treewide: reformat

.sops.nix

···
     }
   ];
 
-  mkHost = name: identities:
-    assert builtins.typeOf identities == "list"; {
+  mkHost =
+    name: identities:
+    assert builtins.typeOf identities == "list";
+    {
       path_regex = "creds/sops/${name}/.*";
       key_groups = [
         {
-          age =
-            [
-              # admin
-              age.soopyc_pxl7ag
-              age.soopyc_mbp14
-            ]
-            ++ identities;
+          age = [
+            # admin
+            age.soopyc_pxl7ag
+            age.soopyc_mbp14
+          ] ++ identities;
         }
       ];
     };
-in {
+in
+{
   # remember to run `just utils update-sops-config` and `sops updatekeys` after editing.
   creation_rules = [
     {
···
       key_groups = everything;
     }
 
-    (mkHost "koumakan" [age.koumakan])
-    (mkHost "satori" [age.satori])
-    (mkHost "renko" [age.renko])
+    (mkHost "koumakan" [ age.koumakan ])
+    (mkHost "satori" [ age.satori ])
+    (mkHost "renko" [ age.renko ])
 
-    (mkHost "bocchi" [age.bocchi])
-    (mkHost "kita" [age.kita])
-    (mkHost "ryo" [age.ryo])
-    (mkHost "nijika" [age.nijika])
+    (mkHost "bocchi" [ age.bocchi ])
+    (mkHost "kita" [ age.kita ])
+    (mkHost "ryo" [ age.ryo ])
+    (mkHost "nijika" [ age.nijika ])
   ];
 }

flake.nix

···
     };
   };
 
-  outputs = {
-    self,
-    nixpkgs,
-    treefmt-nix,
-    ...
-  } @ inputs: let
-    lib = nixpkgs.lib;
+  outputs =
+    {
+      self,
+      nixpkgs,
+      treefmt-nix,
+      ...
+    }@inputs:
+    let
+      lib = nixpkgs.lib;
 
-    systems = [
-      "x86_64-linux"
-      "aarch64-linux"
-      "x86_64-darwin"
-      "aarch64-darwin"
-    ];
-    forAllSystems = fn: lib.genAttrs systems (system: fn nixpkgs.legacyPackages.${system});
-    treefmt = forAllSystems (pkgs: treefmt-nix.lib.evalModule pkgs ./nix/treefmt.nix);
-  in {
-    lib.x86_64-linux = import ./global/utils.nix {
-      inherit inputs;
-      system = "x86_64-linux";
-    };
+      systems = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
+      forAllSystems = fn: lib.genAttrs systems (system: fn nixpkgs.legacyPackages.${system});
+      treefmt = forAllSystems (pkgs: treefmt-nix.lib.evalModule pkgs ./nix/treefmt.nix);
+    in
+    {
+      lib.x86_64-linux = import ./global/utils.nix {
+        inherit inputs;
+        system = "x86_64-linux";
+      };
 
-    packages.x86_64-linux = let
-      system = "x86_64-linux";
-    in {
-      brcmfmac = let
-        pkgs = import nixpkgs {
-          inherit system;
-          config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) ["brcm-mac-firmware"];
+      packages.x86_64-linux =
+        let
+          system = "x86_64-linux";
+        in
+        {
+          brcmfmac =
+            let
+              pkgs = import nixpkgs {
+                inherit system;
+                config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "brcm-mac-firmware" ];
+              };
+            in
+            pkgs.callPackage ./vendor/brcmfmac { };
         };
-      in
-        pkgs.callPackage ./vendor/brcmfmac {};
-    };
 
-    nixosConfigurations = import systems/default.nix {inherit inputs lib;};
+      nixosConfigurations = import systems/default.nix { inherit inputs lib; };
 
-    devShells = forAllSystems (pkgs: import ./nix/devshell.nix {inherit pkgs inputs;});
+      devShells = forAllSystems (pkgs: import ./nix/devshell.nix { inherit pkgs inputs; });
 
-    checks = forAllSystems (pkgs:
-      (import ./nix/checks.nix {inherit pkgs inputs;})
-      // {
-        formatting = treefmt.${pkgs.system}.config.build.check self;
-      });
+      checks = forAllSystems (
+        pkgs:
+        (import ./nix/checks.nix { inherit pkgs inputs; })
+        // {
+          formatting = treefmt.${pkgs.system}.config.build.check self;
+        }
+      );
 
-    formatter = forAllSystems (pkgs: treefmt.${pkgs.system}.config.build.wrapper);
-  };
+      formatter = forAllSystems (pkgs: treefmt.${pkgs.system}.config.build.wrapper);
+    };
 }

global/core.nix

···
   pkgs,
   inputs,
   ...
-}: {
+}:
+{
   imports = [
     ./upgrade-diff.nix
   ];

global/default.nix

···
 # This is a NixOS module, you cannot use this as a standalone file.
 # Other files may be though, but things that starts with {...}: most definitely aren't.
-{inputs, ...}: {
+{ inputs, ... }:
+{
   imports = [
     ./core.nix
     ./gensokyo

global/gensokyo/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./traits.nix
     ./presets

global/gensokyo/presets/certificates.nix

···
   config,
   lib,
   ...
-}: let
+}:
+let
   secrets = _utils.setupSecrets config {
     namespace = "lego";
-    secrets = ["cf_token"];
+    secrets = [ "cf_token" ];
   };
-in {
-  config = lib.mkIf config.gensokyo.presets.certificates (lib.mkMerge [
-    {
-      security.acme = {
-        acceptTerms = true;
+in
+{
+  config = lib.mkIf config.gensokyo.presets.certificates (
+    lib.mkMerge [
+      {
+        security.acme = {
+          acceptTerms = true;
 
-        defaults = {
-          # == lego Configuration ==
-          # In an ideal world we would have an ed/cv25519 algo here but oh well
-          keyType = "ec256"; # Ensure we use ec keys
-          credentialFiles.CLOUDFLARE_DNS_API_TOKEN_FILE = secrets.get "cf_token";
-          dnsProvider = "cloudflare";
+          defaults = {
+            # == lego Configuration ==
+            # In an ideal world we would have an ed/cv25519 algo here but oh well
+            keyType = "ec256"; # Ensure we use ec keys
+            credentialFiles.CLOUDFLARE_DNS_API_TOKEN_FILE = secrets.get "cf_token";
+            dnsProvider = "cloudflare";
 
-          # == LE Configuration ==
-          email = "[e-mail]";
-          # server = "https://acme-staging-v02.api.letsencrypt.org/directory";
-          server = "https://acme-v02.api.letsencrypt.org/directory";
+            # == LE Configuration ==
+            email = "[e-mail]";
+            # server = "https://acme-staging-v02.api.letsencrypt.org/directory";
+            server = "https://acme-v02.api.letsencrypt.org/directory";
+          };
         };
-      };
-    }
-    secrets.generate
-  ]);
+      }
+      secrets.generate
+    ]
+  );
 }

global/gensokyo/presets/default.nix

···
-{lib, ...}: {
+{ lib, ... }:
+{
   imports = [
     ./vmetrics.nix
     ./nginx.nix

global/gensokyo/presets/nginx.nix

···
   pkgs,
   config,
   ...
-}: let
+}:
+let
   presetConf = config.gensokyo.presets;
 in
-  lib.mkIf presetConf.nginx (lib.mkMerge [
+lib.mkIf presetConf.nginx (
+  lib.mkMerge [
     {
       services.nginx = {
         enable = lib.mkDefault true;
···
       services.vmagent.prometheusConfig.scrape_configs = [
         {
           job_name = "nginx";
-          static_configs = [{targets = ["localhost:${builtins.toString config.services.prometheus.exporters.nginx.port}"];}];
+          static_configs = [
+            { targets = [ "localhost:${builtins.toString config.services.prometheus.exporters.nginx.port}" ]; }
+          ];
           relabel_configs = [
             {
               target_label = "instance";
···
         }
       ];
     })
-  ])
+  ]
+)

global/gensokyo/presets/secureboot.nix

···
 let
   cfg = config.gensokyo.presets;
 in
-  lib.mkIf cfg.secureboot {
-    environment.systemPackages = [pkgs.sbctl];
+lib.mkIf cfg.secureboot {
+  environment.systemPackages = [ pkgs.sbctl ];
 
-    # lanzaboote currently replaces systemd-boot, so disable that here.
-    boot.loader.systemd-boot.enable = lib.mkForce false;
-    boot.lanzaboote = {
-      enable = true;
-      pkiBundle = "/etc/secureboot";
-    };
-  }
+  # lanzaboote currently replaces systemd-boot, so disable that here.
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.lanzaboote = {
+    enable = true;
+    pkiBundle = "/etc/secureboot";
+  };
+}

global/gensokyo/presets/vmetrics.nix

···
   config,
   _utils,
   ...
-}: let
+}:
+let
   secrets = _utils.setupSecrets config {
     namespace = "vmetrics";
-    secrets = ["auth"];
+    secrets = [ "auth" ];
   };
-in {
+in
+{
   # inb4 this causes conflicts
-  config = lib.mkIf config.gensokyo.presets.vmetrics (lib.mkMerge [
-    {
-      services.prometheus.exporters.node.enable = true;
-      services.vmagent.enable = true;
-      services.vmagent.remoteWrite.url = "https://panopticon.soopy.moe/api/v1/write";
-      services.vmagent.extraArgs = ["-remoteWrite.bearerTokenFile=%d/auth_token"];
-      services.vmagent.prometheusConfig = {
-        global.scrape_interval = "30s";
+  config = lib.mkIf config.gensokyo.presets.vmetrics (
+    lib.mkMerge [
+      {
+        services.prometheus.exporters.node.enable = true;
+        services.vmagent.enable = true;
+        services.vmagent.remoteWrite.url = "https://panopticon.soopy.moe/api/v1/write";
+        services.vmagent.extraArgs = [ "-remoteWrite.bearerTokenFile=%d/auth_token" ];
+        services.vmagent.prometheusConfig = {
+          global.scrape_interval = "30s";
 
-        scrape_configs = [
-          {
-            job_name = "node";
-            static_configs = [{targets = ["localhost:${builtins.toString config.services.prometheus.exporters.node.port}"];}];
-            relabel_configs = [
-              {
-                target_label = "instance";
-                replacement = "${hostname}.d.soopy.moe";
-              }
-            ];
-          }
+          scrape_configs = [
+            {
+              job_name = "node";
+              static_configs = [
+                { targets = [ "localhost:${builtins.toString config.services.prometheus.exporters.node.port}" ]; }
+              ];
+              relabel_configs = [
+                {
+                  target_label = "instance";
+                  replacement = "${hostname}.d.soopy.moe";
+                }
+              ];
+            }
+          ];
+        };
+
+        systemd.services.vmagent.serviceConfig.LoadCredential = [
+          "auth_token:${secrets.get "auth"}"
         ];
-      };
-
-      systemd.services.vmagent.serviceConfig.LoadCredential = [
-        "auth_token:${secrets.get "auth"}"
-      ];
-    }
+      }
 
-    secrets.generate
-  ]);
+      secrets.generate
+    ]
+  );
 }

global/gensokyo/traits.nix

···
-{lib, ...}: {
+{ lib, ... }:
+{
   options.gensokyo.traits = {
     sensitive = lib.mkEnableOption "or selectively disable options specific to security-sensitive systems";
     gui = lib.mkEnableOption "graphical programs, related packages and modules";

global/gui/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./power.nix
     ./hardware.nix

global/gui/locale.nix

···
   ...
 }:
 lib.mkIf config.gensokyo.traits.gui {
-  i18n.supportedLocales = ["all"];
+  i18n.supportedLocales = [ "all" ];
 }

global/gui/power.nix

···
     killUserProcesses = false;
   };
 
-  systemd.targets = lib.genAttrs [
-    "sleep"
-    "suspend"
-    "hibernate"
-    "hybrid-sleep"
-  ] (_: {enable = false;});
+  systemd.targets =
+    lib.genAttrs
+      [
+        "sleep"
+        "suspend"
+        "hibernate"
+        "hybrid-sleep"
+      ]
+      (_: {
+        enable = false;
+      });
 }

global/home.nix

···
   config,
   inputs,
   ...
-}: {
+}:
+{
   home-manager = {
     useGlobalPkgs = true;
     useUserPackages = true;

global/programs/compat.nix

···
-{...}: {
+{ ... }:
+{
   programs.nix-ld.enable = true;
 }

global/programs/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./nix
 

global/programs/editors.nix

···
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   programs.neovim = {
     enable = true;
     defaultEditor = false;

global/programs/misc.nix

···
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   # Miscellaneous packages that do not have an option.
   # It is recommended to use packages.<package>.enable when possible.
 

global/programs/multiplexers.nix

···
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   programs.tmux = {
     enable = true;
     newSession = true;

global/programs/networking.nix

···
 
   {
     networking.hosts = {
-      "62.176.231.184" = ["codeberg.org"];
+      "62.176.231.184" = [ "codeberg.org" ];
     };
   }
 ]

global/programs/nix/config.nix

···
       {
         n.flake = inputs.nixpkgs;
       }
-      // (builtins.mapAttrs (_: flake: {inherit flake;})
-        (lib.filterAttrs (n: _: n != "nixpkgs") inputs));
+      // (builtins.mapAttrs (_: flake: { inherit flake; }) (
+        lib.filterAttrs (n: _: n != "nixpkgs") inputs
+      ));
 
     # nix-index[-database]
     programs.nix-index.enable = true;

global/programs/nix/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./config.nix
     ./dist-builds.nix

global/programs/nix/dist-builds.nix

···
   config,
   hostname,
   ...
-}: let
+}:
+let
   baselineFeatures = [
     "big-parallel"
     "ca-derivations"
   ];
 
-  mkBuildMachines = attr: let
-    cleanAttr = builtins.removeAttrs attr [hostname];
-  in
-    lib.mapAttrsToList (name: value:
+  mkBuildMachines =
+    attr:
+    let
+      cleanAttr = builtins.removeAttrs attr [ hostname ];
+    in
+    lib.mapAttrsToList (
+      name: value:
       {
         hostName = name + ".mist-nessie.ts.net";
 
···
         maxJobs = 2;
         supportedFeatures = baselineFeatures;
 
-        systems = ["i686-linux" "x86_64-linux"];
+        systems = [
+          "i686-linux"
+          "x86_64-linux"
+        ];
       }
-      // value)
-    cleanAttr;
-in {
+      // value
+    ) cleanAttr;
+in
+{
   sops.secrets.builder_key = {
     sopsFile = inputs.self + "/creds/sops/global/id_builder";
     format = "binary";
···
   nix.settings.builders-use-substitutes = true;
   nix.buildMachines = mkBuildMachines {
     renko = {
-      supportedFeatures = baselineFeatures ++ ["kvm" "nixos-test"];
+      supportedFeatures = baselineFeatures ++ [
+        "kvm"
+        "nixos-test"
+      ];
       speedFactor = 5;
       publicHostKey = "c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSUoreGNleXA4YnRVNnd0dThpRUFKMkZ4cm5rZlBsS1M3TWFJL2xLT0ZuUDEgcm9vdEByZW5rbwo=";
     };
     nijika = {
-      systems = ["aarch64-linux"];
+      systems = [ "aarch64-linux" ];
       publicHostKey = "c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSVBsWGZ5MnMxejRIQ05oem92Rk55UzBhcCtyMEF2ZzAzNDlKeFFjMW0xaFEK";
     };
   };

global/programs/scm.nix

···
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   programs.git = {
     enable = true;
     config = {

global/programs/security/crypto.nix

···
 # crypto stands for cryptography, not cryptocurrency
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   environment.systemPackages = with pkgs; [
     gnupg
     pinentry

global/programs/security/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./crypto.nix
     ./sudo.nix

global/programs/security/firewall.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./ip-bans.nix
   ];

global/programs/security/ip-bans.nix

···
-{lib, ...}: let
+{ lib, ... }:
+let
   banned = {
     ip = [
       "156.229.232.142" # added 2025-04-10: minecraft server scanner with 30m intervals
     ];
-    ip6 = [];
+    ip6 = [ ];
   };
-in {
-  networking.firewall.extraCommands = builtins.concatStringsSep "\n" (lib.flatten (lib.mapAttrsToList (family: ips: builtins.map (ip: "${family}tables -w -I INPUT -s ${ip} -j DROP") ips) banned));
+in
+{
+  networking.firewall.extraCommands = builtins.concatStringsSep "\n" (
+    lib.flatten (
+      lib.mapAttrsToList (
+        family: ips: builtins.map (ip: "${family}tables -w -I INPUT -s ${ip} -j DROP") ips
+      ) banned
+    )
+  );
 }

global/programs/security/sudo.nix

···
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   security.sudo.extraConfig = ''
     Defaults insults
   '';
-  security.sudo.package = pkgs.sudo.override {withInsults = true;};
+  security.sudo.package = pkgs.sudo.override { withInsults = true; };
 }

global/programs/shells.nix

···
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   users.defaultUserShell = pkgs.zsh;
   programs.zsh = {
     enable = true;

global/programs/ssh.nix

···
-{config, ...}: let
+{ config, ... }:
+let
   nixos = config.system.nixos;
-in {
+in
+{
   # Enable the OpenSSH daemon.
   services.openssh = {
     enable = true;
···
 
   programs.ssh = {
     startAgent = true;
-    pubkeyAcceptedKeyTypes = ["ssh-ed25519" "[e-mail]"];
+    pubkeyAcceptedKeyTypes = [
+      "ssh-ed25519"
+      "[e-mail]"
+    ];
     # enableAskPassword = true;
 
     extraConfig = ''

global/programs/system-manager/default.nix

···
   config,
   lib,
   ...
-}: let
+}:
+let
   types = lib.types;
   cfg = config.gensokyo.system-manager;
-in {
+in
+{
   options.gensokyo.system-manager = {
     enable = lib.mkEnableOption "a shortcut to manage the system no matter where you are (in the system)";
     flakeLocation = lib.mkOption {
···
 
   config = lib.mkIf cfg.enable {
     environment.systemPackages = [
-      (pkgs.callPackage ./package.nix {inherit (cfg) flakeLocation;})
+      (pkgs.callPackage ./package.nix { inherit (cfg) flakeLocation; })
     ];
   };
 }

global/programs/system-manager/package.nix

···
   meta = {
     description = "A shortcut to run `just` in the local system flake directory.";
     license = lib.licenses.cc0;
-    maintainers = with lib.maintainers; [soopyc];
+    maintainers = with lib.maintainers; [ soopyc ];
   };
 
   # we could make this more robust by not using `just` and (hardcode?) commands in, but this is by far the easiest

global/sops.nix

···
   hostname,
   inputs,
   ...
-}: {
-  sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+}:
+{
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
   sops.defaultSopsFile = "${inputs.self}/creds/sops/${hostname}/default.yaml";
 }

global/upgrade-diff.nix

···
   lib,
   pkgs,
   ...
-}: {
+}:
+{
   system.activationScripts.diff = {
     supportsDryActivation = true;
     text = ''

global/utils.nix

···
   inputs,
   system,
   ...
-}: let
+}:
+let
   pkgs = inputs.nixpkgs.legacyPackages.${system};
   lib = pkgs.lib;
-in rec {
-  mkVhost = opts:
+in
+rec {
+  mkVhost =
+    opts:
     lib.mkMerge [
       {
         forceSSL = lib.mkDefault true;
···
       opts
     ];
 
-  mkSimpleProxy = {
-    protocol ? "http",
-    host ? "localhost",
-    port ? null,
-    socketPath ? null,
-    location ? "/",
-    websockets ? false,
-    extraConfig ? {},
-  }:
-    assert lib.assertMsg (port != null || socketPath != null) "one of port or socketPath must be specified";
+  mkSimpleProxy =
+    {
+      protocol ? "http",
+      host ? "localhost",
+      port ? null,
+      socketPath ? null,
+      location ? "/",
+      websockets ? false,
+      extraConfig ? { },
+    }:
+    assert lib.assertMsg (
+      port != null || socketPath != null
+    ) "one of port or socketPath must be specified";
     # i dislike logic gates
-    assert lib.assertMsg (!(port != null && socketPath != null)) "only one of port or socketPath may be specified at the same time";
-    assert lib.assertMsg (socketPath != null -> host == "localhost") "setting host has no effect when socketPath is set";
+    assert lib.assertMsg (
+      !(port != null && socketPath != null)
+    ) "only one of port or socketPath may be specified at the same time";
+    assert lib.assertMsg (
+      socketPath != null -> host == "localhost"
+    ) "setting host has no effect when socketPath is set";
     assert lib.assertMsg (port != null -> builtins.isInt port) "port must be an integer if specified";
-      mkVhost (lib.mkMerge [
+    mkVhost (
+      lib.mkMerge [
         extraConfig
         {
           locations."${location}" = {
             proxyPass =
               "${protocol}://"
-              + (
-                if (socketPath == null)
-                then "${host}:${builtins.toString port}"
-                else "unix:${socketPath}"
-              );
+              + (if (socketPath == null) then "${host}:${builtins.toString port}" else "unix:${socketPath}");
             proxyWebsockets = websockets;
           };
         }
-      ]);
+      ]
+    );
 
-  setupSecrets = _config: {
-    namespace ? (lib.warn "secret namespace left as default, which is empty. it is encouraged to set a namespace for easier secret management. to override, explicitly set this to an empty value." ""),
-    secrets,
-    config ? {},
-  }: let
-    _r_ns = namespace + lib.optionalString (lib.stringLength namespace != 0) "/";
-    check = path:
-      assert lib.assertMsg (lib.elem path secrets)
-      "secret path `${path}` is not defined in namespace `${namespace}`. (resolved to: ${_r_ns namespace}/${path})"; path;
-    getRealPath = path: _r_ns + check path;
-  in
+  setupSecrets =
+    _config:
+    {
+      namespace ? (
+        lib.warn "secret namespace left as default, which is empty. it is encouraged to set a namespace for easier secret management. to override, explicitly set this to an empty value." ""
+      ),
+      secrets,
+      config ? { },
+    }:
+    let
+      _r_ns = namespace + lib.optionalString (lib.stringLength namespace != 0) "/";
+      check =
+        path:
+        assert lib.assertMsg (lib.elem path secrets)
+          "secret path `${path}` is not defined in namespace `${namespace}`. (resolved to: ${_r_ns namespace}/${path})";
+        path;
+      getRealPath = path: _r_ns + check path;
+    in
     builtins.addErrorContext "while setting up secrets with namespace ${namespace}" {
-      generate = {sops.secrets = genSecrets namespace secrets config;}; # i love trolling
+      generate = {
+        sops.secrets = genSecrets namespace secrets config;
+      }; # i love trolling
       get = path: _config.sops.secrets.${getRealPath path}.path;
 
       placeholder = path: _config.sops.placeholder.${getRealPath path};
       getTemplate = file: _config.sops.templates.${file}.path;
-      mkTemplate = file: content:
+      mkTemplate =
+        file: content:
         builtins.addErrorContext "while generating sops template ${file}" {
-          sops.templates.${file} =
-            {inherit content;} // (builtins.removeAttrs config ["content"]);
+          sops.templates.${file} = {
+            inherit content;
+          } // (builtins.removeAttrs config [ "content" ]);
           # // (lib.optionalAttrs (builtins.hasAttr "owner" config) {inherit (config) owner;})
           # // (lib.optionalAttrs (builtins.hasAttr "group" config) {inherit (config) group;});
         };
     };
 
-  genSecrets = namespace: files: value:
-    lib.genAttrs (
-      map (x: namespace + lib.optionalString (lib.stringLength namespace != 0) "/" + x) files
-    ) (_: value);
+  genSecrets =
+    namespace: files: value:
+    lib.genAttrs (map (
+      x: namespace + lib.optionalString (lib.stringLength namespace != 0) "/" + x
+    ) files) (_: value);
 
-  mkNginxFile = {
-    filename ? "index.html",
-    content,
-  }:
+  mkNginxFile =
+    {
+      filename ? "index.html",
+      content,
+    }:
     builtins.addErrorContext "while creating a static nginx file ${filename}" (
       let
-        contentDir = assert lib.assertMsg (builtins.typeOf content == "string")
-        "content must be a string, got `${builtins.typeOf content}`";
+        contentDir =
+          assert lib.assertMsg (
+            builtins.typeOf content == "string"
+          ) "content must be a string, got `${builtins.typeOf content}`";
           builtins.toString (pkgs.writeTextDir filename content) + "/";
-      in {
+      in
+      {
         alias = contentDir;
         tryFiles = "${filename} =500"; # if it can't find the file something has gone wrong.
       }
     );
 
-  mkNginxJSON = filename: attrset:
+  mkNginxJSON =
+    filename: attrset:
     builtins.addErrorContext "while creating a static nginx JSON file ${filename}" (
-      assert lib.assertMsg (builtins.typeOf attrset == "set")
-      "expected argument type `set`, got `${builtins.typeOf attrset}` instead.";
-        mkNginxFile {
-          inherit filename;
-          content = builtins.toJSON attrset;
-        }
+      assert lib.assertMsg (
+        builtins.typeOf attrset == "set"
+      ) "expected argument type `set`, got `${builtins.typeOf attrset}` instead.";
+      mkNginxFile {
+        inherit filename;
+        content = builtins.toJSON attrset;
+      }
     );
 }

nix/checks.nix

···
 {
   inputs,
   pkgs,
-}: {
+}:
+{
   deadcode = pkgs.stdenvNoCC.mkDerivation {
     name = "deadcode_check";
     src = inputs.self;
     dontPatch = true;
     dontConfigure = true;
 
-    buildInputs = with pkgs; [deadnix];
+    buildInputs = with pkgs; [ deadnix ];
     buildPhase = ''
       set -euo pipefail
 

nix/devshell.nix

···
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   default = pkgs.mkShellNoCC {
     packages = [
       pkgs.nixos-rebuild

nix/treefmt.nix

···
-{...}: {
+{ ... }:
+{
   projectRootFile = "flake.nix";
-  programs.alejandra.enable = true;
+  programs.nixfmt.enable = true;
 }

systems/default.nix

···
   lib,
   inputs,
   ...
-}: let
+}:
+let
   utils = import ../global/utils.nix;
 
-  mkSystem = hostname: system:
+  mkSystem =
+    hostname: system:
     lib.nixosSystem {
       specialArgs = {
         inherit inputs;
 
         hostname = hostname;
-        _utils = utils {inherit inputs system;};
+        _utils = utils { inherit inputs system; };
       };
 
       modules = [
···
         ./${hostname}/hardware-configuration.nix
 
         {
-          home-manager.extraSpecialArgs = {inherit inputs;};
+          home-manager.extraSpecialArgs = { inherit inputs; };
           networking.hostName = hostname;
           nixpkgs.hostPlatform = lib.mkDefault system; # ensure we detect conflicts
         }
       ];
     };
-in {
+in
+{
   koumakan = mkSystem "koumakan" "x86_64-linux";
   satori = mkSystem "satori" "x86_64-linux";
   renko = mkSystem "renko" "x86_64-linux";

systems/kita/certificates/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./mail.nix
     ./web.nix

systems/kita/certificates/mail.nix

···
-{config, ...}: {
+{ config, ... }:
+{
   security.acme.certs."kita.c.soopy.moe" = {
     group = config.services.maddy.group;
     extraLegoRenewFlags = [

systems/kita/certificates/web.nix

···
-{...}: {
+{ ... }:
+{
   security.acme.certs."kita-web.c.soopy.moe" = {
     group = "nginx";
     extraDomainNames = [

systems/kita/configuration.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./certificates
     ./services

systems/kita/hardware-configuration.nix

···
-{modulesPath, ...}: {
-  imports = [(modulesPath + "/profiles/qemu-guest.nix")];
+{ modulesPath, ... }:
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
   boot.loader.grub.device = "/dev/sda";
-  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi"];
-  boot.initrd.kernelModules = ["nvme"];
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "xen_blkfront"
+    "vmw_pvscsi"
+  ];
+  boot.initrd.kernelModules = [ "nvme" ];
   fileSystems."/" = {
     device = "/dev/sda1";
     fsType = "ext4";

systems/kita/networking.nix

···
-{lib, ...}: {
+{ lib, ... }:
+{
   # This file was populated at runtime with the networking
   # details gathered from the active system.
   networking = {

systems/kita/services/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./fallback_page
     ./mail

systems/kita/services/dns.nix

···
-{...}: {
+{ ... }:
+{
   services.pdns-recursor = {
     enable = true;
 

systems/kita/services/fallback_page/default.nix

···
   pkgs,
   _utils,
   ...
-}: {
+}:
+{
   services.nginx.virtualHosts."_" = _utils.mkVhost {
     useACMEHost = "kita-web.c.soopy.moe";
     default = true;
 
     locations."/" = {
-      root = pkgs.callPackage ./package.nix {};
+      root = pkgs.callPackage ./package.nix { };
       tryFiles = "$uri $uri/index.html $uri.html =404";
     };
   };

systems/kita/services/fallback_page/package.nix

···
-{stdenvNoCC}:
+{ stdenvNoCC }:
 stdenvNoCC.mkDerivation (final: {
   name = "kita-landing";
   src = ./.;

systems/kita/services/gatus.nix

···
   _utils,
   config,
   ...
-}: let
+}:
+let
   mkHttpEndpoint = name: group: url: {
     inherit name url group;
     enabled = true;
···
       "[CONNECTED] == true"
     ];
   };
-in {
+in
+{
   services.gatus = {
     enable = true;
     settings = {
···
       endpoints = [
         (mkHttpEndpoint "Main Site" "core" "https://soopy.moe")
 
-        (mkHttpEndpoint "Gateway (Kanidm)" "koumakan" "https://gateway.soopy.moe" // {enabled = false;}) # TODO
+        (mkHttpEndpoint "Gateway (Kanidm)" "koumakan" "https://gateway.soopy.moe" // { enabled = false; }) # TODO
         (mkHttpEndpoint "Patchy (Forgejo)" "koumakan" "https://patchy.soopy.moe")
         (mkHttpEndpoint "Suika (Grafana)" "koumakan" "https://suika.soopy.moe/login")
         (mkHttpEndpoint "Nue (Synapse)" "koumakan" "https://nue.soopy.moe/health")

systems/kita/services/mail/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./roundcube.nix
 

systems/kita/services/mail/maddy.nix

···
-{config, ...}: {
+{ config, ... }:
+{
   services.maddy = {
     enable = true;
     hostname = "mx2.soopy.moe";

systems/kita/services/mail/mta-sts.nix

···
 # mail-transfer-agent strict transport security policy
-{_utils, ...}: {
+{ _utils, ... }:
+{
   services.nginx.virtualHosts."mta-sts.soopy.moe" = _utils.mkVhost {
     useACMEHost = "kita-web.c.soopy.moe";
 

systems/kita/services/mail/roundcube.nix

···
   pkgs,
   _utils,
   ...
-}: {
+}:
+{
   services.roundcube = {
     enable = true;
-    package = pkgs.roundcube.withPlugins (plugins: with plugins; [carddav contextmenu]);
-    dicts = with pkgs.aspellDicts; [en];
+    package = pkgs.roundcube.withPlugins (
+      plugins: with plugins; [
+        carddav
+        contextmenu
+      ]
+    );
+    dicts = with pkgs.aspellDicts; [ en ];
     hostName = "webmail.soopy.moe";
 
     extraConfig = ''

systems/kita/services/mail/rspamd.nix

···
   config,
   _utils,
   ...
-}: let
+}:
+let
   secrets = _utils.setupSecrets config {
     namespace = "rspamd";
-    secrets = ["controller_passwd"];
+    secrets = [ "controller_passwd" ];
     config.owner = config.users.users.rspamd.name;
   };
-in {
+in
+{
   imports = [
     secrets.generate
-    (
-      secrets.mkTemplate "rspamd-controller-pwd.inc" ''
-        password = "${secrets.placeholder "controller_passwd"}";
-      ''
-    )
+    (secrets.mkTemplate "rspamd-controller-pwd.inc" ''
+      password = "${secrets.placeholder "controller_passwd"}";
+    '')
   ];
   services.rspamd = {
     enable = true;
···
       .include(try=false; priority=10) "${secrets.getTemplate "rspamd-controller-pwd.inc"}"
     '';
 
-    workers."normal".bindSockets = ["127.0.0.1:11333"];
+    workers."normal".bindSockets = [ "127.0.0.1:11333" ];
   };
 
   services.redis.servers.rspamd.enable = true;

systems/kita/services/postgresql.nix

···
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   services.postgresql = {
     enable = true;
     package = pkgs.postgresql_16; # we like to specify a package so we know what we're using.
···
         ensureDBOwnership = true;
       }
     ];
-    ensureDatabases = ["maildb"];
+    ensureDatabases = [ "maildb" ];
   };
 }

systems/kita/services/radicale.nix

···
-{_utils, ...}: {
+{ _utils, ... }:
+{
   services.radicale = {
     enable = true;
     settings = {

systems/koumakan/administration/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./telemetry.nix
   ];

systems/koumakan/administration/telemetry.nix

···
-{...}: {
+{ ... }:
+{
   services.prometheus.exporters = {
     node = {
       enable = true;

systems/koumakan/certificates/breezewiki.nix

···
-{...}: {
+{ ... }:
+{
   # Certificate for breezewiki
   security.acme.certs."bw.c.soopy.moe" = {
     group = "nginx";

systems/koumakan/certificates/bsky-pds.nix

···
-{...}: {
+{ ... }:
+{
   # Certificate for fedi services
   security.acme.certs."bsky.c.soopy.moe" = {
     group = "nginx";

systems/koumakan/certificates/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./global.nix
     ./postgresql.nix

systems/koumakan/certificates/fediverse.nix

···
-{...}: {
+{ ... }:
+{
   # Certificate for fedi services
   security.acme.certs."fedi.c.soopy.moe" = {
     group = "nginx";

systems/koumakan/certificates/global.nix

···
-{...}: {
+{ ... }:
+{
   # Global certificate
   security.acme.certs."global.c.soopy.moe" = {
     group = "nginx";

systems/koumakan/certificates/postgresql.nix

···
-{config, ...}: {
+{ config, ... }:
+{
   # PostgreSQL only certificate
   security.acme.certs."phant.soopy.moe" = {
     group = "postgres";
···
 
   # https://nixos.org/manual/nixos/stable/#module-security-acme-root-owned
   systemd.services.postgresql = {
-    requires = ["acme-finished-phant.soopy.moe.target"];
-    serviceConfig.LoadCredential = let
-      certDir = config.security.acme.certs."phant.soopy.moe".directory;
-    in [
-      "cert.pem:${certDir}/cert.pem"
-      "key.pem:${certDir}/key.pem"
-    ];
+    requires = [ "acme-finished-phant.soopy.moe.target" ];
+    serviceConfig.LoadCredential =
+      let
+        certDir = config.security.acme.certs."phant.soopy.moe".directory;
+      in
+      [
+        "cert.pem:${certDir}/cert.pem"
+        "key.pem:${certDir}/key.pem"
+      ];
   };
 }

systems/koumakan/configuration.nix

···
-{inputs, ...}: {
+{ inputs, ... }:
+{
   imports = [
     inputs.mystia.nixosModules.fixups
     inputs.mystia.nixosModules.vmauth

systems/koumakan/hardware-configuration.nix

···
   lib,
   modulesPath,
   ...
-}: {
+}:
+{
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = ["xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "sr_mod"];
-  boot.initrd.kernelModules = [];
-  boot.kernelModules = ["kvm-intel"];
-  boot.extraModulePackages = [];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ehci_pci"
+    "ahci"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
 
   fileSystems."/" = {
     device = "/dev/disk/by-uuid/738969fe-b2a0-4fa1-9ac5-69f2a25536e7";
···
   fileSystems."/boot" = {
     device = "/dev/disk/by-uuid/62FD-C60A";
     fsType = "vfat";
-    options = ["fmask=0022" "dmask=0022"];
+    options = [
+      "fmask=0022"
+      "dmask=0022"
+    ];
   };
 
   swapDevices = [
-    {device = "/dev/disk/by-uuid/902b902d-3486-49de-9a58-7a079c9a090d";}
+    { device = "/dev/disk/by-uuid/902b902d-3486-49de-9a58-7a079c9a090d"; }
   ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking

systems/koumakan/networking/cjdns.nix

···
-{...}: {
+{ ... }:
+{
   services.cjdns = {
     enable = true;
 

systems/koumakan/networking/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./firewall.nix
     ./interface.nix

systems/koumakan/networking/firewall.nix

···
-{lib, ...}: {
+{ lib, ... }:
+{
   networking.firewall = {
     enable = true;
     allowedTCPPorts = [

systems/koumakan/networking/interface.nix

···
-{...}: {
+{ ... }:
+{
   networking.networkmanager.ethernet.macAddress = "stable";
 }

systems/koumakan/security/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./pam.nix
   ];

systems/koumakan/security/pam.nix

···
-{...}: {
+{ ... }:
+{
   security.pam.yubico = {
     enable = true;
     id = "91582";

systems/koumakan/services/anubis.nix

···
   lib,
   config,
   ...
-}: {
-  assertions =
-    lib.mapAttrsToList (k: v: {
-      # assertion = v.settings.METRICS_BIND_NETWORK == "tcp" -> !builtins.isNull (builtins.match "127.0.0.1:.*" v.settings.METRICS_BIND);
-      assertion = !builtins.isNull (builtins.match "^127.0.0.1:17[[:digit:]]\{3\}$" v.settings.METRICS_BIND); # stricter
-      message = "koumakan-internal(anubis `${k}`): settings.METRICS_BIND must be in the form `127.0.0.1:17xxx`";
-    })
-    config.services.anubis.instances;
+}:
+{
+  assertions = lib.mapAttrsToList (k: v: {
+    # assertion = v.settings.METRICS_BIND_NETWORK == "tcp" -> !builtins.isNull (builtins.match "127.0.0.1:.*" v.settings.METRICS_BIND);
+    assertion =
+      !builtins.isNull (builtins.match "^127.0.0.1:17[[:digit:]]\{3\}$" v.settings.METRICS_BIND); # stricter
+    message = "koumakan-internal(anubis `${k}`): settings.METRICS_BIND must be in the form `127.0.0.1:17xxx`";
+  }) config.services.anubis.instances;
 
   # neither VM nor Prom supports scraping unix domain sockets and i currently cba writing a custom scraper for it
   # prom: https://github.com/prometheus/prometheus/issues/12024

systems/koumakan/services/arion/breezewiki.nix

···
-{_utils, ...}: {
+{ _utils, ... }:
+{
   virtualisation.arion.projects.breezewiki.settings = {
     services.breezewiki = {
       service = {
         image = "quay.io/pussthecatorg/breezewiki";
-        ports = ["127.0.0.1:35612:10416"];
+        ports = [ "127.0.0.1:35612:10416" ];
         environment = {
           bw_canonical_origin = "https://bw.soopy.moe";
           bw_log_outgoing = "false";

systems/koumakan/services/arion/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./breezewiki.nix
     ./pixivfe.nix

systems/koumakan/services/arion/pixivfe.nix

···
   config,
   lib,
   ...
-}: let
+}:
+let
   secrets = _utils.setupSecrets config {
     namespace = "pixivfe";
-    secrets = ["token"];
+    secrets = [ "token" ];
   };
-in {
+in
+{
   imports = [
     secrets.generate
     (secrets.mkTemplate "pixivfe.env" ''

systems/koumakan/services/ci/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./hydra
   ];

systems/koumakan/services/ci/hydra/default.nix

···
   config,
   lib,
   ...
-}: let
+}:
+let
   secrets = _utils.setupSecrets config {
     namespace = "hydra";
     secrets = [
···
 
   webhookScript = pkgs.writeShellApplication {
     name = "hydra-webhook";
-    runtimeInputs = with pkgs; [xh];
+    runtimeInputs = with pkgs; [ xh ];
     text = ''
       xh :8000 @"$1"
     '';
   };
-in {
+in
+{
   imports = [
     secrets.generate
     (secrets.mkTemplate "hydra-s3-creds" ''

systems/koumakan/services/databases/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./postgresql.nix
     ./redis.nix

systems/koumakan/services/databases/postgresql.nix

···
   pkgs,
   lib,
   ...
-}: {
+}:
+{
   services.postgresql = {
     enable = true;
 
···
       host    all             all             ::1/128                 scram-sha-256
     '';
 
-    settings = let
-      credsDir = "/run/credentials/postgresql.service";
-    in {
-      listen_addresses = pkgs.lib.mkForce "*";
-      max_connections = 200;
-      password_encryption = "scram-sha-256";
+    settings =
+      let
+        credsDir = "/run/credentials/postgresql.service";
+      in
+      {
+        listen_addresses = pkgs.lib.mkForce "*";
+        max_connections = 200;
+        password_encryption = "scram-sha-256";
 
-      log_line_prefix = "%m [%p] %h ";
-      ssl = "on";
-      ssl_cert_file = "${credsDir}/cert.pem";
-      ssl_key_file = "${credsDir}/key.pem";
+        log_line_prefix = "%m [%p] %h ";
+        ssl = "on";
+        ssl_cert_file = "${credsDir}/cert.pem";
+        ssl_key_file = "${credsDir}/key.pem";
 
-      log_hostname = true;
-      datestyle = "iso, dmy";
-      log_timezone = "Asia/Hong_Kong";
-      timezone = "Asia/Hong_Kong";
-      default_text_search_config = "pg_catalog.english";
+        log_hostname = true;
+        datestyle = "iso, dmy";
+        log_timezone = "Asia/Hong_Kong";
+        timezone = "Asia/Hong_Kong";
+        default_text_search_config = "pg_catalog.english";
 
-      max_wal_size = "2GB";
-      min_wal_size = "80MB";
-    };
+        max_wal_size = "2GB";
+        min_wal_size = "80MB";
+      };
   };
 
   users.users.postgres.useDefaultShell = lib.mkForce false;

systems/koumakan/services/databases/redis.nix

···
-{...}: {
+{ ... }:
+{
   services.redis.servers."" = {
     enable = true;
   };

systems/koumakan/services/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./nginx.nix
 

systems/koumakan/services/fediverse/bsky-pds.nix

···
   config,
   _utils,
   ...
-}: let
+}:
+let
   secrets = _utils.setupSecrets config {
     namespace = "pds";
     secrets = [
···
     ];
     config.owner = config.services.bsky-pds.user;
   };
-in {
-  imports = [secrets.generate];
+in
+{
+  imports = [ secrets.generate ];
   services.bsky-pds = {
     enable = true;
     package = inputs.mystia.packages.${pkgs.system}.bsky-pds;

systems/koumakan/services/fediverse/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./writefreely.nix
     ./bsky-pds.nix

systems/koumakan/services/fediverse/writefreely.nix

···
   # inputs,
   # pkgs,
   ...
-}: {
+}:
+{
   services.writefreely = {
     enable = true;
     # package = inputs.nixpkgs-wf.legacyPackages.${pkgs.system}.writefreely;

systems/koumakan/services/feeds/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./miniflux.nix
   ];

systems/koumakan/services/feeds/miniflux.nix

···
-{_utils, ...}: {
+{ _utils, ... }:
+{
   services.miniflux = {
     enable = true;
     config = {

systems/koumakan/services/ftp.nix

···
   config,
   inputs,
   ...
-}: {
+}:
+{
   sops.secrets = {
     "vsftpdUsers.db" = {
       sopsFile = inputs.self + "/creds/sops/koumakan/vsftpdUsers.db";
···
     group = "vsftpd";
     enable = true;
     settings = {
-      server.listen = ["100.100.16.16:38563"];
+      server.listen = [ "100.100.16.16:38563" ];
       accounts.auth-type = "htpasswd.default";
 
       htpasswd.default.htpasswd = config.sops.secrets."webdav.scan.htpasswd".path;
···
 
       location = [
         {
-          route = ["/*path"];
+          route = [ "/*path" ];
           auth = "true";
           handler = "filesystem";
-          methods = ["webdav-rw"];
+          methods = [ "webdav-rw" ];
 
           directory = "/var/www/ftp";
         }

systems/koumakan/services/matrix/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./synapse.nix
   ];

systems/koumakan/services/matrix/synapse.nix

···
   lib,
   config,
   ...
-}: let
+}:
+let
   getSocket = file: "/run/matrix-synapse/${file}.sock";
-in {
+in
+{
   sops.secrets."synapse.yaml" = {
     mode = "0400";
     owner = config.users.users.matrix-synapse.name;
···
     ];
 
     workers = {
-      federation-sender-0 = {};
-      pusher-0 = {};
+      federation-sender-0 = { };
+      pusher-0 = { };
     };
 
     settings = {
···
   };
 
   services.postgresql = {
-    ensureDatabases = ["synapse"];
+    ensureDatabases = [ "synapse" ];
     ensureUsers = [
       {
         name = "synapse";
···
     ];
   };
 
-  users.users.nginx.extraGroups = ["matrix-synapse"];
+  users.users.nginx.extraGroups = [ "matrix-synapse" ];
   services.nginx.virtualHosts."nue.soopy.moe" = _utils.mkVhost {
     extraConfig = ''
       access_log off;

systems/koumakan/services/nginx.nix

···
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   gensokyo.presets.nginx = true;
 
-  users.users.nginx.extraGroups = ["anubis"];
+  users.users.nginx.extraGroups = [ "anubis" ];
   services.nginx = {
     enable = true;
     clientMaxBodySize = "50m";

systems/koumakan/services/proxies/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./nitter.nix
     ./searxng.nix

systems/koumakan/services/proxies/minio.nix

···
   _utils,
   inputs,
   ...
-}: {
+}:
+{
   services.nginx.virtualHosts = {
     "s3.soopy.moe" = _utils.mkSimpleProxy {
       host = "renko.mist-nessie.ts.net";

systems/koumakan/services/proxies/nitter.nix

···
-{_utils, ...}: {
+{ _utils, ... }:
+{
   services.nginx.virtualHosts."nitter.soopy.moe" = _utils.mkVhost {
     locations."/".return = "301 https://twiiit.com$request_uri";
   };

systems/koumakan/services/proxies/searxng.nix

···
   config,
   lib,
   ...
-}: let
+}:
+let
   secrets = _utils.setupSecrets config {
     namespace = "searxng";
-    secrets = ["secret"];
+    secrets = [ "secret" ];
   };
-in {
+in
+{
   imports = [
     secrets.generate
     (secrets.mkTemplate "searxng.env" ''
···
     '')
   ];
 
-  users.users.nginx.extraGroups = [config.users.groups.searx.name];
+  users.users.nginx.extraGroups = [ config.users.groups.searx.name ];
 
   services.searx = {
     enable = true;
···
           engine = "discourse";
           shortcut = "dno";
           base_url = "https://discourse.nixos.org";
-          categories = ["it" "q&a"];
+          categories = [
+            "it"
+            "q&a"
+          ];
         }
       ];
     };

systems/koumakan/services/scm/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./forgejo.nix
     ./tangled-knot.nix

systems/koumakan/services/scm/forgejo.nix

···
   config,
   pkgs,
   ...
-}: let
+}:
+let
   secrets = [
     "database/pass"
     "turnstile/secret"
···
   #   else "/run/secrets/${ns}";
 
   runConfig = config.services.forgejo.customDir + "/conf/app.ini";
-in {
+in
+{
   sops.secrets = _utils.genSecrets ns secrets {
     owner = config.services.forgejo.user;
   };
···
   # }}}
 }
 # vim:foldmethod=marker
-

systems/koumakan/services/scm/tangled-knot.nix

···
   _utils,
   config,
   ...
-}: let
+}:
+let
   secrets = _utils.setupSecrets config {
     namespace = "tangled";
-    secrets = ["knot/key"];
+    secrets = [ "knot/key" ];
   };
-in {
+in
+{
   imports = [
     secrets.generate
 

systems/koumakan/services/security/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./vaultwarden.nix
   ];

systems/koumakan/services/security/vaultwarden.nix

···
   config,
   # lib,
   ...
-}: let
+}:
+let
   # mkSecrets = file:
   #   if !lib.elem file secrets
   #   then throw "Provided secret file ${file} is not in the list of defined secrets."
···
     "push/installation_id"
     "push/installation_key"
   ];
-in {
-  sops.secrets = _utils.genSecrets "vaultwarden" secrets {};
-  sops.templates."vaultwarden.env".content = let
-    ph = p: config.sops.placeholder."vaultwarden/${p}";
-  in ''
-    DATABASE_URL=postgresql://${ph "database/username"}:${ph "database/password"}@localhost/vaultwarden
-    ADMIN_TOKEN=${ph "admin_token"}
-    YUBICO_CLIENT_ID=${ph "yubico/id"}
-    YUBICO_SECRET_KEY=${ph "yubico/secret"}
-    SMTP_USERNAME=${ph "smtp/username"}
-    SMTP_FROM=${ph "smtp/username"}
-    SMTP_PASSWORD=${ph "smtp/password"}
-    SMTP_HOST=${ph "smtp/host"}
-    SMTP_SECURITY=${ph "smtp/security"}
-    SMTP_PORT=${ph "smtp/port"}
-    PUSH_INSTALLATION_ID=${ph "push/installation_id"}
-    PUSH_INSTALLATION_KEY=${ph "push/installation_key"}
-  '';
+in
+{
+  sops.secrets = _utils.genSecrets "vaultwarden" secrets { };
+  sops.templates."vaultwarden.env".content =
+    let
+      ph = p: config.sops.placeholder."vaultwarden/${p}";
+    in
+    ''
+      DATABASE_URL=postgresql://${ph "database/username"}:${ph "database/password"}@localhost/vaultwarden
+      ADMIN_TOKEN=${ph "admin_token"}
+      YUBICO_CLIENT_ID=${ph "yubico/id"}
+      YUBICO_SECRET_KEY=${ph "yubico/secret"}
+      SMTP_USERNAME=${ph "smtp/username"}
+      SMTP_FROM=${ph "smtp/username"}
+      SMTP_PASSWORD=${ph "smtp/password"}
+      SMTP_HOST=${ph "smtp/host"}
+      SMTP_SECURITY=${ph "smtp/security"}
+      SMTP_PORT=${ph "smtp/port"}
+      PUSH_INSTALLATION_ID=${ph "push/installation_id"}
+      PUSH_INSTALLATION_KEY=${ph "push/installation_key"}
+    '';
 
   services.vaultwarden = {
     enable = true;
···
     upstreams = {
       vault-default = {
         servers = {
-          "[::1]:38480" = {};
+          "[::1]:38480" = { };
         };
         extraConfig = ''
           zone vaultwarden 128k;  # XXX: are there any security implications if we reuse the same zone for both webvault and the ws server?

systems/koumakan/services/static-sites/assets.nix

···
-{_utils, ...}: {
+{ _utils, ... }:
+{
   services.nginx.virtualHosts."assets.soopy.moe" = _utils.mkVhost {
     root = "/opt/public-assets";
     locations = {

systems/koumakan/services/static-sites/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./assets.nix
     ./nonbunary.nix

systems/koumakan/services/static-sites/nonbunary.nix

···
-{_utils, ...}: {
+{ _utils, ... }:
+{
   services.nginx.virtualHosts."nonbunary.soopy.moe" = _utils.mkVhost {
     locations."/".return = "404";
     locations."= /" = _utils.mkNginxFile {

systems/koumakan/services/static-sites/photography.nix

···
   lib,
   _utils,
   ...
-}: {
+}:
+{
   # TODO: we can make this better by just automating everything needed to make a h5ai site.
   services.phpfpm.pools."photography" = {
     user = "photography";
···
       "php_admin_flag[log_errors]" = true;
       "catch_workers_output" = true;
     };
-    phpEnv."PATH" = lib.makeBinPath (with pkgs; [
-      zip
-    ]);
+    phpEnv."PATH" = lib.makeBinPath (
+      with pkgs;
+      [
+        zip
+      ]
+    );
   };
 
   services.nginx.virtualHosts."photography.soopy.moe" = _utils.mkVhost {
···
     group = "photography";
     createHome = false;
   };
-  users.groups.photography = {};
+  users.groups.photography = { };
 
-  users.users.nginx.extraGroups = ["photography"];
-  users.users.cassie.extraGroups = ["photography"];
+  users.users.nginx.extraGroups = [ "photography" ];
+  users.users.cassie.extraGroups = [ "photography" ];
 }

systems/koumakan/services/storage/atuin.nix

···
-{_utils, ...}: {
+{ _utils, ... }:
+{
   services.atuin = {
     enable = true;
     database.createLocally = true;

systems/koumakan/services/storage/wastebin.nix

···
   _utils,
   config,
   ...
-}: let
+}:
+let
   secrets = _utils.setupSecrets config {
     namespace = "wastebasket";
-    secrets = ["key"];
+    secrets = [ "key" ];
   };
-in {
+in
+{
   # figure out a way to disable encryption, i don't trust the impl.
   imports = [
     secrets.generate

systems/koumakan/services/storage/zipline.nix

···
   lib,
   config,
   ...
-}: let
+}:
+let
   secrets = _utils.setupSecrets config {
     namespace = "zipline";
     secrets = [
···
       "s3/access_secret"
     ];
   };
-in {
+in
+{
   imports = [
     secrets.generate
     (secrets.mkTemplate "zipline.env" ''

systems/koumakan/services/telemetry/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./victoriametrics.nix
     ./grafana

systems/koumakan/services/telemetry/grafana/default.nix

···
   _utils,
   config,
   ...
-}: let
+}:
+let
   secrets = _utils.setupSecrets config {
     namespace = "grafana";
     secrets = [
···
     };
   };
   fromSecret = path: "$__file{${secrets.get path}}";
-in {
+in
+{
   imports = [
     secrets.generate
     ./provisioning.nix

systems/koumakan/services/telemetry/grafana/provisioning.nix

···
-{...}: {
+{ ... }:
+{
   services.grafana.provision = {
     datasources.settings = {
       apiVersion = 1; # i am stupid. keep this as 1.
···
           uid = "gs_panopticon";
           url = "http://localhost:20090";
           isDefault = true;
-          jsonData = {prometheusVersion = "2.44.0";};
+          jsonData = {
+            prometheusVersion = "2.44.0";
+          };
         }
       ];
     };

systems/koumakan/services/telemetry/victoriametrics.nix

···
   lib,
   _utils,
   ...
-}: let
+}:
+let
   monitoredHosts = [
     "mail"
     "satori"
···
   ];
   secrets = _utils.setupSecrets config {
     namespace = "vmetrics";
-    secrets = ["agent/akkoma"] ++ builtins.map (f: "auth/hosts/" + f) monitoredHosts;
+    secrets = [ "agent/akkoma" ] ++ builtins.map (f: "auth/hosts/" + f) monitoredHosts;
   };
-in {
+in
+{
   imports = [
     secrets.generate
 
···
       VMA_AKKOMA_CRED=${secrets.placeholder "agent/akkoma"}
     '')
     (secrets.mkTemplate "vmauth.env" (
-      lib.concatLines (builtins.map (
+      lib.concatLines (
+        builtins.map (
           host: "AUTH_${lib.toUpper host}_TOKEN=${secrets.placeholder "auth/hosts/${host}"}"
-        )
-        monitoredHosts)
+        ) monitoredHosts
+      )
     ))
   ];
 
···
           static_configs = lib.singleton {
             targets = lib.singleton "localhost:${builtins.toString config.services.prometheus.exporters.node.port}";
           };
-          relabel_configs =
-            lib.singleton
-            {
-              target_label = "instance";
-              replacement = "koumakan";
-            };
+          relabel_configs = lib.singleton {
+            target_label = "instance";
+            replacement = "koumakan";
+          };
         }
 
         # external nodes uses remote write
···
         # other services' metrics
         {
           job_name = "nginx";
-          static_configs = lib.singleton {targets = lib.singleton "localhost:${builtins.toString config.services.prometheus.exporters.nginx.port}";};
-          relabel_configs =
-            lib.singleton
-            {
-              target_label = "instance";
-              replacement = "koumakan";
-            };
+          static_configs = lib.singleton {
+            targets = lib.singleton "localhost:${builtins.toString config.services.prometheus.exporters.nginx.port}";
+          };
+          relabel_configs = lib.singleton {
+            target_label = "instance";
+            replacement = "koumakan";
+          };
         }
       ];
     };
···
     authConfig = {
       users = builtins.concatMap (
         token:
-          lib.singleton
-          {
-            bearer_token = token;
-            url_prefix = "http://${config.services.victoriametrics.listenAddress}"; # send directly to vm
-          }
+        lib.singleton {
+          bearer_token = token;
+          url_prefix = "http://${config.services.victoriametrics.listenAddress}"; # send directly to vm
+        }
       ) (builtins.map (host: "%{AUTH_${lib.toUpper host}_TOKEN}") monitoredHosts);
     };
     environmentFile = secrets.getTemplate "vmauth.env";

systems/nijika/configuration.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./services
     ./networking.nix # generated at runtime by nixos-infect

systems/nijika/hardware-configuration.nix

···
-{modulesPath, ...}: {
-  imports = [(modulesPath + "/profiles/qemu-guest.nix")];
+{ modulesPath, ... }:
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
   boot.loader.grub = {
     efiSupport = true;
     efiInstallAsRemovable = true;
···
     device = "/dev/disk/by-uuid/5E93-6B15";
     fsType = "vfat";
   };
-  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "xen_blkfront"];
-  boot.initrd.kernelModules = ["nvme"];
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "xen_blkfront"
+  ];
+  boot.initrd.kernelModules = [ "nvme" ];
   fileSystems."/" = {
     device = "/dev/sda1";
     fsType = "ext4";

systems/nijika/networking.nix

···
-{lib, ...}: {
+{ lib, ... }:
+{
   # This file was populated at runtime with the networking
   # details gathered from the active system.
   networking = {

systems/nijika/services/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./fallback_page
   ];

systems/nijika/services/fallback_page/default.nix

···
   pkgs,
   _utils,
   ...
-}: {
+}:
+{
   services.nginx.virtualHosts."nijika.soopy.moe" = _utils.mkVhost {
     useACMEHost = null;
     enableACME = true;
     default = true;
 
     locations."/" = {
-      root = pkgs.callPackage ./package.nix {};
+      root = pkgs.callPackage ./package.nix { };
       tryFiles = "$uri $uri/index.html $uri.html =404";
     };
   };

systems/nijika/services/fallback_page/package.nix

···
-{stdenvNoCC}:
+{ stdenvNoCC }:
 stdenvNoCC.mkDerivation (final: {
   name = "nijika-landing";
   src = ./.;

systems/renko/configuration.nix

···
   inputs,
   pkgs,
   ...
-}: {
+}:
+{
   imports = [
     ./gui
     ./development

systems/renko/development/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./docker.nix
     ./postgresql.nix

systems/renko/development/docker.nix

···
-{...}: {
+{ ... }:
+{
   virtualisation.docker = {
     enable = true;
     storageDriver = "btrfs";

systems/renko/development/postgresql.nix

···
-{lib, ...}: {
+{ lib, ... }:
+{
   services.postgresql = {
     enable = true;
     enableTCPIP = true;

systems/renko/gui/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./virt.nix
     ./finance.nix

systems/renko/gui/finance.nix

···
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   environment.systemPackages = [
     pkgs.kmymoney
   ];

systems/renko/gui/games/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./osu.nix
     ./steam.nix

systems/renko/gui/graphics.nix

···
-{...}: {
+{ ... }:
+{
   # enforce settings
   hardware.opengl = {
     enable = true;

systems/renko/gui/virt.nix

···
-{...}: {
+{ ... }:
+{
   programs.virt-manager.enable = true;
   virtualisation.libvirtd = {
     enable = true;

systems/renko/hardware-configuration.nix

···
   lib,
   modulesPath,
   ...
-}: {
+}:
+{
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "ahci" "usbhid"];
-  boot.initrd.kernelModules = [];
-  boot.kernelModules = ["kvm-amd"];
-  boot.extraModulePackages = [];
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "ahci"
+    "usbhid"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
 
   fileSystems."/" = {
     device = "/dev/disk/by-uuid/e6637f8a-12fc-4aa4-8335-3fad10d8f63a";
···
   fileSystems."/efi" = {
     device = "/dev/disk/by-uuid/77E6-011C";
     fsType = "vfat";
-    options = ["fmask=0022" "dmask=0022" "umask=0077"];
+    options = [
+      "fmask=0022"
+      "dmask=0022"
+      "umask=0077"
+    ];
   };
 
   swapDevices = [
-    {device = "/dev/disk/by-uuid/40a77774-ab28-45db-8f8a-845814eacba9";}
+    { device = "/dev/disk/by-uuid/40a77774-ab28-45db-8f8a-845814eacba9"; }
   ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking

systems/renko/services/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./vmagent.nix
     ./minio.nix

systems/renko/services/minio.nix

···
   _utils,
   config,
   ...
-}: let
+}:
+let
   secrets = _utils.setupSecrets config {
     namespace = "minio";
     secrets = [
···
       "root_pass"
     ];
   };
-in {
+in
+{
   imports = [
     secrets.generate
     (secrets.mkTemplate "minio.env" ''

systems/renko/services/vmagent.nix

···
   config,
   lib,
   ...
-}: let
+}:
+let
   secrets = _utils.setupSecrets config {
     namespace = "vmetrics";
-    secrets = ["minio_token"];
+    secrets = [ "minio_token" ];
   };
-in {
+in
+{
   imports = lib.singleton secrets.generate;
   systemd.services.vmagent.serviceConfig.LoadCredential = [
     "minio_token:${secrets.get "minio_token"}"
···
     job_name = "minio-job";
     metrics_path = "/minio/v2/metrics/cluster";
     scheme = "http";
-    static_configs = lib.singleton {targets = lib.singleton "localhost:26531";};
+    static_configs = lib.singleton { targets = lib.singleton "localhost:26531"; };
     relabel_configs = lib.singleton {
       target_label = "instance";
       replacement = config.networking.fqdnOrHostName;

systems/ryo/configuration.nix

···
 # ryo because empty-headed. also btr naming scheme.
 # DO NOT copy anything done on this host, it's insecure by design.
-{...}: {
+{ ... }:
+{
   imports = [
     ./services
   ];

systems/ryo/hardware-configuration.nix

···
   modulesPath,
   lib,
   ...
-}: {
-  imports = [(modulesPath + "/profiles/qemu-guest.nix")];
+}:
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
 
-  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "xen_blkfront" "vmw_pvscsi"];
-  boot.initrd.kernelModules = ["nvme"];
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "xen_blkfront"
+    "vmw_pvscsi"
+  ];
+  boot.initrd.kernelModules = [ "nvme" ];
   boot.loader.grub = {
     efiSupport = true;
     efiInstallAsRemovable = true;

systems/ryo/services/default.nix

···
-{...}: {
+{ ... }:
+{
   imports = [
     ./novnc.nix
     ./thefunny.nix

systems/ryo/services/novnc.nix

···
   pkgs,
   lib,
   ...
-}: {
+}:
+{
   services.nginx.virtualHosts."ryo.soopy.moe" = _utils.mkSimpleProxy {
     port = 6080;
     websockets = true;
···
 
   systemd.services."novnc" = {
     enable = true;
-    wantedBy = ["multi-user.target"];
-    path = with pkgs; [procps];
+    wantedBy = [ "multi-user.target" ];
+    path = with pkgs; [ procps ];
     serviceConfig = {
       DynamicUser = true;
       ExecStart = "${lib.getExe pkgs.novnc} --file-only";

systems/ryo/services/thefunny.nix

···
   pkgs,
   lib,
   ...
-}: let
+}:
+let
   serviceHardening = {
     PrivateUsers = true;
     LockPersonality = true;
···
       # "~@privileged" # cage/wlroots needs setgid for some reason?
     ];
   };
-in {
+in
+{
   users.users.funny = {
     isSystemUser = true;
     group = "funny";
   };
-  users.groups.funny = {};
+  users.groups.funny = { };
 
   systemd.services = {
     cage-feh = {
-      wantedBy = ["multi-user.target"];
-      serviceConfig =
-        {
-          User = "funny";
-          RuntimeDirectory = "funny";
-          Restart = "on-failure";
-          RestartSec = "1";
-        }
-        // serviceHardening;
-      path = with pkgs; [cage feh];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        User = "funny";
+        RuntimeDirectory = "funny";
+        Restart = "on-failure";
+        RestartSec = "1";
+      } // serviceHardening;
+      path = with pkgs; [
+        cage
+        feh
+      ];
       script = ''
         set -e
         cage -d feh -- -.dz -D10 --draw-tinted /srv/funny
···
     };
 
     wayvnc-feh = {
-      wantedBy = ["multi-user.target"];
-      requires = ["cage-feh.service"];
-      after = ["cage-feh.service"];
-      serviceConfig =
-        {
-          User = "funny";
-          RuntimeDirectory = "funny";
-          ExecStart = "${lib.getExe pkgs.wayvnc} -d 0.0.0.0";
-          Restart = "on-failure";
-          RestartSec = "1";
-        }
-        // serviceHardening;
+      wantedBy = [ "multi-user.target" ];
+      requires = [ "cage-feh.service" ];
+      after = [ "cage-feh.service" ];
+      serviceConfig = {
+        User = "funny";
+        RuntimeDirectory = "funny";
+        ExecStart = "${lib.getExe pkgs.wayvnc} -d 0.0.0.0";
+        Restart = "on-failure";
+        RestartSec = "1";
+      } // serviceHardening;
       environment = {
         WAYLAND_DISPLAY = "wayland-0";
         XDG_RUNTIME_DIR = "%t/funny";

systems/satori/configuration.nix

···
   pkgs,
   lib,
   ...
-}: {
+}:
+{
   imports = [
     ./steam.nix
     inputs.nixos-hardware.nixosModules.apple-t2

systems/satori/hardware-configuration.nix

···
   lib,
   modulesPath,
   ...
-}: {
+}:
+{
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = ["xhci_pci" "nvme" "usbhid" "usb_storage" "sd_mod"];
-  boot.initrd.kernelModules = [];
-  boot.kernelModules = ["kvm-intel"];
-  boot.extraModulePackages = [];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "nvme"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
 
   fileSystems."/" = {
     device = "/dev/disk/by-uuid/f4bb41e2-b477-49e7-ae96-61fd80a63b2e";
···
   fileSystems."/boot" = {
     device = "/dev/disk/by-uuid/3231-A446";
     fsType = "vfat";
-    options = ["fmask=0022" "dmask=0022" "umask=0077"];
+    options = [
+      "fmask=0022"
+      "dmask=0022"
+      "umask=0077"
+    ];
   };
 
-  swapDevices = [];
+  swapDevices = [ ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's

systems/satori/steam.nix

···
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   programs.steam = {
     enable = true;
 

users/_tester.nix

···
-{...}: {
+{ ... }:
+{
   virtualisation.vmVariant.users.users._tester = builtins.warn "[vm] building tester user..." {
     password = "explode";
     isNormalUser = true;
-    extraGroups = ["wheel"];
+    extraGroups = [ "wheel" ];
   };
 }

users/builder.nix

···
     shell = pkgs.zsh;
   };
 
-  users.groups.remote-builder = {};
+  users.groups.remote-builder = { };
 }