configuration/default.nix

@@ -1,10 +1,12 @@
-{ config
-, pkgs
-, lib
-, modulesPath
-, flake-inputs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  lib,
+  modulesPath,
+  flake-inputs,
+  ...
+}:
+{
   imports = [
     flake-inputs.disko.nixosModules.disko
     flake-inputs.sops-nix.nixosModules.sops
@@ -51,7 +53,10 @@
 
   # Optimization for minecraft servers, see:
   # https://bugs.mojang.com/browse/MC-183518
-  boot.kernelParams = [ "highres=off" "nohz=off" ];
+  boot.kernelParams = [
+    "highres=off"
+    "nohz=off"
+  ];
 
   networking = {
     usePredictableInterfaceNames = false;

configuration/hardware-specific/hetzner/default.nix

@@ -25,9 +25,7 @@
         };
       }
       # IPv6
-      {
-        addressConfig.Address = "2a01:4f8:10b:3c85::2/64";
-      }
+      { addressConfig.Address = "2a01:4f8:10b:3c85::2/64"; }
     ];
 
     networkConfig = {

configuration/hardware-specific/hetzner/disko.nix

@@ -19,7 +19,10 @@
         };
       };
 
-      mountOptions = [ "compress=zstd" "noatime" ];
+      mountOptions = [
+        "compress=zstd"
+        "noatime"
+      ];
     in
     {
       sda = {
@@ -54,7 +57,15 @@
                 type = "btrfs";
                 # Hack to get multi-device btrfs going
                 # See https://github.com/nix-community/disko/issues/99
-                extraArgs = [ "-d" "raid1" "-m" "raid1" "--runtime-features" "quota" "/dev/sda3" ];
+                extraArgs = [
+                  "-d"
+                  "raid1"
+                  "-m"
+                  "raid1"
+                  "--runtime-features"
+                  "quota"
+                  "/dev/sda3"
+                ];
                 subvolumes = {
                   "/volume" = { };
                   "/volume/root" = {

configuration/hardware-specific/vm.nix

@@ -1,4 +1,5 @@
-{ lib, ... }: {
+{ lib, ... }:
+{
   users.users.tlater.password = "insecure";
 
   # Disable graphical tty so -curses works

configuration/nginx.nix

@@ -1,7 +1,5 @@
-{ config
-, lib
-, ...
-}: {
+{ config, lib, ... }:
+{
   services.nginx = {
     enable = true;
     recommendedTlsSettings = true;
@@ -26,8 +24,8 @@
       # Override the default, just keep fewer logs
       nginx.rotate = 6;
     }
-    // lib.mapAttrs'
-      (virtualHost: _:
+    // lib.mapAttrs' (
+      virtualHost: _:
       lib.nameValuePair "/var/log/nginx/${virtualHost}/access.log" {
         frequency = "daily";
         rotate = 2;
@@ -35,17 +33,14 @@
         delaycompress = true;
         su = "${config.services.nginx.user} ${config.services.nginx.group}";
         postrotate = "[ ! -f /var/run/nginx/nginx.pid ] || kill -USR1 `cat /var/run/nginx/nginx.pid`";
-        })
-      config.services.nginx.virtualHosts;
+      }
+    ) config.services.nginx.virtualHosts;
 
-  systemd.tmpfiles.rules =
-    lib.mapAttrsToList
-      (
+  systemd.tmpfiles.rules = lib.mapAttrsToList (
     virtualHost: _:
     #
     "d /var/log/nginx/${virtualHost} 0750 ${config.services.nginx.user} ${config.services.nginx.group}"
-      )
-      config.services.nginx.virtualHosts;
+  ) config.services.nginx.virtualHosts;
 
   security.acme = {
     defaults.email = "tm@tlater.net";
@@ -61,8 +56,8 @@
 
   services.backups.acme = {
     user = "acme";
-    paths =
-      lib.mapAttrsToList (virtualHost: _: "/var/lib/acme/${virtualHost}")
-        config.services.nginx.virtualHosts;
+    paths = lib.mapAttrsToList (
+      virtualHost: _: "/var/lib/acme/${virtualHost}"
+    ) config.services.nginx.virtualHosts;
   };
 }

configuration/services/afvalcalendar.nix

@@ -1,7 +1,5 @@
-{ pkgs
-, config
-, ...
-}: {
+{ pkgs, config, ... }:
+{
   systemd.services.afvalcalendar = {
     description = "Enschede afvalcalendar -> ical converter";
     wantedBy = [ "multi-user.target" ];
@@ -25,16 +23,23 @@
       ProtectKernelModules = true;
       ProtectKernelLogs = true;
       ProtectControlGroups = true;
-      RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+      RestrictAddressFamilies = [
+        "AF_UNIX"
+        "AF_INET"
+        "AF_INET6"
+      ];
       RestrictNamespaces = true;
       LockPersonality = true;
       MemoryDenyWriteExecute = true;
       RestrictRealtime = true;
       RestrictSUIDSGID = true;
       SystemCallArchitectures = "native";
-      SystemCallFilter = [ "@system-service" "~@privileged @resources @setuid @keyring" ];
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged @resources @setuid @keyring"
+      ];
 
-      Umask = 0002;
+      Umask = 2;
       SupplementaryGroups = "afvalcalendar-hosting";
 
       ReadWritePaths = "/srv/afvalcalendar";

configuration/services/backups.nix

@@ -1,29 +1,35 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
 let
   inherit (lib) types optional singleton;
-  mkShutdownScript = service:
+  mkShutdownScript =
+    service:
     pkgs.writeShellScript "backup-${service}-shutdown" ''
       if systemctl is-active --quiet '${service}'; then
         touch '/tmp/${service}-was-active'
         systemctl stop '${service}'
       fi
     '';
-  mkRestartScript = service:
+  mkRestartScript =
+    service:
     pkgs.writeShellScript "backup-${service}-restart" ''
       if [ -f '/tmp/${service}-was-active' ]; then
         rm '/tmp/${service}-was-active'
         systemctl start '${service}'
       fi
     '';
-  writeScript = name: packages: text:
-    lib.getExe (pkgs.writeShellApplication {
+  writeScript =
+    name: packages: text:
+    lib.getExe (
+      pkgs.writeShellApplication {
         inherit name text;
         runtimeInputs = packages;
-    });
+      }
+    );
 
   # *NOT* a TOML file, for some reason quotes are interpreted
   # *literally
@@ -49,10 +55,10 @@ in
       description = lib.mdDoc ''
         Configure restic backups with a specific tag.
       '';
-      type = types.attrsOf (types.submodule ({ config
-                                             , name
-                                             , ...
-                                             }: {
+      type = types.attrsOf (
+        types.submodule (
+          { config, name, ... }:
+          {
             options = {
               user = lib.mkOption {
                 type = types.str;
@@ -127,7 +133,9 @@ in
                 '';
               };
             };
-      }));
+          }
+        )
+      );
     };
   };
 
@@ -164,15 +172,13 @@ in
           };
         };
       }
-      // lib.mapAttrs'
-        (name: backup:
+      // lib.mapAttrs' (
+        name: backup:
         lib.nameValuePair "backup-${name}" {
           # Don't want to restart mid-backup
           restartIfChanged = false;
 
-            environment =
-              resticEnv
-              // {
+          environment = resticEnv // {
             RESTIC_CACHE_DIR = "%C/backup-${name}";
           };
 
@@ -197,25 +203,37 @@ in
             PrivateTmp = true;
 
             ExecStart = [
-                (lib.concatStringsSep " " ([ "${pkgs.restic}/bin/restic" "backup" "--tag" name ] ++ backup.paths))
+              (lib.concatStringsSep " " (
+                [
+                  "${pkgs.restic}/bin/restic"
+                  "backup"
+                  "--tag"
+                  name
+                ]
+                ++ backup.paths
+              ))
             ];
 
             ExecStartPre =
               map (service: "+${mkShutdownScript service}") backup.pauseServices
-                ++ singleton (writeScript "backup-${name}-repo-init" [ ] ''
+              ++ singleton (
+                writeScript "backup-${name}-repo-init" [ ] ''
                   restic snapshots || restic init
-                '')
-                ++ optional (backup.preparation.text != null)
-                  (writeScript "backup-${name}-prepare" backup.preparation.packages backup.preparation.text);
+                ''
+              )
+              ++ optional (backup.preparation.text != null) (
+                writeScript "backup-${name}-prepare" backup.preparation.packages backup.preparation.text
+              );
 
             # TODO(tlater): Add repo pruning/checking
             ExecStopPost =
               map (service: "+${mkRestartScript service}") backup.pauseServices
-                ++ optional (backup.cleanup.text != null)
-                  (writeScript "backup-${name}-cleanup" backup.cleanup.packages backup.cleanup.text);
+              ++ optional (backup.cleanup.text != null) (
+                writeScript "backup-${name}-cleanup" backup.cleanup.packages backup.cleanup.text
+              );
           };
-          })
-        config.services.backups;
+        }
+      ) config.services.backups;
 
     systemd.timers =
       {
@@ -227,8 +245,8 @@ in
           # of the backup jobs.
         };
       }
-      // lib.mapAttrs'
-        (name: backup:
+      // lib.mapAttrs' (
+        name: backup:
         lib.nameValuePair "backup-${name}" {
           wantedBy = [ "timers.target" ];
           timerConfig = {
@@ -237,8 +255,8 @@ in
             FixedRandomDelay = true;
             Persistent = true;
           };
-          })
-        config.services.backups;
+        }
+      ) config.services.backups;
 
     users = {
       # This user is only used to own the ssh key, because apparently

configuration/services/battery-manager.nix

@@ -1,10 +1,6 @@
-{ config
-, flake-inputs
-, ...
-}: {
-  imports = [
-    flake-inputs.sonnenshift.nixosModules.default
-  ];
+{ config, flake-inputs, ... }:
+{
+  imports = [ flake-inputs.sonnenshift.nixosModules.default ];
 
   services.batteryManager = {
     enable = true;

configuration/services/conduit.nix

@@ -1,7 +1,8 @@
-{ pkgs
-, config
-, lib
-, ...
+{
+  pkgs,
+  config,
+  lib,
+  ...
 }:
 let
   inherit (lib.strings) concatMapStringsSep;
@@ -42,7 +43,8 @@ in
   systemd.services.heisenbridge =
     let
       replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret";
-      registrationFile = builtins.toFile "heisenbridge-registration.yaml" (builtins.toJSON {
+      registrationFile = builtins.toFile "heisenbridge-registration.yaml" (
+        builtins.toJSON {
           id = "heisenbridge";
           url = "http://127.0.0.1:9898";
           as_token = "@AS_TOKEN@";
@@ -63,7 +65,8 @@ in
             aliases = [ ];
             rooms = [ ];
           };
-      });
+        }
+      );
 
       # TODO(tlater): Starting with systemd 253 it will become possible
       # to do the credential setup as part of ExecStartPre/preStart
@@ -114,7 +117,7 @@ in
         RestrictRealtime = true;
         ProtectProc = "invisible";
         ProcSubset = "pid";
-        UMask = 0077;
+        UMask = 77;
 
         # For the identd port
         # CapabilityBoundingSet = ["CAP_NET_BIND_SERVICE"];
@@ -134,9 +137,7 @@ in
     use-auth-secret = true;
     static-auth-secret-file = config.sops.secrets."turn/secret".path;
     realm = turn-realm;
-    relay-ips = [
-      "116.202.158.55"
-    ];
+    relay-ips = [ "116.202.158.55" ];
 
     # SSL config
     #
@@ -245,9 +246,7 @@ in
 
   services.backups.conduit = {
     user = "root";
-    paths = [
-      "/var/lib/private/matrix-conduit/"
-    ];
+    paths = [ "/var/lib/private/matrix-conduit/" ];
     # Other services store their data in conduit, so no other services
     # need to be shut down currently.
     pauseServices = [ "conduit.service" ];

configuration/services/fail2ban.nix

@@ -1,4 +1,5 @@
-{ pkgs, ... }: {
+{ pkgs, ... }:
+{
   services.fail2ban = {
     enable = true;
     extraPackages = [ pkgs.ipset ];

configuration/services/foundryvtt.nix

@@ -1,8 +1,9 @@
-{ lib
-, config
-, flake-inputs
-, pkgs
-, ...
+{
+  lib,
+  config,
+  flake-inputs,
+  pkgs,
+  ...
 }:
 let
   domain = "foundryvtt.${config.services.nginx.domain}";
@@ -40,9 +41,7 @@ in
 
   services.backups.foundryvtt = {
     user = "foundryvtt";
-    paths = [
-      config.services.foundryvtt.dataDir
-    ];
+    paths = [ config.services.foundryvtt.dataDir ];
     pauseServices = [ "foundryvtt.service" ];
   };
 }

configuration/services/gitea.nix

@@ -1,7 +1,8 @@
-{ pkgs
-, config
-, lib
-, ...
+{
+  pkgs,
+  config,
+  lib,
+  ...
 }:
 let
   domain = "gitea.${config.services.nginx.domain}";
@@ -34,9 +35,7 @@ in
       secretPath = config.sops.secrets."forgejo/metrics-token".path;
       runConfig = "${config.services.forgejo.customDir}/conf/app.ini";
     in
-    [
-      "+${replaceSecretBin} '#metricstoken#' '${secretPath}' '${runConfig}'"
-    ];
+    [ "+${replaceSecretBin} '#metricstoken#' '${secretPath}' '${runConfig}'" ];
 
   # Set up SSL
   services.nginx.virtualHosts."${domain}" =

configuration/services/metrics/exporters.nix

@@ -1,7 +1,8 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
 let
   yaml = pkgs.formats.yaml { };
@@ -20,9 +21,7 @@ in
               "tlater.com"
             ];
           in
-          [
-            "--config=${yaml.generate "domains.yml" conf}"
-          ];
+          [ "--config=${yaml.generate "domains.yml" conf}" ];
       };
 
       # System statistics
@@ -51,9 +50,7 @@ in
         listenAddress = "127.0.0.1";
         group = "nginx";
 
-        settings.namespaces =
-          lib.mapAttrsToList
-            (name: virtualHost: {
+        settings.namespaces = lib.mapAttrsToList (name: virtualHost: {
           inherit name;
           metrics_override.prefix = "nginxlog";
           namespace_label = "vhost";
@@ -66,11 +63,8 @@ in
             ''uht="$upstream_header_time" urt="$upstream_response_time"''
           ];
 
-              source.files = [
-                "/var/log/nginx/${name}/access.log"
-              ];
-            })
-            config.services.nginx.virtualHosts;
+          source.files = [ "/var/log/nginx/${name}/access.log" ];
+        }) config.services.nginx.virtualHosts;
       };
     };
 
@@ -86,7 +80,11 @@ in
             requires = [ "fail2ban.service" ];
             serviceConfig = {
               Group = "fail2ban";
-              RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+              RestrictAddressFamilies = [
+                "AF_UNIX"
+                "AF_INET"
+                "AF_INET6"
+              ];
               ExecStart = lib.concatStringsSep " " [
                 "${pkgs.local.prometheus-fail2ban-exporter}/bin/fail2ban-prometheus-exporter"
                 "--collector.f2b.socket=/var/run/fail2ban/fail2ban.sock"

configuration/services/metrics/options.nix

@@ -1,7 +1,8 @@
-{ pkgs
-, config
-, lib
-, ...
+{
+  pkgs,
+  config,
+  lib,
+  ...
 }:
 let
   inherit (lib) types mkOption mkDefault;
@@ -11,7 +12,8 @@ in
   options = {
     services.prometheus = {
       extraExporters = mkOption {
-        type = types.attrsOf (types.submodule {
+        type = types.attrsOf (
+          types.submodule {
             options = {
               port = mkOption {
                 type = types.int;
@@ -27,15 +29,16 @@ in
                 description = "An attrset to be merged with the exporter's systemd service.";
               };
             };
-        });
+          }
+        );
       };
     };
 
     services.victoriametrics.scrapeConfigs = mkOption {
-      type = types.attrsOf (types.submodule ({ name
-                                             , self
-                                             , ...
-                                             }: {
+      type = types.attrsOf (
+        types.submodule (
+          { name, self, ... }:
+          {
             options = {
               job_name = mkOption {
                 type = types.str;
@@ -62,7 +65,8 @@ in
 
               static_configs = mkOption {
                 default = [ ];
-            type = types.listOf (types.submodule {
+                type = types.listOf (
+                  types.submodule {
                     options = {
                       targets = mkOption {
                         type = types.listOf types.str;
@@ -80,18 +84,22 @@ in
                         default = { };
                       };
                     };
-            });
+                  }
+                );
               };
             };
-      }));
+          }
+        )
+      );
     };
   };
 
   config = {
     systemd.services = lib.mkMerge [
-      (lib.mapAttrs'
-        (name: exporter:
-          lib.nameValuePair "prometheus-${name}-exporter" (lib.mkMerge [
+      (lib.mapAttrs' (
+        name: exporter:
+        lib.nameValuePair "prometheus-${name}-exporter" (
+          lib.mkMerge [
             {
               # Shamelessly copied from upstream because the upstream
               # module is an intractable mess
@@ -117,7 +125,10 @@ in
               serviceConfig.ProtectKernelTunables = true;
               serviceConfig.ProtectSystem = mkDefault "strict";
               serviceConfig.RemoveIPC = true;
-              serviceConfig.RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+              serviceConfig.RestrictAddressFamilies = [
+                "AF_INET"
+                "AF_INET6"
+              ];
               serviceConfig.RestrictNamespaces = true;
               serviceConfig.RestrictRealtime = true;
               serviceConfig.RestrictSUIDSGID = true;
@@ -125,8 +136,9 @@ in
               serviceConfig.UMask = "0077";
             }
             exporter.serviceOpts
-          ]))
-        config.services.prometheus.extraExporters)
+          ]
+        )
+      ) config.services.prometheus.extraExporters)
 
       {
         vmagent-scrape-exporters =
@@ -134,24 +146,25 @@ in
             listenAddress = config.services.victoriametrics.listenAddress;
             vmAddr = (lib.optionalString (lib.hasPrefix ":" listenAddress) "127.0.0.1") + listenAddress;
             promscrape = yaml.generate "prometheus.yml" {
-              scrape_configs = lib.mapAttrsToList
-                (_: scrape:
-                  lib.recursiveUpdate
-                    {
+              scrape_configs = lib.mapAttrsToList (
+                _: scrape:
+                lib.recursiveUpdate {
                   inherit (scrape) job_name;
                   static_configs =
                     scrape.static_configs
                     ++ lib.optional (scrape.targets != [ ]) { targets = scrape.targets; };
-                    }
-                    scrape.extraSettings)
-                config.services.victoriametrics.scrapeConfigs;
+                } scrape.extraSettings
+              ) config.services.victoriametrics.scrapeConfigs;
             };
           in
           {
             enable = true;
             path = [ pkgs.victoriametrics ];
             wantedBy = [ "multi-user.target" ];
-            after = [ "network.target" "victoriametrics.service" ];
+            after = [
+              "network.target"
+              "victoriametrics.service"
+            ];
             serviceConfig = {
               ExecStart = [
                 (lib.concatStringsSep " " [
@@ -180,7 +193,10 @@ in
               ProtectKernelTunables = true;
               ProtectSystem = "strict";
               RemoveIPC = true;
-              RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+              RestrictAddressFamilies = [
+                "AF_INET"
+                "AF_INET6"
+              ];
               RestrictNamespaces = true;
               RestrictRealtime = true;
               RestrictSUIDSGID = true;
@@ -195,19 +211,15 @@ in
 
     services.victoriametrics.scrapeConfigs =
       let
-        allExporters =
-          lib.mapAttrs
-            (name: exporter: {
-              inherit (exporter) listenAddress port;
-            })
-            ((lib.filterAttrs (_: exporter: builtins.isAttrs exporter && exporter.enable)
-              config.services.prometheus.exporters)
-            // config.services.prometheus.extraExporters);
+        allExporters = lib.mapAttrs (name: exporter: { inherit (exporter) listenAddress port; }) (
+          (lib.filterAttrs (
+            _: exporter: builtins.isAttrs exporter && exporter.enable
+          ) config.services.prometheus.exporters)
+          // config.services.prometheus.extraExporters
+        );
       in
-      lib.mapAttrs
-        (_: exporter: {
+      lib.mapAttrs (_: exporter: {
         targets = [ "${exporter.listenAddress}:${toString exporter.port}" ];
-        })
-        allExporters;
+      }) allExporters;
   };
 }

configuration/services/metrics/victoriametrics.nix

@@ -1,9 +1,8 @@
-{ config, ... }: {
+{ config, ... }:
+{
   config.services.victoriametrics = {
     enable = true;
-    extraOptions = [
-      "-storage.minFreeDiskSpaceBytes=5GB"
-    ];
+    extraOptions = [ "-storage.minFreeDiskSpaceBytes=5GB" ];
 
     scrapeConfigs = {
       forgejo = {

configuration/services/nextcloud.nix

@@ -1,7 +1,8 @@
-{ pkgs
-, config
-, lib
-, ...
+{
+  pkgs,
+  config,
+  lib,
+  ...
 }:
 let
   # Update pending on rewrite of nextcloud news, though there is an
@@ -15,8 +16,8 @@ in
     inherit hostName;
 
     package = nextcloud;
-    phpPackage = lib.mkForce
-      (pkgs.php.override {
+    phpPackage = lib.mkForce (
+      pkgs.php.override {
         packageOverrides = final: prev: {
           extensions = prev.extensions // {
             pgsql = prev.extensions.pgsql.overrideAttrs (old: {
@@ -27,7 +28,8 @@ in
             });
           };
         };
-      });
+      }
+    );
     enable = true;
     maxUploadSize = "2G";
     https = true;
@@ -52,7 +54,14 @@ in
     };
 
     extraApps = {
-      inherit (pkgs.local) bookmarks calendar contacts cookbook news notes;
+      inherit (pkgs.local)
+        bookmarks
+        calendar
+        contacts
+        cookbook
+        news
+        notes
+        ;
     };
   };
 

configuration/services/postgres.nix

@@ -1,4 +1,5 @@
-{ pkgs, ... }: {
+{ pkgs, ... }:
+{
   services.postgresql = {
     package = pkgs.postgresql_14;
     enable = true;

configuration/services/starbound.nix

@@ -1,7 +1,4 @@
-{ pkgs
-, lib
-, ...
-}:
+{ pkgs, lib, ... }:
 let
   inherit (lib) concatStringsSep;
 in
@@ -114,9 +111,7 @@ in
 
   services.backups.starbound = {
     user = "root";
-    paths = [
-      "/var/lib/private/starbound/storage/universe/"
-    ];
+    paths = [ "/var/lib/private/starbound/storage/universe/" ];
     pauseServices = [ "starbound.service" ];
   };
 }

configuration/services/wireguard.nix

@@ -1,4 +1,5 @@
-{ config, ... }: {
+{ config, ... }:
+{
   # iptables needs to permit forwarding from wg0 to wg0
   networking.firewall.extraCommands = ''
     iptables -A FORWARD -i wg0 -o wg0 -j ACCEPT

flake.nix

@@ -33,13 +33,14 @@
   };
 
   outputs =
-    { self
-    , nixpkgs
-    , sops-nix
-    , nvfetcher
-    , deploy-rs
-    , ...
-    } @ inputs:
+    {
+      self,
+      nixpkgs,
+      sops-nix,
+      nvfetcher,
+      deploy-rs,
+      ...
+    }@inputs:
     let
       system = "x86_64-linux";
       pkgs = nixpkgs.legacyPackages.${system};
@@ -84,7 +85,12 @@
           };
 
           sshUser = "tlater";
-          sshOpts = [ "-p" "2222" "-o" "ForwardAgent=yes" ];
+          sshOpts = [
+            "-p"
+            "2222"
+            "-o"
+            "ForwardAgent=yes"
+          ];
         };
       };
 
@@ -144,10 +150,11 @@
       # Development environment #
       ###########################
       devShells.${system}.default = nixpkgs.legacyPackages.${system}.mkShell {
-        sopsPGPKeyDirs = [ "./keys/hosts/" "./keys/users/" ];
-        nativeBuildInputs = [
-          sops-nix.packages.${system}.sops-import-keys-hook
+        sopsPGPKeyDirs = [
+          "./keys/hosts/"
+          "./keys/users/"
         ];
+        nativeBuildInputs = [ sops-nix.packages.${system}.sops-import-keys-hook ];
 
         packages = with pkgs; [
           sops-nix.packages.${system}.sops-init-gpg-key

modules/default.nix

@@ -1,5 +1 @@
-{
-  imports = [
-    ./nginxExtensions.nix
-  ];
-}
+{ imports = [ ./nginxExtensions.nix ]; }

modules/nginxExtensions.nix

@@ -1,8 +1,10 @@
-{ config
-, pkgs
-, lib
-, ...
-}: {
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
   options = {
     services.nginx.domain = lib.mkOption {
       type = lib.types.str;
@@ -12,10 +14,8 @@
     services.nginx.virtualHosts =
       let
         extraVirtualHostOptions =
-          { name
-          , config
-          , ...
-          }: {
+          { name, config, ... }:
+          {
             options = {
               enableHSTS = lib.mkEnableOption "Enable HSTS";
 
@@ -40,9 +40,7 @@
             };
           };
       in
-      lib.mkOption {
-        type = lib.types.attrsOf (lib.types.submodule extraVirtualHostOptions);
-      };
+      lib.mkOption { type = lib.types.attrsOf (lib.types.submodule extraVirtualHostOptions); };
   };
 
   config = {
@@ -51,11 +49,11 @@
       let
         confirm = ''[[ "tlater.net" = ${config.services.nginx.domain} ]]'';
       in
-      lib.mapAttrs'
-        (cert: _:
+      lib.mapAttrs' (
+        cert: _:
         lib.nameValuePair "acme-${cert}" {
           serviceConfig.ExecCondition = ''${pkgs.runtimeShell} -c '${confirm}' '';
-          })
-        config.security.acme.certs;
+        }
+      ) config.security.acme.certs;
   };
 }

pkgs/afvalcalendar/default.nix

@@ -1,19 +1,12 @@
-{ pkgs
-, rustPlatform
-, ...
-}:
+{ pkgs, rustPlatform, ... }:
 rustPlatform.buildRustPackage {
   pname = "afvalcalendar";
   version = "0.1.0";
   src = ./.;
 
-  nativeBuildInputs = with pkgs; [
-    pkg-config
-  ];
+  nativeBuildInputs = with pkgs; [ pkg-config ];
 
-  buildInputs = with pkgs; [
-    openssl
-  ];
+  buildInputs = with pkgs; [ openssl ];
 
   cargoHash = "sha256-JXx6aUKdKbUTBCwlBw5i1hZy8ofCfSrhLCwFzqdA8cI=";
 }

pkgs/default.nix

@@ -1,7 +1,4 @@
-{ pkgs
-, lib
-,
-}:
+{ pkgs, lib }:
 let
   inherit (builtins) fromJSON mapAttrs readFile;
   inherit (pkgs) callPackage;
@@ -13,7 +10,7 @@ in
   };
   afvalcalendar = callPackage ./afvalcalendar { };
 }
-  // (
+// (
   # Add nextcloud apps
   let
     mkNextcloudApp = pkgs.callPackage ./mkNextcloudApp.nix { };

pkgs/mkNextcloudApp.nix

@@ -1,7 +1,5 @@
-{ fetchNextcloudApp
-, lib
-,
-}: source:
+{ fetchNextcloudApp, lib }:
+source:
 fetchNextcloudApp {
   url = source.src.url;
   sha256 = source.src.sha256;

pkgs/prometheus/fail2ban-exporter.nix

@@ -1,7 +1,4 @@
-{ buildGoModule
-, sources
-,
-}:
+{ buildGoModule, sources }:
 buildGoModule {
   inherit (sources.prometheus-fail2ban-exporter) pname src version;
   vendorHash = "sha256-5o8p5p0U/c0WAIV5dACnWA3ThzSh2tt5LIFMb59i9GY=";

pkgs/starbound/default.nix

@@ -1,19 +1,21 @@
-{ stdenv
-, lib
-, makeWrapper
-, patchelf
-, steamPackages
-, replace-secret
-,
+{
+  stdenv,
+  lib,
+  makeWrapper,
+  patchelf,
+  steamPackages,
+  replace-secret,
 }:
 let
   # Use the directory in which starbound is installed so steamcmd
   # doesn't have to be reinstalled constantly (we're using DynamicUser
   # with StateDirectory to persist this).
-  steamcmd = steamPackages.steamcmd.override {
-    steamRoot = "/var/lib/starbound/.steamcmd";
-  };
-  wrapperPath = lib.makeBinPath [ patchelf steamcmd replace-secret ];
+  steamcmd = steamPackages.steamcmd.override { steamRoot = "/var/lib/starbound/.steamcmd"; };
+  wrapperPath = lib.makeBinPath [
+    patchelf
+    steamcmd
+    replace-secret
+  ];
 in
 stdenv.mkDerivation {
   name = "starbound-update-script";