feat: introduce treefmt and fmt all

.gitignore

@@ -4,3 +4,6 @@
 .env
 **/result
 .direnv/
+
+# nixago: ignore-linked-files
+/treefmt.toml

.vscode/settings.json

@@ -1,4 +1,9 @@
 {
+    "editor.defaultFormatter": "ibecker.treefmt-vscode",
+    "treefmt.command": "treefmt",
+    "editor.formatOnSave": true,
+    "nix.enableLanguageServer": true,
+    "nix.serverPath": "nil",
     "nix.serverSettings": {
         // settings for 'nil' LSP
         "nil": {
@@ -9,11 +14,14 @@
                     "unused_with"
                 ]
             },
-            "formatting": {
+            // TODO: this doesn't work because treefmt-nix wants the output path as an argument
-                "command": [
+            // "formatting": {
-                    "alejandra",
+            //     "command": [
-                ]
+            //         "treefmt-nix",
-            }
+            //         "--stdin",
+            //         "/dev/stdout"
+            //     ]
+            // }
         }
     },
 }

default.nix

@@ -4,6 +4,9 @@
 # Having pkgs default to <nixpkgs> is fine though, and it lets you use short
 # commands such as:
 #     nix-build -A mypackage
-{pkgs ? import <nixpkgs> {}}: {
+{
-  pkgs = import ./nix/pkgs {inherit pkgs;};
+  pkgs ? import <nixpkgs> { },
+}:
+{
+  pkgs = import ./nix/pkgs { inherit pkgs; };
 }

flake.lock

@@ -346,6 +346,81 @@
       }
     },
     "flake-utils_3": {
+      "locked": {
+        "lastModified": 1653893745,
+        "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_4": {
+      "locked": {
+        "lastModified": 1653893745,
+        "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_5": {
+      "locked": {
+        "lastModified": 1653893745,
+        "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_6": {
+      "locked": {
+        "lastModified": 1653893745,
+        "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_7": {
+      "locked": {
+        "lastModified": 1653893745,
+        "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_8": {
       "inputs": {
         "systems": "systems_3"
       },
@@ -363,7 +438,7 @@
         "type": "github"
       }
     },
-    "flake-utils_4": {
+    "flake-utils_9": {
       "inputs": {
         "systems": "systems_4"
       },
@@ -485,7 +560,7 @@
     },
     "lib-aggregate": {
       "inputs": {
-        "flake-utils": "flake-utils_3",
+        "flake-utils": "flake-utils_8",
         "nixpkgs-lib": "nixpkgs-lib_2"
       },
       "locked": {
@@ -639,6 +714,126 @@
         "type": "github"
       }
     },
+    "nixago": {
+      "inputs": {
+        "flake-utils": "flake-utils_3",
+        "nixago-exts": "nixago-exts",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1714086354,
+        "narHash": "sha256-yKVQMxL9p7zCWUhnGhDzRVT8sDgHoI3V595lBK0C2YA=",
+        "owner": "jmgilman",
+        "repo": "nixago",
+        "rev": "5133633e9fe6b144c8e00e3b212cdbd5a173b63d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "jmgilman",
+        "repo": "nixago",
+        "type": "github"
+      }
+    },
+    "nixago-exts": {
+      "inputs": {
+        "flake-utils": "flake-utils_4",
+        "nixago": "nixago_2",
+        "nixpkgs": [
+          "nixago",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1676070308,
+        "narHash": "sha256-QaJ65oc2l8iwQIGWUJ0EKjCeSuuCM/LqR8RauxZUUkc=",
+        "owner": "nix-community",
+        "repo": "nixago-extensions",
+        "rev": "e5380cb0456f4ea3c86cf94e3039eb856bf07d0b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixago-extensions",
+        "type": "github"
+      }
+    },
+    "nixago-exts_2": {
+      "inputs": {
+        "flake-utils": "flake-utils_6",
+        "nixago": "nixago_3",
+        "nixpkgs": [
+          "nixago",
+          "nixago-exts",
+          "nixago",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1655508669,
+        "narHash": "sha256-BDDdo5dZQMmwNH/GNacy33nPBnCpSIydWFPZs0kkj/g=",
+        "owner": "nix-community",
+        "repo": "nixago-extensions",
+        "rev": "3022a932ce109258482ecc6568c163e8d0b426aa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixago-extensions",
+        "type": "github"
+      }
+    },
+    "nixago_2": {
+      "inputs": {
+        "flake-utils": "flake-utils_5",
+        "nixago-exts": "nixago-exts_2",
+        "nixpkgs": [
+          "nixago",
+          "nixago-exts",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1676070010,
+        "narHash": "sha256-iYzJIWptE1EUD8VINAg66AAMUajizg8JUYN3oBmb8no=",
+        "owner": "nix-community",
+        "repo": "nixago",
+        "rev": "d480ba6c0c16e2c5c0bd2122852d6a0c9ad1ed0e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "rename-config-data",
+        "repo": "nixago",
+        "type": "github"
+      }
+    },
+    "nixago_3": {
+      "inputs": {
+        "flake-utils": "flake-utils_7",
+        "nixpkgs": [
+          "nixago",
+          "nixago-exts",
+          "nixago",
+          "nixago-exts",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1655405483,
+        "narHash": "sha256-Crd49aZWNrpczlRTOwWGfwBMsTUoG9vlHDKQC7cx264=",
+        "owner": "nix-community",
+        "repo": "nixago",
+        "rev": "e6a9566c18063db5b120e69e048d3627414e327d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixago",
+        "type": "github"
+      }
+    },
     "nixos-anywhere": {
       "inputs": {
         "disko": "disko",
@@ -1058,6 +1253,7 @@
         "logseq_0_10_9_aarch64_appimage": "logseq_0_10_9_aarch64_appimage",
         "nix-vscode-extensions": "nix-vscode-extensions",
         "nix4vscode": "nix4vscode",
+        "nixago": "nixago",
         "nixos-anywhere": "nixos-anywhere",
         "nixpkgs": [
           "nixpkgs-2405"
@@ -1080,6 +1276,7 @@
         "rperf": "rperf",
         "sops-nix": "sops-nix",
         "srvos": "srvos",
+        "treefmt-nix": "treefmt-nix_4",
         "x13s-bt-firmware": "x13s-bt-firmware",
         "yofi": "yofi"
       }
@@ -1316,6 +1513,26 @@
         "type": "github"
       }
     },
+    "treefmt-nix_4": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1730321837,
+        "narHash": "sha256-vK+a09qq19QNu2MlLcvN4qcRctJbqWkX7ahgPZ/+maI=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "746901bb8dba96d154b66492a29f5db0693dbfcc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
     "x13s-bt-firmware": {
       "flake": false,
       "locked": {
@@ -1330,7 +1547,7 @@
     },
     "yofi": {
       "inputs": {
-        "flake-utils": "flake-utils_4",
+        "flake-utils": "flake-utils_9",
         "nixpkgs": [
           "nixpkgs"
         ]

flake.nix

@@ -125,218 +125,246 @@
       url = "github:nix-community/nixvim/nixos-24.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    treefmt-nix = {
+      url = "github:numtide/treefmt-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    nixago.url = "github:jmgilman/nixago";
+    nixago.inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs = inputs @ {
+  outputs =
-    self,
+    inputs@{
-    flake-parts,
+      self,
-    nixpkgs,
+      flake-parts,
-    ...
+      nixpkgs,
-  }: let
+      ...
-    inherit (nixpkgs) lib;
+    }:
+    let
+      inherit (nixpkgs) lib;
 
-    systems = [
+      systems = [
-      "x86_64-linux"
+        "x86_64-linux"
-      "aarch64-linux"
+        "aarch64-linux"
-    ];
+      ];
-  in
+    in
-    flake-parts.lib.mkFlake {inherit inputs;}
+    flake-parts.lib.mkFlake { inherit inputs; } (
-    ({withSystem, ...}: {
+      { withSystem, ... }:
-      flake.colmena =
+      {
-        lib.lists.foldl (sum: cur: lib.attrsets.recursiveUpdate sum cur)
+        flake.colmena =
-        {
+          lib.lists.foldl (sum: cur: lib.attrsets.recursiveUpdate sum cur)
-          meta.nixpkgs = import inputs.nixpkgs.outPath {
+            { meta.nixpkgs = import inputs.nixpkgs.outPath { system = builtins.elemAt systems 0; }; }
-            system = builtins.elemAt systems 0;
+            # FIXME: this doesn't seem to work to apply overlays into a node's nixpkgs import
-          };
+            # try this instead: https://github.com/zhaofengli/colmena/issues/60#issuecomment-1510496861
-        }
-        # FIXME: this doesn't seem to work to apply overlays into a node's nixpkgs import
-        # try this instead: https://github.com/zhaofengli/colmena/issues/60#issuecomment-1510496861
-        (builtins.map
-          (nodeName:
-            import ./nix/os/devices/${nodeName} {
-              inherit nodeName;
-              repoFlake = self;
-              repoFlakeWithSystem = withSystem;
-              nodeFlake = self.inputs.get-flake ./nix/os/devices/${nodeName};
-            }) [
-            "steveej-t14"
-            "steveej-x13s"
-            "steveej-x13s-rmvbl"
-            # "elias-e525"
-            # "justyna-p300"
-
-            # "srv0-dmz0"
-            # "router0-dmz0"
-            "router0-ifog"
-            "router0-hosthatch"
-
-            "sj-srv1"
-
-            "hstk0"
-          ]);
-
-      flake.lib = {
-        inherit withSystem;
-      };
-
-      # this makes nixos-anywhere work
-      flake.nixosConfigurations = let
-        colmenaHive = (inputs.colmena.lib.makeHive self.outputs.colmena).nodes;
-        router0-dmz0 = (inputs.get-flake ./nix/os/devices/router0-dmz0).nixosConfigurations;
-      in (
-        colmenaHive
-        // {
-          router0-dmz0 = router0-dmz0.native;
-
-          # for now deploy directly with:
-          # nixos-rebuild switch --flake .\#router0-dmz0_cross --build-host localhost --target-host root@192.168.10.1
-          router0-dmz0_cross = router0-dmz0.cross;
-
-          steveej-x13s_cross = (inputs.get-flake ./nix/os/devices/steveej-x13s).nixosConfigurations.cross;
-          steveej-x13s-rmvbl_cross = (inputs.get-flake ./nix/os/devices/steveej-x13s-rmvbl).nixosConfigurations.cross;
-        }
-      );
-
-      inherit systems;
-
-      perSystem = {
-        self',
-        inputs',
-        system,
-        config,
-        lib,
-        pkgs,
-        ...
-      }: {
-        imports = [
-          ./nix/modules/flake-parts/perSystem/default.nix
-        ];
-
-        packages = let
-          dcpj4110dw = pkgs.callPackage (self + /nix/pkgs/dcpj4110dw) {};
-
-          craneLibFn = (inputs.crane.mkLib inputs.nixpkgs.legacyPackages.${system}).overrideToolchain;
-
-          craneLib =
-            craneLibFn
-            inputs'.fenix.packages.stable.toolchain;
-
-          craneLibOfiPass =
-            craneLibFn
             (
-              inputs'.fenix.packages.stable.toolchain
+              builtins.map
-              # .override {
+                (
-              #   date = "1.60.0";
+                  nodeName:
-              # }
+                  import ./nix/os/devices/${nodeName} {
+                    inherit nodeName;
+                    repoFlake = self;
+                    repoFlakeWithSystem = withSystem;
+                    nodeFlake = self.inputs.get-flake ./nix/os/devices/${nodeName};
+                  }
+                )
+                [
+                  "steveej-t14"
+                  "steveej-x13s"
+                  "steveej-x13s-rmvbl"
+                  # "elias-e525"
+                  # "justyna-p300"
+
+                  # "srv0-dmz0"
+                  # "router0-dmz0"
+                  "router0-ifog"
+                  "router0-hosthatch"
+
+                  "sj-srv1"
+
+                  "hstk0"
+                ]
             );
-        in {
-          dcpj4110dwDriver = dcpj4110dw.driver;
-          dcpj4110dwCupswrapper = dcpj4110dw.cupswrapper;
 
-          inherit (inputs'.colmena.packages) colmena;
+        flake.lib = {
+          inherit withSystem;
 
-          prs =
+          treefmtEval =
-            pkgs.callPackage
+            pkgs:
-            ({
+            let
-              pkgs,
+              settingsNix = {
-              dbus,
+                # Used to find the project root
-              glib,
+                projectRootFile = ".git/config";
-              gpgme,
+                programs.nixfmt.enable = true;
-              gtk3,
+              };
-              libxcb,
+            in
-              libxkbcommon,
+            inputs.treefmt-nix.lib.evalModule pkgs settingsNix;
-              installShellFiles,
-              pkg-config,
-              python3,
-            }:
-              craneLib.buildPackage {
-                pname = "prs";
-                version = inputs.prs.shortRev;
-                src = inputs.prs;
-                nativeBuildInputs = [gpgme installShellFiles pkg-config python3];
 
-                buildInputs = [
+          treefmtSettings = pkgs: (self.lib.treefmtEval pkgs).config.settings;
-                  dbus
-                  glib
-                  gpgme
-                  gtk3
-                  libxcb
-                  libxkbcommon
-                ];
-
-                cargoExtraArgs = "--features backend-gpgme";
-
-                postInstall = ''
-                  for shell in bash fish zsh; do
-                    installShellCompletion --cmd prs --$shell <($out/bin/prs internal completions $shell --stdout)
-                  done
-                '';
-              })
-            {};
-
-          nomad = inputs'.nixpkgs-unstable.legacyPackages.nomad_1_6;
-
-          ledger-live-desktop-wrapped = pkgs.writeShellScriptBin "ledger-live-desktop-wrapped" ''
-            set -x
-            pkill -9 wayland-proxy-v
-            export NIXOS_OZONE_WL=""
-            ${pkgs.wayland-proxy-virtwl}/bin/wayland-proxy-virtwl \
-              --wayland-display=wayland-3 \
-              --xwayland-binary=${pkgs.xwayland}/bin/Xwayland \
-              --x-display=3 \
-              &
-              # --x-unscale=3 \
-              #--verbose \
-
-            export PROXYPID="$!"
-
-            trap "kill -9 \$PROXYPID" EXIT
-            # trap "pkill -9 wayland-proxy-v" EXIT
-
-            env \
-                WAYLAND_DISPLAY=wayland-3 \
-                DISPLAY=:3 \
-              ledger-live-desktop
-          '';
-
-          syncthing-container-webui = pkgs.writeShellScriptBin "reverse-port-forward-syncthing-container" ''
-            ssh root@${self.colmena.sj-vps-htz0.deployment.targetHost} -L 8385:syncthing.containers:8384
-          '';
-
-          rperf = craneLib.buildPackage {
-            src = inputs.rperf;
-            nativeBuildInputs = [
-              pkgs.pkg-config
-            ];
-            buildInputs = [
-            ];
-          };
-
-          x13s-bt-firmware = pkgs.runCommand "x13s-bt-firmware" {} ''
-            mkdir -p $out/lib/firmware/qca
-            cp -v ${self}/misc/x13s_bt_firmware/hpnv21g.b8c.crypt.fw $out/lib/firmware/qca/hpnv21.bin
-            cp -v ${inputs.x13s-bt-firmware} $out/lib/firmware/qca//hpbtfw21.tlv
-          '';
-
-          x13s-ath11k-firmware = pkgs.runCommand "x13s-ath11k-firmware-before" {} ''
-            mkdir -p $out/lib/firmware/ath11k/WCN6855/hw2.1/
-            cp -v ${inputs.ath11k-firmware}/WCN6855/hw2.1/{board-2,regdb}.bin $out/lib/firmware/ath11k/WCN6855/hw2.1/
-            cp -v ${inputs.ath11k-firmware}/WCN6855/hw2.1/1.1/WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41/{amss,m3}.bin $out/lib/firmware/ath11k/WCN6855/hw2.1/
-          '';
         };
 
-        formatter = pkgs.alejandra;
+        # this makes nixos-anywhere work
+        flake.nixosConfigurations =
+          let
+            colmenaHive = (inputs.colmena.lib.makeHive self.outputs.colmena).nodes;
+            router0-dmz0 = (inputs.get-flake ./nix/os/devices/router0-dmz0).nixosConfigurations;
+          in
+          (
+            colmenaHive
+            // {
+              router0-dmz0 = router0-dmz0.native;
 
-        devShells = let
+              # for now deploy directly with:
-          all = import ./nix/devShells.nix {
+              # nixos-rebuild switch --flake .\#router0-dmz0_cross --build-host localhost --target-host root@192.168.10.1
-            inherit
+              router0-dmz0_cross = router0-dmz0.cross;
-              self
+
-              self'
+              steveej-x13s_cross = (inputs.get-flake ./nix/os/devices/steveej-x13s).nixosConfigurations.cross;
-              inputs'
+              steveej-x13s-rmvbl_cross =
-              pkgs
+                (inputs.get-flake ./nix/os/devices/steveej-x13s-rmvbl).nixosConfigurations.cross;
-              ;
+            }
+          );
+
+        inherit systems;
+
+        perSystem =
+          {
+            self',
+            inputs',
+            system,
+            config,
+            lib,
+            pkgs,
+            ...
+          }:
+          {
+            imports = [ ./nix/modules/flake-parts/perSystem/default.nix ];
+
+            packages =
+              let
+                dcpj4110dw = pkgs.callPackage (self + /nix/pkgs/dcpj4110dw) { };
+
+                craneLibFn = (inputs.crane.mkLib inputs.nixpkgs.legacyPackages.${system}).overrideToolchain;
+
+                craneLib = craneLibFn inputs'.fenix.packages.stable.toolchain;
+
+                craneLibOfiPass = craneLibFn (
+                  inputs'.fenix.packages.stable.toolchain
+                  # .override {
+                  #   date = "1.60.0";
+                  # }
+                );
+              in
+              {
+                dcpj4110dwDriver = dcpj4110dw.driver;
+                dcpj4110dwCupswrapper = dcpj4110dw.cupswrapper;
+
+                inherit (inputs'.colmena.packages) colmena;
+
+                prs = pkgs.callPackage (
+                  {
+                    pkgs,
+                    dbus,
+                    glib,
+                    gpgme,
+                    gtk3,
+                    libxcb,
+                    libxkbcommon,
+                    installShellFiles,
+                    pkg-config,
+                    python3,
+                  }:
+                  craneLib.buildPackage {
+                    pname = "prs";
+                    version = inputs.prs.shortRev;
+                    src = inputs.prs;
+                    nativeBuildInputs = [
+                      gpgme
+                      installShellFiles
+                      pkg-config
+                      python3
+                    ];
+
+                    buildInputs = [
+                      dbus
+                      glib
+                      gpgme
+                      gtk3
+                      libxcb
+                      libxkbcommon
+                    ];
+
+                    cargoExtraArgs = "--features backend-gpgme";
+
+                    postInstall = ''
+                      for shell in bash fish zsh; do
+                        installShellCompletion --cmd prs --$shell <($out/bin/prs internal completions $shell --stdout)
+                      done
+                    '';
+                  }
+                ) { };
+
+                nomad = inputs'.nixpkgs-unstable.legacyPackages.nomad_1_6;
+
+                ledger-live-desktop-wrapped = pkgs.writeShellScriptBin "ledger-live-desktop-wrapped" ''
+                  set -x
+                  pkill -9 wayland-proxy-v
+                  export NIXOS_OZONE_WL=""
+                  ${pkgs.wayland-proxy-virtwl}/bin/wayland-proxy-virtwl \
+                    --wayland-display=wayland-3 \
+                    --xwayland-binary=${pkgs.xwayland}/bin/Xwayland \
+                    --x-display=3 \
+                    &
+                    # --x-unscale=3 \
+                    #--verbose \
+
+                  export PROXYPID="$!"
+
+                  trap "kill -9 \$PROXYPID" EXIT
+                  # trap "pkill -9 wayland-proxy-v" EXIT
+
+                  env \
+                      WAYLAND_DISPLAY=wayland-3 \
+                      DISPLAY=:3 \
+                    ledger-live-desktop
+                '';
+
+                syncthing-container-webui = pkgs.writeShellScriptBin "reverse-port-forward-syncthing-container" ''
+                  ssh root@${self.colmena.sj-vps-htz0.deployment.targetHost} -L 8385:syncthing.containers:8384
+                '';
+
+                rperf = craneLib.buildPackage {
+                  src = inputs.rperf;
+                  nativeBuildInputs = [ pkgs.pkg-config ];
+                  buildInputs = [ ];
+                };
+
+                x13s-bt-firmware = pkgs.runCommand "x13s-bt-firmware" { } ''
+                  mkdir -p $out/lib/firmware/qca
+                  cp -v ${self}/misc/x13s_bt_firmware/hpnv21g.b8c.crypt.fw $out/lib/firmware/qca/hpnv21.bin
+                  cp -v ${inputs.x13s-bt-firmware} $out/lib/firmware/qca//hpbtfw21.tlv
+                '';
+
+                x13s-ath11k-firmware = pkgs.runCommand "x13s-ath11k-firmware-before" { } ''
+                  mkdir -p $out/lib/firmware/ath11k/WCN6855/hw2.1/
+                  cp -v ${inputs.ath11k-firmware}/WCN6855/hw2.1/{board-2,regdb}.bin $out/lib/firmware/ath11k/WCN6855/hw2.1/
+                  cp -v ${inputs.ath11k-firmware}/WCN6855/hw2.1/1.1/WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41/{amss,m3}.bin $out/lib/firmware/ath11k/WCN6855/hw2.1/
+                '';
+              };
+
+            formatter = (self.lib.treefmtEval pkgs).config.build.wrapper;
+
+            devShells =
+              let
+                all = import ./nix/devShells.nix {
+                  inherit
+                    self
+                    self'
+                    inputs'
+                    pkgs
+                    ;
+                };
+              in
+              (all // { default = all.develop; });
           };
-        in (all // {default = all.develop;});
+      }
-      };
+    );
-    });
 }

nix/container-images/default.nix

@@ -1,6 +1,10 @@
-{pkgs ? import <nixpkgs> {}}: let
+{
-  baseEnv = ["SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"];
+  pkgs ? import <nixpkgs> { },
-in rec {
+}:
+let
+  baseEnv = [ "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" ];
+in
+rec {
   base = pkgs.dockerTools.buildImage rec {
     name = "base";
 
@@ -21,59 +25,70 @@ in rec {
   interactive_base = pkgs.dockerTools.buildImage {
     name = "interactive_base";
     fromImage = base;
-    contents = with pkgs; [procps zsh coreutils neovim];
+    contents = with pkgs; [
+      procps
+      zsh
+      coreutils
+      neovim
+    ];
 
-    config = {Cmd = ["/bin/zsh"];};
+    config = {
+      Cmd = [ "/bin/zsh" ];
+    };
   };
 
-  s3ql = let
+  s3ql =
-    entrypoint = pkgs.writeScript "entrypoint" ''
+    let
-      #!${pkgs.stdenv.shell}
+      entrypoint = pkgs.writeScript "entrypoint" ''
+        #!${pkgs.stdenv.shell}
 
-      if [ -z "$S3QL_BUCKET" ]; then
+        if [ -z "$S3QL_BUCKET" ]; then
-        echo S3QL_BUCKET not set
+          echo S3QL_BUCKET not set
-        exit 1
+          exit 1
-      fi
+        fi
 
-      if [ -z "$S3QL_STORAGE_URL" ]; then
+        if [ -z "$S3QL_STORAGE_URL" ]; then
-        echo S3QL_STORAGE_URL not set
+          echo S3QL_STORAGE_URL not set
-        exit 1
+          exit 1
-      fi
+        fi
 
-      if [ -z "$S3QL_CACHESIZE" ]; then
+        if [ -z "$S3QL_CACHESIZE" ]; then
-        echo S3QL_CACHESIZE not set
+          echo S3QL_CACHESIZE not set
-        exit 1
+          exit 1
-      fi
+        fi
 
-      set -x
+        set -x
 
-      if [ "$S3QL_SKIP_FSCK" != "1" ]; then
+        if [ "$S3QL_SKIP_FSCK" != "1" ]; then
-        fsck.s3ql \
+          fsck.s3ql \
-          --authfile $S3QL_AUTHINFO2 \
+            --authfile $S3QL_AUTHINFO2 \
+            --log none \
+            --cachedir $S3QL_CACHE_DIR \
+            $S3QL_STORAGE_URL
+        fi
+
+        exec mount.s3ql \
+          --cachedir "$S3QL_CACHE_DIR" \
+          --authfile "$S3QL_AUTHINFO2" \
+          --cachesize "$S3QL_CACHESIZE" \
+          --fg \
+          --compress lzma-6 \
+          --threads 4 \
           --log none \
-          --cachedir $S3QL_CACHE_DIR \
+          --allow-root \
-          $S3QL_STORAGE_URL
+          "$S3QL_STORAGE_URL" \
-      fi
+          /bucket
 
-      exec mount.s3ql \
+        # FIXME: touch .isbucket after mount
-        --cachedir "$S3QL_CACHE_DIR" \
+      '';
-        --authfile "$S3QL_AUTHINFO2" \
+    in
-        --cachesize "$S3QL_CACHESIZE" \
-        --fg \
-        --compress lzma-6 \
-        --threads 4 \
-        --log none \
-        --allow-root \
-        "$S3QL_STORAGE_URL" \
-        /bucket
-
-      # FIXME: touch .isbucket after mount
-    '';
-  in
     pkgs.dockerTools.buildImage {
       name = "s3ql";
       fromImage = interactive_base;
-      contents = [pkgs.s3ql pkgs.fuse];
+      contents = [
+        pkgs.s3ql
+        pkgs.fuse
+      ];
 
       runAsRoot = ''
         #!${pkgs.stdenv.shell}
@@ -84,57 +99,58 @@ in rec {
       '';
 
       config = {
-        Env =
+        Env = baseEnv ++ [
-          baseEnv
+          "HOME=/home/s3ql"
-          ++ [
+          "S3QL_CACHE_DIR=/var/cache/s3ql"
-            "HOME=/home/s3ql"
+          "S3QL_AUTHINFO2=/etc/s3ql/authinfo2"
-            "S3QL_CACHE_DIR=/var/cache/s3ql"
+          "CONTAINER_ENTRYPOINT=${entrypoint}"
-            "S3QL_AUTHINFO2=/etc/s3ql/authinfo2"
+        ];
-            "CONTAINER_ENTRYPOINT=${entrypoint}"
+        Cmd = [ entrypoint ];
-          ];
-        Cmd = [entrypoint];
         Volumes = {
-          "/var/cache/s3ql" = {};
+          "/var/cache/s3ql" = { };
-          "/etc/s3ql/authinfo2" = {};
+          "/etc/s3ql/authinfo2" = { };
-          "/buckets" = {};
+          "/buckets" = { };
-          "/tmp" = {};
+          "/tmp" = { };
         };
       };
     };
 
-  syncthing = let
+  syncthing =
-    entrypoint = pkgs.writeScript "entrypoint" ''
+    let
-      #!${pkgs.stdenv.shell}
+      entrypoint = pkgs.writeScript "entrypoint" ''
-      set -x
+        #!${pkgs.stdenv.shell}
-      if [ ! -e /data/.isbucket ]; then
+        set -x
-        echo ERROR: Bucket not mounted at /data
+        if [ ! -e /data/.isbucket ]; then
-        exit 1
+          echo ERROR: Bucket not mounted at /data
-      fi
+          exit 1
+        fi
 
-      if [ -z "$SYNCTHING_GUI_ADDRESS" ]; then
+        if [ -z "$SYNCTHING_GUI_ADDRESS" ]; then
-        echo ERROR: SYNCTHING_GUI_ADDRESS is not set
+          echo ERROR: SYNCTHING_GUI_ADDRESS is not set
-        exit 1
+          exit 1
-      fi
+        fi
 
-      if [ ! -w "$SYNCTHING_HOME" ]; then
+        if [ ! -w "$SYNCTHING_HOME" ]; then
-        echo ERROR : SYNCTHING_HOME is not writable
+          echo ERROR : SYNCTHING_HOME is not writable
-      fi
+        fi
 
-      exec syncthing \
+        exec syncthing \
-        -home $SYNCTHING_HOME \
+          -home $SYNCTHING_HOME \
-        -gui-address=$SYNCTHING_GUI_ADDRESS \
+          -gui-address=$SYNCTHING_GUI_ADDRESS \
-        -no-browser
+          -no-browser
-    '';
+      '';
-  in
+    in
     pkgs.dockerTools.buildImage {
       name = "syncthing";
       fromImage = interactive_base;
       contents = pkgs.syncthing;
 
       config = {
-        Env = baseEnv ++ ["SYNCTHING_HOME=/home/syncthing"];
+        Env = baseEnv ++ [ "SYNCTHING_HOME=/home/syncthing" ];
-        Cmd = [entrypoint];
+        Cmd = [ entrypoint ];
-        Volumes = {"/data" = {};};
+        Volumes = {
+          "/data" = { };
+        };
       };
     };
 }

nix/default.nix

@@ -1,26 +1,34 @@
-{versionsPath}: let
+{ versionsPath }:
+let
   channelVersions = import versionsPath;
-  mkChannelSource = name: let
+  mkChannelSource =
-    channelVersion = builtins.getAttr name channelVersions;
+    name:
-  in
+    let
+      channelVersion = builtins.getAttr name channelVersions;
+    in
     builtins.fetchGit {
       # Descriptive name to make the store path easier to identify
       inherit name;
       inherit (channelVersion) url ref rev;
     };
-  nixPath = builtins.concatStringsSep ":" (builtins.map
+  nixPath = builtins.concatStringsSep ":" (
-    (elemName: let
+    builtins.map (
-      elem = builtins.getAttr elemName channelVersions;
+      elemName:
-      elemPath = mkChannelSource elemName;
+      let
-      suffix =
+        elem = builtins.getAttr elemName channelVersions;
-        if builtins.hasAttr "suffix" elem
+        elemPath = mkChannelSource elemName;
-        then elem.suffix
+        suffix = if builtins.hasAttr "suffix" elem then elem.suffix else "";
-        else "";
+      in
-    in
+      builtins.concatStringsSep "=" [
-      builtins.concatStringsSep "=" [elemName elemPath] + suffix)
+        elemName
-    (builtins.attrNames channelVersions));
+        elemPath
-  pkgs = import (mkChannelSource "nixpkgs") {};
+      ]
-in {
+      + suffix
+    ) (builtins.attrNames channelVersions)
+  );
+  pkgs = import (mkChannelSource "nixpkgs") { };
+in
+{
   inherit nixPath;
   channelSources = pkgs.writeText "channels.rc" ''
     export NIX_PATH=${nixPath}

nix/devShells.nix

@@ -3,9 +3,11 @@
   self',
   inputs',
   pkgs,
-}: let
+}:
+let
   pkgsUnstable = inputs'.nixpkgs-unstable.legacyPackages;
-in {
+in
+{
   install = pkgs.mkShell {
     name = "infra-install";
     packages = with pkgs; [
@@ -20,10 +22,9 @@ in {
 
   develop = pkgs.mkShell {
     name = "infra-develop";
-    inputsFrom = [
+    inputsFrom = [ self'.devShells.install ];
-      self'.devShells.install
-    ];
     packages = with pkgs; [
+      pkgs.treefmt
       inputs'.colmena.packages.colmena
       dconf2nix
       inputs'.nixos-anywhere.packages.nixos-anywhere
@@ -91,6 +92,15 @@ in {
     # Set Environment Variables
     RUST_BACKTRACE = 1;
 
-    KANIDM_URL = self.nixosConfigurations.sj-srv1.config.containers.webserver.config.services.kanidm.serverSettings.origin;
+    KANIDM_URL =
+      self.nixosConfigurations.sj-srv1.config.containers.webserver.config.services.kanidm.serverSettings.origin;
+
+    shellHook =
+      (self.inputs.nixago.lib.${pkgs.stdenv.system}.make {
+        data = self.lib.treefmtSettings pkgs;
+        output = "treefmt.toml";
+        format = "toml";
+      }).shellHook;
+
   };
 }

nix/home-manager/configuration/graphical-fullblown.nix

@@ -7,11 +7,13 @@
   repoFlake,
   packages',
   ...
-}: let
+}:
+let
   pkgsUnstable =
     pkgs.pkgsUnstable
-    or (import nodeFlake.inputs.nixpkgs-unstable {inherit (pkgs) system config overlays;});
+      or (import nodeFlake.inputs.nixpkgs-unstable { inherit (pkgs) system config overlays; });
-in {
+in
+{
   imports = [
     ../profiles/common.nix
     # ../profiles/dotfiles.nix
@@ -34,18 +36,18 @@ in {
     ../programs/libreoffice.nix
     ../programs/neovim.nix
     ../programs/vscode
-    {
+    { home.packages = [ pkgsUnstable.markdown-oxide ]; }
-      home.packages = [
-        pkgsUnstable.markdown-oxide
-      ];
-    }
   ];
 
   home.sessionVariables.HM_CONFIG = "graphical-fullblown";
   home.sessionVariables.GOPATH = "$HOME/src/go";
-  home.sessionVariables.PATH = pkgs.lib.concatStringsSep ":" ["$HOME/.local/bin" "$PATH"];
+  home.sessionVariables.PATH = pkgs.lib.concatStringsSep ":" [
+    "$HOME/.local/bin"
+    "$PATH"
+  ];
 
-  nixpkgs.config.allowInsecurePredicate = pkg:
+  nixpkgs.config.allowInsecurePredicate =
+    pkg:
     builtins.elem (lib.getName pkg) [
       "electron-28.3.3"
       "electron-27.3.11"
@@ -68,7 +70,7 @@ in {
   #   ];
 
   home.packages =
-    []
+    [ ]
     ++ (with pkgs; [
       # Authentication
       # cacert
@@ -246,19 +248,15 @@ in {
       # libretro.snes9x2010
       # retroarchFull
 
-      (
+      (pkgs.logseq.overrideAttrs (
-        pkgs.logseq.overrideAttrs (
+        attrs:
-          attrs:
+        lib.attrsets.recursiveUpdate attrs (
-            lib.attrsets.recursiveUpdate
+          lib.attrsets.optionalAttrs pkgs.stdenv.isAarch64 {
-            attrs
+            src = repoFlake.inputs.logseq_0_10_9_aarch64_appimage;
-            (
+            meta.platforms = [ "aarch64-linux" ];
-              lib.attrsets.optionalAttrs pkgs.stdenv.isAarch64 {
+          }
-                src = repoFlake.inputs.logseq_0_10_9_aarch64_appimage;
-                meta.platforms = ["aarch64-linux"];
-              }
-            )
         )
-      )
+      ))
 
       # (
       #   pkgsUnstable.callPackage (repoFlake + "/nix/pkgs/logseq")
@@ -267,8 +265,7 @@ in {
       #   })
       # )
     ])
-    ++ (lib.lists.optionals (!pkgs.stdenv.targetPlatform.isAarch64) [
+    ++ (lib.lists.optionals (!pkgs.stdenv.targetPlatform.isAarch64) [ ])
-      ])
     ++ (lib.lists.optionals (!pkgs.stdenv.targetPlatform.isAarch64) [
       pkgsUnstable.ledger-live-desktop
 

nix/home-manager/configuration/graphical-gnome3.nix

@@ -1,10 +1,7 @@
+{ pkgs, config, ... }:
 {
-  pkgs,
-  config,
-  ...
-}: {
   home.packages =
-    []
+    [ ]
     ++ (with pkgs; [
       gnome.gnome-tweaks
       gnome.gnome-keyring

nix/home-manager/configuration/graphical-removable.nix

@@ -1,8 +1,5 @@
+{ pkgs, config, ... }:
 {
-  pkgs,
-  config,
-  ...
-}: {
   imports = [
     ../profiles/common.nix
     ../profiles/qtile-desktop.nix
@@ -17,7 +14,7 @@
   ];
 
   home.packages =
-    []
+    [ ]
     ++ (with pkgs; [
       # Nix package related tools
       patchelf

nix/home-manager/lib.nix

@@ -1,14 +1,22 @@
-{}: let
+{ }:
-in {
+let
-  mkSimpleTrayService = {execStart}: {
+in
-    Unit = {
+{
-      Description = "";
+  mkSimpleTrayService =
-      After = ["graphical-session-pre.target"];
+    { execStart }:
-      PartOf = ["graphical-session.target"];
+    {
+      Unit = {
+        Description = "";
+        After = [ "graphical-session-pre.target" ];
+        PartOf = [ "graphical-session.target" ];
+      };
+
+      Install = {
+        WantedBy = [ "graphical-session.target" ];
+      };
+
+      Service = {
+        ExecStart = execStart;
+      };
     };
-
-    Install = {WantedBy = ["graphical-session.target"];};
-
-    Service = {ExecStart = execStart;};
-  };
 }

nix/home-manager/profiles/common.nix

@@ -1,8 +1,5 @@
+{ pkgs, lib, ... }:
 {
-  pkgs,
-  lib,
-  ...
-}: {
   home.stateVersion = lib.mkDefault "23.11";
 
   # TODO: re-enable this with the appropriate version?
@@ -15,7 +12,8 @@
     allowUnfree = true;
     allowUnsupportedSystem = true;
 
-    allowInsecurePredicate = pkg:
+    allowInsecurePredicate =
+      pkg:
       builtins.elem (lib.getName pkg) [
         "electron-28.3.3"
         "electron-27.3.11"
@@ -28,7 +26,8 @@
       "electron"
     ];
 
-    allowUnfreePredicate = pkg:
+    allowUnfreePredicate =
+      pkg:
       builtins.elem (lib.getName pkg) [
         "obsidian"
         "vivaldi"
@@ -57,7 +56,7 @@
   programs.fzf.enable = true;
 
   home.packages =
-    []
+    [ ]
     ++ (with pkgs; [
       coreutils
 

nix/home-manager/profiles/dotfiles.nix

@@ -5,21 +5,23 @@
   repoHttps ? "https://gitlab.com/steveeJ/dotfiles.git",
   repoSsh ? "git@gitlab.com:/steveeJ/dotfiles.git",
   ...
-}: let
+}:
+let
   repoBareLocal =
     pkgs.runCommand "fetchbare"
-    {
+      {
-      outputHashMode = "recursive";
+        outputHashMode = "recursive";
-      outputHashAlgo = "sha256";
+        outputHashAlgo = "sha256";
-      outputHash = "0000000000000000000000000000000000000000000000000000";
+        outputHash = "0000000000000000000000000000000000000000000000000000";
-    } ''
+      }
-      (
+      ''
-        set -xe
+        (
-        export GIT_SSL_CAINFO=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
+          set -xe
-        export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
+          export GIT_SSL_CAINFO=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
-        ${pkgs.git}/bin/git clone --mirror ${repoHttps} $out
+          export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
-      )
+          ${pkgs.git}/bin/git clone --mirror ${repoHttps} $out
-    '';
+        )
+      '';
   vcshActivationScript = pkgs.writeScript "activation-script" ''
     export HOST=$(hostname -s)
 
@@ -39,7 +41,8 @@
       set_remotes ${repoHttps} ${repoSsh}
     fi
   '';
-in {
+in
+{
   # TODO: fix the dotfiles
   # home.activation.vcsh = config.lib.dag.entryAfter["linkGeneration"] ''
   #   $DRY_RUN_CMD ${vcshActivationScript}

nix/home-manager/profiles/dotfiles/vcsh.tmpl.nix

@@ -3,38 +3,40 @@
   repoHttps ? "https://gitlab.com/steveeJ/dotfiles.git",
   repoSsh ? "git@gitlab.com:/steveeJ/dotfiles.git",
   ...
-}: let
+}:
+let
   repoBareLocal =
     pkgs.runCommand "fetchbare"
-    {
+      {
-      outputHashMode = "recursive";
+        outputHashMode = "recursive";
-      outputHashAlgo = "sha256";
+        outputHashAlgo = "sha256";
-      outputHash = "0000000000000000000000000000000000000000000000000000";
+        outputHash = "0000000000000000000000000000000000000000000000000000";
-    } ''
+      }
-      (
+      ''
-        set -xe
+        (
-        export GIT_SSL_CAINFO=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
+          set -xe
-        export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
+          export GIT_SSL_CAINFO=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
-        ${pkgs.git}/bin/git clone --mirror ${repoHttps} $out
+          export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
-      )
+          ${pkgs.git}/bin/git clone --mirror ${repoHttps} $out
-    '';
+        )
+      '';
 in
-  pkgs.writeScript "activation-script" ''
+pkgs.writeScript "activation-script" ''
-    export HOST=$(hostname -s)
+  export HOST=$(hostname -s)
 
-    function set_remotes {
+  function set_remotes {
-      ${pkgs.vcsh}/bin/vcsh dotfiles remote set-url origin $1
+    ${pkgs.vcsh}/bin/vcsh dotfiles remote set-url origin $1
-      ${pkgs.vcsh}/bin/vcsh dotfiles remote set-url --push origin $2
+    ${pkgs.vcsh}/bin/vcsh dotfiles remote set-url --push origin $2
-    }
+  }
 
-    if ! test -d $HOME/.config/vcsh/repo.d/dotfiles.git; then
+  if ! test -d $HOME/.config/vcsh/repo.d/dotfiles.git; then
-      echo Cloning dotfiles for $HOST...
+    echo Cloning dotfiles for $HOST...
-      ${pkgs.vcsh}/bin/vcsh clone -b $HOST ${repoBareLocal} dotfiles
+    ${pkgs.vcsh}/bin/vcsh clone -b $HOST ${repoBareLocal} dotfiles
-      set_remotes ${repoHttps} ${repoSsh}
+    set_remotes ${repoHttps} ${repoSsh}
-    else
+  else
-      set_remotes ${repoBareLocal} ${repoSsh}
+    set_remotes ${repoBareLocal} ${repoSsh}
-      echo Updating dotfiles for $HOST...
+    echo Updating dotfiles for $HOST...
-      ${pkgs.vcsh}/bin/vcsh pull $HOST || true
+    ${pkgs.vcsh}/bin/vcsh pull $HOST || true
-      set_remotes ${repoHttps} ${repoSsh}
+    set_remotes ${repoHttps} ${repoSsh}
-    fi
+  fi
-  ''
+''

nix/home-manager/profiles/experimental-desktop.nix

@@ -5,12 +5,12 @@
   nodeFlake,
   packages',
   ...
-}: let
+}:
-  pkgsUnstable = pkgs.callPackage nodeFlake.inputs.nixpkgs-unstable.outPath {};
+let
-in {
+  pkgsUnstable = pkgs.callPackage nodeFlake.inputs.nixpkgs-unstable.outPath { };
-  imports = [
+in
-    ../profiles/wayland-desktop.nix
+{
-  ];
+  imports = [ ../profiles/wayland-desktop.nix ];
 
   home.packages = [
     # experimental WMs

nix/home-manager/profiles/gnome-desktop.nix

@@ -3,11 +3,11 @@
   config,
   lib,
   ...
-}: let
+}:
-in {
+let
-  imports = [
+in
-    ../profiles/wayland-desktop.nix
+{
-  ];
+  imports = [ ../profiles/wayland-desktop.nix ];
 
   services = {
     gnome-keyring.enable = false;
@@ -25,85 +25,83 @@ in {
 
   services.gpg-agent.pinentryPackage = pkgs.pinentry-gnome3;
 
-  dconf.settings = let
+  dconf.settings =
-    manualKeybindings = [
+    let
-      {
+      manualKeybindings = [
-        binding = "Print";
+        {
-        command = "flameshot gui";
+          binding = "Print";
-        name = "flameshot";
+          command = "flameshot gui";
-      }
+          name = "flameshot";
+        }
 
-      {
+        {
-        binding = "<Super>t";
+          binding = "<Super>t";
-        command = "alacritty";
+          command = "alacritty";
-        name = "alacritty";
+          name = "alacritty";
-      }
+        }
-    ];
+      ];
 
-    numWorkspaces = 10;
+      numWorkspaces = 10;
-    customKeybindingBaseName = "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom";
+      customKeybindingBaseName = "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom";
-    customKeybindingsNames =
+      customKeybindingsNames = builtins.genList (i: "/${customKeybindingBaseName}${toString i}/") (
-      builtins.genList (i: "/${customKeybindingBaseName}${toString i}/")
+        (builtins.length manualKeybindings) + numWorkspaces # for sending to the workspace
-      (
-        (builtins.length manualKeybindings)
-        + numWorkspaces # for sending to the workspace
       );
 
-    workspacesKeyBindingsOffset = builtins.length manualKeybindings;
+      workspacesKeyBindingsOffset = builtins.length manualKeybindings;
 
-    # with this we can make use of all number keys [0-9]
+      # with this we can make use of all number keys [0-9]
-    mapToNumber = i:
+      mapToNumber =
-      if i < 10
+        i:
-      then i
+        if i < 10 then
-      else if i == 10
+          i
-      then 0
+        else if i == 10 then
-      else throw "i exceeds 10: ${i}";
+          0
-  in
+        else
+          throw "i exceeds 10: ${i}";
+    in
     {
       "org/gnome/settings-daemon/plugins/media-keys" = {
         custom-keybindings = customKeybindingsNames;
         screenreader = "@as []";
-        screensaver = ["<Alt><Super>l"];
+        screensaver = [ "<Alt><Super>l" ];
       };
 
       # disable the builtin <Super>[1-9] functionality
-      "org/gnome/shell/keybindings" = builtins.listToAttrs ((builtins.genList
+      "org/gnome/shell/keybindings" = builtins.listToAttrs (
-          (i: {
+        (builtins.genList (i: {
-            name = "switch-to-application-${toString (i + 1)}";
+          name = "switch-to-application-${toString (i + 1)}";
-            value = [];
+          value = [ ];
-          })
+        }) numWorkspaces)
-          numWorkspaces)
         ++ [
           {
             name = "toggle-overview";
-            value = [];
+            value = [ ];
           }
-        ]);
+        ]
+      );
 
       # remap it to switching to the workspaces
-      "org/gnome/desktop/wm/keybindings" = builtins.listToAttrs (builtins.genList
+      "org/gnome/desktop/wm/keybindings" = builtins.listToAttrs (
-        (i: {
+        builtins.genList (i: {
           name = "switch-to-workspace-${toString (i + 1)}";
-          value = [
+          value = [ "<Super>${toString (mapToNumber (i + 1))}" ];
-            "<Super>${toString (mapToNumber (i + 1))}"
+        }) numWorkspaces
-          ];
+      );
-        })
-        numWorkspaces);
     }
-    // builtins.listToAttrs (builtins.genList
+    // builtins.listToAttrs (
-      (i: {
+      builtins.genList (i: {
         name = "${customKeybindingBaseName}${toString i}";
         value = builtins.elemAt manualKeybindings i;
-      })
+      }) (builtins.length manualKeybindings)
-      (builtins.length manualKeybindings))
+    )
-    // builtins.listToAttrs (builtins.genList
+    // builtins.listToAttrs (
-      (i: {
+      builtins.genList (i: {
         name = "${customKeybindingBaseName}${toString (workspacesKeyBindingsOffset + i)}";
         value = {
           binding = "<Control><Super>${toString (mapToNumber (i + 1))}";
           command = "wmctrl -r :ACTIVE: -t ${toString i}";
           name = "Send to workspace ${toString (i + 1)}";
         };
-      })
+      }) numWorkspaces
-      numWorkspaces);
+    );
 }

nix/home-manager/profiles/nix-channels.nix

@@ -1,28 +1,24 @@
+{ pkgs, config, ... }:
+let
+in
 {
-  pkgs,
-  config,
-  ...
-}: let
-in {
   home.file.".nix-channels".text = "";
 
-  home.activation.removeExistingNixChannels = config.lib.dag.entryBefore ["checkLinkTargets"] ''
+  home.activation.removeExistingNixChannels = config.lib.dag.entryBefore [ "checkLinkTargets" ] ''
-    $DRY_RUN_CMD ${
+    $DRY_RUN_CMD ${pkgs.writeScript "activation-script" ''
-      pkgs.writeScript "activation-script" ''
+      set -ex
-        set -ex
+      if test -f $HOME/.nix-channels; then
-        if test -f $HOME/.nix-channels; then
+        echo Uninstalling available channels...
-          echo Uninstalling available channels...
+        if test -f $HOME/.nix-channel; then
-          if test -f $HOME/.nix-channel; then
+          while read url channel; do
-            while read url channel; do
+            nix-channel --remove $channel
-              nix-channel --remove $channel
+          done < $HOME/.nix-channel
-            done < $HOME/.nix-channel
-          fi
-          echo Moving existing file away...
-          touch $HOME/.nix-channels.dummy
-          mv --backup=numbered $HOME/.nix-channels.dummy $HOME/.nix-channels
-          rm $HOME/.nix-channels
         fi
-      ''
+        echo Moving existing file away...
-    };
+        touch $HOME/.nix-channels.dummy
+        mv --backup=numbered $HOME/.nix-channels.dummy $HOME/.nix-channels
+        rm $HOME/.nix-channels
+      fi
+    ''};
   '';
 }

nix/home-manager/profiles/qtile-desktop.nix

@@ -1,14 +1,15 @@
-{
+{ pkgs, config, ... }:
-  pkgs,
+let
-  config,
+  inherit (import ../lib.nix { }) mkSimpleTrayService;
-  ...
-}: let
-  inherit (import ../lib.nix {}) mkSimpleTrayService;
 
   audio = pkgs.writeShellScript "audio" ''
     export PATH=${
       with pkgs;
-        lib.makeBinPath [pulseaudio findutils gnugrep]
+      lib.makeBinPath [
+        pulseaudio
+        findutils
+        gnugrep
+      ]
     }:$PATH
 
     export MUTEFILE=''${TEMPDIR:-/tmp}/.qtilemute
@@ -33,7 +34,7 @@
   terminalCommand = "${pkgs.alacritty}/bin/alacritty";
 
   dpmsScript = pkgs.writeShellScript "dpmsScript" ''
-    export PATH=${with pkgs; lib.makeBinPath [xorg.xset]}:$PATH
+    export PATH=${with pkgs; lib.makeBinPath [ xorg.xset ]}:$PATH
 
     set -xe
 
@@ -56,7 +57,7 @@
   '';
 
   screenLockCommand = pkgs.writeShellScript "screenLock" ''
-    export PATH=${with pkgs; lib.makeBinPath [i3lock]}:$PATH
+    export PATH=${with pkgs; lib.makeBinPath [ i3lock ]}:$PATH
 
     revert() {
       ${dpmsScript} default
@@ -251,7 +252,8 @@
     def print_new_window(window):
       print("new window: ", window)
   '';
-in {
+in
+{
   services = {
     gnome-keyring.enable = true;
     blueman-applet.enable = true;

nix/home-manager/profiles/sway-desktop.nix

@@ -1,19 +1,19 @@
 /*
-TODO: create helper scripts for sharing of a screen portion
+  TODO: create helper scripts for sharing of a screen portion
-```
+  ```
 
-# this will create a new output named HEADLESS-<n>. <n> increments by 1 with each invocation even if the output is `unplug`ged.
+  # this will create a new output named HEADLESS-<n>. <n> increments by 1 with each invocation even if the output is `unplug`ged.
-swaymsg create_output
+  swaymsg create_output
 
-# find the name and the workspace number
+  # find the name and the workspace number
-swaymsg -t get_outputs | jq '.[] | select(.name | test("HEADLESS-.*")) | (.name, .current_workspace)'
+  swaymsg -t get_outputs | jq '.[] | select(.name | test("HEADLESS-.*")) | (.name, .current_workspace)'
 
-swaymsg output HEADLESS-1 mode 1920@108060Hz
+  swaymsg output HEADLESS-1 mode 1920@108060Hz
 
-# mirror the headless workspace on the current one
+  # mirror the headless workspace on the current one
-nix run nixpkgs\#wl-mirror -- HEADLESS-1
+  nix run nixpkgs\#wl-mirror -- HEADLESS-1
 
-# shift windows to the workspace and switch the focus to it
+  # shift windows to the workspace and switch the focus to it
 */
 {
   pkgs,
@@ -22,14 +22,16 @@ nix run nixpkgs\#wl-mirror -- HEADLESS-1
   # packages',
   repoFlakeInputs',
   ...
-}: let
+}:
-  inherit (import ../lib.nix {}) mkSimpleTrayService;
+let
+  inherit (import ../lib.nix { }) mkSimpleTrayService;
 
   lockCmd = "${pkgs.swaylock}/bin/swaylock -efF --color '#000000'";
   displayOffCmd = "${pkgs.sway}/bin/swaymsg 'output * power off'";
   displayOnCmd = "${pkgs.sway}/bin/swaymsg 'output * power on'";
   swapOutputWorkspaces = ../../../scripts/sway-swapoutputworkspaces.sh;
-in {
+in
+{
   imports = [
     ../profiles/wayland-desktop.nix
     ../programs/waybar.nix
@@ -98,112 +100,121 @@ in {
     systemd.enable = true;
     xwayland = false;
 
-    config = let
+    config =
-      modifier = "Mod4";
+      let
-      inherit (config.wayland.windowManager.sway.config) left right up down;
+        modifier = "Mod4";
-    in {
+        inherit (config.wayland.windowManager.sway.config)
-      inherit modifier;
+          left
-      bars = [];
+          right
+          up
+          down
+          ;
+      in
+      {
+        inherit modifier;
+        bars = [ ];
 
-      input = {
+        input = {
-        "type:keyboard" =
+          "type:keyboard" =
-          {
+            {
-            xkb_layout = config.home.keyboard.layout;
+              xkb_layout = config.home.keyboard.layout;
-            xkb_variant = config.home.keyboard.variant;
+              xkb_variant = config.home.keyboard.variant;
-          }
+            }
-          // lib.attrsets.optionalAttrs (builtins.length (config.home.keyboard.options or []) > 0) {
+            // lib.attrsets.optionalAttrs (builtins.length (config.home.keyboard.options or [ ]) > 0) {
-            xkb_options = builtins.concatStringsSep "," config.home.keyboard.options;
+              xkb_options = builtins.concatStringsSep "," config.home.keyboard.options;
+            };
+
+          "type:touchpad" = {
+            natural_scroll = "enabled";
           };
 
-        "type:touchpad" = {
+          # alternatively run this command
-          natural_scroll = "enabled";
+          # swaymsg input "1386:914:Wacom_Intuos_Pro_S_Pen" tool_mode "* relative"
+          # and then switch to a different VT (alt+ctrl+f2) and back
+          "1386:914:Wacom_Intuos_Pro_S_Pen" = {
+            tool_mode = "* relative";
+          };
         };
 
-        # alternatively run this command
+        keybindings = lib.mkOptionDefault {
-        # swaymsg input "1386:914:Wacom_Intuos_Pro_S_Pen" tool_mode "* relative"
+          # as of 2023-05-21 the `!!` arg parsing mode was broken for me on yofi
-        # and then switch to a different VT (alt+ctrl+f2) and back
+          # "${modifier}+d" = "exec ${packages'.yofi}/bin/yofi binapps";
-        "1386:914:Wacom_Intuos_Pro_S_Pen" = {
+          "${modifier}+d" = "exec ${pkgs.fuzzel}/bin/fuzzel --show-actions";
-          tool_mode = "* relative";
+
+          # only 1-9 exist on the default config
+          "${modifier}+0" = "workspace number 0";
+          "${modifier}+Shift+0" = "move container to workspace number 0";
+
+          # disable splitting for now as i sometimes trigger it accidentally and then get stuck with it
+          "${modifier}+b" = "nop";
+          "${modifier}+v" = "nop";
+
+          # move workspace to output
+          "${modifier}+Control+Shift+${left}" = "move workspace to output left";
+          "${modifier}+Control+Shift+${right}" = "move workspace to output right";
+          "${modifier}+Control+Shift+${up}" = "move workspace to output up";
+          "${modifier}+Control+Shift+${down}" = "move workspace to output down";
+          # move workspace to output with arrow keys
+          "${modifier}+Control+Shift+Left" = "move workspace to output left";
+          "${modifier}+Control+Shift+Right" = "move workspace to output right";
+          "${modifier}+Control+Shift+Up" = "move workspace to output up";
+          "${modifier}+Control+Shift+Down" = "move workspace to output down";
+
+          # TODO: i've been hitting this one accidentally way too often. find a better place.
+          # "${modifier}+Shift+e" = "exec ${pkgs.sway}/bin/swaymsg exit";
+          "${modifier}+q" = "kill";
+          "${modifier}+Shift+q" = "exec ${pkgs.sway}/bin/swaymsg -t get_tree | ${pkgs.jq}/bin/jq 'recurse(.nodes[], .floating_nodes[]) | select(.focused).pid' | ${pkgs.findutils}/bin/xargs -L1 kill -9";
+
+          "${modifier}+x" = "exec ${swapOutputWorkspaces}";
+
+          "${modifier}+Ctrl+l" = "exec ${lockCmd}";
+
+          "--locked XF86AudioPlay" = "exec ${pkgs.playerctl}/bin/playerctl play-pause";
+          "XF86AudioPrev" = "exec ${pkgs.playerctl}/bin/playerctl previous";
+          "XF86AudioNext" = "exec ${pkgs.playerctl}/bin/playerctl next";
+
+          "XF86AudioRaiseVolume" = "exec ${pkgs.pulsemixer}/bin/pulsemixer --change-volume +5";
+          "XF86AudioLowerVolume" = "exec ${pkgs.pulsemixer}/bin/pulsemixer --change-volume -5";
+          "--locked XF86AudioMute" = "exec ${pkgs.pulsemixer}/bin/pulsemixer --toggle-mute";
+
+          "Print" = "exec ${pkgs.shotman}/bin/shotman --capture region";
         };
+
+        terminal = "alacritty";
+        startup =
+          [
+            {
+              command = builtins.toString (
+                pkgs.writeShellScript "ensure-graphical-session" ''
+                  (
+                    ${pkgs.coreutils}/bin/sleep 0.2
+                    ${pkgs.systemd}/bin/systemctl --user restart graphical-session.target
+                  ) &
+                ''
+              );
+            }
+          ]
+          ++ lib.optionals config.services.swayidle.enable [
+            {
+              command = builtins.toString (
+                pkgs.writeShellScript "ensure-graphical-session" ''
+                  (
+                    ${pkgs.coreutils}/bin/sleep 0.2
+                    ${pkgs.systemd}/bin/systemctl --user restart swayidle
+                  ) &
+                ''
+              );
+            }
+          ];
+
+        colors.focused = lib.mkOptionDefault { childBorder = lib.mkForce "#ffa500"; };
+
+        window.titlebar = false;
+        window.border = 4;
+
+        # this maps to focus_on_window_activation
+        focus.newWindow = "urgent";
       };
-
-      keybindings = lib.mkOptionDefault {
-        # as of 2023-05-21 the `!!` arg parsing mode was broken for me on yofi
-        # "${modifier}+d" = "exec ${packages'.yofi}/bin/yofi binapps";
-        "${modifier}+d" = "exec ${pkgs.fuzzel}/bin/fuzzel --show-actions";
-
-        # only 1-9 exist on the default config
-        "${modifier}+0" = "workspace number 0";
-        "${modifier}+Shift+0" = "move container to workspace number 0";
-
-        # disable splitting for now as i sometimes trigger it accidentally and then get stuck with it
-        "${modifier}+b" = "nop";
-        "${modifier}+v" = "nop";
-
-        # move workspace to output
-        "${modifier}+Control+Shift+${left}" = "move workspace to output left";
-        "${modifier}+Control+Shift+${right}" = "move workspace to output right";
-        "${modifier}+Control+Shift+${up}" = "move workspace to output up";
-        "${modifier}+Control+Shift+${down}" = "move workspace to output down";
-        # move workspace to output with arrow keys
-        "${modifier}+Control+Shift+Left" = "move workspace to output left";
-        "${modifier}+Control+Shift+Right" = "move workspace to output right";
-        "${modifier}+Control+Shift+Up" = "move workspace to output up";
-        "${modifier}+Control+Shift+Down" = "move workspace to output down";
-
-        # TODO: i've been hitting this one accidentally way too often. find a better place.
-        # "${modifier}+Shift+e" = "exec ${pkgs.sway}/bin/swaymsg exit";
-        "${modifier}+q" = "kill";
-        "${modifier}+Shift+q" = "exec ${pkgs.sway}/bin/swaymsg -t get_tree | ${pkgs.jq}/bin/jq 'recurse(.nodes[], .floating_nodes[]) | select(.focused).pid' | ${pkgs.findutils}/bin/xargs -L1 kill -9";
-
-        "${modifier}+x" = "exec ${swapOutputWorkspaces}";
-
-        "${modifier}+Ctrl+l" = "exec ${lockCmd}";
-
-        "--locked XF86AudioPlay" = "exec ${pkgs.playerctl}/bin/playerctl play-pause";
-        "XF86AudioPrev" = "exec ${pkgs.playerctl}/bin/playerctl previous";
-        "XF86AudioNext" = "exec ${pkgs.playerctl}/bin/playerctl next";
-
-        "XF86AudioRaiseVolume" = "exec ${pkgs.pulsemixer}/bin/pulsemixer --change-volume +5";
-        "XF86AudioLowerVolume" = "exec ${pkgs.pulsemixer}/bin/pulsemixer --change-volume -5";
-        "--locked XF86AudioMute" = "exec ${pkgs.pulsemixer}/bin/pulsemixer --toggle-mute";
-
-        "Print" = "exec ${pkgs.shotman}/bin/shotman --capture region";
-      };
-
-      terminal = "alacritty";
-      startup =
-        [
-          {
-            command = builtins.toString (pkgs.writeShellScript "ensure-graphical-session" ''
-              (
-                ${pkgs.coreutils}/bin/sleep 0.2
-                ${pkgs.systemd}/bin/systemctl --user restart graphical-session.target
-              ) &
-            '');
-          }
-        ]
-        ++ lib.optionals config.services.swayidle.enable [
-          {
-            command = builtins.toString (pkgs.writeShellScript "ensure-graphical-session" ''
-              (
-                ${pkgs.coreutils}/bin/sleep 0.2
-                ${pkgs.systemd}/bin/systemctl --user restart swayidle
-              ) &
-            '');
-          }
-        ];
-
-      colors.focused = lib.mkOptionDefault {
-        childBorder = lib.mkForce "#ffa500";
-      };
-
-      window.titlebar = false;
-      window.border = 4;
-
-      # this maps to focus_on_window_activation
-      focus.newWindow = "urgent";
-    };
   };
 
   services.swayidle = {

nix/home-manager/profiles/wayland-desktop.nix

@@ -5,12 +5,14 @@
   repoFlake,
   nodeFlake,
   ...
-}: let
+}:
-  inherit (import ../lib.nix {}) mkSimpleTrayService;
+let
+  inherit (import ../lib.nix { }) mkSimpleTrayService;
 
   nixpkgs-wayland' = repoFlake.inputs.nixpkgs-wayland.packages.${pkgs.system};
   wayprompt = nixpkgs-wayland'.wayprompt;
-in {
+in
+{
   fonts.fontconfig.enable = true;
 
   # services.gpg-agent.pinentryFlavor = lib.mkForce null;
@@ -26,11 +28,12 @@ in {
   systemd.user.targets.tray = {
     Unit = {
       Description = "Home Manager System Tray";
-      Requires = ["graphical-session-pre.target"];
+      Requires = [ "graphical-session-pre.target" ];
     };
   };
 
-  home.packages = with pkgs;
+  home.packages =
+    with pkgs;
     [
       # required by network-manager-applet
       networkmanagerapplet
@@ -62,11 +65,9 @@ in {
 
       waypipe
     ]
-    ++ (
+    ++ (lib.lists.optionals (!pkgs.stdenv.isAarch64)
-      lib.lists.optionals (!pkgs.stdenv.isAarch64)
       # TODO: broken on aarch64
-      [
+      [ ]
-      ]
     );
 
   home.sessionVariables = {

nix/home-manager/programs/chromium.nix

@@ -3,14 +3,15 @@
   lib,
   pkgs,
   ...
-}: let
+}:
+let
   extensions =
     [
       #undetectable adblocker
-      {id = "gcfcpohokifjldeandkfjoboemihipmb";}
+      { id = "gcfcpohokifjldeandkfjoboemihipmb"; }
 
       # ublock origin
-      {id = "cjpalhdlnbpafiamejdnhcphjbkeiagm";}
+      { id = "cjpalhdlnbpafiamejdnhcphjbkeiagm"; }
 
       # # YT ad block
       # {id = "cmedhionkhpnakcndndgjdbohmhepckk";}
@@ -19,15 +20,15 @@
       # {id = "cfhdojbkjhnklbpkdaibdccddilifddb";}
 
       # Cookie Notice Blocker
-      {id = "odhmfmnoejhihkmfebnolljiibpnednn";}
+      { id = "odhmfmnoejhihkmfebnolljiibpnednn"; }
       # i don't care about cookies
-      {id = "fihnjjcciajhdojfnbdddfaoknhalnja";}
+      { id = "fihnjjcciajhdojfnbdddfaoknhalnja"; }
 
       # NopeCHA
-      {id = "dknlfmjaanfblgfdfebhijalfmhmjjjo";}
+      { id = "dknlfmjaanfblgfdfebhijalfmhmjjjo"; }
 
       # h264ify
-      {id = "aleakchihdccplidncghkekgioiakgal";}
+      { id = "aleakchihdccplidncghkekgioiakgal"; }
 
       # clippy
       # {id = "honbeilkanbghjimjoniipnnehlmhggk"}
@@ -38,31 +39,32 @@
       }
 
       # cookie autodelete
-      {id = "fhcgjolkccmbidfldomjliifgaodjagh";}
+      { id = "fhcgjolkccmbidfldomjliifgaodjagh"; }
 
       # unhook
-      {id = "khncfooichmfjbepaaaebmommgaepoid";}
+      { id = "khncfooichmfjbepaaaebmommgaepoid"; }
     ]
     ++ (lib.lists.optionals ((builtins.match "^steveej.*" name) != null) [
       # polkadotjs
-      {id = "mopnmbcafieddcagagdcbnhejhlodfdd";}
+      { id = "mopnmbcafieddcagagdcbnhejhlodfdd"; }
 
       # rabby wallet
-      {id = "acmacodkjbdgmoleebolmdjonilkdbch";}
+      { id = "acmacodkjbdgmoleebolmdjonilkdbch"; }
 
       # phantom wallet
-      {id = "bfnaelmomeimhlpmgjnjophhpkkoljpa";}
+      { id = "bfnaelmomeimhlpmgjnjophhpkkoljpa"; }
 
       # Vimium C
-      {id = "hfjbmagddngcpeloejdejnfgbamkjaeg";}
+      { id = "hfjbmagddngcpeloejdejnfgbamkjaeg"; }
 
       # always right
-      {id = "npjpaghfnndnnmjiliibnkmdfgbojokj";}
+      { id = "npjpaghfnndnnmjiliibnkmdfgbojokj"; }
 
       # shazam music
-      {id = "mmioliijnhnoblpgimnlajmefafdfilb";}
+      { id = "mmioliijnhnoblpgimnlajmefafdfilb"; }
     ]);
-in {
+in
+{
   programs.chromium = {
     enable = true;
     inherit extensions;
@@ -72,9 +74,7 @@ in {
 
   programs.brave = {
     # TODO: enable this on aarch64-linux
-    enable =
+    enable = true && !pkgs.stdenv.targetPlatform.isAarch64;
-      true
-      && !pkgs.stdenv.targetPlatform.isAarch64;
     inherit extensions;
   };
 }

nix/home-manager/programs/espanso.nix

@@ -1,8 +1,5 @@
+{ pkgs, repoFlake, ... }:
 {
-  pkgs,
-  repoFlake,
-  ...
-}: {
   services.espanso = {
     package = pkgs.espanso-wayland;
     # package = pkgs.espanso-wayland.overrideAttrs (_: {
@@ -24,64 +21,62 @@
         # backend = "Clipboard";
       };
     };
-    matches = let
+    matches =
-      playerctl = ''
+      let
-        ${pkgs.coreutils}/bin/env DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$(${pkgs.coreutils}/bin/id -u)/bus" ${pkgs.playerctl}/bin/playerctl'';
+        playerctl = ''${pkgs.coreutils}/bin/env DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$(${pkgs.coreutils}/bin/id -u)/bus" ${pkgs.playerctl}/bin/playerctl'';
-    in {
+      in
-      default = {
+      {
-        matches = [
+        default = {
-          {
+          matches = [
-            trigger = ":vpos";
+            {
-            replace = "{{output}}";
+              trigger = ":vpos";
-            vars = [
+              replace = "{{output}}";
-              {
+              vars = [
-                name = "output";
+                {
-                type = "script";
+                  name = "output";
-                params = {
+                  type = "script";
-                  args = [
+                  params = {
-                    (pkgs.writeScript "espanso" ''
+                    args = [
-                      #! ${pkgs.python3}/bin/python
+                      (pkgs.writeScript "espanso" ''
-                      import subprocess, os, math, datetime
+                        #! ${pkgs.python3}/bin/python
+                        import subprocess, os, math, datetime
 
-                      id=str(os.getuid())
+                        id=str(os.getuid())
-                      result=subprocess.run(args=["${pkgs.playerctl}/bin/playerctl", "position"], env={"DBUS_SESSION_BUS_ADDRESS": "unix:path=/run/user/"+id+"/bus"},capture_output=True)
+                        result=subprocess.run(args=["${pkgs.playerctl}/bin/playerctl", "position"], env={"DBUS_SESSION_BUS_ADDRESS": "unix:path=/run/user/"+id+"/bus"},capture_output=True)
-                      result.check_returncode()
+                        result.check_returncode()
 
-                      position_secs = math.trunc(float(result.stdout))
+                        position_secs = math.trunc(float(result.stdout))
-                      position_human = datetime.timedelta(seconds=position_secs)
+                        position_human = datetime.timedelta(seconds=position_secs)
-                      print("%s - %s" % (position_human, position_secs))
+                        print("%s - %s" % (position_human, position_secs))
-                    '')
+                      '')
-                  ];
+                    ];
-                };
+                  };
-              }
+                }
-            ];
+              ];
-          }
+            }
-          {
+            {
-            trigger = ":vtit";
+              trigger = ":vtit";
-            replace = "{{output}}";
+              replace = "{{output}}";
-            vars = [
+              vars = [
-              {
+                {
-                name = "output";
+                  name = "output";
-                type = "script";
+                  type = "script";
-                params = {
+                  params = {
-                  args = [
+                    args = [ (pkgs.writeShellScript "espanso" "${playerctl} metadata title") ];
-                    (pkgs.writeShellScript "espanso"
+                  };
-                      "${playerctl} metadata title")
+                }
-                  ];
+              ];
-                };
+            }
-              }
+            {
-            ];
+              trigger = ":dunno";
-          }
+              replace = "¯\\_(ツ)_/¯";
-          {
+            }
-            trigger = ":dunno";
+            {
-            replace = "¯\\_(ツ)_/¯";
+              trigger = ":shrug";
-          }
+              replace = "¯\\_(ツ)_/¯";
-          {
+            }
-            trigger = ":shrug";
+          ];
-            replace = "¯\\_(ツ)_/¯";
+        };
-          }
-        ];
       };
-    };
   };
 }

nix/home-manager/programs/firefox.nix

@@ -1,5 +1,8 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
-  programs.librewolf = {enable = false;};
+{
+  programs.librewolf = {
+    enable = false;
+  };
   programs.firefox = {
     enable = true;
     package = pkgs.firefox-esr-128;

nix/home-manager/programs/gpg-agent.nix

@@ -3,10 +3,9 @@
   pkgs,
   config,
   ...
-}: {
+}:
-  home.packages = [
+{
-    pkgs.gcr
+  home.packages = [ pkgs.gcr ];
-  ];
 
   programs.gpg.enable = true;
   services.gpg-agent = {

nix/home-manager/programs/homeshick.nix

@@ -1,32 +1,28 @@
+{ pkgs, config, ... }:
+let
+in
+# TODO: clean up the impurity in here
 {
-  pkgs,
-  config,
-  ...
-}: let
-  # TODO: clean up the impurity in here
-in {
   home.sessionVariables.HOMESHICK_DIR = "${pkgs.homeshick}";
 
-  home.activation.bootstrapRepos = config.lib.dag.entryAfter ["writeBoundary"] ''
+  home.activation.bootstrapRepos = config.lib.dag.entryAfter [ "writeBoundary" ] ''
-    $DRY_RUN_CMD ${
+    $DRY_RUN_CMD ${pkgs.writeScript "activation-script" ''
-      pkgs.writeScript "activation-script" ''
+      set -e
-        set -e
+      echo home-manager path is ${config.home.path}
-        echo home-manager path is ${config.home.path}
+      echo home is $HOME
-        echo home is $HOME
 
-        source ${pkgs.homeshick}/homeshick.sh
+      source ${pkgs.homeshick}/homeshick.sh
-        type homeshick
+      type homeshick
 
-        # echo Updating homeshick
+      # echo Updating homeshick
-        # ln -sfT ${pkgs.homeshick} "$HOMESICK_REPOS"/.homeshick
+      # ln -sfT ${pkgs.homeshick} "$HOMESICK_REPOS"/.homeshick
-        # mv -Tf "$HOMESICK_REPOS"/{.,}homeshick
+      # mv -Tf "$HOMESICK_REPOS"/{.,}homeshick
-      ''
+    ''};
-    };
   '';
 
   nixpkgs.config = {
-    packageOverrides = pkgs:
+    packageOverrides =
-      with pkgs; {
+      pkgs: with pkgs; {
         homeshick = builtins.fetchGit {
           url = "https://github.com/andsens/homeshick.git";
           ref = "master";

nix/home-manager/programs/libreoffice.nix

@@ -1,3 +1,4 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
-  home.packages = [pkgs.libreoffice];
+{
+  home.packages = [ pkgs.libreoffice ];
 }

nix/home-manager/programs/neovim.nix

@@ -3,10 +3,9 @@
   pkgs,
   lib,
   ...
-}: {
+}:
-  imports = [
+{
-    repoFlake.inputs.nixvim.homeManagerModules.nixvim
+  imports = [ repoFlake.inputs.nixvim.homeManagerModules.nixvim ];
-  ];
 
   programs.nixvim = {
     enable = true;
@@ -14,7 +13,7 @@
     vimdiffAlias = true;
     vimAlias = true;
 
-    extraPython3Packages = ps: with ps; [];
+    extraPython3Packages = ps: with ps; [ ];
 
     # extraConfigVim = builtins.readFile ./neovim/vimrc;
 

nix/home-manager/programs/obs-studio.nix

@@ -1,21 +1,25 @@
+{ pkgs, lib, ... }:
 {
-  pkgs,
-  lib,
-  ...
-}: {
   programs.obs-studio = {
     enable = true;
     plugins =
-      builtins.map (plugin: (plugin.overrideAttrs (attrs: {
+      builtins.map
-        meta = lib.mkMerge [
+        (
-          {inherit (attrs) meta;}
+          plugin:
-          {meta.platforms = [pkgs.stdenv.system];}
+          (plugin.overrideAttrs (attrs: {
-        ];
+            meta = lib.mkMerge [
-      })))
+              { inherit (attrs) meta; }
-      (with pkgs.obs-studio-plugins; [
+              { meta.platforms = [ pkgs.stdenv.system ]; }
-        # wlrobs
+            ];
-        obs-backgroundremoval
+          }))
-        obs-pipewire-audio-capture
+        )
-      ]);
+        (
+          with pkgs.obs-studio-plugins;
+          [
+            # wlrobs
+            obs-backgroundremoval
+            obs-pipewire-audio-capture
+          ]
+        );
   };
 }

nix/home-manager/programs/openvscode-server.nix

@@ -3,10 +3,12 @@
   nodeFlake,
   repoFlake,
   ...
-}: let
+}:
-  pkgsUnstable = import nodeFlake.inputs.nixpkgs-unstable {inherit (pkgs) system config;};
+let
-  pkgsVscodium = import repoFlake.inputs.nixpkgs-vscodium {inherit (pkgs) system config;};
+  pkgsUnstable = import nodeFlake.inputs.nixpkgs-unstable { inherit (pkgs) system config; };
-in {
+  pkgsVscodium = import repoFlake.inputs.nixpkgs-vscodium { inherit (pkgs) system config; };
+in
+{
   home.packages = [
     pkgs.nil
     pkgs.nixd
@@ -20,20 +22,22 @@ in {
     # 3. link the binary. this relies on the client-side setting `"remote.SSH.experimental.serverBinaryName": "openvscode-server"` : ln -s $(which openvscode-server) /home/steveej/.vscodium-server/bin/c8ce3ba4bc6b30b3b10edc61481cb85b1d2396bc/bin/
 
     /*
-    e.g.:
+      e.g.:
-    ```
+      ```
-    (
+      (
-      set -e
+        set -e
-      export COMMIT=$(codium --version | rg '^[0-9a-f]{40}$')
+        export COMMIT=$(codium --version | rg '^[0-9a-f]{40}$')
-      ssh bm-hostkey0 "pkill -9 openvscode; rm -rf /home/steveej/.vscodium-server/bin/$COMMIT; mkdir -p /home/steveej/.vscodium-server/bin/$COMMIT/bin/; ln -s \$(which openvscode-server) /home/steveej/.vscodium-server/bin/$COMMIT/bin/"
+        ssh bm-hostkey0 "pkill -9 openvscode; rm -rf /home/steveej/.vscodium-server/bin/$COMMIT; mkdir -p /home/steveej/.vscodium-server/bin/$COMMIT/bin/; ln -s \$(which openvscode-server) /home/steveej/.vscodium-server/bin/$COMMIT/bin/"
-    )
+      )
-    ```
+      ```
     */
 
     (pkgsVscodium.openvscode-server.overrideAttrs (attrs: {
       src = repoFlake.inputs.openvscode-server;
       version = "1.94.2";
-      yarnCache = attrs.yarnCache.overrideAttrs (_: {outputHash = "sha256-89c6GYLT2RzHqwxBKegYqB6g5rEJ6/nH53cnfV7b0Tt=";});
+      yarnCache = attrs.yarnCache.overrideAttrs (_: {
+        outputHash = "sha256-89c6GYLT2RzHqwxBKegYqB6g5rEJ6/nH53cnfV7b0Tt=";
+      });
     }))
 
     pkgs.waypipe

nix/home-manager/programs/pass.nix

@@ -1,8 +1,5 @@
+{ repoFlake, pkgs, ... }:
 {
-  repoFlake,
-  pkgs,
-  ...
-}: {
   # required by pass-otp
   # home.sessionVariables.PASSWORD_STORE_EXTENSIONS_DIR = "$HOME/.nix-profile/lib/password-store/extensions";
   # home.sessionVariables.PASSWORD_STORE_ENABLE_EXTENSIONS = "true";

nix/home-manager/programs/radicale.nix

@@ -4,7 +4,8 @@
   pkgs,
   osConfig,
   ...
-}: let
+}:
+let
   libdecsync = pkgs.python3Packages.buildPythonPackage rec {
     pname = "libdecsync";
     version = "2.2.1";
@@ -38,50 +39,51 @@
       # pkgs.libxcrypt
     ];
 
-    propagatedBuildInputs = [libdecsync pkgs.python3Packages.setuptools];
+    propagatedBuildInputs = [
+      libdecsync
+      pkgs.python3Packages.setuptools
+    ];
   };
   radicale-decsync = pkgs.radicale.overrideAttrs (old: {
-    propagatedBuildInputs =
+    propagatedBuildInputs = old.propagatedBuildInputs ++ [ radicale-storage-decsync ];
-      old.propagatedBuildInputs
-      ++ [radicale-storage-decsync];
   });
 
-  mkRadicaleService = {
+  mkRadicaleService =
-    suffix,
+    { suffix, port }:
-    port,
+    let
-  }: let
+      radicale-config = pkgs.writeText "radicale-config-${suffix}" ''
-    radicale-config = pkgs.writeText "radicale-config-${suffix}" ''
+        [server]
-      [server]
+        hosts = localhost:${builtins.toString port}
-      hosts = localhost:${builtins.toString port}
 
-      [auth]
+        [auth]
-      type = htpasswd
+        type = htpasswd
-      htpasswd_filename = ${osConfig.sops.secrets.radicale_htpasswd.path}
+        htpasswd_filename = ${osConfig.sops.secrets.radicale_htpasswd.path}
-      htpasswd_encryption = bcrypt
+        htpasswd_encryption = bcrypt
 
-      [storage]
+        [storage]
-      type = radicale_storage_decsync
+        type = radicale_storage_decsync
-      filesystem_folder = ${config.xdg.dataHome}/radicale/radicale-${suffix}
+        filesystem_folder = ${config.xdg.dataHome}/radicale/radicale-${suffix}
-      decsync_dir = ${config.xdg.dataHome}/decsync/decsync-${suffix}
+        decsync_dir = ${config.xdg.dataHome}/decsync/decsync-${suffix}
-    '';
+      '';
-  in {
+    in
-    systemd.user.services."radicale-${suffix}" = {
+    {
-      Unit.Description = "Radicale with DecSync (${suffix})";
+      systemd.user.services."radicale-${suffix}" = {
-      Service = {
+        Unit.Description = "Radicale with DecSync (${suffix})";
-        ExecStart = "${radicale-decsync}/bin/radicale -C ${radicale-config}";
+        Service = {
-        Restart = "on-failure";
+          ExecStart = "${radicale-decsync}/bin/radicale -C ${radicale-config}";
+          Restart = "on-failure";
+        };
+        Install.WantedBy = [ "default.target" ];
       };
-      Install.WantedBy = ["default.target"];
     };
-  };
 in
-  builtins.foldl' (sum: cur: lib.recursiveUpdate sum (mkRadicaleService cur)) {} [
+builtins.foldl' (sum: cur: lib.recursiveUpdate sum (mkRadicaleService cur)) { } [
-    {
+  {
-      suffix = "personal";
+    suffix = "personal";
-      port = 5232;
+    port = 5232;
-    }
+  }
-    {
+  {
-      suffix = "family";
+    suffix = "family";
-      port = 5233;
+    port = 5233;
-    }
+  }
-  ]
+]

nix/home-manager/programs/redshift.nix

@@ -1,10 +1,8 @@
-{
+{ pkgs, config, ... }:
-  pkgs,
+let
-  config,
-  ...
-}: let
   passwords = import ../../variables/passwords.crypt.nix;
-in {
+in
+{
   services.gammastep = {
     enable = true;
     provider = "manual";

nix/home-manager/programs/salut.nix

@@ -8,11 +8,10 @@
 # useful testing command:
 # for i in `seq 0 10`; do nix shell nixpkgs#libnotify --command notify-send notifiiiiiii "$i"; sleep 1; done
 let
-  inherit (import ../lib.nix {}) mkSimpleTrayService;
+  inherit (import ../lib.nix { }) mkSimpleTrayService;
-in {
+in
-  home.packages = [
+{
-    packages'.salut
+  home.packages = [ packages'.salut ];
-  ];
 
   xdg.configFile."salut/config.ini" = {
     enable = true;
@@ -34,7 +33,5 @@ in {
     onChange = "${pkgs.systemd}/bin/systemctl --user restart salut";
   };
 
-  systemd.user.services.salut = mkSimpleTrayService {
+  systemd.user.services.salut = mkSimpleTrayService { execStart = "${packages'.salut}/bin/salut"; };
-    execStart = "${packages'.salut}/bin/salut";
-  };
 }

nix/home-manager/programs/vscode/default.nix

@@ -3,9 +3,11 @@
   nodeFlake,
   repoFlake,
   ...
-}: let
+}:
-  pkgsVscodium = import repoFlake.inputs.nixpkgs-vscodium {inherit (pkgs) system config;};
+let
-in {
+  pkgsVscodium = import repoFlake.inputs.nixpkgs-vscodium { inherit (pkgs) system config; };
+in
+{
   programs.vscode = {
     enable = true;
     package = pkgsVscodium.vscodium;
@@ -18,16 +20,16 @@ in {
         #   sha256 = "1qc1qsahfx1nvznq4adplx63w5d94xhafngv76vnqjjbzhv991v2";
         # })
       ]
-      ++ (with pkgsVscodium.vscode-extensions;
+      ++ (
+        with pkgsVscodium.vscode-extensions;
         [
           eamodio.gitlens
           mkhl.direnv
           tomoki1207.pdf
           vscodevim.vim
 
-          bbenoist.nix
+          # bbenoist.nix
           jnoortheen.nix-ide
-          # kamadorueda.alejandra
 
           ms-vscode.theme-tomorrowkit
           nonylene.dark-molokai-theme
@@ -44,38 +46,41 @@ in {
           # TODO: not compatible with vscodium
           # ms-vscode-remote.remote-ssh
         ]
-        ++ (let
+        ++ (
-          extensions = repoFlake.inputs.nix-vscode-extensions.extensions.${pkgs.system};
+          let
-        in (
+            extensions = repoFlake.inputs.nix-vscode-extensions.extensions.${pkgs.system};
-          with extensions.vscode-marketplace;
+          in
-          with extensions.vscode-marketplace-release; [
+          (
-            tamasfe.even-better-toml
+            with extensions.vscode-marketplace;
+            with extensions.vscode-marketplace-release;
+            [
+              tamasfe.even-better-toml
 
-            serayuzgur.crates
+              serayuzgur.crates
-            rust-lang.rust-analyzer
+              rust-lang.rust-analyzer
-            swellaby.vscode-rust-test-adapter
+              swellaby.vscode-rust-test-adapter
 
-            golang.go
+              golang.go
-            jeff-hykin.better-go-syntax
+              jeff-hykin.better-go-syntax
 
-            ibecker.treefmt-vscode
+              ibecker.treefmt-vscode
-          ]
+            ]
-        )))
+          )
+        )
+      )
       ++ [
-        (pkgsVscodium.vscode-utils.extensionFromVscodeMarketplace
+        (pkgsVscodium.vscode-utils.extensionFromVscodeMarketplace {
-          {
+          name = "markdown-oxide";
-            name = "markdown-oxide";
+          publisher = "felixzeller";
-            publisher = "felixzeller";
+          version = "1.1.0";
-            version = "1.1.0";
+          sha256 = "07l37hkg106m3nl9530l7i39iw1kibckv1zi4n23gbp7srdrwbs3";
-            sha256 = "07l37hkg106m3nl9530l7i39iw1kibckv1zi4n23gbp7srdrwbs3";
+        })
-          })
       ];
     mutableExtensionsDir = true;
   };
 
   home.packages = [
     pkgs.nixpkgs-fmt
-    pkgs.alejandra
     pkgs.nil
   ];
 }
@@ -153,4 +158,3 @@ in {
 # xyz.plsql-language
 # yzane.markdown-pdf
 # zxh404.vscode-proto3
-

nix/home-manager/programs/vscode/nix4vscode/config.toml

@@ -3,3 +3,7 @@ vscode_version = "1.94.2"
 [[extensions]]
 publisher_name = "FelixZeller"
 extension_name = "markdown-oxide"
+
+[[extensions]]
+publisher_name = "ibecker"
+extension_name = "treefmt-vscode"

nix/home-manager/programs/vscode/nix4vscode/default.nix

@@ -0,0 +1,72 @@
+{ pkgs, lib }:
+let
+  inherit (pkgs.stdenv)
+    isDarwin
+    isLinux
+    isi686
+    isx86_64
+    isAarch32
+    isAarch64
+    ;
+  vscode-utils = pkgs.vscode-utils;
+  merge = lib.attrsets.recursiveUpdate;
+in
+merge
+  (merge
+    (merge
+      (merge
+        {
+          "felixzeller"."markdown-oxide" = vscode-utils.extensionFromVscodeMarketplace {
+            name = "markdown-oxide";
+            publisher = "felixzeller";
+            version = "1.1.0";
+            sha256 = "07l37hkg106m3nl9530l7i39iw1kibckv1zi4n23gbp7srdrwbs3";
+          };
+        }
+        (
+          lib.attrsets.optionalAttrs (isLinux && (isi686 || isx86_64)) {
+            "ibecker"."treefmt-vscode" = vscode-utils.extensionFromVscodeMarketplace {
+              name = "treefmt-vscode";
+              publisher = "ibecker";
+              version = "2.1.0";
+              sha256 = "1r17wjpw8xiha5r9h3146facxghpcp416zf8551sw93cmam9ky6j";
+              arch = "linux-x64";
+            };
+          }
+        )
+      )
+      (
+        lib.attrsets.optionalAttrs (isLinux && (isAarch32 || isAarch64)) {
+          "ibecker"."treefmt-vscode" = vscode-utils.extensionFromVscodeMarketplace {
+            name = "treefmt-vscode";
+            publisher = "ibecker";
+            version = "2.1.0";
+            sha256 = "0swvl7fkjcwp43grnrhnmy60a5m3hfwawk204byi8hhbczy131li";
+            arch = "linux-arm64";
+          };
+        }
+      )
+    )
+    (
+      lib.attrsets.optionalAttrs (isDarwin && (isi686 || isx86_64)) {
+        "ibecker"."treefmt-vscode" = vscode-utils.extensionFromVscodeMarketplace {
+          name = "treefmt-vscode";
+          publisher = "ibecker";
+          version = "2.1.0";
+          sha256 = "1swq9hy6a9nzkrn07j21g59pyk2m7aqsfi1pphl9l9y8p4zwiaqm";
+          arch = "darwin-x64";
+        };
+      }
+    )
+  )
+  (
+    lib.attrsets.optionalAttrs (isDarwin && (isAarch32 || isAarch64)) {
+      "ibecker"."treefmt-vscode" = vscode-utils.extensionFromVscodeMarketplace {
+        name = "treefmt-vscode";
+        publisher = "ibecker";
+        version = "2.1.0";
+        sha256 = "1xg3wnn3f1kvsz5a09l0cjpzfm3l9va73cahbvl14mx3n6734r2m";
+        arch = "darwin-arm64";
+      };
+    }
+  )

nix/home-manager/programs/waybar.nix

@@ -3,7 +3,8 @@
   config,
   repoFlake,
   ...
-}: {
+}:
+{
   home.packages = [
     # required by any bar that has a tray plugin
     pkgs.libappindicator-gtk3
@@ -12,10 +13,9 @@
 
   programs.waybar = {
     enable = true;
-    package = repoFlake.inputs.nixpkgs-wayland.outputs.packages.${pkgs.stdenv.hostPlatform.system}.waybar;
+    package =
-    style =
+      repoFlake.inputs.nixpkgs-wayland.outputs.packages.${pkgs.stdenv.hostPlatform.system}.waybar;
-      pkgs.lib.readFile "${pkgs.waybar.src}/resources/style.css"
+    style = pkgs.lib.readFile "${pkgs.waybar.src}/resources/style.css" + pkgs.lib.readFile ./waybar.css;
-      + pkgs.lib.readFile ./waybar.css;
     systemd.enable = true;
     settings = {
       mainBar = {
@@ -24,12 +24,7 @@
         height = 30;
         output =
           # hide the bar on HEADDLESS displays as i use them only for screensharing
-          (
+          (builtins.genList (i: "!HEADLESS-${builtins.toString i}") 99) ++ [ "*" ];
-            builtins.genList (i: "!HEADLESS-${builtins.toString i}") 99
-          )
-          ++ [
-            "*"
-          ];
         # output = [
         #   "eDP-1"
         #   "DP-*"

nix/home-manager/programs/zsh.nix

@@ -3,27 +3,29 @@
   lib,
   pkgs,
   ...
-}: let
+}:
-  just-plugin = let
+let
-    plugin_file = pkgs.writeText "_just" ''
+  just-plugin =
-      #compdef just
+    let
-      #autload
+      plugin_file = pkgs.writeText "_just" ''
+        #compdef just
+        #autload
 
-      alias justl="\just --list"
+        alias justl="\just --list"
-      alias juste="\just --evaluate"
+        alias juste="\just --evaluate"
 
-      local subcmds=()
+        local subcmds=()
 
-      while read -r line ; do
+        while read -r line ; do
-         if [[ ! $line == Available* ]] ;
+           if [[ ! $line == Available* ]] ;
-         then
+           then
-            subcmds+=(''${line/[[:space:]]*\#/:})
+              subcmds+=(''${line/[[:space:]]*\#/:})
-         fi
+           fi
-      done < <(just --list)
+        done < <(just --list)
 
-      _describe 'command' subcmds
+        _describe 'command' subcmds
-    '';
+      '';
-  in
+    in
     pkgs.stdenv.mkDerivation {
       name = "just-completions";
       version = "0.1.0";
@@ -35,7 +37,8 @@
         chmod --recursive a-w $out
       '';
     };
-in {
+in
+{
   programs.zsh = {
     enable = true;
 
@@ -46,56 +49,59 @@ in {
     # will be called again by oh-my-zsh
     enableCompletion = false;
     enableAutosuggestions = true;
-    initExtra = let
+    initExtra =
-      inNixShell = ''$([[ -n "$IN_NIX_SHELL" ]] && printf " 🐚")'';
+      let
-    in ''
+        inNixShell = ''$([[ -n "$IN_NIX_SHELL" ]] && printf " 🐚")'';
-      if test ! -n "$TMPDIR" -a -z "$TMPDIR"; then
+      in
-        unset TMPDIR
+      ''
-      fi
+        if test ! -n "$TMPDIR" -a -z "$TMPDIR"; then
+          unset TMPDIR
+        fi
 
-      if test ! -n "$TMP" -a -z "$TMP"; then
+        if test ! -n "$TMP" -a -z "$TMP"; then
-        unset TMP
+          unset TMP
-      fi
+        fi
 
 
-      PROMPT='%F{%(!.red.green)}%n%f@%m %(?.%F{green}✓%f.%F{red}✗ ($?%))%f %F{blue}%~%f${inNixShell}%F{magenta}$(git_prompt_info)%f$prompt_newline%_%F{%(!.red.green)}$(prompt_char)%f '
+        PROMPT='%F{%(!.red.green)}%n%f@%m %(?.%F{green}✓%f.%F{red}✗ ($?%))%f %F{blue}%~%f${inNixShell}%F{magenta}$(git_prompt_info)%f$prompt_newline%_%F{%(!.red.green)}$(prompt_char)%f '
-      RPROMPT=""
+        RPROMPT=""
 
-      # Automatic rehash
+        # Automatic rehash
-      zstyle ':completion:*' rehash true
+        zstyle ':completion:*' rehash true
 
-      if [ -f $HOME/.shrc.d/sh_aliases ]; then
+        if [ -f $HOME/.shrc.d/sh_aliases ]; then
-        . $HOME/.shrc.d/sh_aliases
+          . $HOME/.shrc.d/sh_aliases
-      fi
+        fi
 
-      ${
+        ${
-        if builtins.hasAttr "homeshick" pkgs
+          if builtins.hasAttr "homeshick" pkgs then
-        then ''
+            ''
-          source ${pkgs.homeshick}/homeshick.sh
+              source ${pkgs.homeshick}/homeshick.sh
-          fpath=(${pkgs.homeshick}/completions $fpath)
+              fpath=(${pkgs.homeshick}/completions $fpath)
-        ''
+            ''
-        else ""
+          else
-      }
+            ""
+        }
 
-      # Disable intercepting of ctrl-s and ctrl-q as flow control.
+        # Disable intercepting of ctrl-s and ctrl-q as flow control.
-      stty stop ''' -ixoff -ixon
+        stty stop ''' -ixoff -ixon
 
-      # don't cd into directories when executed
+        # don't cd into directories when executed
-      unsetopt AUTO_CD
+        unsetopt AUTO_CD
 
-      # print lines without termination
+        # print lines without termination
-      setopt PROMPT_CR
+        setopt PROMPT_CR
-      setopt PROMPT_SP
+        setopt PROMPT_SP
-      export PROMPT_EOL_MARK=""
+        export PROMPT_EOL_MARK=""
 
-      ${lib.optionalString config.services.gpg-agent.enable ''
+        ${lib.optionalString config.services.gpg-agent.enable ''
-        export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/gnupg/S.gpg-agent.ssh"
+          export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/gnupg/S.gpg-agent.ssh"
-      ''}
+        ''}
 
-      ${lib.optionalString config.programs.neovim.enable ''
+        ${lib.optionalString config.programs.neovim.enable ''
-        export EDITOR="nvim"
+          export EDITOR="nvim"
-      ''}
+        ''}
-    '';
+      '';
 
     plugins = [
       {
@@ -128,7 +134,10 @@ in {
     oh-my-zsh = {
       enable = true;
       theme = "tjkirch";
-      plugins = ["git" "sudo"];
+      plugins = [
+        "git"
+        "sudo"
+      ];
     };
   };
 }

nix/modules/flake-parts/colmena.nix

@@ -1,7 +1,8 @@
-{lib, ...}: {
+{ lib, ... }:
+{
   options.flake.colmena = lib.mkOption {
     # type = lib.types.attrsOf lib.types.unspecified;
     type = lib.types.raw;
-    default = {};
+    default = { };
   };
 }

nix/modules/flake-parts/perSystem/default.nix

@@ -5,34 +5,40 @@
   lib,
   pkgs,
   ...
-}: {
+}:
+{
   packages = {
-    myPython = pkgs.python310.withPackages (ps:
+    myPython = pkgs.python310.withPackages (
+      ps:
       with ps;
-        [
+      [
-          pep8
+        pep8
-          yapf
+        yapf
-          flake8
+        flake8
-          # autopep8 (broken)
+        # autopep8 (broken)
-          # pylint (broken)
+        # pylint (broken)
-          ipython
+        ipython
-          llfuse
+        llfuse
-          dugong
+        dugong
-          defusedxml
+        defusedxml
-          wheel
+        wheel
-          pip
+        pip
-          virtualenv
+        virtualenv
-          cffi
+        cffi
-          # pyopenssl
+        # pyopenssl
-          urllib3
+        urllib3
-          # mistune (insecure)
+        # mistune (insecure)
-          sympy
+        sympy
 
-          flask
+        flask
 
-          pyaml
+        pyaml
-          requests
+        requests
-        ]
+      ]
-        ++ [pkgs.pypi2nix pkgs.libffi]);
+      ++ [
+        pkgs.pypi2nix
+        pkgs.libffi
+      ]
+    );
   };
 }

nix/os/cachix.nix

@@ -1,14 +1,12 @@
 # WARN: this file will get overwritten by $ cachix use <name>
-{
+{ pkgs, lib, ... }:
-  pkgs,
+let
-  lib,
-  ...
-}: let
   folder = ./cachix;
   toImport = name: value: folder + ("/" + name);
   filterCaches = key: value: value == "regular" && lib.hasSuffix ".nix" key;
   imports = lib.mapAttrsToList toImport (lib.filterAttrs filterCaches (builtins.readDir folder));
-in {
+in
+{
   inherit imports;
-  nix.settings.substituters = ["https://cache.nixos.org/"];
+  nix.settings.substituters = [ "https://cache.nixos.org/" ];
 }

nix/os/cachix/nixpkgs-wayland.nix

@@ -1,8 +1,6 @@
 {
   nix = {
-    settings.substituters = [
+    settings.substituters = [ "https://nixpkgs-wayland.cachix.org" ];
-      "https://nixpkgs-wayland.cachix.org"
-    ];
     settings.trusted-public-keys = [
       "nixpkgs-wayland.cachix.org-1:3lwxaILxMRkVhehr5StQprHdEo4IrE8sRho9R9HOLYA="
     ];

nix/os/containers/backup.nix

@@ -5,88 +5,107 @@
   subvolumes,
   targetPathSuffix ? "",
   autoStart ? false,
-}: let
+}:
+let
   passwords = import ../../variables/passwords.crypt.nix;
   subvolumeParentDir = "/var/lib/container-volumes";
-in {
+in
-  config = {pkgs, ...}: {
+{
-    system.stateVersion = "20.03"; # Did you read the comment?
+  config =
+    { pkgs, ... }:
+    {
+      system.stateVersion = "20.03"; # Did you read the comment?
 
-    imports = [../profiles/containers/configuration.nix];
+      imports = [ ../profiles/containers/configuration.nix ];
 
-    environment.systemPackages = with pkgs; [btrfs-progs btrbk];
+      environment.systemPackages = with pkgs; [
+        btrfs-progs
+        btrbk
+      ];
 
-    networking.firewall.enable = true;
+      networking.firewall.enable = true;
 
-    systemd.services."bkp-sync" = {
+      systemd.services."bkp-sync" = {
-      enable = true;
+        enable = true;
-      description = "bkp-sync service";
+        description = "bkp-sync service";
 
-      serviceConfig = {Type = "oneshot";};
+        serviceConfig = {
+          Type = "oneshot";
+        };
 
-      after = ["bkp-run.service"];
+        after = [ "bkp-run.service" ];
 
-      requires = ["bkp-run.service"];
+        requires = [ "bkp-run.service" ];
 
-      path = with pkgs; [utillinux];
+        path = with pkgs; [ utillinux ];
-      script = ''
+        script = ''
-        set -x
+          set -x
-        true
+          true
-      '';
-    };
-
-    systemd.services."bkp-run" = {
-      enable = true;
-      description = "bkp-run";
-
-      serviceConfig = {Type = "oneshot";};
-
-      partOf = ["bkp-sync.service"];
-
-      path = with pkgs; [btrfs-progs btrbk coreutils];
-
-      script = let
-        btrbkConf = pkgs.writeText "cfg" ''
-          timestamp_format long
-          ssh_identity ${passwords.storage.backupTarget.keyPath}
-          ssh_user ${passwords.storage.backupTarget.user}
-          ssh_compression no
-          backend_remote btrfs-progs-sudo
-          compat_remote busybox
-          btrfs_commit_delete each
-          snapshot_create onchange
-          snapshot_preserve_min latest
-          snapshot_preserve 7d 4w
-          target_preserve_min latest
-          target_preserve 7d 4w 12m *y
-
-          volume ${subvolumeParentDir}
-            target ${passwords.storage.backupTarget.target}/container-volumes/${targetPathSuffix}
-          ${builtins.foldl' (sum: elem: sum + "  subvolume " + elem + "\n") ""
-            subvolumes}
         '';
-      in ''
+      };
-        #! ${pkgs.bash}/bin/bash
-        set -Eeuxo pipefail
 
-        btrbk -c ${btrbkConf} --progress ''${@:-run}
+      systemd.services."bkp-run" = {
-      '';
+        enable = true;
-    };
+        description = "bkp-run";
 
-    systemd.timers."bkp" = {
+        serviceConfig = {
-      description = "Timer to trigger bkp periodically";
+          Type = "oneshot";
-      enable = true;
+        };
-      wantedBy = ["timer.target" "multi-user.target"];
+
-      timerConfig = {
+        partOf = [ "bkp-sync.service" ];
-        # Obtained using `systemd-analyze calendar "Wed 23:00"`
+
-        # OnCalendar = "Wed *-*-* 23:00:00";
+        path = with pkgs; [
-        OnStartupSec = "1m";
+          btrfs-progs
-        Unit = "bkp-sync.service";
+          btrbk
-        OnUnitInactiveSec = "2h";
+          coreutils
-        Persistent = "true";
+        ];
+
+        script =
+          let
+            btrbkConf = pkgs.writeText "cfg" ''
+              timestamp_format long
+              ssh_identity ${passwords.storage.backupTarget.keyPath}
+              ssh_user ${passwords.storage.backupTarget.user}
+              ssh_compression no
+              backend_remote btrfs-progs-sudo
+              compat_remote busybox
+              btrfs_commit_delete each
+              snapshot_create onchange
+              snapshot_preserve_min latest
+              snapshot_preserve 7d 4w
+              target_preserve_min latest
+              target_preserve 7d 4w 12m *y
+
+              volume ${subvolumeParentDir}
+                target ${passwords.storage.backupTarget.target}/container-volumes/${targetPathSuffix}
+              ${builtins.foldl' (sum: elem: sum + "  subvolume " + elem + "\n") "" subvolumes}
+            '';
+          in
+          ''
+            #! ${pkgs.bash}/bin/bash
+            set -Eeuxo pipefail
+
+            btrbk -c ${btrbkConf} --progress ''${@:-run}
+          '';
+      };
+
+      systemd.timers."bkp" = {
+        description = "Timer to trigger bkp periodically";
+        enable = true;
+        wantedBy = [
+          "timer.target"
+          "multi-user.target"
+        ];
+        timerConfig = {
+          # Obtained using `systemd-analyze calendar "Wed 23:00"`
+          # OnCalendar = "Wed *-*-* 23:00:00";
+          OnStartupSec = "1m";
+          Unit = "bkp-sync.service";
+          OnUnitInactiveSec = "2h";
+          Persistent = "true";
+        };
       };
     };
-  };
 
   inherit autoStart;
 
@@ -114,10 +133,10 @@ in {
     }
   ];
 
-  extraFlags = ["--resolv-conf=bind-host"];
+  extraFlags = [ "--resolv-conf=bind-host" ];
 
   privateNetwork = true;
-  forwardPorts = [];
+  forwardPorts = [ ];
 
   inherit hostAddress localAddress;
 }

nix/os/containers/mailserver.nix

@@ -6,198 +6,207 @@
   imapsPort ? 993,
   sievePort ? 4190,
   autoStart ? false,
-}: {
+}:
+{
   inherit specialArgs;
-  config = {
+  config =
-    pkgs,
+    {
-    config,
+      pkgs,
-    lib,
+      config,
-    repoFlake,
+      lib,
-    ...
+      repoFlake,
-  }: {
+      ...
-    system.stateVersion = "22.05"; # Did you read the comment?
+    }:
+    {
+      system.stateVersion = "22.05"; # Did you read the comment?
 
-    imports = [
+      imports = [
-      ../profiles/containers/configuration.nix
+        ../profiles/containers/configuration.nix
 
-      repoFlake.inputs.sops-nix.nixosModules.sops
+        repoFlake.inputs.sops-nix.nixosModules.sops
-      ../profiles/common/user.nix
+        ../profiles/common/user.nix
-    ];
+      ];
 
-    networking.firewall.allowedTCPPorts = [
+      networking.firewall.allowedTCPPorts = [
-      imapsPort
+        imapsPort
-      sievePort
+        sievePort
-    ];
+      ];
 
-    # FIXME: find out how to use the `defaultSopsFile` so i don't have to specify each secret separately
+      # FIXME: find out how to use the `defaultSopsFile` so i don't have to specify each secret separately
-    # sops.defaultSopsFile = ./mailserver_secrets.yaml;
+      # sops.defaultSopsFile = ./mailserver_secrets.yaml;
 
-    sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+      sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-    sops.secrets.email_mailStefanjunkerDe = {
+      sops.secrets.email_mailStefanjunkerDe = {
-      sopsFile = ./mailserver_secrets.yaml;
+        sopsFile = ./mailserver_secrets.yaml;
-      owner = config.users.users.steveej.name;
+        owner = config.users.users.steveej.name;
-    };
+      };
-    sops.secrets.email_mailStefanjunkerDeHetzner = {
+      sops.secrets.email_mailStefanjunkerDeHetzner = {
-      sopsFile = ./mailserver_secrets.yaml;
+        sopsFile = ./mailserver_secrets.yaml;
-      owner = config.users.users.steveej.name;
+        owner = config.users.users.steveej.name;
-    };
+      };
-    sops.secrets.email_schtifATwebDe = {
+      sops.secrets.email_schtifATwebDe = {
-      sopsFile = ./mailserver_secrets.yaml;
+        sopsFile = ./mailserver_secrets.yaml;
-      owner = config.users.users.steveej.name;
+        owner = config.users.users.steveej.name;
-    };
+      };
-    sops.secrets.email_dovecot_steveej = {
+      sops.secrets.email_dovecot_steveej = {
-      sopsFile = ./mailserver_secrets.yaml;
+        sopsFile = ./mailserver_secrets.yaml;
-      owner = config.users.users.dovecot2.name;
+        owner = config.users.users.dovecot2.name;
-    };
+      };
 
-    # TODO: switch to something other than ddclient as it's no longer maintained
+      # TODO: switch to something other than ddclient as it's no longer maintained
 
-    # TODO: switch to a let's encrypt certificate
+      # TODO: switch to a let's encrypt certificate
-    sops.secrets.dovecotSslServerCert = {
+      sops.secrets.dovecotSslServerCert = {
-      sopsFile = ./mailserver_secrets.yaml;
+        sopsFile = ./mailserver_secrets.yaml;
-      owner = config.users.users.dovecot2.name;
+        owner = config.users.users.dovecot2.name;
-    };
+      };
-    sops.secrets.dovecotSslServerKey = {
+      sops.secrets.dovecotSslServerKey = {
-      sopsFile = ./mailserver_secrets.yaml;
+        sopsFile = ./mailserver_secrets.yaml;
-      owner = config.users.users.dovecot2.name;
+        owner = config.users.users.dovecot2.name;
-    };
+      };
-    services.dovecot2 = {
+      services.dovecot2 = {
-      enable = true;
+        enable = true;
 
-      modules = [pkgs.dovecot_pigeonhole];
+        modules = [ pkgs.dovecot_pigeonhole ];
-      protocols = ["sieve"];
+        protocols = [ "sieve" ];
 
-      enableImap = true;
+        enableImap = true;
-      enableLmtp = true;
+        enableLmtp = true;
-      enablePAM = true;
+        enablePAM = true;
-      showPAMFailure = true;
+        showPAMFailure = true;
-      mailLocation = "maildir:~/.maildir";
+        mailLocation = "maildir:~/.maildir";
-      sslServerCert = config.sops.secrets.dovecotSslServerCert.path;
+        sslServerCert = config.sops.secrets.dovecotSslServerCert.path;
-      sslServerKey = config.sops.secrets.dovecotSslServerKey.path;
+        sslServerKey = config.sops.secrets.dovecotSslServerKey.path;
 
-      #configFile = "/etc/dovecot/dovecot2_manual.conf";
+        #configFile = "/etc/dovecot/dovecot2_manual.conf";
-      extraConfig = ''
+        extraConfig = ''
-        auth_mechanisms = cram-md5 digest-md5
+          auth_mechanisms = cram-md5 digest-md5
-        auth_verbose = yes
+          auth_verbose = yes
 
-        passdb {
+          passdb {
-          driver = passwd-file
+            driver = passwd-file
-          args = scheme=CRYPT username_format=%u /etc/dovecot/users
+            args = scheme=CRYPT username_format=%u /etc/dovecot/users
-        }
+          }
 
-        protocol lda {
+          protocol lda {
-          postmaster_address = "mail@stefanjunker.de"
+            postmaster_address = "mail@stefanjunker.de"
-          mail_plugins = $mail_plugins sieve
+            mail_plugins = $mail_plugins sieve
-        }
+          }
 
-        protocol imap {
+          protocol imap {
-          mail_max_userip_connections = 64
+            mail_max_userip_connections = 64
-        }
+          }
-      '';
-    };
-
-    environment.etc."dovecot/users".source = config.sops.secrets.email_dovecot_steveej.path;
-
-    systemd.services.steveej-getmail-stefanjunker = {
-      enable = true;
-      wantedBy = ["multi-user.target"];
-      serviceConfig.User = "steveej";
-      serviceConfig.Group = "dovecot2";
-      serviceConfig.RestartSec = 600;
-      serviceConfig.Restart = "always";
-      description = "Getmail service";
-      path = [pkgs.getmail6];
-      script = let
-        rc = pkgs.writeText "mailATstefanjunker.de.getmail.rc" ''
-          [options]
-          verbose = 1
-          read_all = 0
-          delete_after = 30
-
-          [retriever]
-          type = SimpleIMAPSSLRetriever
-          server = ssl0.ovh.net
-          port = 993
-          username = mail@stefanjunker.de
-          password_command = ("${pkgs.coreutils}/bin/cat", "${config.sops.secrets.email_mailStefanjunkerDe.path}")
-          mailboxes = ('INBOX',)
-
-          [destination]
-          type = MDA_external
-          path = ${pkgs.dovecot}/libexec/dovecot/dovecot-lda
         '';
-      in ''
+      };
-        getmail --idle=INBOX --rcfile=${rc}
+
-      '';
+      environment.etc."dovecot/users".source = config.sops.secrets.email_dovecot_steveej.path;
+
+      systemd.services.steveej-getmail-stefanjunker = {
+        enable = true;
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig.User = "steveej";
+        serviceConfig.Group = "dovecot2";
+        serviceConfig.RestartSec = 600;
+        serviceConfig.Restart = "always";
+        description = "Getmail service";
+        path = [ pkgs.getmail6 ];
+        script =
+          let
+            rc = pkgs.writeText "mailATstefanjunker.de.getmail.rc" ''
+              [options]
+              verbose = 1
+              read_all = 0
+              delete_after = 30
+
+              [retriever]
+              type = SimpleIMAPSSLRetriever
+              server = ssl0.ovh.net
+              port = 993
+              username = mail@stefanjunker.de
+              password_command = ("${pkgs.coreutils}/bin/cat", "${config.sops.secrets.email_mailStefanjunkerDe.path}")
+              mailboxes = ('INBOX',)
+
+              [destination]
+              type = MDA_external
+              path = ${pkgs.dovecot}/libexec/dovecot/dovecot-lda
+            '';
+          in
+          ''
+            getmail --idle=INBOX --rcfile=${rc}
+          '';
+      };
+
+      systemd.services.steveej-getmail-stefanjunker-hetzner = {
+        enable = true;
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig.User = "steveej";
+        serviceConfig.Group = "dovecot2";
+        serviceConfig.RestartSec = 60;
+        serviceConfig.Restart = "always";
+        description = "Getmail service";
+        path = [ pkgs.getmail6 ];
+        script =
+          let
+            rc = pkgs.writeText "mailATstefanjunker.de.getmail.rc" ''
+              [options]
+              verbose = 2
+              read_all = 0
+              delete_after = 30
+
+              [retriever]
+              type = SimpleIMAPSSLRetriever
+              server = mail.your-server.de
+              port = 993
+              username = mail@stefanjunker.de
+              password_command = ("${pkgs.coreutils}/bin/cat", "${config.sops.secrets.email_mailStefanjunkerDeHetzner.path}")
+              mailboxes = ('INBOX',)
+
+              [destination]
+              type = MDA_external
+              path = ${pkgs.dovecot}/libexec/dovecot/dovecot-lda
+            '';
+          in
+          ''
+            getmail --rcfile=${rc} --idle=INBOX
+          '';
+      };
+
+      systemd.services.steveej-getmail-webde = {
+        enable = true;
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig.User = "steveej";
+        serviceConfig.Group = "dovecot2";
+        description = "Getmail service";
+        path = [ pkgs.getmail6 ];
+        serviceConfig.RestartSec = 1000;
+        serviceConfig.Restart = "always";
+        script =
+          let
+            rc = pkgs.writeText "schtifATweb.de.getmail.rc" ''
+              [options]
+              verbose = 1
+              read_all = 0
+              delete_after = 30
+
+              [retriever]
+              type = SimpleIMAPSSLRetriever
+              server = imap.web.de
+              port = 993
+              username = schtif
+              password_command = ("${pkgs.coreutils}/bin/cat", "${config.sops.secrets.email_schtifATwebDe.path}")
+              mailboxes = ('INBOX',)
+
+              [destination]
+              type = Maildir
+              path = ~/.maildir/
+            '';
+          in
+          ''
+            getmail --rcfile=${rc} --idle=INBOX
+          '';
+      };
     };
 
-    systemd.services.steveej-getmail-stefanjunker-hetzner = {
-      enable = true;
-      wantedBy = ["multi-user.target"];
-      serviceConfig.User = "steveej";
-      serviceConfig.Group = "dovecot2";
-      serviceConfig.RestartSec = 60;
-      serviceConfig.Restart = "always";
-      description = "Getmail service";
-      path = [pkgs.getmail6];
-      script = let
-        rc = pkgs.writeText "mailATstefanjunker.de.getmail.rc" ''
-          [options]
-          verbose = 2
-          read_all = 0
-          delete_after = 30
-
-          [retriever]
-          type = SimpleIMAPSSLRetriever
-          server = mail.your-server.de
-          port = 993
-          username = mail@stefanjunker.de
-          password_command = ("${pkgs.coreutils}/bin/cat", "${config.sops.secrets.email_mailStefanjunkerDeHetzner.path}")
-          mailboxes = ('INBOX',)
-
-          [destination]
-          type = MDA_external
-          path = ${pkgs.dovecot}/libexec/dovecot/dovecot-lda
-        '';
-      in ''
-        getmail --rcfile=${rc} --idle=INBOX
-      '';
-    };
-
-    systemd.services.steveej-getmail-webde = {
-      enable = true;
-      wantedBy = ["multi-user.target"];
-      serviceConfig.User = "steveej";
-      serviceConfig.Group = "dovecot2";
-      description = "Getmail service";
-      path = [pkgs.getmail6];
-      serviceConfig.RestartSec = 1000;
-      serviceConfig.Restart = "always";
-      script = let
-        rc = pkgs.writeText "schtifATweb.de.getmail.rc" ''
-          [options]
-          verbose = 1
-          read_all = 0
-          delete_after = 30
-
-          [retriever]
-          type = SimpleIMAPSSLRetriever
-          server = imap.web.de
-          port = 993
-          username = schtif
-          password_command = ("${pkgs.coreutils}/bin/cat", "${config.sops.secrets.email_schtifATwebDe.path}")
-          mailboxes = ('INBOX',)
-
-          [destination]
-          type = Maildir
-          path = ~/.maildir/
-        '';
-      in ''
-        getmail --rcfile=${rc} --idle=INBOX
-      '';
-    };
-  };
-
   inherit autoStart;
 
   bindMounts = {

nix/os/containers/mycelium/flake.nix

@@ -11,350 +11,366 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
-  outputs = {
+  outputs =
-    self,
+    {
-    nixpkgs,
+      self,
-    nixos-generators,
+      nixpkgs,
-    ...
+      nixos-generators,
-  }: let
+      ...
-    systems = [
+    }:
-      "aarch64-linux"
+    let
-      "x86_64-linux"
+      systems = [
-    ];
+        "aarch64-linux"
-    forAllSystems = nixpkgs.lib.genAttrs systems;
+        "x86_64-linux"
-  in {
+      ];
-    nixosConfigurations.default =
+      forAllSystems = nixpkgs.lib.genAttrs systems;
-      nixpkgs.lib.nixosSystem
+    in
-      {
+    {
+      nixosConfigurations.default = nixpkgs.lib.nixosSystem {
         system = "aarch64-linux";
 
-        specialArgs = {};
+        specialArgs = { };
 
         modules = [
-          ({
+          (
-            config,
+            {
-            modulesPath,
+              config,
-            pkgs,
+              modulesPath,
-            lib,
+              pkgs,
-            ...
+              lib,
-          }: {
+              ...
-            nixpkgs.overlays = [
+            }:
-              (final: previous: {
+            {
-                # inherit (self.inputs.nixpkgs-systemd256.legacyPackages.${pkgs.system}) systemd systemdMinimal;
+              nixpkgs.overlays = [
-                # systemd =
+                (final: previous: {
-                # self.inputs.nixpkgs-systemd256.legacyPackages.${pkgs.system}.systemd.overrideAttrs (prevAttrs: {
+                  # inherit (self.inputs.nixpkgs-systemd256.legacyPackages.${pkgs.system}) systemd systemdMinimal;
-                #   src = /home/steveej/src/others/systemd;
+                  # systemd =
+                  # self.inputs.nixpkgs-systemd256.legacyPackages.${pkgs.system}.systemd.overrideAttrs (prevAttrs: {
+                  #   src = /home/steveej/src/others/systemd;
 
-                #   withAppArmor = false;
+                  #   withAppArmor = false;
-                #   withRepart = false;
+                  #   withRepart = false;
-                #   withHomed = false;
+                  #   withHomed = false;
-                #   withAcl = false;
+                  #   withAcl = false;
-                #   withEfi = false;
+                  #   withEfi = false;
-                #   withBootloader = false;
+                  #   withBootloader = false;
-                #   withCryptsetup = false;
+                  #   withCryptsetup = false;
-                #   withLibBPF = false;
+                  #   withLibBPF = false;
-                #   withOomd = false;
+                  #   withOomd = false;
-                #   withFido2 = false;
+                  #   withFido2 = false;
-                #   withApparmor = false;
+                  #   withApparmor = false;
-                #   withDocumentation = false;
+                  #   withDocumentation = false;
-                #   withUtmp = false;
+                  #   withUtmp = false;
-                #   withQrencode = false;
+                  #   withQrencode = false;
-                #   withVmspawn = false;
+                  #   withVmspawn = false;
-                #   withMachined = false;
+                  #   withMachined = false;
-                #   withLogTrace = true;
+                  #   withLogTrace = true;
-                #   withArchive = false;
+                  #   withArchive = false;
-                #   # don't need these but cause errors for exampel files not found
+                  #   # don't need these but cause errors for exampel files not found
-                #   # withLogind = false;
+                  #   # withLogind = false;
-                # })
+                  # })
-                # pkgs.systemdMinimal.override {
+                  # pkgs.systemdMinimal.override {
-                #   # getting errors with these disabled
+                  #   # getting errors with these disabled
-                #   withCoredump = true;
+                  #   withCoredump = true;
-                #   withCompression = true;
+                  #   withCompression = true;
-                #   withLogind = true;
+                  #   withLogind = true;
-                #   withSysusers = true;
+                  #   withSysusers = true;
-                #   withUserDb = true;
+                  #   withUserDb = true;
-                # }
+                  # }
-                # pkgs.systemdMinimal
+                  # pkgs.systemdMinimal
-                # pkgs.systemd.override {
+                  # pkgs.systemd.override {
-                #   withRepart = false;
+                  #   withRepart = false;
-                #   withHomed = false;
+                  #   withHomed = false;
-                #   withAcl = false;
+                  #   withAcl = false;
-                #   withEfi = false;
+                  #   withEfi = false;
-                #   withBootloader = false;
+                  #   withBootloader = false;
-                #   withCryptsetup = false;
+                  #   withCryptsetup = false;
-                #   withLibBPF = false;
+                  #   withLibBPF = false;
-                #   withOomd = false;
+                  #   withOomd = false;
-                #   withFido2 = false;
+                  #   withFido2 = false;
-                #   withApparmor = false;
+                  #   withApparmor = false;
-                #   withDocumentation = false;
+                  #   withDocumentation = false;
-                #   withUtmp = false;
+                  #   withUtmp = false;
-                #   withQrencode = false;
+                  #   withQrencode = false;
-                #   withVmspawn = false;
+                  #   withVmspawn = false;
-                #   withMachined = false;
+                  #   withMachined = false;
-                #   withLogTrace = true;
+                  #   withLogTrace = true;
-                #   # don't need these but cause errors for exampel files not found
+                  #   # don't need these but cause errors for exampel files not found
-                #   # withLogind = false;
+                  #   # withLogind = false;
-                # }
+                  # }
-                # ;
+                  # ;
-              })
+                })
-            ];
+              ];
 
-            imports = [
+              imports = [ (modulesPath + "/profiles/minimal.nix") ];
-              (modulesPath + "/profiles/minimal.nix")
+              system.stateVersion = "24.11";
-            ];
-            system.stateVersion = "24.11";
 
-            # https://github.com/hercules-ci/arion/blob/c24c185e67f093298a081900b49ca18716077dec/src/nix/modules/nixos/container-systemd.nix
+              # https://github.com/hercules-ci/arion/blob/c24c185e67f093298a081900b49ca18716077dec/src/nix/modules/nixos/container-systemd.nix
-            boot.isContainer = true;
+              boot.isContainer = true;
-            # boot.tmp.useTmpfs = true;
+              # boot.tmp.useTmpfs = true;
-            boot.loader.grub.enable = lib.mkForce false;
+              boot.loader.grub.enable = lib.mkForce false;
-            boot.loader.systemd-boot.enable = lib.mkForce false;
+              boot.loader.systemd-boot.enable = lib.mkForce false;
-            services.journald.console = "/dev/console";
+              services.journald.console = "/dev/console";
-            services.journald.storage = "none";
+              services.journald.storage = "none";
-            # boot.specialFileSystems = lib.mkForce {};
+              # boot.specialFileSystems = lib.mkForce {};
 
-            services.nscd.enable = false;
+              services.nscd.enable = false;
-            system.nssModules = lib.mkForce [];
+              system.nssModules = lib.mkForce [ ];
-            systemd.services.systemd-logind.enable = false;
+              systemd.services.systemd-logind.enable = false;
-            systemd.services.console-getty.enable = false;
+              systemd.services.console-getty.enable = false;
 
-            systemd.sockets.nix-daemon.enable = false;
+              systemd.sockets.nix-daemon.enable = false;
-            systemd.services.nix-daemon.enable = false;
+              systemd.services.nix-daemon.enable = false;
-            systemd.oomd.enable = false;
+              systemd.oomd.enable = false;
-            networking.useDHCP = false;
+              networking.useDHCP = false;
-            networking.firewall.enable = false;
+              networking.firewall.enable = false;
 
-            # system.build.earlyMountScript =
+              # system.build.earlyMountScript =
-            #   lib.mkForce ''
+              #   lib.mkForce ''
-            #   '';
+              #   '';
-            # system.activationScripts.specialfs =
+              # system.activationScripts.specialfs =
-            #   lib.mkForce ''
+              #   lib.mkForce ''
-            #   '';
+              #   '';
-            boot.postBootCommands = ''
+              boot.postBootCommands = ''
-              ls -lha /run
+                ls -lha /run
-              mkdir -p /run/wrappers
+                mkdir -p /run/wrappers
-            '';
+              '';
 
-            boot.kernelParams = [
+              boot.kernelParams = [ "systemd.log_level=debug" ];
-              "systemd.log_level=debug"
-            ];
 
-            # services.udev.enable = false;
+              # services.udev.enable = false;
 
-            # TODO: this is only needed because `/run/current-system` is missing
+              # TODO: this is only needed because `/run/current-system` is missing
-            # environment.variables.PATH = "${lib.makeBinPath config.environment.systemPackages}:$PATH";
+              # environment.variables.PATH = "${lib.makeBinPath config.environment.systemPackages}:$PATH";
 
-            systemd.mounts = lib.mkForce [];
+              systemd.mounts = lib.mkForce [ ];
-            fileSystems = lib.mkForce {};
+              fileSystems = lib.mkForce { };
 
-            services.mycelium.enable = false;
+              services.mycelium.enable = false;
-            services.mycelium.keyFile = "/var/lib/secrets/mycelium-keyfile";
+              services.mycelium.keyFile = "/var/lib/secrets/mycelium-keyfile";
-            systemd.services.mycelium.serviceConfig.DynamicUser = lib.mkForce false;
+              systemd.services.mycelium.serviceConfig.DynamicUser = lib.mkForce false;
-            systemd.services.mycelium.serviceConfig.User = lib.mkForce "root";
+              systemd.services.mycelium.serviceConfig.User = lib.mkForce "root";
-            systemd.services.mycelium.serviceConfig.ExecStart = lib.mkForce (pkgs.writeShellScript "mycelium" ''
+              systemd.services.mycelium.serviceConfig.ExecStart = lib.mkForce (
-              while true; do
+                pkgs.writeShellScript "mycelium" ''
-                ls -lha $CREDENTIALS_DIRECTORY
-                sleep 5
-              done
-            '');
-
-            systemd.services.testing-credentials = {
-              wantedBy = ["multi-user.target"];
-              path = [pkgs.coreutils];
-
-              serviceConfig = {
-                # SyslogIdentifier = "testing-credentials";
-                # StateDirectory = "testing-credentials";
-                # DynamicUser = true;
-                # User = "tc";
-                # ProtectHome = true;
-                # ProtectSystem = true;
-                # LoadCredential = [
-                #   "mycelium-keyfile:${self.nixosConfigurations.default.config.services.mycelium.keyFile}"
-                #   "hosts:/etc/hosts"
-                # ];
-                SetCredential = "mycelium-keyfile:not secret string";
-                ExecStart = lib.mkForce (pkgs.writeShellScript "mycelium" ''
-                  cd $STATE_DIRECTORY
-                  pwd
-                  env
                   while true; do
                     ls -lha $CREDENTIALS_DIRECTORY
                     sleep 5
                   done
-                '');
+                ''
-              };
+              );
-            };
 
-            services.caddy = {
+              systemd.services.testing-credentials = {
-              enable = true;
+                wantedBy = [ "multi-user.target" ];
-              globalConfig = ''
+                path = [ pkgs.coreutils ];
-                auto_https off
+
-              '';
+                serviceConfig = {
-              virtualHosts.":80" = {
+                  # SyslogIdentifier = "testing-credentials";
-                extraConfig = ''
+                  # StateDirectory = "testing-credentials";
-                  respond "hello from ${config.networking.hostName}"
+                  # DynamicUser = true;
+                  # User = "tc";
+                  # ProtectHome = true;
+                  # ProtectSystem = true;
+                  # LoadCredential = [
+                  #   "mycelium-keyfile:${self.nixosConfigurations.default.config.services.mycelium.keyFile}"
+                  #   "hosts:/etc/hosts"
+                  # ];
+                  SetCredential = "mycelium-keyfile:not secret string";
+                  ExecStart = lib.mkForce (
+                    pkgs.writeShellScript "mycelium" ''
+                      cd $STATE_DIRECTORY
+                      pwd
+                      env
+                      while true; do
+                        ls -lha $CREDENTIALS_DIRECTORY
+                        sleep 5
+                      done
+                    ''
+                  );
+                };
+              };
+
+              services.caddy = {
+                enable = true;
+                globalConfig = ''
+                  auto_https off
                 '';
+                virtualHosts.":80" = {
+                  extraConfig = ''
+                    respond "hello from ${config.networking.hostName}"
+                  '';
+                };
               };
-            };
-          })
-        ];
-      };
-    packages = forAllSystems (system: let
-      name = "mycelium";
-      inherit (self.inputs) nix-snapshotter;
-
-      config = {
-        entrypoint = "${self.nixosConfigurations.default.config.system.build.toplevel}/init";
-        # port = 2379;
-        args = [
-        ];
-        # nodePort = 30001;
-      };
-
-      myceliumPorts = {
-        tcp = [9651];
-        udp = [9650 9651];
-      };
-
-      inherit
-        (config)
-        entrypoint
-        # port
-        
-        args
-        # nodePort
-        
-        ;
-
-      pkgs = import nixpkgs {
-        overlays = [nix-snapshotter.overlays.default];
-      };
-
-      image = pkgs.nix-snapshotter.buildImage {
-        inherit name;
-        resolvedByNix = true;
-        config = {
-          entrypoint = [entrypoint];
-          env = [
-            # this is read by the `/init` script and prevents various incompatible commands like mount, etc.
-            # the value of this doesn't seem to matter as long as it's not an empty string.
-            "container=nerd"
-            "SYSTEMD_LOG_LEVEL=debug"
-          ];
-          volumes = {
-            # "/var/lib/private/mycelium/key.bin" = {};
-            # "/run" = {};
-            # "/tmp" = {};
-            # "/etc" = {};
-          };
-          copyToRoot = [
-            # self.nixosConfigurations.default.config.system.build.toplevel
-          ];
-        };
-      };
-    in {
-      k8s = let
-        pod = pkgs.writeText "${name}-pod.json" (builtins.toJSON {
-          apiVersion = "v1";
-          kind = "Pod";
-          metadata = {
-            inherit name;
-            labels = {inherit name;};
-          };
-          spec.containers = [
-            {
-              inherit name args;
-              image = "nix:0${image}";
-              ports = [
-                {
-                  name = "mycelium-tcp-0";
-                  containerPort = builtins.elemAt myceliumPorts.tcp 0;
-                }
-                {
-                  name = "mycelium-udp-0";
-                  protocol = "UDP";
-                  containerPort = builtins.elemAt myceliumPorts.udp 0;
-                }
-                {
-                  name = "mycelium-udp-1";
-                  protocol = "UDP";
-                  containerPort = builtins.elemAt myceliumPorts.udp 1;
-                }
-              ];
             }
-          ];
+          )
-        });
+        ];
+      };
+      packages = forAllSystems (
+        system:
+        let
+          name = "mycelium";
+          inherit (self.inputs) nix-snapshotter;
 
-        service = pkgs.writeText "${name}-service.json" (builtins.toJSON {
+          config = {
-          apiVersion = "v1";
+            entrypoint = "${self.nixosConfigurations.default.config.system.build.toplevel}/init";
-          kind = "Service";
+            # port = 2379;
-          metadata.name = "${name}-service";
+            args = [ ];
-          spec = {
+            # nodePort = 30001;
-            type = "NodePort";
+          };
-            selector = {inherit name;};
+
-            ports = [
+          myceliumPorts = {
-              {
+            tcp = [ 9651 ];
-                name = "mycelium-tcp-0";
+            udp = [
-                port = builtins.elemAt myceliumPorts.tcp 0 + 50000;
+              9650
-                targetPort = "mycelium-tcp-0";
+              9651
-              }
-              {
-                name = "mycelium-udp-0";
-                protocol = "UDP";
-                port = builtins.elemAt myceliumPorts.udp 0 + 50000;
-                targetPort = "mycelium-udp-0";
-              }
-              {
-                name = "mycelium-udp-1";
-                protocol = "UDP";
-                port = builtins.elemAt myceliumPorts.udp 1 + 50000;
-                targetPort = "mycelium-udp-1";
-              }
             ];
           };
-        });
-      in
-        pkgs.runCommand "declarative-k8s" {} ''
-          mkdir -p $out/share/k8s
-          cp ${pod} $out/share/k8s/
-          cp ${service} $out/share/k8s/
-        '';
 
-      inherit image;
+          inherit (config)
+            entrypoint
+            # port
 
-      start = pkgs.writeShellApplication {
+            args
-        name = "start";
+            # nodePort
-        text = ''
-          set -x
-          rm -rf ./result
-          nix build --impure .#image
-          sudo nix2container load ./result
-          sudo -E nerdctl run  --name ${name} --privileged -dt \
-            --cgroup-manager cgroupfs \
-            --volume "$PWD/key.bin.crypt:${self.nixosConfigurations.default.config.services.mycelium.keyFile}:ro" \
-            "nix:0$(readlink result):latest"
-        '';
-      };
 
-      stop = pkgs.writeShellApplication {
+            ;
-        name = "stop";
-        text = ''
-          set +e
-          sudo -E nerdctl stop -t 60 ${name}
-          sudo -E nerdctl rm --force ${name}
-          sudo -E nerdctl system prune --all --force
-          sudo systemctl stop nix-snapshotter
-          sudo systemctl stop containerd
-          mount | rg -No '(/var/lib/container|/tmp/initial)[^ ]+' | tac | xargs sudo umount -l
-          sudo systemctl start containerd
-          sudo systemctl start nix-snapshotter
-        '';
 
-        # tmpfs on /run/credentials/mycelium.service type tmpfs (ro,nosuid,nodev,noexec,relatime,nosymfollow,size=1024k,nr_inodes=1024,mode=700,noswap)
+          pkgs = import nixpkgs { overlays = [ nix-snapshotter.overlays.default ]; };
 
-        # mount -t tmpfs tmpfs /run/credentials/mycelium.service -o ro,nosuid,nodev,noexec,relatime,nosymfollow,size=1024k,nr_inodes=1024,mode=700,noswap
+          image = pkgs.nix-snapshotter.buildImage {
-      };
+            inherit name;
-    });
+            resolvedByNix = true;
-  };
+            config = {
+              entrypoint = [ entrypoint ];
+              env = [
+                # this is read by the `/init` script and prevents various incompatible commands like mount, etc.
+                # the value of this doesn't seem to matter as long as it's not an empty string.
+                "container=nerd"
+                "SYSTEMD_LOG_LEVEL=debug"
+              ];
+              volumes = {
+                # "/var/lib/private/mycelium/key.bin" = {};
+                # "/run" = {};
+                # "/tmp" = {};
+                # "/etc" = {};
+              };
+              copyToRoot = [
+                # self.nixosConfigurations.default.config.system.build.toplevel
+              ];
+            };
+          };
+        in
+        {
+          k8s =
+            let
+              pod = pkgs.writeText "${name}-pod.json" (
+                builtins.toJSON {
+                  apiVersion = "v1";
+                  kind = "Pod";
+                  metadata = {
+                    inherit name;
+                    labels = {
+                      inherit name;
+                    };
+                  };
+                  spec.containers = [
+                    {
+                      inherit name args;
+                      image = "nix:0${image}";
+                      ports = [
+                        {
+                          name = "mycelium-tcp-0";
+                          containerPort = builtins.elemAt myceliumPorts.tcp 0;
+                        }
+                        {
+                          name = "mycelium-udp-0";
+                          protocol = "UDP";
+                          containerPort = builtins.elemAt myceliumPorts.udp 0;
+                        }
+                        {
+                          name = "mycelium-udp-1";
+                          protocol = "UDP";
+                          containerPort = builtins.elemAt myceliumPorts.udp 1;
+                        }
+                      ];
+                    }
+                  ];
+                }
+              );
+
+              service = pkgs.writeText "${name}-service.json" (
+                builtins.toJSON {
+                  apiVersion = "v1";
+                  kind = "Service";
+                  metadata.name = "${name}-service";
+                  spec = {
+                    type = "NodePort";
+                    selector = {
+                      inherit name;
+                    };
+                    ports = [
+                      {
+                        name = "mycelium-tcp-0";
+                        port = builtins.elemAt myceliumPorts.tcp 0 + 50000;
+                        targetPort = "mycelium-tcp-0";
+                      }
+                      {
+                        name = "mycelium-udp-0";
+                        protocol = "UDP";
+                        port = builtins.elemAt myceliumPorts.udp 0 + 50000;
+                        targetPort = "mycelium-udp-0";
+                      }
+                      {
+                        name = "mycelium-udp-1";
+                        protocol = "UDP";
+                        port = builtins.elemAt myceliumPorts.udp 1 + 50000;
+                        targetPort = "mycelium-udp-1";
+                      }
+                    ];
+                  };
+                }
+              );
+            in
+            pkgs.runCommand "declarative-k8s" { } ''
+              mkdir -p $out/share/k8s
+              cp ${pod} $out/share/k8s/
+              cp ${service} $out/share/k8s/
+            '';
+
+          inherit image;
+
+          start = pkgs.writeShellApplication {
+            name = "start";
+            text = ''
+              set -x
+              rm -rf ./result
+              nix build --impure .#image
+              sudo nix2container load ./result
+              sudo -E nerdctl run  --name ${name} --privileged -dt \
+                --cgroup-manager cgroupfs \
+                --volume "$PWD/key.bin.crypt:${self.nixosConfigurations.default.config.services.mycelium.keyFile}:ro" \
+                "nix:0$(readlink result):latest"
+            '';
+          };
+
+          stop = pkgs.writeShellApplication {
+            name = "stop";
+            text = ''
+              set +e
+              sudo -E nerdctl stop -t 60 ${name}
+              sudo -E nerdctl rm --force ${name}
+              sudo -E nerdctl system prune --all --force
+              sudo systemctl stop nix-snapshotter
+              sudo systemctl stop containerd
+              mount | rg -No '(/var/lib/container|/tmp/initial)[^ ]+' | tac | xargs sudo umount -l
+              sudo systemctl start containerd
+              sudo systemctl start nix-snapshotter
+            '';
+
+            # tmpfs on /run/credentials/mycelium.service type tmpfs (ro,nosuid,nodev,noexec,relatime,nosymfollow,size=1024k,nr_inodes=1024,mode=700,noswap)
+
+            # mount -t tmpfs tmpfs /run/credentials/mycelium.service -o ro,nosuid,nodev,noexec,relatime,nosymfollow,size=1024k,nr_inodes=1024,mode=700,noswap
+          };
+        }
+      );
+    };
 }

nix/os/containers/syncthing.nix

@@ -6,28 +6,27 @@
   syncthingPort ? 22000,
   syncthingLocalAnnouncePort ? 21027,
   autoStart ? false,
-}: {
+}:
+{
   inherit specialArgs;
-  config = {
+  config =
-    config,
+    { config, pkgs, ... }:
-    pkgs,
+    {
-    ...
+      system.stateVersion = "20.05"; # Did you read the comment?
-  }: {
-    system.stateVersion = "20.05"; # Did you read the comment?
 
-    imports = [../profiles/containers/configuration.nix];
+      imports = [ ../profiles/containers/configuration.nix ];
 
-    networking.firewall.allowedTCPPorts = [
+      networking.firewall.allowedTCPPorts = [
-      # syncthing gui
+        # syncthing gui
-      8384
+        8384
-    ];
+      ];
 
-    services.syncthing = {
+      services.syncthing = {
-      enable = true;
+        enable = true;
-      openDefaultPorts = true;
+        openDefaultPorts = true;
-      guiAddress = "0.0.0.0:8384";
+        guiAddress = "0.0.0.0:8384";
+      };
     };
-  };
 
   inherit autoStart;
 

nix/os/containers/webserver.nix

@@ -7,405 +7,417 @@
   httpsPort,
   forgejoSshPort,
   autoStart ? false,
-}: let
+}:
+let
   domain = "www.stefanjunker.de";
-in {
+in
+{
   inherit specialArgs;
-  config = {
+  config =
-    config,
+    {
-    pkgs,
+      config,
-    lib,
+      pkgs,
-    repoFlake,
+      lib,
-    nodeFlake,
+      repoFlake,
-    system,
+      nodeFlake,
-    ...
+      system,
-  }: {
+      ...
-    system.stateVersion = "22.05"; # Did you read the comment?
+    }:
+    {
+      system.stateVersion = "22.05"; # Did you read the comment?
 
-    disabledModules = [
+      disabledModules = [
-      "services/misc/forgejo.nix"
+        "services/misc/forgejo.nix"
-      "services/security/kanidm.nix"
+        "services/security/kanidm.nix"
-    ];
-
-    imports = [
-      "${nodeFlake.inputs.nixpkgs-unstable}/nixos/modules/services/misc/forgejo.nix"
-      "${repoFlake.inputs.nixpkgs-kanidm}/nixos/modules/services/security/kanidm.nix"
-
-      ../profiles/containers/configuration.nix
-
-      repoFlake.inputs.sops-nix.nixosModules.sops
-    ];
-
-    sops.defaultSopsFile = ./webserver_secrets.yaml;
-
-    networking.firewall.allowedTCPPorts = [
-      httpPort
-      httpsPort
-      forgejoSshPort
-    ];
-
-    sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
-    sops.secrets.hedgedoc_environment_file = {
-      sopsFile = ./webserver_secrets.yaml;
-      owner = config.users.users.hedgedoc.name;
-    };
-
-    services.caddy = {
-      enable = true;
-      logFormat = ''
-        level ERROR
-      '';
-      virtualHosts."${domain}" = {
-        extraConfig = ''
-          redir /hedgedoc* https://hedgedoc.${domain}
-
-          file_server /*/* {
-            browse
-            root /var/www/stefanjunker.de/htdocs/caddy
-            pass_thru
-          }
-
-          # respond "Hi"
-          # respond (not /*/*) "Hi"
-        '';
-      };
-
-      virtualHosts."hedgedoc.${domain}" = {
-        extraConfig = ''
-          reverse_proxy http://[::1]:3000
-        '';
-      };
-
-      virtualHosts."authelia.${domain}" = {
-        extraConfig = ''
-          reverse_proxy http://127.0.0.1:${builtins.toString config.services.authelia.instances.default.settings.server.port}
-        '';
-      };
-
-      virtualHosts."lldap.${domain}" = {
-        extraConfig = ''
-          reverse_proxy http://127.0.0.1:${builtins.toString config.services.lldap.settings.http_port}
-        '';
-      };
-
-      virtualHosts."forgejo.${domain}" = {
-        extraConfig = ''
-          reverse_proxy http://127.0.0.1:${builtins.toString config.services.forgejo.settings.server.HTTP_PORT}
-        '';
-      };
-
-      virtualHosts."kanidm.${domain}" = {
-        extraConfig = ''
-          reverse_proxy https://${builtins.toString config.services.kanidm.serverSettings.bindaddress} {
-            transport http {
-                tls_server_name ${config.services.kanidm.serverSettings.domain}
-            }
-          }
-        '';
-      };
-    };
-
-    services.hedgedoc = {
-      enable = true;
-      settings = {
-        domain = "hedgedoc.${domain}";
-        urlPath = "";
-        protocolUseSSL = true;
-        db = {
-          dialect = "sqlite";
-          storage = "/var/lib/hedgedoc/db.hedgedoc.sqlite";
-        };
-
-        allowAnonymous = false;
-        allowAnonymousEdits = false;
-        allowGravatar = false;
-        allowFreeURL = false;
-        defaultPermission = "private";
-
-        allowEmailRegister = false;
-        email = false;
-
-        ldap = {
-          url = "ldap://127.0.0.1:${builtins.toString config.services.lldap.settings.ldap_port}";
-          bindDn = "uid=admin,ou=people,dc=stefanjunker,dc=de";
-          # these are set via the `environmentFile`
-          # bindCredentials = "$LDAP_ADMIN_PASSWORD";
-          searchBase = "ou=people,dc=stefanjunker,dc=de";
-          searchFilter = "(&(memberOf=cn=hedgedoc,ou=groups,dc=stefanjunker,dc=de)(uid={{username}}))";
-          useridField = "uid";
-        };
-
-        oauth2 = let
-          originURL = config.services.kanidm.serverSettings.origin;
-        in {
-          providerName = "kanidm (${originURL})";
-
-          authorizationURL = "${originURL}/ui/oauth2";
-          tokenURL = "${originURL}/oauth2/token";
-          userProfileURL = "${originURL}/oauth2/openid/hedgedoc/userinfo";
-
-          scope = "openid email profile";
-          # rolesClaim = "roles";
-          # accessRole = "role/hedgedoc";
-
-          userProfileUsernameAttr = "name";
-          userProfileDisplayNameAttr = "displayname";
-          userProfileEmailAttr = "email";
-
-          clientID = "hedgedoc";
-          # set via the `environmentFile`
-          # clientSecret = "$CMD_OAUTH2_CLIENT_SECRET";
-        };
-
-        uploadsPath = "/var/lib/hedgedoc/uploads";
-      };
-
-      environmentFile = config.sops.secrets.hedgedoc_environment_file.path;
-    };
-
-    services.jitsi-meet = {
-      enable = false;
-      hostName = "meet.${domain}";
-      config = {
-        prejoinPageEnabled = true;
-      };
-      caddy.enable = true;
-      nginx.enable = false;
-    };
-
-    sops.secrets.authelia_storageEncryptionKey = {
-      sopsFile = ./webserver_secrets.yaml;
-      owner = config.users.users.authelia-default.name;
-    };
-
-    sops.secrets.authelia_jwtSecret = {
-      sopsFile = ./webserver_secrets.yaml;
-      owner = config.users.users.authelia-default.name;
-    };
-
-    services.authelia.instances.default = let
-      baseDir = "/var/lib/authelia-default";
-    in {
-      enable = true;
-      secrets.storageEncryptionKeyFile = config.sops.secrets.authelia_storageEncryptionKey.path;
-      secrets.jwtSecretFile = config.sops.secrets.authelia_jwtSecret.path;
-      settings = {
-        theme = "auto";
-        default_2fa_method = "totp";
-        log.level = "debug";
-
-        server = {
-          disable_healthcheck = true;
-          host = "127.0.0.1";
-          port = 9091;
-          # path = "authelia";
-        };
-
-        storage = {
-          local.path = "${baseDir}/authelia.sqlite";
-        };
-
-        authentication_backend = {
-          file.path = "${baseDir}/first_factor.yaml";
-          file.search.email = true;
-          file.search.case_insensitive = false;
-        };
-
-        access_control = {
-          default_policy = "one_factor";
-        };
-
-        session.domain = "stefanjunker.de";
-
-        notifier = {
-          disable_startup_check = true;
-          filesystem.filename = "${baseDir}/notification.txt";
-        };
-      };
-    };
-
-    users.groups.lldap = {};
-    users.users.lldap = {
-      isSystemUser = true;
-      group = "lldap";
-    };
-
-    sops.secrets.lldap_jwtSecret = {
-      sopsFile = ./webserver_secrets.yaml;
-      owner = config.users.users.lldap.name;
-    };
-
-    sops.secrets.lldap_adminPassword = {
-      sopsFile = ./webserver_secrets.yaml;
-      owner = config.users.users.lldap.name;
-    };
-
-    sops.secrets.lldap_environmentFile = {
-      sopsFile = ./webserver_secrets.yaml;
-      owner = config.users.users.lldap.name;
-    };
-
-    services.lldap = {
-      enable = true;
-      environment = {
-        LLDAP_JWT_SECRET_FILE = config.sops.secrets.lldap_jwtSecret.path;
-        LLDAP_LDAP_USER_PASS_FILE = config.sops.secrets.lldap_adminPassword.path;
-      };
-      environmentFile = config.sops.secrets.lldap_environmentFile.path;
-
-      settings = {
-        verbose = true;
-
-        ldap_base_dn = "dc=stefanjunker,dc=de";
-        http_url = "https://lldap.${domain}";
-
-        ## Options to configure SMTP parameters, to send password reset emails.
-        ## To set these options from environment variables, use the following format
-        ## (example with "password"): LLDAP_SMTP_OPTIONS__PASSWORD
-        smtp_options = {
-          ## Whether to enabled password reset via email, from LLDAP.
-          enable_password_reset = true;
-
-          # port = 465;
-          ## How the connection is encrypted, either "NONE" (no encryption), "TLS" or "STARTTLS".
-          # smtp_encryption = "TLS";
-        };
-
-        # database_url = "sqlite:///var/lib/lldap/users.db?mode=rwc";
-      };
-    };
-
-    sops.secrets.FORGEJO_JWT_SECRET = {};
-    sops.secrets.FORGEJO_INTERNAL_TOKEN = {};
-    sops.secrets.FORGEJO_SECRET_KEY = {};
-
-    services.forgejo = {
-      enable = true;
-      package = nodeFlake.inputs.nixpkgs-unstable.legacyPackages.${pkgs.system}.forgejo;
-      settings = {
-        service.DISABLE_REGISTRATION = true;
-        server.HTTP_ADDR = "127.0.0.1";
-        server.START_SSH_SERVER = true;
-        server.SSH_PORT = forgejoSshPort;
-        server.ROOT_URL = "https://forgejo.${domain}";
-        server.HTTP_PORT = 3001;
-
-        # TODO: how do i get a 3072 length SSH key with the yubikey?
-        "ssh.minimum_key_sizes".RSA = 2048;
-      };
-      secrets = {
-        oauth2.JWT_SECRET = lib.mkForce config.sops.secrets.FORGEJO_JWT_SECRET.path;
-        security.INTERNAL_TOKEN = lib.mkForce config.sops.secrets.FORGEJO_INTERNAL_TOKEN.path;
-        security.SECRET_KEY = lib.mkForce config.sops.secrets.FORGEJO_SECRET_KEY.path;
-      };
-    };
-
-    systemd.services.lldap.serviceConfig.User = config.users.users.lldap.name;
-    systemd.services.lldap.serviceConfig.Group = config.users.groups.lldap.name;
-    systemd.services.lldap.serviceConfig.DynamicUser = lib.mkForce false;
-
-    # combine a path watcher with a service that transfers the certs by caddy to kanidm
-    systemd.paths.kanidm-tls-watch = {
-      enable = true;
-      requiredBy = ["kanidm.service"];
-      pathConfig = {
-        PathChanged = [
-          "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.key"
-          "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.crt"
-        ];
-        Unit = "kanidm-tls-update.service";
-      };
-    };
-    systemd.services.kanidm-tls-update = let
-      dbDir =
-        builtins.dirOf
-        config.services.kanidm.serverSettings.db_path;
-    in {
-      enable = true;
-      requiredBy = ["kanidm.service"];
-      unitConfig = {
-        # ConditionPathExists = [
-        #   "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.key"
-        #   "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.crt"
-        # ];
-      };
-      serviceConfig.Type = "oneshot";
-      script = let
-        tlsDir = builtins.dirOf config.services.kanidm.serverSettings.tls_key;
-      in ''
-        set -xe
-
-        cat "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.key" > tls.key
-        cat "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.crt" > tls.chain
-
-        chown ${config.systemd.services.kanidm.serviceConfig.User}:${config.systemd.services.kanidm.serviceConfig.Group} tls.{key,chain}
-        chmod 400 tls.{key,chain}
-
-        # create the kanidm directory in case it's missing
-        if [[ ! -d ${tlsDir} ]]; then
-          mkdir -p ${tlsDir}
-          chown -R ${config.systemd.services.kanidm.serviceConfig.User}:${config.systemd.services.kanidm.serviceConfig.Group} ${tlsDir}
-          chmod 700 ${tlsDir}
-        fi
-
-        mv tls.key ${config.services.kanidm.serverSettings.tls_key}
-        mv tls.chain ${config.services.kanidm.serverSettings.tls_chain}
-
-        if [[ ! -d ${dbDir} ]]; then
-          mkdir -p ${dbDir}
-          chown -R ${config.systemd.services.kanidm.serviceConfig.User}:${config.systemd.services.kanidm.serviceConfig.Group} ${dbDir}
-          chmod 700 ${dbDir}
-        fi
-      '';
-    };
-
-    systemd.services.kanidm.serviceConfig = let
-      dbDir =
-        builtins.dirOf
-        config.services.kanidm.serverSettings.db_path;
-      # stateDir = "/var/lib/${config.systemd.services.kanidm.serviceConfig.StateDirectory}";
-    in {
-      # ExecStartPre = ''
-      #   mkdir -p ${dbDir}
-      # '';
-      BindPaths = [
-        dbDir
-        # stateDir
       ];
-    };
 
-    services.kanidm = let
+      imports = [
-      dataDir = "/var/lib/kanidm";
+        "${nodeFlake.inputs.nixpkgs-unstable}/nixos/modules/services/misc/forgejo.nix"
-    in {
+        "${repoFlake.inputs.nixpkgs-kanidm}/nixos/modules/services/security/kanidm.nix"
-      package = repoFlake.inputs.nixpkgs-kanidm.legacyPackages.${pkgs.system}.kanidm;
 
-      enablePam = false;
+        ../profiles/containers/configuration.nix
-      enableClient = false;
 
-      enableServer = true;
+        repoFlake.inputs.sops-nix.nixosModules.sops
-      serverSettings = {
+      ];
-        role = "WriteReplica";
-        log_level = "debug";
 
-        domain = "kanidm.${domain}";
+      sops.defaultSopsFile = ./webserver_secrets.yaml;
-        origin = "https://kanidm.${domain}";
 
-        db_path = "${dataDir}/db/kanidm.db";
+      networking.firewall.allowedTCPPorts = [
+        httpPort
+        httpsPort
+        forgejoSshPort
+      ];
 
-        bindaddress = "127.0.0.1:8444";
+      sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+      sops.secrets.hedgedoc_environment_file = {
+        sopsFile = ./webserver_secrets.yaml;
+        owner = config.users.users.hedgedoc.name;
+      };
 
-        # don't expose ldap
+      services.caddy = {
-        # ldapbindaddress = "[::1]:6636";
+        enable = true;
+        logFormat = ''
+          level ERROR
+        '';
+        virtualHosts."${domain}" = {
+          extraConfig = ''
+            redir /hedgedoc* https://hedgedoc.${domain}
 
-        tls_key = "${dataDir}/tls/tls.key";
+            file_server /*/* {
-        tls_chain = "${dataDir}/tls/tls.chain";
+              browse
+              root /var/www/stefanjunker.de/htdocs/caddy
+              pass_thru
+            }
 
-        online_backup = {
+            # respond "Hi"
-          schedule = "00 06 * * *";
+            # respond (not /*/*) "Hi"
+          '';
+        };
+
+        virtualHosts."hedgedoc.${domain}" = {
+          extraConfig = ''
+            reverse_proxy http://[::1]:3000
+          '';
+        };
+
+        virtualHosts."authelia.${domain}" = {
+          extraConfig = ''
+            reverse_proxy http://127.0.0.1:${builtins.toString config.services.authelia.instances.default.settings.server.port}
+          '';
+        };
+
+        virtualHosts."lldap.${domain}" = {
+          extraConfig = ''
+            reverse_proxy http://127.0.0.1:${builtins.toString config.services.lldap.settings.http_port}
+          '';
+        };
+
+        virtualHosts."forgejo.${domain}" = {
+          extraConfig = ''
+            reverse_proxy http://127.0.0.1:${builtins.toString config.services.forgejo.settings.server.HTTP_PORT}
+          '';
+        };
+
+        virtualHosts."kanidm.${domain}" = {
+          extraConfig = ''
+            reverse_proxy https://${builtins.toString config.services.kanidm.serverSettings.bindaddress} {
+              transport http {
+                  tls_server_name ${config.services.kanidm.serverSettings.domain}
+              }
+            }
+          '';
         };
       };
+
+      services.hedgedoc = {
+        enable = true;
+        settings = {
+          domain = "hedgedoc.${domain}";
+          urlPath = "";
+          protocolUseSSL = true;
+          db = {
+            dialect = "sqlite";
+            storage = "/var/lib/hedgedoc/db.hedgedoc.sqlite";
+          };
+
+          allowAnonymous = false;
+          allowAnonymousEdits = false;
+          allowGravatar = false;
+          allowFreeURL = false;
+          defaultPermission = "private";
+
+          allowEmailRegister = false;
+          email = false;
+
+          ldap = {
+            url = "ldap://127.0.0.1:${builtins.toString config.services.lldap.settings.ldap_port}";
+            bindDn = "uid=admin,ou=people,dc=stefanjunker,dc=de";
+            # these are set via the `environmentFile`
+            # bindCredentials = "$LDAP_ADMIN_PASSWORD";
+            searchBase = "ou=people,dc=stefanjunker,dc=de";
+            searchFilter = "(&(memberOf=cn=hedgedoc,ou=groups,dc=stefanjunker,dc=de)(uid={{username}}))";
+            useridField = "uid";
+          };
+
+          oauth2 =
+            let
+              originURL = config.services.kanidm.serverSettings.origin;
+            in
+            {
+              providerName = "kanidm (${originURL})";
+
+              authorizationURL = "${originURL}/ui/oauth2";
+              tokenURL = "${originURL}/oauth2/token";
+              userProfileURL = "${originURL}/oauth2/openid/hedgedoc/userinfo";
+
+              scope = "openid email profile";
+              # rolesClaim = "roles";
+              # accessRole = "role/hedgedoc";
+
+              userProfileUsernameAttr = "name";
+              userProfileDisplayNameAttr = "displayname";
+              userProfileEmailAttr = "email";
+
+              clientID = "hedgedoc";
+              # set via the `environmentFile`
+              # clientSecret = "$CMD_OAUTH2_CLIENT_SECRET";
+            };
+
+          uploadsPath = "/var/lib/hedgedoc/uploads";
+        };
+
+        environmentFile = config.sops.secrets.hedgedoc_environment_file.path;
+      };
+
+      services.jitsi-meet = {
+        enable = false;
+        hostName = "meet.${domain}";
+        config = {
+          prejoinPageEnabled = true;
+        };
+        caddy.enable = true;
+        nginx.enable = false;
+      };
+
+      sops.secrets.authelia_storageEncryptionKey = {
+        sopsFile = ./webserver_secrets.yaml;
+        owner = config.users.users.authelia-default.name;
+      };
+
+      sops.secrets.authelia_jwtSecret = {
+        sopsFile = ./webserver_secrets.yaml;
+        owner = config.users.users.authelia-default.name;
+      };
+
+      services.authelia.instances.default =
+        let
+          baseDir = "/var/lib/authelia-default";
+        in
+        {
+          enable = true;
+          secrets.storageEncryptionKeyFile = config.sops.secrets.authelia_storageEncryptionKey.path;
+          secrets.jwtSecretFile = config.sops.secrets.authelia_jwtSecret.path;
+          settings = {
+            theme = "auto";
+            default_2fa_method = "totp";
+            log.level = "debug";
+
+            server = {
+              disable_healthcheck = true;
+              host = "127.0.0.1";
+              port = 9091;
+              # path = "authelia";
+            };
+
+            storage = {
+              local.path = "${baseDir}/authelia.sqlite";
+            };
+
+            authentication_backend = {
+              file.path = "${baseDir}/first_factor.yaml";
+              file.search.email = true;
+              file.search.case_insensitive = false;
+            };
+
+            access_control = {
+              default_policy = "one_factor";
+            };
+
+            session.domain = "stefanjunker.de";
+
+            notifier = {
+              disable_startup_check = true;
+              filesystem.filename = "${baseDir}/notification.txt";
+            };
+          };
+        };
+
+      users.groups.lldap = { };
+      users.users.lldap = {
+        isSystemUser = true;
+        group = "lldap";
+      };
+
+      sops.secrets.lldap_jwtSecret = {
+        sopsFile = ./webserver_secrets.yaml;
+        owner = config.users.users.lldap.name;
+      };
+
+      sops.secrets.lldap_adminPassword = {
+        sopsFile = ./webserver_secrets.yaml;
+        owner = config.users.users.lldap.name;
+      };
+
+      sops.secrets.lldap_environmentFile = {
+        sopsFile = ./webserver_secrets.yaml;
+        owner = config.users.users.lldap.name;
+      };
+
+      services.lldap = {
+        enable = true;
+        environment = {
+          LLDAP_JWT_SECRET_FILE = config.sops.secrets.lldap_jwtSecret.path;
+          LLDAP_LDAP_USER_PASS_FILE = config.sops.secrets.lldap_adminPassword.path;
+        };
+        environmentFile = config.sops.secrets.lldap_environmentFile.path;
+
+        settings = {
+          verbose = true;
+
+          ldap_base_dn = "dc=stefanjunker,dc=de";
+          http_url = "https://lldap.${domain}";
+
+          ## Options to configure SMTP parameters, to send password reset emails.
+          ## To set these options from environment variables, use the following format
+          ## (example with "password"): LLDAP_SMTP_OPTIONS__PASSWORD
+          smtp_options = {
+            ## Whether to enabled password reset via email, from LLDAP.
+            enable_password_reset = true;
+
+            # port = 465;
+            ## How the connection is encrypted, either "NONE" (no encryption), "TLS" or "STARTTLS".
+            # smtp_encryption = "TLS";
+          };
+
+          # database_url = "sqlite:///var/lib/lldap/users.db?mode=rwc";
+        };
+      };
+
+      sops.secrets.FORGEJO_JWT_SECRET = { };
+      sops.secrets.FORGEJO_INTERNAL_TOKEN = { };
+      sops.secrets.FORGEJO_SECRET_KEY = { };
+
+      services.forgejo = {
+        enable = true;
+        package = nodeFlake.inputs.nixpkgs-unstable.legacyPackages.${pkgs.system}.forgejo;
+        settings = {
+          service.DISABLE_REGISTRATION = true;
+          server.HTTP_ADDR = "127.0.0.1";
+          server.START_SSH_SERVER = true;
+          server.SSH_PORT = forgejoSshPort;
+          server.ROOT_URL = "https://forgejo.${domain}";
+          server.HTTP_PORT = 3001;
+
+          # TODO: how do i get a 3072 length SSH key with the yubikey?
+          "ssh.minimum_key_sizes".RSA = 2048;
+        };
+        secrets = {
+          oauth2.JWT_SECRET = lib.mkForce config.sops.secrets.FORGEJO_JWT_SECRET.path;
+          security.INTERNAL_TOKEN = lib.mkForce config.sops.secrets.FORGEJO_INTERNAL_TOKEN.path;
+          security.SECRET_KEY = lib.mkForce config.sops.secrets.FORGEJO_SECRET_KEY.path;
+        };
+      };
+
+      systemd.services.lldap.serviceConfig.User = config.users.users.lldap.name;
+      systemd.services.lldap.serviceConfig.Group = config.users.groups.lldap.name;
+      systemd.services.lldap.serviceConfig.DynamicUser = lib.mkForce false;
+
+      # combine a path watcher with a service that transfers the certs by caddy to kanidm
+      systemd.paths.kanidm-tls-watch = {
+        enable = true;
+        requiredBy = [ "kanidm.service" ];
+        pathConfig = {
+          PathChanged = [
+            "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.key"
+            "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.crt"
+          ];
+          Unit = "kanidm-tls-update.service";
+        };
+      };
+      systemd.services.kanidm-tls-update =
+        let
+          dbDir = builtins.dirOf config.services.kanidm.serverSettings.db_path;
+        in
+        {
+          enable = true;
+          requiredBy = [ "kanidm.service" ];
+          unitConfig = {
+            # ConditionPathExists = [
+            #   "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.key"
+            #   "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.crt"
+            # ];
+          };
+          serviceConfig.Type = "oneshot";
+          script =
+            let
+              tlsDir = builtins.dirOf config.services.kanidm.serverSettings.tls_key;
+            in
+            ''
+              set -xe
+
+              cat "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.key" > tls.key
+              cat "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.crt" > tls.chain
+
+              chown ${config.systemd.services.kanidm.serviceConfig.User}:${config.systemd.services.kanidm.serviceConfig.Group} tls.{key,chain}
+              chmod 400 tls.{key,chain}
+
+              # create the kanidm directory in case it's missing
+              if [[ ! -d ${tlsDir} ]]; then
+                mkdir -p ${tlsDir}
+                chown -R ${config.systemd.services.kanidm.serviceConfig.User}:${config.systemd.services.kanidm.serviceConfig.Group} ${tlsDir}
+                chmod 700 ${tlsDir}
+              fi
+
+              mv tls.key ${config.services.kanidm.serverSettings.tls_key}
+              mv tls.chain ${config.services.kanidm.serverSettings.tls_chain}
+
+              if [[ ! -d ${dbDir} ]]; then
+                mkdir -p ${dbDir}
+                chown -R ${config.systemd.services.kanidm.serviceConfig.User}:${config.systemd.services.kanidm.serviceConfig.Group} ${dbDir}
+                chmod 700 ${dbDir}
+              fi
+            '';
+        };
+
+      systemd.services.kanidm.serviceConfig =
+        let
+          dbDir = builtins.dirOf config.services.kanidm.serverSettings.db_path;
+        in
+        # stateDir = "/var/lib/${config.systemd.services.kanidm.serviceConfig.StateDirectory}";
+        {
+          # ExecStartPre = ''
+          #   mkdir -p ${dbDir}
+          # '';
+          BindPaths = [
+            dbDir
+            # stateDir
+          ];
+        };
+
+      services.kanidm =
+        let
+          dataDir = "/var/lib/kanidm";
+        in
+        {
+          package = repoFlake.inputs.nixpkgs-kanidm.legacyPackages.${pkgs.system}.kanidm;
+
+          enablePam = false;
+          enableClient = false;
+
+          enableServer = true;
+          serverSettings = {
+            role = "WriteReplica";
+            log_level = "debug";
+
+            domain = "kanidm.${domain}";
+            origin = "https://kanidm.${domain}";
+
+            db_path = "${dataDir}/db/kanidm.db";
+
+            bindaddress = "127.0.0.1:8444";
+
+            # don't expose ldap
+            # ldapbindaddress = "[::1]:6636";
+
+            tls_key = "${dataDir}/tls/tls.key";
+            tls_chain = "${dataDir}/tls/tls.chain";
+
+            online_backup = {
+              schedule = "00 06 * * *";
+            };
+          };
+        };
     };
-  };
 
   inherit autoStart;
 

nix/os/devices/default.nix

@@ -1,20 +1,25 @@
 {
   dir,
-  pkgs ? import <channels-nixos-stable> {},
+  pkgs ? import <channels-nixos-stable> { },
-  ownLib ? import ../lib/default.nix {inherit (pkgs) lib;},
+  ownLib ? import ../lib/default.nix { inherit (pkgs) lib; },
   gitRoot ? "$(git rev-parse --show-toplevel)",
   # FIXME: why do these need explicit mentioning?
   moreargs ? "",
   rebuildarg ? "",
   ...
-} @ args: let
+}@args:
-  rebuildargsSudo = ["switch" "boot"];
+let
-  rebuild = {
+  rebuildargsSudo = [
-    gitRoot,
+    "switch"
-    rebuildarg ? "dry-activate",
+    "boot"
-    moreargs ? "",
+  ];
-    ...
+  rebuild =
-  }:
+    {
+      gitRoot,
+      rebuildarg ? "dry-activate",
+      moreargs ? "",
+      ...
+    }:
     pkgs.writeScript "script" ''
       #!/usr/bin/env bash
       set -xe
@@ -30,25 +35,24 @@
 
       ${
         if
-          (builtins.elem rebuildarg rebuildargsSudo)
+          (builtins.elem rebuildarg rebuildargsSudo) && (builtins.match ".*--target-host.*" moreargs) == null
-          && (builtins.match ".*--target-host.*" moreargs) == null
+        then
-        then "sudo -E \\"
+          "sudo -E \\"
-        else ""
+        else
+          ""
       }
       nixos-rebuild --show-trace -I nixos-config=''${NIXOS_CONFIG} ${rebuildarg} ${moreargs}
     '';
-in {
+in
-  recipes =
+{
-    {
+  recipes = {
-      rebuild =
+    rebuild = rebuild {
-        rebuild {
+      inherit gitRoot;
-          inherit gitRoot;
+      inherit moreargs;
-          inherit moreargs;
+      inherit rebuildarg;
-          inherit rebuildarg;
-        }
-        # // pkgs.lib.attrsets.optionalAttrs (moreargs != "") { inherit moreargs; }
-        # // pkgs.lib.attrsets.optionalAttrs (rebuildarg != "") { inherit rebuildarg; }
-        ;
     }
-    // (import ./disk.nix (args // {inherit pkgs ownLib gitRoot;}));
+    # // pkgs.lib.attrsets.optionalAttrs (moreargs != "") { inherit moreargs; }
+    # // pkgs.lib.attrsets.optionalAttrs (rebuildarg != "") { inherit rebuildarg; }
+    ;
+  } // (import ./disk.nix (args // { inherit pkgs ownLib gitRoot; }));
 }

nix/os/devices/disk.nix

@@ -3,40 +3,29 @@
   ownLib,
   dir,
   gitRoot,
-  diskId ?
+  diskId ? (import ((builtins.getEnv "PWD") + "/${dir}/hw.nix") { }).hardware.opinionatedDisk.diskId,
-    (import ((builtins.getEnv "PWD") + "/${dir}/hw.nix")
-      {})
-    .hardware
-    .opinionatedDisk
-    .diskId,
   encrypted ?
-    (import ((builtins.getEnv "PWD") + "/${dir}/hw.nix")
+    (import ((builtins.getEnv "PWD") + "/${dir}/hw.nix") { }).hardware.opinionatedDisk.encrypted,
-      {})
-    .hardware
-    .opinionatedDisk
-    .encrypted,
   previousDiskId ? "",
   ...
-}: let
+}:
+let
   mntRootVol = "/mnt/${diskId}-root";
-in rec {
+in
+rec {
   diskMount = pkgs.writeScript "script" ''
     #!/usr/bin/env bash
     set -xe
     echo Mounting ${diskId}
     ${pkgs.lib.strings.optionalString encrypted ''
-      sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${
+      sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${ownLib.disk.luksName diskId}
-        ownLib.disk.luksName diskId
-      }
     ''}
     sleep 1
     sudo vgchange -ay ${ownLib.disk.volumeGroup diskId}
     sudo mkdir -p /mnt
     sudo mkdir ${mntRootVol}
     sudo mount ${ownLib.disk.rootFsDevice diskId} ${mntRootVol}
-    sudo mount ${
+    sudo mount ${ownLib.disk.rootFsDevice diskId} ${mntRootVol}/nixos/home -o subvol=home
-      ownLib.disk.rootFsDevice diskId
-    } ${mntRootVol}/nixos/home -o subvol=home
     sudo mount ${ownLib.disk.bootFsDevice diskId} ${mntRootVol}/nixos/boot
   '';
 
@@ -73,9 +62,7 @@ in rec {
     #!/usr/bin/env bash
     set -xe
 
-    read -p "Continue to format ${
+    read -p "Continue to format ${ownLib.disk.bootGrubDevice diskId} (YES/n)? " choice
-      ownLib.disk.bootGrubDevice diskId
-    } (YES/n)? " choice
     case "$choice" in
       YES ) echo "Continuing in 3 seconds..."; sleep 3;;
       n|N ) echo "Exiting..."; exit 0;;
@@ -122,15 +109,11 @@ in rec {
     ${pkgs.lib.strings.optionalString encrypted ''
       # Encrypt
       sudo cryptsetup luksFormat ${ownLib.disk.bootLuksDevice diskId} -
-      sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${
+      sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${ownLib.disk.luksName diskId}
-        ownLib.disk.luksName diskId
-      }
     ''}
 
     # LVM
-    sudo vgcreate ${ownLib.disk.volumeGroup diskId} ${
+    sudo vgcreate ${ownLib.disk.volumeGroup diskId} ${ownLib.disk.lvmPv diskId encrypted}
-      ownLib.disk.lvmPv diskId encrypted
-    }
     sudo lvcreate ${ownLib.disk.volumeGroup diskId} -L 2G -n swap
     sudo lvcreate ${ownLib.disk.volumeGroup diskId} -l 100%FREE -n root
 
@@ -154,9 +137,7 @@ in rec {
     #!/usr/bin/env bash
     set -xe
 
-    read -p "Continue to relabel ${
+    read -p "Continue to relabel ${ownLib.disk.bootGrubDevice diskId} (YES/n)?" choice
-      ownLib.disk.bootGrubDevice diskId
-    } (YES/n)?" choice
     case "$choice" in
       YES ) echo "Continuing in 3 seconds..."; sleep 3;;
       n|N ) echo "Exiting..."; exit 0;;
@@ -187,13 +168,9 @@ in rec {
 
 
     if test "${previousDiskId}"; then
-      ${
+      ${pkgs.lib.strings.optionalString encrypted ''
-      pkgs.lib.strings.optionalString encrypted ''
+        sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${ownLib.disk.luksName diskId}
-        sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${
+      ''}
-          ownLib.disk.luksName diskId
-        }
-      ''
-    }
       sync
       sleep 1
       if sudo vgs ${previousDiskId}; then

nix/os/devices/elias-e525/boot.nix

@@ -1,4 +1,5 @@
-{lib, ...}: {
+{ lib, ... }:
+{
   boot.loader.grub.efiSupport = lib.mkForce false;
   boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
 }

nix/os/devices/elias-e525/configuration.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   imports = [
     ../../profiles/common/configuration.nix
     ../../profiles/graphical/configuration.nix

nix/os/devices/elias-e525/default.nix

@@ -3,17 +3,17 @@
   repoFlake,
   nodeFlake,
   ...
-}: let
+}:
+let
   system = "x86_64-linux";
-in {
+in
+{
   meta.nodeSpecialArgs.${nodeName} = {
     inherit repoFlake nodeName nodeFlake;
     packages' = repoFlake.packages.${system};
   };
 
-  meta.nodeNixpkgs.${nodeName} = import nodeFlake.inputs.nixpkgs.outPath {
+  meta.nodeNixpkgs.${nodeName} = import nodeFlake.inputs.nixpkgs.outPath { inherit system; };
-    inherit system;
-  };
 
   ${nodeName} = {
     deployment.targetHost = "elias-e525.lan";

nix/os/devices/elias-e525/flake.nix

@@ -6,5 +6,5 @@
     inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs = _: {};
+  outputs = _: { };
 }

nix/os/devices/elias-e525/hw.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   # TASK: new device
   hardware.opinionatedDisk = {
     enable = true;

nix/os/devices/elias-e525/pkg.nix

@@ -1,8 +1,5 @@
-{
+{ pkgs, lib, ... }:
-  pkgs,
+let
-  lib,
-  ...
-}: let
   homeEnv = keyboard: {
     imports = [
       ../../../home-manager/profiles/common.nix
@@ -22,26 +19,27 @@
       rustdesk
     ];
   };
-in {
+in
+{
   services.gnome = builtins.mapAttrs (attr: value: lib.mkForce value) {
     gnome-remote-desktop.enable = true;
   };
 
   home-manager.users.steveej = homeEnv {
     layout = "en";
-    options = ["nodeadkey"];
+    options = [ "nodeadkey" ];
     variant = "altgr-intl";
   };
 
   home-manager.users.elias = homeEnv {
     layout = "de";
-    options = [];
+    options = [ ];
     variant = "";
   };
 
   home-manager.users.justyna = homeEnv {
     layout = "de";
-    options = [];
+    options = [ ];
     variant = "";
   };
 

nix/os/devices/elias-e525/system.nix

@@ -3,8 +3,10 @@
   lib,
   config,
   ...
-}: let
+}:
-in {
+let
+in
+{
   # TASK: new device
   networking.hostName = "elias-e525"; # Define your hostname.
 
@@ -38,11 +40,13 @@ in {
     # udev.packages = [ pkgs.gnome3.gnome-settings-daemon ];
   };
 
-  security.pki.certificateFiles = ["${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"];
+  security.pki.certificateFiles = [ "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" ];
 
-  services.xserver.videoDrivers = ["modesetting"];
+  services.xserver.videoDrivers = [ "modesetting" ];
 
   boot.kernelPackages = lib.mkForce pkgs.linuxPackages_latest;
 
-  nix.gc = {automatic = true;};
+  nix.gc = {
+    automatic = true;
+  };
 }

nix/os/devices/elias-e525/user.nix

@@ -3,10 +3,12 @@
   pkgs,
   lib,
   ...
-}: let
+}:
+let
   keys = import ../../../variables/keys.nix;
-  inherit (pkgs.callPackage ../../lib/default.nix {}) mkUser;
+  inherit (pkgs.callPackage ../../lib/default.nix { }) mkUser;
-in {
+in
+{
   sops.secrets.sharedUsers-elias = {
     sopsFile = ../../../../secrets/shared-users.yaml;
     neededForUsers = true;

nix/os/devices/fwhost1/boot.nix

@@ -1,4 +1,5 @@
-{lib, ...}: {
+{ lib, ... }:
+{
   boot.loader.grub.efiInstallAsRemovable = lib.mkForce true;
   boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
 }

nix/os/devices/fwhost1/configuration.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   imports = [
     ../../profiles/common/configuration.nix
     ../../modules/opinionatedDisk.nix

nix/os/devices/fwhost1/hw.nix

@@ -1,5 +1,7 @@
-{...}: let
+{ ... }:
-in {
+let
+in
+{
   # TASK: new device
   hardware.opinionatedDisk = {
     enable = true;

nix/os/devices/fwhost1/pkg.nix

@@ -1,17 +1,17 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
-  nixpkgs.config.packageOverrides = pkgs:
+{
-    with pkgs; {
+  nixpkgs.config.packageOverrides =
-      nixPath =
+    pkgs: with pkgs; {
-        (import ../../../default.nix {
+      nixPath = (import ../../../default.nix { versionsPath = ./versions.nix; }).nixPath;
-          versionsPath = ./versions.nix;
-        })
-        .nixPath;
     };
   home-manager.users.steveej = import ../../../home-manager/configuration/text-minimal.nix {
     inherit pkgs;
   };
 
-  environment.systemPackages = with pkgs; [iw wirelesstools];
+  environment.systemPackages = with pkgs; [
+    iw
+    wirelesstools
+  ];
 
   system.stateVersion = "21.11";
 }

nix/os/devices/fwhost1/system.nix

@@ -3,10 +3,12 @@
   lib,
   config,
   ...
-}: let
+}:
+let
   keys = import ../../../variables/keys.nix;
   passwords = import ../../../variables/passwords.crypt.nix;
-in {
+in
+{
   # TASK: new device
   networking.hostName = "fwhost1"; # Define your hostname.
 
@@ -21,11 +23,14 @@ in {
   networking.firewall.logRefusedConnections = false;
   networking.usePredictableInterfaceNames = false;
 
-  networking.bridges.breth.interfaces = ["eth0" "eth1"];
+  networking.bridges.breth.interfaces = [
+    "eth0"
+    "eth1"
+  ];
   networking.bridges.breth.rstp = true;
 
   networking.defaultGateway.address = "172.172.171.10";
-  networking.nameservers = ["172.172.171.10"];
+  networking.nameservers = [ "172.172.171.10" ];
 
   # WAN interfaces, currently unused because the OPNsense guest acts as a router.
   networking.vlans.wan1.id = 3;

nix/os/devices/fwhost1/user.nix

@@ -1,9 +1,7 @@
-{
+{ config, pkgs, ... }:
-  config,
+let
-  pkgs,
-  ...
-}: let
   passwords = import ../../../variables/passwords.crypt.nix;
   keys = import ../../../variables/keys.nix;
-  inherit (import ../../lib/default.nix {}) mkUser;
+  inherit (import ../../lib/default.nix { }) mkUser;
-in {}
+in
+{ }

nix/os/devices/fwhost1/versions.nix

@@ -4,9 +4,12 @@ let
     ref = "nixos-21.11";
     rev = "386234e2a61e1e8acf94dfa3a3d3ca19a6776efb";
   };
-in {
+in
+{
   inherit nixpkgs;
-  nixos = nixpkgs // {suffix = "/nixos";};
+  nixos = nixpkgs // {
+    suffix = "/nixos";
+  };
   "channels-nixos-stable" = nixpkgs;
 
   "channels-nixos-unstable" = {

nix/os/devices/fwhost1/versions.tmpl.nix

@@ -6,9 +6,12 @@ let
       <% git ls-remote https://github.com/nixos/nixpkgs nixos-21.11 | awk '{ print $1 }' | tr -d '
       ' -%>'';
   };
-in {
+in
+{
   inherit nixpkgs;
-  nixos = nixpkgs // {suffix = "/nixos";};
+  nixos = nixpkgs // {
+    suffix = "/nixos";
+  };
   "channels-nixos-stable" = nixpkgs;
 
   "channels-nixos-unstable" = {

nix/os/devices/fwhost2/boot.nix

@@ -1,4 +1,5 @@
-{lib, ...}: {
+{ lib, ... }:
+{
   boot.loader.grub.efiInstallAsRemovable = lib.mkForce true;
   boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
 }

nix/os/devices/fwhost2/configuration.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   imports = [
     ../../profiles/common/configuration.nix
     ../../modules/opinionatedDisk.nix

nix/os/devices/fwhost2/hw.nix

@@ -1,5 +1,7 @@
-{...}: let
+{ ... }:
-in {
+let
+in
+{
   # TASK: new device
   hardware.opinionatedDisk = {
     enable = true;

nix/os/devices/fwhost2/pkg.nix

@@ -1,17 +1,17 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
-  nixpkgs.config.packageOverrides = pkgs:
+{
-    with pkgs; {
+  nixpkgs.config.packageOverrides =
-      nixPath =
+    pkgs: with pkgs; {
-        (import ../../../default.nix {
+      nixPath = (import ../../../default.nix { versionsPath = ./versions.nix; }).nixPath;
-          versionsPath = ./versions.nix;
-        })
-        .nixPath;
     };
   home-manager.users.steveej = import ../../../home-manager/configuration/text-minimal.nix {
     inherit pkgs;
   };
 
-  environment.systemPackages = with pkgs; [iw wirelesstools];
+  environment.systemPackages = with pkgs; [
+    iw
+    wirelesstools
+  ];
 
   system.stateVersion = "21.11";
 }

nix/os/devices/fwhost2/system.nix

@@ -4,10 +4,12 @@
   config,
   utils,
   ...
-}: let
+}:
+let
   keys = import ../../../variables/keys.nix;
   passwords = import ../../../variables/passwords.crypt.nix;
-in {
+in
+{
   # TASK: new device
   networking.hostName = "fwhost2"; # Define your hostname.
 
@@ -22,11 +24,14 @@ in {
   networking.firewall.logRefusedConnections = false;
   networking.usePredictableInterfaceNames = false;
 
-  networking.bridges.breth.interfaces = ["eth0" "eth1"];
+  networking.bridges.breth.interfaces = [
+    "eth0"
+    "eth1"
+  ];
   networking.bridges.breth.rstp = true;
 
   networking.defaultGateway.address = "172.172.171.10";
-  networking.nameservers = ["172.172.171.10"];
+  networking.nameservers = [ "172.172.171.10" ];
 
   # WAN interfaces, currently unused because the OPNsense guest acts as a router.
   networking.vlans.wan1.id = 3;

nix/os/devices/fwhost2/user.nix

@@ -1,12 +1,10 @@
-{
+{ config, pkgs, ... }:
-  config,
+let
-  pkgs,
-  ...
-}: let
   passwords = import ../../../variables/passwords.crypt.nix;
   keys = import ../../../variables/keys.nix;
-  inherit (import ../../lib/default.nix {inherit (pkgs) lib;}) mkUser;
+  inherit (import ../../lib/default.nix { inherit (pkgs) lib; }) mkUser;
-in {
+in
+{
   # users.extraUsers.steveej2 = mkUser {
   #   uid = 1001;
   #   openssh.authorizedKeys.keys = keys.users.steveej.openssh;

nix/os/devices/fwhost2/versions.nix

@@ -4,9 +4,12 @@ let
     ref = "nixos-21.11";
     rev = "386234e2a61e1e8acf94dfa3a3d3ca19a6776efb";
   };
-in {
+in
+{
   inherit nixpkgs;
-  nixos = nixpkgs // {suffix = "/nixos";};
+  nixos = nixpkgs // {
+    suffix = "/nixos";
+  };
   "channels-nixos-stable" = nixpkgs;
 
   "channels-nixos-unstable" = {

nix/os/devices/fwhost2/versions.tmpl.nix

@@ -6,9 +6,12 @@ let
       <% git ls-remote https://github.com/nixos/nixpkgs nixos-21.11 | awk '{ print $1 }' | tr -d '
       ' -%>'';
   };
-in {
+in
+{
   inherit nixpkgs;
-  nixos = nixpkgs // {suffix = "/nixos";};
+  nixos = nixpkgs // {
+    suffix = "/nixos";
+  };
   "channels-nixos-stable" = nixpkgs;
 
   "channels-nixos-unstable" = {

nix/os/devices/hstk0/configuration.nix

@@ -9,9 +9,9 @@
   nodeName,
   system,
   ...
-}: {
+}:
-  disabledModules = [
+{
-  ];
+  disabledModules = [ ];
 
   imports = [
     nodeFlake.inputs.disko.nixosModules.disko
@@ -28,9 +28,7 @@
     }
 
     ../../snippets/nix-settings.nix
-    {
+    { nix.settings.sandbox = lib.mkForce "relaxed"; }
-      nix.settings.sandbox = lib.mkForce "relaxed";
-    }
 
     ../../snippets/mycelium.nix
 
@@ -80,60 +78,58 @@
     nat.enable = true;
     firewall.enable = true;
 
-    firewall.allowedTCPPorts = [
+    firewall.allowedTCPPorts = [ 5201 ];
-      5201
+    firewall.allowedUDPPorts = [ 5201 ];
-    ];
-    firewall.allowedUDPPorts = [
-      5201
-    ];
   };
 
-  disko.devices = let
+  disko.devices =
-    disk = id: {
+    let
-      type = "disk";
+      disk = id: {
-      device = "/dev/${id}";
+        type = "disk";
-      content = {
+        device = "/dev/${id}";
-        type = "gpt";
+        content = {
-        partitions = {
+          type = "gpt";
-          boot = {
+          partitions = {
-            size = "1M";
+            boot = {
-            type = "EF02"; # for grub MBR
+              size = "1M";
-          };
+              type = "EF02"; # for grub MBR
-          mdadm = {
+            };
-            size = "100%";
+            mdadm = {
-            content = {
+              size = "100%";
-              type = "mdraid";
+              content = {
-              name = "raid0";
+                type = "mdraid";
+                name = "raid0";
+              };
             };
           };
         };
       };
-    };
+    in
-  in {
+    {
-    disk = {
+      disk = {
-      sda = disk "sda";
+        sda = disk "sda";
-      sdb = disk "sdb";
+        sdb = disk "sdb";
-    };
+      };
-    mdadm = {
+      mdadm = {
-      raid0 = {
+        raid0 = {
-        type = "mdadm";
+          type = "mdadm";
-        level = 0;
+          level = 0;
-        content = {
+          content = {
-          type = "gpt";
+            type = "gpt";
-          partitions = {
+            partitions = {
-            primary = {
+              primary = {
-              size = "100%";
+                size = "100%";
-              content = {
+                content = {
-                type = "filesystem";
+                  type = "filesystem";
-                format = "btrfs";
+                  format = "btrfs";
-                mountpoint = "/";
+                  mountpoint = "/";
+                };
               };
             };
           };
         };
       };
     };
-  };
 
   system.stateVersion = "24.05";
 
@@ -149,7 +145,5 @@
 
   virtualisation.libvirtd.enable = true;
 
-  boot.binfmt.emulatedSystems = [
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
-    "aarch64-linux"
-  ];
 }

nix/os/devices/hstk0/default.nix

@@ -3,19 +3,22 @@
   repoFlake,
   nodeFlake,
   ...
-}: let
+}:
+let
   system = "x86_64-linux";
-in {
+in
+{
   meta.nodeSpecialArgs.${nodeName} = {
-    inherit repoFlake nodeName nodeFlake system;
+    inherit
+      repoFlake
+      nodeName
+      nodeFlake
+      system
+      ;
     packages' = repoFlake.packages.${system};
   };
 
-  meta.nodeNixpkgs.${nodeName} =
+  meta.nodeNixpkgs.${nodeName} = import nodeFlake.inputs.nixpkgs.outPath { inherit system; };
-    import nodeFlake.inputs.nixpkgs.outPath
-    {
-      inherit system;
-    };
 
   ${nodeName} = {
     deployment.targetHost = "185.130.224.33";

nix/os/devices/hstk0/flake.nix

@@ -16,38 +16,37 @@
 
   # outputs = _: {};
 
-  outputs = {
+  outputs =
-    self,
+    {
-    get-flake,
+      self,
-    nixpkgs,
+      get-flake,
-    ...
+      nixpkgs,
-  } @ attrs: let
+      ...
-    system = "x86_64-linux";
+    }@attrs:
-    nodeName = "hostkey-0";
+    let
+      system = "x86_64-linux";
+      nodeName = "hostkey-0";
 
-    mkNixosConfiguration = {extraModules ? [], ...} @ attrs:
+      mkNixosConfiguration =
-      nixpkgs.lib.nixosSystem (
-        nixpkgs.lib.attrsets.recursiveUpdate
-        attrs
         {
-          specialArgs = {
+          extraModules ? [ ],
-            nodeFlake = self;
+          ...
-            repoFlake = get-flake ../../../..;
+        }@attrs:
-            inherit nodeName;
+        nixpkgs.lib.nixosSystem (
-          };
+          nixpkgs.lib.attrsets.recursiveUpdate attrs {
+            specialArgs = {
+              nodeFlake = self;
+              repoFlake = get-flake ../../../..;
+              inherit nodeName;
+            };
 
-          modules =
+            modules = [ ./configuration.nix ] ++ extraModules;
-            [
+          }
-              ./configuration.nix
+        );
-            ]
+    in
-            ++ extraModules;
+    {
-        }
+      nixosConfigurations = {
-      );
+        native = mkNixosConfiguration { inherit system; };
-  in {
-    nixosConfigurations = {
-      native = mkNixosConfiguration {
-        inherit system;
       };
     };
-  };
 }

nix/os/devices/justyna-p300/boot.nix

@@ -1,4 +1,5 @@
-{lib, ...}: {
+{ lib, ... }:
+{
   boot.loader.grub.efiInstallAsRemovable = lib.mkForce false;
   boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
   boot.loader.grub.efiSupport = lib.mkForce false;

nix/os/devices/justyna-p300/configuration.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   imports = [
     ../../profiles/common/configuration.nix
     ../../profiles/graphical/configuration.nix

nix/os/devices/justyna-p300/default.nix

@@ -3,17 +3,17 @@
   repoFlake,
   nodeFlake,
   ...
-}: let
+}:
+let
   system = "x86_64-linux";
-in {
+in
+{
   meta.nodeSpecialArgs.${nodeName} = {
     inherit repoFlake nodeName nodeFlake;
     packages' = repoFlake.packages.${system};
   };
 
-  meta.nodeNixpkgs.${nodeName} = import nodeFlake.inputs.nixpkgs.outPath {
+  meta.nodeNixpkgs.${nodeName} = import nodeFlake.inputs.nixpkgs.outPath { inherit system; };
-    inherit system;
-  };
 
   ${nodeName} = {
     deployment.targetHost = nodeName;

nix/os/devices/justyna-p300/flake.nix

@@ -6,8 +6,8 @@
     inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  inputs.disko.url = github:nix-community/disko;
+  inputs.disko.url = "github:nix-community/disko";
   inputs.disko.inputs.nixpkgs.follows = "nixpkgs";
 
-  outputs = _: {};
+  outputs = _: { };
 }

nix/os/devices/justyna-p300/hw.nix

@@ -3,10 +3,9 @@
   nodeFlake,
   lib,
   ...
-}: {
+}:
-  imports = [
+{
-    nodeFlake.inputs.disko.nixosModules.disko
+  imports = [ nodeFlake.inputs.disko.nixosModules.disko ];
-  ];
 
   disko.devices.disk.sda = {
     device = "/dev/sda";
@@ -20,7 +19,7 @@
           start = "0";
           end = "1M";
           part-type = "primary";
-          flags = ["bios_grub"];
+          flags = [ "bios_grub" ];
         }
         {
           name = "root";
@@ -30,14 +29,14 @@
           bootable = true;
           content = {
             type = "btrfs";
-            extraArgs = ["-f"]; # Override existing partition
+            extraArgs = [ "-f" ]; # Override existing partition
             subvolumes = {
               # Subvolume name is different from mountpoint
               "/rootfs" = {
                 mountpoint = "/";
               };
               "/nix" = {
-                mountOptions = ["noatime"];
+                mountOptions = [ "noatime" ];
               };
             };
           };

nix/os/devices/justyna-p300/pkg.nix

@@ -3,7 +3,8 @@
   lib,
   packages',
   ...
-}: let
+}:
+let
   homeEnv = keyboard: {
     imports = [
       ../../../home-manager/profiles/common.nix
@@ -23,15 +24,19 @@
       rustdesk
     ];
   };
-in {
+in
+{
   services.gnome = builtins.mapAttrs (attr: value: lib.mkForce value) {
     gnome-remote-desktop.enable = true;
   };
 
-  services.printing.drivers = lib.mkForce (with packages'; [
+  services.printing.drivers = lib.mkForce (
-    dcpj4110dwDriver
+    with packages';
-    dcpj4110dwCupswrapper
+    [
-  ]);
+      dcpj4110dwDriver
+      dcpj4110dwCupswrapper
+    ]
+  );
 
   services.printing.extraConf = ''
     LogLevel debug
@@ -39,31 +44,29 @@ in {
 
   home-manager.users.steveej = homeEnv {
     layout = "en";
-    options = ["nodeadkey"];
+    options = [ "nodeadkey" ];
     variant = "altgr-intl";
   };
 
   home-manager.users.elias = homeEnv {
     layout = "de";
-    options = [];
+    options = [ ];
     variant = "";
   };
 
   home-manager.users.justyna =
     lib.attrsets.recursiveUpdate
-    (homeEnv {
+      (homeEnv {
-      layout = "de";
+        layout = "de";
-      options = [];
+        options = [ ];
-      variant = "";
+        variant = "";
-    })
+      })
-    {
+      {
-      services.syncthing.enable = true;
+        services.syncthing.enable = true;
-      services.syncthing.tray = true;
+        services.syncthing.tray = true;
 
-      home.packages = with pkgs; [
+        home.packages = with pkgs; [ session-desktop ];
-        session-desktop
+      };
-      ];
-    };
 
   system.stateVersion = "21.11";
 }

nix/os/devices/justyna-p300/system.nix

@@ -3,9 +3,11 @@
   lib,
   config,
   ...
-}: let
+}:
+let
   passwords = import ../../../variables/passwords.crypt.nix;
-in {
+in
+{
   networking.firewall.enable = true;
   networking.firewall.allowedTCPPorts = [
     # iperf3
@@ -39,11 +41,13 @@ in {
     # udev.packages = [ pkgs.gnome3.gnome-settings-daemon ];
   };
 
-  security.pki.certificateFiles = ["${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"];
+  security.pki.certificateFiles = [ "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" ];
 
-  services.xserver.videoDrivers = ["modesetting"];
+  services.xserver.videoDrivers = [ "modesetting" ];
 
   boot.kernelPackages = lib.mkForce pkgs.linuxPackages_latest;
 
-  nix.gc = {automatic = true;};
+  nix.gc = {
+    automatic = true;
+  };
 }

nix/os/devices/justyna-p300/user.nix

@@ -1,11 +1,9 @@
-{
+{ config, pkgs, ... }:
-  config,
+let
-  pkgs,
-  ...
-}: let
   keys = import ../../../variables/keys.nix;
-  inherit (pkgs.callPackage ../../lib/default.nix {}) mkUser;
+  inherit (pkgs.callPackage ../../lib/default.nix { }) mkUser;
-in {
+in
+{
   sops.secrets.sharedUsers-elias = {
     sopsFile = ../../../../secrets/shared-users.yaml;
     neededForUsers = true;

nix/os/devices/router0-dmz0/default.nix

@@ -5,25 +5,24 @@
   nodeFlake,
   localDomainName ? "internal",
   ...
-}: {
+}:
+{
   meta.nodeSpecialArgs.${nodeName} = {
-    inherit repoFlake nodeName nodeFlake system;
+    inherit
+      repoFlake
+      nodeName
+      nodeFlake
+      system
+      ;
     packages' = repoFlake.packages.${system};
     nodePackages' = nodeFlake.packages.${system};
 
-    inherit
+    inherit (nodeFlake.inputs.bpir3.packages.${system}) armTrustedFirmwareMT7986;
-      (nodeFlake.inputs.bpir3.packages.${system})
-      armTrustedFirmwareMT7986
-      ;
 
     inherit localDomainName;
   };
 
-  meta.nodeNixpkgs.${nodeName} =
+  meta.nodeNixpkgs.${nodeName} = import nodeFlake.inputs.nixpkgs.outPath { inherit system; };
-    import nodeFlake.inputs.nixpkgs.outPath
-    {
-      inherit system;
-    };
 
   ${nodeName} = {
     deployment.targetHost = "${nodeName}.${localDomainName}";

nix/os/devices/router0-dmz0/flake.nix

@@ -18,8 +18,8 @@
       # "github:steveej-forks/nakato_nixos-sbc/kernel-6.9_and_cross-compile"
       # "github:steveej-forks/nakato_nixos-sbc/kernel-6.10_and_cross-compile"
       "github:steveej-forks/nakato_nixos-sbc/kernel-6.10_and_cross-compile_mtkbump"
-      # "git+file:///home/steveej/src/others/nakato_nixos-sbc/"
+    # "git+file:///home/steveej/src/others/nakato_nixos-sbc/"
-      ;
+    ;
     nixos-sbc.inputs.nixpkgs.follows = "nixpkgs";
 
     nixos-nftables-firewall.url = "github:thelegy/nixos-nftables-firewall";
@@ -39,43 +39,43 @@
     # };
   };
 
-  outputs = {
+  outputs =
-    self,
+    {
-    get-flake,
+      self,
-    nixpkgs,
+      get-flake,
-    nixos-sbc,
+      nixpkgs,
-    ...
+      nixos-sbc,
-  }: let
+      ...
-    nativeSystem = "aarch64-linux";
+    }:
-    nodeName = "router0-dmz0";
+    let
+      nativeSystem = "aarch64-linux";
+      nodeName = "router0-dmz0";
 
-    pkgs = nixpkgs.legacyPackages.${nativeSystem};
+      pkgs = nixpkgs.legacyPackages.${nativeSystem};
-    pkgsCross = import self.inputs.nixpkgs {
+      pkgsCross = import self.inputs.nixpkgs {
-      system = "x86_64-linux";
+        system = "x86_64-linux";
-      crossSystem = {
+        crossSystem = {
-        config = "aarch64-unknown-linux-gnu";
+          config = "aarch64-unknown-linux-gnu";
+        };
       };
-    };
 
-    mkNixosConfiguration = {extraModules ? [], ...} @ attrs:
+      mkNixosConfiguration =
-      nixpkgs.lib.nixosSystem (
-        nixpkgs.lib.attrsets.recursiveUpdate
-        attrs
         {
-          specialArgs =
+          extraModules ? [ ],
-            (import ./default.nix {
+          ...
-              system = nativeSystem;
+        }@attrs:
-              inherit nodeName;
+        nixpkgs.lib.nixosSystem (
+          nixpkgs.lib.attrsets.recursiveUpdate attrs {
+            specialArgs =
+              (import ./default.nix {
+                system = nativeSystem;
+                inherit nodeName;
 
-              repoFlake = get-flake ../../../..;
+                repoFlake = get-flake ../../../..;
-              nodeFlake = self;
+                nodeFlake = self;
-            })
+              }).meta.nodeSpecialArgs.${nodeName};
-            .meta
-            .nodeSpecialArgs
-            .${nodeName};
 
-          modules =
+            modules = [
-            [
               ./configuration.nix
 
               # flake registry
@@ -83,34 +83,30 @@
                 nixpkgs.overlays = builtins.attrValues self.overlays;
                 nix.registry.nixpkgs.flake = nixpkgs;
               }
-            ]
+            ] ++ extraModules;
-            ++ extraModules;
-        }
-      );
-  in {
-    nixosConfigurations = {
-      native = mkNixosConfiguration {
-        system = nativeSystem;
-      };
-
-      cross = mkNixosConfiguration {
-        extraModules = [
-          {
-            nixpkgs.buildPlatform.system = "x86_64-linux";
-            nixpkgs.hostPlatform.system = nativeSystem;
           }
-        ];
+        );
-      };
+    in
-    };
+    {
+      nixosConfigurations = {
+        native = mkNixosConfiguration { system = nativeSystem; };
 
-    overlays.default = final: previous: {
+        cross = mkNixosConfiguration {
-      hostapd = previous.hostapd.overrideDerivation (attrs: {
+          extraModules = [
-        patches =
+            {
-          attrs.patches
+              nixpkgs.buildPlatform.system = "x86_64-linux";
-          ++ [
+              nixpkgs.hostPlatform.system = nativeSystem;
+            }
+          ];
+        };
+      };
+
+      overlays.default = final: previous: {
+        hostapd = previous.hostapd.overrideDerivation (attrs: {
+          patches = attrs.patches ++ [
             "${self.inputs.openwrt}/package/network/services/hostapd/patches/710-vlan_no_bridge.patch"
           ];
-      });
+        });
+      };
     };
-  };
 }

nix/os/devices/router0-hosthatch/configuration.nix

@@ -9,7 +9,8 @@
   system,
   variables,
   ...
-}: {
+}:
+{
   system.stateVersion = "24.05";
 
   imports = [
@@ -48,7 +49,7 @@
       boot.loader.grub.efiSupport = false;
 
       # forcing seems required or else there's an error about duplicated devices
-      boot.loader.grub.devices = lib.mkForce ["/dev/vda"];
+      boot.loader.grub.devices = lib.mkForce [ "/dev/vda" ];
 
       disko.devices.disk.vda = {
         device = "/dev/vda";
@@ -64,14 +65,14 @@
               size = "100%";
               content = {
                 type = "btrfs";
-                extraArgs = ["-f"]; # Override existing partition
+                extraArgs = [ "-f" ]; # Override existing partition
                 subvolumes = {
                   # Subvolume name is different from mountpoint
                   "/rootfs" = {
                     mountpoint = "/";
                   };
                   "/nix" = {
-                    mountOptions = ["noatime"];
+                    mountOptions = [ "noatime" ];
                     mountpoint = "/nix";
                   };
                   "/boot" = {
@@ -156,9 +157,7 @@
       interface = "eth0";
       address = variables.ipv4gateway;
     };
-    nameservers = [
+    nameservers = [ variables.ipv4dns ];
-      variables.ipv4dns
-    ];
 
     # these will be configured via nftables
     nat.enable = lib.mkForce false;
@@ -176,17 +175,20 @@
         snippets.nnf-common.enable = true;
 
         zones.wan = {
-          interfaces = ["eth0"];
+          interfaces = [ "eth0" ];
         };
 
         zones.vpn = {
-          interfaces = ["wg0" "wg1"];
+          interfaces = [
+            "wg0"
+            "wg1"
+          ];
         };
 
         rules = {
           to-fw = {
             from = "all";
-            to = ["fw"];
+            to = [ "fw" ];
             verdict = "drop";
 
             allowedTCPPorts = [
@@ -202,8 +204,8 @@
           };
 
           vpn-to-wan-nat = {
-            from = ["vpn"];
+            from = [ "vpn" ];
-            to = ["wan"];
+            to = [ "wan" ];
             masquerade = true;
             verdict = "accept";
           };
@@ -283,9 +285,7 @@
   systemd.network.networks.wg0 = {
     enable = true;
     matchConfig.Name = "wg0";
-    address = [
+    address = [ "10.0.1.0/31" ];
-      "10.0.1.0/31"
-    ];
 
     routes = [
       {
@@ -299,9 +299,7 @@
   systemd.network.networks.wg1 = {
     enable = true;
     matchConfig.Name = "wg1";
-    address = [
+    address = [ "10.0.1.2/31" ];
-      "10.0.1.2/31"
-    ];
 
     routes = [
       {

nix/os/devices/router0-hosthatch/default.nix

@@ -4,20 +4,24 @@
   repoFlake,
   nodeFlake,
   ...
-}: let
+}:
+let
   variables = import ./variables.crypt.nix;
-in {
+in
+{
   meta.nodeSpecialArgs.${nodeName} = {
-    inherit repoFlake nodeName nodeFlake system variables;
+    inherit
+      repoFlake
+      nodeName
+      nodeFlake
+      system
+      variables
+      ;
     packages' = repoFlake.packages.${system};
     nodePackages' = nodeFlake.packages.${system};
   };
 
-  meta.nodeNixpkgs.${nodeName} =
+  meta.nodeNixpkgs.${nodeName} = import nodeFlake.inputs.nixpkgs.outPath { inherit system; };
-    import nodeFlake.inputs.nixpkgs.outPath
-    {
-      inherit system;
-    };
 
   ${nodeName} = {
     deployment.targetHost = variables.ipv4;

nix/os/devices/router0-hosthatch/flake.nix

@@ -15,5 +15,5 @@
     nixos-nftables-firewall.inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs = _: {};
+  outputs = _: { };
 }

nix/os/devices/router0-ifog/configuration.nix

@@ -9,7 +9,8 @@
   system,
   variables,
   ...
-}: {
+}:
+{
   system.stateVersion = "23.11";
 
   imports = [
@@ -48,7 +49,7 @@
       boot.loader.grub.efiSupport = false;
 
       # forcing seems required or else there's an error about duplicated devices
-      boot.loader.grub.devices = lib.mkForce ["/dev/vda"];
+      boot.loader.grub.devices = lib.mkForce [ "/dev/vda" ];
 
       disko.devices.disk.vda = {
         device = "/dev/vda";
@@ -64,14 +65,14 @@
               size = "100%";
               content = {
                 type = "btrfs";
-                extraArgs = ["-f"]; # Override existing partition
+                extraArgs = [ "-f" ]; # Override existing partition
                 subvolumes = {
                   # Subvolume name is different from mountpoint
                   "/rootfs" = {
                     mountpoint = "/";
                   };
                   "/nix" = {
-                    mountOptions = ["noatime"];
+                    mountOptions = [ "noatime" ];
                     mountpoint = "/nix";
                   };
                   "/boot" = {
@@ -156,9 +157,7 @@
       interface = "eth0";
       address = variables.ipv4gateway;
     };
-    nameservers = [
+    nameservers = [ variables.ipv4dns ];
-      variables.ipv4dns
-    ];
 
     # these will be configured via nftables
     nat.enable = lib.mkForce false;
@@ -176,17 +175,20 @@
         snippets.nnf-common.enable = true;
 
         zones.wan = {
-          interfaces = ["eth0"];
+          interfaces = [ "eth0" ];
         };
 
         zones.vpn = {
-          interfaces = ["wg0" "wg1"];
+          interfaces = [
+            "wg0"
+            "wg1"
+          ];
         };
 
         rules = {
           to-fw = {
             from = "all";
-            to = ["fw"];
+            to = [ "fw" ];
             verdict = "drop";
 
             allowedTCPPorts = [
@@ -202,8 +204,8 @@
           };
 
           vpn-to-wan-nat = {
-            from = ["vpn"];
+            from = [ "vpn" ];
-            to = ["wan"];
+            to = [ "wan" ];
             masquerade = true;
             verdict = "accept";
           };
@@ -283,9 +285,7 @@
   systemd.network.networks.wg0 = {
     enable = true;
     matchConfig.Name = "wg0";
-    address = [
+    address = [ "10.0.0.0/31" ];
-      "10.0.0.0/31"
-    ];
 
     routes = [
       {
@@ -299,9 +299,7 @@
   systemd.network.networks.wg1 = {
     enable = true;
     matchConfig.Name = "wg1";
-    address = [
+    address = [ "10.0.0.2/31" ];
-      "10.0.0.2/31"
-    ];
 
     routes = [
       {

nix/os/devices/router0-ifog/default.nix

@@ -4,20 +4,24 @@
   repoFlake,
   nodeFlake,
   ...
-}: let
+}:
+let
   variables = import ./variables.crypt.nix;
-in {
+in
+{
   meta.nodeSpecialArgs.${nodeName} = {
-    inherit repoFlake nodeName nodeFlake system variables;
+    inherit
+      repoFlake
+      nodeName
+      nodeFlake
+      system
+      variables
+      ;
     packages' = repoFlake.packages.${system};
     nodePackages' = nodeFlake.packages.${system};
   };
 
-  meta.nodeNixpkgs.${nodeName} =
+  meta.nodeNixpkgs.${nodeName} = import nodeFlake.inputs.nixpkgs.outPath { inherit system; };
-    import nodeFlake.inputs.nixpkgs.outPath
-    {
-      inherit system;
-    };
 
   ${nodeName} = {
     deployment.targetHost = variables.ipv4;

nix/os/devices/router0-ifog/flake.nix

@@ -15,5 +15,5 @@
     nixos-nftables-firewall.inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs = _: {};
+  outputs = _: { };
 }

nix/os/devices/sj-srv1/boot.nix

@@ -1,3 +1,4 @@
-{lib, ...}: {
+{ lib, ... }:
-  boot.extraModulePackages = [];
+{
+  boot.extraModulePackages = [ ];
 }

nix/os/devices/sj-srv1/configuration.nix

@@ -3,8 +3,9 @@
   config,
   pkgs,
   ...
-}: {
+}:
-  disabledModules = [];
+{
+  disabledModules = [ ];
   imports = [
     ../../profiles/common/configuration.nix
     {

nix/os/devices/sj-srv1/default.nix

@@ -3,17 +3,17 @@
   repoFlake,
   nodeFlake,
   ...
-}: let
+}:
+let
   system = "x86_64-linux";
-in {
+in
+{
   meta.nodeSpecialArgs.${nodeName} = {
     inherit repoFlake nodeName nodeFlake;
     packages' = repoFlake.packages.${system};
   };
 
-  meta.nodeNixpkgs.${nodeName} = import nodeFlake.inputs.nixpkgs.outPath {
+  meta.nodeNixpkgs.${nodeName} = import nodeFlake.inputs.nixpkgs.outPath { inherit system; };
-    inherit system;
-  };
 
   ${nodeName} = {
     deployment.targetHost = "${nodeName}.dmz.internal";

nix/os/devices/sj-srv1/flake.nix

@@ -12,5 +12,5 @@
   inputs.nixpkgs_forgejo.url = "github:NixOS/nixpkgs/af4ac075a3e97cb239078e187112afdf380cd47b";
   # nixpkgs_forgejo.url = "github:steveej-forks/nixpkgs/9c3519ab3beb11b8d997281f8922330f707df419";
 
-  outputs = _: {};
+  outputs = _: { };
 }

nix/os/devices/sj-srv1/hw.nix

@@ -1,4 +1,5 @@
-{...}: let
+{ ... }:
+let
   stage1Modules = [
     "virtio_balloon"
     "virtio_scsi"
@@ -38,7 +39,8 @@
     "cdc_ether"
     "uas"
   ];
-in {
+in
+{
   hardware.opinionatedDisk = {
     enable = true;
     encrypted = false;

nix/os/devices/sj-srv1/system.nix

@@ -6,29 +6,29 @@
   nodeFlake,
   nodeName,
   ...
-}: let
+}:
+let
   hostBridgeAddress = "192.168.101.1";
-in {
+in
+{
   imports = [
     ../../snippets/systemd-resolved.nix
     {
       # make sure it uses the DNS that comes in via DHCP
-      networking.nameservers = lib.mkForce [];
+      networking.nameservers = lib.mkForce [ ];
       services.resolved.enable = true;
 
       # provide DNS to the containers
       services.resolved.extraConfig = ''
         DNSStubListenerExtra=${hostBridgeAddress}
       '';
-      networking.firewall.interfaces.br0.allowedTCPPorts = [53];
+      networking.firewall.interfaces.br0.allowedTCPPorts = [ 53 ];
-      networking.firewall.interfaces.br0.allowedUDPPorts = [53];
+      networking.firewall.interfaces.br0.allowedUDPPorts = [ 53 ];
     }
   ];
 
   programs.wireshark.enable = true;
-  environment.systemPackages = [
+  environment.systemPackages = [ pkgs.dnsutils ];
-    pkgs.dnsutils
-  ];
 
   networking.firewall.enable = true;
   networking.nftables.enable = true;
@@ -48,13 +48,13 @@ in {
 
   networking.nat = {
     enable = true;
-    internalInterfaces = ["br0"];
+    internalInterfaces = [ "br0" ];
     externalInterface = "dmz0";
   };
 
   networking.bridges = {
     br0 = {
-      interfaces = [];
+      interfaces = [ ];
     };
   };
   networking.interfaces = {
@@ -89,9 +89,7 @@ in {
     networkConfig.LinkLocalAddressing = "no";
 
     # TODO: i'm not sure if and if so why this is required
-    macvlan = [
+    macvlan = [ "dmz0" ];
-      "dmz0"
-    ];
 
     DHCP = "no";
   };
@@ -111,45 +109,49 @@ in {
   };
 
   # virtualization
-  virtualisation = {docker.enable = false;};
+  virtualisation = {
+    docker.enable = false;
+  };
 
-  nix.gc = {automatic = true;};
+  nix.gc = {
+    automatic = true;
+  };
 
   sops.secrets.restic-password.sopsFile = ../../../../secrets/${nodeName}/secrets.yaml;
 
   # adapted from https://github.com/lilyinstarlight/foosteros/blob/5c75ded111878970fd4f600c7adc013f971d5e71/config/restic.nix
-  services.restic.backups.${nodeName} = let
+  services.restic.backups.${nodeName} =
-    btrfs = "${pkgs.btrfs-progs}/bin/btrfs";
+    let
-  in {
+      btrfs = "${pkgs.btrfs-progs}/bin/btrfs";
-    initialize = true;
+    in
-    repository = "sftp://u217879-sub3@u217879-sub3.your-storagebox.de:23/restic/${nodeName}";
+    {
+      initialize = true;
+      repository = "sftp://u217879-sub3@u217879-sub3.your-storagebox.de:23/restic/${nodeName}";
 
-    paths = [
+      paths = [ "/backup" ];
-      "/backup"
-    ];
 
-    pruneOpts = [
+      pruneOpts = [
-      "--keep-daily 7"
+        "--keep-daily 7"
-      "--keep-weekly 5"
+        "--keep-weekly 5"
-      "--keep-monthly 12"
+        "--keep-monthly 12"
-      "--keep-yearly 2"
+        "--keep-yearly 2"
-    ];
+      ];
 
-    timerConfig = {
+      timerConfig = {
-      OnCalendar = lib.mkDefault "daily";
+        OnCalendar = lib.mkDefault "daily";
-      Persistent = true;
+        Persistent = true;
+      };
+
+      passwordFile = config.sops.secrets.restic-password.path;
+
+      backupPrepareCommand = ''
+        ${btrfs} su snapshot -r /var/lib/container-volumes /backup/container-volumes
+      '';
+      backupCleanupCommand = ''
+        ${btrfs} su delete /backup/container-volumes
+      '';
     };
 
-    passwordFile = config.sops.secrets.restic-password.path;
-
-    backupPrepareCommand = ''
-      ${btrfs} su snapshot -r /var/lib/container-volumes /backup/container-volumes
-    '';
-    backupCleanupCommand = ''
-      ${btrfs} su delete /backup/container-volumes
-    '';
-  };
-
   containers = {
     mailserver = import ../../containers/mailserver.nix {
       specialArgs = {
@@ -167,25 +169,23 @@ in {
       sievePort = 4190;
     };
 
-    webserver =
+    webserver = import ../../containers/webserver.nix {
-      import ../../containers/webserver.nix
+      specialArgs = {
-      {
+        inherit repoFlake nodeFlake;
-        specialArgs = {
-          inherit repoFlake nodeFlake;
-          hostAddress = hostBridgeAddress;
-        };
-
-        autoStart = true;
-
-        hostBridge = "br0";
         hostAddress = hostBridgeAddress;
-        localAddress = "192.168.101.11/24";
-
-        httpPort = 80;
-        httpsPort = 443;
-        forgejoSshPort = 2222;
       };
 
+      autoStart = true;
+
+      hostBridge = "br0";
+      hostAddress = hostBridgeAddress;
+      localAddress = "192.168.101.11/24";
+
+      httpPort = 80;
+      httpsPort = 443;
+      forgejoSshPort = 2222;
+    };
+
     syncthing = import ../../containers/syncthing.nix {
       specialArgs = {
         inherit repoFlake nodeFlake;