[meta] format all files

overlays/pyronet-packages/default.nix

···
 # deadnix: skip
-{ inputs, ...}: final: prev: {
-  py = inputs.self.packages.${prev.system};
-}
+{ inputs, ... }: final: prev: { py = inputs.self.packages.${prev.system}; }

packages/olympus/default.nix

···
-{
-  pkgs
-}: let
+{ pkgs }:
+let
   olympus = pkgs.stdenv.mkDerivation rec {
     pname = "olympus";
     version = "4085";
···
       hash = "sha256-8qHQ59QQvUfm4/2rbPaweh+q6dbzTUMMJ1n5duJ3XpI=";
     };
 
-    buildInputs = [pkgs.unzip];
+    buildInputs = [ pkgs.unzip ];
     installPhase = ''
       mkdir -p "$out/opt/olympus/"
       mv dist.zip "$out/opt/olympus/" && cd "$out/opt/olympus/"
···
     '';
   };
 in
-  pkgs.buildFHSUserEnv {
-    name = "olympus";
-    runScript = "${olympus}/opt/olympus/olympus";
-    targetPkgs = pkgs: [
-      pkgs.freetype
-      pkgs.zlib
-      pkgs.SDL2
-      pkgs.curl
-      pkgs.libpulseaudio
-      pkgs.gtk3
-      pkgs.glib
-      pkgs.libGL
-      pkgs.libdrm
-    ];
+pkgs.buildFHSUserEnv {
+  name = "olympus";
+  runScript = "${olympus}/opt/olympus/olympus";
+  targetPkgs = pkgs: [
+    pkgs.freetype
+    pkgs.zlib
+    pkgs.SDL2
+    pkgs.curl
+    pkgs.libpulseaudio
+    pkgs.gtk3
+    pkgs.glib
+    pkgs.libGL
+    pkgs.libdrm
+  ];
 
-    # https://github.com/EverestAPI/Olympus/blob/main/lib-linux/olympus.desktop
-    # https://stackoverflow.com/questions/8822097/how-to-replace-a-whole-line-with-sed
-    extraInstallCommands = ''cp -r "${olympus}/share/" $out'';
-  }
+  # https://github.com/EverestAPI/Olympus/blob/main/lib-linux/olympus.desktop
+  # https://stackoverflow.com/questions/8822097/how-to-replace-a-whole-line-with-sed
+  extraInstallCommands = ''cp -r "${olympus}/share/" $out'';
+}

systems/x86_64-linux/marvin/firewall.nix

···
-{networking.firewall = {
-  allowedTCPPorts = [80 443 6912 34197];
-  allowedUDPPorts = [4367 34197];
-  trustedInterfaces = ["tailscale0" "wg0"];
-};}
+{
+  networking.firewall = {
+    allowedTCPPorts = [
+      80
+      443
+      6912
+      34197
+    ];
+    allowedUDPPorts = [
+      4367
+      34197
+    ];
+    trustedInterfaces = [
+      "tailscale0"
+      "wg0"
+    ];
+  };
+}

systems/x86_64-linux/marvin/networking.nix

···
+{ lib, pkgs, ... }:
 {
-  lib,
-  pkgs,
-  ...
-}: {
   networking = {
     hostName = "marvin";
     hostId = "5711215d";
···
       enp42s0.useDHCP = lib.mkDefault true;
       wlp41s0.useDHCP = lib.mkDefault true;
     };
-    networkmanager = {enable = true;};
+    networkmanager = {
+      enable = true;
+    };
     wireless.enable = false;
 
     # Enable NAT for containers
     nat = {
       enable = true;
-      internalInterfaces = ["ve-+"];
+      internalInterfaces = [ "ve-+" ];
       externalInterface = "wlp41s0";
       # Lazy IPv6 connectivity for the container
       enableIPv6 = true;

systems/x86_64-linux/marvin/services/authentik.nix

···
-{config, lib, ...}: let
+{ config, lib, ... }:
+let
   d = lib.py.data.services.authentik;
-in {
-  virtualisation.oci-containers.containers = let
-    authentikVersion = "2024.2";
-    base = {
-      environmentFiles = [config.age.secrets.authentik-env.path];
-      extraOptions = ["--network=authentik"];
-    };
-    authentikBase = base // {
-      image = "ghcr.io/goauthentik/server:${authentikVersion}";
-      environment = {
-        AUTHENTIK_REDIS__HOST = "authentik-redict";
+in
+{
+  virtualisation.oci-containers.containers =
+    let
+      authentikVersion = "2024.2";
+      base = {
+        environmentFiles = [ config.age.secrets.authentik-env.path ];
+        extraOptions = [ "--network=authentik" ];
+      };
+      authentikBase = base // {
+        image = "ghcr.io/goauthentik/server:${authentikVersion}";
+        environment = {
+          AUTHENTIK_REDIS__HOST = "authentik-redict";
 
-        # Postgres Settings
-        AUTHENTIK_POSTGRESQL__HOST = "authentik-db";
-        AUTHENTIK_POSTGRESQL__PORT = "5432";
-        AUTHENTIK_POSTGRESQL__USER = "authentik";
-        AUTHENTIK_POSTGRESQL__NAME = "authentik";
-        AUTHENTIK_POSTGRESQL__PASSWORD = "\${PG_PASS}";
+          # Postgres Settings
+          AUTHENTIK_POSTGRESQL__HOST = "authentik-db";
+          AUTHENTIK_POSTGRESQL__PORT = "5432";
+          AUTHENTIK_POSTGRESQL__USER = "authentik";
+          AUTHENTIK_POSTGRESQL__NAME = "authentik";
+          AUTHENTIK_POSTGRESQL__PASSWORD = "\${PG_PASS}";
 
-        # Disable error reporting
-        AUTHENTIK_ERROR_REPORTING__ENABLED = "false";
+          # Disable error reporting
+          AUTHENTIK_ERROR_REPORTING__ENABLED = "false";
 
-        # Avatars are an attribute based on an uploaded file
-        AUTHENTIK_AVATARS = "attributes.user.avatar";
+          # Avatars are an attribute based on an uploaded file
+          AUTHENTIK_AVATARS = "attributes.user.avatar";
 
-        # Email Settings
-        AUTHENTIK_EMAIL__HOST = "mail.pyrox.dev";
-        AUTHENTIK_EMAIL__USERNAME = "[e-mail]";
-        AUTHENTIK_EMAIL__PORT = "465";
-        AUTHENTIK_EMAIL__USE_TLS = "true";
-        AUTHENTIK_EMAIL__FROM = "PyroServ Auth <[e-mail]>";
+          # Email Settings
+          AUTHENTIK_EMAIL__HOST = "mail.pyrox.dev";
+          AUTHENTIK_EMAIL__USERNAME = "[e-mail]";
+          AUTHENTIK_EMAIL__PORT = "465";
+          AUTHENTIK_EMAIL__USE_TLS = "true";
+          AUTHENTIK_EMAIL__FROM = "PyroServ Auth <[e-mail]>";
+        };
+      };
+      authentikVols = [
+        "/var/lib/authentik/media:/media"
+        "/var/lib/authentik/templates:/templates"
+      ];
+    in
+    {
+      authentik-db = base // {
+        image = "postgres:12-alpine";
+        volumes = [ "/var/lib/authentik/db_12:/var/lib/postgresql/data" ];
+        environment = {
+          POSTGRES_PASSWORD = "\${PG_PASS}";
+          POSTGRES_USER = "authentik";
+          POSTGRES_DB = "authentik";
+        };
+      };
+      authentik-redict = {
+        image = "registry.redict.io/redict:alpine";
+        extraOptions = [ "--network=authentik" ];
+      };
+      authentik-server = authentikBase // {
+        cmd = [ "server" ];
+        ports = [
+          "${toString d.port}:9000"
+          "6943:9443"
+          "9301:9300"
+        ];
+        volumes = authentikVols ++ [ "/var/lib/authentik/custom.css:/web/dist/custom.css" ];
       };
-    };
-    authentikVols = [
-      "/var/lib/authentik/media:/media"
-      "/var/lib/authentik/templates:/templates"
-    ];
-  in {
-    authentik-db = base // {
-      image = "postgres:12-alpine";
-      volumes = ["/var/lib/authentik/db_12:/var/lib/postgresql/data"];
-      environment = {
-        POSTGRES_PASSWORD = "\${PG_PASS}";
-        POSTGRES_USER = "authentik";
-        POSTGRES_DB = "authentik";
+      authentik-worker = authentikBase // {
+        cmd = [ "worker" ];
+        volumes = authentikVols ++ [ "/var/lib/authentik/certs:/certs" ];
       };
-    };
-    authentik-redict = {
-      image = "registry.redict.io/redict:alpine";
-      extraOptions = ["--network=authentik"];
-    };
-    authentik-server = authentikBase // {
-      cmd = ["server"];
-      ports = ["${toString d.port}:9000" "6943:9443" "9301:9300"];
-      volumes = authentikVols ++ [
-        "/var/lib/authentik/custom.css:/web/dist/custom.css"
-      ];
-    };
-    authentik-worker = authentikBase // {
-      cmd = ["worker"];
-      volumes = authentikVols ++ [
-        "/var/lib/authentik/certs:/certs"
-      ];
-    };
-    authentik-ldap = base // {
-      image = "ghcr.io/goauthentik/ldap:${authentikVersion}";
-      ports = ["389:3389" "636:6636"];
-      environment = {
-        AUTHENTIK_HOST = "https://${d.extUrl}";
-        AUTHENTIK_INSECURE = "false";
+      authentik-ldap = base // {
+        image = "ghcr.io/goauthentik/ldap:${authentikVersion}";
+        ports = [
+          "389:3389"
+          "636:6636"
+        ];
+        environment = {
+          AUTHENTIK_HOST = "https://${d.extUrl}";
+          AUTHENTIK_INSECURE = "false";
+        };
       };
     };
-  };
   age.secrets.authentik-env = {
     file = ../secrets/authentik-env.age;
     owner = "thehedgehog";

systems/x86_64-linux/marvin/services/bookstack.nix

···
-{services.bookstack = {enable = true;};}
+{
+  services.bookstack = {
+    enable = true;
+  };
+}

systems/x86_64-linux/marvin/services/bots.nix

···
+{ pkgs, ... }:
 {
-  pkgs,
-  ...
-}: {
   systemd.services = {
-  io-bot = {
-    enable = false;
-    wantedBy = ["multi-user.target"];
-    after = ["network.target" "io-bot-lavalink.service"];
-    description = "I/O, my personal bot";
-    path = [pkgs.python311];
-    serviceConfig = {
-      ExecStart = "${pkgs.bash}/bin/bash start.sh";
-      Restart = "always";
-      RestartSec = 3;
-      WorkingDirectory = "/home/thehedgehog/io-py";
+    io-bot = {
+      enable = false;
+      wantedBy = [ "multi-user.target" ];
+      after = [
+        "network.target"
+        "io-bot-lavalink.service"
+      ];
+      description = "I/O, my personal bot";
+      path = [ pkgs.python311 ];
+      serviceConfig = {
+        ExecStart = "${pkgs.bash}/bin/bash start.sh";
+        Restart = "always";
+        RestartSec = 3;
+        WorkingDirectory = "/home/thehedgehog/io-py";
+      };
     };
-  };
-  io-bot-lavalink = {
-    enable = false;
-    wantedBy = ["multi-user.target"];
-    after = ["network.target"];
-    description = "Lavalink server for I/O";
-    serviceConfig = {
-      ExecStart = "${pkgs.openjdk17_headless}/bin/java -jar ../Lavalink.jar";
-      Restart = "always";
-      RestartSec = 3;
-      WorkingDirectory = "/home/thehedgehog/io-py/config";
+    io-bot-lavalink = {
+      enable = false;
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      description = "Lavalink server for I/O";
+      serviceConfig = {
+        ExecStart = "${pkgs.openjdk17_headless}/bin/java -jar ../Lavalink.jar";
+        Restart = "always";
+        RestartSec = 3;
+        WorkingDirectory = "/home/thehedgehog/io-py/config";
+      };
     };
-  };
-  misc-bot = {
-    enable = false;
-    wantedBy = ["multi-user.target"];
-    after = ["network.target"];
-    description = "Random Bot 1";
-    path = [pkgs.python311];
-    serviceConfig = {
-      ExecStart = "${pkgs.bash}/bin/bash start.sh";
-      Restart = "always";
-      RestartSec = 3;
-      WorkingDirectory = "/home/thehedgehog/bots/bot1";
+    misc-bot = {
+      enable = false;
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      description = "Random Bot 1";
+      path = [ pkgs.python311 ];
+      serviceConfig = {
+        ExecStart = "${pkgs.bash}/bin/bash start.sh";
+        Restart = "always";
+        RestartSec = 3;
+        WorkingDirectory = "/home/thehedgehog/bots/bot1";
+      };
     };
-  };
   };
 }

systems/x86_64-linux/marvin/services/buildbot.nix

···
-{config, lib, ...}: let
+{ config, lib, ... }:
+let
   as = config.age.secrets;
   d = lib.py.data.services.buildbot;
   g = lib.py.data.services.git;
···
     owner = "buildbot";
     group = "buildbot";
   };
-in {
+in
+{
   services = {
-  buildbot-nix.master = {
-    enable = true;
-    dbUrl = "postgresql://buildbot@localhost/buildbot";
-    workersFile = as.buildbot-workers.path;
-    authBackend = "gitea";
-    gitea = {
+    buildbot-nix.master = {
       enable = true;
-      tokenFile = as.buildbot-gitea-token.path;
-      oauthSecretFile = as.buildbot-oauth-secret.path;
-      instanceUrl = g.extUrl;
-      oauthId = "2bfd5c46-43a7-4d98-b443-9176dc0a9452";
-      topic = "buildbot-enable";
+      dbUrl = "postgresql://buildbot@localhost/buildbot";
+      workersFile = as.buildbot-workers.path;
+      authBackend = "gitea";
+      gitea = {
+        enable = true;
+        tokenFile = as.buildbot-gitea-token.path;
+        oauthSecretFile = as.buildbot-oauth-secret.path;
+        instanceUrl = g.extUrl;
+        oauthId = "2bfd5c46-43a7-4d98-b443-9176dc0a9452";
+        topic = "buildbot-enable";
+      };
+      admins = [ "pyrox" ];
+      domain = d.extUrl;
+      useHttps = true;
     };
-    admins = [
-      "pyrox"
-    ];
-    domain = d.extUrl;
-    useHttps = true;
-  };
-  postgresql = {
-    ensureUsers = [{
-      name = "buildbot";
-      ensureDBOwnership = true;
-      ensureClauses.login = true;
-    }];
-    ensureDatabases = [ "buildbot" ];
-  };
-  buildbot-master.port = 6915;
+    postgresql = {
+      ensureUsers = [
+        {
+          name = "buildbot";
+          ensureDBOwnership = true;
+          ensureClauses.login = true;
+        }
+      ];
+      ensureDatabases = [ "buildbot" ];
+    };
+    buildbot-master.port = 6915;
   };
   age.secrets = {
     buildbot-gitea-token = bbSecret // {

systems/x86_64-linux/marvin/services/deemix.nix

···
-{data, lib, ...}: let
+{ data, lib, ... }:
+let
   d = lib.py.data.services.deemix;
-in {
+in
+{
   virtualisation.oci-containers.containers.deemix = {
     image = "registry.gitlab.com/bockiii/deemix-docker";
-    volumes = ["/var/lib/deemix:/config" "/var/lib/music:/downloads"];
-    ports = ["${toString d.port}:6595"];
+    volumes = [
+      "/var/lib/deemix:/config"
+      "/var/lib/music:/downloads"
+    ];
+    ports = [ "${toString d.port}:6595" ];
     environment = {
       PUID = "1000";
       PGID = "1000";

systems/x86_64-linux/marvin/services/grafana.nix

···
-{config, lib, ...}: let
+{ config, lib, ... }:
+let
   d = lib.py.data.services.grafana;
   a = lib.py.data.services.authentik;
-in {
+in
+{
   services.grafana = {
     enable = true;
     settings = {

systems/x86_64-linux/marvin/services/jellyfin.nix

···
 {
-  services.jellyfin = {enable = true;};
-  networking.firewall.allowedUDPPorts = [1900 7359];
+  services.jellyfin = {
+    enable = true;
+  };
+  networking.firewall.allowedUDPPorts = [
+    1900
+    7359
+  ];
 }

systems/x86_64-linux/marvin/services/minio.nix

···
-{config, ...}: {
+{ config, ... }:
+{
   services.minio = {
     enable = true;
     region = "us-east-1";

systems/x86_64-linux/marvin/services/nextcloud/imaginary.nix

···
-{ lib, ...}: let
+{ lib, ... }:
+let
   d = lib.py.data.services.nextcloud-imaginary;
-in{
+in
+{
   services.imaginary = {
     inherit (d) port;
     enable = true;

systems/x86_64-linux/marvin/services/nextcloud/office.nix

···
-{ lib, ...}: let
+{ lib, ... }:
+let
   d = lib.py.data.services.nextcloud-office;
-in {
+in
+{
   virtualisation.oci-containers.containers.collabora-office = {
     image = "collabora/code";
     ports = [ "${toString d.port}:9980" ];
···
       "--cap-add=CHOWN"
       "--cap-add=FOWNER"
     ];
-    environment = let
-      mkAlias = domain:
-        "https://" + (builtins.replaceStrings [ "." ] [ "\\." ] domain)
-        + ":443";
-    in {
-      server_name = "office.pyrox.dev";
-      aliasgroup1 = mkAlias "office.pyrox.dev";
-      aliasgroup2 = mkAlias "cloud.pyrox.dev";
-      extra_params = "--o:ssl.enable=false --o:ssl.termination=true";
-    };
-    volumes = [
-      "/var/lib/nextcloud-office/coolwsd.xml:/etc/coolwsd/coolwsd.xml"
-    ];
+    environment =
+      let
+        mkAlias = domain: "https://" + (builtins.replaceStrings [ "." ] [ "\\." ] domain) + ":443";
+      in
+      {
+        server_name = "office.pyrox.dev";
+        aliasgroup1 = mkAlias "office.pyrox.dev";
+        aliasgroup2 = mkAlias "cloud.pyrox.dev";
+        extra_params = "--o:ssl.enable=false --o:ssl.termination=true";
+      };
+    volumes = [ "/var/lib/nextcloud-office/coolwsd.xml:/etc/coolwsd/coolwsd.xml" ];
   };
 }

systems/x86_64-linux/marvin/services/nginx.nix

···
-{lib, ...}: let
+{ lib, ... }:
+let
   n = lib.py.data.services.nextcloud;
-in {
+in
+{
   services.nginx = {
     virtualHosts = {
       "${n.extUrl}" = {
-        listen = [ { inherit (n) port; addr = "0.0.0.0"; } ];
+        listen = [
+          {
+            inherit (n) port;
+            addr = "0.0.0.0";
+          }
+        ];
       };
     };
   };

systems/x86_64-linux/marvin/services/planka.nix

···
-{ config, lib, ... }: let
+{ config, lib, ... }:
+let
   dataDir = "/var/lib/planka";
   d = lib.py.data.services.planka;
-in {
+in
+{
   virtualisation.oci-containers.containers = {
     planka-server = {
       image = "ghcr.io/plankanban/planka:latest";
-      ports = ["${toString d.port}:1337"];
+      ports = [ "${toString d.port}:1337" ];
       environment = {
         BASE_URL = "https://${d.extUrl}";
         DATABASE_URL = "postgresql://planka@planka-db/planka";
···
         DEFAULT_ADMIN_EMAIL = "[e-mail]";
         DEFAULT_ADMIN_USERNAME = "pyrox";
       };
-      environmentFiles = [
-        config.age.secrets.planka-env.path
-      ];
+      environmentFiles = [ config.age.secrets.planka-env.path ];
       volumes = [
         "${dataDir}/user-avatars:/app/public/user-avatars"
         "${dataDir}/project-background-images:/app/public/project-background-images"
         "${dataDir}/attachments:/app/private/attachments"
       ];
-      extraOptions = ["--network=planka"];
+      extraOptions = [ "--network=planka" ];
     };
     planka-db = {
       image = "postgres:16-alpine";
-      volumes = [
-        "${dataDir}/db:/var/lib/postgresql/data"
-      ];
+      volumes = [ "${dataDir}/db:/var/lib/postgresql/data" ];
       environment = {
         POSTGRES_USER = "planka";
         POSTGRES_DB = "planka";
         POSTGRES_HOST_AUTH_METHOD = "trust";
       };
-      extraOptions = ["--network=planka"];
+      extraOptions = [ "--network=planka" ];
     };
   };
   age.secrets.planka-env = {

systems/x86_64-linux/marvin/services/podman.nix

···
-{virtualisation = {
-  oci-containers.backend = "docker";
-  docker = {
-    enable = true;
-    storageDriver = "zfs";
-    autoPrune.enable = true;
-    liveRestore = true;
-    daemon.settings = {
-      experimental = true;
-      ip6tables = true;
-      fixed-cidr-v6 = "2001:db8:1::/64";
+{
+  virtualisation = {
+    oci-containers.backend = "docker";
+    docker = {
+      enable = true;
+      storageDriver = "zfs";
+      autoPrune.enable = true;
+      liveRestore = true;
+      daemon.settings = {
+        experimental = true;
+        ip6tables = true;
+        fixed-cidr-v6 = "2001:db8:1::/64";
+      };
     };
   };
-};}
+}

systems/x86_64-linux/marvin/services/postgres.nix

···
-{pkgs, config, ...}: let
-cfg = config.services.postgresql;
-in {
+{ pkgs, config, ... }:
+let
+  cfg = config.services.postgresql;
+in
+{
   services.postgresql = {
     enable = true;
     package = pkgs.postgresql_16;
···
   };
   systemd.services.pg-autovacuum = {
     description = "Vacuum all Postgres databases.";
-    requisite = [
-      "postgresql.service"
-    ];
-    wantedBy = ["multi-user.target"];
+    requisite = [ "postgresql.service" ];
+    wantedBy = [ "multi-user.target" ];
     serviceConfig = {
       Type = "oneshot";
       User = "postgres";

systems/x86_64-linux/marvin/services/prometheus.nix

···
-{config, ...}: {
+{ config, ... }:
+{
   services.prometheus = {
     enable = true;
     port = 6999;
     exporters = {
       node = {
         enable = true;
-        enabledCollectors = ["systemd"];
+        enabledCollectors = [ "systemd" ];
         port = 6998;
       };
     };
···
       {
         job_name = "marvin";
         static_configs = [
-          {
-            targets = [
-              "127.0.0.1:${
-                toString config.services.prometheus.exporters.node.port
-              }"
-            ];
-          }
+          { targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ]; }
         ];
       }
       {
         job_name = "gitea";
         static_configs = [
-          {
-            targets = [
-              "127.0.0.1:${
-                toString config.services.gitea.settings.server.HTTP_PORT
-              }"
-            ];
-          }
+          { targets = [ "127.0.0.1:${toString config.services.gitea.settings.server.HTTP_PORT}" ]; }
         ];
       }
       {
         job_name = "jellyfin";
-        static_configs = [{targets = ["127.0.0.1:8096"];}];
+        static_configs = [ { targets = [ "127.0.0.1:8096" ]; } ];
       }
       {
         job_name = "authentik";
-        static_configs = [{targets = ["127.0.0.1:9301"];}];
+        static_configs = [ { targets = [ "127.0.0.1:9301" ]; } ];
       }
       {
         job_name = "prometheus";
-        static_configs = [{targets = ["127.0.0.1:6999"];}];
+        static_configs = [ { targets = [ "127.0.0.1:6999" ]; } ];
       }
     ];
   };

systems/x86_64-linux/marvin/services/prosody.nix

···
   # deadnix: skip
   lib,
   ...
-}: {services.prosody = {enable = true;};}
+}:
+{
+  services.prosody = {
+    enable = true;
+  };
+}

systems/x86_64-linux/marvin/services/redlib.nix

···
-{ pkgs, lib, ...}: let
+{ pkgs, lib, ... }:
+let
   d = lib.py.data.services.redlib;
-in {
+in
+{
   services.libreddit = {
     inherit (d) port;
     enable = true;

systems/x86_64-linux/marvin/services/syncthing.nix

···
     guiAddress = "0.0.0.0:8384";
   };
   # Open The Ports!
-  networking.firewall.allowedTCPPorts = [8384 22000];
-  networking.firewall.allowedUDPPorts = [22000 21027];
+  networking.firewall.allowedTCPPorts = [
+    8384
+    22000
+  ];
+  networking.firewall.allowedUDPPorts = [
+    22000
+    21027
+  ];
 }

systems/x86_64-linux/marvin/services/tailscale.nix

···
-{config, ...}: {
+{ config, ... }:
+{
   services.tailscale = {
     enable = true;
     permitCertUid = "962";
   };
   networking.firewall = {
-    trustedInterfaces = ["tailscale0"];
-    allowedUDPPorts = [config.services.tailscale.port];
+    trustedInterfaces = [ "tailscale0" ];
+    allowedUDPPorts = [ config.services.tailscale.port ];
     checkReversePath = "loose";
   };
 }

systems/x86_64-linux/marvin/services/vaultwarden.nix

···
-{pkgs, config, lib, ...}: let
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
 
-d = lib.py.data.services.vaultwarden;
+  d = lib.py.data.services.vaultwarden;
 
-vaultwardenSecret = {
-  owner = "vaultwarden";
-  group = "vaultwarden";
-};
-in {
+  vaultwardenSecret = {
+    owner = "vaultwarden";
+    group = "vaultwarden";
+  };
+in
+{
   services.vaultwarden = {
     enable = true;
     dbBackend = "postgresql";
···
     environmentFile = config.age.secrets.vaultwarden-vars.path;
   };
   systemd.services.vaultwarden.environment.PGPASSFILE = config.age.secrets.vaultwarden-pgpass.path;
-  environment.systemPackages = with pkgs; [vaultwarden-vault];
+  environment.systemPackages = with pkgs; [ vaultwarden-vault ];
   age.secrets.vaultwarden-vars = vaultwardenSecret // {
     file = ../secrets/vaultwarden-vars.age;
   };

systems/x86_64-linux/marvin/services/webmentiond.nix

···
-{
-  config,
-  lib,
-  ...
-}: let
+{ config, lib, ... }:
+let
   d = lib.py.data.services.webmentiond;
   p = toString d.port;
-in {
+in
+{
   virtualisation.oci-containers.containers.webmentiond = {
     image = "zerok/webmentiond:latest";
-    volumes = ["/var/lib/webmentiond:/data"];
-    environmentFiles = [config.age.secrets.webmentiond-env.path];
-    ports = [ "${p}:${p}"];
+    volumes = [ "/var/lib/webmentiond:/data" ];
+    environmentFiles = [ config.age.secrets.webmentiond-env.path ];
+    ports = [ "${p}:${p}" ];
     cmd = [
       "--addr 0.0.0.0:${p}"
       "--public-url https://${d.extUrl}"

systems/x86_64-linux/marvin/services/zfs.nix

···
   services.zfs = {
     trim.enable = true;
     autoScrub.enable = true;
-    autoScrub.pools = ["tank"];
+    autoScrub.pools = [ "tank" ];
     autoSnapshot.enable = true;
   };
 }

systems/x86_64-linux/prefect/dn42/default.nix

···
-{pkgs, ...}: {
-  imports = [./services.nix ./wireguard.nix];
+{ pkgs, ... }:
+{
+  imports = [
+    ./services.nix
+    ./wireguard.nix
+  ];
   networking.interfaces.lo = {
     ipv4.addresses = [
       {

systems/x86_64-linux/prefect/dn42/services.nix

···
-{
-  pkgs,
-  lib,
-  ...
-}: let
+{ pkgs, lib, ... }:
+let
   script = pkgs.writeShellScriptBin "update-roa" ''
     mkdir -p /etc/bird/
     ${pkgs.curl}/bin/curl -sfSLR {-o,-z}/etc/bird/roa_dn42_v6.conf https://dn42.burble.com/roa/dn42_roa_bird2_6.conf
···
     ${pkgs.bird2}/bin/birdc c
     ${pkgs.bird2}/bin/birdc reload in all
   '';
-  bgp = import ./bgp.nix {};
-in {
+  bgp = import ./bgp.nix { };
+in
+{
   systemd = {
-  timers.dn42-roa = {
-    description = "Trigger a ROA table update";
+    timers.dn42-roa = {
+      description = "Trigger a ROA table update";
 
-    timerConfig = {
-      OnBootSec = "5m";
-      OnUnitInactiveSec = "1h";
-      Unit = "dn42-roa.service";
-    };
+      timerConfig = {
+        OnBootSec = "5m";
+        OnUnitInactiveSec = "1h";
+        Unit = "dn42-roa.service";
+      };
 
-    wantedBy = ["timers.target"];
-    before = ["bird.service"];
-  };
-  services = {
-    dn42-roa = {
-      after = ["network.target"];
-      description = "DN42 ROA Updated";
-      unitConfig = {Type = "one-shot";};
-      serviceConfig = {ExecStart = "${script}/bin/update-roa";};
+      wantedBy = [ "timers.target" ];
+      before = [ "bird.service" ];
+    };
+    services = {
+      dn42-roa = {
+        after = [ "network.target" ];
+        description = "DN42 ROA Updated";
+        unitConfig = {
+          Type = "one-shot";
+        };
+        serviceConfig = {
+          ExecStart = "${script}/bin/update-roa";
+        };
+      };
     };
-  };
-  services.bird-lg-proxy.serviceConfig.User = lib.mkForce "bird2";
-  services.bird-lg-proxy.serviceConfig.Group = lib.mkForce "bird2";
+    services.bird-lg-proxy.serviceConfig.User = lib.mkForce "bird2";
+    services.bird-lg-proxy.serviceConfig.Group = lib.mkForce "bird2";
   };
 
   services = {
···
         netSpecificMode = "dn42";
         # protocolFilter = ["bgp" "ospf" "static"];
         proxyPort = 8000;
-        servers = ["dn42"];
+        servers = [ "dn42" ];
         whois = "whois.burble.dn42";
         # titleBrand = "THEHEDGEHOG LG";
         # navbar.brand = "THEHEDGEHOG LG";
···
       checkConfig = false;
       config =
         builtins.readFile ./bird.conf
-        + lib.concatStrings (builtins.map
-          (x: "\n      protocol bgp ${x.name} from dnpeers {\n        ${
-              if x.multihop
-              then "multihop;"
-              else ""
+        + lib.concatStrings (
+          builtins.map (
+            x:
+            "\n      protocol bgp ${x.name} from dnpeers {\n        ${
+              if x.multihop then "multihop;" else ""
             }\n        ${
-              if x.gracefulRestart
-              then "graceful restart on;"
-              else ""
+              if x.gracefulRestart then "graceful restart on;" else ""
             }\n        neighbor ${x.neigh} as ${x.as};\n        ${
-              if x.multi || x.v4
-              then "\n        ipv4 {\n                extended next hop on;\n                import where dn42_import_filter(${x.link},25,34);\n                export where dn42_export_filter(${x.link},25,34);\n                import keep filtered;\n        };\n        "
-              else ""
+              if x.multi || x.v4 then
+                "\n        ipv4 {\n                extended next hop on;\n                import where dn42_import_filter(${x.link},25,34);\n                export where dn42_export_filter(${x.link},25,34);\n                import keep filtered;\n        };\n        "
+              else
+                ""
             }\n        ${
-              if x.multi || x.v6
-              then "\n        ipv6 {\n                extended next hop on;\n                import where dn42_import_filter(${x.link},25,34);\n                export where dn42_export_filter(${x.link},25,34);\n                import keep filtered;\n        };\n        "
-              else ""
-            }\n    }\n        ")
-          bgp.sessions)
+              if x.multi || x.v6 then
+                "\n        ipv6 {\n                extended next hop on;\n                import where dn42_import_filter(${x.link},25,34);\n                export where dn42_export_filter(${x.link},25,34);\n                import keep filtered;\n        };\n        "
+              else
+                ""
+            }\n    }\n        "
+          ) bgp.sessions
+        )
         + bgp.extraConfig;
     };
   };
-  users.users.thehedgehog.extraGroups = ["bird2"];
+  users.users.thehedgehog.extraGroups = [ "bird2" ];
 }

systems/x86_64-linux/prefect/dn42/wireguard.nix

···
-{
-  pkgs,
-  lib,
-  ...
-}: let
+{ pkgs, lib, ... }:
+let
   defaultLocalIPv4 = "172.20.43.96/32";
   defaultLocalIPv6 = "fe80::1/64";
   privKeyFile = "/run/agenix/dn42-privkey";
   # deadnix: skip
   defaultPubKey = "e6kp9sca4XIzncKa9GEQwyOnMjje299Xg9ZdgXWMwHg=";
-in {
-  environment.systemPackages = [pkgs.wireguard-tools];
+in
+{
+  environment.systemPackages = [ pkgs.wireguard-tools ];
 
   networking.wireguard.interfaces = import ./tunnels.nix rec {
-    customTunnel = listenPort: privKeyFile: peerPubKey: endpoint: name: peerIPv4: peerIPv6: localIPv4: localIPv6: isOspf: {
-      inherit listenPort;
-      privateKeyFile = privKeyFile;
-      allowedIPsAsRoutes = false;
-      peers = [
-        {
-          inherit endpoint;
-          publicKey = peerPubKey;
-          allowedIPs = ["0.0.0.0/0" "::/0"];
-          dynamicEndpointRefreshSeconds = 5;
-          persistentKeepalive = 15;
-        }
-      ];
-      postSetup =
-        ''
-          ${
-            if peerIPv4 != ""
-            then "${pkgs.iproute2}/bin/ip addr add ${localIPv4} peer ${peerIPv4} dev ${name}"
-            else ""
-          }
-          ${
-            if peerIPv6 != ""
-            then "${pkgs.iproute2}/bin/ip -6 addr add ${localIPv6} peer ${peerIPv6} dev ${name}"
-            else ""
+    customTunnel =
+      listenPort: privKeyFile: peerPubKey: endpoint: name: peerIPv4: peerIPv6: localIPv4: localIPv6: isOspf: {
+        inherit listenPort;
+        privateKeyFile = privKeyFile;
+        allowedIPsAsRoutes = false;
+        peers = [
+          {
+            inherit endpoint;
+            publicKey = peerPubKey;
+            allowedIPs = [
+              "0.0.0.0/0"
+              "::/0"
+            ];
+            dynamicEndpointRefreshSeconds = 5;
+            persistentKeepalive = 15;
           }
-        ''
-        + lib.optionalString isOspf
-        "${pkgs.iproute2}/bin/ip -6 addr add ${defaultLocalIPv6} dev ${name}";
-    };
+        ];
+        postSetup =
+          ''
+            ${
+              if peerIPv4 != "" then
+                "${pkgs.iproute2}/bin/ip addr add ${localIPv4} peer ${peerIPv4} dev ${name}"
+              else
+                ""
+            }
+            ${
+              if peerIPv6 != "" then
+                "${pkgs.iproute2}/bin/ip -6 addr add ${localIPv6} peer ${peerIPv6} dev ${name}"
+              else
+                ""
+            }
+          ''
+          + lib.optionalString isOspf "${pkgs.iproute2}/bin/ip -6 addr add ${defaultLocalIPv6} dev ${name}";
+      };
     # deadnix: skip
-    tunnel = listenPort: privKey: peerPubKey: localIPv4: localIPv6: endpoint: name: peerIPv4: peerIPv6:
-      customTunnel listenPort privKeyFile peerPubKey endpoint name peerIPv4
-      peerIPv6
-      localIPv4
-      localIPv6
-      false;
+    tunnel =
+      listenPort: privKey: peerPubKey: localIPv4: localIPv6: endpoint: name: peerIPv4: peerIPv6:
+      customTunnel listenPort privKeyFile peerPubKey endpoint name peerIPv4 peerIPv6 localIPv4 localIPv6
+        false;
     # deadnix: skip
-    ospf = listenPort: privKey: peerPubKey: endpoint: name: peerIPv4: peerIPv6: ULAIPv6:
-      customTunnel listenPort privKeyFile peerPubKey endpoint name peerIPv4
-      peerIPv6
-      defaultLocalIPv4
-      ULAIPv6
-      true;
+    ospf =
+      listenPort: privKey: peerPubKey: endpoint: name: peerIPv4: peerIPv6: ULAIPv6:
+      customTunnel listenPort privKeyFile peerPubKey endpoint name peerIPv4 peerIPv6 defaultLocalIPv4
+        ULAIPv6
+        true;
   };
 }

systems/x86_64-linux/prefect/firewall.nix

···
   networking.nftables.enable = true;
   networking.firewall = {
     enable = true;
-    allowedTCPPorts = [80 143 179 389 443 465 587 636 993 4130 6900 8000];
-    allowedUDPPorts = [636 4367 6900 34197];
+    allowedTCPPorts = [
+      80
+      143
+      179
+      389
+      443
+      465
+      587
+      636
+      993
+      4130
+      6900
+      8000
+    ];
+    allowedUDPPorts = [
+      636
+      4367
+      6900
+      34197
+    ];
     allowedUDPPortRanges = [
       {
         from = 480;

systems/x86_64-linux/prefect/hardware.nix

···
-{zramSwap.enable = true;}
+{ zramSwap.enable = true; }

systems/x86_64-linux/prefect/networking.nix

···
+{ lib, ... }:
 {
-  lib,
-  ...
-}: {
   networking = {
     hostName = "prefect";
     hostId = "496e5e96";

systems/x86_64-linux/prefect/packages.nix

···
-{pkgs, ...}: {environment.systemPackages = with pkgs; [direnv];}
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [ direnv ];
+}

systems/x86_64-linux/prefect/secrets/secrets.nix

···
   # deadnix: skip
   backup = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCyTiGctsHaTUlRJn2XQ/745dD0UWGWO8W0en8J5rf7BLI8lL/hPUmbNt45vC5754LXcBjnp1t/1FNgiGhvNZIWJpC+elBmhyMhg8z1exRZPD+as7XaH7scnij2vSbSphQFUqH433ggAGe77x5bc7wKFp9n7vj8G1u0JJxMEe1M7kNFY0+ShNtaHna3LxiQOVcW7qVlNKZP8Ol1V7kZLblRADCJMTYOXDIbktA8bbGRfGhbNjJGkL665qz36haYwb2i6A4sC7Y583N8ro8hIDG/ByJqwbl/Sz4rSxkT6G4+OdBvS6sa7TovNXHjmQCculMIltdog7UhgyBsim1sTzxAen3YyFRi1Cz/kLM0oH39m/W4IoMvJcNZCJ3ItLgy+lEVMd87jVOqfuq/hyjHVI0wJtU2Si2HTxv7aKL8gPzqXwbNH+nhkhlQ0ZH8zKVBunOgLDgsmGIky5X/T3bpWZpIoFkOR7AYrId/5dOeGM3pHhHb6woZ3SRubZ43Ah/VdJM=";
   prefect = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP532AB5mkNvE29MkDDY8HEf8ZdktGWiI0PzLrvbmLQe";
-in {
-  imports = [../../common/secrets/secrets.nix];
-  "headscale-oidc-secret.age".publicKeys = [prefect yubi-main yubi-back];
-  "dn42-privkey.age".publicKeys = [prefect yubi-main yubi-back];
-  "dn42-peerfinder-uuid.age".publicKeys = [prefect yubi-main yubi-back];
-  "wireguard-priv-key.age".publicKeys = [prefect yubi-main yubi-back];
-  "acme-creds.age".publicKeys = [prefect yubi-main yubi-back];
+in
+{
+  imports = [ ../../common/secrets/secrets.nix ];
+  "headscale-oidc-secret.age".publicKeys = [
+    prefect
+    yubi-main
+    yubi-back
+  ];
+  "dn42-privkey.age".publicKeys = [
+    prefect
+    yubi-main
+    yubi-back
+  ];
+  "dn42-peerfinder-uuid.age".publicKeys = [
+    prefect
+    yubi-main
+    yubi-back
+  ];
+  "wireguard-priv-key.age".publicKeys = [
+    prefect
+    yubi-main
+    yubi-back
+  ];
+  "acme-creds.age".publicKeys = [
+    prefect
+    yubi-main
+    yubi-back
+  ];
 }

systems/x86_64-linux/prefect/services/acme.nix

···
-{config, ...}: {
+{ config, ... }:
+{
   security.acme = {
-    certs."pyrox.dev" = {domain = "*.pyrox.dev";};
+    certs."pyrox.dev" = {
+      domain = "*.pyrox.dev";
+    };
     defaults = {
       # LE Production Server
       server = "https://acme-v02.api.letsencrypt.org/directory";

systems/x86_64-linux/prefect/services/blog-update.nix

···
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   systemd.timers.blog-update = {
     enable = false;
-    after = ["network.target"];
-    wantedBy = ["multi-user.target"];
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
     description = "Blog Update Timer";
     timerConfig = {
       Unit = "blog-update.service";
···
 
   systemd.services.blog-update = {
     enable = false;
-    wantedBy = ["multi-user.target"];
+    wantedBy = [ "multi-user.target" ];
     description = "Blog Update Service";
     path = [
       "${pkgs.hugo}"

systems/x86_64-linux/prefect/services/headscale.nix

···
       # See https://tailscale.com/kb/1081/magicdns/ for more details
       magicDns = true;
       # I inject DNS.sb as my secondary nameserver, and my adblocking server as primary.
-      nameservers = ["45.11.45.11"];
+      nameservers = [ "45.11.45.11" ];
       # Domains to inject, so I can type "media/" into my search bar and go to "media.main.hog"
       # You can't tell headscale to not create a namespace, so this is the best that I can do
-      domains = ["main.hog"];
+      domains = [ "main.hog" ];
     };
     # Automatic TLS
     tls = {
···
       # oidc.strip_email_domain = true;
       # NixOS handles our updates
       disable_check_updates = true;
-      ip_prefixes = ["4349:3909:beef::/48" "100.64.0.0/10"];
+      ip_prefixes = [
+        "4349:3909:beef::/48"
+        "100.64.0.0/10"
+      ];
       derp = {
         server = {
           enabled = true;
···
       };
     };
   };
-  systemd.services.headscale.serviceConfig.CapabilityBoundingSet = ["CAP_CHOWN" "CAP_NET_BIND_SERVICE"];
-  systemd.services.headscale.serviceConfig.AmbientCapabilities = ["CAP_CHOWN" "CAP_NET_BIND_SERVICE"];
+  systemd.services.headscale.serviceConfig.CapabilityBoundingSet = [
+    "CAP_CHOWN"
+    "CAP_NET_BIND_SERVICE"
+  ];
+  systemd.services.headscale.serviceConfig.AmbientCapabilities = [
+    "CAP_CHOWN"
+    "CAP_NET_BIND_SERVICE"
+  ];
 }

systems/x86_64-linux/prefect/services/mailserver/default.nix

···
+{ lib, ... }:
 {
-  lib,
-  ...
-}: {
-  imports = [./logins.nix ./monitoring.nix ./overrides.nix];
+  imports = [
+    ./logins.nix
+    ./monitoring.nix
+    ./overrides.nix
+  ];
   mailserver = {
     enable = true;
     fqdn = "mail.pyrox.dev";
     openFirewall = true;
 
     # All domains this server runs email for
-    domains = ["pyrox.dev"];
+    domains = [ "pyrox.dev" ];
 
     # Enable STARTTLS
     enableImap = true;
···
     dkimKeyDirectory = "/srv/mail/dkim";
 
     # Set all no-reply addresses
-    rejectRecipients = [ "[e-mail]" "[e-mail]" ];
+    rejectRecipients = [
+      "[e-mail]"
+      "[e-mail]"
+    ];
 
     # DKIM Settings
     dkimBodyCanonicalization = "relaxed";

systems/x86_64-linux/prefect/services/mailserver/logins.nix

···
   mailserver.loginAccounts = {
     "[e-mail]" = {
       hashedPassword = "$2b$05$8k04quBe6adg8d1yznEp3uNYM54MOVJTwDGIWvzocQFoWbmcCvebC";
-      aliases = ["pyrox" "[e-mail]" "[e-mail]" "[e-mail]"];
+      aliases = [
+        "pyrox"
+        "[e-mail]"
+        "[e-mail]"
+        "[e-mail]"
+      ];
     };
     "[e-mail]" = {
       hashedPassword = "$2b$05$kFDeXvSKU9oXuQXlitA7v.kkbzgCDTrm4O3Nb1kifPe7yAR7.KimO";

systems/x86_64-linux/prefect/services/mailserver/monitoring.nix

···
-{
-  config,
-  pkgs,
-  ...
-}:
+{ config, pkgs, ... }:
 # let
 #   cfg = config.mailserver;
 # in

systems/x86_64-linux/prefect/services/mailserver/overrides.nix

···
-{lib, ...}: let
+{ lib, ... }:
+let
   inherit (lib) mkForce;
   tlsProtocols = ">=TLSv1.2";
   excludeCiphers = "MD5, DES, ADH, RC4, PSD, SRP, 3DES, eNULL, aNULL, AES128-SHA, AES256-SHA";
-in {
+in
+{
   services.postfix.config = {
     # only support TLS 1.3/1.2
     smtpd_tls_protocols = mkForce tlsProtocols;

systems/x86_64-linux/prefect/services/nginx/default.nix

···
-{ lib
-, ...
-}: {
+{ lib, ... }:
+{
   services.nginx = {
     enable = true;
     additionalModules = [ ];

systems/x86_64-linux/prefect/services/php.nix

···
+{ lib, pkgs, ... }:
 {
-  lib,
-  pkgs,
-  ...
-}: {
   services.phpfpm.pools = {
     littlelink = {
       user = "caddy";
···
         "php_admin_flag[log_errors]" = true;
         "catch_workers_output" = true;
       };
-      phpEnv."PATH" = lib.makeBinPath [pkgs.php];
+      phpEnv."PATH" = lib.makeBinPath [ pkgs.php ];
     };
   };
 }

systems/x86_64-linux/prefect/services/prometheus.nix

···
-{config, ...}: {
+{ config, ... }:
+{
   services.prometheus = {
     enable = true;
     port = 6999;
     exporters = {
       node = {
         enable = true;
-        enabledCollectors = ["systemd"];
+        enabledCollectors = [ "systemd" ];
         port = 6998;
       };
-      bird = {enable = true;};
+      bird = {
+        enable = true;
+      };
     };
     scrapeConfigs = [
       {
         job_name = "prefect";
         static_configs = [
-          {
-            targets = [
-              "127.0.0.1:${
-                toString config.services.prometheus.exporters.node.port
-              }"
-            ];
-          }
+          { targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ]; }
         ];
       }
       {
         job_name = "caddy";
-        static_configs = [{targets = ["127.0.0.1:6899"];}];
+        static_configs = [ { targets = [ "127.0.0.1:6899" ]; } ];
       }
       {
         job_name = "bird";
-        static_configs = [{targets = ["127.0.0.1:9324"];}];
+        static_configs = [ { targets = [ "127.0.0.1:9324" ]; } ];
       }
       {
         job_name = "prometheus";
-        static_configs = [{targets = ["127.0.0.1:6999"];}];
+        static_configs = [ { targets = [ "127.0.0.1:6999" ]; } ];
       }
     ];
   };

systems/x86_64-linux/prefect/services/tailscale.nix

···
-{config, ...}: {
-  services.tailscale = {enable = true;};
+{ config, ... }:
+{
+  services.tailscale = {
+    enable = true;
+  };
   networking.firewall = {
-    trustedInterfaces = ["tailscale0"];
-    allowedUDPPorts = [config.services.tailscale.port];
+    trustedInterfaces = [ "tailscale0" ];
+    allowedUDPPorts = [ config.services.tailscale.port ];
     checkReversePath = "loose";
   };
 }

systems/x86_64-linux/prefect/services/zerotier.nix

···
 {
   services.zerotierone = {
     enable = true;
-    joinNetworks = ["a84ac5c10a3b1d69"];
+    joinNetworks = [ "a84ac5c10a3b1d69" ];
   };
 }

systems/x86_64-linux/thought/firewall.nix

···
 {
   networking.firewall = {
     enable = true;
-    allowedTCPPorts = [8000];
-    allowedUDPPorts = [34197];
+    allowedTCPPorts = [ 8000 ];
+    allowedUDPPorts = [ 34197 ];
   };
   services.ferm = {
     enable = true;

systems/x86_64-linux/thought/hardware.nix

···
-{zramSwap.enable = true;}
+{ zramSwap.enable = true; }

systems/x86_64-linux/thought/networking.nix

···
+{ lib, ... }:
 {
-  lib,
-  ...
-}: {
   networking = {
     hostName = "thought";
     hostId = "1e22528e";
     useDHCP = false;
-    nameservers = lib.mkForce [];
+    nameservers = lib.mkForce [ ];
     resolvconf.enable = false;
     interfaces.enp1s0 = {
       ipv6.addresses = [

systems/x86_64-linux/thought/packages.nix

···
-{pkgs, ...}: {environment.systemPackages = with pkgs; [direnv];}
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [ direnv ];
+}

systems/x86_64-linux/thought/secrets/secrets.nix

···
   backup = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCyTiGctsHaTUlRJn2XQ/745dD0UWGWO8W0en8J5rf7BLI8lL/hPUmbNt45vC5754LXcBjnp1t/1FNgiGhvNZIWJpC+elBmhyMhg8z1exRZPD+as7XaH7scnij2vSbSphQFUqH433ggAGe77x5bc7wKFp9n7vj8G1u0JJxMEe1M7kNFY0+ShNtaHna3LxiQOVcW7qVlNKZP8Ol1V7kZLblRADCJMTYOXDIbktA8bbGRfGhbNjJGkL665qz36haYwb2i6A4sC7Y583N8ro8hIDG/ByJqwbl/Sz4rSxkT6G4+OdBvS6sa7TovNXHjmQCculMIltdog7UhgyBsim1sTzxAen3YyFRi1Cz/kLM0oH39m/W4IoMvJcNZCJ3ItLgy+lEVMd87jVOqfuq/hyjHVI0wJtU2Si2HTxv7aKL8gPzqXwbNH+nhkhlQ0ZH8zKVBunOgLDgsmGIky5X/T3bpWZpIoFkOR7AYrId/5dOeGM3pHhHb6woZ3SRubZ43Ah/VdJM=";
   # deadnix: skip
   thought = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGkJcLykggEp427h2IywoiR74Yl3N+FU6Pwx9ZFQ3vjq";
-in {
-  imports = [../../common/secrets/secrets.nix];
+in
+{
+  imports = [ ../../common/secrets/secrets.nix ];
   # "headscale-oidc-secret.age".publicKeys = [ prefect yubi-main yubi-back ];
 }

systems/x86_64-linux/thought/services/prometheus.nix

···
-{config, ...}: {
+{ config, ... }:
+{
   services.prometheus = {
     enable = true;
     port = 6999;
     exporters = {
       node = {
         enable = true;
-        enabledCollectors = ["systemd"];
+        enabledCollectors = [ "systemd" ];
         port = 6998;
       };
-      bird = {enable = true;};
+      bird = {
+        enable = true;
+      };
     };
     scrapeConfigs = [
       {
         job_name = "prefect";
         static_configs = [
-          {
-            targets = [
-              "127.0.0.1:${
-                toString config.services.prometheus.exporters.node.port
-              }"
-            ];
-          }
+          { targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ]; }
         ];
       }
       {
         job_name = "caddy";
-        static_configs = [{targets = ["127.0.0.1:6899"];}];
+        static_configs = [ { targets = [ "127.0.0.1:6899" ]; } ];
       }
       {
         job_name = "bird";
-        static_configs = [{targets = ["127.0.0.1:9324"];}];
+        static_configs = [ { targets = [ "127.0.0.1:9324" ]; } ];
       }
       {
         job_name = "prometheus";
-        static_configs = [{targets = ["127.0.0.1:6999"];}];
+        static_configs = [ { targets = [ "127.0.0.1:6999" ]; } ];
       }
     ];
   };

systems/x86_64-linux/thought/services/tailscale.nix

···
-{config, ...}: {
-  services.tailscale = {enable = true;};
+{ config, ... }:
+{
+  services.tailscale = {
+    enable = true;
+  };
   networking.firewall = {
-    trustedInterfaces = ["tailscale0"];
-    allowedUDPPorts = [config.services.tailscale.port];
+    trustedInterfaces = [ "tailscale0" ];
+    allowedUDPPorts = [ config.services.tailscale.port ];
     checkReversePath = "loose";
   };
 }

systems/x86_64-linux/zaphod/fonts.nix

···
+{ pkgs, lib, ... }:
 {
-  pkgs,
-  lib,
-  ...
-}: {
   fonts = {
     fontDir.enable = true;
     fontconfig = {
       enable = lib.mkForce true;
       defaultFonts = {
-        serif = ["IBM Plex Serif"];
-        sansSerif = ["IBM Plex Sans"];
-        monospace = ["IBM Plex Mono" "FiraCode Nerd Font Mono"];
-        emoji = ["JoyPixels"];
+        serif = [ "IBM Plex Serif" ];
+        sansSerif = [ "IBM Plex Sans" ];
+        monospace = [
+          "IBM Plex Mono"
+          "FiraCode Nerd Font Mono"
+        ];
+        emoji = [ "JoyPixels" ];
       };
     };
     packages = with pkgs; [

systems/x86_64-linux/zaphod/kde.nix

···
-{services.xserver = {
-  enable = false;
-  displayManager = {
-    sddm.enable = false;
-    defaultSession = "plasmawayland";
-  };
-  desktopManager.plasma5 = {
+{
+  services.xserver = {
     enable = false;
-    phononBackend = "vlc";
-    runUsingSystemd = true;
-    useQtScaling = true;
-  };
+    displayManager = {
+      sddm.enable = false;
+      defaultSession = "plasmawayland";
+    };
+    desktopManager.plasma5 = {
+      enable = false;
+      phononBackend = "vlc";
+      runUsingSystemd = true;
+      useQtScaling = true;
+    };
   };
   qt = {
     enable = true;

systems/x86_64-linux/zaphod/networking.nix

···
+{ lib, pkgs, ... }:
 {
-  lib,
-  pkgs,
-  ...
-}: {
   networking = {
     enableB43Firmware = false;
     enableIPv6 = true;
···
       dns = lib.mkForce "default";
       wifi.powersave = true;
     };
-    wireless = {enable = false;};
+    wireless = {
+      enable = false;
+    };
 
     # Tailscale fix(not needed, but recommended)
     firewall.checkReversePath = "loose";
 
     # DNS Servers
     # Only use local resolver
-    nameservers = lib.mkForce [];
+    nameservers = lib.mkForce [ ];
 
     resolvconf.enable = false;
   };
   services.resolved = {
     enable = false;
     llmnr = "true";
-    fallbackDns = ["158.59.252.11"];
+    fallbackDns = [ "158.59.252.11" ];
     extraConfig = ''
       MulticastDNS=true
     '';

systems/x86_64-linux/zaphod/power.nix

···
-{powerManagement.enable = true;}
+{ powerManagement.enable = true; }

systems/x86_64-linux/zaphod/programs/sway.nix

···
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   programs.sway = {
     enable = true;
-    extraPackages = with pkgs; [swaylock-effects swayidle kitty];
+    extraPackages = with pkgs; [
+      swaylock-effects
+      swayidle
+      kitty
+    ];
     wrapperFeatures.base = true;
     wrapperFeatures.gtk = true;
   };

systems/x86_64-linux/zaphod/secrets/secrets.nix

···
   yubi-back = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDTVGi3PItsbUhFgnFZlqo1iUggL4npMg94+9FsyhEPfShcQwJK2/jJzjv5S9KPuk3cY7aoqyVFLbnasSBZPXmscJmOiVNvtWvHoC3QPXvf3IAcVZ5KOLpY2NJlPx/pAb31C6ewtg8v3VlyhL4zEp6M+AGwXX51tFDh2GnYD+7SNF+aMhKCrX63syAhgPy3F8mZ2RIDLAu+lsYlwdpWRkSEv9kcjX/6+3QgUWjfPBaKEeYID22ihSuj7+AiuAt0gM4q0TY/Hpcx+qDLonrIuBnm1hMZDgbv//D0sHIUxJQkGTKTEbkZxoh0Qri7UV/V6l3mETaG40deuemMU7RFY7Khl8RajNZ+9z0FdquS/HCt8+fYQk6eLneJrMIQ1bI4awrtblG3P2Yf2QUu+H3kfCQe44R3WjUugTbNtumVgyQBzl2dzlIVn1pZBeyZy70XCgbaFKkDR8Y/qZiUoZ0afP3vTOXhkn5UBfutTKwUiSGh3S8Ge5YhNgKHWE2eQp1ckEm0IMJV/q5Nsw/yBBXj/kfD8ekz96LQ+gP5JFLq4EaipXI7FM4aZNOBUZU1l/sCEuq7m997nrBucTKqGm7Ho3rq7bgdj4f6GyUJXSMOM1cN61LLrRumZGGTH8WghVL7ligxZyNFcQoudR8jfpf4mrgRxipQOe1A2umvuufMr+l/bw==";
   yubi-main = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBBsOIMMZVmleClXfqUMrnmyh8PFuyiJqHKEZ51Xy746";
   backup = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCyTiGctsHaTUlRJn2XQ/745dD0UWGWO8W0en8J5rf7BLI8lL/hPUmbNt45vC5754LXcBjnp1t/1FNgiGhvNZIWJpC+elBmhyMhg8z1exRZPD+as7XaH7scnij2vSbSphQFUqH433ggAGe77x5bc7wKFp9n7vj8G1u0JJxMEe1M7kNFY0+ShNtaHna3LxiQOVcW7qVlNKZP8Ol1V7kZLblRADCJMTYOXDIbktA8bbGRfGhbNjJGkL665qz36haYwb2i6A4sC7Y583N8ro8hIDG/ByJqwbl/Sz4rSxkT6G4+OdBvS6sa7TovNXHjmQCculMIltdog7UhgyBsim1sTzxAen3YyFRi1Cz/kLM0oH39m/W4IoMvJcNZCJ3ItLgy+lEVMd87jVOqfuq/hyjHVI0wJtU2Si2HTxv7aKL8gPzqXwbNH+nhkhlQ0ZH8zKVBunOgLDgsmGIky5X/T3bpWZpIoFkOR7AYrId/5dOeGM3pHhHb6woZ3SRubZ43Ah/VdJM=";
-in {"wg-privkey.age".publicKeys = [yubi-back yubi-main backup];}
+in
+{
+  "wg-privkey.age".publicKeys = [
+    yubi-back
+    yubi-main
+    backup
+  ];
+}

systems/x86_64-linux/zaphod/security/modules.nix

···
 {
-  imports = [./pam.nix];
-  security = {protectKernelImage = true;};
+  imports = [ ./pam.nix ];
+  security = {
+    protectKernelImage = true;
+  };
 }

systems/x86_64-linux/zaphod/services/docker.nix

···
-{pkgs, ...}: let
+{ pkgs, ... }:
+let
 
-betterDocker = pkgs.docker.override {
-  buildxSupport = false;
-  composeSupport = false;
-  sbomSupport = false;
-};
-in {
+  betterDocker = pkgs.docker.override {
+    buildxSupport = false;
+    composeSupport = false;
+    sbomSupport = false;
+  };
+in
+{
   virtualisation.docker = {
     enable = true;
     package = betterDocker;

systems/x86_64-linux/zaphod/services/fprintd.nix

···
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   services.fprintd = {
     enable = true;
     tod.enable = true;

systems/x86_64-linux/zaphod/services/fwupd.nix

···
 {
   services.fwupd = {
     enable = true;
-    extraRemotes = ["lvfs-testing"];
+    extraRemotes = [ "lvfs-testing" ];
     uefiCapsuleSettings = {
       "DisableCapsuleUpdateOnDisk" = true;
     };

systems/x86_64-linux/zaphod/services/greetd.nix

···
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   services.greetd = {
     enable = true;
     settings = {

systems/x86_64-linux/zaphod/services/kmscon.nix

···
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   services.kmscon = {
     enable = true;
     hwRender = true;
     fonts = [
       {
         name = "BlexMono Nerd Font";
-        package = pkgs.nerdfonts.override {fonts = ["IBMPlexMono"];};
+        package = pkgs.nerdfonts.override { fonts = [ "IBMPlexMono" ]; };
       }
     ];
   };

systems/x86_64-linux/zaphod/services/misc.nix

···
+{ config, lib, ... }:
 {
-  config,
-  lib,
-  ...
-}: {
   services = {
     blueman.enable = true;
     fstrim.enable = lib.mkDefault true;
-    tlp.enable =
-      lib.mkDefault
-      ((lib.versionOlder (lib.versions.majorMinor lib.version) "21.05")
-        || !config.services.power-profiles-daemon.enable);
+    tlp.enable = lib.mkDefault (
+      (lib.versionOlder (lib.versions.majorMinor lib.version) "21.05")
+      || !config.services.power-profiles-daemon.enable
+    );
     libinput.enable = lib.mkDefault true;
   };
 }

systems/x86_64-linux/zaphod/services/packagekit.nix

···
-{services = {packagekit.enable = false;};}
+{
+  services = {
+    packagekit.enable = false;
+  };
+}

systems/x86_64-linux/zaphod/services/pcscd.nix

···
-{services.pcscd = {enable = true;};}
+{
+  services.pcscd = {
+    enable = true;
+  };
+}

systems/x86_64-linux/zaphod/services/tailscale.nix

···
-{services.tailscale = {enable = true;};}
+{
+  services.tailscale = {
+    enable = true;
+  };
+}