddresses;
        serverName = access.domain;
        default = mkDefault true;
        forceSSL = mkDefault true;
@ -81,7 +85,7 @@ in {
        inherit locations extraConfig;
      };
      ${access.localDomain} = {
-        serverAliases = mkIf tailscale.enable [ access.tailDomain ];
+        serverAliases = mkIf tailscale.enable [access.tailDomain];
        useACMEHost = mkDefault access.useACMEHost;
        addSSL = mkDefault (access.useACMEHost != null);
        kTLS = mkDefault true;
@ -91,7 +95,7 @@ in {
    };
  };
  config.networking.firewall = {
-    interfaces.local.allowedTCPPorts = [ access.managementPort ];
-    allowedTCPPorts = mkIf access.global.management [ access.managementPort ];
+    interfaces.local.allowedTCPPorts = [access.managementPort];
+    allowedTCPPorts = mkIf access.global.management [access.managementPort];
  };
 }
--- a/nixos/access/vouch.nix
+++ b/nixos/access/vouch.nix
@ -35,8 +35,12 @@ in {
    access.vouch = mkIf cfg.enable {
      url = let
        inherit (cfg.settings.vouch) listen;
-        host = if listen == "0.0.0.0" || listen == "[::]" then "localhost" else listen;
-      in mkOptionDefault "http://${host}:${toString cfg.port}";
+        host =
+          if listen == "0.0.0.0" || listen == "[::]"
+          then "localhost"
+          else listen;
+      in
+        mkOptionDefault "http://${host}:${toString cfg.port}";
    };
    virtualHosts = let
      locations = {
@ -46,15 +50,18 @@ in {
            proxy_redirect default;
          '';
        };
-        "/validate" = { config, ... }: {
+        "/validate" = {config, ...}: {
          proxyPass = mkDefault (access.url + "/validate");
          recommendedProxySettings = mkDefault false;
-          extraConfig = if config.local.trusted then ''
+          extraConfig =
+            if config.local.trusted
+            then ''
              if ($http_x_host = ''') {
                set $http_x_host $host;
              }
              proxy_set_header Host $http_x_host;
-          '' else ''
+            ''
+            else ''
              proxy_set_header Host $host;
            '';
        };
--- a/nixos/access/zigbee2mqtt.nix
+++ b/nixos/access/zigbee2mqtt.nix
@ -2,8 +2,7 @@
  config,
  lib,
  ...
-}:
-let
+}: let
  inherit (lib.options) mkOption;
  inherit (lib.modules) mkIf mkDefault mkOptionDefault;
  cfg = config.services.zigbee2mqtt;
@ -46,7 +45,7 @@ in {
        locations."/" = location;
      };
      ${access.localDomain} = {
-        serverAliases = mkIf config.services.tailscale.enable [ access.tailDomain ];
+        serverAliases = mkIf config.services.tailscale.enable [access.tailDomain];
        local.enable = true;
        locations."/" = location;
      };
--- a/nixos/acme.nix
+++ b/nixos/acme.nix
@ -8,18 +8,30 @@
  inherit (lib.lists) head optional;
  cfg = config.security.acme;
  mkHash = with builtins; val: substring 0 20 (hashString "sha256" val);
-  mkAccountHash = { server ? null, keyType, email }: mkHash "${toString server} ${keyType} ${email}";
+  mkAccountHash = {
+    server ? null,
+    keyType,
+    email,
+  }:
+    mkHash "${toString server} ${keyType} ${email}";
  mkHost = server: head (splitString "/" (removePrefix "https://" server));
-  mkAccountDir = { server ? null, email, keyType }: concatStringsSep "/" ([
+  mkAccountDir = {
+    server ? null,
+    email,
+    keyType,
+  }:
+    concatStringsSep "/" ([
        accountDirRoot
-    (mkAccountHash { inherit server email keyType; })
-  ] ++ optional (server != null) (
+        (mkAccountHash {inherit server email keyType;})
+      ]
+      ++ optional (server != null) (
        mkHost server
-  ) ++ [
+      )
+      ++ [
        cfg.defaults.email
      ]);
  accountDirRoot = "/var/lib/acme/.lego/accounts";
-  addr = concatStringsSep "@" [ "gensokyo" "arcn.mx" ];
+  addr = concatStringsSep "@" ["gensokyo" "arcn.mx"];
 in {
  security.acme = {
    acceptTerms = true;
@ -35,16 +47,19 @@ in {
    };
  };
  sops.secrets = let
-    accountDir = mkAccountDir { inherit (cfg.defaults) server email keyType; };
+    accountDir = mkAccountDir {inherit (cfg.defaults) server email keyType;};
    acmeSecret = {
      sopsFile = mkDefault ./secrets/acme.yaml;
      owner = "acme";
      group = "nginx";
    };
  in {
-    acme_account_key = mkMerge [ acmeSecret {
+    acme_account_key = mkMerge [
+      acmeSecret
+      {
        path = accountDir + "/keys/${cfg.defaults.email}.key";
-    } ];
+      }
+    ];
    acme_cloudflare_email = acmeSecret;
    acme_cloudflare_token = acmeSecret;
  };
--- a/nixos/avahi.nix
+++ b/nixos/avahi.nix
@ -26,7 +26,7 @@ in {
    daemon = "avahi-daemon.service";
    avahi-daemon-watchdog = pkgs.writeShellScript "avahi-daemon-watchdog" ''
      set -eu
-      export PATH="$PATH:${makeBinPath [ config.systemd.package pkgs.coreutils pkgs.gnugrep ]}"
+      export PATH="$PATH:${makeBinPath [config.systemd.package pkgs.coreutils pkgs.gnugrep]}"
      while read -r line; do
        if [[ $line = *"Host name conflict"* ]]; then
          if systemctl is-active ${daemon} > /dev/null; then
@ -38,14 +38,15 @@ in {
        fi
      done < <(journalctl -o cat -feu ${daemon} | grep -F 'Host name conflict, retrying with ')
    '';
-  in mkIf (cfg.enable && cfg.publish.enable) {
+  in
+    mkIf (cfg.enable && cfg.publish.enable) {
      avahi-daemon = {
        serviceConfig = {
          inherit RestartSec;
        };
      };
      avahi-daemon-watchdog = {
-      wantedBy = [ daemon ];
+        wantedBy = [daemon];
        serviceConfig = {
          Type = mkOptionDefault "exec";
          ExecStart = [
--- a/nixos/base/access.nix
+++ b/nixos/base/access.nix
@ -28,8 +28,7 @@

  users.users.root = {
    hashedPassword = "$6$i28yOXoo$/WokLdKds5ZHtJHcuyGrH2WaDQQk/2Pj0xRGLgS8UcmY2oMv3fw2j/85PRpsJJwCB2GBRYRK5LlvdTleHd3mB.";
-    openssh.authorizedKeys.keys = with pkgs.lib;
-      (concatLists (mapAttrsToList
+    openssh.authorizedKeys.keys = with pkgs.lib; (concatLists (mapAttrsToList
      (name: user:
        if elem "wheel" user.extraGroups
        then user.openssh.authorizedKeys.keys
--- a/nixos/base/documentation.nix
+++ b/nixos/base/documentation.nix
@ -1,3 +1,3 @@
-{ config, ... }: {
+{config, ...}: {
  documentation.nixos.enable = false;
 }
--- a/nixos/base/kitty.nix
+++ b/nixos/base/kitty.nix
@ -1,5 +1,7 @@
-{ config, pkgs, ... }:
-
 {
-  environment.systemPackages = [ pkgs.buildPackages.buildPackages.kitty.terminfo ];
+  config,
+  pkgs,
+  ...
+}: {
+  environment.systemPackages = [pkgs.buildPackages.buildPackages.kitty.terminfo];
 }
--- a/nixos/base/nix.nix
+++ b/nixos/base/nix.nix
@ -1,4 +1,10 @@
-{ config, options, lib, inputs, ... }: let
+{
+  config,
+  options,
+  lib,
+  inputs,
+  ...
+}: let
  inherit (lib.modules) mkIf mkDefault;
  hasSops = options ? sops;
 in {
@ -25,7 +31,8 @@ in {
        experimental-features = lib.optional (lib.versionAtLeast config.nix.package.version "2.4") "nix-command flakes";
        substituters = [
          "https://gensokyo-infrastructure.cachix.org"
-          "https://arc.cachix.org" "https://kittywitch.cachix.org"
+          "https://arc.cachix.org"
+          "https://kittywitch.cachix.org"
          "https://nix-community.cachix.org"
        ];
        trusted-public-keys = [
@ -36,7 +43,7 @@ in {
          "ryantrinkle.com-1:JJiAKaRv9mWgpVAz8dwewnZe0AzzEAzPkagE9SP5NWI="
        ];
        auto-optimise-store = true;
-        trusted-users = [ "root" "@wheel" ];
+        trusted-users = ["root" "@wheel"];
      };
      extraOptions = mkIf hasSops ''
        !include ${config.sops.secrets.github-access-token-public.path}
@ -47,7 +54,11 @@ in {
        options = mkDefault "--delete-older-than 7d";
      };
    };
-    ${if hasSops then "sops" else null}.secrets.github-access-token-public = {
+    ${
+      if hasSops
+      then "sops"
+      else null
+    }.secrets.github-access-token-public = {
      sopsFile = mkDefault ../secrets/nix.yaml;
      group = mkDefault "users";
      mode = mkDefault "0644";
--- a/nixos/base/nixpkgs.nix
+++ b/nixos/base/nixpkgs.nix
@ -1,7 +1,4 @@
-{
-  inputs,
-  ...
-}: {
+{inputs, ...}: {
  nixpkgs = {
    overlays = [
      inputs.arcexprs.overlays.default
--- a/nixos/base/packages.nix
+++ b/nixos/base/packages.nix
@ -1,11 +1,16 @@
-{ config, lib, pkgs, ... }:
-
 {
-  environment.systemPackages = with pkgs; [
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  environment.systemPackages = with pkgs;
+    [
      neofetch
      smartmontools
      hddtemp
      lm_sensors
      gnupg
-  ] ++ (lib.optional config.programs.gnupg.agent.enable pinentry-curses);
+    ]
+    ++ (lib.optional config.programs.gnupg.agent.enable pinentry-curses);
 }
--- a/nixos/base/shell.nix
+++ b/nixos/base/shell.nix
@ -1,6 +1,4 @@
-{ config, ... }:
-
-{
+{config, ...}: {
  programs.zsh = {
    enable = true;
    enableCompletion = true;
--- a/nixos/base/ssh.nix
+++ b/nixos/base/ssh.nix
@ -29,7 +29,7 @@ in {
  };
  networking.firewall = {
    allowedTCPPorts = [publicPort];
-    interfaces.local.allowedTCPPorts = [ 22 ];
+    interfaces.local.allowedTCPPorts = [22];
  };

  programs.mosh.enable = true;
--- a/nixos/base/time.nix
+++ b/nixos/base/time.nix
@ -1,3 +1,3 @@
-{ config, ... }: {
+{config, ...}: {
  services.tzupdate.enable = true;
 }
--- a/nixos/base/urxvt.nix
+++ b/nixos/base/urxvt.nix
@ -1,6 +1,4 @@
-{ pkgs, ... }:
-
-{
+{pkgs, ...}: {
  environment.systemPackages = [
    pkgs.buildPackages.rxvt-unicode-unwrapped.terminfo
  ];
--- a/nixos/bazarr.nix
+++ b/nixos/bazarr.nix
@ -1,12 +1,9 @@
-{
-  lib,
-  ...
-}: let
+{lib, ...}: let
  inherit (lib.modules) mkDefault;
 in {
  services.bazarr = {
    enable = mkDefault true;
    listenPort = mkDefault 6767;
  };
-  users.users.bazarr.extraGroups = [ "kyuuto" ];
+  users.users.bazarr.extraGroups = ["kyuuto"];
 }
--- a/nixos/ddclient.nix
+++ b/nixos/ddclient.nix
@ -14,26 +14,30 @@ in {
    protocol = mkDefault "cloudflare";
    zone = mkDefault config.networking.domain;
    use = "no";
-    domains = [ ];
-    extraConfig = mkMerge [ (mkIf config.networking.enableIPv6 ''
+    domains = [];
+    extraConfig = mkMerge [
+      (mkIf config.networking.enableIPv6 ''
        usev6=webv6, webv6=https://ipv6.nsupdate.info/myip
-    '') ''
+      '')
+      ''
        usev4=webv4, webv4=https://ipv4.nsupdate.info/myip
        max-interval=1d
-    '' ];
+      ''
+    ];
    passwordFile = config.sops.secrets.dyndns_cloudflare_token.path;
  };
  systemd.services.ddclient = mkIf cfg.enable rec {
-    wants = [ "network-online.target" ];
+    wants = ["network-online.target"];
    after = wants;
-    wantedBy = mkForce [ ];
+    wantedBy = mkForce [];
    serviceConfig = {
      ExecStartPre = let
        inherit (config.systemd.services.ddclient.serviceConfig) RuntimeDirectory;
        prestart-domains = pkgs.writeShellScript "ddclient-prestart-domains" ''
          cat ${config.sops.secrets.dyndns_ddclient_domains.path} >> /run/${RuntimeDirectory}/ddclient.conf
        '';
-      in mkAfter [ "!${prestart-domains}" ];
+      in
+        mkAfter ["!${prestart-domains}"];
      TimeoutStartSec = 90;
      LogFilterPatterns = [
        "~WARNING"
--- a/nixos/deluge.nix
+++ b/nixos/deluge.nix
@ -42,28 +42,32 @@ in {
    parent = builtins.dirOf downloadDir;
    hasCompletedSubdir = completedDir != null && hasPrefix parent completedDir;
    completedSubdir = removePrefix parent completedDir;
-    download = if hasCompletedSubdir then {
+    download =
+      if hasCompletedSubdir
+      then {
        path = parent;
        subdirectories = [
          (builtins.baseNameOf downloadDir)
          completedSubdir
        ];
-    } else {
+      }
+      else {
        path = downloadDir;
      };
    completed = {
      path = cfg.config.move_completed_path;
    };
-  in mkIf cfg.enable (mkAfter [
+  in
+    mkIf cfg.enable (mkAfter [
      download
      (mkIf (completedDir != null && !hasCompletedSubdir) completed)
    ]);
  users.users = mkIf cfg.enable (mkMerge [
    {
-      deluge.extraGroups = [ "kyuuto" ];
+      deluge.extraGroups = ["kyuuto"];
    }
    (mkIf mediatomb.enable {
-      ${mediatomb.user}.extraGroups = [ cfg.group ];
+      ${mediatomb.user}.extraGroups = [cfg.group];
    })
  ]);
 }
--- a/nixos/github-runner/zone.nix
+++ b/nixos/github-runner/zone.nix
@ -14,7 +14,9 @@
  genZoneAttrs = prefix: f: listToAttrs (genZone (i: nameValuePair "${prefix}${toString i}" (f i)));
 in {
  options.services.github-runner-zone = with lib.types; {
-    enable = mkEnableOption "github-runners.zone" // {
+    enable =
+      mkEnableOption "github-runners.zone"
+      // {
        default = true;
      };
    targetName = mkOption {
@ -64,7 +66,7 @@ in {
        enable = mkDefault true;
        ephemeral = mkDefault cfg.ephemeral;
        replace = mkDefault true;
-        extraLabels = [ "ubuntu-latest" ];
+        extraLabels = ["ubuntu-latest"];
        tokenFile = mkDefault config.sops.secrets.github-runner-gensokyo-zone-token.path;
        url = mkDefault "https://github.com/gensokyo-zone";
        group = mkDefault cfg.group;
@ -73,9 +75,9 @@ in {
        };
        networkNamespace.name = mkIf (cfg.networkNamespace.name != null) (mkDefault cfg.networkNamespace.name);
        serviceSettings = {
-          wantedBy = [ "${cfg.targetName}.target" ];
+          wantedBy = ["${cfg.targetName}.target"];
          unitConfig = {
-            StopPropagatedFrom = [ "${cfg.targetName}.target" ];
+            StopPropagatedFrom = ["${cfg.targetName}.target"];
          };
        };
        serviceOverrides = mkIf (!cfg.dynamicUser) {
@ -88,7 +90,8 @@ in {
      };
    };

-    services.github-runners = genZoneAttrs cfg.keyPrefix (i: mkMerge [
+    services.github-runners = genZoneAttrs cfg.keyPrefix (i:
+      mkMerge [
        (unmerged.merge cfg.runnerSettings)
        {
          name = mkDefault "${cfg.namePrefix}${toString i}";
@ -106,13 +109,13 @@ in {
        };
      };
      targets.${cfg.targetName} = {
-        wantedBy = [ "multi-user.target" ];
+        wantedBy = ["multi-user.target"];
      };
    };

    users = mkIf cfg.enable {
      groups = mkIf (cfg.group != null) {
-        ${toString cfg.group} = { };
+        ${toString cfg.group} = {};
      };
      users = mkMerge [
        (mkIf (!cfg.dynamicUser) (genZoneAttrs cfg.userPrefix (i: {
--- a/nixos/home-assistant.nix
+++ b/nixos/home-assistant.nix
@ -85,7 +85,8 @@ in {
        ];
        entity_config = {};
      };
-      homekit = [ {
+      homekit = [
+        {
          name = "Tewi";
          port = 21063;
          filter = let
@ -95,7 +96,8 @@ in {
            include_entities = "!include homekit_include_entities.yaml";
          };
          entity_config = "!include homekit_entity_config.yaml";
-      } ];
+        }
+      ];
      tts = [
        {
          platform = "google_translate";
--- a/nixos/invidious.nix
+++ b/nixos/invidious.nix
@ -1,4 +1,8 @@
-{ config, lib, ... }: let
+{
+  config,
+  lib,
+  ...
+}: let
  inherit (lib.modules) mkIf mkDefault mkForce;
  cfg = config.services.invidious;
 in {
@ -6,12 +10,13 @@ in {
    commonSecret = {
      sopsFile = ./secrets/invidious.yaml;
      owner = "invidious";
-    }; in {
+    };
+  in {
    invidious_db_password = commonSecret;
    invidious_hmac_key = commonSecret;
  };

-  networking.firewall.interfaces.local.allowedTCPPorts = [ cfg.port ];
+  networking.firewall.interfaces.local.allowedTCPPorts = [cfg.port];
  users.groups.invidious = {};
  users.users.invidious = {
    isSystemUser = true;
--- a/nixos/kyuuto/mount.nix
+++ b/nixos/kyuuto/mount.nix
@ -34,7 +34,7 @@ in {
    };
    gameLibraries = mkOption {
      type = listOf str;
-      default = [ "PC" ];
+      default = ["PC"];
    };
  };

@ -42,10 +42,19 @@ in {
    kyuuto = {
      gameLibraries = [
        "PC"
-        "Wii" "Gamecube" "N64" "SNES" "NES"
-        "NDS" "GBA" "GBC"
-        "PS3" "PS2" "PS1"
-        "PSVita" "PSP"
+        "Wii"
+        "Gamecube"
+        "N64"
+        "SNES"
+        "NES"
+        "NDS"
+        "GBA"
+        "GBC"
+        "PS3"
+        "PS2"
+        "PS1"
+        "PSVita"
+        "PSP"
        "Genesis"
      ];
    };
@ -74,7 +83,7 @@ in {
        {
          ${cfg.shareDir} = mkMerge [
            shared
-            { group = "peeps"; }
+            {group = "peeps";}
          ];
          ${cfg.transferDir} = shared;
          ${cfg.libraryDir} = shared;
@ -108,14 +117,19 @@ in {
    };

    users = let
-      mapId = id: if config.proxmoxLXC.privileged or true then 100000 + id else id;
+      mapId = id:
+        if config.proxmoxLXC.privileged or true
+        then 100000 + id
+        else id;
      mkDummyUsers = {
        name,
        group ? name,
-        enable ? !config.services.${serviceName}.enable, serviceName ? name,
+        enable ? !config.services.${serviceName}.enable,
+        serviceName ? name,
        uid ? config.ids.uids.${name},
        gid ? config.ids.gids.${group},
-      }: mkIf enable {
+      }:
+        mkIf enable {
          users.${name} = {
            group = mkIf (group != null) group;
            uid = mapId uid;
@ -125,11 +139,12 @@ in {
            gid = mapId gid;
          };
        };
-    in mkMerge [
-      (mkDummyUsers { name = "deluge"; })
-      (mkDummyUsers { name = "radarr"; })
-      (mkDummyUsers { name = "sonarr"; })
-      (mkDummyUsers { name = "lidarr"; })
+    in
+      mkMerge [
+        (mkDummyUsers {name = "deluge";})
+        (mkDummyUsers {name = "radarr";})
+        (mkDummyUsers {name = "sonarr";})
+        (mkDummyUsers {name = "lidarr";})
      ];
  };
 }
--- a/nixos/kyuuto/nfs.nix
+++ b/nixos/kyuuto/nfs.nix
@ -1,4 +1,3 @@
-
 {
  config,
  lib,
--- a/nixos/kyuuto/opl.nix
+++ b/nixos/kyuuto/opl.nix
@ -10,7 +10,9 @@
  cfg = kyuuto.opl;
 in {
  options.kyuuto.opl = with lib.types; {
-    enable = mkEnableOption "hosting" // {
+    enable =
+      mkEnableOption "hosting"
+      // {
        default = config.services.samba.enable;
      };
    user = mkOption {
@ -39,9 +41,12 @@ in {
      };
      shares.opl = let
        inherit (config.networking.access) cidrForNetwork;
-        localAddrs = cidrForNetwork.loopback.all ++ cidrForNetwork.local.all
+        localAddrs =
+          cidrForNetwork.loopback.all
+          ++ cidrForNetwork.local.all
          ++ lib.optionals config.services.tailscale.enable cidrForNetwork.tail.all;
-      in mkIf cfg.enable {
+      in
+        mkIf cfg.enable {
          comment = "Kyuuto Media OPL";
          path = cfg.rootDir;
          writeable = true;
--- a/nixos/kyuuto/samba.nix
+++ b/nixos/kyuuto/samba.nix
@ -1,4 +1,3 @@
-
 {
  config,
  lib,
@ -9,15 +8,19 @@
  inherit (config.networking.access) cidrForNetwork;
  inherit (config) kyuuto;
  cfg = config.services.samba;
-  localAddrs = cidrForNetwork.loopback.all ++ cidrForNetwork.local.all
+  localAddrs =
+    cidrForNetwork.loopback.all
+    ++ cidrForNetwork.local.all
    ++ optionals config.services.tailscale.enable cidrForNetwork.tail.all;
-  guestUsers = mkIf cfg.guest.enable [ cfg.guest.user ];
+  guestUsers = mkIf cfg.guest.enable [cfg.guest.user];
  kyuuto-media = {
    "create mask" = "0664";
    "force directory mode" = "3000";
    "directory mask" = "7775";
  };
-  kyuuto-library = kyuuto-media // {
+  kyuuto-library =
+    kyuuto-media
+    // {
      "acl group control" = true;
    };
 in {
@ -35,7 +38,7 @@ in {
        public = true;
        "valid users" = mkMerge [
          guestUsers
-          [ "@peeps" ]
+          ["@peeps"]
        ];
        #"guest only" = true;
        "hosts allow" = localAddrs;
@ -54,10 +57,10 @@ in {
          public = true;
          "valid users" = mkMerge [
            guestUsers
-            [ "@kyuuto-peeps" ]
+            ["@kyuuto-peeps"]
          ];
          "read list" = guestUsers;
-          "write list" = [ "@kyuuto-peeps" ];
+          "write list" = ["@kyuuto-peeps"];
          "hosts allow" = localAddrs;
        }
      ];
@ -69,7 +72,7 @@ in {
          writeable = true;
          public = false;
          browseable = false;
-          "valid users" = [ "@kyuuto-peeps" ];
+          "valid users" = ["@kyuuto-peeps"];
        }
      ];
      kyuuto-media = mkMerge [
@ -80,7 +83,7 @@ in {
          writeable = true;
          public = false;
          browseable = false;
-          "valid users" = [ "@kyuuto-peeps" ];
+          "valid users" = ["@kyuuto-peeps"];
        }
      ];
      shared = {
@ -89,7 +92,7 @@ in {
        writeable = true;
        public = false;
        browseable = false;
-        "valid users" = [ "@peeps" ];
+        "valid users" = ["@peeps"];
        "create mask" = "0775";
        "force create mode" = "0010";
        "force directory mode" = "2000";
@ -99,7 +102,7 @@ in {
        writeable = true;
        browseable = true;
        public = false;
-        "valid users" = [ "@peeps" ];
+        "valid users" = ["@peeps"];
        "create mask" = "0664";
        "force directory mode" = "5000";
        "directory mask" = "7775";
@ -108,5 +111,5 @@ in {
  };

  # give guest users proper access to the transfer share
-  users.users.guest.extraGroups = [ "kyuuto" ];
+  users.users.guest.extraGroups = ["kyuuto"];
 }
--- a/nixos/lidarr.nix
+++ b/nixos/lidarr.nix
@ -2,5 +2,5 @@ _: {
  services.lidarr = {
    enable = true;
  };
-  users.users.lidarr.extraGroups = [ "kyuuto" ];
+  users.users.lidarr.extraGroups = ["kyuuto"];
 }
--- a/nixos/mediatomb.nix
+++ b/nixos/mediatomb.nix
@ -12,6 +12,6 @@ in {
    uuid = mkDefault "082fd344-bf69-5b72-a68f-a5a4d88e76b2";
  };
  config.users.users = mkIf cfg.enable {
-    ${cfg.user}.extraGroups = [ "kyuuto" ];
+    ${cfg.user}.extraGroups = ["kyuuto"];
  };
 }
--- a/nixos/nfs.nix
+++ b/nixos/nfs.nix
@ -29,9 +29,9 @@ in {
    idmapd.settings = {
      General.Domain = mkDefault config.networking.domain;
      Translation.GSS-Methods = concatStringsSep "," (
-        [ "static" ]
+        ["static"]
        ++ optional enableLdap "umich_ldap"
-        ++ [ "nsswitch" ]
+        ++ ["nsswitch"]
      );
      Static = {
      };
--- a/nixos/ombi.nix
+++ b/nixos/ombi.nix
@ -1,7 +1,4 @@
-{
-  lib,
-  ...
-}: let
+{lib, ...}: let
  inherit (lib.modules) mkDefault;
 in {
  services.ombi = {
--- a/nixos/plex.nix
+++ b/nixos/plex.nix
@ -1,4 +1,9 @@
-{config, lib, pkgs, ...}: let
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
  inherit (lib.modules) mkIf mkForce mkDefault;
  inherit (lib.strings) escapeShellArg;
  cfg = config.services.plex;
@ -21,7 +26,8 @@ in {
          fi
          ${pkgs.coreutils}/bin/ln -sfT ../Cache "$PLEX_DATADIR/Plex Media Server/Cache"
        '';
-      in mkForce [
+      in
+        mkForce [
          ''!${preStartScript}''
        ];
      # KillMode = "mixed" doesn't behave as expected...
--- a/nixos/postgres.nix
+++ b/nixos/postgres.nix
@ -8,7 +8,7 @@
 in {
  services.postgresql = {
    enable = mkDefault true;
-    ensureDatabases = ["hass" "invidious" "dex"];
+    ensureDatabases = ["hass" "invidious" "dex" "keycloak"];
    ensureUsers = [
      {
        name = "hass";
@ -25,6 +25,11 @@ in {
        ensureDBOwnership = true;
        authentication.local.allow = true;
      }
+      {
+        name = "keycloak";
+        ensureDBOwnership = true;
+        authentication.local.allow = true;
+      }
    ];
  };

--- a/nixos/radarr.nix
+++ b/nixos/radarr.nix
@ -3,5 +3,5 @@ _: {
    enable = true;
  };

-  users.users.radarr.extraGroups = [ "kyuuto" ];
+  users.users.radarr.extraGroups = ["kyuuto"];
 }
--- a/nixos/readarr.nix
+++ b/nixos/readarr.nix
@ -2,5 +2,5 @@ _: {
  services.readarr = {
    enable = true;
  };
-  users.users.readarr.extraGroups = [ "kyuuto" ];
+  users.users.readarr.extraGroups = ["kyuuto"];
 }
--- a/nixos/reisen-ct/filesystem.nix
+++ b/nixos/reisen-ct/filesystem.nix
@ -1,7 +1,4 @@
-{
-  lib,
-  ...
-}: let
+{lib, ...}: let
  inherit (lib) mkDefault;
 in {
  services.kanidm.serverSettings.db_fs_type = mkDefault "zfs";
--- a/nixos/samba.nix
+++ b/nixos/samba.nix
@ -7,7 +7,7 @@
  inherit (lib.lists) any;
  inherit (lib.strings) hasInfix concatMapStringsSep splitString;
  cfg = config.services.samba;
-  hasIpv4 = any (hasInfix ".") config.systemd.network.networks.eth0.address or [ ];
+  hasIpv4 = any (hasInfix ".") config.systemd.network.networks.eth0.address or [];
 in {
  services.samba = {
    enable = mkDefault true;
--- a/nixos/secrets/postgres.yaml
+++ b/nixos/secrets/postgres.yaml
@ -1,4 +1,4 @@
-postgresql-init: ENC[AES256_GCM,data:fW9g0WKVHTO9blqlEXLJejyQUqC3na/Xh6Il2GNfuX6c2LfRjfFSeour4qt2envtPO+WanGl+ueE1AMck5t02TjqrN4a6DsQpAIGFVE7L4ajp/13Gp308pY4Xu7OKHjkGpzVBATKgLDZkoU8yAkqKZCBEU3d4xegp8pgnsLSpb/LndKiITjhTe2IJOSkIJd9twSsra8JQWRYCW8WjZZ9YOe5nqtU+56b/zb0CxVhhln0jU/3e5s7pfblfou2TnvnFezswjNTIGftNU1wOaxSCA==,iv:hjKNZ4EbPpl5YIcaWJYLKJzxuOmMjL4AtfUeL4vm5QA=,tag:mYcu4cRUnZeLgeISfaxXPQ==,type:str]
+postgresql-init: ENC[AES256_GCM,data:lbkeMv6PZgB7tEl4VbIYX9VUAgJ6Kcj0jLNyyqxJJcVJPjo1lF2d/i5bFnU1/6aJ2T7ftMW4hefYgrnIMdKXxPPfrHftaEMhl9bfJIsuX2I1CXAasZOhpsmg9Wf2cvXuVYIlqTVssg+3EKW0ejCMdX6OfGdAXvBlio1DQs7YrUc+BjDiEuAUAaaYbz67EYY3dpYQixQGl/8G2w7S897uCXpc1oOh6vbGY4Nl+GGQ7B5xrrbYcdATwfGyYlZYSlIv8feDsLv7Rt+w3o4tTAxcz+8qZ7KZ6sIsu/nUoYeqoT9MJ8uRpWccXKcBVAFSEooUIHUEBA/QsGizAXBgzCnyLDvuv3DOquo2xeMg0kWM8zsF1f9YRyUKqQ==,iv:RKIvggRZlPocygabF0iKNBThBRFG5rlzrIvGjjt7s0o=,tag:U/XUDJs5J8lHB9BJ5/0fFA==,type:str]
 sops:
    shamir_threshold: 1
    kms: []
@ -33,8 +33,8 @@ sops:
            a3l3bUx5NzdqUGd1TEpGY3UvQWt4TU0KB4MAjvI43FaOiGhWTkwPpeMMiAnX4v3L
            rLZDdc/vegF10FKTNJdxdq1E7ccMaV1KwjQkJoOJnWe6teKLjGOFkA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-02-19T03:46:45Z"
-    mac: ENC[AES256_GCM,data:FMzWnFllHDpgIoDJIKS7aWpUSVNH0+ij0+AIzl3qtjeuzmUUluDtEes6yAR8g/Daq+nxiMRnsse0HfUqZeT0rVVEpqvQB4Wsoq+G9qj8mmEUrHJzjU5rSDWV8uf5F1BsZbvF13VBulh/RWsmWjps+z6vyJ7uM1QjS3hSF2k3hSM=,iv:tpH8XjoTtNzPOOIosObpsvOAzZO7ywK9xjow3xTOJqY=,tag:BTzezbH9zZDZBzy1x+AJ1w==,type:str]
+    lastmodified: "2024-03-13T21:46:56Z"
+    mac: ENC[AES256_GCM,data:rEtRHX3PH1B+uoR82lDH3ACKHPbhxy+y7B9YgR6TzPSU4yIaTSqSK51eLJZoUtW6UTl6QDcTrsKDA8lGu9M/Ohfx8ayp6rkX63H/hkl0h6YaQmWDAQoNAAEWqfJ9r8O8tKKpE6qF/rw4c4KpuA5ONufOl9qj1KSgFzz0WHaKtWk=,iv:TUBAe62dmF6FAjZOPaxwzQjWL21TdWQG0YyuXJGgtk8=,tag:dewWivfnZO30Np2gajwLIw==,type:str]
    pgp:
        - created_at: "2024-01-19T19:08:55Z"
          enc: |-
--- a/nixos/sonarr.nix
+++ b/nixos/sonarr.nix
@ -2,5 +2,5 @@ _: {
  services.sonarr = {
    enable = true;
  };
-  users.users.sonarr.extraGroups = [ "kyuuto" ];
+  users.users.sonarr.extraGroups = ["kyuuto"];
 }
--- a/nixos/sops.nix
+++ b/nixos/sops.nix
@ -1,8 +1,13 @@
-{ lib, inputs,  ... }: with lib; {
+{
+  lib,
+  inputs,
+  ...
+}:
+with lib; {
  imports = [
    inputs.sops-nix.nixosModules.sops
  ];
  sops = {
-    age.sshKeyPaths = mkDefault [ "/etc/ssh/ssh_host_ed25519_key" ];
+    age.sshKeyPaths = mkDefault ["/etc/ssh/ssh_host_ed25519_key"];
  };
 }
--- a/nixos/steam/account-switch.nix
+++ b/nixos/steam/account-switch.nix
@ -1,7 +1,4 @@
-{
-  lib,
-  ...
-}: let
+{lib, ...}: let
  inherit (lib.modules) mkDefault;
 in {
  services.steam.accountSwitch = {
--- a/nixos/steam/beatsaber.nix
+++ b/nixos/steam/beatsaber.nix
@ -1,15 +1,12 @@
-{
-  lib,
-  ...
-}: let
+{lib, ...}: let
  inherit (lib.modules) mkDefault;
 in {
  services.steam.beatsaber = {
    enable = mkDefault true;
    defaultVersion = mkDefault "1.29.0";
    versions = {
-      "1.29.0" = { };
-      "1.34.2" = { };
+      "1.29.0" = {};
+      "1.34.2" = {};
    };
  };
 }
--- a/nixos/syncthing-kat/syncthing.nix
+++ b/nixos/syncthing-kat/syncthing.nix
@ -1,4 +1,4 @@
-{ config, ... }: {
+{config, ...}: {
  services.syncthing = {
    enable = true;
    relay.enable = true;
--- a/nixos/systemd2mqtt.nix
+++ b/nixos/systemd2mqtt.nix
@ -10,7 +10,8 @@ in {
    enable = mkDefault true;
    user = mkDefault "root";
    mqtt = {
-      url = mkDefault (if config.services.mosquitto.enable
+      url = mkDefault (
+        if config.services.mosquitto.enable
        then "tcp://localhost:1883"
        else "tcp://mqtt.local.${config.networking.domain}:1883"
      );
--- a/nixos/tautulli.nix
+++ b/nixos/tautulli.nix
@ -1,4 +1,8 @@
-{config, lib, ...}: let
+{
+  config,
+  lib,
+  ...
+}: let
  inherit (lib.modules) mkIf mkDefault;
  cfg = config.services.tautulli;
 in {
--- a/nixos/users/arc.nix
+++ b/nixos/users/arc.nix
@ -1,22 +1,22 @@
-{ config, ... }:
-
-{
-  users.users.arc = { name, ... }: {
+{config, ...}: {
+  users.users.arc = {name, ...}: {
    uid = 8001;
    isNormalUser = true;
    autoSubUidGidRange = false;
    group = name;
    extraGroups = [
-      "users" "peeps"
+      "users"
+      "peeps"
      "kyuuto"
-      "steamaccount" "beatsaber"
+      "steamaccount"
+      "beatsaber"
      "wheel"
    ];
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ8Z6briIboxIdedPGObEWB6QEQkvxKvnMW/UVU9t/ac mew-pgp"
    ];
  };
-  users.groups.arc = { name, ... }: {
+  users.groups.arc = {name, ...}: {
    gid = config.users.users.${name}.uid;
  };
 }
--- a/nixos/users/connie.nix
+++ b/nixos/users/connie.nix
@ -1,17 +1,16 @@
-{ config, ... }:
-
-{
-  users.users.connieallure = { name, ... }: {
+{config, ...}: {
+  users.users.connieallure = {name, ...}: {
    uid = 8003;
    isNormalUser = true;
    autoSubUidGidRange = false;
    group = name;
    extraGroups = [
-      "users" "peeps"
+      "users"
+      "peeps"
      "kyuuto"
    ];
  };
-  users.groups.connieallure = { name, ... }: {
+  users.groups.connieallure = {name, ...}: {
    gid = config.users.users.${name}.uid;
  };
 }
--- a/nixos/users/kaosu.nix
+++ b/nixos/users/kaosu.nix
@ -1,18 +1,18 @@
-{ config, ... }:
-
-{
-  users.users.kaosubaloo = { name, ... }: {
+{config, ...}: {
+  users.users.kaosubaloo = {name, ...}: {
    uid = 8002;
    isNormalUser = true;
    autoSubUidGidRange = false;
    group = name;
    extraGroups = [
-      "users" "peeps"
+      "users"
+      "peeps"
      "kyuuto"
-      "steamaccount" "beatsaber"
+      "steamaccount"
+      "beatsaber"
    ];
  };
-  users.groups.kaosubaloo = { name, ... }: {
+  users.groups.kaosubaloo = {name, ...}: {
    gid = config.users.users.${name}.uid;
  };
 }
--- a/nixos/users/kat.nix
+++ b/nixos/users/kat.nix
@ -1,25 +1,25 @@
-{ config, ... }:
-
-{
-  users.users.kat = { name, ... }: {
+{config, ...}: {
+  users.users.kat = {name, ...}: {
    uid = 8000;
    isNormalUser = true;
    autoSubUidGidRange = false;
    group = name;
    extraGroups = [
-      "users" "peeps"
+      "users"
+      "peeps"
      "kyuuto"
-      "steamaccount" "beatsaber"
+      "steamaccount"
+      "beatsaber"
      "wheel"
    ];
    openssh.authorizedKeys.keys = [
      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCocjQqiDIvzq+Qu3jkf7FXw5piwtvZ1Mihw9cVjdVcsra3U2c9WYtYrA3rS50N3p00oUqQm9z1KUrvHzdE+03ZCrvaGdrtYVsaeoCuuvw7qxTQRbItTAEsfRcZLQ5c1v/57HNYNEsjVrt8VukMPRXWgl+lmzh37dd9w45cCY1QPi+JXQQ/4i9Vc3aWSe4X6PHOEMSBHxepnxm5VNHm4PObGcVbjBf0OkunMeztd1YYA9sEPyEK3b8IHxDl34e5t6NDLCIDz0N/UgzCxSxoz+YJ0feQuZtud/YLkuQcMxW2dSGvnJ0nYy7SA5DkW1oqcy6CGDndHl5StOlJ1IF9aGh0gGkx5SRrV7HOGvapR60RphKrR5zQbFFka99kvSQgOZqSB3CGDEQGHv8dXKXIFlzX78jjWDOBT67vA/M9BK9FS2iNnBF5x6shJ9SU5IK4ySxq8qvN7Us8emkN3pyO8yqgsSOzzJT1JmWUAx0tZWG/BwKcFBHfceAPQl6pwxx28TM3BTBRYdzPJLTkAy48y6iXW6UYdfAPlShy79IYjQtEThTuIiEzdzgYdros0x3PDniuAP0KOKMgbikr0gRa6zahPjf0qqBnHeLB6nHAfaVzI0aNbhOg2bdOueE1FX0x48sjKqjOpjlIfq4WeZp9REr2YHEsoLFOBfgId5P3BPtpBQ== yubikey5"
-"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDPsu3vNsvBb/G+wALpstD/DnoRZ3fipAs00jtl8rzDuv96RlS7AJr4aNvG6Pt2D9SYn2wVLaiw+76mz2gOycH9/N+VCvL4/0MN9uqj+7XIcxNRo0gHVOblmi2bOXcmGKh3eRwHj1xyDwRxo9WIuBEP2bPpDPz75OXRtEdlTgvky7siSguQxJu03cb0p9hNAYhUoohNXyWW2CjDCLUQVE1+QRVUzsKq3KkPy0cHYgmZC1gRSMQyKpMt72L5tayLz3Tp/zrshucc+QO5IJeZdqMxsNAcvALsysT1J5EqxZoYH9VpWLRhSgVD6Nvn853pycJAlXQxgOCpSD3/v/JbgUe5NE+ci0o7NMy5IiHUv2gQMRIEhwBHlRGwokUPL9upx0lsjaEiPya5xQqqDKRom87xytM778ANS5CuMdQMWg9qVbpHZUHMjA0QmNkjPgq71pUDXHk5L4mZuS8wVjyjnvlw68yIJuHEc8P7QiLcjvRHFS2L9Ck8NRmPDTQXlQi9kk6LmMyu6fdevR/kZL21b+xO1e2DMyxBbNDTot8luppiiL8adgUDMwptpIne7JCWB1o9NFCbXUVgwuCCYBif6pOGSc6bGo1JTAKMflRlcy6Mi3t5H0mR2lj/sCSTWwTlP5FM4aPIq08NvW6PeuK1bFJY9fIgTwVsUnbAKOhmsMt62w== cardno:12 078 454"
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDPsu3vNsvBb/G+wALpstD/DnoRZ3fipAs00jtl8rzDuv96RlS7AJr4aNvG6Pt2D9SYn2wVLaiw+76mz2gOycH9/N+VCvL4/0MN9uqj+7XIcxNRo0gHVOblmi2bOXcmGKh3eRwHj1xyDwRxo9WIuBEP2bPpDPz75OXRtEdlTgvky7siSguQxJu03cb0p9hNAYhUoohNXyWW2CjDCLUQVE1+QRVUzsKq3KkPy0cHYgmZC1gRSMQyKpMt72L5tayLz3Tp/zrshucc+QO5IJeZdqMxsNAcvALsysT1J5EqxZoYH9VpWLRhSgVD6Nvn853pycJAlXQxgOCpSD3/v/JbgUe5NE+ci0o7NMy5IiHUv2gQMRIEhwBHlRGwokUPL9upx0lsjaEiPya5xQqqDKRom87xytM778ANS5CuMdQMWg9qVbpHZUHMjA0QmNkjPgq71pUDXHk5L4mZuS8wVjyjnvlw68yIJuHEc8P7QiLcjvRHFS2L9Ck8NRmPDTQXlQi9kk6LmMyu6fdevR/kZL21b+xO1e2DMyxBbNDTot8luppiiL8adgUDMwptpIne7JCWB1o9NFCbXUVgwuCCYBif6pOGSc6bGo1JTAKMflRlcy6Mi3t5H0mR2lj/sCSTWwTlP5FM4aPIq08NvW6PeuK1bFJY9fIgTwVsUnbAKOhmsMt62w== cardno:12 078 454"
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII74JrgGsDQ6r7tD7+k3ykxXV7DpeeFRscPMxrBsDPhz kat@goliath"
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDkeBFF4xxZgeURLzNHcvUFxImmkQ3pxXtpj3mtSyHXB kat@koishi"
    ];
  };
-  users.groups.kat = { name, ... }: {
+  users.groups.kat = {name, ...}: {
    gid = config.users.users.${name}.uid;
  };
 }
--- a/overlays/default.nix
+++ b/overlays/default.nix
@ -1,8 +1,10 @@
-{inputs, system}: {
+{
+  inputs,
+  system,
+}: {
  pkgs = import inputs.nixpkgs {
    inherit system;
-    overlays =
-      [
+    overlays = [
      inputs.deploy-rs.overlay
      inputs.arcexprs.overlays.default
      (final: prev: {
--- a/packages/default.nix
+++ b/packages/default.nix
@ -12,7 +12,7 @@
    export NF_CONFIG_ROOT=''${NF_CONFIG_ROOT-${toString ../.}}
  '';
  exportsSsh = ''
-    export PATH="${makeBinPath [ packages.nf-hostname packages.nf-sshopts ]}:$PATH"
+    export PATH="${makeBinPath [packages.nf-hostname packages.nf-sshopts]}:$PATH"
  '';
  exportsFmtNix = ''
    NF_NIX_BLACKLIST_DIRS=(${string.concatMapSep " " string.escapeShellArg fmt.nix.blacklistDirs})
@ -20,10 +20,15 @@
    NF_NIX_WHITELIST_FILES=(${string.concatMapSep " " string.escapeShellArg fmt.nix.whitelist})
  '';
  output = {
-    inherit (pkgs.buildPackages)
-      terraform tflint
-      alejandra deadnix statix
-      ssh-to-age jq
+    inherit
+      (pkgs.buildPackages)
+      terraform
+      tflint
+      alejandra
+      deadnix
+      statix
+      ssh-to-age
+      jq
      ;
    inherit (inputs.deploy-rs.packages.${system}) deploy-rs;
    nf-deploy = pkgs.writeShellScriptBin "nf-deploy" ''
@ -52,7 +57,8 @@
        INPUT_INFRA_CT_CONFIG = reisen + "/bin/ct-config.sh";
      };
      inputVars = set.mapToValues (key: path: ''${key}="$(base64 -w0 < ${path})"'') inputAttrs;
-    in pkgs.writeShellScriptBin "nf-setup-node" ''
+    in
+      pkgs.writeShellScriptBin "nf-setup-node" ''
        ${exports}
        NF_SETUP_INPUTS=(
          ${string.intercalate "\n" inputVars}
@ -65,13 +71,13 @@
    '';
    nf-sshopts = pkgs.writeShellScriptBin "nf-sshopts" ''
      ${exports}
-      export PATH="$PATH:${makeBinPath [ pkgs.jq ]}"
+      export PATH="$PATH:${makeBinPath [pkgs.jq]}"
      source ${../ci/sshopts.sh}
    '';
    nf-sops-keyscan = pkgs.writeShellScriptBin "nf-sops-keyscan" ''
      ${exports}
      ${exportsSsh}
-      export PATH="$PATH:${makeBinPath [ pkgs.ssh-to-age ]}"
+      export PATH="$PATH:${makeBinPath [pkgs.ssh-to-age]}"
      source ${../ci/sops-keyscan.sh}
    '';
    nf-ssh = pkgs.writeShellScriptBin "nf-ssh" ''
@ -94,39 +100,39 @@
    '';
    nf-generate = pkgs.writeShellScriptBin "nf-generate" ''
      ${exports}
-      export PATH="$PATH:${makeBinPath [ pkgs.jq ]}"
+      export PATH="$PATH:${makeBinPath [pkgs.jq]}"
      source ${../ci/generate.sh}
    '';
    nf-statix = pkgs.writeShellScriptBin "nf-statix" ''
      ${exports}
-      export PATH="${makeBinPath [ packages.statix ]}:$PATH"
+      export PATH="${makeBinPath [packages.statix]}:$PATH"
      source ${../ci/statix.sh}
    '';
    nf-deadnix = pkgs.writeShellScriptBin "nf-deadnix" ''
      ${exports}
      ${exportsFmtNix}
-      export PATH="${makeBinPath [ packages.deadnix pkgs.findutils ]}:$PATH"
+      export PATH="${makeBinPath [packages.deadnix pkgs.findutils]}:$PATH"
      source ${../ci/deadnix.sh}
    '';
    nf-alejandra = pkgs.writeShellScriptBin "nf-alejandra" ''
      ${exports}
      ${exportsFmtNix}
-      export PATH="${makeBinPath [ packages.alejandra ]}:$PATH"
+      export PATH="${makeBinPath [packages.alejandra]}:$PATH"
      source ${../ci/alejandra.sh}
    '';
    nf-lint-tf = pkgs.writeShellScriptBin "nf-lint-tf" ''
      ${exports}
-      export PATH="$PATH:${makeBinPath [ packages.tflint ]}"
+      export PATH="$PATH:${makeBinPath [packages.tflint]}"
      source ${../ci/lint-tf.sh}
    '';
    nf-lint-nix = pkgs.writeShellScriptBin "nf-lint-nix" ''
      ${exports}
-      export PATH="${makeBinPath [ packages.nf-statix packages.nf-deadnix ]}:$PATH"
+      export PATH="${makeBinPath [packages.nf-statix packages.nf-deadnix]}:$PATH"
      source ${../ci/lint-nix.sh}
    '';
    nf-fmt-tf = pkgs.writeShellScriptBin "nf-fmt-tf" ''
      ${exports}
-      export PATH="${makeBinPath [ packages.terraform ]}:$PATH"
+      export PATH="${makeBinPath [packages.terraform]}:$PATH"
      source ${../ci/fmt-tf.sh}
    '';
    nf-fmt-nix = pkgs.writeShellScriptBin "nf-fmt-nix" ''
@ -144,4 +150,5 @@
      inherit (inputs) self;
    };
  };
-in output
+in
+  output
--- a/packages/snakeoil.nix
+++ b/packages/snakeoil.nix
@ -5,12 +5,17 @@
 }: let
  inherit (lib.strings) concatStringsSep;
  inherit (lib.lists) toList head;
-in { domain, name }: runCommand name {
+in
+  {
+    domain,
+    name,
+  }:
+    runCommand name {
      domains = concatStringsSep "," (toList domain);
      domain = head (toList domain);
-  nativeBuildInputs = [ buildPackages.minica ];
-  outputs = [ "out" "key" "cakey" "ca" "cert" "fullchain" ];
-} ''
+      nativeBuildInputs = [buildPackages.minica];
+      outputs = ["out" "key" "cakey" "ca" "cert" "fullchain"];
+    } ''
      install -d $out
      minica \
        --ca-key ca.key.pem \
@ -27,4 +32,4 @@ in { domain, name }: runCommand name {
      ln -s $cakey $out/ca.key.pem
      ln -s $cert $out/cert.pem
      ln -s $ca $out/ca.pem
-''
+    ''