Nixfmt Tree

common/backups/restic.nix

@@ -3,10 +3,17 @@
   pkgs,
   lib,
   ...
-}: let
+}:
-  inherit (lib) mkIf mkEnableOption mkOption types;
+let
+  inherit (lib)
+    mkIf
+    mkEnableOption
+    mkOption
+    types
+    ;
   cfg = config.foehammer.backups.restic;
-in {
+in
+{
   options.foehammer.backups.restic = {
     enable = mkEnableOption "Enable restic backups";
 

common/caddy.nix

@@ -2,10 +2,12 @@
   config,
   lib,
   ...
-}: let
+}:
+let
   inherit (lib) mkIf mkEnableOption;
   cfg = config.foehammer.caddy;
-in {
+in
+{
   options.foehammer.caddy.enable = mkEnableOption "Enable caddy with default configuration.";
   config = mkIf cfg.enable {
     services.caddy = {
@@ -13,6 +15,9 @@ in {
       email = "foehammer127points+acme@gmail.com";
     };
 
-    networking.firewall.allowedTCPPorts = [80 443];
+    networking.firewall.allowedTCPPorts = [
+      80
+      443
+    ];
   };
 }

common/nix.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   nix = {
     extraOptions = ''
       experimental-features = nix-command flakes
@@ -17,10 +18,19 @@
         "nix-command"
       ];
 
-      trusted-users = ["root" "@wheel"];
+      trusted-users = [
+        "root"
+        "@wheel"
+      ];
 
-      substituters = ["https://cache.nixos.org" "https://cache.garnix.io"];
+      substituters = [
-      trusted-public-keys = ["cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g=" "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="];
+        "https://cache.nixos.org"
+        "https://cache.garnix.io"
+      ];
+      trusted-public-keys = [
+        "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
+        "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+      ];
     };
   };
 }

common/nixos.nix

@@ -3,20 +3,28 @@
   lib,
   pkgs,
   ...
-}: let
+}:
+let
   inherit (lib) mkIf;
-in {
+in
+{
   config = {
     users.mutableUsers = false;
 
-    environment.systemPackages = with pkgs; [neovim git];
+    environment.systemPackages = with pkgs; [
+      neovim
+      git
+    ];
 
     networking = {
       firewall = {
         enable = true;
       };
 
-      nameservers = ["1.1.1.1" "8.8.8.8"];
+      nameservers = [
+        "1.1.1.1"
+        "8.8.8.8"
+      ];
       # If using dhcpcd:
       dhcpcd.extraConfig = mkIf config.networking.dhcpcd.enable "nohook resolv.conf";
       # If using NetworkManager:

common/services/authelia.nix

@@ -2,11 +2,18 @@
   config,
   lib,
   ...
-}: let
+}:
-  inherit (lib) mkIf types mkOption mkEnableOption;
+let
+  inherit (lib)
+    mkIf
+    types
+    mkOption
+    mkEnableOption
+    ;
 
   cfg = config.foehammer.services.authelia;
-in {
+in
+{
   options.foehammer.services.authelia = {
     enable = mkEnableOption "Enable authelia server component.";
     domain = mkOption {
@@ -27,7 +34,6 @@ in {
       type = types.path;
     };
 
-
     # https://www.authelia.com/integration/ldap/lldap/
     ldap = {
       addr = mkOption {
@@ -190,8 +196,7 @@ in {
       };
 
       secrets = {
-        inherit
+        inherit (cfg)
-          (cfg)
           jwtSecretFile
           oidcIssuerPrivateKeyFile
           oidcHmacSecretFile

common/services/gitea.nix

@@ -3,11 +3,13 @@
   lib,
   pkgs,
   ...
-}: let
+}:
+let
   inherit (lib) mkEnableOption mkIf mkOption;
 
   cfg = config.foehammer.services.forgejo;
-in {
+in
+{
   options.foehammer.services.forgejo = {
     enable = mkEnableOption "Enable Gitea Server";
 

common/services/goatcounter.nix

@@ -3,11 +3,13 @@
   lib,
   pkgs,
   ...
-}: let
+}:
+let
   inherit (lib) mkEnableOption mkIf mkOption;
 
   cfg = config.foehammer.services.goatcounter;
-in {
+in
+{
   options.foehammer.services.goatcounter = {
     enable = mkEnableOption "Enable goatcounter server";
 

common/services/lldap.nix

@@ -3,11 +3,18 @@
   lib,
   pkgs,
   ...
-}: let
+}:
-  inherit (lib) mkEnableOption types mkIf mkOption;
+let
+  inherit (lib)
+    mkEnableOption
+    types
+    mkIf
+    mkOption
+    ;
 
   cfg = config.foehammer.services.lldap;
-in {
+in
+{
   options.foehammer.services.lldap = {
     enable = mkEnableOption "Enable LLDAP Server";
 

common/services/vaultwarden.nix

@@ -3,11 +3,13 @@
   lib,
   pkgs,
   ...
-}: let
+}:
+let
   inherit (lib) mkEnableOption mkIf mkOption;
 
   cfg = config.foehammer.services.vaultwarden;
-in {
+in
+{
   options.foehammer.services.vaultwarden = {
     enable = mkEnableOption "Enable Vaultwarden Server";
 

common/sudo.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   security.sudo = {
     enable = true;
     execWheelOnly = true;

common/tailscale.nix

@@ -2,10 +2,17 @@
   config,
   lib,
   ...
-}: let
+}:
-  inherit (lib) mkEnableOption mkOption types mkIf;
+let
+  inherit (lib)
+    mkEnableOption
+    mkOption
+    types
+    mkIf
+    ;
   cfg = config.foehammer.tailscale;
-in {
+in
+{
   options.foehammer.tailscale = {
     enable = mkEnableOption "Enable tailscale";
     authKeyFile = mkOption {

common/users/admin.nix

@@ -3,10 +3,18 @@
   lib,
   foelib,
   ...
-}: let
+}:
-  inherit (lib) mkIf mkOption mkEnableOption optionals types;
+let
+  inherit (lib)
+    mkIf
+    mkOption
+    mkEnableOption
+    optionals
+    types
+    ;
   cfg = config.foehammer.users.admin;
-in {
+in
+{
   options.foehammer.users.admin = {
     enable = mkEnableOption "Enable a wheel admin user.";
     hashedPasswordFile = mkOption {

flake.nix

@@ -5,18 +5,27 @@
     flake-parts.url = "github:hercules-ci/flake-parts";
   };
 
-  outputs = inputs @ {self, ...}:
+  outputs =
-  inputs.flake-parts.lib.mkFlake {inherit inputs;} (toplevel @ {withSystem, ...}: {
+    inputs@{ self, ... }:
-    systems = ["aarch64-darwin" "aarch64-linux" "x86_64-linux"];
+    inputs.flake-parts.lib.mkFlake { inherit inputs; } (
+      toplevel@{ withSystem, ... }:
+      {
+        systems = [
+          "aarch64-darwin"
+          "aarch64-linux"
+          "x86_64-linux"
+        ];
 
-    perSystem = {
+        perSystem =
+          {
             config,
             self',
             inputs',
             pkgs,
             system,
             ...
-    }: {
+          }:
+          {
             _module.args.pkgs = import inputs.nixpkgs {
               localSystem = system;
               config = {
@@ -26,6 +35,10 @@
               # overlays = [self.overlays.default];
             };
 
+            devShells.default = pkgs.mkShell {
+              buildInputs = with pkgs; [ nixfmt-tree ];
+            };
+
             # packages = import ./lib/packages.nix pkgs;
           };
 
@@ -34,9 +47,12 @@
 
           # overlays.default = final: prev: (import ./lib/packages.nix prev);
 
-      nixosModules.default = {...}: {
+          nixosModules.default =
+            { ... }:
+            {
               imports = self.lib.utils.findNixFiles ./common;
             };
         };
-  });
+      }
+    );
 }

lib/data.nix

@@ -1,5 +1,6 @@
 rec {
-  getSSHKeys = let
+  getSSHKeys =
+    let
       sshKeys = builtins.fromTOML (builtins.readFile ../data/ssh-keys.toml);
     in
     name: (builtins.mapAttrs (_: value: builtins.attrValues value) sshKeys)."${name}";

lib/nixos.nix

@@ -1,12 +1,14 @@
-nixpkgs: withSystem: let
+nixpkgs: withSystem:
+let
   foelib = import ./default.nix nixpkgs withSystem;
-in {
+in
-  mkSystem = hostname: host-platform: modules:
+{
-    withSystem host-platform
+  mkSystem =
-    ({pkgs, ...}:
+    hostname: host-platform: modules:
+    withSystem host-platform (
+      { pkgs, ... }:
       nixpkgs.lib.nixosSystem {
-        modules =
+        modules = [
-          [
           {
             nix.registry = {
               nixpkgs.flake = nixpkgs;
@@ -21,5 +23,6 @@ in {
         specialArgs = {
           inherit hostname foelib;
         };
-      });
+      }
+    );
 }

lib/packages.nix

@@ -1,24 +1,21 @@
-pkgs: let
+pkgs:
-  getPackages = dir: let
+let
+  getPackages =
+    dir:
+    let
       entries = builtins.readDir dir;
 
-    procEntry = name: type: let
+      procEntry =
+        name: type:
+        let
           path = dir + "/${name}";
         in
-      if type == "directory"
+        if type == "directory" then
-      then
+          (if builtins.pathExists (path + "/default.nix") then [ path ] else [ ])
-        (
+        else
-          if builtins.pathExists (path + "/default.nix")
+          [ ];
-          then [path]
-          else []
-        )
-      else [];
     in
-    builtins.concatLists (
+    builtins.concatLists (builtins.attrValues (builtins.mapAttrs procEntry entries));
-      builtins.attrValues (
-        builtins.mapAttrs procEntry entries
-      )
-    );
 
   buildPackage = path: {
     name = builtins.baseNameOf (toString path);

lib/utils.nix

@@ -1,6 +1,13 @@
 rec {
-  findNixFiles = dir: let
+  findNixFiles =
-    inherit (builtins) attrNames readDir pathExists concatMap;
+    dir:
+    let
+      inherit (builtins)
+        attrNames
+        readDir
+        pathExists
+        concatMap
+        ;
 
       # Helper function to build full paths
       fullPath = name: dir + "/${name}";
@@ -12,36 +19,36 @@ rec {
       names = attrNames contents;
 
       # Filter and process each item
-    processItem = name: let
+      processItem =
+        name:
+        let
           path = fullPath name;
           type = contents.${name};
         in
-      if type == "regular" && hasSuffix "nix" name
+        if type == "regular" && hasSuffix "nix" name then
-      then [path]
+          [ path ]
-      else if type == "directory" && pathExists path
+        else if type == "directory" && pathExists path then
-      then findNixFiles path
+          findNixFiles path
-      else [];
+        else
+          [ ];
     in
     concatMap processItem names;
 
-  getName = filename: let
+  getName =
+    filename:
+    let
       parts = builtins.split "\\." filename;
       base = builtins.head (builtins.split "\\." filename);
     in
-    if builtins.length parts == 1
+    if builtins.length parts == 1 then filename else base;
-    then filename
-    else base;
 
-  getSuffix = filename: let
+  getSuffix =
+    filename:
+    let
       parts = builtins.split "\\." filename;
       end = builtins.tail (builtins.split "\\." filename);
     in
-    if builtins.length parts == 1
+    if builtins.length parts == 1 then filename else builtins.elemAt end (builtins.length end - 1);
-    then filename
-    else builtins.elemAt end (builtins.length end - 1);
 
-  hasSuffix = suffix: filename:
+  hasSuffix = suffix: filename: if (getSuffix filename) == suffix then true else false;
-    if (getSuffix filename) == suffix
-    then true
-    else false;
 }

machines/lebesgue/config/configuration.nix

@@ -3,7 +3,8 @@
   lib,
   pkgs,
   ...
-}: {
+}:
+{
   foehammer = {
     users.admin = {
       enable = true;
@@ -62,7 +63,11 @@
       environmentFile = config.sops.secrets.restic-env.path;
       passwordFile = config.sops.secrets.restic-password.path;
 
-      paths = ["/var/lib/vaultwarden" "/var/lib/authelia" "/var/lib/forgejo"];
+      paths = [
+        "/var/lib/vaultwarden"
+        "/var/lib/authelia"
+        "/var/lib/forgejo"
+      ];
     };
 
     tailscale = {

machines/lebesgue/config/hardware-configuration.nix

@@ -4,14 +4,21 @@
   pkgs,
   modulesPath,
   ...
-}: {
+}:
+{
   imports = [
     (modulesPath + "/profiles/qemu-guest.nix")
   ];
 
   services.qemuGuest.enable = true;
 
-  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk"];
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "sr_mod"
+    "virtio_blk"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
@@ -45,27 +52,51 @@
   fileSystems."/" = {
     device = "/dev/disk/by-label/NIXROOT";
     fsType = "btrfs";
-    options = ["subvol=root" "defaults" "noatime" "compress=zstd:1" "discard=async" "nodatacow"];
+    options = [
+      "subvol=root"
+      "defaults"
+      "noatime"
+      "compress=zstd:1"
+      "discard=async"
+      "nodatacow"
+    ];
   };
 
   fileSystems."/nix" = {
     device = "/dev/disk/by-label/NIXROOT";
     fsType = "btrfs";
     neededForBoot = true;
-    options = ["subvol=nix" "defaults" "noatime" "compress=zstd:3" "discard=async" "nodatacow"];
+    options = [
+      "subvol=nix"
+      "defaults"
+      "noatime"
+      "compress=zstd:3"
+      "discard=async"
+      "nodatacow"
+    ];
   };
 
   fileSystems."/persist" = {
     device = "/dev/disk/by-label/NIXROOT";
     fsType = "btrfs";
     neededForBoot = true;
-    options = ["subvol=persist" "defaults" "noatime" "compress=zstd:1" "discard=async" "nodatacow"];
+    options = [
+      "subvol=persist"
+      "defaults"
+      "noatime"
+      "compress=zstd:1"
+      "discard=async"
+      "nodatacow"
+    ];
   };
 
   fileSystems."/boot" = {
     device = "/dev/disk/by-label/NIXBOOT";
     fsType = "vfat";
-    options = ["fmask=0077" "dmask=0077"];
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
   };
 
   swapDevices = [ ];

machines/lebesgue/config/routing.nix

@@ -1,4 +1,5 @@
-{config, ...}: {
+{ config, ... }:
+{
   foehammer.caddy.enable = true;
 
   services.caddy = {

machines/lebesgue/config/secrets.nix

@@ -1,22 +1,31 @@
-{...}: {
+{ ... }:
+{
   sops = {
     defaultSopsFile = ../secrets/main.yaml;
 
-    secrets = let
+    secrets =
+      let
         autheliaSecret = {
           owner = "authelia-main";
           sopsFile = ../secrets/authelia/secrets.yaml;
         };
-    in {
+      in
+      {
         admin-password.neededForUsers = true;
 
         tskey = { };
 
         vaultwarden-env = { };
 
-      restic-env = {owner = "restic";};
+        restic-env = {
-      restic-password = {owner = "restic";};
+          owner = "restic";
-      restic-repository = {owner = "restic";};
+        };
+        restic-password = {
+          owner = "restic";
+        };
+        restic-repository = {
+          owner = "restic";
+        };
 
         lldap-admin-password.owner = "lldap";
 

machines/lebesgue/config/state.nix

@@ -1,4 +1,5 @@
-{config, ...}: {
+{ config, ... }:
+{
   sops.age.sshKeyPaths = [ "/persist/etc/ssh/ssh_host_ed25519_key" ];
 
   environment.persistence."/persist" = {
@@ -14,7 +15,12 @@
       "/var/lib/caddy/.local/share/caddy"
       "/var/lib/vaultwarden"
 
-      { directory = "/var/lib/lldap"; user = "lldap"; group = "lldap"; mode = "0700"; }
+      {
+        directory = "/var/lib/lldap";
+        user = "lldap";
+        group = "lldap";
+        mode = "0700";
+      }
     ];
 
     files = [

machines/lebesgue/flake.nix

@@ -12,16 +12,26 @@
       url = "github:nix-community/impermanence";
     };
   };
-  outputs = inputs @ {common, ...}: let
+  outputs =
-    supportedSystems = ["x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin"];
+    inputs@{ common, ... }:
+    let
+      supportedSystems = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
       forAllSystems = inputs.nixpkgs.lib.genAttrs supportedSystems;
-    buildNixpkgs = system:
+      buildNixpkgs =
+        system:
         import inputs.nixpkgs {
           inherit system;
           overlays = [ ];
         };
-  in {
+    in
-    nixosConfigurations.default = let
+    {
+      nixosConfigurations.default =
+        let
           config = common.lib.utils.findNixFiles ./config;
           modules = [
             inputs.sops-nix.nixosModules.sops
@@ -31,12 +41,19 @@
         in
         common.lib.mkSystem "lebesgue" "x86_64-linux" (config ++ modules);
 
-    devShells = forAllSystems (system: let
+      devShells = forAllSystems (
+        system:
+        let
           pkgs = buildNixpkgs system;
-    in {
+        in
+        {
           default = pkgs.mkShell {
-        buildInputs = with pkgs; [sops nixos-rebuild];
+            buildInputs = with pkgs; [
-      };
+              sops
-    });
+              nixos-rebuild
+            ];
+          };
+        }
+      );
     };
 }