style(treewide): Switch to nixfmt

nix/module.nix

@@ -1,18 +1,14 @@
-{
-  self,
-  system,
-}: {
-  config,
-  lib,
-  ...
-}: let
+{ self, system }:
+{ config, lib, ... }:
+let
   inherit (lib) mkEnableOption mkIf mkOption;
   inherit (lib.types) str int;
   inherit (lib.strings) escapeShellArgs;
   inherit (self.packages.${system}) server templates;
 
   cfg = config.services.tlaternet-webserver;
-in {
+in
+{
   options = {
     services.tlaternet-webserver = {
       enable = mkEnableOption "tlaternet web server";
@@ -35,8 +31,8 @@ in {
   config = mkIf cfg.enable {
     systemd.services.tlaternet-webserver = {
       description = "tlaternet webserver";
-      wantedBy = ["multi-user.target"];
-      after = ["network.target"];
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
 
       script = escapeShellArgs [
         "${server}/bin/tlaternet-webserver"
@@ -60,14 +56,21 @@ in {
         ProtectKernelModules = true;
         ProtectKernelLogs = true;
         ProtectControlGroups = true;
-        RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"];
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
         RestrictNamespaces = true;
         LockPersonality = true;
         MemoryDenyWriteExecute = true;
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         SystemCallArchitectures = "native";
-        SystemCallFilter = ["@system-service" "~@privileged @resources @setuid @keyring"];
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged @resources @setuid @keyring"
+        ];
       };
     };
   };