treewide: apply the new rfc nixfmt

(Forgot to enable nix-direnv all this time. How dumb am I.)

flake.lock

@@ -293,11 +293,11 @@
         "nixvim": "nixvim"
       },
       "locked": {
-        "lastModified": 1724158316,
+        "lastModified": 1724306750,
-        "narHash": "sha256-cz2N0vPfe0jmjxqKWh7dgVecLqmPLHQrvxGJk0atDbg=",
+        "narHash": "sha256-mT8DXzj0zHfGJ+zuxFAnqnk+0bDEFgEk7TvEk59WbWQ=",
         "ref": "refs/heads/master",
-        "rev": "a5eb7fe89ee8ba654f339d8f75cecb39851743ec",
+        "rev": "81990813485a580d69853d8429e3b8aece7f66a6",
-        "revCount": 4,
+        "revCount": 11,
         "type": "git",
         "url": "https://git.xinyang.life/xin/nixvim"
       },

flake.nix

@@ -52,28 +52,28 @@
     catppuccin.url = "github:catppuccin/nix";
   };
 
-
   outputs =
-    { self
+    {
-    , home-manager
+      self,
-    , nixpkgs
+      home-manager,
-    , nixos-hardware
+      nixpkgs,
-    , flake-utils
+      nixos-hardware,
-    , nur
+      flake-utils,
-    , catppuccin
+      nur,
-    , my-nixvim
+      catppuccin,
-    , ...
+      my-nixvim,
+      ...
     }@inputs:
     let
-      nixvimOverlay = (final: prev: {
+      nixvimOverlay = (final: prev: { nixvim = self.packages.${prev.stdenv.system}.nixvim; });
-        nixvim = self.packages.${prev.stdenv.system}.nixvim;
+      overlayModule =
-      });
+        { ... }:
-      overlayModule = { ... }: {
+        {
-        nixpkgs.overlays = [
+          nixpkgs.overlays = [
-          nixvimOverlay
+            nixvimOverlay
-          (import ./overlays/add-pkgs.nix)
+            (import ./overlays/add-pkgs.nix)
-        ];
+          ];
-      };
+        };
       deploymentModule = {
         deployment.targetUser = "xin";
       };
@@ -87,20 +87,25 @@
         catppuccin.homeManagerModules.catppuccin
         self.homeManagerModules
       ];
-      mkHome = user: host: { ... }: {
+      mkHome =
-        imports = [
+        user: host:
-          home-manager.nixosModules.home-manager
+        { ... }:
-          {
+        {
-            home-manager = {
+          imports = [
-              sharedModules = sharedHmModules;
+            home-manager.nixosModules.home-manager
-              useGlobalPkgs = true;
+            {
-              useUserPackages = true;
+              home-manager = {
-              extraSpecialArgs = { inherit inputs; };
+                sharedModules = sharedHmModules;
-            };
+                useGlobalPkgs = true;
-            home-manager.users.${user} = (import ./home).${user}.${host};
+                useUserPackages = true;
-          }
+                extraSpecialArgs = {
-        ];
+                  inherit inputs;
-      };
+                };
+              };
+              home-manager.users.${user} = (import ./home).${user}.${host};
+            }
+          ];
+        };
       mkHomeConfiguration = user: host: {
         name = user;
         value = home-manager.lib.homeManagerConfiguration {
@@ -114,94 +119,109 @@
           };
         };
       };
-      mkNixos = { system, modules, specialArgs ? { } }: nixpkgs.lib.nixosSystem {
+      mkNixos =
-        inherit system;
+        {
-        specialArgs = specialArgs // { inherit inputs system; };
+          system,
-        modules = [
+          modules,
-          self.nixosModules.default
+          specialArgs ? { },
-          nur.nixosModules.nur
+        }:
-        ] ++ modules;
+        nixpkgs.lib.nixosSystem {
-      };
+          inherit system;
+          specialArgs = specialArgs // {
+            inherit inputs system;
+          };
+          modules = [
+            self.nixosModules.default
+            nur.nixosModules.nur
+          ] ++ modules;
+        };
     in
     {
       nixpkgs = nixpkgs;
-      nixosModules.default = { imports = [ ./modules/nixos overlayModule ]; };
+      nixosModules.default = {
+        imports = [
+          ./modules/nixos
+          overlayModule
+        ];
+      };
       homeManagerModules = import ./modules/home-manager;
 
       homeConfigurations = builtins.listToAttrs [ (mkHomeConfiguration "xin" "calcite") ];
 
       colmenaHive = inputs.colmena.lib.makeHive {
         meta = {
-          nixpkgs = import nixpkgs {
+          nixpkgs = import nixpkgs { system = "x86_64-linux"; };
-            system = "x86_64-linux";
-          };
           specialArgs = {
             inherit inputs;
           };
         };
 
-        massicot = { ... }: {
+        massicot =
-          deployment.targetHost = "49.13.13.122";
+          { ... }:
-          deployment.buildOnTarget = true;
+          {
+            deployment.targetHost = "49.13.13.122";
+            deployment.buildOnTarget = true;
 
-          imports = [
+            imports = [
-            { nixpkgs.system = "aarch64-linux"; }
+              { nixpkgs.system = "aarch64-linux"; }
-            machines/massicot
+              machines/massicot
-          ] ++ sharedColmenaModules;
+            ] ++ sharedColmenaModules;
-        };
-
-        tok-00 = { ... }: {
-          imports = [
-            machines/dolomite
-          ] ++ sharedColmenaModules;
-          nixpkgs.system = "x86_64-linux";
-          networking.hostName = "tok-00";
-          system.stateVersion = "23.11";
-          deployment = {
-            targetHost = "video01.namely.icu";
-            buildOnTarget = false;
-            tags = [ "proxy" ];
           };
-        };
 
-        la-00 = { ... }: {
+        tok-00 =
-          imports = [
+          { ... }:
-            machines/dolomite
+          {
-          ] ++ sharedColmenaModules;
+            imports = [ machines/dolomite ] ++ sharedColmenaModules;
-          nixpkgs.system = "x86_64-linux";
+            nixpkgs.system = "x86_64-linux";
-          networking.hostName = "la-00";
+            networking.hostName = "tok-00";
-          system.stateVersion = "21.05";
+            system.stateVersion = "23.11";
-          deployment = {
+            deployment = {
-            targetHost = "la-00.video.namely.icu";
+              targetHost = "video01.namely.icu";
-            buildOnTarget = false;
+              buildOnTarget = false;
-            tags = [ "proxy" ];
+              tags = [ "proxy" ];
+            };
           };
-        };
 
-        raspite = { ... }: {
+        la-00 =
-          deployment = {
+          { ... }:
-            targetHost = "raspite.local";
+          {
-            buildOnTarget = false;
+            imports = [ machines/dolomite ] ++ sharedColmenaModules;
+            nixpkgs.system = "x86_64-linux";
+            networking.hostName = "la-00";
+            system.stateVersion = "21.05";
+            deployment = {
+              targetHost = "la-00.video.namely.icu";
+              buildOnTarget = false;
+              tags = [ "proxy" ];
+            };
           };
-          nixpkgs.system = "aarch64-linux";
-          imports = [
-            "${nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
-            nixos-hardware.nixosModules.raspberry-pi-4
-            machines/raspite/configuration.nix
-          ] ++ sharedColmenaModules;
-        };
 
-        weilite = { ... }: {
+        raspite =
-          imports = [
+          { ... }:
-            machines/weilite
+          {
-          ] ++ sharedColmenaModules;
+            deployment = {
-          deployment = {
+              targetHost = "raspite.local";
-            targetHost = "weilite.coho-tet.ts.net";
+              buildOnTarget = false;
-            targetPort = 22;
+            };
-            buildOnTarget = false;
+            nixpkgs.system = "aarch64-linux";
+            imports = [
+              "${nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
+              nixos-hardware.nixosModules.raspberry-pi-4
+              machines/raspite/configuration.nix
+            ] ++ sharedColmenaModules;
+          };
+
+        weilite =
+          { ... }:
+          {
+            imports = [ machines/weilite ] ++ sharedColmenaModules;
+            deployment = {
+              targetHost = "weilite.coho-tet.ts.net";
+              targetPort = 22;
+              buildOnTarget = false;
+            };
+            nixpkgs.system = "x86_64-linux";
           };
-          nixpkgs.system = "x86_64-linux";
-        };
       };
 
       nixosConfigurations = {
@@ -215,18 +235,30 @@
         };
       } // self.colmenaHive.nodes;
 
-    } // flake-utils.lib.eachDefaultSystem (system:
-    let pkgs = nixpkgs.legacyPackages.${system}; in
-    {
-      devShells = {
-        default = pkgs.mkShell {
-          packages = with pkgs; [ nix git colmena sops nix-output-monitor nil nvd ];
-        };
-      };
-
-      packages = {
-        nixvim = my-nixvim.packages.${system}.default;
-      };
     }
+    // flake-utils.lib.eachDefaultSystem (
+      system:
+      let
+        pkgs = nixpkgs.legacyPackages.${system};
+      in
+      {
+        devShells = {
+          default = pkgs.mkShell {
+            packages = with pkgs; [
+              nix
+              git
+              colmena
+              sops
+              nix-output-monitor
+              nil
+              nvd
+            ];
+          };
+        };
+
+        packages = {
+          nixvim = my-nixvim.packages.${system}.default;
+        };
+      }
     );
 }

home/xin/calcite.nix

@@ -1,8 +1,6 @@
 { config, pkgs, ... }@inputs:
 {
-  imports = [
+  imports = [ ./common ];
-    ./common
-  ];
 
   programs.nix-index-database.comma.enable = true;
 
@@ -46,15 +44,42 @@
   };
 
   custom-hm = {
-    alacritty = { enable = true; };
+    alacritty = {
-    direnv = { enable = true; };
+      enable = true;
-    fish = { enable = true; };
+    };
-    git = { enable = true; signing.enable = true; };
+    cosmic-term = {
-    neovim = { enable = true; };
+      enable = true;
-    vscode = { enable = true; languages = { cxx = true; python = true; scala = true; latex = true; }; llm = true; };
+    };
-    zellij = { enable = true; };
+    direnv = {
+      enable = true;
+    };
+    fish = {
+      enable = true;
+    };
+    git = {
+      enable = true;
+      signing.enable = true;
+    };
+    neovim = {
+      enable = true;
+    };
+    vscode = {
+      enable = true;
+      languages = {
+        cxx = true;
+        python = true;
+        scala = true;
+        latex = true;
+      };
+      llm = true;
+    };
+    zellij = {
+      enable = true;
+    };
   };
 
+  programs.gnome-shell.enable = true;
+
   programs.atuin = {
     enable = true;
     flags = [ "--disable-up-arrow" ];
@@ -68,10 +93,82 @@
 
   programs.firefox.profiles.default = {
     isDefault = true;
-    userChrome = builtins.readFile "${pkgs.fetchgit {
+    userChrome = ''
-      url = "https://gist.github.com/0ded98af9fe3da35f3688f81364d8c14.git";
+      #titlebar {
-      rev = "11bb4f428382052bcbbceb6cc3fef97f3c939481";
+        display: none;
-      hash = "sha256-J11indzEGdUA0HSW8eFe5AjesOxCL/G05KwkJk9GZSY=";
+      }
-    }}/userChrome.css";
+
+      #sidebar-header {
+        display: none;
+      }
+
+      [titlepreface*="."] #sidebar-header {
+        visibility: collapse !important;
+      }
+      [titlepreface*="."] #titlebar {
+        visibility: collapse;
+      }
+
+      #sidebar-box{
+        --uc-sidebar-width: 33px;
+        --uc-sidebar-hover-width: 300px;
+        --uc-autohide-sidebar-delay: 90ms;
+        position: relative;
+        min-width: var(--uc-sidebar-width) !important;
+        width: var(--uc-sidebar-width) !important;
+        max-width: var(--uc-sidebar-width) !important;
+        z-index:1;
+      }
+
+      #sidebar-box[positionend]{ direction: rtl }
+      #sidebar-box[positionend] > *{ direction: ltr }
+
+      #sidebar-box[positionend]:-moz-locale-dir(rtl){ direction: ltr }
+      #sidebar-box[positionend]:-moz-locale-dir(rtl) > *{ direction: rtl }
+
+      #main-window[sizemode="fullscreen"] #sidebar-box{ --uc-sidebar-width: 1px; }
+
+      #sidebar-splitter{ display: none }
+
+      #sidebar-header{
+        overflow: hidden;
+        color: var(--chrome-color, inherit) !important;
+        padding-inline: 0 !important;
+      }
+
+      #sidebar-header::before,
+      #sidebar-header::after{
+        content: "";
+        display: -moz-box;
+        padding-left: 8px;
+      }
+
+      #sidebar-switcher-target{
+        -moz-box-pack: start !important;
+      }
+
+      #sidebar-header,
+      #sidebar{
+        transition: min-width 115ms linear var(--uc-autohide-sidebar-delay) !important;
+        min-width: var(--uc-sidebar-width) !important;
+        will-change: min-width;
+      }
+      #sidebar-box:hover > #sidebar-header,
+      #sidebar-box:hover > #sidebar{
+        min-width: var(--uc-sidebar-hover-width) !important;
+        transition-delay: 0ms !important;
+      }
+
+      .sidebar-panel{
+        background-color: transparent !important;
+        color: var(--newtab-text-primary-color) !important;
+      }
+
+      .sidebar-panel #search-box{
+        -moz-appearance: none !important;
+        background-color: rgba(249,249,250,0.1) !important;
+        color: inherit !important;
+      }
+    '';
   };
 }

home/xin/common/default.nix

@@ -1,4 +1,10 @@
-{ inputs, pkgs, lib, ... }: {
+{
+  inputs,
+  pkgs,
+  lib,
+  ...
+}:
+{
   imports = [ ];
 
   home.packages = with pkgs; [

home/xin/gold/default.nix

@@ -1,15 +1,15 @@
 { pkgs, home-manager, ... }:
-  home-manager.lib.homeManagerConfiguration {
+home-manager.lib.homeManagerConfiguration {
-    inherit pkgs;
+  inherit pkgs;
-    modules = [
+  modules = [
-      ../common
+    ../common
-      {
+    {
-        home.username = "xin";
+      home.username = "xin";
-        home.homeDirectory = "/home/xin";
+      home.homeDirectory = "/home/xin";
-        home.stateVersion = "23.05";
+      home.stateVersion = "23.05";
 
-        # Let Home Manager install and manage itself.
+      # Let Home Manager install and manage itself.
-        programs.home-manager.enable = true;
+      programs.home-manager.enable = true;
-      }
+    }
-    ];
+  ];
-  }
+}

home/xin/raspite/default.nix

@@ -1,9 +1,6 @@
-
 { config, pkgs, ... }:
 {
-  imports = [
+  imports = [ ../common ];
-    ../common
-  ];
 
   home.username = "xin";
   home.homeDirectory = "/home/xin";

machines/calcite/configuration.nix

@@ -1,13 +1,17 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 {
-  imports =
+  imports = [
-    [
+    # Include the results of the hardware scan.
-      # Include the results of the hardware scan.
+    ./hardware-configuration.nix
-      ./hardware-configuration.nix
+    ./network.nix
-      ./network.nix
+    ../sops.nix
-      ../sops.nix
+  ];
-    ];
 
   commonSettings = {
     auth.enable = true;
@@ -22,7 +26,11 @@
   boot.loader.efi.canTouchEfiVariables = true;
   boot.loader.efi.efiSysMountPoint = "/boot/efi";
   # boot.kernelPackages = pkgs.linuxPackages_latest;
-  boot.kernelModules = [ "nvidia" "nvidia_modeset" "nvidia_uvm" ];
+  boot.kernelModules = [
+    "nvidia"
+    "nvidia_modeset"
+    "nvidia_uvm"
+  ];
   boot.supportedFilesystems = [ "ntfs" ];
   boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
 
@@ -45,7 +53,9 @@
 
   programs.steam = {
     enable = true;
-    gamescopeSession = { enable = true; };
+    gamescopeSession = {
+      enable = true;
+    };
   };
 
   programs.oidc-agent.enable = true;
@@ -93,7 +103,6 @@
   services.xserver.displayManager.gdm.enable = true;
   services.xserver.desktopManager.gnome.enable = true;
 
-
   # Configure keymap in X11
   services.xserver = {
     xkb.layout = "us";
@@ -135,7 +144,12 @@
   users.users.xin = {
     isNormalUser = true;
     description = "xin";
-    extraGroups = [ "networkmanager" "wheel" "wireshark" "tss" ];
+    extraGroups = [
+      "networkmanager"
+      "wheel"
+      "wireshark"
+      "tss"
+    ];
   };
 
   services.kanidm = {
@@ -179,13 +193,14 @@
     # reference: https://nixos.wiki/wiki/Python
     (
       let
-        my-python-packages = python-packages: with python-packages; [
+        my-python-packages =
-          pandas
+          python-packages: with python-packages; [
-          requests
+            pandas
-          numpy
+            requests
-          pyyaml
+            numpy
-          setuptools
+            pyyaml
-        ];
+            setuptools
+          ];
         python-with-my-packages = python3.withPackages my-python-packages;
       in
       python-with-my-packages
@@ -280,14 +295,19 @@
     acceleration = "cuda";
   };
 
-
   # MTP support
   services.gvfs.enable = true;
 
   # Fonts
   fonts = {
     packages = with pkgs; [
-      (nerdfonts.override { fonts = [ "FiraCode" ]; })
+      (nerdfonts.override {
+        fonts = [
+          "FiraCode"
+          "FiraMono"
+          "JetBrainsMono"
+        ];
+      })
       noto-fonts
       noto-fonts-emoji
       liberation_ttf
@@ -305,9 +325,19 @@
     ];
     fontconfig = {
       defaultFonts = {
-        serif = [ "Noto Serif CJK SC" "Ubuntu" ];
+        serif = [
-        sansSerif = [ "Noto Sans CJK SC" "Ubuntu" ];
+          "Noto Serif CJK SC"
-        monospace = [ "FiraCode NerdFont Mono" "Noto Sans Mono CJK SC" "Ubuntu" ];
+          "Ubuntu"
+        ];
+        sansSerif = [
+          "Noto Sans CJK SC"
+          "Ubuntu"
+        ];
+        monospace = [
+          "FiraCode NerdFont Mono"
+          "Noto Sans Mono CJK SC"
+          "Ubuntu"
+        ];
       };
     };
     enableDefaultPackages = true;

machines/calcite/hardware-configuration.nix

@@ -1,14 +1,23 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "ahci" "usbhid" ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "nvme"
+    "ahci"
+    "usbhid"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.initrd.luks.devices.cryptroot = {
     device = "/dev/disk/by-uuid/5a51f623-6fbd-4843-9f83-c895067e8e7d";
@@ -16,26 +25,29 @@
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { # device = "/dev/disk/by-label/NIXROOT";
+    # device = "/dev/disk/by-label/NIXROOT";
-      device = "/dev/mapper/cryptroot";
+    device = "/dev/mapper/cryptroot";
-      fsType = "btrfs";
+    fsType = "btrfs";
-    };
+  };
 
-  fileSystems."/boot/efi" =
+  fileSystems."/boot/efi" = {
-    { device = "/dev/disk/by-label/EFIBOOT";
+    device = "/dev/disk/by-label/EFIBOOT";
-      fsType = "vfat";
+    fsType = "vfat";
-    };
+  };
 
-  fileSystems."/media/data" =
+  fileSystems."/media/data" = {
-    { device = "/dev/nvme0n1p7";
+    device = "/dev/nvme0n1p7";
-      fsType = "ntfs-3g";
+    fsType = "ntfs-3g";
-      options = [ "rw" "uid=1000" "nofail" "x-systemd.device-timeout=2" ];
+    options = [
-    };
+      "rw"
-
+      "uid=1000"
-  swapDevices =
+      "nofail"
-    [ { device = "/dev/disk/by-label/NIXSWAP"; }
+      "x-systemd.device-timeout=2"
     ];
+  };
+
+  swapDevices = [ { device = "/dev/disk/by-label/NIXSWAP"; } ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's

machines/calcite/network.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ...}:
+{ config, pkgs, ... }:
 
 {
   imports = [ ];
@@ -10,6 +10,7 @@
       dns = "systemd-resolved";
     };
   };
+  systemd.services.NetworkManager-wait-online.enable = false;
 
   services.resolved = {
     enable = true;
@@ -37,10 +38,11 @@
   # Open ports in the firewall.
   networking.firewall.enable = true;
   networking.firewall.allowedTCPPorts = [ 3389 ];
-  networking.firewall.allowedUDPPorts = [ 3389 41641 ];
+  networking.firewall.allowedUDPPorts = [
-  networking.firewall.trustedInterfaces = [
+    3389
-    "tailscale0"
+    41641
   ];
+  networking.firewall.trustedInterfaces = [ "tailscale0" ];
   # Use nftables to manager firewall
   networking.nftables.enable = true;
 

machines/dolomite/bandwagon.nix

@@ -1,30 +1,42 @@
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 let
   cfg = config.isBandwagon;
 in
 {
   imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
 
-
   options = {
     isBandwagon = lib.mkEnableOption "Bandwagon instance";
   };
 
   config = lib.mkIf cfg {
-    boot.initrd.availableKernelModules = [ "ata_piix" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+    boot.initrd.availableKernelModules = [
+      "ata_piix"
+      "xhci_pci"
+      "virtio_pci"
+      "virtio_scsi"
+      "sd_mod"
+      "sr_mod"
+    ];
     boot.initrd.kernelModules = [ ];
     boot.kernelModules = [ ];
     boot.extraModulePackages = [ ];
 
-    fileSystems."/" =
+    fileSystems."/" = {
-      { device = "/dev/disk/by-label/NIXROOT";
+      device = "/dev/disk/by-label/NIXROOT";
-        fsType = "xfs";
+      fsType = "xfs";
-      };
+    };
 
-    fileSystems."/boot" =
+    fileSystems."/boot" = {
-      { device = "/dev/disk/by-label/NIXBOOT";
+      device = "/dev/disk/by-label/NIXBOOT";
-        fsType = "vfat";
+      fsType = "vfat";
-      };
+    };
 
     swapDevices = [ ];
 

machines/dolomite/default.nix

@@ -1,6 +1,6 @@
 { config, lib, ... }:
 let
-  awsHosts = [ "tok-00"];
+  awsHosts = [ "tok-00" ];
   bwgHosts = [ "la-00" ];
 in
 {
@@ -10,7 +10,6 @@ in
     ./lightsail.nix
   ];
 
-
   config = {
     isBandwagon = builtins.elem config.networking.hostName bwgHosts;
     isLightsail = builtins.elem config.networking.hostName awsHosts;
@@ -37,10 +36,18 @@ in
       acceptTerms = true;
       certs.${config.deployment.targetHost} = {
         email = "me@namely.icu";
-        listenHTTP = ":80";
+        # Avoid port conflict
+        listenHTTP = if config.services.caddy.enable then ":30310" else ":80";
       };
     };
-    networking.firewall.allowedTCPPorts = [ 80 8080 ];
+    services.caddy.virtualHosts."http://${config.deployment.targetHost}:80".extraConfig = ''
+      reverse_proxy 127.0.0.1:30310
+    '';
+
+    networking.firewall.allowedTCPPorts = [
+      80
+      8080
+    ];
     networking.firewall.allowedUDPPorts = [ ] ++ (lib.range 6311 6314);
 
     custom.prometheus = {
@@ -75,119 +82,129 @@ in
       wheelNeedsPassword = false;
     };
 
-    services.sing-box = let
+    services.sing-box =
-      singTls = {
+      let
-        enabled = true;
+        singTls = {
-        server_name = config.deployment.targetHost;
+          enabled = true;
-        key_path = config.security.acme.certs.${config.deployment.targetHost}.directory + "/key.pem";
+          server_name = config.deployment.targetHost;
-        certificate_path = config.security.acme.certs.${config.deployment.targetHost}.directory + "/cert.pem";
+          key_path = config.security.acme.certs.${config.deployment.targetHost}.directory + "/key.pem";
-      };
+          certificate_path =
-      password = {
+            config.security.acme.certs.${config.deployment.targetHost}.directory + "/cert.pem";
-        _secret = config.sops.secrets.singbox_password.path;
-      };
-      uuid = {
-        _secret = config.sops.secrets.singbox_uuid.path;
-      };
-    in
-    {
-      enable = true;
-      settings = {
-        dns = {
-          servers = [
-            {
-              tag = "warp";
-              address = "1.1.1.1";
-              detour = "wg-out";
-            }
-            {
-              tag = "directdns";
-              address = "h3://8.8.8.8/dns-query";
-            }
-          ];
-          rules = [
-            {
-              outbound = "wg-out";
-              server = "warp";
-            }
-            {
-              outbound = "direct";
-              server = "directdns";
-            }
-          ];
         };
-        inbounds = [
+        password = {
-          {
+          _secret = config.sops.secrets.singbox_password.path;
-            tag = "sg0";
+        };
-            type = "trojan";
+        uuid = {
-            listen = "::";
+          _secret = config.sops.secrets.singbox_uuid.path;
-            listen_port = 8080;
+        };
-            users = [
+      in
-              { name = "proxy";
+      {
-                password = password;
+        enable = true;
+        settings = {
+          dns = {
+            servers = [
+              {
+                tag = "warp";
+                address = "1.1.1.1";
+                detour = "wg-out";
+              }
+              {
+                tag = "directdns";
+                address = "h3://8.8.8.8/dns-query";
               }
             ];
-            tls = singTls;
+            rules = [
-          }
+              {
-        ] ++ lib.forEach (lib.range 6311 6314) (port: {
+                outbound = "wg-out";
-            tag = "sg" + toString (port - 6310);
+                server = "warp";
-            type = "tuic";
+              }
-            listen = "::";
+              {
-            listen_port = port;
+                outbound = "direct";
-            congestion_control = "bbr";
+                server = "directdns";
-            users = [
-              { name = "proxy";
-                uuid = uuid;
-                password = password;
               }
             ];
-            tls = singTls;
+          };
-          });
+          inbounds =
-        outbounds = [
+            [
-          {
+              {
-            type = "wireguard";
+                tag = "sg0";
-            tag = "wg-out";
+                type = "trojan";
-            private_key = {
+                listen = "::";
-              _secret = config.sops.secrets.wg_private_key.path;
+                listen_port = 8080;
-            };
+                users = [
-            local_address = [
+                  {
-              "172.16.0.2/32"
+                    name = "proxy";
-              { _secret = config.sops.secrets.wg_ipv6_local_addr.path; }
+                    password = password;
-            ];
+                  }
-            peers = [
+                ];
-              { public_key= "bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=";
+                tls = singTls;
-                allowed_ips = [ "0.0.0.0/0" "::/0" ];
-                server = "162.159.192.1";
-                server_port = 500;
               }
-            ];
+            ]
-          }
+            ++ lib.forEach (lib.range 6311 6314) (port: {
-          {
+              tag = "sg" + toString (port - 6310);
-            type = "direct";
+              type = "tuic";
-            tag = "direct";
+              listen = "::";
-          }
+              listen_port = port;
-          {
+              congestion_control = "bbr";
-            type = "dns";
+              users = [
-            tag = "dns-out";
+                {
-          }
+                  name = "proxy";
-        ];
+                  uuid = uuid;
-        route = {
+                  password = password;
-          rules = [
+                }
+              ];
+              tls = singTls;
+            });
+          outbounds = [
             {
-              outbound = "dns-out";
+              type = "wireguard";
-              protocol = "dns";
+              tag = "wg-out";
+              private_key = {
+                _secret = config.sops.secrets.wg_private_key.path;
+              };
+              local_address = [
+                "172.16.0.2/32"
+                { _secret = config.sops.secrets.wg_ipv6_local_addr.path; }
+              ];
+              peers = [
+                {
+                  public_key = "bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=";
+                  allowed_ips = [
+                    "0.0.0.0/0"
+                    "::/0"
+                  ];
+                  server = "162.159.192.1";
+                  server_port = 500;
+                }
+              ];
             }
             {
-              inbound = "sg0";
+              type = "direct";
-              outbound = "direct";
+              tag = "direct";
             }
             {
-              inbound = "sg4";
+              type = "dns";
-              outbound = "direct";
+              tag = "dns-out";
             }
           ];
+          route = {
+            rules = [
+              {
+                outbound = "dns-out";
+                protocol = "dns";
+              }
+              {
+                inbound = "sg0";
+                outbound = "direct";
+              }
+              {
+                inbound = "sg4";
+                outbound = "direct";
+              }
+            ];
+          };
         };
       };
-    };
   };
 
 }

machines/dolomite/lightsail.nix

@@ -1,4 +1,10 @@
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 with lib;
 let
   cfg = config.ec2;
@@ -39,18 +45,22 @@ in
       fsType = "vfat";
     };
 
-    boot.extraModulePackages = [
+    boot.extraModulePackages = [ config.boot.kernelPackages.ena ];
-      config.boot.kernelPackages.ena
-    ];
     boot.initrd.kernelModules = [ "xen-blkfront" ];
     boot.initrd.availableKernelModules = [ "nvme" ];
-    boot.kernelParams = [ "console=ttyS0,115200n8" "random.trust_cpu=on" ];
+    boot.kernelParams = [
+      "console=ttyS0,115200n8"
+      "random.trust_cpu=on"
+    ];
 
     # Prevent the nouveau kernel module from being loaded, as it
     # interferes with the nvidia/nvidia-uvm modules needed for CUDA.
     # Also blacklist xen_fbfront to prevent a 30 second delay during
     # boot.
-    boot.blacklistedKernelModules = [ "nouveau" "xen_fbfront" ];
+    boot.blacklistedKernelModules = [
+      "nouveau"
+      "xen_fbfront"
+    ];
 
     boot.loader.grub.efiSupport = cfg.efi;
     boot.loader.grub.efiInstallAsRemovable = cfg.efi;
@@ -64,7 +74,7 @@ in
     systemd.services.fetch-ec2-metadata = {
       wantedBy = [ "multi-user.target" ];
       wants = [ "network-online.target" ];
-      after = ["network-online.target"];
+      after = [ "network-online.target" ];
       path = [ pkgs.curl ];
       script = builtins.readFile ./ec2-metadata-fetcher.sh;
       serviceConfig.Type = "oneshot";

machines/massicot/default.nix

@@ -1,4 +1,10 @@
-{ inputs, config, libs, pkgs, ... }:
+{
+  inputs,
+  config,
+  libs,
+  pkgs,
+  ...
+}:
 
 {
   imports = [

machines/massicot/hardware-configuration.nix

@@ -5,9 +5,19 @@
     efiSupport = true;
     device = "nodev";
   };
-  fileSystems."/boot" = { device = "/dev/disk/by-uuid/AC27-D9D6"; fsType = "vfat"; };
+  fileSystems."/boot" = {
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" ];
+    device = "/dev/disk/by-uuid/AC27-D9D6";
+    fsType = "vfat";
+  };
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "xen_blkfront"
+  ];
   boot.initrd.kernelModules = [ "nvme" ];
-  fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };
+  fileSystems."/" = {
+    device = "/dev/sda1";
+    fsType = "ext4";
+  };
 
 }

machines/massicot/kanidm-provision.nix

@@ -21,7 +21,11 @@
       members = [ "xin" ];
     };
     immich-users = {
-      members = [ "xin" "zhuo" "ycm" ];
+      members = [
+        "xin"
+        "zhuo"
+        "ycm"
+      ];
     };
     grafana-superadmins = {
       members = [ "xin" ];
@@ -65,7 +69,12 @@
       originLanding = "https://git.xinyang.life/user/oauth2/kandim";
       allowInsecureClientDisablePkce = true;
       scopeMaps = {
-        forgejo-access = [ "openid" "email" "profile" "groups" ];
+        forgejo-access = [
+          "openid"
+          "email"
+          "profile"
+          "groups"
+        ];
       };
       claimMaps = {
         forgejo_role = {
@@ -83,7 +92,12 @@
       originLanding = "https://xinyang.life/";
       allowInsecureClientDisablePkce = true;
       scopeMaps = {
-        gts-users = [ "openid" "email" "profile" "groups" ];
+        gts-users = [
+          "openid"
+          "email"
+          "profile"
+          "groups"
+        ];
       };
     };
     owncloud = {
@@ -92,7 +106,11 @@
       originLanding = "https://home.xinyang.life:9201/";
       public = true;
       scopeMaps = {
-        ocis-users = [ "openid" "email" "profile" ];
+        ocis-users = [
+          "openid"
+          "email"
+          "profile"
+        ];
       };
     };
     hedgedoc = {
@@ -101,7 +119,11 @@
       originLanding = "https://docs.xinyang.life/auth/oauth2";
       allowInsecureClientDisablePkce = true;
       scopeMaps = {
-        hedgedoc-users = [ "openid" "email" "profile" ];
+        hedgedoc-users = [
+          "openid"
+          "email"
+          "profile"
+        ];
       };
     };
     immich-mobile = {
@@ -110,7 +132,11 @@
       originLanding = "https://immich.xinyang.life:8000/api/oauth/mobile-redirect/";
       allowInsecureClientDisablePkce = true;
       scopeMaps = {
-        immich-users = [ "openid" "email" "profile" ];
+        immich-users = [
+          "openid"
+          "email"
+          "profile"
+        ];
       };
     };
     miniflux = {
@@ -118,7 +144,11 @@
       originUrl = "https://rss.xinyang.life/";
       originLanding = "https://rss.xinyang.life/";
       scopeMaps = {
-        miniflux-users = [ "openid" "email" "profile" ];
+        miniflux-users = [
+          "openid"
+          "email"
+          "profile"
+        ];
       };
     };
     grafana = {
@@ -126,7 +156,12 @@
       originUrl = "https://grafana.xinyang.life/";
       originLanding = "https://grafana.xinyang.life/";
       scopeMaps = {
-        grafana-users = [ "openid" "email" "profile" "groups" ];
+        grafana-users = [
+          "openid"
+          "email"
+          "profile"
+          "groups"
+        ];
       };
       claimMaps = {
         grafana_role = {

machines/massicot/networking.nix

@@ -1,11 +1,14 @@
-{ pkgs, ... }: {
+{ pkgs, ... }:
+{
   networking = {
     interfaces = {
       eth0.useDHCP = true;
-      eth0.ipv6.addresses = [{
+      eth0.ipv6.addresses = [
-        address = "2a01:4f8:c17:345f::1";
+        {
-        prefixLength = 64;
+          address = "2a01:4f8:c17:345f::1";
-      }];
+          prefixLength = 64;
+        }
+      ];
     };
     defaultGateway6 = {
       address = "fe80::1";

machines/massicot/services.nix

@@ -1,10 +1,24 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   kanidm_listen_port = 5324;
 in
 {
-  networking.firewall.allowedTCPPorts = [ 80 443 2222 8448 ];
+  networking.firewall.allowedTCPPorts = [
-  networking.firewall.allowedUDPPorts = [ 80 443 8448 ];
+    80
+    443
+    2222
+    8448
+  ];
+  networking.firewall.allowedUDPPorts = [
+    80
+    443
+    8448
+  ];
 
   custom.vaultwarden = {
     enable = true;
@@ -32,16 +46,23 @@ in
     exporters.miniflux.enable = true;
   };
 
-  systemd.mounts = map
+  systemd.mounts =
-    (share: {
+    map
-      what = "//u380335-sub1.your-storagebox.de/u380335-sub1/${share}";
+      (share: {
-      where = "/mnt/storage/${share}";
+        what = "//u380335-sub1.your-storagebox.de/u380335-sub1/${share}";
-      type = "cifs";
+        where = "/mnt/storage/${share}";
-      options = "rw,uid=${share},gid=${share},credentials=${config.sops.secrets.storage_box_mount.path},_netdev,fsc";
+        type = "cifs";
-      before = [ "${share}.service" ];
+        options = "rw,uid=${share},gid=${share},credentials=${config.sops.secrets.storage_box_mount.path},_netdev,fsc";
-      after = [ "cachefilesd.service" ];
+        before = [ "${share}.service" ];
-      wantedBy = [ "${share}.service" ];
+        after = [ "cachefilesd.service" ];
-    }) [ "forgejo" "gotosocial" "conduit" "hedgedoc" ];
+        wantedBy = [ "${share}.service" ];
+      })
+      [
+        "forgejo"
+        "gotosocial"
+        "conduit"
+        "hedgedoc"
+      ];
 
   services.cachefilesd.enable = true;
 
@@ -82,6 +103,7 @@ in
       bindaddress = "[::]:${toString kanidm_listen_port}";
       tls_key = ''${config.security.acme.certs."auth.xinyang.life".directory}/key.pem'';
       tls_chain = ''${config.security.acme.certs."auth.xinyang.life".directory}/fullchain.pem'';
+      online_backup.versions = 7;
       # db_path = "/var/lib/kanidm/kanidm.db";
     };
     provision = import ./kanidm-provision.nix;
@@ -224,11 +246,14 @@ in
         allow_assign_grafana_admin = true;
         auto_login = true;
       };
-      "auth" = { disable_login_form = true; };
+      "auth" = {
+        disable_login_form = true;
+      };
     };
   };
 
-  systemd.services.grafana.serviceConfig.EnvironmentFile = config.sops.secrets.grafana_oauth_secret.path;
+  systemd.services.grafana.serviceConfig.EnvironmentFile =
+    config.sops.secrets.grafana_oauth_secret.path;
 
   users.users.git = {
     isSystemUser = true;
@@ -239,9 +264,7 @@ in
   users.groups.git = { };
 
   users.users = {
-    ${config.services.caddy.user}.extraGroups = [
+    ${config.services.caddy.user}.extraGroups = [ config.services.ntfy-sh.group ];
-      config.services.ntfy-sh.group
-    ];
   };
 
   services.caddy = {

machines/raspite/configuration.nix

@@ -1,17 +1,19 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 {
-  imports = [
+  imports = [ ./hass.nix ];
-    ./hass.nix
-  ];
 
   commonSettings.nix.enableMirrors = true;
 
   nixpkgs.overlays = [
     # Workaround https://github.com/NixOS/nixpkgs/issues/126755#issuecomment-869149243
     (final: super: {
-      makeModulesClosure = x:
+      makeModulesClosure = x: super.makeModulesClosure (x // { allowMissing = true; });
-        super.makeModulesClosure (x // { allowMissing = true; });
     })
   ];
 

machines/raspite/hass.nix

@@ -1,4 +1,5 @@
-{ config, pkgs, ... }: {
+{ config, pkgs, ... }:
+{
   services.home-assistant = {
     enable = true;
     extraComponents = [
@@ -9,14 +10,12 @@
     ];
     openFirewall = false;
     config = {
-      default_config = {};
+      default_config = { };
       http = {
         server_host = "::1";
         base_url = "raspite.local:1000";
         use_x_forward_for = true;
-        trusted_proxies = [
+        trusted_proxies = [ "::1" ];
-          "::1"
-        ];
       };
     };
   };
@@ -28,16 +27,17 @@
 
   users.groups.dialout.members = config.users.groups.wheel.members;
 
-  environment.systemPackages = with pkgs; [
+  environment.systemPackages = with pkgs; [ zigbee2mqtt ];
-    zigbee2mqtt
-  ];
 
-  networking.firewall.allowedTCPPorts = [ 1000 1001 ];
+  networking.firewall.allowedTCPPorts = [
+    1000
+    1001
+  ];
 
   services.caddy = {
     enable = true;
     virtualHosts = {
-        # reverse_proxy ${config.services.home-assistant.config.http.server_host}:${toString config.services.home-assistant.config.http.server_port}
+      # reverse_proxy ${config.services.home-assistant.config.http.server_host}:${toString config.services.home-assistant.config.http.server_port}
       "raspite.local:1000".extraConfig = ''
         reverse_proxy http://[::1]:8123
       '';

machines/sops.nix

@@ -1,4 +1,9 @@
-{ inputs, config, lib, ... }:
+{
+  inputs,
+  config,
+  lib,
+  ...
+}:
 {
   imports = [ inputs.sops-nix.nixosModules.sops ];
   config = {
@@ -11,24 +16,22 @@
           owner = "root";
         };
         singbox_sg_server = {
-           owner = "root";
+          owner = "root";
         };
         singbox_jp_server = {
-           owner = "root";
+          owner = "root";
         };
         singbox_password = {
-           owner = "root";
+          owner = "root";
         };
         singbox_uuid = {
-           owner = "root";
+          owner = "root";
         };
         private_dns_address = {
-           owner = "root";
+          owner = "root";
         };
       };
-      secrets.grafana_cloud_api = lib.mkIf config.services.prometheus.enable {
+      secrets.grafana_cloud_api = lib.mkIf config.services.prometheus.enable { owner = "prometheus"; };
-        owner = "prometheus";
-      };
     };
   };
 }

machines/weilite/default.nix

@@ -1,4 +1,11 @@
-{ inputs, config, pkgs, lib, modulesPath, ... }:
+{
+  inputs,
+  config,
+  pkgs,
+  lib,
+  modulesPath,
+  ...
+}:
 
 with lib;
 
@@ -19,17 +26,21 @@ with lib;
     };
 
     boot = {
-      loader =  {
+      loader = {
         systemd-boot.enable = true;
         efi.canTouchEfiVariables = true;
       };
-      initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "usb_storage" "sd_mod" ];
+      initrd.availableKernelModules = [
+        "uhci_hcd"
+        "ehci_pci"
+        "ahci"
+        "usb_storage"
+        "sd_mod"
+      ];
       kernelModules = [ "kvm-intel" ];
     };
 
-    environment.systemPackages = [
+    environment.systemPackages = [ pkgs.virtiofsd ];
-      pkgs.virtiofsd
-    ];
 
     sops = {
       defaultSopsFile = ./secrets.yaml;
@@ -47,13 +58,15 @@ with lib;
     };
 
     systemd.mounts = [
-      { what = "immich";
+      {
+        what = "immich";
         where = "/mnt/XinPhotos/immich";
         type = "virtiofs";
         options = "rw";
         wantedBy = [ "immich-server.service" ];
       }
-      { what = "originals";
+      {
+        what = "originals";
         where = "/mnt/XinPhotos/originals";
         type = "virtiofs";
         options = "ro,nodev,nosuid";
@@ -61,7 +74,10 @@ with lib;
       }
     ];
 
-    services.openssh.ports = [ 22 2222 ];
+    services.openssh.ports = [
+      22
+      2222
+    ];
 
     services.immich = {
       enable = true;
@@ -90,7 +106,10 @@ with lib;
       enable = true;
       package = pkgs.caddy.withPlugins {
         caddyModules = [
-          { repo = "github.com/caddy-dns/cloudflare"; version = "89f16b99c18ef49c8bb470a82f895bce01cbaece"; }
+          {
+            repo = "github.com/caddy-dns/cloudflare";
+            version = "89f16b99c18ef49c8bb470a82f895bce01cbaece";
+          }
         ];
         vendorHash = "sha256-fTcMtg5GGEgclIwJCav0jjWpqT+nKw2OF1Ow0MEEitk=";
       };
@@ -124,7 +143,10 @@ with lib;
     fileSystems."/boot" = {
       device = "/dev/sda1";
       fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
+      options = [
+        "fmask=0022"
+        "dmask=0022"
+      ];
     };
 
     system.stateVersion = "24.11";

modules/home-manager/alacritty.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, lib, ... }:
 with lib;
 
 let
@@ -25,6 +25,7 @@ in
         window = {
           resize_increments = true;
           dynamic_padding = true;
+          decorations = "none";
         };
       };
     };

modules/home-manager/cosmic-term.nix

@@ -0,0 +1,19 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  inherit (lib) mkEnableOption mkIf;
+
+  cfg = config.custom-hm.cosmic-term;
+in
+{
+  options.custom-hm.cosmic-term = {
+    enable = mkEnableOption "cosmic-term";
+  };
+
+  config = mkIf cfg.enable { home.packages = [ pkgs.cosmic-term ]; };
+}

modules/home-manager/default.nix

@@ -1,6 +1,7 @@
 {
   imports = [
     ./alacritty.nix
+    ./cosmic-term.nix
     ./direnv.nix
     ./fish.nix
     ./git.nix

modules/home-manager/direnv.nix

@@ -24,6 +24,7 @@ in
       direnv = {
         enable = true;
         stdlib = changeCacheDir;
+        nix-direnv.enable = true;
       };
     };
   };

modules/home-manager/fish.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }: 
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 with lib;
 
@@ -10,7 +15,12 @@ in
     enable = mkEnableOption "fish";
     plugins = mkOption {
       type = types.listOf types.str;
-      default = [ "pisces" "done" "hydro" "grc" ];
+      default = [
+        "pisces"
+        "done"
+        "hydro"
+        "grc"
+      ];
     };
     functions = {
       enable = mkOption {
@@ -30,40 +40,65 @@ in
     home.packages = [ pkgs.grc ];
     programs.fish = {
       enable = true;
-      plugins = with pkgs; (filter (
+      plugins =
-        e: hasAttr e.name (builtins.listToAttrs # { "xxx" = true; }
+        with pkgs;
-           (map (p: { name = p; value = true; }) cfg.plugins) # { name = "xxx"; value = true; }
+        (filter
-      )) [
+          (
-        { name = "pisces";
+            e:
-          src = fishPlugins.pisces.src;
+            hasAttr e.name (
-        }
+              builtins.listToAttrs # { "xxx" = true; }
-        { name = "done";
+                (
-          src = fishPlugins.done.src;
+                  map (p: {
-        }
+                    name = p;
-        { name = "hydro";
+                    value = true;
-          src = fishPlugins.hydro.src;
+                  }) cfg.plugins
-        }
+                ) # { name = "xxx"; value = true; }
-        { name = "grc";
+            )
-          src = fishPlugins.grc.src;
+          )
-        }
+          [
-      ]);
+            {
-      interactiveShellInit = let
+              name = "pisces";
-        extraInit = if cfg.functions.enable then ''
+              src = fishPlugins.pisces.src;
-          ${pkgs.nix-your-shell}/bin/nix-your-shell fish | source
+            }
-          function fish_right_prompt
+            {
-            if test -n "$IN_NIX_SHELL"
+              name = "done";
-              echo -n "<nix-shell>"
+              src = fishPlugins.done.src;
-            else if test $SHLVL -ge 3
+            }
-              echo -n "<🚀lv$SHLVL>"
+            {
-            end
+              name = "hydro";
-          end
+              src = fishPlugins.hydro.src;
-          function fish_command_not_found
+            }
-            ${pkgs.comma}/bin/comma $argv
+            {
-          end
+              name = "grc";
-        '' else "";
+              src = fishPlugins.grc.src;
-      in ''
+            }
-        fish_config prompt choose arrow
+          ]
-      '' + extraInit;
+        );
+      interactiveShellInit =
+        let
+          extraInit =
+            if cfg.functions.enable then
+              ''
+                ${pkgs.nix-your-shell}/bin/nix-your-shell fish | source
+                function fish_right_prompt
+                  if test -n "$IN_NIX_SHELL"
+                    echo -n "<nix-shell>"
+                  else if test $SHLVL -ge 3
+                    echo -n "<🚀lv$SHLVL>"
+                  end
+                end
+                function fish_command_not_found
+                  ${pkgs.comma}/bin/comma $argv
+                end
+                set -gx LS_COLORS (${lib.getExe pkgs.vivid} generate catppuccin-mocha)
+              ''
+            else
+              "";
+        in
+        ''
+          fish_config prompt choose default
+        ''
+        + extraInit;
       functions = mkIf cfg.functions.enable {
         gitignore = "curl -sL https://www.gitignore.io/api/$argv";
       };

modules/home-manager/git.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }: 
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 with lib;
 
@@ -36,12 +41,8 @@ in
         signByDefault = true;
         key = cfg.signing.keyFile;
       };
-      extraConfig.user = mkIf cfg.signing.enable {
+      extraConfig.user = mkIf cfg.signing.enable { signingkey = cfg.signing.keyFile; };
-        signingkey = cfg.signing.keyFile;
+      extraConfig.gpg = mkIf cfg.signing.enable { format = "ssh"; };
-      };
-      extraConfig.gpg = mkIf cfg.signing.enable {
-        format = "ssh";
-      };
     };
   };
 }

modules/home-manager/tmux.nix

@@ -1 +1 @@
-{}
+{ }

modules/home-manager/vim.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   inherit (lib) mkIf mkEnableOption getExe;
   cfg = config.custom-hm.neovim;
@@ -13,7 +18,10 @@ in
     enable = mkEnableOption "neovim configurations";
   };
   config = mkIf cfg.enable {
-    home.packages = with pkgs; [ nixvim neovide ];
+    home.packages = with pkgs; [
+      nixvim
+      neovide
+    ];
     programs.neovim.enable = false;
     home.file.".config/neovide/config.toml" = {
       source = tomlFormat.generate "neovide-config" neovideConfig;

modules/home-manager/vscode.nix

@@ -1,4 +1,10 @@
-{ inputs, config, lib, pkgs, ... }:
+{
+  inputs,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib;
 
 let
@@ -6,7 +12,10 @@ let
 
   packages = {
     nixPackages = {
-      systemPackages = with pkgs; [ nixd nixpkgs-fmt ];
+      systemPackages = with pkgs; [
+        nixd
+        nixpkgs-fmt
+      ];
       extension = with inputs.nix-vscode-extensions.extensions.${pkgs.system}.vscode-marketplace; [
         jnoortheen.nix-ide
       ];
@@ -17,10 +26,15 @@ let
       };
     };
     cxxPackages = {
-      systemPackages = with pkgs; [ clang-tools cmake-format ];
+      systemPackages = with pkgs; [
+        clang-tools
+        cmake-format
+      ];
       extension = with inputs.nix-vscode-extensions.extensions.${pkgs.system}.vscode-marketplace; [
         llvm-vs-code-extensions.vscode-clangd
-        (ms-vscode.cmake-tools.overrideAttrs (_: { sourceRoot = "extension"; }))
+        (ms-vscode.cmake-tools.overrideAttrs (_: {
+          sourceRoot = "extension";
+        }))
         twxs.cmake
         ms-vscode.cpptools
       ];
@@ -43,7 +57,10 @@ let
       settings = { };
     };
     scalaPackages = {
-      systemPackages = with pkgs; [ coursier metals ];
+      systemPackages = with pkgs; [
+        coursier
+        metals
+      ];
       extension = with inputs.nix-vscode-extensions.extensions.${pkgs.system}.vscode-marketplace; [
         scala-lang.scala
         scalameta.metals
@@ -61,20 +78,56 @@ let
           {
             "name" = "xelatex";
             "command" = "xelatex";
-            "args" = [ "-synctex=1" "-interaction=nonstopmode" "-file-line-error" "%DOCFILE%" ];
+            "args" = [
+              "-synctex=1"
+              "-interaction=nonstopmode"
+              "-file-line-error"
+              "%DOCFILE%"
+            ];
           }
           {
             "name" = "pdflatex";
             "command" = "pdflatex";
-            "args" = [ "-synctex=1" "-interaction=nonstopmode" "-file-line-error" "%DOCFILE%" ];
+            "args" = [
+              "-synctex=1"
+              "-interaction=nonstopmode"
+              "-file-line-error"
+              "%DOCFILE%"
+            ];
+          }
+          {
+            "name" = "bibtex";
+            "command" = "bibtex";
+            "args" = [ "%DOCFILE%" ];
           }
-          { "name" = "bibtex"; "command" = "bibtex"; "args" = [ "%DOCFILE%" ]; }
         ];
         "latex-workshop.latex.recipes" = [
-          { "name" = "xelatex"; "tools" = [ "xelatex" ]; }
+          {
-          { "name" = "pdflatex"; "tools" = [ "pdflatex" ]; }
+            "name" = "xelatex";
-          { "name" = "xe->bib->xe->xe"; "tools" = [ "xelatex" "bibtex" "xelatex" "xelatex" ]; }
+            "tools" = [ "xelatex" ];
-          { "name" = "pdf->bib->pdf->pdf"; "tools" = [ "pdflatex" "bibtex" "pdflatex" "pdflatex" ]; }
+          }
+          {
+            "name" = "pdflatex";
+            "tools" = [ "pdflatex" ];
+          }
+          {
+            "name" = "xe->bib->xe->xe";
+            "tools" = [
+              "xelatex"
+              "bibtex"
+              "xelatex"
+              "xelatex"
+            ];
+          }
+          {
+            "name" = "pdf->bib->pdf->pdf";
+            "tools" = [
+              "pdflatex"
+              "bibtex"
+              "pdflatex"
+              "pdflatex"
+            ];
+          }
         ];
         "[latex]" = {
           "editor.formatOnPaste" = false;
@@ -88,9 +141,15 @@ let
   };
   llmExtensions = [ pkgs.vscode-extensions.continue.continue ];
 
-  languages = [ "nix" "cxx" "python" "scala" "latex" ];
+  languages = [
-  zipAttrsWithLanguageOption = (attr:
+    "nix"
-    (map (l: (lib.mkIf cfg.languages.${l} packages."${l}Packages".${attr})) languages)
+    "cxx"
+    "python"
+    "scala"
+    "latex"
+  ];
+  zipAttrsWithLanguageOption = (
+    attr: (map (l: (lib.mkIf cfg.languages.${l} packages."${l}Packages".${attr})) languages)
   );
 in
 {
@@ -111,64 +170,71 @@ in
   config = mkIf cfg.enable {
     nixpkgs.config.allowUnfree = true;
 
-    home.packages = lib.mkMerge ([
+    home.packages = lib.mkMerge (
-      [ pkgs.clang-tools ]
+      [
-      (mkIf cfg.llm [ pkgs.ollama ])
+        [ pkgs.clang-tools ]
-    ] ++ zipAttrsWithLanguageOption "systemPackages");
+        (mkIf cfg.llm [ pkgs.ollama ])
+      ]
+      ++ zipAttrsWithLanguageOption "systemPackages"
+    );
     programs.vscode = {
       enable = true;
       package = pkgs.vscode.override { commandLineArgs = "--enable-wayland-ime"; };
       enableUpdateCheck = false;
       enableExtensionUpdateCheck = false;
       mutableExtensionsDir = false;
-      extensions = lib.mkMerge ([
+      extensions = lib.mkMerge (
-        (with inputs.nix-vscode-extensions.extensions.${pkgs.system}.vscode-marketplace; [
+        [
-          mkhl.direnv
+          (with inputs.nix-vscode-extensions.extensions.${pkgs.system}.vscode-marketplace; [
+            mkhl.direnv
 
-          ms-azuretools.vscode-docker
+            ms-azuretools.vscode-docker
-          ms-vscode-remote.remote-ssh
+            ms-vscode-remote.remote-ssh
-          vscodevim.vim
+            vscodevim.vim
-          github.vscode-pull-request-github
+            github.vscode-pull-request-github
-          gruntfuggly.todo-tree # todo highlight
+            gruntfuggly.todo-tree # todo highlight
 
-          # Markdown
+            # Markdown
-          davidanson.vscode-markdownlint
+            davidanson.vscode-markdownlint
-          # Latex
+            # Latex
-          # Scale / chisel
+            # Scale / chisel
-          sterben.fpga-support
+            sterben.fpga-support
 
-          ms-vscode-remote.remote-ssh-edit
+            ms-vscode-remote.remote-ssh-edit
-          mushan.vscode-paste-image
+            mushan.vscode-paste-image
-        ])
+          ])
 
-        (with pkgs.vscode-extensions; [
+          (with pkgs.vscode-extensions; [
-          waderyan.gitblame
+            waderyan.gitblame
-          catppuccin.catppuccin-vsc
+            catppuccin.catppuccin-vsc
-          # Rust
+            # Rust
-          rust-lang.rust-analyzer
+            rust-lang.rust-analyzer
-        ])
+          ])
 
-        (mkIf cfg.llm llmExtensions)
+          (mkIf cfg.llm llmExtensions)
-      ] ++ zipAttrsWithLanguageOption "extension");
+        ]
-      userSettings = lib.mkMerge ([
+        ++ zipAttrsWithLanguageOption "extension"
-        {
+      );
-          "workbench.colorTheme" = "Catppuccin Macchiato";
+      userSettings = lib.mkMerge (
-          "terminal.integrated.sendKeybindingsToShell" = true;
+        [
-          "extensions.ignoreRecommendations" = true;
+          {
-          "files.autoSave" = "afterDelay";
+            "workbench.colorTheme" = "Catppuccin Macchiato";
-          "editor.inlineSuggest.enabled" = true;
+            "terminal.integrated.sendKeybindingsToShell" = true;
-          "editor.rulers" = [
+            "extensions.ignoreRecommendations" = true;
-            80
+            "files.autoSave" = "afterDelay";
-          ];
+            "editor.inlineSuggest.enabled" = true;
-          "editor.mouseWheelZoom" = true;
+            "editor.rulers" = [ 80 ];
-          "git.autofetch" = false;
+            "editor.mouseWheelZoom" = true;
-          "window.zoomLevel" = -1;
+            "git.autofetch" = false;
+            "window.zoomLevel" = -1;
 
-          "extensions.experimental.affinity" = {
+            "extensions.experimental.affinity" = {
-            "vscodevim.vim" = 1;
+              "vscodevim.vim" = 1;
-          };
+            };
-        }
+          }
-      ] ++ zipAttrsWithLanguageOption "settings");
+        ]
+        ++ zipAttrsWithLanguageOption "settings"
+      );
     };
 
     home.file.".continue/config.json".text = lib.generators.toJSON { } {
@@ -180,7 +246,7 @@ in
         }
       ];
       tabAutocompleteModel = {
-        model ="deepseek-coder:6.7b-base";
+        model = "deepseek-coder:6.7b-base";
         provider = "ollama";
         title = "codegemma";
       };

modules/home-manager/zellij.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }: 
+{ config, lib, ... }:
 
 with lib;
 
@@ -14,20 +14,22 @@ in
       enable = true;
       settings = {
         default_shell = "fish";
-        keybinds = {
-          unbind = [
-            "Ctrl p"
-            "Ctrl n"
-          ];
-          shared_except = {
-            _args = [ "pane" "locked" ];
-            bind = {
-              _args = [ "Ctrl b"];
-              SwitchToMode = "Pane";
-            };
-          };
-        };
       };
     };
+    xdg.configFile."zellij/config.kdl".text = ''
+      keybinds {
+          shared_except "pane" "locked" {
+            bind "Ctrl b" { SwitchToMode "Pane"; }
+          }
+          shared_except "locked" {
+            bind "Ctrl h" { MoveFocusOrTab "Left"; }
+            bind "Ctrl l" { MoveFocusOrTab "Right"; }
+            bind "Ctrl j" { MoveFocus "Down"; }
+            bind "Ctrl k" { MoveFocus "Up"; }
+            unbind "Alt h" "Alt l" "Alt j" "Alt k"
+          }
+          unbind "Ctrl p" "Ctrl n"
+      }
+    '';
   };
 }

modules/nixos/common-settings/auth.nix

@@ -1,7 +1,17 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
-  inherit (lib) mkIf mkEnableOption mkOption types;
+  inherit (lib)
+    mkIf
+    mkEnableOption
+    mkOption
+    types
+    ;
 
   cfg = config.commonSettings.auth;
 in
@@ -38,4 +48,3 @@ in
     };
   };
 }
-

modules/nixos/common-settings/nix-conf.nix

@@ -1,7 +1,17 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
-  inherit (lib) mkIf mkEnableOption mkOption types;
+  inherit (lib)
+    mkIf
+    mkEnableOption
+    mkOption
+    types
+    ;
 
   cfg = config.commonSettings.nix;
 in
@@ -33,7 +43,10 @@ in
     nix.optimise.automatic = true;
 
     nix.settings = {
-      experimental-features = [ "nix-command" "flakes" ];
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
       auto-optimise-store = true;
       trusted-users = [ "root" ];
 
@@ -52,10 +65,7 @@ in
         "xin-1:8/ul1IhdWLswERF/8RfeAw8VZqjwHrJ1x55y1yjxQ+Y="
       ];
 
-      secret-key-files = mkIf cfg.signing.enable [
+      secret-key-files = mkIf cfg.signing.enable [ cfg.signing.keyFile ];
-        cfg.signing.keyFile
-      ];
     };
   };
 }
-

modules/nixos/forgejo-actions-runner.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   cfg = config.custom.forgejo-actions-runner;
 in
@@ -6,9 +11,7 @@ in
   options = {
     custom.forgejo-actions-runner = {
       enable = lib.mkEnableOption "TPM supported ssh agent in go";
-      tokenFile = lib.mkOption {
+      tokenFile = lib.mkOption { type = lib.types.path; };
-        type = lib.types.path;
-      };
     };
   };
   config = lib.mkIf cfg.enable {

modules/nixos/hedgedoc.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 with lib;
 
@@ -26,22 +31,12 @@ in
       };
       oidc = {
         enable = mkEnableOption "OIDC support for HedgeDoc";
-        baseURL = mkOption {
+        baseURL = mkOption { type = types.str; };
-          type = types.str;
+        authorizationURL = mkOption { type = types.str; };
-        };
+        tokenURL = mkOption { type = types.str; };
-        authorizationURL = mkOption {
+        userProfileURL = mkOption { type = types.str; };
-          type = types.str;
-        };
-        tokenURL = mkOption {
-          type = types.str;
-        };
-        userProfileURL = mkOption {
-          type = types.str;
-        };
-      };
-      environmentFile = mkOption {
-        type = types.path;
       };
+      environmentFile = mkOption { type = types.path; };
     };
   };
   config = mkIf cfg.enable {

modules/nixos/inbounds.nix

@@ -1,17 +1,14 @@
-{ config
+{ config, lib, ... }:
-, lib
-, ... }:
 let
   cfg = config.custom.sing-box-server;
 
-  secretFileType = lib.types.submodule {
+  secretFileType = lib.types.submodule { _secret = lib.types.path; };
-    _secret = lib.types.path;
-  };
   singTls = {
     enabled = true;
     server_name = config.deployment.targetHost;
     key_path = config.security.acme.certs.${config.deployment.targetHost}.directory + "/key.pem";
-    certificate_path = config.security.acme.certs.${config.deployment.targetHost}.directory + "/cert.pem";
+    certificate_path =
+      config.security.acme.certs.${config.deployment.targetHost}.directory + "/cert.pem";
   };
 in
 {
@@ -22,17 +19,11 @@ in
         type = lib.types.str;
         default = "proxy";
       };
-      password = lib.mkOption {
+      password = lib.mkOption { type = secretFileType; };
-        type = secretFileType;
+      uuid = lib.mkOption { type = secretFileType; };
-      };
-      uuid = lib.mkOption {
-        type = secretFileType;
-      };
     };
     wgOut = {
-      privKeyFile = lib.mkOption {
+      privKeyFile = lib.mkOption { type = lib.types.path; };
-        type = lib.types.path;
-      };
       pubkey = lib.mkOption {
         type = lib.types.str;
         default = "bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=";
@@ -73,17 +64,19 @@ in
             }
           ];
         };
-        inbounds = [
+        inbounds =
-          # TODO: Trojan and tuic enable
+          [
-          {
+            # TODO: Trojan and tuic enable
-            tag = "trojan-in";
+            {
-            type = "trojan";
+              tag = "trojan-in";
-            listen = "::";
+              type = "trojan";
-            listen_port = 8080;
+              listen = "::";
-            users = map (u: removeAttrs u [ "uuid" ]) cfg.users;
+              listen_port = 8080;
-            tls = singTls;
+              users = map (u: removeAttrs u [ "uuid" ]) cfg.users;
-          }
+              tls = singTls;
-        ] ++ lib.forEach (cfg.tuic.ports ++ cfg.tuic.directPorts) (port: {
+            }
+          ]
+          ++ lib.forEach (cfg.tuic.ports ++ cfg.tuic.directPorts) (port: {
             tag = "tuic-in" + toString port;
             type = "tuic";
             listen = "::";
@@ -102,23 +95,38 @@ in
               "2606:4700:110:82ed:a443:3c62:6cbc:b59b/128"
             ];
             peers = [
-              { public_key= cfg.wgOut.pubkey;
+              {
-                allowed_ips = [ "0.0.0.0/0" "::/0" ];
+                public_key = cfg.wgOut.pubkey;
+                allowed_ips = [
+                  "0.0.0.0/0"
+                  "::/0"
+                ];
                 server = "162.159.192.1";
                 server_port = 500;
               }
             ];
           }
-          { type = "direct"; tag = "direct-out"; }
+          {
-          { type = "dns"; tag = "dns-out"; }
+            type = "direct";
+            tag = "direct-out";
+          }
+          {
+            type = "dns";
+            tag = "dns-out";
+          }
         ];
         route = {
-          rules = [
+          rules =
-            { outbound = "dns-out"; protocol = "dns"; }
+            [
-          ] ++ lib.forEach cfg.tuic.directPorts (port: {
+              {
-            inbound = "tuic-in" + toString port;
+                outbound = "dns-out";
-            outbound = "direct-out";
+                protocol = "dns";
-          });
+              }
+            ]
+            ++ lib.forEach cfg.tuic.directPorts (port: {
+              inbound = "tuic-in" + toString port;
+              outbound = "direct-out";
+            });
         };
       };
     };

modules/nixos/kanidm-client.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 with lib;
 
 let
@@ -27,27 +32,25 @@ in
         type = types.listOf types.str;
         default = [ ];
       };
-      uri = mkOption {
+      uri = mkOption { type = types.str; };
-        type = types.str;
-      };
     };
   };
   config = mkIf cfg.enable {
-    services.kanidm = mkMerge
+    services.kanidm = mkMerge [
-      [ (mkIf cfg.enable {
+      (mkIf cfg.enable {
-          enableClient = true;
+        enableClient = true;
-          clientSettings = {
+        clientSettings = {
-            uri = cfg.uri;
+          uri = cfg.uri;
-          };
+        };
-        })
+      })
-        (mkIf cfg.asSSHAuth.enable {
+      (mkIf cfg.asSSHAuth.enable {
-           enablePam = true;
+        enablePam = true;
-           unixSettings = {
+        unixSettings = {
-             pam_allowed_login_groups = cfg.asSSHAuth.allowedGroups;
+          pam_allowed_login_groups = cfg.asSSHAuth.allowedGroups;
-             default_shell = "/bin/sh";
+          default_shell = "/bin/sh";
-           };
+        };
-        })
+      })
-      ];
+    ];
     services.openssh = mkIf cfg.asSSHAuth.enable {
       enable = true;
       authorizedKeysCommand = "/etc/ssh/auth %u";
@@ -70,8 +73,10 @@ in
     };
     users.groups.wheel.members = cfg.sudoers;
     users.groups.kanidm-ssh-runner = { };
-    users.users.kanidm-ssh-runner = { isSystemUser = true; group = "kanidm-ssh-runner"; };
+    users.users.kanidm-ssh-runner = {
+      isSystemUser = true;
+      group = "kanidm-ssh-runner";
+    };
 
   };
 }
-

modules/nixos/miniflux.nix

@@ -1,6 +1,19 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
-  inherit (lib) mkEnableOption mkPackageOption mkOption types literalExpression mkIf mkDefault;
+  inherit (lib)
+    mkEnableOption
+    mkPackageOption
+    mkOption
+    types
+    literalExpression
+    mkIf
+    mkDefault
+    ;
   cfg = config.custom.miniflux;
 
   defaultAddress = "localhost:8080";
@@ -18,12 +31,15 @@ in
 
       package = mkPackageOption pkgs "miniflux" { };
 
-      oauth2SecretFile = mkOption {
+      oauth2SecretFile = mkOption { type = types.path; };
-        type = types.path;
-      };
 
       environment = mkOption {
-        type = with types; attrsOf (oneOf [ int str ]);
+        type =
+          with types;
+          attrsOf (oneOf [
+            int
+            str
+          ]);
       };
 
       createDatabaseLocally = mkOption {
@@ -50,17 +66,22 @@ in
 
     services.postgresql = lib.mkIf cfg.createDatabaseLocally {
       enable = true;
-      ensureUsers = [{
+      ensureUsers = [
-        name = "miniflux";
+        {
-        ensureDBOwnership = true;
+          name = "miniflux";
-      }];
+          ensureDBOwnership = true;
+        }
+      ];
       ensureDatabases = [ "miniflux" ];
     };
 
     systemd.services.miniflux-dbsetup = lib.mkIf cfg.createDatabaseLocally {
       description = "Miniflux database setup";
       requires = [ "postgresql.service" ];
-      after = [ "network.target" "postgresql.service" ];
+      after = [
+        "network.target"
+        "postgresql.service"
+      ];
       serviceConfig = {
         Type = "oneshot";
         User = config.services.postgresql.superUser;
@@ -72,8 +93,12 @@ in
       description = "Miniflux service";
       wantedBy = [ "multi-user.target" ];
       requires = lib.optional cfg.createDatabaseLocally "miniflux-dbsetup.service";
-      after = [ "network.target" ]
+      after =
-        ++ lib.optionals cfg.createDatabaseLocally [ "postgresql.service" "miniflux-dbsetup.service" ];
+        [ "network.target" ]
+        ++ lib.optionals cfg.createDatabaseLocally [
+          "postgresql.service"
+          "miniflux-dbsetup.service"
+        ];
 
       serviceConfig = {
         Type = "notify";
@@ -104,12 +129,19 @@ in
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         ProtectProc = "invisible";
-        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
         RestrictNamespaces = true;
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         SystemCallArchitectures = "native";
-        SystemCallFilter = [ "@system-service" "~@privileged" ];
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
         UMask = "0077";
       };
 

modules/nixos/oidc-agent.nix

@@ -1,10 +1,20 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
-  inherit (lib) mkIf mkEnableOption mkOption types;
+  inherit (lib)
+    mkIf
+    mkEnableOption
+    mkOption
+    types
+    ;
 
   cfg = config.programs.oidc-agent;
-  providerFormat = pkgs.formats.json {};
+  providerFormat = pkgs.formats.json { };
 in
 {
   options.programs.oidc-agent = {
@@ -18,7 +28,7 @@ in
     };
     providers = mkOption {
       type = providerFormat.type;
-      default = {};
+      default = { };
       description = ''
         Configuration of providers which contains a json array of json objects
         each describing an issuer, see https://indigo-dc.gitbook.io/oidc-agent/configuration/issuers

modules/nixos/prometheus/blackbox.nix

@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   cfg = config.custom.prometheus;
 in
@@ -8,7 +13,7 @@ in
       enable = true;
       listenAddress = "127.0.0.1";
       configFile = pkgs.writeText "blackbox.config.yaml" (
-        lib.generators.toYAML {} {
+        lib.generators.toYAML { } {
           modules = {
             tcp4_connect = {
               prober = "tcp";
@@ -25,7 +30,7 @@ in
     };
 
     services.prometheus.scrapeConfigs = [
-       {
+      {
         job_name = "blackbox";
         scrape_interval = "1m";
         metrics_path = "/probe";
@@ -73,8 +78,13 @@ in
             alert = "HighProbeLatency";
             expr = "probe_duration_seconds > 0.5";
             for = "2m";
-            labels = { severity = "warning"; };
+            labels = {
-            annotations = { summary = "High request latency on {{ $labels.instance }}"; description = "95th percentile of request latency is above 0.5 seconds for the last 2 minutes."; };
+              severity = "warning";
+            };
+            annotations = {
+              summary = "High request latency on {{ $labels.instance }}";
+              description = "95th percentile of request latency is above 0.5 seconds for the last 2 minutes.";
+            };
           }
         ];
       }

modules/nixos/prometheus/caddy.nix

@@ -13,9 +13,7 @@ in
     services.prometheus.scrapeConfigs = [
       {
         job_name = "caddy";
-        static_configs = [
+        static_configs = [ { targets = [ "127.0.0.1:2019" ]; } ];
-          { targets = [ "127.0.0.1:2019" ]; }
-        ];
       }
     ];
 
@@ -27,8 +25,12 @@ in
             alert = "UpstreamHealthy";
             expr = "caddy_reverse_proxy_upstreams_healthy != 1";
             for = "5m";
-            labels = { severity = "critical"; };
+            labels = {
-            annotations = { summary = "Upstream {{ $labels.unstream }} not healthy"; };
+              severity = "critical";
+            };
+            annotations = {
+              summary = "Upstream {{ $labels.unstream }} not healthy";
+            };
           }
         ];
       }

modules/nixos/prometheus/default.nix

@@ -1,26 +1,31 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 with lib;
 
 let
   cfg = config.custom.prometheus;
-  mkExporterOption = enableOption: (mkOption {
+  mkExporterOption =
-    type = types.bool;
+    enableOption:
-    default = enableOption;
+    (mkOption {
-    description = "Enable this exporter";
+      type = types.bool;
-  });
+      default = enableOption;
+      description = "Enable this exporter";
+    });
 
   mkRulesOption = mkOption {
-    type = types.listOf (types.submodule {
+    type = types.listOf (
-      options = {
+      types.submodule {
-        name = mkOption {
+        options = {
-          type = lib.types.str;
+          name = mkOption { type = lib.types.str; };
+          rules = mkOption { type = lib.types.listOf lib.types.attrs; };
         };
-        rules = mkOption {
+      }
-          type = lib.types.listOf lib.types.attrs;
+    );
-        };
-      };
-    });
   };
 in
 {
@@ -54,153 +59,172 @@ in
       };
       grafana = {
         enable = mkEnableOption "Grafana Cloud";
-        password_file = mkOption {
+        password_file = mkOption { type = types.path; };
-          type = types.path;
-        };
       };
       ruleModules = mkRulesOption;
     };
   };
 
-  config = mkIf cfg.enable
+  config = mkIf cfg.enable {
-    {
+    services.tailscale = {
-      services.tailscale = {
+      enable = true;
-        enable = true;
+      permitCertUid = config.services.caddy.user;
-        permitCertUid = config.services.caddy.user;
+      openFirewall = true;
-        openFirewall = true;
+    };
-      };
 
-      services.caddy = {
+    services.caddy = {
-        enable = true;
+      enable = true;
-        virtualHosts."${config.networking.hostName}.coho-tet.ts.net".extraConfig = ''
+      virtualHosts."${config.networking.hostName}.coho-tet.ts.net".extraConfig = ''
-          reverse_proxy 127.0.0.1:${toString config.services.prometheus.port}
+        reverse_proxy 127.0.0.1:${toString config.services.prometheus.port}
-        '';
+      '';
-      };
+    };
 
-      services.prometheus = mkIf cfg.enable
+    services.prometheus = mkIf cfg.enable {
+      enable = true;
+      port = 9091;
+      globalConfig.external_labels = {
+        hostname = config.networking.hostName;
+      };
+      remoteWrite = mkIf cfg.grafana.enable [
         {
+          name = "grafana";
+          url = "https://prometheus-prod-24-prod-eu-west-2.grafana.net/api/prom/push";
+          basic_auth = {
+            username = "1340065";
+            password_file = cfg.grafana.password_file;
+          };
+        }
+      ];
+      exporters = {
+        node = {
           enable = true;
-          port = 9091;
+          enabledCollectors = [
-          globalConfig.external_labels = { hostname = config.networking.hostName; };
+            "loadavg"
-          remoteWrite = mkIf cfg.grafana.enable [
+            "time"
-            {
+            "systemd"
-              name = "grafana";
-              url = "https://prometheus-prod-24-prod-eu-west-2.grafana.net/api/prom/push";
-              basic_auth = {
-                username = "1340065";
-                password_file = cfg.grafana.password_file;
-              };
-            }
           ];
-          exporters = {
+          listenAddress = "127.0.0.1";
-            node = {
+          port = 9100;
-              enable = true;
-              enabledCollectors = [
-                "loadavg"
-                "time"
-                "systemd"
-              ];
-              listenAddress = "127.0.0.1";
-              port = 9100;
-            };
-          };
-          scrapeConfigs = [
-            {
-              job_name = "prometheus";
-              static_configs = [
-                { targets = [ "localhost:${toString config.services.prometheus.port}" ]; }
-              ];
-            }
-            {
-              job_name = "node";
-              static_configs = [
-                { targets = [ "localhost:${toString config.services.prometheus.exporters.node.port}" ]; }
-              ];
-            }
-          ];
-
-          alertmanager = {
-            enable = true;
-            listenAddress = "127.0.0.1";
-            logLevel = "debug";
-            configuration = {
-              route = {
-                receiver = "ntfy";
-              };
-              receivers = [
-                {
-                  name = "ntfy";
-                  webhook_configs = [
-                    {
-                      url = "https://ntfy.xinyang.life/prometheus-alerts?tpl=yes&m=${lib.escapeURL ''
-                        Alert {{.status}}
-                        {{range .alerts}}-----{{range $k,$v := .labels}}
-                        {{$k}}={{$v}}{{end}}
-                        {{end}}
-                      ''}";
-                      send_resolved = true;
-                    }
-                  ];
-                }
-              ];
-            };
-          };
-
-          alertmanagers = [
-            {
-              scheme = "http";
-              static_configs = [
-                {
-                  targets = [
-                    "${config.services.prometheus.alertmanager.listenAddress}:${toString config.services.prometheus.alertmanager.port}"
-                  ];
-                }
-              ];
-            }
-          ];
-          rules = [ (lib.generators.toYAML { } { groups = cfg.ruleModules; }) ];
         };
-      custom.prometheus.ruleModules = [
+      };
+      scrapeConfigs = [
         {
-          name = "system_alerts";
+          job_name = "prometheus";
-          rules = [
+          static_configs = [ { targets = [ "localhost:${toString config.services.prometheus.port}" ]; } ];
+        }
+        {
+          job_name = "node";
+          static_configs = [
+            { targets = [ "localhost:${toString config.services.prometheus.exporters.node.port}" ]; }
+          ];
+        }
+      ];
+
+      alertmanager = {
+        enable = true;
+        listenAddress = "127.0.0.1";
+        logLevel = "debug";
+        configuration = {
+          route = {
+            receiver = "ntfy";
+          };
+          receivers = [
             {
-              alert = "SystemdFailedUnits";
+              name = "ntfy";
-              expr = "node_systemd_unit_state{state=\"failed\"} > 0";
+              webhook_configs = [
-              for = "5m";
+                {
-              labels = { severity = "critical"; };
+                  url = "https://ntfy.xinyang.life/prometheus-alerts?tpl=yes&m=${lib.escapeURL ''
-              annotations = { summary = "Systemd has failed units on {{ $labels.instance }}"; description = "There are {{ $value }} failed units on {{ $labels.instance }}. Immediate attention required!"; };
+                    Alert {{.status}}
+                    {{range .alerts}}-----{{range $k,$v := .labels}}
+                    {{$k}}={{$v}}{{end}}
+                    {{end}}
+                  ''}";
+                  send_resolved = true;
+                }
+              ];
             }
+          ];
+        };
+      };
+
+      alertmanagers = [
+        {
+          scheme = "http";
+          static_configs = [
             {
-              alert = "HighLoadAverage";
+              targets = [
-              expr = "node_load1 > 0.8 * count without (cpu) (node_cpu_seconds_total{mode=\"idle\"})";
+                "${config.services.prometheus.alertmanager.listenAddress}:${toString config.services.prometheus.alertmanager.port}"
-              for = "1m";
+              ];
-              labels = { severity = "warning"; };
-              annotations = { summary = "High load average detected on {{ $labels.instance }}"; description = "The 1-minute load average ({{ $value }}) exceeds 80% the number of CPUs."; };
-            }
-            {
-              alert = "HighTransmitTraffic";
-              expr = "rate(node_network_transmit_bytes_total{device!=\"lo\"}[5m]) > 100000000";
-              for = "1m";
-              labels = { severity = "warning"; };
-              annotations = { summary = "High network transmit traffic on {{ $labels.instance }} ({{ $labels.device }})"; description = "The network interface {{ $labels.device }} on {{ $labels.instance }} is transmitting data at a rate exceeding 100 MB/s for the last 1 minute."; };
-            }
-            {
-              alert = "NetworkTrafficExceedLimit";
-              expr = ''increase(node_network_transmit_bytes_total{device!="lo",device!~"tailscale.*",device!~"wg.*",device!~"br.*"}[30d]) > 322122547200'';
-              for = "0m";
-              labels = { severity = "critical"; };
-              annotations = { summary = "Outbound network traffic exceed 300GB for last 30 day"; };
-            }
-            {
-              alert = "JobDown";
-              expr = "up == 0";
-              for = "1m";
-              labels = { severity = "critical"; };
-              annotations = { summary = "Job {{ $labels.job }} down for 1m."; };
             }
           ];
         }
       ];
+      rules = [ (lib.generators.toYAML { } { groups = cfg.ruleModules; }) ];
     };
+    custom.prometheus.ruleModules = [
+      {
+        name = "system_alerts";
+        rules = [
+          {
+            alert = "SystemdFailedUnits";
+            expr = "node_systemd_unit_state{state=\"failed\"} > 0";
+            for = "5m";
+            labels = {
+              severity = "critical";
+            };
+            annotations = {
+              summary = "Systemd has failed units on {{ $labels.instance }}";
+              description = "There are {{ $value }} failed units on {{ $labels.instance }}. Immediate attention required!";
+            };
+          }
+          {
+            alert = "HighLoadAverage";
+            expr = "node_load1 > 0.8 * count without (cpu) (node_cpu_seconds_total{mode=\"idle\"})";
+            for = "1m";
+            labels = {
+              severity = "warning";
+            };
+            annotations = {
+              summary = "High load average detected on {{ $labels.instance }}";
+              description = "The 1-minute load average ({{ $value }}) exceeds 80% the number of CPUs.";
+            };
+          }
+          {
+            alert = "HighTransmitTraffic";
+            expr = "rate(node_network_transmit_bytes_total{device!=\"lo\"}[5m]) > 100000000";
+            for = "1m";
+            labels = {
+              severity = "warning";
+            };
+            annotations = {
+              summary = "High network transmit traffic on {{ $labels.instance }} ({{ $labels.device }})";
+              description = "The network interface {{ $labels.device }} on {{ $labels.instance }} is transmitting data at a rate exceeding 100 MB/s for the last 1 minute.";
+            };
+          }
+          {
+            alert = "NetworkTrafficExceedLimit";
+            expr = ''increase(node_network_transmit_bytes_total{device!="lo",device!~"tailscale.*",device!~"wg.*",device!~"br.*"}[30d]) > 322122547200'';
+            for = "0m";
+            labels = {
+              severity = "critical";
+            };
+            annotations = {
+              summary = "Outbound network traffic exceed 300GB for last 30 day";
+            };
+          }
+          {
+            alert = "JobDown";
+            expr = "up == 0";
+            for = "1m";
+            labels = {
+              severity = "critical";
+            };
+            annotations = {
+              summary = "Job {{ $labels.job }} down for 1m.";
+            };
+          }
+        ];
+      }
+    ];
+  };
 }

modules/nixos/prometheus/gotosocial.nix

@@ -10,9 +10,7 @@ in
     services.prometheus.scrapeConfigs = [
       {
         job_name = "gotosocial";
-        static_configs = [
+        static_configs = [ { targets = [ "localhost:8080" ]; } ];
-          { targets = [ "localhost:8080" ]; }
-        ];
       }
     ];
   };

modules/nixos/prometheus/immich.nix

@@ -3,9 +3,10 @@ let
   cfg = config.custom.prometheus;
   immichEnv = config.services.immich.environment;
   metricPort =
-    if builtins.hasAttr "IMMICH_API_METRICS_PORT" immichEnv
+    if builtins.hasAttr "IMMICH_API_METRICS_PORT" immichEnv then
-    then immichEnv.IMMICH_API_METRICS_PORT
+      immichEnv.IMMICH_API_METRICS_PORT
-    else 8081;
+    else
+      8081;
 in
 {
   config = lib.mkIf (cfg.enable && cfg.exporters.immich.enable) {
@@ -16,9 +17,7 @@ in
     services.prometheus.scrapeConfigs = [
       {
         job_name = "immich";
-        static_configs = [
+        static_configs = [ { targets = [ "127.0.0.1:${toString metricPort}" ]; } ];
-          { targets = [ "127.0.0.1:${toString metricPort}" ]; }
-        ];
       }
     ];
   };

modules/nixos/prometheus/miniflux.nix

@@ -8,9 +8,7 @@ in
     services.prometheus.scrapeConfigs = [
       {
         job_name = "miniflux";
-        static_configs = [
+        static_configs = [ { targets = [ config.systemd.services.miniflux.environment.LISTEN_ADDR ]; } ];
-          { targets = [ config.systemd.services.miniflux.environment.LISTEN_ADDR ]; }
-        ];
       }
     ];
   };

modules/nixos/prometheus/ntfy-sh.nix

@@ -8,9 +8,7 @@ in
     services.prometheus.scrapeConfigs = [
       {
         job_name = "ntfy-sh";
-        static_configs = [
+        static_configs = [ { targets = [ "ntfy.xinyang.life" ]; } ];
-          { targets = [ "ntfy.xinyang.life" ]; }
-        ];
       }
     ];
   };

modules/nixos/prometheus/restic.nix

@@ -9,9 +9,7 @@ in
     services.prometheus.scrapeConfigs = [
       (lib.mkIf cfg.exporters.restic.enable {
         job_name = "restic";
-        static_configs = [
+        static_configs = [ { targets = [ config.services.restic.server.listenAddress ]; } ];
-          { targets = [ config.services.restic.server.listenAddress ]; }
-        ];
       })
     ];
 
@@ -23,15 +21,25 @@ in
             alert = "ResticCheckFailed";
             expr = "restic_check_success == 0";
             for = "5m";
-            labels = { severity = "critical"; };
+            labels = {
-            annotations = { summary = "Restic check failed (instance {{ $labels.instance }})"; description = "Restic check failed\\n  VALUE = {{ $value }}\\n  LABELS = {{ $labels }}"; };
+              severity = "critical";
+            };
+            annotations = {
+              summary = "Restic check failed (instance {{ $labels.instance }})";
+              description = "Restic check failed\\n  VALUE = {{ $value }}\\n  LABELS = {{ $labels }}";
+            };
           }
           {
             alert = "ResticOutdatedBackup";
             expr = "time() - restic_backup_timestamp > 518400";
             for = "0m";
-            labels = { severity = "critical"; };
+            labels = {
-            annotations = { summary = "Restic {{ $labels.client_hostname }} / {{ $labels.client_username }} backup is outdated"; description = "Restic backup is outdated\\n  VALUE = {{ $value }}\\n  LABELS = {{ $labels }}"; };
+              severity = "critical";
+            };
+            annotations = {
+              summary = "Restic {{ $labels.client_hostname }} / {{ $labels.client_username }} backup is outdated";
+              description = "Restic backup is outdated\\n  VALUE = {{ $value }}\\n  LABELS = {{ $labels }}";
+            };
           }
         ];
       }

modules/nixos/restic.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   cfg = config.custom.restic;
 in
@@ -45,4 +50,3 @@ in
     };
   };
 }
-

modules/nixos/sing-box.nix

@@ -1,4 +1,10 @@
-{ config, pkgs, lib, utils, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  utils,
+  ...
+}:
 let
   cfg = config.custom.sing-box;
   settingsFormat = pkgs.formats.json { };
@@ -16,9 +22,7 @@ in
       };
 
       configFile = {
-        urlFile = lib.mkOption {
+        urlFile = lib.mkOption { type = lib.types.path; };
-          type = lib.types.path;
-        };
         name = lib.mkOption {
           type = lib.types.str;
           default = "config.json";
@@ -63,9 +67,9 @@ in
     systemd.packages = [ cfg.package ];
 
     systemd.services.sing-box =
-    let
+      let
-      configFile = cfg.stateDir + "/${cfg.configFile.name}";
+        configFile = cfg.stateDir + "/${cfg.configFile.name}";
-    in
+      in
       {
         preStart = ''
           umask 0077
@@ -81,4 +85,3 @@ in
       };
   };
 }
-

modules/nixos/ssh-tpm-agent.nix

@@ -1,5 +1,10 @@
 # Temporary workaround
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   cfg = config.services.ssh-tpm-agent;
 in

modules/nixos/vaultwarden.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 with lib;
 
@@ -23,7 +28,7 @@ in
     };
   };
   config = mkIf cfg.enable {
-    services.vaultwarden =  {
+    services.vaultwarden = {
       enable = true;
       dbBackend = "sqlite";
       config = {
@@ -44,4 +49,3 @@ in
     };
   };
 }
-

oci-images/nix-ci-base/flake.nix

@@ -6,72 +6,78 @@
     flake-utils.url = "github:numtide/flake-utils";
   };
 
-  outputs = {
+  outputs =
-    self,
+    {
-    flake-utils,
+      self,
-    nix,
+      flake-utils,
-    nixpkgs,
+      nix,
-    ...
+      nixpkgs,
-  }:
+      ...
-    flake-utils.lib.eachDefaultSystem (system: let
+    }:
-      pkgs = (import nixpkgs) {
+    flake-utils.lib.eachDefaultSystem (
-        inherit system;
+      system:
-      };
+      let
-      lib = pkgs.lib;
+        pkgs = (import nixpkgs) { inherit system; };
-    in rec {
+        lib = pkgs.lib;
-      packages = rec {
+      in
-        # a modified version of the nixos/nix image
+      rec {
-        # re-using the upstream nix docker image generation code
+        packages = rec {
-        base = import (nix + "/docker.nix") {
+          # a modified version of the nixos/nix image
-          inherit pkgs;
+          # re-using the upstream nix docker image generation code
-          name = "nix-ci-base";
+          base = import (nix + "/docker.nix") {
-          maxLayers = 10;
+            inherit pkgs;
-          extraPkgs = with pkgs; [
+            name = "nix-ci-base";
-            nodejs_20 # nodejs is needed for running most 3rdparty actions
+            maxLayers = 10;
-            # add any other pre-installed packages here
+            extraPkgs = with pkgs; [
-            curl
+              nodejs_20 # nodejs is needed for running most 3rdparty actions
-            xz
+              # add any other pre-installed packages here
-            openssl
+              curl
-            coreutils-full
+              xz
-            cmake
+              openssl
-            gnumake
+              coreutils-full
-            gcc
+              cmake
-          ];
+              gnumake
-          # change this is you want 
+              gcc
-          channelURL = "https://nixos.org/channels/nixpkgs-23.11";
+            ];
-          nixConf = {
+            # change this is you want 
-            substituters = [
+            channelURL = "https://nixos.org/channels/nixpkgs-23.11";
-              "https://mirrors.bfsu.edu.cn/nix-channels/store"
+            nixConf = {
-              "https://mirrors.ustc.edu.cn/nix-channels/store"
+              substituters = [
-              "https://cache.nixos.org/"
+                "https://mirrors.bfsu.edu.cn/nix-channels/store"
+                "https://mirrors.ustc.edu.cn/nix-channels/store"
+                "https://cache.nixos.org/"
 
-              "https://nix-community.cachix.org"
+                "https://nix-community.cachix.org"
-            ];
+              ];
-            accept-flake-config = "true";
+              accept-flake-config = "true";
-            log-lines = "300";
+              log-lines = "300";
-            trusted-public-keys = [
+              trusted-public-keys = [
-              "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+                "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-              "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+                "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-            ];
+              ];
-            # allow using the new flake commands in our workflows
+              # allow using the new flake commands in our workflows
-            experimental-features = ["nix-command" "flakes"];
+              experimental-features = [
+                "nix-command"
+                "flakes"
+              ];
+            };
+          };
+          # make /bin/sleep available on the image
+          runner = pkgs.dockerTools.buildImage {
+            name = "nix-runner";
+            tag = "2.21.0-pkgs-23.11";
+
+            fromImage = base;
+            fromImageName = null;
+            fromImageTag = "latest";
+
+            copyToRoot = pkgs.buildEnv {
+              name = "image-root";
+              paths = [ pkgs.coreutils-full ];
+              pathsToLink = [ "/bin" ]; # add coreutuls (which includes sleep) to /bin
+            };
           };
         };
-        # make /bin/sleep available on the image
+      }
-        runner = pkgs.dockerTools.buildImage {
+    );
-          name = "nix-runner";
-          tag = "2.21.0-pkgs-23.11";
-
-          fromImage = base;
-          fromImageName = null;
-          fromImageTag = "latest";
-
-          copyToRoot = pkgs.buildEnv {
-            name = "image-root";
-            paths = [pkgs.coreutils-full];
-            pathsToLink = ["/bin"]; # add coreutuls (which includes sleep) to /bin
-          };
-        };
-      };
-    });
 }

overlays/add-ime-electron.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 {
   nixpkgs.overlays = [

overlays/add-pkgs.nix

@@ -1,3 +1 @@
-(final: prev: {
+(final: prev: { oidc-agent = prev.callPackage ./pkgs/oidc-agent { }; })
-  oidc-agent = prev.callPackage ./pkgs/oidc-agent { };
-})

overlays/pkgs/oidc-agent/default.nix

@@ -1,14 +1,15 @@
-{ lib
+{
-, stdenv
+  lib,
-, fetchFromGitHub
+  stdenv,
-, curl
+  fetchFromGitHub,
-, webkitgtk
+  curl,
-, libmicrohttpd
+  webkitgtk,
-, libsecret
+  libmicrohttpd,
-, qrencode
+  libsecret,
-, libsodium
+  qrencode,
-, pkg-config
+  libsodium,
-, help2man
+  pkg-config,
+  help2man,
 }:
 
 stdenv.mkDerivation rec {
@@ -19,8 +20,7 @@ stdenv.mkDerivation rec {
     owner = "indigo-dc";
     repo = "oidc-agent";
     rev = "v${version}";
-    sha256 = "sha256-cOK/rZ/jnyALLuhDM3+qvwwe4Fjkv8diQBkw7NfVo0c="
+    sha256 = "sha256-cOK/rZ/jnyALLuhDM3+qvwwe4Fjkv8diQBkw7NfVo0c=";
-    ;
   };
 
   buildInputs = [
@@ -47,7 +47,6 @@ stdenv.mkDerivation rec {
     make install_man PREFIX=$out
   '';
 
-
   meta = with lib; {
     description = "oidc-agent for managing OpenID Connect tokens on the command line";
     homepage = "https://github.com/indigo-dc/oidc-agent";
@@ -55,4 +54,3 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
   };
 }
-