Format project using nixfmt rfc candidate.

config/etc.nix

@@ -4,11 +4,12 @@
   pkgs,
   ...
 }:
-with lib; {
+with lib;
+{
   environment.etc = mkIf (elem "etcfiles" config.machine.conffiles) {
-    "rofi.rasi".source = import ./etc/rofi.rasi.nix {inherit pkgs;};
+    "rofi.rasi".source = import ./etc/rofi.rasi.nix { inherit pkgs; };
     "i3/py3status".source = ./etc/i3/py3status;
-    "sway/config".source = mkDefault (import ./etc/sway/config.nix {inherit pkgs;});
+    "sway/config".source = mkDefault (import ./etc/sway/config.nix { inherit pkgs; });
     "mpv/input.conf".source = ./etc/mpv/input.conf;
     "mpv/mpv.conf".source = ./etc/mpv/mpv.conf;
     "youtube-dl.conf".source = ./etc/youtube-dl.conf;

config/etc/i3/config.nix

@@ -1,4 +1,5 @@
-{pkgs, ...}: (pkgs.writeText "config" ''
+{ pkgs, ... }:
+(pkgs.writeText "config" ''
   # i3 config file (v4)
   #
   # Please see http://i3wm.org/docs/userguide.html for a complete reference!

config/etc/rofi.rasi.nix

@@ -1,5 +1,8 @@
-{pkgs}: let
+{ pkgs }:
-  tabMode = pkgs.writeScript "tab-finder.sh" (with pkgs; /* bash */ ''
+let
+  tabMode = pkgs.writeScript "tab-finder.sh" (
+    with pkgs; # bash
+    ''
       #!/usr/bin/env bash
       if [ -z ''${1} ]; then
         ${brotab}/bin/bt list;
@@ -12,9 +15,10 @@
         fi
       fi
       exit 0;
-  '');
+    ''
+  );
 in
-  pkgs.writeText "rofi.rasi" ''
+pkgs.writeText "rofi.rasi" ''
   configuration {
     modi: "combi,window,drun,ssh,tabFinder:${tabMode}";
     font: "hack 10";
@@ -23,4 +27,4 @@ in
     show-icons: true;
   }
   @theme "DarkBlue"
-  ''
+''

config/etc/sway/config.nix

@@ -1,8 +1,10 @@
-{pkgs}:
+{ pkgs }:
 
 let
   # TODO/FIX: pkgs.sway-unwrapped is not the same sway derivation as the one running the desktop
-  grim-wrapper = pkgs.writeShellScript "grim-wrapper" /* bash */ ''
+  grim-wrapper =
+    pkgs.writeShellScript "grim-wrapper" # bash
+      ''
         OUTPUT_DIR="$(${pkgs.xdg-user-dirs}/bin/xdg-user-dir PICTURES)"
         DATE="$(${pkgs.coreutils}/bin/date +'%Y-%m-%d;%H:%M:%S;')";
         WINDOW_LIST="$(${pkgs.sway-unwrapped}/bin/swaymsg -t get_tree | ${pkgs.jq}/bin/jq -r '.. | select(.pid? and .visible?) | "\(.rect.x+.window_rect.x),\(.rect.y+.window_rect.y) \(.window_rect.width)x\(.window_rect.height) \(.app_id):\(.name)"' | ${pkgs.coreutils}/bin/tr -d '"/;\\')";
@@ -29,8 +31,8 @@ let
             ;;
         esac;
       '';
-in pkgs.writeText "config"
+in
-''
+pkgs.writeText "config" ''
   include /etc/sway/config.d/*
 
   # Read `man 5 sway` for a complete reference.

config/fonts.nix

@@ -5,7 +5,7 @@
   ...
 }:
 with lib;
-  mkIf (elem "fonts" config.machine.conffiles) {
+mkIf (elem "fonts" config.machine.conffiles) {
   fonts = {
     fontDir.enable = true;
     enableGhostscriptFonts = true;
@@ -21,4 +21,4 @@ with lib;
       })
     ];
   };
-  }
+}

config/locale.nix

@@ -3,17 +3,22 @@
   lib,
   pkgs,
   ...
-}: {
+}:
+{
   console.keyMap = "de";
   i18n = {
     defaultLocale = "en_US.UTF-8";
-    supportedLocales = ["all"];
+    supportedLocales = [ "all" ];
     inputMethod = {
       enable = (lib.elem "desktop" config.machine.services);
       type = "fcitx5";
       fcitx5 = {
         waylandFrontend = true;
-        addons = with pkgs; [fcitx5-chinese-addons fcitx5-mozc fcitx5-table-extra];
+        addons = with pkgs; [
+          fcitx5-chinese-addons
+          fcitx5-mozc
+          fcitx5-table-extra
+        ];
       };
     };
   };

config/networking.nix

@@ -3,9 +3,11 @@
   lib,
   ...
 }:
-with lib; let
+with lib;
+let
   inherit (config.machine) networkD;
-in {
+in
+{
   networking = {
     inherit (config.machine) hostName;
     useNetworkd = networkD.enable;
@@ -16,14 +18,19 @@ in {
   # https://github.com/NixOS/nixpkgs/issues/10001#issuecomment-905532069
   systemd.network = mkIf networkD.enable {
     enable = true;
-    networks = let
+    networks =
+      let
         networkConfig = {
           DHCP = "yes";
           DNSSEC = "yes";
           DNSOverTLS = "yes";
-        DNS = ["1.1.1.1" "1.0.0.1"];
+          DNS = [
+            "1.1.1.1"
+            "1.0.0.1"
+          ];
         };
-    in {
+      in
+      {
         "40-wired" = {
           enable = true;
           name = "en*";

config/nix.nix

@@ -6,10 +6,12 @@
   config,
   lib,
   ...
-}: let
+}:
+let
   cfg = config.machine;
   emptyGlobalRegistry = pkgs.writeText "registry.json" ''{ "flakes": [], "version": 2 }'';
-in {
+in
+{
   nix = {
     package = pkgs.nix;
     registry = {
@@ -22,19 +24,15 @@ in {
       cores = 1;
       sandbox = true;
       auto-optimise-store = true;
-      trusted-substituters =
+      trusted-substituters = [
-        [
         "https://cache.nixos.org"
-        ]
+      ] ++ cfg.binaryCaches;
-        ++ cfg.binaryCaches;
       # TODO: integrate into sops
       # trusted-public-keys = [ (lib.fileContents "${cfg.secretPath}/hydra_cache.pub") ];
-      substituters =
+      substituters = [
-        [
         "https://cache.nixos.org"
-        ]
+      ] ++ cfg.binaryCaches;
-        ++ cfg.binaryCaches;
+      allowed-users = [ "root" ] ++ (map (n: n.name) cfg.administrators);
-      allowed-users = ["root"] ++ (map (n: n.name) cfg.administrators);
     };
     extraOptions = ''
       build-timeout = 86400  # 24 hours

config/security.nix

@@ -4,9 +4,9 @@
   ...
 }:
 with lib;
-  mkIf (elem "security" config.machine.conffiles) {
+mkIf (elem "security" config.machine.conffiles) {
   security = {
     audit.enable = true;
     auditd.enable = true;
   };
-  }
+}

config/users.nix

@@ -5,15 +5,18 @@
   pkgs,
   ...
 }:
-with lib; let
+with lib;
+let
   withDocker = config.virtualisation.docker.enable;
   withPodman = config.virtualisation.podman.enable;
   administrators = user: {
     inherit (user) name;
-    value = let
+    value =
+      let
         cfg = config.services;
         passPath = config.sops.secrets."users/${user.name}/password".path;
-    in {
+      in
+      {
         isNormalUser = true;
         inherit (user) name;
         uid = user.id;
@@ -30,9 +33,19 @@ with lib; let
         description = "Administrative user ${user.name}.";
         group = user.name;
         extraGroups =
-        ["audio" "wheel" "network"]
+          [
-        ++ (optionals (lib.elem "desktop" config.machine.services) ["input" "video"])
+            "audio"
-        ++ (optionals cfg.printing.enable ["cups" "lp"])
+            "wheel"
+            "network"
+          ]
+          ++ (optionals (lib.elem "desktop" config.machine.services) [
+            "input"
+            "video"
+          ])
+          ++ (optionals cfg.printing.enable [
+            "cups"
+            "lp"
+          ])
           ++ (optional (withDocker && !withPodman) "docker")
           ++ (optional withPodman "podman");
         shell = "${pkgs.zsh}/bin/zsh";
@@ -45,15 +58,14 @@ with lib; let
     value = {
       inherit (user) name;
       gid = user.id;
-      members = [user.name];
+      members = [ user.name ];
     };
   };
-in {
+in
-  sops.secrets =
+{
-    fn.sopsHelper
+  sops.secrets = fn.sopsHelper (user: "users/${user.name}/password") config.machine.administrators {
-    (user: "users/${user.name}/password")
+    neededForUsers = true;
-    config.machine.administrators
+  };
-    {neededForUsers = true;};
   users = {
     mutableUsers = false;
     users = listToAttrs (map administrators config.machine.administrators);

config/zsh.nix

@@ -4,7 +4,7 @@
   ...
 }:
 with lib;
-  mkIf (elem "zsh" config.machine.conffiles) {
+mkIf (elem "zsh" config.machine.conffiles) {
   programs.zsh = {
     enable = true;
     autosuggestions.enable = true;
@@ -31,8 +31,17 @@ with lib;
 
     ohMyZsh = {
       enable = true;
-        plugins = ["cabal" "docker" "gitfast" "python" "pip" "sudo" "systemd" "man"];
+      plugins = [
+        "cabal"
+        "docker"
+        "gitfast"
+        "python"
+        "pip"
+        "sudo"
+        "systemd"
+        "man"
+      ];
       theme = "gentoo";
     };
   };
-  }
+}

flake.nix

@@ -18,7 +18,8 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
-  outputs = {
+  outputs =
+    {
       self,
       nixpkgs,
       flake-utils,
@@ -26,11 +27,12 @@
       mailserver,
       sops-nix,
       ...
-  } @ attrs:
+    }@attrs:
     flake-utils.lib.eachDefaultSystem (
-      system: let
+      system:
+      let
         inherit (nixpkgs) lib;
-        fn = import ./fn.nix {inherit lib;};
+        fn = import ./fn.nix { inherit lib; };
         pkgs = nixpkgs.legacyPackages."${system}";
         machineList = fn.lst {
           p = toString ./machines;
@@ -39,7 +41,8 @@
         };
         nixosSystemFor = machine: {
           name = machine;
-          value = let
+          value =
+            let
               configFiles = fn.lst {
                 p = toString ./config;
                 b = true;
@@ -52,33 +55,38 @@
                 p = toString ./services;
                 b = true;
               };
-            machinePath = lib.concatStringsSep "/" [(toString ./.) "machines" machine];
+              machinePath = lib.concatStringsSep "/" [
-            machineFiles = lib.filter (lib.strings.hasSuffix ".nix") (fn.lst {
+                (toString ./.)
+                "machines"
+                machine
+              ];
+              machineFiles = lib.filter (lib.strings.hasSuffix ".nix") (
+                fn.lst {
                   p = machinePath;
                   b = true;
-            });
+                }
+              );
             in
             nixpkgs.lib.nixosSystem {
               inherit system;
-              specialArgs =
+              specialArgs = attrs // {
-                attrs
-                // {
                 inherit system;
                 inherit fn;
               };
-              modules =
+              modules = [
-                [
+                (
-                  ({config, ...}: {config.nixpkgs.overlays = [nixpkgs-wayland.overlay];})
+                  { config, ... }:
+                  {
+                    config.nixpkgs.overlays = [ nixpkgs-wayland.overlay ];
+                  }
+                )
                 (toString ./options/machine.nix)
                 sops-nix.nixosModules.sops
-                ]
+              ] ++ machineFiles ++ configFiles ++ pkgsFiles ++ serviceFiles;
-                ++ machineFiles
-                ++ configFiles
-                ++ pkgsFiles
-                ++ serviceFiles;
             };
         };
-      in {
+      in
+      {
         apps = {
           "lint" = {
             type = "app";

fn.nix

@@ -1,85 +1,94 @@
-{lib}:
+{ lib }:
 with builtins;
-with lib; rec {
+with lib;
-  ifelse = a: b: c:
+rec {
-    if a
+  ifelse =
-    then b
+    a: b: c:
-    else c;
+    if a then b else c;
-  fileContentsOr = a: b: (ifelse
+  fileContentsOr = a: b: (ifelse (pathIsRegularFile a) a b);
-    (pathIsRegularFile a)
-    a
-    b);
   cwd = builtins.getEnv "PWD";
 
   # lst (string PATH) (string FILETYPE) (bool RETURNFULLPATH)
-  lst = {
+  lst =
+    {
       p ? cwd,
       t ? "regular",
       b ? false,
-  }: (lists.forEach
+    }:
-    (attrNames
+    (lists.forEach (attrNames (filterAttrs (n: v: v == t) (readDir p))) (
-      (filterAttrs (n: v: v == t)
+      v: ((optionalString b "${p}/") + v)
-        (readDir p)))
+    ));
-    (v: ((optionalString b "${p}/") + v)));
+  lsf = p: (lst { inherit p; });
-  lsf = p: (lst {inherit p;});
+  lsd =
-  lsd = p: (lst {
+    p:
+    (lst {
       inherit p;
       t = "directory";
       b = true;
     });
-  lsfRec = p: b:
+  lsfRec =
-    flatten ((map (np: lsfRec np b) (lsd p))
+    p: b:
+    flatten (
+      (map (np: lsfRec np b) (lsd p))
       ++ (lst {
         inherit p;
         inherit b;
-      }));
+      })
-  hasAttrs = aList: d: (map
+    );
-    (a: (ifelse (isList a)
+  hasAttrs = aList: d: (map (a: (ifelse (isList a) (hasAttrByPath a d) (hasAttr a d))) aList);
-      (hasAttrByPath a d)
-      (hasAttr a d)))
-    aList);
 
   # Not sure how list operations are implemented in Nix
   # This might be a tad bit inefficient.
   # TODO: look for better implementation (map is a builtin function so checking that probably won't help)
   # Sequentially checks elements of list (l) for condition (cond) and executes do on first match.
-  meetsConDo = cond: do: l:
+  meetsConDo =
-    ifelse (l == []) false
+    cond: do: l:
-    (let
+    ifelse (l == [ ]) false (
+      let
         h = head l;
         t = tail l;
       in
-      ifelse (cond h) (do h)
+      ifelse (cond h) (do h) (meetsConDo cond do t)
-      (meetsConDo cond do t));
+    );
-  deps = p:
+  deps =
-    ifelse (isAttrs p) (
+    p:
-      filter isAttrs
+    ifelse (isAttrs p) (filter isAttrs (
-      (p.buildInputs ++ p.nativeBuildInputs ++ p.propagatedBuildInputs ++ p.propagatedNativeBuildInputs)
+      p.buildInputs ++ p.nativeBuildInputs ++ p.propagatedBuildInputs ++ p.propagatedNativeBuildInputs
-    ) [];
+    )) [ ];
   importFilter = l: filter (n: elem (nameFromURL (toString n) ".") l);
-  depsRec = ld: ifelse (ld == []) [] ((toList ld) ++ (depsRec (lists.unique (lists.flatten (map deps (toList ld))))));
+  depsRec =
-  isBroken = p:
+    ld:
-    meetsConDo (s: ((hasAttrByPath s.path p) && (s.check (getAttrFromPath s.path p)))) (s: s.msg)
+    ifelse (ld == [ ]) [ ] (
-    [
+      (toList ld) ++ (depsRec (lists.unique (lists.flatten (map deps (toList ld)))))
+    );
+  isBroken =
+    p:
+    meetsConDo (s: ((hasAttrByPath s.path p) && (s.check (getAttrFromPath s.path p)))) (s: s.msg) [
       {
-        path = ["meta" "broken"];
+        path = [
+          "meta"
+          "broken"
+        ];
         msg = warn "Package ${p.name} is marked as broken." true;
         check = m: m;
       }
       {
-        path = ["meta" "knownVulnerabilities"];
+        path = [
+          "meta"
+          "knownVulnerabilities"
+        ];
         msg = warn "Package ${p.name} has known Vulnerabilities.." true;
-        check = m: m != [];
+        check = m: m != [ ];
       }
       {
-        path = ["name"];
+        path = [ "name" ];
         msg = warn "${p.name}: python2 is depricated." false;
         check = m: (strings.hasInfix "python2" m) || (strings.hasInfix "python-2" m);
       }
       # not sure if the following test creates false positives (AFAIK every derivation/package needs to have an outPath)
       # , definitely should catch all corner cases/everything that fails to evaluate.
       {
-        path = ["outPath"];
+        path = [ "outPath" ];
         msg = warn "Package ${p.name} has no outPath" true;
         check = m: !(tryEval m).success;
       }
@@ -87,35 +96,45 @@ with lib; rec {
   depsBroken = p: lists.any (p: (isBroken p)) (deps p);
   # No more magic 🧙 here 😢
   # But at least it now (hopefully) checks ONLY dependencies (and all of them at that).
-  depsBrokenRec = p: (
+  depsBrokenRec =
-    meetsConDo
+    p: (meetsConDo (p: ifelse (depsBroken p) true (depsBrokenRec (deps p))) (p: true) (deps p));
-    (p: ifelse (depsBroken p) true (depsBrokenRec (deps p)))
+  sopsHelper =
-    (p: true) (deps p)
+    template: names: options:
-  );
+    let
-  sopsHelper = template: names: options: let
       optionsIsFunction = (typeOf options) == "lambda";
     in
-    listToAttrs (map
+    listToAttrs (
-      (name: {
+      map (name: {
         name = template name;
         value = ifelse optionsIsFunction (options name) options;
-      })
+      }) names
-      names);
+    );
-  pkgFilter = ld: (filter
+  pkgFilter =
-    (p: (
+    ld:
-      ifelse (isBroken p)
+    (filter (
-      false
+      p:
-      (ifelse (depsBrokenRec p)
+      (ifelse (isBroken p) false (
-        (warn "Dependency of ${p.name} is marked as broken." false)
+        ifelse (depsBrokenRec p) (warn "Dependency of ${p.name} is marked as broken." false) true
-        true)
       ))
-    ld);
+    ) ld);
-  makeOptionTypeList = path: (
+  makeOptionTypeList =
-    lists.forEach
+    path:
+    (lists.forEach
       # get a list of all files ending in .nix in path
-    (filter (hasSuffix ".nix")
+      (filter (hasSuffix ".nix") (lsfRec path true))
-      (lsfRec path true))
       # remove leading path and trailing ".nix", replace every slash with "::"
-    (replaceStrings ["${path}/" "/" ".nix"] ["" "::" ""])
+      (
+        replaceStrings
+          [
+            "${path}/"
+            "/"
+            ".nix"
+          ]
+          [
+            ""
+            "::"
+            ""
+          ]
+      )
     );
 }

machines/Lilim/configuration.nix

@@ -2,7 +2,8 @@
   pkgs,
   lib,
   ...
-}: {
+}:
+{
   services.cron.enable = false;
 
   networking.dhcpcd.extraConfig = "noarp";
@@ -56,7 +57,7 @@
     };
     joycond.enable = true;
     udev = {
-      packages = [];
+      packages = [ ];
       extraRules = ''
         KERNEL=="rtc0", GROUP="audio"
         KERNEL=="hpet", GROUP="audio"
@@ -64,8 +65,13 @@
     };
   };
   boot = {
-    kernelModules = ["snd-usb-audio" "snd-aloop" "snd-seq" "snd-rawmidi"];
+    kernelModules = [
-    kernelParams = ["threadirq"];
+      "snd-usb-audio"
+      "snd-aloop"
+      "snd-seq"
+      "snd-rawmidi"
+    ];
+    kernelParams = [ "threadirq" ];
     extraModprobeConfig = ''
       options snd-usb-audio nrpacks=1
     '';

machines/Lilim/hardware-configuration.nix

@@ -3,10 +3,12 @@
   config,
   pkgs,
   ...
-}: let
+}:
+let
   cfg = config.machine;
-in {
+in
-  imports = ["${nixpkgs}/nixos/modules/installer/scan/not-detected.nix"];
+{
+  imports = [ "${nixpkgs}/nixos/modules/installer/scan/not-detected.nix" ];
 
   boot = {
     loader.systemd-boot = {
@@ -22,14 +24,24 @@ in {
     };
 
     kernelPackages = pkgs.linuxPackages_latest;
-    initrd.availableKernelModules = ["xhci_pci" "ahci" "sd_mod" "rtsx_pci_sdmmc"];
+    initrd.availableKernelModules = [
-    kernelModules = ["acpi_call" "i915" "kvm-intel" "uinput"];
+      "xhci_pci"
+      "ahci"
+      "sd_mod"
+      "rtsx_pci_sdmmc"
+    ];
+    kernelModules = [
+      "acpi_call"
+      "i915"
+      "kvm-intel"
+      "uinput"
+    ];
     # 5_10 breaks my touchpad/mouse buttons
     # https://bbs.archlinux.org/viewtopic.php?id=254885
     # maybe modprobe hid_rmi or i2c_i801
     # blacklistedKernelModules = [ "i2c_i801" ];
-    extraModulePackages = with config.boot.kernelPackages; [acpi_call]; #pkgs.gitpkgs.linuxPackages_latest.hid-nintendo ];
+    extraModulePackages = with config.boot.kernelPackages; [ acpi_call ]; # pkgs.gitpkgs.linuxPackages_latest.hid-nintendo ];
-    kernelParams = ["intel_iommu=on"];
+    kernelParams = [ "intel_iommu=on" ];
     extraModprobeConfig = ''
       options i915 enable_fbc=1 enable_guc=3
     '';
@@ -51,13 +63,15 @@ in {
   };
 
   hardware = {
-    firmware = with pkgs; [firmwareLinuxNonfree];
+    firmware = with pkgs; [ firmwareLinuxNonfree ];
     cpu.intel.updateMicrocode = true;
     enableAllFirmware = false;
     ksm.enable = true;
     graphics = {
       extraPackages = with pkgs; [ (intel-vaapi-driver.override { enableHybridCodec = true; }) ];
-      extraPackages32 = with pkgs.pkgsi686Linux; [  (intel-vaapi-driver.override { enableHybridCodec = true; }) ];
+      extraPackages32 = with pkgs.pkgsi686Linux; [
+        (intel-vaapi-driver.override { enableHybridCodec = true; })
+      ];
     };
 
     pulseaudio = {
@@ -82,7 +96,7 @@ in {
   };
   services = {
     upower.enable = true;
-    xserver.videoDrivers = ["intel"];
+    xserver.videoDrivers = [ "intel" ];
   };
   environment.variables.LIBVA_DRIVER_NAME = "i915";
   time.timeZone = "Europe/Berlin";

machines/Lilim/options.nix

@@ -3,7 +3,8 @@
   lib,
   ...
 }:
-with lib; {
+with lib;
+{
   imports = [
     ../../options/copySysConf.nix
   ];
@@ -51,8 +52,8 @@ with lib; {
     firewall = {
       enable = true;
       allowPing = true;
-      allowedUDPPorts = [24642];
+      allowedUDPPorts = [ 24642 ];
-      allowedTCPPorts = [24642];
+      allowedTCPPorts = [ 24642 ];
       allowedUDPPortRanges = [
         {
           from = 1714;

machines/Lilim/sops.nix

@@ -2,7 +2,8 @@
   config,
   lib,
   ...
-}: {
+}:
+{
   sops = {
     defaultSopsFile = ./secrets.yaml;
     age = {

machines/Marid/configuration.nix

@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   services.cron.enable = false;
   security.pki.certificateFiles = [
     ./certs/proxy

machines/Marid/hardware-configuration.nix

@@ -3,10 +3,12 @@
   pkgs,
   modulesPath,
   ...
-}: let
+}:
+let
   cfg = config.machine;
-in {
+in
-  imports = [(modulesPath + "/installer/scan/not-detected.nix")];
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
 
   boot = {
     loader.systemd-boot = {
@@ -19,8 +21,14 @@ in {
     };
 
     kernelPackages = pkgs.linuxPackages_latest;
-    initrd.availableKernelModules = ["nvme" "xhci_pci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc"];
+    initrd.availableKernelModules = [
-    kernelModules = ["kvm-amd"];
+      "nvme"
+      "xhci_pci"
+      "usb_storage"
+      "sd_mod"
+      "rtsx_pci_sdmmc"
+    ];
+    kernelModules = [ "kvm-amd" ];
     kernelParams = [
       # get backlight service to work part one (fixes systemd backlight service)
       "acpi_backlight=native"
@@ -43,7 +51,7 @@ in {
   };
 
   hardware = {
-    firmware = with pkgs; [firmwareLinuxNonfree];
+    firmware = with pkgs; [ firmwareLinuxNonfree ];
     enableAllFirmware = true;
     ksm.enable = true;
     opengl = {

machines/Marid/options.nix

@@ -3,7 +3,8 @@
   lib,
   ...
 }:
-with lib; {
+with lib;
+{
   imports = [
     ../../options/copySysConf.nix
   ];
@@ -41,10 +42,10 @@ with lib; {
     firewall = {
       enable = true;
       allowPing = true;
-      allowedUDPPorts = [];
+      allowedUDPPorts = [ ];
-      allowedTCPPorts = [];
+      allowedTCPPorts = [ ];
-      allowedUDPPortRanges = [];
+      allowedUDPPortRanges = [ ];
-      allowedTCPPortRanges = [];
+      allowedTCPPortRanges = [ ];
     };
   };
 

machines/Marid/sops.nix

@@ -2,7 +2,8 @@
   config,
   lib,
   ...
-}: {
+}:
+{
   sops = {
     defaultSopsFile = ./secrets.yaml;
     age = {

machines/Ophanim/hardware-configuration.nix

@@ -2,16 +2,23 @@
   nixpkgs,
   pkgs,
   ...
-}: {
+}:
+{
   imports = [
     "${nixpkgs}/nixos/modules/profiles/qemu-guest.nix"
   ];
 
   boot = {
-    initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "sd_mod" "sr_mod"];
+    initrd.availableKernelModules = [
+      "ata_piix"
+      "uhci_hcd"
+      "virtio_pci"
+      "sd_mod"
+      "sr_mod"
+    ];
     kernelPackages = pkgs.linuxPackages_latest;
-    kernelModules = [];
+    kernelModules = [ ];
-    extraModulePackages = [];
+    extraModulePackages = [ ];
     loader.grub = {
       enable = true;
       device = "/dev/sda"; # or "nodev" for efi only
@@ -25,5 +32,5 @@
     fsType = "ext4";
   };
 
-  swapDevices = [];
+  swapDevices = [ ];
 }

machines/Ophanim/options.nix

@@ -3,9 +3,11 @@
   lib,
   ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.machine;
-in {
+in
+{
   config.machine = rec {
     hostName = "Ophanim";
     domain = "ophanim.de";
@@ -18,7 +20,10 @@ in {
     mailAccounts = [
       {
         name = "derped";
-        aliases = ["postmaster" "baensch"];
+        aliases = [
+          "postmaster"
+          "baensch"
+        ];
       }
     ];
     allowUnfree = true;
@@ -42,9 +47,11 @@ in {
       "nginx"
       "openssh"
     ];
-    vHosts = let
+    vHosts =
+      let
         base = domain;
-    in [
+      in
+      [
         {
           domain = base;
           service = "simple";
@@ -71,8 +78,17 @@ in {
     firewall = {
       enable = true;
       allowPing = false;
-      allowedUDPPorts = [22 80 443 7776];
+      allowedUDPPorts = [
-      allowedTCPPorts = [80 443 7776];
+        22
+        80
+        443
+        7776
+      ];
+      allowedTCPPorts = [
+        80
+        443
+        7776
+      ];
     };
   };
 }

machines/Ophanim/sops.nix

@@ -2,7 +2,8 @@
   config,
   lib,
   ...
-}: {
+}:
+{
   sops = {
     defaultSopsFile = ./secrets.yaml;
     age = {

machines/Sheol/august.nix

@@ -18,7 +18,11 @@
   };
   fileSystems."/home/august/Videos" = {
     device = "/mnt/WD/Videos/Movies/";
-    options = [ "nofail" "bind" "x-systemd.automount" ];
+    options = [
+      "nofail"
+      "bind"
+      "x-systemd.automount"
+    ];
     neededForBoot = false;
   };
 }

machines/Sheol/configuration.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   services = {
     avahi = {
       enable = true;
@@ -13,12 +14,14 @@
   };
   # udp5353 1024-65535
 
-  networking.firewall = let
+  networking.firewall =
+    let
       range = {
         from = 1024;
         to = 65535;
       };
-  in {
+    in
+    {
       allowedUDPPorts = [ 5353 ];
       allowedUDPPortRanges = [ range ];
       allowedTCPPortRanges = [ range ];

machines/Sheol/hardware-configuration.nix

@@ -1,11 +1,16 @@
-{nixos-hardware, ...}: {
+{ nixos-hardware, ... }:
+{
   imports = [
     nixos-hardware.nixosModules.raspberry-pi-5
   ];
 
   boot = {
-    kernelParams = [ "8250.nr_uarts=11" "console=ttyAMA10,9600" "console=tty0" ];
+    kernelParams = [
-    supportedFilesystems = ["btrfs"];
+      "8250.nr_uarts=11"
+      "console=ttyAMA10,9600"
+      "console=tty0"
+    ];
+    supportedFilesystems = [ "btrfs" ];
     initrd.systemd.enableTpm2 = false;
     loader.systemd-boot.enable = true;
     loader.efi.canTouchEfiVariables = false;
@@ -14,7 +19,12 @@
     "/" = {
       device = "none";
       fsType = "tmpfs";
-      options = ["defaults" "size=2G" "mode=755" "noexec"];
+      options = [
+        "defaults"
+        "size=2G"
+        "mode=755"
+        "noexec"
+      ];
     };
     "/boot" = {
       device = "/dev/disk/by-uuid/F8BB-8019";
@@ -23,25 +33,40 @@
     "/nix" = {
       device = "/dev/disk/by-uuid/7741fa2e-ce5d-4aef-bf3c-8e283e973409";
       fsType = "btrfs";
-      options = ["subvol=nix" "compress=zstd" "noatime"];
+      options = [
+        "subvol=nix"
+        "compress=zstd"
+        "noatime"
+      ];
       neededForBoot = true;
     };
     "/persist" = {
       device = "/dev/disk/by-uuid/7741fa2e-ce5d-4aef-bf3c-8e283e973409";
       fsType = "btrfs";
-      options = ["subvol=persist" "compress=zstd" "noexec"];
+      options = [
+        "subvol=persist"
+        "compress=zstd"
+        "noexec"
+      ];
       neededForBoot = true;
     };
     "/snapshots" = {
       device = "/dev/disk/by-uuid/7741fa2e-ce5d-4aef-bf3c-8e283e973409";
       fsType = "btrfs";
-      options = ["subvol=snapshots" "compress=zstd" "noexec"];
+      options = [
+        "subvol=snapshots"
+        "compress=zstd"
+        "noexec"
+      ];
       neededForBoot = false;
     };
     "/mnt/WD" = {
       device = "/dev/disk/by-uuid/EA2866C92866947B";
       fsType = "ntfs";
-      options = ["nofail" "x-systemd.automount"];
+      options = [
+        "nofail"
+        "x-systemd.automount"
+      ];
       neededForBoot = false;
     };
   };

machines/Sheol/impermanence.nix

@@ -1,4 +1,5 @@
-{impermanence, ...}: {
+{ impermanence, ... }:
+{
   imports = [
     impermanence.nixosModules.impermanence
   ];

machines/Sheol/options.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   imports = [
     ../../options/copySysConf.nix
   ];

machines/Sheol/sops.nix

@@ -2,7 +2,8 @@
   config,
   lib,
   ...
-}: {
+}:
+{
   sops = {
     defaultSopsFile = ./secrets.yaml;
     age = {

options/copySysConf.nix

@@ -4,12 +4,12 @@
   lib,
   ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.system.copySysConf;
   cfgPath = ../.;
   copySysConf =
-    if !(isStorePath cfgPath)
+    if !(isStorePath cfgPath) then
-    then
       pkgs.stdenv.mkDerivation rec {
         name = "NixOS_Configuration-${version}";
         version = commitIdFromGitRepo (cfgPath + "/.git");
@@ -20,8 +20,10 @@ with lib; let
           cp -R ./. $out
         '';
       }
-    else (builtins.toPath ../.);
+    else
-in {
+      (builtins.toPath ../.);
+in
+{
   options.system.copySysConf = {
     enable = mkOption {
       type = types.bool;

options/machine.nix

@@ -5,7 +5,8 @@
   ...
 }:
 with builtins;
-with lib; let
+with lib;
+let
   cfg = config.machine;
   pkgsetList = fn.makeOptionTypeList (toString ../pkgsets);
   serviceList = fn.makeOptionTypeList (toString ../services);
@@ -13,7 +14,12 @@ with lib; let
     name = pname;
     value = rec {
       pkgwrap = mkOption {
-        type = with types; oneOf [package (listOf package)];
+        type =
+          with types;
+          oneOf [
+            package
+            (listOf package)
+          ];
         default = fn.pkgFilter cfg.pkgsets."${pname}".pkgs;
         description = ''
           Package Wrapper for packages using a wrapper function (like python, haskell, ...)
@@ -21,18 +27,19 @@ with lib; let
       };
       pkgs = mkOption {
         type = types.unspecified;
-        default = [];
+        default = [ ];
         description = ''
           ${pname} package list.
         '';
       };
     };
   };
-in {
+in
+{
   options.machine = {
     pkgs = mkOption {
       type = types.listOf (types.enum pkgsetList);
-      default = ["base"];
+      default = [ "base" ];
       description = ''
         The list of metapackages to be installed.
       '';
@@ -41,14 +48,14 @@ in {
     pkgsets = listToAttrs (map pkgOption (lists.filter (v: !(strings.hasInfix "::" v)) pkgsetList));
     services = mkOption {
       type = types.listOf (types.enum serviceList);
-      default = [];
+      default = [ ];
       description = ''
         List of services to be enabled.
       '';
     };
     conffiles = mkOption {
       type = types.listOf types.str;
-      default = ["zsh"];
+      default = [ "zsh" ];
       description = ''
         List of configuration files to be enabled.
       '';
@@ -77,7 +84,7 @@ in {
     };
     binaryCaches = mkOption {
       type = types.listOf types.str;
-      default = [];
+      default = [ ];
       description = ''
         Adds binary caches to both nix.trustedBinaryCaches and nix.binaryCaches. ("https://cache.nixos.org" is kept by default)
       '';
@@ -97,28 +104,47 @@ in {
     };
     extraDomains = mkOption {
       type = types.listOf types.str;
-      default = [];
+      default = [ ];
       description = ''
         Extra domains used in various services.
       '';
     };
     mailAccounts = mkOption {
       type = types.listOf types.attrs;
-      default = [];
+      default = [ ];
       description = ''
         List of mail account user names.
       '';
     };
     vHosts = mkOption {
       type = types.listOf types.attrs;
-      default = [];
+      default = [ ];
       description = ''
         Domain - Service mappings for nginx vHost config.
       '';
     };
   };
   imports = [
-    (mkAliasOptionModule ["machine" "firewall"] ["networking" "firewall"])
+    (mkAliasOptionModule
-    (mkAliasOptionModule ["machine" "allowUnfree"] ["nixpkgs" "config" "allowUnfree"])
+      [
+        "machine"
+        "firewall"
+      ]
+      [
+        "networking"
+        "firewall"
+      ]
+    )
+    (mkAliasOptionModule
+      [
+        "machine"
+        "allowUnfree"
+      ]
+      [
+        "nixpkgs"
+        "config"
+        "allowUnfree"
+      ]
+    )
   ];
 }

options/mailman3/core.nix

@@ -68,7 +68,7 @@ buildPythonPackage rec {
   meta = with stdenv.lib; {
     description = "GNU Mailman, a mailing list management system";
     license = licenses.gpl3;
-    maintainers = with maintainers; [];
+    maintainers = with maintainers; [ ];
     homepage = "http://list.org/";
   };
 }

options/mailman3/extraPackages/aiosmtpd.nix

@@ -14,5 +14,5 @@ buildPythonPackage rec {
     sha256 = "1xdfk741pjmz1cm8dsi4n5vq4517i175rm94696m3f7kcgk7xsmp";
   };
   doCheck = false;
-  propagatedBuildInputs = [atpublic];
+  propagatedBuildInputs = [ atpublic ];
 }

options/mailman3/extraPackages/flufl_bounce.nix

@@ -16,7 +16,10 @@ buildPythonPackage rec {
     sha256 = "0k5kjqa3x6gvwwxyzb2vwi1g1i6asm1zw5fivylxz3d583y4kid2";
   };
 
-  propagatedBuildInputs = [atpublic zope_interface];
+  propagatedBuildInputs = [
+    atpublic
+    zope_interface
+  ];
 
   doCheck = false;
 }

options/mailman3/extraPackages/flufl_i18n.nix

@@ -15,7 +15,7 @@ buildPythonPackage rec {
     sha256 = "1csgds59nx0ann9v2alqr69lakp1cnc1ikmbgn96l6n23js7c2ah";
   };
 
-  propagatedBuildInputs = [atpublic];
+  propagatedBuildInputs = [ atpublic ];
 
   doCheck = false;
 }

options/mailman3/extraPackages/flufl_lock.nix

@@ -15,7 +15,7 @@ buildPythonPackage rec {
     sha256 = "0nzzd6l30ff6cwsrlrb94xzfja4wkyrqv3ydc6cz0hdbr766mmm8";
   };
 
-  propagatedBuildInputs = [atpublic];
+  propagatedBuildInputs = [ atpublic ];
 
   doCheck = false;
 }

options/mailman3/extraPackages/lazr_config.nix

@@ -15,7 +15,7 @@ buildPythonPackage rec {
     sha256 = "1s7pyvlq06qjrkaw9r6nc290lb095n25ybzgavvy51ygpxkgqxwn";
   };
 
-  propagatedBuildInputs = [lazr_delegates];
+  propagatedBuildInputs = [ lazr_delegates ];
 
   doCheck = false;
 }

options/mailman3/extraPackages/lazr_delegates.nix

@@ -16,7 +16,10 @@ buildPythonPackage rec {
     sha256 = "1rdnl85j9ayp8n85l0ciip621j9dcziz5qnmv2m7krgwgcn31vfx";
   };
 
-  propagatedBuildInputs = [nose zope_interface];
+  propagatedBuildInputs = [
+    nose
+    zope_interface
+  ];
 
   doCheck = false;
 }

options/mailman3/options.nix

@@ -4,8 +4,9 @@
   config,
   ...
 }:
-with lib; let
+with lib;
-  mailman3 = import ./release.nix {};
+let
+  mailman3 = import ./release.nix { };
   cfg = config.services.mailman3;
   usePostgresql = cfg.database.type == "postgresql";
   useSqlite = cfg.database.type == "sqlite3";
@@ -75,7 +76,8 @@ with lib; let
 
     ${cfg.extraConfig}
   '';
-in {
+in
+{
   options.services.mailman3 = {
     enable = mkOption {
       type = types.bool;
@@ -104,7 +106,11 @@ in {
 
     database = {
       type = mkOption {
-        type = types.enum ["sqlite3" "mysql" "postgres"];
+        type = types.enum [
+          "sqlite3"
+          "mysql"
+          "postgres"
+        ];
         default = "sqlite3";
         example = "mysql";
         description = ''
@@ -273,7 +279,10 @@ in {
     mta = {
       # TODO: add Sentmail and qmail
       type = mkOption {
-        type = types.enum ["postfix" "exim4"];
+        type = types.enum [
+          "postfix"
+          "exim4"
+        ];
         default = "postfix";
         example = "exim4";
         description = ''
@@ -366,35 +375,48 @@ in {
         home = cfg.paths.var_dir;
         createHome = true;
         useDefaultShell = true;
-        packages = [mailman3.core];
+        packages = [ mailman3.core ];
       };
     };
 
     services.postfix.recipientDelimiter = mkIf usePostfix (mkDefault "+");
-    services.postfix.mapFiles."transport_maps" = mkIf usePostfix (mkDefault "${cfg.paths.data_dir}/postfix_lmtp");
+    services.postfix.mapFiles."transport_maps" = mkIf usePostfix (
-    services.postfix.mapFiles."local_recipient_maps" = mkIf usePostfix (mkDefault "${cfg.paths.data_dir}/postfix_lmtp");
+      mkDefault "${cfg.paths.data_dir}/postfix_lmtp"
-    services.postfix.mapFiles."relay_domains" = mkIf usePostfix (mkDefault "${cfg.paths.data_dir}/postfix_domains");
+    );
+    services.postfix.mapFiles."local_recipient_maps" = mkIf usePostfix (
+      mkDefault "${cfg.paths.data_dir}/postfix_lmtp"
+    );
+    services.postfix.mapFiles."relay_domains" = mkIf usePostfix (
+      mkDefault "${cfg.paths.data_dir}/postfix_domains"
+    );
 
-    warnings =
+    warnings = optional (cfg.database.password != "") ''
-      optional (cfg.database.password != "")
+      config.services.mailman3.database.password will be stored as plaintext
-      ''        config.services.mailman3.database.password will be stored as plaintext
               in the Nix store. Use database.passwordFile instead.'';
 
     # Create database passwordFile default when password is configured.
-    services.mailman3.database.passwordFile = mkDefault (toString (pkgs.writeTextFile {
+    services.mailman3.database.passwordFile = mkDefault (
+      toString (
+        pkgs.writeTextFile {
           name = "mailman3-database-password";
           text = cfg.database.password;
-    }));
+        }
+      )
+    );
 
     systemd.services.mailman3 = {
       description = "GNU Mailing List Manager";
-      after = ["network.target"] ++ lib.optional usePostgresql "postgresql.service" ++ lib.optional useMysql "mysql.service";
+      after = [
-      wantedBy = ["multi-user.target"];
+        "network.target"
+      ] ++ lib.optional usePostgresql "postgresql.service" ++ lib.optional useMysql "mysql.service";
+      wantedBy = [ "multi-user.target" ];
 
-      preStart = let
+      preStart =
+        let
           dbpass = fileContents cfg.database.passwordFile;
           smtppass = fileContents cfg.mta.smtp_passFile;
-      in ''
+        in
+        ''
           mkdir -p ${cfg.paths.etc_dir}
           cp ${configFile} ${cfg.paths.etc_dir}/mailman.cfg
           ${optionalString (useMysql || usePostgresql) ''

options/mailman3/release.nix

@@ -1,17 +1,28 @@
 {
-  pkgs ? import <nixpkgs> {},
+  pkgs ? import <nixpkgs> { },
   python3Packages ? pkgs.python3Packages,
-}: let
+}:
+let
   mailman3 = {
-    core = python3Packages.callPackage ./core.nix (with deps; {
+    core = python3Packages.callPackage ./core.nix (
-      inherit aiosmtpd atpublic flufl_bounce flufl_i18n flufl_lock lazr_config;
+      with deps;
-    });
+      {
+        inherit
+          aiosmtpd
+          atpublic
+          flufl_bounce
+          flufl_i18n
+          flufl_lock
+          lazr_config
+          ;
+      }
+    );
   };
   deps = rec {
     aiosmtpd = python3Packages.callPackage ./extraPackages/aiosmtpd.nix {
       inherit atpublic;
     };
-    atpublic = python3Packages.callPackage ./extraPackages/atpublic.nix {};
+    atpublic = python3Packages.callPackage ./extraPackages/atpublic.nix { };
     flufl_bounce = python3Packages.callPackage ./extraPackages/flufl_bounce.nix {
       inherit atpublic;
     };
@@ -24,7 +35,7 @@
     lazr_config = python3Packages.callPackage ./extraPackages/lazr_config.nix {
       inherit lazr_delegates;
     };
-    lazr_delegates = python3Packages.callPackage ./extraPackages/lazr_delegates.nix {};
+    lazr_delegates = python3Packages.callPackage ./extraPackages/lazr_delegates.nix { };
   };
 in
-  mailman3
+mailman3

pkgs/flat-remix/default.nix

@@ -13,6 +13,6 @@ stdenv.mkDerivation {
     sha256 = "0rfv75w9yr8drc3x9g4iz2cb88ixy1lqbflvmb7farw4dz74fk5f";
     fetchSubmodules = true;
   };
-  makeFlags = ["PREFIX=$(out)"];
+  makeFlags = [ "PREFIX=$(out)" ];
-  propagatedUserEnvPkgs = [gtk-engine-murrine];
+  propagatedUserEnvPkgs = [ gtk-engine-murrine ];
 }

pkgs/kanagawa/default.nix

@@ -15,7 +15,7 @@ stdenv.mkDerivation {
     sha256 = "sha256-BZRmjVas8q6zsYbXFk4bCk5Ec/3liy9PQ8fqFGHAXe0=";
   };
 
-  propagatedUserEnvPkgs = [gtk-engine-murrine];
+  propagatedUserEnvPkgs = [ gtk-engine-murrine ];
 
   installPhase = ''
     runHook preInstall

pkgs/nixpkgs.nix

@@ -6,20 +6,22 @@
   nixpkgs-stable,
   nixpkgs-git,
   ...
-}: let
+}:
+let
   inherit (pkgs) callPackage;
-in {
+in
+{
   nixpkgs = {
     config = {
       allowUnfree = true;
       mpv.vaapiSupport = lib.elem "xserver" config.machine.services;
 
       packageOverrides = {
-        pyluxafor = pkgs.python3Packages.callPackage ./pyluxafor {};
+        pyluxafor = pkgs.python3Packages.callPackage ./pyluxafor { };
-        theme_flat-remix = callPackage ./flat-remix {};
+        theme_flat-remix = callPackage ./flat-remix { };
-        theme_sddm_midnight = callPackage ./sddm_midnight {};
+        theme_sddm_midnight = callPackage ./sddm_midnight { };
-        xdiskusage = callPackage ./xdiskusage {};
+        xdiskusage = callPackage ./xdiskusage { };
-        kanagawa = callPackage ./kanagawa {};
+        kanagawa = callPackage ./kanagawa { };
       };
     };
     overlays = [

pkgs/pyluxafor/default.nix

@@ -18,5 +18,8 @@ buildPythonApplication rec {
     substituteInPlace setup.py --replace '"click>=6.0,<=6.7.99",' ""
     substituteInPlace setup.py --replace '"pyusb==1.0.0",' ""
   '';
-  propagatedBuildInputs = [click pyusb];
+  propagatedBuildInputs = [
+    click
+    pyusb
+  ];
 }

pkgs/systemPackages.nix

@@ -5,22 +5,20 @@
   pkgs,
   ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.machine;
   pkgsets = fn.lst {
     p = toString ../pkgsets;
     b = true;
   };
-in {
+in
+{
   imports = pkgsets;
 
-  environment.systemPackages =
+  environment.systemPackages = flatten (
-    flatten
+    lists.forEach (attrVals (filter (v: !(strings.hasInfix "::" v)) cfg.pkgs) cfg.pkgsets) (
-    (lists.forEach
+      v: v.pkgwrap
-      (attrVals
+    )
-        (filter
+  );
-          (v: !(strings.hasInfix "::" v))
-          cfg.pkgs)
-        cfg.pkgsets)
-      (v: v.pkgwrap));
 }

pkgs/xdiskusage/default.nix

@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   name = "xdiskusage";
   version = "1.51";
 
-  buildInputs = [fltk];
+  buildInputs = [ fltk ];
 
   src = fetchurl {
     url = "http://xdiskusage.sourceforge.net/${name}-${version}.tgz";

pkgsets/base.nix

@@ -3,7 +3,8 @@
   config,
   pkgs,
   ...
-}: {
+}:
+{
   config.machine.pkgsets.base.pkgs = with pkgs; [
     age
     sops

pkgsets/cpp.nix

@@ -2,7 +2,8 @@
   config,
   pkgs,
   ...
-}: {
+}:
+{
   config.machine.pkgsets.cpp.pkgs = with pkgs; [
     clang
     cmake

pkgsets/dict.nix

@@ -2,10 +2,24 @@
   config,
   pkgs,
   ...
-}: {
+}:
+{
   config.machine.pkgsets.dict.pkgs = with pkgs; [
     translate-shell
-    (hunspellWithDicts (with pkgs.hunspellDicts; [de-de en-us]))
+    (hunspellWithDicts (
-    (aspellWithDicts (d: with d; [de en en-computers en-science]))
+      with pkgs.hunspellDicts;
+      [
+        de-de
+        en-us
+      ]
+    ))
+    (aspellWithDicts (
+      d: with d; [
+        de
+        en
+        en-computers
+        en-science
+      ]
+    ))
   ];
 }

pkgsets/extra.nix

@@ -2,7 +2,8 @@
   config,
   pkgs,
   ...
-}: {
+}:
+{
   config.machine.pkgsets.extra.pkgs = with pkgs; [
     alsaUtils
     binutils-unwrapped

pkgsets/haskell-tools.nix

@@ -2,6 +2,10 @@
   config,
   pkgs,
   ...
-}: {
+}:
-  config.machine.pkgsets.haskell-tools.pkgs = with pkgs; [cabal-install hlint]; # ghcid
+{
+  config.machine.pkgsets.haskell-tools.pkgs = with pkgs; [
+    cabal-install
+    hlint
+  ]; # ghcid
 }

pkgsets/haskell.nix

@@ -4,8 +4,11 @@
   fn,
   pkgs,
   ...
-}: {
+}:
-  config.machine.pkgsets.haskell.pkgwrap = pkgs.haskellPackages.ghcWithPackages (pkgs: (fn.pkgFilter config.machine.pkgsets.haskell.pkgs));
+{
+  config.machine.pkgsets.haskell.pkgwrap = pkgs.haskellPackages.ghcWithPackages (
+    pkgs: (fn.pkgFilter config.machine.pkgsets.haskell.pkgs)
+  );
   config.machine.pkgsets.haskell.pkgs = with pkgs.haskellPackages; [
     hindent
     mtl

pkgsets/latex.nix

@@ -4,7 +4,8 @@
   pkgs,
   ...
 }:
-with lib; {
+with lib;
+{
   config.machine.pkgsets.latex.pkgs = with pkgs; [
     texlive.combined.scheme-full
     texlab

pkgsets/mail_utils.nix

@@ -1,7 +1,8 @@
 {
   pkgs,
   ...
-}: {
+}:
+{
   config.machine.pkgsets.mail_utils.pkgs = with pkgs; [
     aerc
     abook

pkgsets/nodejs.nix

@@ -1,6 +1,11 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   config.machine.pkgsets.nodejs.pkgs =
-    (with pkgs; [nodejs yarn deno])
+    (with pkgs; [
+      nodejs
+      yarn
+      deno
+    ])
     ++ (with pkgs.nodePackages; [
       autoprefixer
       mermaid-cli

pkgsets/php.nix

@@ -4,11 +4,12 @@
   fn,
   pkgs,
   ...
-}: {
+}:
+{
   config.machine.pkgsets.php.pkgwrap = fn.pkgFilter config.machine.pkgsets.php.pkgs;
   config.machine.pkgsets.php.pkgs =
     (with pkgs.php82Packages; [
       composer
     ])
-    ++ (with pkgs; [php82]);
+    ++ (with pkgs; [ php82 ]);
 }

pkgsets/python3.nix

@@ -5,8 +5,11 @@
   pkgs,
   ...
 }:
-with lib; {
+with lib;
-  config.machine.pkgsets.python3.pkgwrap = pkgs.python3.withPackages (ps: (fn.pkgFilter config.machine.pkgsets.python3.pkgs));
+{
+  config.machine.pkgsets.python3.pkgwrap = pkgs.python3.withPackages (
+    ps: (fn.pkgFilter config.machine.pkgsets.python3.pkgs)
+  );
   config.machine.pkgsets.python3.pkgs = with pkgs.python3Packages; [
     bpython
     flake8

pkgsets/rustpkgs.nix

@@ -1,15 +1,22 @@
-{config, ...}: let
+{ config, ... }:
-  mozRust = with builtins;
+let
-    (map (p:
+  mozRust =
-      import ((fetchTarball {
+    with builtins;
+    (map (
+      p:
+      import (
+        (fetchTarball {
           url = "https://github.com/mozilla/nixpkgs-mozilla/archive/e912ed4.tar.gz";
           sha256 = "08fvzb8w80bkkabc1iyhzd15f4sm7ra10jn32kfch5klgl0gj3j3";
         })
-        + p))) [
+        + p
+      )
+    ))
+      [
         (toPath "/lib-overlay.nix")
         (toPath "/rust-overlay.nix")
       ];
-  stablepkgs = import <nixos-stable> {overlays = mozRust;};
+  stablepkgs = import <nixos-stable> { overlays = mozRust; };
 
   # https://rust-lang.github.io/rustup-components-history
   nightly = stablepkgs.rustChannelOf {
@@ -27,18 +34,26 @@
           "rustfmt-preview"
         ];
       }
-      // {src = nightly.rust-src;};
+      // {
+        src = nightly.rust-src;
+      };
     inherit (nightly) cargo;
   };
-  rustPNightly = stablepkgs.recurseIntoAttrs (stablepkgs.makeRustPlatform {
+  rustPNightly = stablepkgs.recurseIntoAttrs (
+    stablepkgs.makeRustPlatform {
       inherit (rustNightly) rustc cargo;
-  });
+    }
-in {
+  );
+in
+{
   config.machine.pkgsets.rustpkgs.pkgs =
     (with stablepkgs; [
       diesel-cli
       carnix
       rustracer
     ])
-    ++ (with rustNightly; [rustc cargo]);
+    ++ (with rustNightly; [
+      rustc
+      cargo
+    ]);
 }

pkgsets/server.nix

@@ -2,7 +2,8 @@
   config,
   pkgs,
   ...
-}: {
+}:
+{
   config.machine.pkgsets.server.pkgs = with pkgs; [
     audit
     certbot

pkgsets/tracking.nix

@@ -4,7 +4,8 @@
   pkgs,
   ...
 }:
-with lib; {
+with lib;
+{
   config.machine.pkgsets.tracking.pkgs = with pkgs; [
     aw-qt
     aw-server-rust

pkgsets/uniProgs.nix

@@ -2,6 +2,7 @@
   config,
   pkgs,
   ...
-}: {
+}:
-  config.machine.pkgsets.uniProgs.pkgs = with pkgs; [qucs];
+{
+  config.machine.pkgsets.uniProgs.pkgs = with pkgs; [ qucs ];
 }

pkgsets/xpkgs.nix

@@ -2,9 +2,11 @@
   config,
   pkgs,
   ...
-}: let
+}:
+let
   cfg = config.machine;
-in {
+in
+{
   config.machine.pkgsets.xpkgs.pkgs = with pkgs; [
     acpilight
     feh

services/acme.nix

@@ -7,13 +7,14 @@
   ...
 }:
 with builtins;
-with lib; let
+with lib;
+let
   cfg = config.machine;
 in
-  mkIf (elem "acme" cfg.services) {
+mkIf (elem "acme" cfg.services) {
   security.acme = {
     # see https://letsencrypt.org/repository/
     acceptTerms = true;
     defaults.email = "${(elemAt cfg.mailAccounts 0).name}@${cfg.domain}";
   };
-  }
+}

services/bind.nix

@@ -8,13 +8,14 @@
   ...
 }:
 with builtins;
-with lib; let
+with lib;
+let
   cfg = config.machine;
 in
-  mkIf (elem "bind" cfg.services) {
+mkIf (elem "bind" cfg.services) {
   services.bind = {
     enable = true;
-      listenOn = ["127.0.0.1"];
+    listenOn = [ "127.0.0.1" ];
     forwarders = [
       # Cloudflare CDN
       "1.1.1.1"
@@ -33,4 +34,4 @@ in
       version none;
     '';
   };
-  }
+}

services/containers.nix

@@ -4,7 +4,7 @@
   ...
 }:
 with lib;
-  mkIf (elem "containers" config.machine.services) {
+mkIf (elem "containers" config.machine.services) {
   containers.CDServer = {
     privateNetwork = true;
     hostAddress = "192.168.100.10";
@@ -21,4 +21,4 @@ with lib;
       services.ntp.enable = false;
     };
   };
-  }
+}

services/cups.nix

@@ -5,11 +5,16 @@
   ...
 }:
 with lib;
-  mkIf (elem "cups" config.machine.services) {
+mkIf (elem "cups" config.machine.services) {
   services.printing = {
     enable = true;
     browsed.enable = false;
     startWhenNeeded = true;
-      drivers = with pkgs; [gutenprint hplip splix samsung-unified-linux-driver];
+    drivers = with pkgs; [
+      gutenprint
+      hplip
+      splix
+      samsung-unified-linux-driver
+    ];
   };
-  }
+}

services/desktop.nix

@@ -5,17 +5,18 @@
   pkgs,
   ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.machine;
   desktopFiles = fn.lst {
     p = toString ./desktop;
     b = true;
   };
 in
-  {
+{
   imports = desktopFiles;
-  }
+}
-  // mkIf (elem "desktop" cfg.services) {
+// mkIf (elem "desktop" cfg.services) {
   xdg.portal = {
     enable = true;
     wlr.enable = true;
@@ -50,7 +51,7 @@ in
   };
 
   environment = {
-      systemPackages = with pkgs; [kanagawa];
+    systemPackages = with pkgs; [ kanagawa ];
     etc."xdg/gtk-2.0/gtkrc".text = ''
       gtk-key-theme-name = "Kanagawa-BL"
     '';
@@ -69,4 +70,4 @@ in
     ACTION=="add", SUBSYSTEM=="backlight", RUN+="${pkgs.coreutils}/bin/chgrp video /sys/class/backlight/%k/brightness"
     ACTION=="add", SUBSYSTEM=="backlight", RUN+="${pkgs.coreutils}/bin/chmod 664 /sys/class/backlight/%k/brightness"
   '';
-  }
+}

services/desktop/i3.nix

@@ -5,12 +5,12 @@
   ...
 }:
 with lib;
-  mkIf (elem "desktop::i3" config.machine.services) {
+mkIf (elem "desktop::i3" config.machine.services) {
   services.xserver = {
     enable = true;
     windowManager.i3 = {
       enable = true;
-        configFile = import ../../config/etc/i3/config.nix {inherit pkgs;};
+      configFile = import ../../config/etc/i3/config.nix { inherit pkgs; };
       extraPackages = with pkgs; [
         dmenu
         file
@@ -20,5 +20,9 @@ with lib;
       ];
     };
   };
-    machine.pkgsets.python3.pkgs = with pkgs.python3Packages; [py3status pytz tzlocal];
+  machine.pkgsets.python3.pkgs = with pkgs.python3Packages; [
-  }
+    py3status
+    pytz
+    tzlocal
+  ];
+}

services/desktop/sway.nix

@@ -5,7 +5,7 @@
   ...
 }:
 with lib;
-  mkIf (elem "desktop::sway" config.machine.services) {
+mkIf (elem "desktop::sway" config.machine.services) {
   programs.sway = {
     enable = true;
     package = pkgs.sway.override {
@@ -48,4 +48,4 @@ with lib;
       export NIXOS_OZONE_WL=1
     '';
   };
-  }
+}

services/docker.nix

@@ -6,11 +6,15 @@
 }:
 # Note: add privileged users to docker group for access
 with lib;
-  mkIf ((elem "docker" config.machine.services) && !(elem "podman" config.machine.services)) {
+mkIf ((elem "docker" config.machine.services) && !(elem "podman" config.machine.services)) {
   virtualisation.docker = {
     enable = true;
     # Disable live restore as it tends to delay/block system shutdown
     liveRestore = false;
   };
-    environment.systemPackages = with pkgs; [docker-compose docker-machine cntr];
+  environment.systemPackages = with pkgs; [
-  }
+    docker-compose
+    docker-machine
+    cntr
+  ];
+}

services/fail2ban.nix

@@ -3,11 +3,12 @@
   lib,
   ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.machine;
   active = name: (elem name cfg.services);
 in
-  mkIf (elem "fail2ban" cfg.services) {
+mkIf (elem "fail2ban" cfg.services) {
   services.fail2ban = {
     enable = true;
     jails = {
@@ -101,4 +102,4 @@ in
 
   # Limit stack size to reduce memory usage
   systemd.services.fail2ban.serviceConfig.LimitSTACK = 256 * 1024;
-  }
+}

services/forgejo.nix

@@ -4,12 +4,14 @@
   ...
 }:
 with lib;
-  mkIf (elem "forgejo" config.machine.services) {
+mkIf (elem "forgejo" config.machine.services) {
   services = {
-      forgejo = let
+    forgejo =
+      let
         cfg = config.machine;
         inherit ((findFirst (s: s.service == "forgejo") cfg cfg.vHosts)) domain;
-      in {
+      in
+      {
         enable = true;
         user = "git";
         database = {
@@ -56,4 +58,4 @@ with lib;
     createHome = false;
     useDefaultShell = true;
   };
-  }
+}

services/fprintd.nix

@@ -4,8 +4,9 @@
   ...
 }:
 with lib;
-  mkIf (elem "fprintd" config.machine.services) {
+mkIf (elem "fprintd" config.machine.services) {
-    security.pam.services = let
+  security.pam.services =
+    let
       unlock = [
         "sudo"
         "i3lock"
@@ -13,12 +14,16 @@ with lib;
         "lightdm"
       ];
     in
-      listToAttrs (forEach unlock (n: {
+    listToAttrs (
+      forEach unlock (n: {
         name = n;
-        value = {fprintAuth = true;};
+        value = {
-      }));
+          fprintAuth = true;
+        };
+      })
+    );
 
   services.fprintd = {
     enable = true;
   };
-  }
+}

services/hydra.nix

@@ -9,24 +9,32 @@
 # https://qfpl.io/posts/nix/starting-simple-hydra/
 # also for reference a well written hydra config:
 # https://github.com/NixOS/nixos-org-configurations/blob/master/delft/hydra.nix
-with lib; let
+with lib;
+let
   cacheDir = "/var/cache/hydra";
 in
-  mkIf (elem "hydra" config.machine.services) {
+mkIf (elem "hydra" config.machine.services) {
   # also take a look at ../conf/nix.nix
   nix.buildMachines = [
     {
       hostName = "localhost";
       system = "x86_64-linux";
-        supportedFeatures = ["kvm" "nixos-test" "big-parallel" "benchmark"];
+      supportedFeatures = [
+        "kvm"
+        "nixos-test"
+        "big-parallel"
+        "benchmark"
+      ];
       maxJobs = 8;
     }
   ];
 
-    services = let
+  services =
+    let
       cfg = config.machine;
       inherit ((findFirst (s: s.service == "hydra") cfg cfg.vHosts)) domain;
-    in {
+    in
+    {
       hydra = {
         enable = true;
         hydraURL = domain; # externally visible URL
@@ -42,7 +50,9 @@ in
         # hydra.conf: binary_cache_secret_key_file is deprecated and ignored. use store_uri=...?secret-key= instead
         extraConfig = ''
           max_output_size = 4294967296
-          store_uri = file://${cacheDir}?secret-key=${config.sops.secrets."services.hydra.secretKey".path}&write-nar-listing=1&ls-compression=br&log-compression=br
+          store_uri = file://${cacheDir}?secret-key=${
+            config.sops.secrets."services.hydra.secretKey".path
+          }&write-nar-listing=1&ls-compression=br&log-compression=br
           # add ?local-nar-cache= to set nar cache location
           server_store_uri = https://cache.${cfg.domain}
           binary_cache_public_uri https://cache.${cfg.domain}
@@ -68,4 +78,4 @@ in
     owner = "hydra";
     group = "hydra";
   };
-  }
+}

services/mailserver.nix

@@ -6,32 +6,40 @@
   ...
 }:
 with lib;
-  {
+{
   imports = [
     mailserver.nixosModules.mailserver
   ];
-  }
+}
-  // mkIf (elem "mailserver" config.machine.services) {
+// mkIf (elem "mailserver" config.machine.services) {
-    mailserver = let
+  mailserver =
+    let
       cfg = config.machine;
       inherit (cfg) domain;
       fdomain = (findFirst (s: s.service == "mail") cfg cfg.vHosts).domain;
-      mkFqdnAlias = name: ["${name}@${domain}" "${name}@${fdomain}"];
+      mkFqdnAlias = name: [
+        "${name}@${domain}"
+        "${name}@${fdomain}"
+      ];
       mkExDomAlias = name: (map (exDom: "${name}@${exDom}") cfg.extraDomains);
       mkUser = user: rec {
         name = "${user.name}@${domain}";
         value = {
           hashedPasswordFile = config.sops.secrets."users/${user.name}/mail".path;
           aliases =
-            ["${user.name}@${fdomain}"]
+            [ "${user.name}@${fdomain}" ]
             ++ (flatten (map mkFqdnAlias user.aliases))
-            ++ (flatten (map mkExDomAlias ([user.name] ++ user.aliases)));
+            ++ (flatten (map mkExDomAlias ([ user.name ] ++ user.aliases)));
         };
       };
-    in rec {
+    in
+    rec {
       enable = true;
       fqdn = fdomain;
-      domains = [fdomain domain] ++ cfg.extraDomains;
+      domains = [
+        fdomain
+        domain
+      ] ++ cfg.extraDomains;
       loginAccounts = listToAttrs (map mkUser cfg.mailAccounts);
 
       # Use Let's Encrypt certificates. Note that this needs to set up a stripped
@@ -55,9 +63,5 @@ with lib;
       # 1 Gb RAM for the server. Without virus scanning 256 MB RAM should be plenty)
       virusScanning = false;
     };
-    sops.secrets =
+  sops.secrets = fn.sopsHelper (user: "users/${user.name}/mail") config.machine.mailAccounts { };
-      fn.sopsHelper
+}
-      (user: "users/${user.name}/mail")
-      config.machine.mailAccounts
-      {};
-  }

services/mariaDB.nix

@@ -5,9 +5,9 @@
   ...
 }:
 with lib;
-  mkIf (elem "mariaDB" config.machine.services) {
+mkIf (elem "mariaDB" config.machine.services) {
   services.mysql = rec {
     enable = true;
     package = pkgs.mariadb;
   };
-  }
+}

services/mullvad.nix

@@ -4,6 +4,6 @@
   ...
 }:
 with lib;
-  mkIf (elem "mullvad" config.machine.services) {
+mkIf (elem "mullvad" config.machine.services) {
   services.mullvad-vpn.enable = true;
-  }
+}

services/nextcloud.nix

@@ -6,11 +6,13 @@
   ...
 }:
 with lib;
-  mkIf (elem "nextcloud" config.machine.services) {
+mkIf (elem "nextcloud" config.machine.services) {
-    services = let
+  services =
+    let
       cfg = config.machine;
       inherit ((findFirst (s: s.service == "nextcloud") cfg cfg.vHosts)) domain;
-    in {
+    in
+    {
       nextcloud = {
         enable = true;
         home = "/var/lib/nextcloud";
@@ -55,11 +57,13 @@ with lib;
       };
     };
   sops.secrets =
-      fn.sopsHelper
+    fn.sopsHelper (name: "services/nextcloud/${name}")
-      (name: "services/nextcloud/${name}")
+      [
-      ["adminPass" "dbPass"]
+        "adminPass"
+        "dbPass"
+      ]
       {
         owner = "nextcloud";
         group = "nextcloud";
       };
-  }
+}

services/nginx.nix

@@ -15,28 +15,35 @@
 }:
 with lib;
 with builtins;
-  mkIf (elem "nginx" config.machine.services) {
+mkIf (elem "nginx" config.machine.services) {
-    services.nginx = let
+  services.nginx =
-      vHostConfigs = listToAttrs (map
+    let
-        (name: {
+      vHostConfigs = listToAttrs (
-          name = replaceStrings [".nix"] [""] name;
+        map (name: {
-          value = import (./. + (toPath "/nginx_vHosts/${name}")) {inherit options config lib pkgs;};
+          name = replaceStrings [ ".nix" ] [ "" ] name;
-        })
+          value = import (./. + (toPath "/nginx_vHosts/${name}")) {
-        (attrNames (readDir ./nginx_vHosts)));
+            inherit
+              options
+              config
+              lib
+              pkgs
+              ;
+          };
+        }) (attrNames (readDir ./nginx_vHosts))
+      );
 
       mkVHost = vHost: {
         name = vHost.domain;
-        value =
+        value = {
-          {
           enableACME = true;
           forceSSL = true;
           acmeRoot = "/var/lib/acme/acme-challenge";
-          }
+        } // vHostConfigs."${vHost.service}";
-          // vHostConfigs."${vHost.service}";
       };
 
       vHosts = listToAttrs (map mkVHost config.machine.vHosts);
-    in {
+    in
+    {
       enable = true;
       recommendedGzipSettings = true;
       recommendedOptimisation = true;
@@ -56,4 +63,4 @@ with builtins;
       '';
       virtualHosts = vHosts;
     };
-  }
+}

services/nginx_vHosts/cache.nix

@@ -4,10 +4,10 @@
   ...
 }:
 with lib;
-  {
+{
   vHost =
-      if config.services.nix-serve.enable
+    if config.services.nix-serve.enable then
-      then {
+      {
         extraConfig = ''
           location / {
             proxy_pass http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port};
@@ -18,6 +18,7 @@ with lib;
           }
         '';
       }
-      else {};
+    else
-  }
+      { };
-  .vHost
+}
+.vHost

services/nginx_vHosts/forgejo.nix

@@ -4,10 +4,10 @@
   ...
 }:
 with lib;
-  {
+{
   vHost =
-      if config.services.forgejo.enable
+    if config.services.forgejo.enable then
-      then {
+      {
         root = "${config.services.forgejo.stateDir}/public";
         extraConfig = ''
           location / {
@@ -28,6 +28,7 @@ with lib;
           }
         '';
       }
-      else {};
+    else
-  }
+      { };
-  .vHost
+}
+.vHost

services/nginx_vHosts/hydra.nix

@@ -4,10 +4,10 @@
   ...
 }:
 with lib;
-  {
+{
   vHost =
-      if config.services.hydra.enable
+    if config.services.hydra.enable then
-      then {
+      {
         extraConfig = ''
           location / {
             proxy_pass http://${config.services.hydra.listenHost}:${toString config.services.hydra.port};
@@ -18,6 +18,7 @@ with lib;
           }
         '';
       }
-      else {};
+    else
-  }
+      { };
-  .vHost
+}
+.vHost

services/nginx_vHosts/mail.nix

@@ -4,14 +4,15 @@
   ...
 }:
 with lib;
-  {
+{
   vHost =
-      if config.mailserver.enable
+    if config.mailserver.enable then
-      then {
+      {
         serverName = config.mailserver.fqdn;
         enableACME = true;
         forceSSL = true;
       }
-      else {};
+    else
-  }
+      { };
-  .vHost
+}
+.vHost

services/nginx_vHosts/nextcloud.nix

@@ -6,8 +6,7 @@
   ...
 }:
 with lib;
-  if config.services.nextcloud.enable
+if config.services.nextcloud.enable then
-  then
   {
     vHost = {
       enableACME = config.services.nextcloud.https;
@@ -15,4 +14,5 @@ with lib;
     };
   }
   .vHost
-  else {}
+else
+  { }

services/nginx_vHosts/simple.nix

@@ -4,9 +4,9 @@
   ...
 }:
 with lib;
-  {
+{
   vHost = {
     root = "/var/www";
   };
-  }
+}
-  .vHost
+.vHost

services/nginx_vHosts/tandoor.nix

@@ -6,10 +6,11 @@
 with lib;
 let
   tandoor = config.services.tandoor-recipes;
-in {
+in
+{
   vHost =
-      if tandoor.enable
+    if tandoor.enable then
-      then {
+      {
         extraConfig = ''
           location /media/ {
             alias ${tandoor.extraConfig.MEDIA_ROOT};
@@ -24,6 +25,7 @@ in {
           }
         '';
       }
-      else {};
+    else
-  }
+      { };
-  .vHost
+}
+.vHost

services/openssh.nix

@@ -8,22 +8,27 @@
 # https://infosec.mozilla.org/guidelines/openssh.html
 # https://stribika.github.io/2015/01/04/secure-secure-shell.html
 with lib;
-  mkIf (elem "openssh" config.machine.services) {
+mkIf (elem "openssh" config.machine.services) {
   services.openssh = {
     enable = true;
-      settings.KexAlgorithms = ["curve25519-sha256@libssh.org"];
+    settings.KexAlgorithms = [ "curve25519-sha256@libssh.org" ];
-      sftpFlags = ["-f AUTHPRIV" "-l INFO"];
+    sftpFlags = [
+      "-f AUTHPRIV"
+      "-l INFO"
+    ];
     startWhenNeeded = false;
     settings = {
       KbdInteractiveAuthentication = false;
       PasswordAuthentication = false;
       PermitRootLogin = "no";
     };
-      extraConfig = let
+    extraConfig =
+      let
         users =
           concatMapStrings (user: "${user.name} ") config.machine.administrators
           + (optionalString config.services.forgejo.enable (config.services.forgejo.user + " "));
-      in ''
+      in
+      ''
         UsePAM no
         AllowUsers ${users}
         LogLevel VERBOSE
@@ -32,11 +37,9 @@ with lib;
   # Add public keys to /etc/ssh/authorized_keys.d
   # This replaces users.users.*.openssh.authorizedKeys.*
   sops.secrets =
-      fn.sopsHelper
+    fn.sopsHelper (user: "users/${user.name}/publicKey") config.machine.administrators
-      (user: "users/${user.name}/publicKey")
-      config.machine.administrators
       (user: {
         path = "/etc/ssh/authorized_keys.d/${user.name}";
         mode = "444";
       });
-  }
+}

services/podman.nix

@@ -4,10 +4,11 @@
   pkgs,
   ...
 }:
-with lib; let
+with lib;
+let
   withDocker = elem "docker" config.machine.services;
 in
-  mkIf (elem "podman" config.machine.services) {
+mkIf (elem "podman" config.machine.services) {
   virtualisation.podman = {
     enable = true;
     dockerSocket.enable = withDocker;
@@ -17,6 +18,11 @@ in
     };
   };
   environment.systemPackages =
-      (with pkgs; [podman-compose cntr img skopeo])
+    (with pkgs; [
+      podman-compose
+      cntr
+      img
+      skopeo
+    ])
     ++ (optional withDocker pkgs.docker-compose);
-  }
+}

services/tandoor.nix

@@ -5,7 +5,7 @@
   ...
 }:
 with lib;
-  mkIf (elem "tandoor" config.machine.services) {
+mkIf (elem "tandoor" config.machine.services) {
   services.tandoor-recipes = {
     enable = true;
     extraConfig = {
@@ -13,4 +13,4 @@ with lib;
       MEDIA_ROOT = "/var/lib/tandoor-recipes/media/";
     };
   };
-  }
+}

services/udev.nix

@@ -5,6 +5,6 @@
   ...
 }:
 with lib;
-  mkIf (elem "udev" config.machine.services) {
+mkIf (elem "udev" config.machine.services) {
   hardware.steam-hardware.enable = true;
-  }
+}