nix fmt

Signed-off-by: Harald Hoyer <harald@hoyer.xyz>

flake.lock

@@ -935,11 +935,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1720042825,
+        "lastModified": 1726989464,
-        "narHash": "sha256-A0vrUB6x82/jvf17qPCpxaM+ulJnD8YZwH9Ci0BsAzE=",
+        "narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e1391fb22e18a36f57e6999c7a9f966dc80ac073",
+        "rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176",
         "type": "github"
       },
       "original": {
@@ -1519,11 +1519,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1722221733,
+        "lastModified": 1731797254,
-        "narHash": "sha256-sga9SrrPb+pQJxG1ttJfMPheZvDOxApFfwXCFO0H9xw=",
+        "narHash": "sha256-df3dJApLPhd11AlueuoN0Q4fHo/hagP75LlM5K1sz9g=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "12bf09802d77264e441f48e25459c10c93eada2e",
+        "rev": "e8c38b73aeb218e27163376a2d617e61a2ad9b59",
         "type": "github"
       },
       "original": {
@@ -1535,11 +1535,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1719707984,
+        "lastModified": 1728740863,
-        "narHash": "sha256-RoxIr/fbndtuKqulGvNCcuzC6KdAib85Q8gXnjzA1dw=",
+        "narHash": "sha256-u+rxA79a0lyhG+u+oPBRtTDtzz8kvkc9a6SWSt9ekVc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "7dca15289a1c2990efbe4680f0923ce14139b042",
+        "rev": "a3f9ad65a0bf298ed5847629a57808b97e6e8077",
         "type": "github"
       },
       "original": {
@@ -1555,11 +1555,11 @@
         "snowfall-lib": "snowfall-lib"
       },
       "locked": {
-        "lastModified": 1721741092,
+        "lastModified": 1731604482,
-        "narHash": "sha256-ghFoP5gZpc1i4I4PiVCH00QNZ6s6ipGUcA0P1TsSSC8=",
+        "narHash": "sha256-r75GaDBrZFNHSvhcTR5e0JlgSBALvmwFpgNq58pZ4Pg=",
         "owner": "matter-labs",
         "repo": "nixsgx",
-        "rev": "be2c19592d0d5601184c52c07ab6d88dec07ffd6",
+        "rev": "4ec107365fb8403b5dddf35f0ef940bc5657af22",
         "type": "github"
       },
       "original": {
@@ -2649,11 +2649,11 @@
     },
     "unstable": {
       "locked": {
-        "lastModified": 1722185531,
+        "lastModified": 1731676054,
-        "narHash": "sha256-veKR07psFoJjINLC8RK4DiLniGGMgF3QMlS4tb74S6k=",
+        "narHash": "sha256-OZiZ3m8SCMfh3B6bfGC/Bm4x3qc1m2SVEAlkV6iY7Yg=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "52ec9ac3b12395ad677e8b62106f0b98c1f8569d",
+        "rev": "5e4fbfb6b3de1aa2872b76d49fafc942626e2add",
         "type": "github"
       },
       "original": {

flake.nix

@@ -45,7 +45,8 @@
     attic.inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs = inputs:
+  outputs =
+    inputs:
     let
       lib = inputs.snowfall-lib.mkLib {
         inherit inputs;
@@ -66,9 +67,7 @@
         allowUnfree = true;
       };
 
-      homes.modules = with inputs; [
+      homes.modules = with inputs; [ neovim-flake.homeManagerModules.default ];
-        neovim-flake.homeManagerModules.default
-      ];
 
       systems.modules.nixos = with inputs; [
         lanzaboote.nixosModules.lanzaboote
@@ -79,9 +78,7 @@
         attic.nixosModules.atticd
       ];
 
-      overlays = with inputs; [
+      overlays = with inputs; [ nixsgx-flake.overlays.default ];
-        nixsgx-flake.overlays.default
-      ];
 
       outputs-builder = channels: {
         formatter = channels.nixpkgs.nixfmt-rfc-style;

homes/x86_64-darwin/harald@mpro/default.nix

@@ -1,7 +1,8 @@
-{ lib
+{
-, pkgs
+  lib,
-, config
+  pkgs,
-, ...
+  config,
+  ...
 }:
 {
   home = {
@@ -29,4 +30,3 @@
     };
   };
 }
-

homes/x86_64-linux/harald@mx/default.nix

@@ -1,7 +1,8 @@
-{ lib
+{
-, pkgs
+  lib,
-, config
+  pkgs,
-, ...
+  config,
+  ...
 }:
 {
   home.sessionPath = [ "$HOME/bin" ];
@@ -32,43 +33,44 @@
   xdg.enable = true;
   xdg.mime.enable = true;
 
-  /* *****************************************
+  /*
-    systemd.user.services = {
+    *****************************************
-    render_blog = {
+      systemd.user.services = {
-      Service = {
+      render_blog = {
-        Type = "oneshot";
+        Service = {
-        Environment = "PATH=/run/current-system/sw/bin";
+          Type = "oneshot";
-        ExecStart = toString (
+          Environment = "PATH=/run/current-system/sw/bin";
-          pkgs.writeShellScript "render_blog.sh" ''
+          ExecStart = toString (
-            set -eou pipefail
+            pkgs.writeShellScript "render_blog.sh" ''
-            set -x
+              set -eou pipefail
-            DIR=/var/tmp/blog.$$
+              set -x
-            rm -fr $DIR
+              DIR=/var/tmp/blog.$$
-            mkdir -p $DIR
+              rm -fr $DIR
-            cd $DIR
+              mkdir -p $DIR
-            echo $HOME
+              cd $DIR
-            set
+              echo $HOME
-            git config --list
+              set
-            git clone --recurse-submodules https://git.hoyer.xyz/harald/blog.git
+              git config --list
-            cd blog
+              git clone --recurse-submodules https://git.hoyer.xyz/harald/blog.git
-            ./build.sh
+              cd blog
-            cd /var/tmp
+              ./build.sh
-            rm -fr $DIR
+              cd /var/tmp
-          ''
+              rm -fr $DIR
-        );
+            ''
+          );
+        };
+        Install.WantedBy = [ "default.target" ];
+      };
       };
-      Install.WantedBy = [ "default.target" ];
-    };
-    };
 
-    systemd.user.timers = {
+      systemd.user.timers = {
-    render_blog = {
+      render_blog = {
-      Timer = {
+        Timer = {
-        OnCalendar = "hourly";
+          OnCalendar = "hourly";
+        };
+        Install.WantedBy = [ "timers.target" ];
       };
-      Install.WantedBy = [ "timers.target" ];
+      };
-    };
+    *****************************
-    };
+  */
-  ***************************** */
 }
-

homes/x86_64-linux/harald@sgx-azure/default.nix

@@ -1,7 +1,8 @@
-{ lib
+{
-, pkgs
+  lib,
-, config
+  pkgs,
-, ...
+  config,
+  ...
 }:
 {
   home = {
@@ -12,7 +13,10 @@
   };
 
   nix.settings = {
-    substituters = [ "https://cache.nixos.org" "https://attic.teepot.org/tee-pot" ];
+    substituters = [
+      "https://cache.nixos.org"
+      "https://attic.teepot.org/tee-pot"
+    ];
     trusted-public-keys = [
       "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
       "tee-pot:SS6HcrpG87S1M6HZGPsfo7d1xJccCGev7/tXc5+I4jg="
@@ -36,4 +40,3 @@
     };
   };
 }
-

homes/x86_64-linux/harald@sgx-nixos/default.nix

@@ -1,7 +1,4 @@
-{ lib
+{ lib, config, ... }:
-, config
-, ...
-}:
 {
   home.sessionPath = [ "$HOME/bin" ];
 
@@ -27,4 +24,3 @@
   xdg.enable = true;
   xdg.mime.enable = true;
 }
-

homes/x86_64-linux/harald@sgx/default.nix

@@ -1,7 +1,4 @@
-{ lib
+{ lib, config, ... }:
-, config
-, ...
-}:
 {
   home.sessionPath = [ "$HOME/bin" ];
 
@@ -27,4 +24,3 @@
   xdg.enable = true;
   xdg.mime.enable = true;
 }
-

homes/x86_64-linux/harald@t15/default.nix

@@ -1,7 +1,4 @@
-{ lib
+{ lib, config, ... }:
-, config
-, ...
-}:
 {
   home.sessionPath = [ "$HOME/bin" ];
 
@@ -63,4 +60,3 @@
   xdg.enable = true;
   xdg.mime.enable = true;
 }
-

homes/x86_64-linux/harald@x1/default.nix

@@ -1,7 +1,4 @@
-{ lib
+{ lib, config, ... }:
-, config
-, ...
-}:
 {
   home.sessionPath = [ "$HOME/bin" ];
 
@@ -63,4 +60,3 @@
   xdg.enable = true;
   xdg.mime.enable = true;
 }
-

lib/audio/default.nix

@@ -4,62 +4,96 @@ rec {
   ## Renames an alsa device from a given `name` using the new `description`.
   ##
   #@ { name: String, description: String } -> { matches: List, apply_properties: Attrs }
-  mkAlsaRename = { name, description }: {
+  mkAlsaRename =
-    matches = [
+    { name, description }:
-      [
+    {
-        [ "device.name" "matches" name ]
+      matches = [
-      ]
+        [
-    ];
+          [
-    # actions = { "update-props" = { "node.description" = description; }; };
+            "device.name"
-    apply_properties = {
+            "matches"
-      "device.description" = description;
+            name
+          ]
+        ]
+      ];
+      # actions = { "update-props" = { "node.description" = description; }; };
+      apply_properties = {
+        "device.description" = description;
+      };
     };
-  };
 
   ## Create a pipewire audio node.
   ##
   #@ { name: String, factory: String ? "adapter", ... } -> { factory: String, args: Attrs }
-  mkAudioNode = args@{ name, factory ? "adapter", ... }: {
+  mkAudioNode =
-    inherit factory;
+    args@{
-    args = (builtins.removeAttrs args [ "name" "description" ]) // {
+      name,
-      "node.name" = name;
+      factory ? "adapter",
-      "node.description" = args.description or args."node.description";
+      ...
-      "factory.name" = args."factory.name" or "support.null-audio-sink";
+    }:
+    {
+      inherit factory;
+      args =
+        (builtins.removeAttrs args [
+          "name"
+          "description"
+        ])
+        // {
+          "node.name" = name;
+          "node.description" = args.description or args."node.description";
+          "factory.name" = args."factory.name" or "support.null-audio-sink";
+        };
     };
-  };
 
   ## Create a virtual pipewire audio node.
   ##
   #@ { name: String, ... } -> { factory: "adapter", args: Attrs }
-  mkVirtualAudioNode = args@{ name, ... }:
+  mkVirtualAudioNode =
-    mkAudioNode (args // {
+    args@{ name, ... }:
-      name = "virtual-${lib.toLower name}-audio";
+    mkAudioNode (
-      description = "${name} (Virtual)";
+      args
-      "media.class" = args.class or args."media.class" or "Audio/Duplex";
+      // {
-      "object.linger" = args."object.linger" or true;
+        name = "virtual-${lib.toLower name}-audio";
-      "audio.position" = args."audio.position" or [ "FL" "FR" ];
+        description = "${name} (Virtual)";
-      "monitor.channel-volumes" = args."monitor.channel-volumes" or true;
+        "media.class" = args.class or args."media.class" or "Audio/Duplex";
-    });
+        "object.linger" = args."object.linger" or true;
+        "audio.position" =
+          args."audio.position" or [
+            "FL"
+            "FR"
+          ];
+        "monitor.channel-volumes" = args."monitor.channel-volumes" or true;
+      }
+    );
 
   ## Connect two pipewire audio nodes
   ##
   #@ { name: String?, from: String, to: String, ... } -> { name: "libpipewire-module-loopback", args: Attrs }
-  mkBridgeAudioModule = args@{ from, to, ... }: {
+  mkBridgeAudioModule =
-    name = "libpipewire-module-loopback";
+    args@{ from, to, ... }:
-    args = (builtins.removeAttrs args [ "from" "to" "name" ]) // {
+    {
-      "node.name" =
+      name = "libpipewire-module-loopback";
-        if args ? name then
+      args =
-          "${args.name}-bridge"
+        (builtins.removeAttrs args [
-        else
+          "from"
-          "${lib.toLower from}-to-${lib.toLower to}-bridge";
+          "to"
-      "audio.position" = args."audio.position" or [ "FL" "FR" ];
+          "name"
-      "capture.props" = {
+        ])
-        "node.target" = from;
+        // {
-      } // (args."capture.props" or { });
+          "node.name" =
-      "playback.props" = {
+            if args ? name then "${args.name}-bridge" else "${lib.toLower from}-to-${lib.toLower to}-bridge";
-        "node.target" = to;
+          "audio.position" =
-        "monitor.channel-volumes" = true;
+            args."audio.position" or [
-      } // (args."playback.props" or { });
+              "FL"
+              "FR"
+            ];
+          "capture.props" = {
+            "node.target" = from;
+          } // (args."capture.props" or { });
+          "playback.props" = {
+            "node.target" = to;
+            "monitor.channel-volumes" = true;
+          } // (args."playback.props" or { });
+        };
     };
-  };
 }

lib/default.nix

@@ -1,4 +1,8 @@
-{ lib, inputs, snowfall-inputs }:
+{
+  lib,
+  inputs,
+  snowfall-inputs,
+}:
 
 rec {
   ## Override a package's metadata
@@ -13,7 +17,8 @@ rec {
   ## ```
   ##
   #@ Attrs -> Package -> Package
-  override-meta = meta: package:
+  override-meta =
+    meta: package:
     package.overrideAttrs (attrs: {
       meta = (attrs.meta or { }) // meta;
     });

lib/deploy/default.nix

@@ -16,36 +16,42 @@ rec {
   ## ```
   ##
   #@ { self: Flake, overrides: Attrs ? {} } -> Attrs
-  mkDeploy = { self, overrides ? { } }:
+  mkDeploy =
+    {
+      self,
+      overrides ? { },
+    }:
     let
       hosts = self.nixosConfigurations or { };
       names = builtins.attrNames hosts;
-      nodes = lib.foldl
+      nodes = lib.foldl (
-        (result: name:
+        result: name:
-          let
+        let
-            host = hosts.${name};
+          host = hosts.${name};
-            user = host.config.metacfg.user.name or null;
+          user = host.config.metacfg.user.name or null;
-            inherit (host.pkgs) system;
+          inherit (host.pkgs) system;
-          in
+        in
-          result // {
+        result
-            ${name} = (overrides.${name} or { }) // {
+        // {
-              hostname = overrides.${name}.hostname or "${name}";
+          ${name} = (overrides.${name} or { }) // {
-              profiles = (overrides.${name}.profiles or { }) // {
+            hostname = overrides.${name}.hostname or "${name}";
-                system = (overrides.${name}.profiles.system or { }) // {
+            profiles = (overrides.${name}.profiles or { }) // {
+              system =
+                (overrides.${name}.profiles.system or { })
+                // {
                   path = deploy-rs.lib.${system}.activate.nixos host;
-                } // lib.optionalAttrs (user != null) {
+                }
+                // lib.optionalAttrs (user != null) {
                   user = "root";
                   sshUser = user;
-                } // lib.optionalAttrs
+                }
-                  (host.config.metacfg.security.doas.enable or false)
+                // lib.optionalAttrs (host.config.metacfg.security.doas.enable or false) { sudo = "doas -u"; };
-                  {
-                    sudo = "doas -u";
-                  };
-              };
             };
-          })
+          };
-        { }
+        }
-        names;
+      ) { } names;
     in
-    { inherit nodes; };
+    {
+      inherit nodes;
+    };
 }

lib/module/default.nix

@@ -1,6 +1,7 @@
 { lib, ... }:
 
-with lib; rec {
+with lib;
+rec {
   ## Create a NixOS module option.
   ##
   ## ```nix
@@ -8,7 +9,8 @@ with lib; rec {
   ## ```
   ##
   #@ Type -> Any -> String
-  mkOpt = type: default: description:
+  mkOpt =
+    type: default: description:
     mkOption { inherit type default description; };
 
   ## Create a NixOS module option without a description.

lib/network/default.nix

@@ -1,4 +1,8 @@
-{ lib, inputs, snowfall-inputs }:
+{
+  lib,
+  inputs,
+  snowfall-inputs,
+}:
 
 let
   inherit (inputs.nixpkgs.lib) assertMsg last;
@@ -9,14 +13,17 @@ in
     # Type: String -> Attrs
     # Usage: get-address-parts "bismuth:3000"
     #   result: { host = "bismuth"; port = "3000"; }
-    get-address-parts = address:
+    get-address-parts =
+      address:
       let
         address-parts = builtins.split ":" address;
         ip = builtins.head address-parts;
         host = if ip == "" then "127.0.0.1" else ip;
         port = if builtins.length address-parts != 3 then "" else last address-parts;
       in
-      { inherit host port; };
+      {
+        inherit host port;
+      };
 
     ## Create proxy configuration for NGINX virtual hosts.
     ##
@@ -33,22 +40,23 @@ in
     ##
     #@ { port: Int ? null, host: String ? "127.0.0.1", proxy-web-sockets: Bool ? false, extra-config: Attrs ? { } } -> Attrs
     create-proxy =
-      { port ? null
+      {
-      , host ? "127.0.0.1"
+        port ? null,
-      , proxy-web-sockets ? false
+        host ? "127.0.0.1",
-      , extra-config ? { }
+        proxy-web-sockets ? false,
+        extra-config ? { },
       }:
-        assert assertMsg (port != "" && port != null) "port cannot be empty";
+      assert assertMsg (port != "" && port != null) "port cannot be empty";
-        assert assertMsg (host != "") "host cannot be empty";
+      assert assertMsg (host != "") "host cannot be empty";
-        extra-config // {
+      extra-config
-          locations = (extra-config.locations or { }) // {
+      // {
-            "/" = (extra-config.locations."/" or { }) // {
+        locations = (extra-config.locations or { }) // {
-              proxyPass =
+          "/" = (extra-config.locations."/" or { }) // {
-                "http://${host}${if port != null then ":${builtins.toString port}" else ""}";
+            proxyPass = "http://${host}${if port != null then ":${builtins.toString port}" else ""}";
 
-              proxyWebsockets = proxy-web-sockets;
+            proxyWebsockets = proxy-web-sockets;
-            };
           };
         };
+      };
   };
 }

modules/darwin/home/default.nix

@@ -1,4 +1,11 @@
-{ options, config, pkgs, lib, inputs, ... }:
+{
+  options,
+  config,
+  pkgs,
+  lib,
+  inputs,
+  ...
+}:
 
 with lib;
 with lib.metacfg;
@@ -11,10 +18,10 @@ in
   # ];
 
   options.metacfg.home = with types; {
-    file = mkOpt attrs { }
+    file = mkOpt attrs { } "A set of files to be managed by home-manager's <option>home.file</option>.";
-      "A set of files to be managed by home-manager's <option>home.file</option>.";
+    configFile =
-    configFile = mkOpt attrs { }
+      mkOpt attrs { }
-      "A set of files to be managed by home-manager's <option>xdg.configFile</option>.";
+        "A set of files to be managed by home-manager's <option>xdg.configFile</option>.";
     extraOptions = mkOpt attrs { } "Options to pass directly to home-manager.";
     homeConfig = mkOpt attrs { } "Final config for home-manager.";
   };

modules/darwin/nix/default.nix

@@ -1,11 +1,13 @@
-{ options
+{
-, config
+  options,
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
+  ...
 }:
 with lib;
-with lib.metacfg; let
+with lib.metacfg;
+let
   cfg = config.metacfg.nix;
 in
 {
@@ -24,7 +26,10 @@ in
 
     nix =
       let
-        users = [ "root" config.metacfg.user.name ];
+        users = [
+          "root"
+          config.metacfg.user.name
+        ];
       in
       {
         package = cfg.package;
@@ -60,7 +65,9 @@ in
 
         gc = {
           automatic = true;
-          interval = { Day = 7; };
+          interval = {
+            Day = 7;
+          };
           options = "--delete-older-than 30d";
           user = config.metacfg.user.name;
         };

modules/darwin/security/gpg/default.nix

@@ -1,4 +1,10 @@
-{ lib, config, pkgs, inputs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  inputs,
+  ...
+}:
 
 let
   inherit (lib) types mkEnableOption mkIf;
@@ -21,9 +27,7 @@ in
   };
 
   config = mkIf cfg.enable {
-    environment.systemPackages = with pkgs; [
+    environment.systemPackages = with pkgs; [ gnupg ];
-      gnupg
-    ];
 
     environment.shellInit = ''
       export GPG_TTY="$(tty)"

modules/darwin/services/base/default.nix

@@ -1,8 +1,9 @@
-{ options
+{
-, config
+  options,
-, lib
+  config,
-, pkgs
+  lib,
-, ...
+  pkgs,
+  ...
 }:
 with lib;
 with lib.metacfg;
@@ -37,7 +38,10 @@ in
         wget
         starship
       ];
-      shells = [ pkgs.fish pkgs.bash ];
+      shells = [
+        pkgs.fish
+        pkgs.bash
+      ];
     };
 
     programs = {

modules/darwin/services/nix-daemon/default.nix

@@ -11,7 +11,5 @@ in
     enable = mkOpt types.bool true "Whether to enable the Nix daemon.";
   };
 
-  config = mkIf cfg.enable {
+  config = mkIf cfg.enable { services.nix-daemon = enabled; };
-    services.nix-daemon = enabled;
-  };
 }

modules/darwin/suites/common/default.nix

@@ -1,4 +1,10 @@
-{ options, config, lib, pkgs, ... }:
+{
+  options,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 with lib;
 with lib.metacfg;

modules/darwin/system/fonts/default.nix

@@ -1,8 +1,15 @@
-{ options, config, pkgs, lib, ... }:
+{
+  options,
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 with lib;
 with lib.metacfg;
-let cfg = config.metacfg.system.fonts;
+let
+  cfg = config.metacfg.system.fonts;
 in
 {
   options.metacfg.system.fonts = with types; {
@@ -17,14 +24,16 @@ in
     };
 
     fonts = {
-      packages = with pkgs;
+      packages =
+        with pkgs;
         [
           noto-fonts
           noto-fonts-cjk-sans
           noto-fonts-cjk-serif
           noto-fonts-emoji
           (nerdfonts.override { fonts = [ "Hack" ]; })
-        ] ++ cfg.fonts;
+        ]
+        ++ cfg.fonts;
     };
   };
 }

modules/darwin/system/interface/default.nix

@@ -1,8 +1,15 @@
-{ options, config, pkgs, lib, ... }:
+{
+  options,
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 with lib;
 with lib.metacfg;
-let cfg = config.metacfg.system.interface;
+let
+  cfg = config.metacfg.system.interface;
 in
 {
   options.metacfg.system.interface = with types; {
@@ -10,25 +17,26 @@ in
   };
 
   config = mkIf cfg.enable {
-    system.activationScripts.applications.text = let
+    system.activationScripts.applications.text =
-      env = pkgs.buildEnv {
+      let
-        name = "system-applications";
+        env = pkgs.buildEnv {
-        paths = config.environment.systemPackages;
+          name = "system-applications";
-        pathsToLink = "/Applications";
+          paths = config.environment.systemPackages;
-      };
+          pathsToLink = "/Applications";
-    in
+        };
+      in
       lib.mkForce ''
-      # Set up applications.
+        # Set up applications.
-      echo "setting up /Applications..." >&2
+        echo "setting up /Applications..." >&2
-      rm -rf /Applications/Nix\ Apps
+        rm -rf /Applications/Nix\ Apps
-      mkdir -p /Applications/Nix\ Apps
+        mkdir -p /Applications/Nix\ Apps
-      find ${env}/Applications -maxdepth 1 -type l -exec readlink '{}' + |
+        find ${env}/Applications -maxdepth 1 -type l -exec readlink '{}' + |
-      while read -r src; do
+        while read -r src; do
-        app_name=$(basename "$src")
+          app_name=$(basename "$src")
-        echo "copying $src" >&2
+          echo "copying $src" >&2
-        ${pkgs.mkalias}/bin/mkalias "$src" "/Applications/Nix Apps/$app_name"
+          ${pkgs.mkalias}/bin/mkalias "$src" "/Applications/Nix Apps/$app_name"
-      done
+        done
-          '';
+      '';
 
     system.defaults = {
       dock.autohide = true;

modules/darwin/user/default.nix

@@ -1,7 +1,8 @@
-{ lib
+{
-, config
+  lib,
-, pkgs
+  config,
-, ...
+  pkgs,
+  ...
 }:
 let
   inherit (lib) types mkIf mkDefault;

modules/home/cli-apps/bash/default.nix

@@ -1,7 +1,8 @@
-{ lib
+{
-, config
+  lib,
-, pkgs
+  config,
-, ...
+  pkgs,
+  ...
 }:
 let
   inherit (lib) mkEnableOption mkIf;
@@ -14,9 +15,7 @@ in
   };
 
   config = mkIf cfg.enable {
-    home.packages = with pkgs; [
+    home.packages = with pkgs; [ bashInteractive ];
-      bashInteractive
-    ];
     programs.bash = {
       enable = true;
       initExtra = ''

modules/home/cli-apps/bat/default.nix

@@ -1,10 +1,12 @@
-{ lib
+{
-, config
+  lib,
-, pkgs
+  config,
-, ...
+  pkgs,
+  ...
 }:
 with lib;
-with lib.metacfg; let
+with lib.metacfg;
+let
   cfg = config.metacfg.cli-apps.bat;
 in
 {
@@ -16,7 +18,12 @@ in
     programs.bat = {
       enable = true;
       config.theme = "ansi";
-      extraPackages = with pkgs.bat-extras; [ batdiff batman batgrep batwatch ];
+      extraPackages = with pkgs.bat-extras; [
+        batdiff
+        batman
+        batgrep
+        batwatch
+      ];
     };
   };
 }

modules/home/cli-apps/fish/default.nix

@@ -1,7 +1,8 @@
-{ lib
+{
-, config
+  lib,
-, pkgs
+  config,
-, ...
+  pkgs,
+  ...
 }:
 let
   inherit (lib) mkEnableOption mkIf;
@@ -33,15 +34,17 @@ in
         end
       '';
 
-      plugins = [{
+      plugins = [
-        name = "foreign-env";
+        {
-        src = pkgs.fetchFromGitHub {
+          name = "foreign-env";
-          owner = "oh-my-fish";
+          src = pkgs.fetchFromGitHub {
-          repo = "plugin-foreign-env";
+            owner = "oh-my-fish";
-          rev = "dddd9213272a0ab848d474d0cbde12ad034e65bc";
+            repo = "plugin-foreign-env";
-          sha256 = "00xqlyl3lffc5l0viin1nyp819wf81fncqyz87jx8ljjdhilmgbs";
+            rev = "dddd9213272a0ab848d474d0cbde12ad034e65bc";
-        };
+            sha256 = "00xqlyl3lffc5l0viin1nyp819wf81fncqyz87jx8ljjdhilmgbs";
-      }];
+          };
+        }
+      ];
 
       #      shellInit =
       #        ''

modules/home/cli-apps/home-manager/default.nix

@@ -1,4 +1,9 @@
-{ lib, config, pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 
 let
   inherit (lib) mkEnableOption mkIf;
@@ -24,8 +29,6 @@ in
       man = "${pkgs.bat-extras.batman}/bin/batman";
     };
 
-    home.packages = with pkgs; [
+    home.packages = with pkgs; [ vim ];
-      vim
-    ];
   };
 }

modules/home/cli-apps/neovim/default.nix

@@ -1,4 +1,9 @@
-{ lib, config, pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 
 let
   inherit (lib) mkEnableOption mkIf;
@@ -199,7 +204,10 @@ in
               nix = 110;
               ruby = 120;
               java = 130;
-              go = [ 90 130 ];
+              go = [
+                90
+                130
+              ];
             };
           };
         };
@@ -223,7 +231,10 @@ in
           comment-nvim.enable = true;
         };
 
-        vim.spellChecking.languages = [ "en" "de" ];
+        vim.spellChecking.languages = [
+          "en"
+          "de"
+        ];
       };
     };
   };

modules/home/cli-apps/starship/default.nix

@@ -1,7 +1,8 @@
-{ lib
+{
-, config
+  lib,
-, pkgs
+  config,
-, ...
+  pkgs,
+  ...
 }:
 let
   inherit (lib) mkEnableOption mkIf;
@@ -15,16 +16,22 @@ in
 
   config = mkIf cfg.enable {
     home.packages = with pkgs; [
-      (pkgs.nerdfonts.override { fonts = [ "FiraCode" "DroidSansMono" "JetBrainsMono" ]; })
+      (pkgs.nerdfonts.override {
+        fonts = [
+          "FiraCode"
+          "DroidSansMono"
+          "JetBrainsMono"
+        ];
+      })
     ];
     programs.starship = {
       enable = true;
       settings = {
         container.format = "[\\[$name\\]]($style) ";
         git_status = {
-          ahead = "⇡$\{count}";
+          ahead = "⇡\${count}";
-          diverged = "⇕⇡$\{ahead_count}⇣$\{behind_count}";
+          diverged = "⇕⇡\${ahead_count}⇣\${behind_count}";
-          behind = "⇣$\{count}";
+          behind = "⇣\${count}";
         };
       };
     };

modules/home/cli-apps/tmux/default.nix

@@ -1,10 +1,12 @@
-{ lib
+{
-, config
+  lib,
-, pkgs
+  config,
-, ...
+  pkgs,
+  ...
 }:
 with lib;
-with lib.metacfg; let
+with lib.metacfg;
+let
   cfg = config.metacfg.cli-apps.tmux;
 in
 {
@@ -12,9 +14,5 @@ in
     enable = mkEnableOption "Tmux";
   };
 
-  config = mkIf cfg.enable {
+  config = mkIf cfg.enable { home.packages = with pkgs; [ tmux ]; };
-    home.packages = with pkgs; [
-      tmux
-    ];
-  };
 }

modules/home/host/default.nix

@@ -1,4 +1,11 @@
-{ lib, config, pkgs, host ? null, format ? "unknown", ... }:
+{
+  lib,
+  config,
+  pkgs,
+  host ? null,
+  format ? "unknown",
+  ...
+}:
 
 let
   inherit (lib) types;

modules/home/tools/alacritty/default.nix

@@ -1,7 +1,8 @@
-{ lib
+{
-, config
+  lib,
-, pkgs
+  config,
-, ...
+  pkgs,
+  ...
 }:
 let
   inherit (lib) mkEnableOption mkIf;
@@ -16,7 +17,13 @@ in
   config = mkIf cfg.enable {
     home.packages = with pkgs; [
       alacritty
-      (pkgs.nerdfonts.override { fonts = [ "FiraCode" "DroidSansMono" "JetBrainsMono" ]; })
+      (pkgs.nerdfonts.override {
+        fonts = [
+          "FiraCode"
+          "DroidSansMono"
+          "JetBrainsMono"
+        ];
+      })
     ];
   };
 }

modules/home/tools/direnv/default.nix

@@ -1,8 +1,15 @@
-{ options, config, lib, pkgs, ... }:
+{
+  options,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 with lib;
 with lib.metacfg;
-let cfg = config.metacfg.tools.direnv;
+let
+  cfg = config.metacfg.tools.direnv;
 in
 {
   options.metacfg.tools.direnv = with types; {

modules/home/tools/git/default.nix

@@ -1,4 +1,9 @@
-{ lib, config, pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 
 let
   inherit (lib) types mkEnableOption mkIf;
@@ -13,7 +18,8 @@ in
     userName = mkOpt types.str user.fullName "The name to configure git with.";
     userEmail = mkOpt types.str user.email "The email to configure git with.";
     signingKey =
-      mkOpt types.str "7F3D64824AC0B6B8009E50504BC0896FB5693595" "The key ID to sign commits with.";
+      mkOpt types.str "7F3D64824AC0B6B8009E50504BC0896FB5693595"
+        "The key ID to sign commits with.";
     signByDefault = mkOpt types.bool false "Whether to sign commits by default.";
   };
 
@@ -32,10 +38,18 @@ in
         inherit (cfg) signByDefault;
       };
       extraConfig = {
-        init = { defaultBranch = "main"; };
+        init = {
-        pull = { rebase = true; };
+          defaultBranch = "main";
-        push = { autoSetupRemote = true; };
+        };
-        core = { whitespace = "trailing-space,space-before-tab"; };
+        pull = {
+          rebase = true;
+        };
+        push = {
+          autoSetupRemote = true;
+        };
+        core = {
+          whitespace = "trailing-space,space-before-tab";
+        };
         safe = {
           directory = "${user.home}/git";
         };

modules/home/tools/jetbrains/default.nix

@@ -1,8 +1,15 @@
-{ options, config, lib, pkgs, ... }:
+{
+  options,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 with lib;
 with lib.metacfg;
-let cfg = config.metacfg.tools.jetbrains;
+let
+  cfg = config.metacfg.tools.jetbrains;
 in
 {
   options.metacfg.tools.jetbrains = with types; {
@@ -10,12 +17,16 @@ in
   };
 
   config = mkIf cfg.enable {
-    home.sessionPath = [
+    home.sessionPath = [ "$HOME/.local/share/JetBrains/Toolbox/scripts" ];
-      "$HOME/.local/share/JetBrains/Toolbox/scripts"
-    ];
     home.packages = with pkgs; [
       jetbrains-toolbox
-      (pkgs.nerdfonts.override { fonts = [ "FiraCode" "DroidSansMono" "JetBrainsMono" ]; })
+      (pkgs.nerdfonts.override {
+        fonts = [
+          "FiraCode"
+          "DroidSansMono"
+          "JetBrainsMono"
+        ];
+      })
     ];
   };
 }

modules/home/tools/ssh/default.nix

@@ -1,4 +1,9 @@
-{ lib, config, pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 
 let
   inherit (lib) types mkEnableOption mkIf;
@@ -10,9 +15,7 @@ in
   };
 
   config = mkIf cfg.enable {
-    home.packages = with pkgs; [
+    home.packages = with pkgs; [ mosh ];
-      mosh
-    ];
     programs.ssh = {
       enable = true;
       extraConfig = ''

modules/home/user/default.nix

@@ -1,7 +1,18 @@
-{ lib, config, pkgs, osConfig ? { }, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  osConfig ? { },
+  ...
+}:
 
 let
-  inherit (lib) types mkIf mkDefault mkMerge;
+  inherit (lib)
+    types
+    mkIf
+    mkDefault
+    mkMerge
+    ;
   inherit (lib.metacfg) mkOpt;
 
   cfg = config.metacfg.user;

modules/nixos/home/default.nix

@@ -1,15 +1,23 @@
-{ options, config, pkgs, lib, inputs, ... }:
+{
+  options,
+  config,
+  pkgs,
+  lib,
+  inputs,
+  ...
+}:
 
 with lib;
 with lib.metacfg;
-let cfg = config.metacfg.home;
+let
+  cfg = config.metacfg.home;
 in
 {
   options.metacfg.home = with types; {
-    file = mkOpt attrs { }
+    file = mkOpt attrs { } (mdDoc "A set of files to be managed by home-manager's `home.file`.");
-      (mdDoc "A set of files to be managed by home-manager's `home.file`.");
+    configFile = mkOpt attrs { } (
-    configFile = mkOpt attrs { }
+      mdDoc "A set of files to be managed by home-manager's `xdg.configFile`."
-      (mdDoc "A set of files to be managed by home-manager's `xdg.configFile`.");
+    );
     extraOptions = mkOpt attrs { } "Options to pass directly to home-manager.";
   };
 
@@ -25,8 +33,7 @@ in
       useUserPackages = true;
       useGlobalPkgs = true;
 
-      users.${config.metacfg.user.name} =
+      users.${config.metacfg.user.name} = mkAliasDefinitions options.metacfg.home.extraOptions;
-        mkAliasDefinitions options.metacfg.home.extraOptions;
     };
   };
 }

modules/nixos/nix-ld/default.nix

@@ -1,8 +1,15 @@
-{ options, config, lib, pkgs, ... }:
+{
+  options,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 with lib;
 with lib.metacfg;
-let cfg = config.metacfg.nix-ld;
+let
+  cfg = config.metacfg.nix-ld;
 in
 {
   options.metacfg.nix-ld = with types; {

modules/nixos/nix/default.nix

@@ -1,15 +1,25 @@
-{ options, config, pkgs, lib, inputs, ... }:
+{
+  options,
+  config,
+  pkgs,
+  lib,
+  inputs,
+  ...
+}:
 
 with lib;
 with lib.metacfg;
 let
   cfg = config.metacfg.nix;
 
-  substituters-submodule = types.submodule ({ name, ... }: {
+  substituters-submodule = types.submodule (
-    options = with types; {
+    { name, ... }:
-      key = mkOpt (nullOr str) null "The trusted public key for this substituter.";
+    {
-    };
+      options = with types; {
-  });
+        key = mkOpt (nullOr str) null "The trusted public key for this substituter.";
+      };
+    }
+  );
 in
 {
   options.metacfg.nix = with types; {
@@ -18,25 +28,23 @@ in
 
     default-substituter = {
       url = mkOpt str "https://cache.nixos.org" "The url for the substituter.";
-      key = mkOpt str "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" "The trusted public key for the substituter.";
+      key =
+        mkOpt str "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+          "The trusted public key for the substituter.";
     };
 
     extra-substituters = mkOpt (attrsOf substituters-submodule) { } "Extra substituters to configure.";
   };
 
   config = mkIf cfg.enable {
-    assertions = mapAttrsToList
+    assertions = mapAttrsToList (name: value: {
-      (name: value: {
+      assertion = value.key != null;
-        assertion = value.key != null;
+      message = "metacfg.nix.extra-substituters.${name}.key must be set";
-        message = "metacfg.nix.extra-substituters.${name}.key must be set";
+    }) cfg.extra-substituters;
-      })
-      cfg.extra-substituters;
 
     environment.systemPackages = with pkgs; [
       metacfg.nixos-revision
-      (metacfg.nixos-hosts.override {
+      (metacfg.nixos-hosts.override { hosts = inputs.self.nixosConfigurations; })
-        hosts = inputs.self.nixosConfigurations;
-      })
       deploy-rs
       nixfmt
       nix-index
@@ -48,8 +56,10 @@ in
 
     nix =
       let
-        users = [ "root" config.metacfg.user.name ] ++
+        users = [
-          optional config.services.hydra.enable "hydra";
+          "root"
+          config.metacfg.user.name
+        ] ++ optional config.services.hydra.enable "hydra";
         extra-substituters = cfg.extra-substituters // {
           "https://attic.teepot.org/tee-pot".key = "tee-pot:SS6HcrpG87S1M6HZGPsfo7d1xJccCGev7/tXc5+I4jg=";
         };
@@ -57,29 +67,29 @@ in
       {
         package = cfg.package;
 
-        settings = {
+        settings =
-          experimental-features = "nix-command flakes";
+          {
-          http-connections = 50;
+            experimental-features = "nix-command flakes";
-          warn-dirty = false;
+            http-connections = 50;
-          log-lines = 50;
+            warn-dirty = false;
-          sandbox = true;
+            log-lines = 50;
-          auto-optimise-store = true;
+            sandbox = true;
-          trusted-users = users;
+            auto-optimise-store = true;
-          allowed-users = users;
+            trusted-users = users;
+            allowed-users = users;
 
-          substituters =
+            substituters = [
-            [ cfg.default-substituter.url ]
+              cfg.default-substituter.url
-              ++
+            ] ++ (mapAttrsToList (name: value: name) extra-substituters);
-              (mapAttrsToList (name: value: name) extra-substituters);
+            trusted-public-keys = [
-          trusted-public-keys =
+              cfg.default-substituter.key
-            [ cfg.default-substituter.key ]
+            ] ++ (mapAttrsToList (name: value: value.key) extra-substituters);
-              ++
-              (mapAttrsToList (name: value: value.key) extra-substituters);
 
-        } // (lib.optionalAttrs config.metacfg.tools.direnv.enable {
+          }
-          keep-outputs = true;
+          // (lib.optionalAttrs config.metacfg.tools.direnv.enable {
-          keep-derivations = true;
+            keep-outputs = true;
-        });
+            keep-derivations = true;
+          });
 
         gc = {
           automatic = true;

modules/nixos/services/base/default.nix

@@ -1,8 +1,9 @@
-{ options
+{
-, config
+  options,
-, lib
+  config,
-, pkgs
+  lib,
-, ...
+  pkgs,
+  ...
 }:
 with lib;
 with lib.metacfg;
@@ -39,7 +40,9 @@ in
     };
 
     environment = {
-      sessionVariables = { PATH = "$HOME/bin"; };
+      sessionVariables = {
+        PATH = "$HOME/bin";
+      };
       systemPackages = with pkgs; [
         age
         bash
@@ -73,7 +76,10 @@ in
             "$@"
         '')
       ];
-      shells = [ pkgs.fish pkgs.bash ];
+      shells = [
+        pkgs.fish
+        pkgs.bash
+      ];
     };
 
     hardware = {

modules/nixos/services/gui/default.nix

@@ -1,8 +1,15 @@
-{ options, config, lib, pkgs, ... }:
+{
+  options,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 with lib;
 with lib.metacfg;
-let cfg = config.metacfg.gui;
+let
+  cfg = config.metacfg.gui;
 in
 {
   options.metacfg.gui = with types; {
@@ -150,7 +157,13 @@ in
         noto-fonts-emoji
         liberation_ttf
         freefont_ttf
-        (nerdfonts.override { fonts = [ "FiraCode" "DroidSansMono" "JetBrainsMono" ]; })
+        (nerdfonts.override {
+          fonts = [
+            "FiraCode"
+            "DroidSansMono"
+            "JetBrainsMono"
+          ];
+        })
       ];
 
       fontconfig = {

modules/nixos/services/homeprinter/default.nix

@@ -1,8 +1,15 @@
-{ options, config, lib, pkgs, ... }:
+{
+  options,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 with lib;
 with lib.metacfg;
-let cfg = config.metacfg.homeprinter;
+let
+  cfg = config.metacfg.homeprinter;
 in
 {
   options.metacfg.homeprinter = with types; {

modules/nixos/services/podman/default.nix

@@ -1,8 +1,15 @@
-{ options, config, lib, pkgs, ... }:
+{
+  options,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 with lib;
 with lib.metacfg;
-let cfg = config.metacfg.podman;
+let
+  cfg = config.metacfg.podman;
 in
 {
   options.metacfg.podman = with types; {
@@ -18,7 +25,9 @@ in
         dockerCompat = lib.mkDefault true;
 
         # For Nixos version > 22.11
-        defaultNetwork.settings = { dns_enabled = true; };
+        defaultNetwork.settings = {
+          dns_enabled = true;
+        };
       };
     };
   };

modules/nixos/services/secureboot/default.nix

@@ -1,8 +1,15 @@
-{ options, config, lib, pkgs, ... }:
+{
+  options,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 with lib;
 with lib.metacfg;
-let cfg = config.metacfg.secureboot;
+let
+  cfg = config.metacfg.secureboot;
 in
 {
   options.metacfg.secureboot = with types; {

modules/nixos/sgx/aesmd_dcap/default.nix

@@ -1,4 +1,10 @@
-{ options, config, lib, pkgs, ... }:
+{
+  options,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 with lib;
 with lib.metacfg;
@@ -21,14 +27,15 @@ in
       quoteProviderLibrary = pkgs.nixsgx.sgx-dcap.default_qpl;
     };
     systemd.services.aesmd = {
-      environment.LD_LIBRARY_PATH = lib.mkForce (lib.makeLibraryPath [ pkgs.nixsgx.sgx-dcap.default_qpl pkgs.curl.out ]);
+      environment.LD_LIBRARY_PATH = lib.mkForce (
+        lib.makeLibraryPath [
+          pkgs.nixsgx.sgx-dcap.default_qpl
+          pkgs.curl.out
+        ]
+      );
       serviceConfig = {
-        BindReadOnlyPaths = [
+        BindReadOnlyPaths = [ "/etc/sgx_default_qcnl.conf" ];
-          "/etc/sgx_default_qcnl.conf"
+        BindPaths = [ "/dev/log" ];
-        ];
-        BindPaths = [
-          "/dev/log"
-        ];
       };
     };
   };

modules/nixos/sgx/pccs/default.nix

@@ -1,4 +1,10 @@
-{ options, config, lib, pkgs, ... }:
+{
+  options,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 with lib;
 with lib.metacfg;
@@ -49,21 +55,19 @@ in
       };
     };
 
-    systemd.services.pccs-secret =
+    systemd.services.pccs-secret = {
-      {
+      description = "Inject pccs secret";
-        description = "Inject pccs secret";
+      wantedBy = [ "multi-user.target" ];
-        wantedBy = [ "multi-user.target" ];
+      before = [ "podman-pccs.service" ];
-        before = [ "podman-pccs.service" ];
 
-        serviceConfig = {
+      serviceConfig = {
-          EnvironmentFile = cfg.secret;
+        EnvironmentFile = cfg.secret;
-          ExecStart = ''
+        ExecStart = ''
-            -${pkgs.podman}/bin/podman secret create --env PCCS_CONFIG PCCS_CONFIG
+          -${pkgs.podman}/bin/podman secret create --env PCCS_CONFIG PCCS_CONFIG
-          '';
+        '';
-          RemainAfterExit = true;
+        RemainAfterExit = true;
-        };
       };
-
+    };
 
   };
 }

modules/nixos/tools/direnv/default.nix

@@ -1,8 +1,15 @@
-{ options, config, lib, pkgs, ... }:
+{
+  options,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 with lib;
 with lib.metacfg;
-let cfg = config.metacfg.tools.direnv;
+let
+  cfg = config.metacfg.tools.direnv;
 in
 {
   options.metacfg.tools.direnv = with types; {

modules/nixos/tools/git/default.nix

@@ -1,4 +1,10 @@
-{ options, config, pkgs, lib, ... }:
+{
+  options,
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 with lib;
 with lib.metacfg;
@@ -12,8 +18,7 @@ in
     enable = mkBoolOpt false "Whether or not to install and configure git.";
     userName = mkOpt types.str user.fullName "The name to configure git with.";
     userEmail = mkOpt types.str user.email "The email to configure git with.";
-    signingKey =
+    signingKey = mkOpt types.str "9762169A1B35EA68" "The key ID to sign commits with.";
-      mkOpt types.str "9762169A1B35EA68" "The key ID to sign commits with.";
   };
 
   config = mkIf cfg.enable {
@@ -29,10 +34,18 @@ in
           signByDefault = mkIf gpg.enable true;
         };
         extraConfig = {
-          init = { defaultBranch = "main"; };
+          init = {
-          pull = { rebase = true; };
+            defaultBranch = "main";
-          push = { autoSetupRemote = true; };
+          };
-          core = { whitespace = "trailing-space,space-before-tab"; };
+          pull = {
+            rebase = true;
+          };
+          push = {
+            autoSetupRemote = true;
+          };
+          core = {
+            whitespace = "trailing-space,space-before-tab";
+          };
           safe = {
             directory = "${user.home}/git";
           };

modules/nixos/user/default.nix

@@ -1,11 +1,13 @@
-{ options
+{
-, config
+  options,
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
+  ...
 }:
 with lib;
-with lib.metacfg; let
+with lib.metacfg;
+let
   cfg = config.metacfg.user;
   defaultIconFileName = "profile.jpg";
   defaultIcon = pkgs.stdenvNoCC.mkDerivation {
@@ -18,11 +20,17 @@ with lib.metacfg; let
       cp $src $out
     '';
 
-    passthru = { fileName = defaultIconFileName; };
+    passthru = {
+      fileName = defaultIconFileName;
+    };
   };
   propagatedIcon =
     pkgs.runCommandNoCC "propagated-icon"
-      { passthru = { fileName = cfg.icon.fileName; }; }
+      {
+        passthru = {
+          fileName = cfg.icon.fileName;
+        };
+      }
       ''
         local target="$out/share/metacfg-icons/user/${cfg.name}"
         mkdir -p "$target"
@@ -38,9 +46,7 @@ in
     initialPassword =
       mkOpt str "password"
         "The initial password to use when the user is first created.";
-    icon =
+    icon = mkOpt (nullOr package) defaultIcon "The profile picture to use for the user.";
-      mkOpt (nullOr package) defaultIcon
-        "The profile picture to use for the user.";
     prompt-init = mkBoolOpt true "Whether or not to show an initial message when opening a new shell.";
     extraGroups = mkOpt (listOf str) [ ] "Groups for the user to be assigned.";
     sshKeys = mkOpt (listOf str) [
@@ -49,14 +55,11 @@ in
       "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAYbUTKpy4QR3s944/hjJ1UK05asFEs/SmWeUbtS0cdA660sT4xHnRfals73FicOoz+uIucJCwn/SCM804j+wtM="
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMNsmP15vH8BVKo7bdvIiiEjiQboPGcRPqJK0+bH4jKD harald@lenovo.fritz.box"
     ] "ssh keys";
-    extraOptions =
+    extraOptions = mkOpt attrs { } (mdDoc "Extra options passed to `users.users.<name>`.");
-      mkOpt attrs { }
-        (mdDoc "Extra options passed to `users.users.<name>`.");
   };
 
   config = {
-    environment.systemPackages = with pkgs; [
+    environment.systemPackages = with pkgs; [ ];
-    ];
 
     metacfg.home = {
       file = {
@@ -68,10 +71,7 @@ in
         "Videos/.keep".text = "";
         "work/.keep".text = "";
         ".face".source = cfg.icon;
-        "Pictures/${
+        "Pictures/${cfg.icon.fileName or (builtins.baseNameOf cfg.icon)}".source = cfg.icon;
-          cfg.icon.fileName or (builtins.baseNameOf cfg.icon)
-        }".source =
-          cfg.icon;
       };
 
       extraOptions.programs.bash.initExtra = ''
@@ -85,27 +85,25 @@ in
       '';
     };
 
-    users.users.${cfg.name} =
+    users.users.${cfg.name} = {
-      {
+      isNormalUser = true;
-        isNormalUser = true;
 
-        # inherit (cfg) name initialPassword;
+      # inherit (cfg) name initialPassword;
 
-        openssh.authorizedKeys.keys = cfg.sshKeys;
+      openssh.authorizedKeys.keys = cfg.sshKeys;
-        home = "/home/${cfg.name}";
+      home = "/home/${cfg.name}";
-        group = "users";
+      group = "users";
 
-        shell = pkgs.bash;
+      shell = pkgs.bash;
 
-        # Arbitrary user ID to use for the user. Since I only
+      # Arbitrary user ID to use for the user. Since I only
-        # have a single user on my machines this won't ever collide.
+      # have a single user on my machines this won't ever collide.
-        # However, if you add multiple users you'll need to change this
+      # However, if you add multiple users you'll need to change this
-        # so each user has their own unique uid (or leave it out for the
+      # so each user has their own unique uid (or leave it out for the
-        # system to select).
+      # system to select).
-        uid = 1000;
+      uid = 1000;
 
-        extraGroups = [ "wheel" ] ++ cfg.extraGroups;
+      extraGroups = [ "wheel" ] ++ cfg.extraGroups;
-      }
+    } // cfg.extraOptions;
-      // cfg.extraOptions;
   };
 }

overlays/nixsgx/default.nix

@@ -1,5 +1 @@
-{ channels, ... }:
+{ channels, ... }: final: prev: { inherit (channels.nixpkgs.nixsgx) sgx-psw; }
-final: prev:
-{
-  inherit (channels.nixpkgs.nixsgx) sgx-psw;
-}

packages/dcpl2530dw-cups/default.nix

@@ -1,17 +1,18 @@
-{ lib
+{
-, stdenv
+  lib,
-, fetchurl
+  stdenv,
-, makeWrapper
+  fetchurl,
-, cups
+  makeWrapper,
-, dpkg
+  cups,
-, a2ps
+  dpkg,
-, ghostscript
+  a2ps,
-, gnugrep
+  ghostscript,
-, gnused
+  gnugrep,
-, coreutils
+  gnused,
-, file
+  coreutils,
-, perl
+  file,
-, which
+  perl,
+  which,
 }:
 
 stdenv.mkDerivation rec {
@@ -27,7 +28,12 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ cups ghostscript dpkg a2ps ];
+  buildInputs = [
+    cups
+    ghostscript
+    dpkg
+    a2ps
+  ];
 
   dontUnpack = true;
 
@@ -55,9 +61,14 @@ stdenv.mkDerivation rec {
     ; do
       #substituteInPlace $f \
       wrapProgram $f \
-        --prefix PATH : ${lib.makeBinPath [
+        --prefix PATH : ${
-          coreutils ghostscript gnugrep gnused
+          lib.makeBinPath [
-        ]}
+            coreutils
+            ghostscript
+            gnugrep
+            gnused
+          ]
+        }
     done
 
     mkdir -p $out/lib/cups/filter/
@@ -67,7 +78,17 @@ stdenv.mkDerivation rec {
     ln -s $out/opt/brother/Printers/DCPL2530DW/cupswrapper/brother-DCPL2530DW-cups-en.ppd $out/share/cups/model/
 
     wrapProgram $out/opt/brother/Printers/DCPL2530DW/lpd/lpdfilter \
-      --prefix PATH ":" ${ lib.makeBinPath [ ghostscript a2ps file gnused gnugrep coreutils which ] }
+      --prefix PATH ":" ${
+        lib.makeBinPath [
+          ghostscript
+          a2ps
+          file
+          gnused
+          gnugrep
+          coreutils
+          which
+        ]
+      }
   '';
 
   meta = with lib; {
@@ -79,4 +100,3 @@ stdenv.mkDerivation rec {
     downloadPage = "https://www.brother.de/support/dcp-l2530dw/downloads";
   };
 }
-

packages/nixos-hosts/default.nix

@@ -1,11 +1,12 @@
-{ lib
+{
-, writeText
+  lib,
-, writeShellApplication
+  writeText,
-, substituteAll
+  writeShellApplication,
-, gum
+  substituteAll,
-, inputs
+  gum,
-, hosts ? { }
+  inputs,
-, ...
+  hosts ? { },
+  ...
 }:
 
 let
@@ -14,9 +15,7 @@ let
 
   substitute = args: builtins.readFile (substituteAll args);
 
-  formatted-hosts = mapAttrsToList
+  formatted-hosts = mapAttrsToList (name: host: "${name},${host.pkgs.system}") hosts;
-    (name: host: "${name},${host.pkgs.system}")
-    hosts;
 
   hosts-csv = writeText "hosts.csv" ''
     Name,System
@@ -35,9 +34,7 @@ let
 
     checkPhase = "";
 
-    runtimeInputs = [
+    runtimeInputs = [ gum ];
-      gum
-    ];
   };
 
   new-meta = with lib; {

packages/nixos-revision/default.nix

@@ -1,7 +1,8 @@
-{ pkgs
+{
-, lib
+  pkgs,
-, gitHostCommitUrl ? "https://git.hoyer.xyz/harald/nixcfg/commit"
+  lib,
-, ...
+  gitHostCommitUrl ? "https://git.hoyer.xyz/harald/nixcfg/commit",
+  ...
 }:
 
 let
@@ -13,61 +14,60 @@ let
     maintainers = with maintainers; [ jakehamilton ];
   };
 
-  package =
+  package = pkgs.writeShellScriptBin "nixos-revision" ''
-    pkgs.writeShellScriptBin "nixos-revision" ''
+    HAS_HELP=false
-      HAS_HELP=false
+    HAS_OPEN=false
-      HAS_OPEN=false
 
-      while [[ $# -gt 0 ]]; do
+    while [[ $# -gt 0 ]]; do
-      	case $1 in
+    	case $1 in
-      		-h|--help)
+    		-h|--help)
-      			HAS_HELP=true
+    			HAS_HELP=true
-      			shift
+    			shift
-      			;;
+    			;;
-      		-o|--open)
+    		-o|--open)
-      			HAS_OPEN=true
+    			HAS_OPEN=true
-      			shift
+    			shift
-      			;;
+    			;;
-      		*)
+    		*)
-      			shift
+    			shift
-      			;;
+    			;;
-      	esac
+    	esac
-      done
+    done
 
-      if [ $HAS_HELP == true ]; then
+    if [ $HAS_HELP == true ]; then
-      	HELP_MSG="
+    	HELP_MSG="
-      nixos-revision
+    nixos-revision
 
-      USAGE
+    USAGE
 
-        nixos-revision [options]
+      nixos-revision [options]
 
-      OPTIONS
+    OPTIONS
 
-        -h, --help              Show this help message
+      -h, --help              Show this help message
-        -o, --open              Open the revision on GitHub
+      -o, --open              Open the revision on GitHub
 
-      EXAMPLES
+    EXAMPLES
 
-        $ # Print the current revision
+      $ # Print the current revision
-        $ nixos-revision
+      $ nixos-revision
 
-        $ # Open the current revision on GitHub
+      $ # Open the current revision on GitHub
-        $ nixos-revision --open
+      $ nixos-revision --open
-      "
+    "
-      	echo "$HELP_MSG"
+    	echo "$HELP_MSG"
-        exit 0
+      exit 0
-      fi
+    fi
 
-      REVISION=$(nixos-version --json | ${pkgs.jq}/bin/jq -r .configurationRevision)
+    REVISION=$(nixos-version --json | ${pkgs.jq}/bin/jq -r .configurationRevision)
 
-      if [ $HAS_OPEN == true ]; then
+    if [ $HAS_OPEN == true ]; then
-        GITHUB_URL="${gitHostCommitUrl}/$REVISION"
+      GITHUB_URL="${gitHostCommitUrl}/$REVISION"
-        echo "Opening URL: $GITHUB_URL"
+      echo "Opening URL: $GITHUB_URL"
-        ${pkgs.xdg-utils}/bin/xdg-open $GITHUB_URL
+      ${pkgs.xdg-utils}/bin/xdg-open $GITHUB_URL
-      else
+    else
-        echo $REVISION
+      echo $REVISION
-      fi
+    fi
-    '';
+  '';
 in
 override-meta new-meta package

packages/rot8000/default.nix

@@ -1,8 +1,9 @@
-{ lib
+{
-, stdenv
+  lib,
-, rustPlatform
+  stdenv,
-, fetchFromGitHub
+  rustPlatform,
-, ...
+  fetchFromGitHub,
+  ...
 }:
 rustPlatform.buildRustPackage rec {
   pname = "rot8000";

systems/x86_64-darwin/mpro/default.nix

@@ -8,9 +8,7 @@ with lib.metacfg;
     };
   };
 
-  environment.systemPath = [
+  environment.systemPath = [ "/usr/local/Homebrew/bin" ];
-    "/usr/local/Homebrew/bin"
-  ];
 
   users.users.harald.shell = pkgs.fish;
 

systems/x86_64-linux/mx/acme.nix

@@ -1,4 +1,9 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 {
   sops.secrets.internetbs = {
     sopsFile = ../../../.secrets/hetzner/internetbs.yaml; # bring your own password file
@@ -13,27 +18,19 @@
     };
     certs = {
       "surfsite.org" = {
-        extraDomainNames = [
+        extraDomainNames = [ "*.surfsite.org" ];
-          "*.surfsite.org"
-        ];
       };
 
       "hartwin-hoyer.de" = {
-        extraDomainNames = [
+        extraDomainNames = [ "*.hartwin-hoyer.de" ];
-          "*.hartwin-hoyer.de"
-        ];
       };
 
       "herward-hoyer.de" = {
-        extraDomainNames = [
+        extraDomainNames = [ "*.herward-hoyer.de" ];
-          "*.herward-hoyer.de"
-        ];
       };
 
       "varlink.org" = {
-        extraDomainNames = [
+        extraDomainNames = [ "*.varlink.org" ];
-          "*.varlink.org"
-        ];
       };
 
       "meike-hoyer.de" = { };
@@ -71,9 +68,7 @@
       };
 
       "harald-hoyer.de" = {
-        extraDomainNames = [
+        extraDomainNames = [ "*.harald-hoyer.de" ];
-          "*.harald-hoyer.de"
-        ];
       };
     };
   };

systems/x86_64-linux/mx/backup.nix

@@ -4,7 +4,7 @@
     shell = pkgs.bash;
     isNormalUser = true;
     openssh.authorizedKeys.keys = [
-      "restrict,command=\"/run/wrappers/bin/rrsync -ro /\" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQGdtB6BFdXN+cRepkzWhbG5KRIM5nXmHiw1K+CEhGihwWsNVKGgU/q4rePK6PVNflTIoHUfL30jkA7H8VpSzu0XOa97Tqf+sF9VQOFrMjpf2rOWv38nc2GnKpnUu68c17KRZ+i8cnPZH0VUqRzaY/1IPMFH3OYO4qHJAEN5oAsyMFI9pbqFLqRnwNALjxf8fUvR/XB88zt3P34vFFer15FtLr4dlIzoEFGdUSOErmGJGmDzTptMqi/t0kn2AgaBKzMxwGTDUj6adU6KKBERj4ii3ekOrPwcNjsws3Mtlm5p8ycUkwUFoIiXukF6XRzCRSWMbZOgSnu2TfC6jRRrdbMNWn4QGF/jdBvvKcBoD4sChzpG6aF4m+7ue0QuHES7Kd2Rwnq0jbesGuBnRciDN+jssGvxZKX7XEialuXiaTQ4jPUA4zgWq474CR6ksuxpUDlKpH+leWPLtuKlhEZZnJHCMhz8Ewk/ZwiNSbLO97cwJciBM71orGWpFxHciT1QE= root@sgx"
+      ''restrict,command="/run/wrappers/bin/rrsync -ro /" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQGdtB6BFdXN+cRepkzWhbG5KRIM5nXmHiw1K+CEhGihwWsNVKGgU/q4rePK6PVNflTIoHUfL30jkA7H8VpSzu0XOa97Tqf+sF9VQOFrMjpf2rOWv38nc2GnKpnUu68c17KRZ+i8cnPZH0VUqRzaY/1IPMFH3OYO4qHJAEN5oAsyMFI9pbqFLqRnwNALjxf8fUvR/XB88zt3P34vFFer15FtLr4dlIzoEFGdUSOErmGJGmDzTptMqi/t0kn2AgaBKzMxwGTDUj6adU6KKBERj4ii3ekOrPwcNjsws3Mtlm5p8ycUkwUFoIiXukF6XRzCRSWMbZOgSnu2TfC6jRRrdbMNWn4QGF/jdBvvKcBoD4sChzpG6aF4m+7ue0QuHES7Kd2Rwnq0jbesGuBnRciDN+jssGvxZKX7XEialuXiaTQ4jPUA4zgWq474CR6ksuxpUDlKpH+leWPLtuKlhEZZnJHCMhz8Ewk/ZwiNSbLO97cwJciBM71orGWpFxHciT1QE= root@sgx''
     ];
   };
 

systems/x86_64-linux/mx/coturn.nix

@@ -1,4 +1,9 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 {
   sops.secrets."coturn/static-auth-secret" = {
     sopsFile = ../../../.secrets/hetzner/coturn.yaml; # bring your own password file
@@ -8,20 +13,30 @@
 
   networking.firewall =
     let
-      range = with config.services.coturn; [{
+      range = with config.services.coturn; [
-        from = min-port;
+        {
-        to = max-port;
+          from = min-port;
-      }];
+          to = max-port;
+        }
+      ];
     in
     {
       allowedUDPPortRanges = range;
-      allowedTCPPorts = [ 3478 3479 5349 ];
+      allowedTCPPorts = [
-      allowedUDPPorts = [ 3478 3479 5349 ];
+        3478
+        3479
+        5349
+      ];
+      allowedUDPPorts = [
+        3478
+        3479
+        5349
+      ];
     };
 
   # get a certificate
   security.acme.certs.${config.services.coturn.realm} = {
-    /* insert here the right configuration to obtain a certificate */
+    # insert here the right configuration to obtain a certificate
     postRun = "systemctl restart coturn.service";
     group = "turnserver";
   };

systems/x86_64-linux/mx/forgejo.nix

@@ -1,4 +1,9 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 {
   sops.secrets."postgres/gitea_dbpass" = {
     sopsFile = ../../../.secrets/hetzner/postgres.yaml; # bring your own password file

systems/x86_64-linux/mx/hardware-configuration.nix

@@ -1,12 +1,15 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ lib, pkgs, modulesPath, ... }:
+{
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports = [
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
 
   boot.kernelPackages = lib.mkForce pkgs.linuxPackages;
 
@@ -28,15 +31,17 @@
     "rng_core"
   ];
 
-
   boot.swraid.enable = true;
   boot.swraid.mdadmConf = ''
     MAILADDR admin@hoyer.xyz
   '';
   disko.devices = import ./server-raid.nix {
     inherit lib;
-    disks = [ "/dev/sda" "/dev/sdb" ];
+    disks = [
+      "/dev/sda"
+      "/dev/sdb"
+    ];
   };
 
-  swapDevices = [{ device = "/swapfile"; }];
+  swapDevices = [ { device = "/swapfile"; } ];
 }

systems/x86_64-linux/mx/kicker.nix

@@ -9,9 +9,7 @@
         "/home/hartwin/kicker/.htpasswd:/app/public/.htpasswd"
         "/home/hartwin/kicker/live.db:/app/db/data/current.db"
       ];
-      extraOptions = [
+      extraOptions = [ "--pull=always" ];
-        "--pull=always"
-      ];
     };
   };
 }

systems/x86_64-linux/mx/mailserver.nix

@@ -1,4 +1,9 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 {
   # email addresses git smudged
   mailserver = {

systems/x86_64-linux/mx/network.nix

@@ -8,7 +8,10 @@
   services.resolved.extraConfig = "ReadEtcHosts=no";
   services.nscd.enableNsncd = false;
 
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
   networking.firewall.allowPing = true;
 
   networking.hostName = "mx"; # Define your hostname.
@@ -26,20 +29,26 @@
 
   networking.interfaces.enp0s31f6 = {
     ipv6 = {
-      addresses = [{
+      addresses = [
-        address = "2a01:4f9:2b:2e3::2"; # Your IPv6 here
+        {
-        prefixLength = 64;
+          address = "2a01:4f9:2b:2e3::2"; # Your IPv6 here
-      }];
+          prefixLength = 64;
+        }
+      ];
       # Default IPv6 route
-      routes = [{
+      routes = [
-        address = "::";
+        {
-        prefixLength = 0;
+          address = "::";
-        via = "fe80::1";
+          prefixLength = 0;
-      }];
+          via = "fe80::1";
+        }
+      ];
     };
-    ipv4.addresses = [{
+    ipv4.addresses = [
-      address = "95.216.66.178";
+      {
-      prefixLength = 26;
+        address = "95.216.66.178";
-    }];
+        prefixLength = 26;
+      }
+    ];
   };
 }

systems/x86_64-linux/mx/nextcloud.nix

@@ -49,9 +49,7 @@
   };
 
   services.postgresql = {
-    ensureDatabases = [
+    ensureDatabases = [ "nextcloud" ];
-      "nextcloud"
-    ];
     ensureUsers = [
       {
         name = "nextcloud";

systems/x86_64-linux/mx/nginx.nix

@@ -30,7 +30,6 @@
         root = "/var/www/hoyer.xyz/html";
       };
 
-
       "hoyer.world" = {
         enableACME = false;
         useACMEHost = "hoyer.world";
@@ -47,9 +46,7 @@
 
       "hoyer.xyz" = {
         #      serverName = "hoyer.xyz";
-        serverAliases = [
+        serverAliases = [ "www.hoyer.xyz" ];
-          "www.hoyer.xyz"
-        ];
         useACMEHost = "hoyer.xyz";
         enableACME = false;
         forceSSL = true;
@@ -108,17 +105,13 @@
       };
 
       "harald-hoyer.de" = {
-        serverAliases = [
+        serverAliases = [ "www.harald-hoyer.de" ];
-          "www.harald-hoyer.de"
-        ];
         useACMEHost = "harald-hoyer.de";
         globalRedirect = "harald.hoyer.xyz";
         forceSSL = true;
       };
       "harald.hoyer.xyz" = {
-        serverAliases = [
+        serverAliases = [ "www.harald.hoyer.xyz" ];
-          "www.harald.hoyer.xyz"
-        ];
         useACMEHost = "hoyer.xyz";
         root = "/var/www/harald.hoyer.xyz/html/";
         extraConfig = ''
@@ -141,9 +134,7 @@
       };
 
       "hartwin-hoyer.de" = {
-        serverAliases = [
+        serverAliases = [ "www.hartwin-hoyer.de" ];
-          "www.hartwin-hoyer.de"
-        ];
         useACMEHost = "hartwin-hoyer.de";
         globalRedirect = "hartwin.hoyer.xyz";
         forceSSL = true;

systems/x86_64-linux/mx/postgresql.nix

@@ -1,4 +1,9 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 {
   services.postgresql = {
     package = pkgs.postgresql_14;

systems/x86_64-linux/mx/rspamd.nix

@@ -10,10 +10,12 @@ let
   '';
 in
 {
-  services.rspamd.workers.controller.bindSockets = [{
+  services.rspamd.workers.controller.bindSockets = [
-    socket = "/run/rspamd/worker-controller.sock";
+    {
-    mode = "0660";
+      socket = "/run/rspamd/worker-controller.sock";
-  }];
+      mode = "0660";
+    }
+  ];
   services.rspamd.locals = {
     "settings.conf".text = ''
       bogenschiessen {

systems/x86_64-linux/mx/server-raid.nix

@@ -1,4 +1,11 @@
-{ disks ? [ "/dev/sda" "/dev/sdb" ], ... }: {
+{
+  disks ? [
+    "/dev/sda"
+    "/dev/sdb"
+  ],
+  ...
+}:
+{
   disk = {
     one = {
       type = "disk";

systems/x86_64-linux/sgx-attic/atticd.nix

@@ -1,18 +1,21 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 {
   services.postgresql = {
     enable = true;
     ensureDatabases = [ "attic" ];
-    ensureUsers = [{ name = "atticd"; }];
+    ensureUsers = [ { name = "atticd"; } ];
   };
 
   systemd.services.postgresql.postStart = lib.mkAfter ''
     $PSQL -tAc 'ALTER DATABASE "attic" OWNER TO "atticd"'
   '';
 
-  environment.systemPackages = with pkgs; [
+  environment.systemPackages = with pkgs; [ attic-client ];
-    attic-client
-  ];
   services.atticd = {
     enable = true;
 

systems/x86_64-linux/sgx-attic/default.nix

@@ -1,4 +1,9 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 with lib;
 with lib.metacfg;
 {

systems/x86_64-linux/sgx-attic/hardware-configuration.nix

@@ -1,17 +1,28 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [
-    [
+    ./disko.nix
-      ./disko.nix
+    (modulesPath + "/profiles/qemu-guest.nix")
-      (modulesPath + "/profiles/qemu-guest.nix")
+  ];
-    ];
   disko.devices.disk.main.device = "/dev/vda";
 
-  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ];
+  boot.initrd.availableKernelModules = [
+    "ahci"
+    "xhci_pci"
+    "virtio_pci"
+    "sr_mod"
+    "virtio_blk"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];

systems/x86_64-linux/sgx-nixos/default.nix

@@ -1,10 +1,13 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 with lib;
 with lib.metacfg;
 {
-  imports = [
+  imports = [ ./hardware-configuration.nix ];
-    ./hardware-configuration.nix
-  ];
 
   boot.kernel.sysctl."net.ipv4.conf.all.route_localnet" = 1;
   boot.kernelPackages = lib.mkOverride 0 pkgs.linuxPackages_latest;
@@ -20,7 +23,10 @@ with lib.metacfg;
     nix.enable = true;
     aesmd_dcap.enable = true;
     podman.enable = true;
-    user.extraGroups = [ "docker" "sgx" ];
+    user.extraGroups = [
+      "docker"
+      "sgx"
+    ];
   };
 
   environment.etc."sgx_default_qcnl.conf".text = ''
@@ -59,8 +65,18 @@ with lib.metacfg;
   systemd.user.extraConfig = "DefaultLimitNOFILE=32768";
 
   security.pam.loginLimits = [
-    { domain = "*"; item = "nofile"; type = "-"; value = "32768"; }
+    {
-    { domain = "*"; item = "memlock"; type = "-"; value = "32768"; }
+      domain = "*";
+      item = "nofile";
+      type = "-";
+      value = "32768";
+    }
+    {
+      domain = "*";
+      item = "memlock";
+      type = "-";
+      value = "32768";
+    }
   ];
 
   system.stateVersion = "23.11";

systems/x86_64-linux/sgx-nixos/hardware-configuration.nix

@@ -1,30 +1,37 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-    [
-      (modulesPath + "/profiles/qemu-guest.nix")
-    ];
 
-  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ];
+  boot.initrd.availableKernelModules = [
+    "ahci"
+    "xhci_pci"
+    "virtio_pci"
+    "sr_mod"
+    "virtio_blk"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    {
+    device = "/dev/disk/by-uuid/ebb90474-ddcb-484b-9663-d71863827af4";
-      device = "/dev/disk/by-uuid/ebb90474-ddcb-484b-9663-d71863827af4";
+    fsType = "ext4";
-      fsType = "ext4";
+  };
-    };
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    {
+    device = "/dev/disk/by-uuid/941C-7B02";
-      device = "/dev/disk/by-uuid/941C-7B02";
+    fsType = "vfat";
-      fsType = "vfat";
+  };
-    };
 
   swapDevices = [ ];
 

systems/x86_64-linux/sgx/backup.nix

@@ -1,4 +1,9 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 let
   backup_new_path = "/mnt/raid/backup/hoyer/new/";
   restic_repo = "/mnt/backup/restic-repo";
@@ -61,8 +66,7 @@ in
           ".log"
           ".Trash"
         ];
-        ignoreFile = builtins.toFile "ignore"
+        ignoreFile = builtins.toFile "ignore" (lib.foldl (a: b: a + "\n" + b) "" ignorePatterns);
-          (lib.foldl (a: b: a + "\n" + b) "" ignorePatterns);
       in
       [ "--exclude-file=${ignoreFile}" ];
     pruneOpts = [

systems/x86_64-linux/sgx/default.nix

@@ -1,4 +1,9 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 {
   imports = [
     ./hardware-configuration.nix

systems/x86_64-linux/sgx/fileserver.nix

@@ -1,4 +1,9 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 {
   services.netatalk = {
     enable = true;

systems/x86_64-linux/sgx/hardware-configuration.nix

@@ -1,12 +1,16 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ pkgs, config, lib, modulesPath, ... }:
+{
+  pkgs,
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports = [
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
 
   boot.initrd.availableKernelModules = [
     "xhci_pci"
@@ -43,18 +47,33 @@
     "/mnt/raid" = {
       fsType = "btrfs";
       device = "/dev/disk/by-uuid/11727be7-bf9b-4888-8b02-d7eb1f898712";
-      options = [ "defaults" "compress=zstd" "subvol=root" "autodefrag" "noatime" "nofail" "x-systemd.device-timeout=60" ];
+      options = [
+        "defaults"
+        "compress=zstd"
+        "subvol=root"
+        "autodefrag"
+        "noatime"
+        "nofail"
+        "x-systemd.device-timeout=60"
+      ];
     };
 
     "/mnt/backup" = {
       fsType = "btrfs";
       device = "/dev/disk/by-uuid/c29e7eac-26ba-41b1-ac3e-11123476b7c5";
-      options = [ "defaults" "compress=zstd" "subvol=root" "autodefrag" "noatime" "nofail" "x-systemd.device-timeout=60" ];
+      options = [
+        "defaults"
+        "compress=zstd"
+        "subvol=root"
+        "autodefrag"
+        "noatime"
+        "nofail"
+        "x-systemd.device-timeout=60"
+      ];
     };
   };
 
-  swapDevices =
+  swapDevices = [ { device = "/dev/disk/by-uuid/72d061d7-ab18-47b9-beb1-1c465dda1be9"; } ];
-    [{ device = "/dev/disk/by-uuid/72d061d7-ab18-47b9-beb1-1c465dda1be9"; }];
 
   environment.etc."crypttab".text = ''
     a16 /dev/disk/by-uuid/6f1c1b24-3c94-44be-8d1b-70db562079c1 /dev/disk/by-id/usb-Ut165_USB2FlashStorage_08050508d213e6-0:0-part1 luks,keyfile-size=256

systems/x86_64-linux/sgx/network.nix

@@ -1,4 +1,9 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 {
   networking.hostName = "sgx"; # Define your hostname.
   networking.useDHCP = false;
@@ -37,7 +42,14 @@
     };
   };
 
-  networking.firewall.allowedTCPPorts = [ 8384 22000 config.services.netatalk.port ];
+  networking.firewall.allowedTCPPorts = [
-  networking.firewall.allowedUDPPorts = [ 22000 21027 ];
+    8384
+    22000
+    config.services.netatalk.port
+  ];
+  networking.firewall.allowedUDPPorts = [
+    22000
+    21027
+  ];
   networking.firewall.allowPing = true;
 }

systems/x86_64-linux/t15/default.nix

@@ -10,7 +10,10 @@
     podman.enable = true;
     secureboot.enable = true;
     homeprinter.enable = true;
-    user.extraGroups = [ "docker" "dialout" ];
+    user.extraGroups = [
+      "docker"
+      "dialout"
+    ];
   };
 
   system.autoUpgrade = {

systems/x86_64-linux/t15/hardware-configuration.nix

@@ -1,12 +1,16 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports = [
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
 
   boot.kernelModules = [ "kvm-intel" ];
   boot.initrd.availableKernelModules = [
@@ -40,7 +44,7 @@
   boot.extraModulePackages = [ ];
 
   services.btrfs.autoScrub.enable = true;
-  swapDevices = [{ device = "/swapfile"; }];
+  swapDevices = [ { device = "/swapfile"; } ];
 
   boot.initrd.luks.devices.crypted = {
     device = "/dev/nvme0n1p2";
@@ -48,13 +52,12 @@
   };
 
   fileSystems = {
-    "/" =
+    "/" = {
-      {
+      device = "/dev/mapper/crypted";
-        device = "/dev/mapper/crypted";
+      fsType = "btrfs";
-        fsType = "btrfs";
+      options = [ "subvol=/rootfs" ];
-        options = [ "subvol=/rootfs" ];
+      neededForBoot = true;
-        neededForBoot = true;
+    };
-      };
     "/nix" = {
       device = "/dev/mapper/crypted";
       fsType = "btrfs";
@@ -72,11 +75,10 @@
       options = [ "subvol=/persist" ];
       neededForBoot = true;
     };
-    "/boot" =
+    "/boot" = {
-      {
+      device = "/dev/disk/by-partlabel/disk-one-ESP";
-        device = "/dev/disk/by-partlabel/disk-one-ESP";
+      fsType = "vfat";
-        fsType = "vfat";
+    };
-      };
   };
 
   console.keyMap = "de-latin1-nodeadkeys";

systems/x86_64-linux/x1/default.nix

@@ -12,7 +12,10 @@ with lib.metacfg;
     podman.enable = true;
     secureboot.enable = true;
     homeprinter.enable = true;
-    user.extraGroups = [ "docker" "dialout" ];
+    user.extraGroups = [
+      "docker"
+      "dialout"
+    ];
   };
 
   environment.systemPackages = with pkgs; [
@@ -51,8 +54,18 @@ with lib.metacfg;
   systemd.user.extraConfig = "DefaultLimitNOFILE=32768";
 
   security.pam.loginLimits = [
-    { domain = "*"; item = "nofile"; type = "-"; value = "32768"; }
+    {
-    { domain = "*"; item = "memlock"; type = "-"; value = "32768"; }
+      domain = "*";
+      item = "nofile";
+      type = "-";
+      value = "32768";
+    }
+    {
+      domain = "*";
+      item = "memlock";
+      type = "-";
+      value = "32768";
+    }
   ];
 
   services.ollama = {

systems/x86_64-linux/x1/hardware-configuration.nix

@@ -1,14 +1,25 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports = [
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "uas" "usbhid" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "thunderbolt"
+    "nvme"
+    "uas"
+    "usbhid"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelPackages = lib.mkOverride 0 pkgs.linuxPackages_latest;
   boot.kernelModules = [ "kvm-intel" ];
@@ -24,12 +35,11 @@
 
   services.btrfs.autoScrub.enable = true;
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    {
+    device = "/dev/disk/by-uuid/1106202c-c3bf-4c15-b7cd-e78749e5c955";
-      device = "/dev/disk/by-uuid/1106202c-c3bf-4c15-b7cd-e78749e5c955";
+    fsType = "btrfs";
-      fsType = "btrfs";
+    options = [ "subvol=@" ];
-      options = [ "subvol=@" ];
+  };
-    };
 
   boot.initrd.luks.devices."luks-0e2792db-1b80-49a7-b2eb-54e4b5fc3502" = {
     device = "/dev/disk/by-uuid/0e2792db-1b80-49a7-b2eb-54e4b5fc3502";
@@ -41,13 +51,12 @@
     allowDiscards = true;
   };
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    {
+    device = "/dev/disk/by-uuid/13C4-A825";
-      device = "/dev/disk/by-uuid/13C4-A825";
+    fsType = "vfat";
-      fsType = "vfat";
+  };
-    };
 
-  swapDevices = [{ device = "/dev/mapper/luks-280f2e07-e5fc-478e-b7ee-445c99bea415"; }];
+  swapDevices = [ { device = "/dev/mapper/luks-280f2e07-e5fc-478e-b7ee-445c99bea415"; } ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's