configuration/default.nix

@@ -1,10 +1,9 @@
-{
+{ config
-  config,
+, pkgs
-  pkgs,
+, lib
-  lib,
+, modulesPath
-  modulesPath,
+, flake-inputs
-  flake-inputs,
+, ...
-  ...
 }: {
   imports = [
     flake-inputs.disko.nixosModules.disko

configuration/hardware-specific/hetzner/disko.nix

@@ -1,5 +1,6 @@
 {
-  disko.devices.disk = let
+  disko.devices.disk =
+    let
       bootPartition = {
         size = "1M";
         type = "EF02";
@@ -19,7 +20,8 @@
       };
 
       mountOptions = [ "compress=zstd" "noatime" ];
-  in {
+    in
+    {
       sda = {
         type = "disk";
         device = "/dev/sda";

configuration/nginx.nix

@@ -1,7 +1,6 @@
-{
+{ config
-  config,
+, lib
-  lib,
+, ...
-  ...
 }: {
   services.nginx = {
     enable = true;
@@ -27,7 +26,8 @@
       # Override the default, just keep fewer logs
       nginx.rotate = 6;
     }
-    // lib.mapAttrs' (virtualHost: _:
+    // lib.mapAttrs'
+      (virtualHost: _:
         lib.nameValuePair "/var/log/nginx/${virtualHost}/access.log" {
           frequency = "daily";
           rotate = 2;
@@ -39,7 +39,8 @@
       config.services.nginx.virtualHosts;
 
   systemd.tmpfiles.rules =
-    lib.mapAttrsToList (
+    lib.mapAttrsToList
+      (
         virtualHost: _:
           #
           "d /var/log/nginx/${virtualHost} 0750 ${config.services.nginx.user} ${config.services.nginx.group}"

configuration/services/afvalcalendar.nix

@@ -1,7 +1,6 @@
-{
+{ pkgs
-  pkgs,
+, config
-  config,
+, ...
-  ...
 }: {
   systemd.services.afvalcalendar = {
     description = "Enschede afvalcalendar -> ical converter";

configuration/services/backups.nix

@@ -1,9 +1,9 @@
-{
+{ config
-  config,
+, pkgs
-  pkgs,
+, lib
-  lib,
+, ...
-  ...
+}:
-}: let
+let
   inherit (lib) types optional singleton;
   mkShutdownScript = service:
     pkgs.writeShellScript "backup-${service}-shutdown" ''
@@ -42,16 +42,16 @@
     RESTIC_REPOSITORY = "rclone:storagebox:backups";
     RCLONE_CONFIG = rcloneConfig;
   };
-in {
+in
+{
   options = {
     services.backups = lib.mkOption {
       description = lib.mdDoc ''
         Configure restic backups with a specific tag.
       '';
-      type = types.attrsOf (types.submodule ({
+      type = types.attrsOf (types.submodule ({ config
-        config,
+                                             , name
-        name,
+                                             , ...
-        ...
                                              }: {
         options = {
           user = lib.mkOption {
@@ -164,7 +164,8 @@ in {
           };
         };
       }
-      // lib.mapAttrs' (name: backup:
+      // lib.mapAttrs'
+        (name: backup:
           lib.nameValuePair "backup-${name}" {
             # Don't want to restart mid-backup
             restartIfChanged = false;
@@ -226,7 +227,8 @@ in {
           # of the backup jobs.
         };
       }
-      // lib.mapAttrs' (name: backup:
+      // lib.mapAttrs'
+        (name: backup:
           lib.nameValuePair "backup-${name}" {
             wantedBy = [ "timers.target" ];
             timerConfig = {

configuration/services/battery-manager.nix

@@ -1,7 +1,6 @@
-{
+{ config
-  config,
+, flake-inputs
-  flake-inputs,
+, ...
-  ...
 }: {
   imports = [
     flake-inputs.sonnenshift.nixosModules.default

configuration/services/conduit.nix

@@ -1,15 +1,16 @@
-{
+{ pkgs
-  pkgs,
+, config
-  config,
+, lib
-  lib,
+, ...
-  ...
+}:
-}: let
+let
   inherit (lib.strings) concatMapStringsSep;
 
   cfg = config.services.matrix-conduit;
   domain = "matrix.${config.services.nginx.domain}";
   turn-realm = "turn.${config.services.nginx.domain}";
-in {
+in
+{
   services.matrix-conduit = {
     enable = true;
     settings.global = {
@@ -17,10 +18,12 @@ in {
       server_name = domain;
       database_backend = "rocksdb";
 
-      turn_uris = let
+      turn_uris =
+        let
           address = "${config.services.coturn.realm}:${toString config.services.coturn.listening-port}";
           tls-address = "${config.services.coturn.realm}:${toString config.services.coturn.tls-listening-port}";
-      in [
+        in
+        [
           "turn:${address}?transport=udp"
           "turn:${address}?transport=tcp"
           "turns:${tls-address}?transport=udp"
@@ -29,7 +32,8 @@ in {
     };
   };
 
-  systemd.services.heisenbridge = let
+  systemd.services.heisenbridge =
+    let
       replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret";
       registrationFile = builtins.toFile "heisenbridge-registration.yaml" (builtins.toJSON {
         id = "heisenbridge";
@@ -73,7 +77,8 @@ in {
             --owner @tlater:matrix.tlater.net \
             'http://localhost:${toString cfg.settings.global.port}'
       '';
-  in {
+    in
+    {
       description = "Matrix<->IRC bridge";
       wantedBy = [ "multi-user.target" ];
       after = [ "conduit.service" ];

configuration/services/foundryvtt.nix

@@ -1,11 +1,12 @@
-{
+{ lib
-  lib,
+, config
-  config,
+, flake-inputs
-  flake-inputs,
+, ...
-  ...
+}:
-}: let
+let
   domain = "foundryvtt.${config.services.nginx.domain}";
-in {
+in
+{
   imports = [ flake-inputs.foundryvtt.nixosModules.foundryvtt ];
 
   services.foundryvtt = {
@@ -20,9 +21,11 @@ in {
   # running
   systemd.services.foundryvtt.wantedBy = lib.mkForce [ ];
 
-  services.nginx.virtualHosts."${domain}" = let
+  services.nginx.virtualHosts."${domain}" =
+    let
       inherit (config.services.foundryvtt) port;
-  in {
+    in
+    {
       forceSSL = true;
       useACMEHost = "tlater.net";
       enableHSTS = true;

configuration/services/gitea.nix

@@ -1,11 +1,12 @@
-{
+{ pkgs
-  pkgs,
+, config
-  config,
+, lib
-  lib,
+, ...
-  ...
+}:
-}: let
+let
   domain = "gitea.${config.services.nginx.domain}";
-in {
+in
+{
   services.forgejo = {
     enable = true;
     database.type = "postgres";
@@ -27,19 +28,23 @@ in {
     };
   };
 
-  systemd.services.forgejo.serviceConfig.ExecStartPre = let
+  systemd.services.forgejo.serviceConfig.ExecStartPre =
+    let
       replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret";
       secretPath = config.sops.secrets."forgejo/metrics-token".path;
       runConfig = "${config.services.forgejo.customDir}/conf/app.ini";
-  in [
+    in
+    [
       "+${replaceSecretBin} '#metricstoken#' '${secretPath}' '${runConfig}'"
     ];
 
   # Set up SSL
-  services.nginx.virtualHosts."${domain}" = let
+  services.nginx.virtualHosts."${domain}" =
+    let
       httpAddress = config.services.forgejo.settings.server.HTTP_ADDR;
       httpPort = config.services.forgejo.settings.server.HTTP_PORT;
-  in {
+    in
+    {
       forceSSL = true;
       useACMEHost = "tlater.net";
       enableHSTS = true;

configuration/services/metrics/exporters.nix

@@ -1,23 +1,26 @@
-{
+{ config
-  config,
+, pkgs
-  pkgs,
+, lib
-  lib,
+, ...
-  ...
+}:
-}: let
+let
   yaml = pkgs.formats.yaml { };
-in {
+in
+{
   services.prometheus = {
     exporters = {
       # Periodically check domain registration status
       domain = {
         enable = true;
         listenAddress = "127.0.0.1";
-        extraFlags = let
+        extraFlags =
+          let
             conf.domains = [
               "tlater.net"
               "tlater.com"
             ];
-        in [
+          in
+          [
             "--config=${yaml.generate "domains.yml" conf}"
           ];
       };
@@ -49,7 +52,8 @@ in {
         group = "nginx";
 
         settings.namespaces =
-          lib.mapAttrsToList (name: virtualHost: {
+          lib.mapAttrsToList
+            (name: virtualHost: {
               inherit name;
               metrics_override.prefix = "nginxlog";
               namespace_label = "vhost";
@@ -71,9 +75,11 @@ in {
     };
 
     extraExporters = {
-      fail2ban = let
+      fail2ban =
+        let
           cfg = config.services.prometheus.extraExporters.fail2ban;
-      in {
+        in
+        {
           port = 9191;
           serviceOpts = {
             after = [ "fail2ban.service" ];

configuration/services/metrics/grafana.nix

@@ -1,6 +1,8 @@
-{config, ...}: let
+{ config, ... }:
+let
   domain = "metrics.${config.services.nginx.domain}";
-in {
+in
+{
   services.grafana = {
     enable = true;
     settings = {

configuration/services/metrics/options.nix

@@ -1,12 +1,13 @@
-{
+{ pkgs
-  pkgs,
+, config
-  config,
+, lib
-  lib,
+, ...
-  ...
+}:
-}: let
+let
   inherit (lib) types mkOption mkDefault;
   yaml = pkgs.formats.yaml { };
-in {
+in
+{
   options = {
     services.prometheus = {
       extraExporters = mkOption {
@@ -31,10 +32,9 @@ in {
     };
 
     services.victoriametrics.scrapeConfigs = mkOption {
-      type = types.attrsOf (types.submodule ({
+      type = types.attrsOf (types.submodule ({ name
-        name,
+                                             , self
-        self,
+                                             , ...
-        ...
                                              }: {
         options = {
           job_name = mkOption {
@@ -89,7 +89,8 @@ in {
 
   config = {
     systemd.services = lib.mkMerge [
-      (lib.mapAttrs' (name: exporter:
+      (lib.mapAttrs'
+        (name: exporter:
           lib.nameValuePair "prometheus-${name}-exporter" (lib.mkMerge [
             {
               # Shamelessly copied from upstream because the upstream
@@ -128,12 +129,15 @@ in {
         config.services.prometheus.extraExporters)
 
       {
-        vmagent-scrape-exporters = let
+        vmagent-scrape-exporters =
+          let
             listenAddress = config.services.victoriametrics.listenAddress;
             vmAddr = (lib.optionalString (lib.hasPrefix ":" listenAddress) "127.0.0.1") + listenAddress;
             promscrape = yaml.generate "prometheus.yml" {
-            scrape_configs = lib.mapAttrsToList (_: scrape:
+              scrape_configs = lib.mapAttrsToList
-              lib.recursiveUpdate {
+                (_: scrape:
+                  lib.recursiveUpdate
+                    {
                       inherit (scrape) job_name;
                       static_configs =
                         scrape.static_configs
@@ -142,7 +146,8 @@ in {
                     scrape.extraSettings)
                 config.services.victoriametrics.scrapeConfigs;
             };
-        in {
+          in
+          {
             enable = true;
             path = [ pkgs.victoriametrics ];
             wantedBy = [ "multi-user.target" ];
@@ -188,15 +193,19 @@ in {
 
     users.groups.metrics = { };
 
-    services.victoriametrics.scrapeConfigs = let
+    services.victoriametrics.scrapeConfigs =
+      let
         allExporters =
-        lib.mapAttrs (name: exporter: {
+          lib.mapAttrs
+            (name: exporter: {
               inherit (exporter) listenAddress port;
-        }) ((lib.filterAttrs (_: exporter: builtins.isAttrs exporter && exporter.enable)
+            })
+            ((lib.filterAttrs (_: exporter: builtins.isAttrs exporter && exporter.enable)
               config.services.prometheus.exporters)
             // config.services.prometheus.extraExporters);
       in
-      lib.mapAttrs (_: exporter: {
+      lib.mapAttrs
+        (_: exporter: {
           targets = [ "${exporter.listenAddress}:${toString exporter.port}" ];
         })
         allExporters;

configuration/services/nextcloud.nix

@@ -1,14 +1,15 @@
-{
+{ pkgs
-  pkgs,
+, config
-  config,
+, ...
-  ...
+}:
-}: let
+let
   # Update pending on rewrite of nextcloud news, though there is an
   # alpha to switch to if it becomes necessary:
   # https://github.com/nextcloud/news/issues/2610
   nextcloud = pkgs.nextcloud27;
   hostName = "nextcloud.${config.services.nginx.domain}";
-in {
+in
+{
   services.nextcloud = {
     inherit hostName;
 

configuration/services/starbound.nix

@@ -1,10 +1,11 @@
-{
+{ pkgs
-  pkgs,
+, lib
-  lib,
+, ...
-  ...
+}:
-}: let
+let
   inherit (lib) concatStringsSep;
-in {
+in
+{
   # Sadly, steam-run requires some X libs
   environment.noXlibs = false;
 

configuration/services/webserver.nix

@@ -1,6 +1,8 @@
-{config, ...}: let
+{ config, ... }:
+let
   domain = config.services.nginx.domain;
-in {
+in
+{
   services.tlaternet-webserver = {
     enable = true;
     listen = {
@@ -10,9 +12,11 @@ in {
   };
 
   # Set up SSL
-  services.nginx.virtualHosts."${domain}" = let
+  services.nginx.virtualHosts."${domain}" =
+    let
       inherit (config.services.tlaternet-webserver.listen) addr port;
-  in {
+    in
+    {
       serverAliases = [ "www.${domain}" ];
 
       forceSSL = true;

flake.nix

@@ -32,17 +32,19 @@
     };
   };
 
-  outputs = {
+  outputs =
-    self,
+    { self
-    nixpkgs,
+    , nixpkgs
-    sops-nix,
+    , sops-nix
-    nvfetcher,
+    , nvfetcher
-    deploy-rs,
+    , deploy-rs
-    ...
+    , ...
-  } @ inputs: let
+    } @ inputs:
+    let
       system = "x86_64-linux";
       pkgs = nixpkgs.legacyPackages.${system};
-  in {
+    in
+    {
       ##################
       # Configurations #
       ##################
@@ -89,7 +91,8 @@
 
         run-vm = {
           type = "app";
-        program = let
+          program =
+            let
               vm = nixpkgs.lib.nixosSystem {
                 inherit system;
                 specialArgs.flake-inputs = inputs;
@@ -102,32 +105,31 @@
             in
             (pkgs.writeShellScript "" ''
               ${vm.config.system.build.vm.outPath}/bin/run-testvm-vm
-          '')
+            '').outPath;
-          .outPath;
         };
 
         update-pkgs = {
           type = "app";
-        program = let
+          program =
+            let
               nvfetcher-bin = "${nvfetcher.packages.${system}.default}/bin/nvfetcher";
             in
             (pkgs.writeShellScript "update-pkgs" ''
               cd "$(git rev-parse --show-toplevel)/pkgs"
               ${nvfetcher-bin} -o _sources_pkgs -c nvfetcher.toml
-          '')
+            '').outPath;
-          .outPath;
         };
 
         update-nextcloud-apps = {
           type = "app";
-        program = let
+          program =
+            let
               nvfetcher-bin = "${nvfetcher.packages.${system}.default}/bin/nvfetcher";
             in
             (pkgs.writeShellScript "update-nextcloud-apps" ''
               cd "$(git rev-parse --show-toplevel)/pkgs"
               ${nvfetcher-bin} -o _sources_nextcloud -c nextcloud-apps.toml
-          '')
+            '').outPath;
-          .outPath;
         };
       };
 
@@ -144,6 +146,8 @@
           sops-nix.packages.${system}.sops-init-gpg-key
           deploy-rs.packages.${system}.default
 
+          nixpkgs-fmt
+
           cargo
           clippy
           rustc

modules/nginxExtensions.nix

@@ -1,8 +1,7 @@
-{
+{ config
-  config,
+, pkgs
-  pkgs,
+, lib
-  lib,
+, ...
-  ...
 }: {
   options = {
     services.nginx.domain = lib.mkOption {
@@ -10,11 +9,12 @@
       description = "The base domain name to append to virtual domain names";
     };
 
-    services.nginx.virtualHosts = let
+    services.nginx.virtualHosts =
-      extraVirtualHostOptions = {
+      let
-        name,
+        extraVirtualHostOptions =
-        config,
+          { name
-        ...
+          , config
+          , ...
           }: {
             options = {
               enableHSTS = lib.mkEnableOption "Enable HSTS";
@@ -47,10 +47,12 @@
 
   config = {
     # Don't attempt to run acme if the domain name is not tlater.net
-    systemd.services = let
+    systemd.services =
+      let
         confirm = ''[[ "tlater.net" = ${config.services.nginx.domain} ]]'';
       in
-      lib.mapAttrs' (cert: _:
+      lib.mapAttrs'
+        (cert: _:
           lib.nameValuePair "acme-${cert}" {
             serviceConfig.ExecCondition = ''${pkgs.runtimeShell} -c '${confirm}' '';
           })

pkgs/afvalcalendar/default.nix

@@ -1,7 +1,6 @@
-{
+{ pkgs
-  pkgs,
+, rustPlatform
-  rustPlatform,
+, ...
-  ...
 }:
 rustPlatform.buildRustPackage {
   pname = "afvalcalendar";

pkgs/default.nix

@@ -1,7 +1,8 @@
-{
+{ pkgs
-  pkgs,
+, lib
-  lib,
+,
-}: let
+}:
+let
   inherit (builtins) fromJSON mapAttrs readFile;
   inherit (pkgs) callPackage;
 in

pkgs/mkNextcloudApp.nix

@@ -1,6 +1,6 @@
-{
+{ fetchNextcloudApp
-  fetchNextcloudApp,
+, lib
-  lib,
+,
 }: source:
 fetchNextcloudApp {
   url = source.src.url;

pkgs/prometheus/fail2ban-exporter.nix

@@ -1,6 +1,6 @@
-{
+{ buildGoModule
-  buildGoModule,
+, sources
-  sources,
+,
 }:
 buildGoModule {
   inherit (sources.prometheus-fail2ban-exporter) pname src version;

pkgs/starbound/default.nix

@@ -1,11 +1,12 @@
-{
+{ stdenv
-  stdenv,
+, lib
-  lib,
+, makeWrapper
-  makeWrapper,
+, patchelf
-  patchelf,
+, steamPackages
-  steamPackages,
+, replace-secret
-  replace-secret,
+,
-}: let
+}:
+let
   # Use the directory in which starbound is installed so steamcmd
   # doesn't have to be reinstalled constantly (we're using DynamicUser
   # with StateDirectory to persist this).