style: format with nixfmt-rfc-style

config/acme.nix

@@ -1,4 +1,5 @@
-{config, ...}: {
+{ config, ... }:
+{
   security.acme = {
     acceptTerms = true;
     defaults.email = "hey@winston.sh";

config/default.nix

@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   imports = [
     ./games
     ./secrets

config/games/valheim.nix

@@ -1,5 +1,7 @@
-{lib, ...}: {
+{ lib, ... }:
-  nixpkgs.config.allowUnfreePredicate = pkg:
+{
+  nixpkgs.config.allowUnfreePredicate =
+    pkg:
     builtins.elem (lib.getName pkg) [
       "valheim-server"
       "steamworks-sdk-redist"

config/nix.nix

@@ -1,12 +1,16 @@
 {
   nix = {
     gc.automatic = true;
-    settings =
+    settings = (import ../flake.nix).nixConfig // {
-      (import ../flake.nix).nixConfig
-      // {
       auto-optimise-store = true;
-        experimental-features = ["nix-command" "flakes"];
+      experimental-features = [
-        trusted-users = ["@wheel" "winston"];
+        "nix-command"
+        "flakes"
+      ];
+      trusted-users = [
+        "@wheel"
+        "winston"
+      ];
     };
   };
 }

config/secrets/default.nix

@@ -1,7 +1,13 @@
-{lib, ...}: {
+{ lib, ... }:
-  age.secrets = with builtins;
+{
-    listToAttrs (map (k: {
+  age.secrets =
+    with builtins;
+    listToAttrs (
+      map (k: {
         name = lib.removeSuffix ".age" k;
-      value = {file = ./. + "/${k}";};
+        value = {
-    }) (attrNames (import ./secrets.nix)));
+          file = ./. + "/${k}";
+        };
+      }) (attrNames (import ./secrets.nix))
+    );
 }

config/secrets/secrets.nix

@@ -2,8 +2,12 @@ let
   users.winston = "age1yubikey1qfkn095xth4ukxjye98ew4ul6xdkyz7sek0hd67yfjs5z6tv7q9jgnfchls";
   systems.main-node = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFcY5fuyxK8rs3eocLuLnvSPDL6qcvq7oUdYrE+wLj0y";
 
-  default = [users.winston systems.main-node];
+  default = [
-in {
+    users.winston
+    systems.main-node
+  ];
+in
+{
   "containers/faerber.env.age".publicKeys = default;
   "containers/ghcr-token.age".publicKeys = default;
 

config/services/attic.nix

@@ -1,4 +1,5 @@
-{config, ...}: {
+{ config, ... }:
+{
   services.atticd = {
     enable = true;
     credentialsFile = config.age.secrets."services/attic/atticd.env".path;

config/services/atuin.nix

@@ -1,8 +1,5 @@
+{ config, pkgs, ... }:
 {
-  config,
-  pkgs,
-  ...
-}: {
   services.atuin = {
     enable = true;
     package = pkgs.unstable.atuin;

config/services/forgejo.nix

@@ -3,14 +3,17 @@
   inputs,
   pkgs,
   ...
-}: let
+}:
-  modules = ["services/misc/forgejo.nix" "services/continuous-integration/gitea-actions-runner.nix"];
+let
-in {
+  modules = [
+    "services/misc/forgejo.nix"
+    "services/continuous-integration/gitea-actions-runner.nix"
+  ];
+in
+{
   # swap out stable for unstable modules
   disabledModules = modules;
-  imports =
+  imports = builtins.map (v: "${inputs.nixpkgs-unstable}/nixos/modules/${v}") modules;
-    builtins.map (v: "${inputs.nixpkgs-unstable}/nixos/modules/${v}")
-    modules;
 
   age.secrets = {
     "services/forgejo/minio-secretkey".owner = config.services.forgejo.user;
@@ -44,10 +47,13 @@ in {
     settings = {
       DEFAULT.APP_NAME = "winston's forgejo";
 
-      indexer = with config.services.elasticsearch; let
+      indexer =
+        with config.services.elasticsearch;
+        let
           indexer = "elasticsearch";
           conn = "http://${listenAddress}:${toString port}";
-      in {
+        in
+        {
           REPO_INDEXER_ENABLED = true;
           REPO_INDEXER_CONN_STR = conn;
           REPO_INDEXER_TYPE = indexer;

config/services/freshrss.nix

@@ -1,4 +1,5 @@
-{config, ...}: {
+{ config, ... }:
+{
   services.freshrss = rec {
     enable = true;
 

config/services/geoipupdate.nix

@@ -1,10 +1,15 @@
-{config, ...}: {
+{ config, ... }:
+{
   services.geoipupdate = {
     enable = true;
     settings = {
       AccountID = 1062126;
       LicenseKey = config.age.secrets."services/geoipupdate/license".path;
-      EditionIDs = ["GeoLite2-ASN" "GeoLite2-City" "GeoLite2-Country"];
+      EditionIDs = [
+        "GeoLite2-ASN"
+        "GeoLite2-City"
+        "GeoLite2-Country"
+      ];
     };
   };
 }

config/services/minio.nix

@@ -1,4 +1,5 @@
-{config, ...}: {
+{ config, ... }:
+{
   services.minio = {
     enable = true;
     browser = true;

config/services/monitoring.nix

@@ -3,7 +3,8 @@
   lib,
   pkgs,
   ...
-}: let
+}:
+let
   geoipDir = config.services.geoipupdate.settings.DatabaseDirectory;
 
   log_params = [
@@ -25,7 +26,8 @@
   ];
   log_format = lib.concatStringsSep " " (map (p: "${p}=\"\$${p}\"") log_params);
   log_file = "/var/log/nginx/access.log";
-in {
+in
+{
   services.grafana = {
     enable = true;
     settings = {
@@ -82,10 +84,12 @@ in {
 
     globalConfig.scrape_interval = "10s";
     scrapeConfigs =
-      (builtins.map (config: {
+      (builtins.map
+        (config: {
           inherit (config) job_name;
           static_configs = [ { targets = [ "localhost:${toString config.port}" ]; } ];
-        }) [
+        })
+        [
           {
             job_name = "fail2ban";
             port = 9191;
@@ -106,7 +110,8 @@ in {
             job_name = "postgres";
             port = config.services.prometheus.exporters.postgres.port;
           }
-        ])
+        ]
+      )
       ++ [
         {
           job_name = "minio";
@@ -116,7 +121,9 @@ in {
         }
         {
           job_name = "forgejo";
-          static_configs = with config.services.forgejo.settings.server; [{targets = ["${HTTP_ADDR}:${toString HTTP_PORT}"];}];
+          static_configs = with config.services.forgejo.settings.server; [
+            { targets = [ "${HTTP_ADDR}:${toString HTTP_PORT}" ]; }
+          ];
         }
       ];
 
@@ -165,8 +172,24 @@ in {
       };
       node = {
         enable = true;
-        enabledCollectors = ["logind" "processes" "systemd"];
+        enabledCollectors = [
-        disabledCollectors = ["bonding" "fibrechannel" "infiniband" "ipvs" "mdadm" "nfs" "nfsd" "nvme" "tapestats" "watchdog" "zfs"];
+          "logind"
+          "processes"
+          "systemd"
+        ];
+        disabledCollectors = [
+          "bonding"
+          "fibrechannel"
+          "infiniband"
+          "ipvs"
+          "mdadm"
+          "nfs"
+          "nfsd"
+          "nvme"
+          "tapestats"
+          "watchdog"
+          "zfs"
+        ];
       };
       postgres = {
         enable = true;

config/services/nextcloud.nix

@@ -1,8 +1,5 @@
+{ config, pkgs, ... }:
 {
-  config,
-  pkgs,
-  ...
-}: {
   age.secrets = {
     "services/nextcloud/admin-password".owner = "nextcloud";
     "services/nextcloud/s3-secret".owner = "nextcloud";
@@ -20,8 +17,7 @@
     };
 
     extraApps = {
-      inherit
+      inherit (config.services.nextcloud.package.packages.apps)
-        (config.services.nextcloud.package.packages.apps)
         end_to_end_encryption
         previewgenerator
         twofactor_webauthn

config/services/nginx.nix

@@ -1,13 +1,11 @@
-{
+{ config, pkgs, ... }:
-  config,
+let
-  pkgs,
-  ...
-}: let
   snakeoilCert = pkgs.runCommand "nginx-snakeoil-cert" { buildInputs = [ pkgs.openssl ]; } ''
     mkdir "$out"
     openssl req -newkey rsa:4096 -x509 -sha256 -days 36500 -subj '/CN=Snakeoil CA' -nodes -out "$out/cert.pem" -keyout "$out/cert.key"
   '';
-in {
+in
+{
   services.nginx = {
     enable = true;
     package = pkgs.nginxMainline;
@@ -47,7 +45,10 @@ in {
     params.nginx = { };
   };
 
-  networking.firewall.allowedTCPPorts = [80 443];
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
 
   # allow nginx to access Acme secrets
   users.users.nginx.extraGroups = [ "acme" ];

config/services/postgres.nix

@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   services.postgresql = {
     enable = true;
     package = pkgs.postgresql_14;

config/services/renovate.nix

@@ -3,7 +3,8 @@
   inputs,
   pkgs,
   ...
-}: {
+}:
+{
   imports = [ "${inputs.nixpkgs-unstable}/nixos/modules/services/misc/renovate.nix" ];
 
   services.renovate = {

config/services/wakapi.nix

@@ -1,8 +1,5 @@
+{ config, pkgs, ... }:
 {
-  config,
-  pkgs,
-  ...
-}: {
   services.wakapi = {
     enable = true;
     package = pkgs.unstable.wakapi;

config/users.nix

@@ -3,29 +3,35 @@
   lib,
   pkgs,
   ...
-}: let
+}:
+let
   nu_scripts = "${pkgs.nu_scripts}/share/nu_scripts";
-  mkCompletions = completions:
+  mkCompletions =
+    completions:
     lib.concatStringsSep "\n" (
       builtins.map (
         el: "source ${nu_scripts}/custom-completions/${el.name or el}/${el.filename or el}-completions.nu"
-      )
+      ) completions
-      completions
     );
-in {
+in
+{
   i18n.defaultLocale = "en_US.UTF-8";
 
   users = {
     mutableUsers = false;
     users.root = {
       hashedPasswordFile = config.age.secrets."system/password-root".path;
-      openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ/mwLoiuaQ6KH+1IOvYO541gq37S43pYtMetilMG3v5"] ++ config.users.users.winston.openssh.authorizedKeys.keys;
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICgFwSZPS1B3wndghjmgmamdM5LZ7hqv4fZsbcmYBQWT"
+      ] ++ config.users.users.winston.openssh.authorizedKeys.keys;
     };
     users.winston = {
       extraGroups = [ "wheel" ];
       hashedPasswordFile = config.age.secrets."system/password-winston".path;
       isNormalUser = true;
-      openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILm0O46zW/XfVOSwz0okRWYeOAg+wCVkCtCAoVTpZsOh"];
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILm0O46zW/XfVOSwz0okRWYeOAg+wCVkCtCAoVTpZsOh"
+      ];
     };
   };
 
@@ -102,7 +108,12 @@ in {
               }
 
               source ${nu_scripts}/aliases/git/git-aliases.nu
-              ${mkCompletions ["git" "man" "rg" "tar"]}
+              ${mkCompletions [
+                "git"
+                "man"
+                "rg"
+                "tar"
+              ]}
             '';
         };
         starship.enable = true;

flake.nix

@@ -1,11 +1,13 @@
 {
-  outputs = {
+  outputs =
+    {
       flake-parts,
       nixpkgs,
       nixpkgs-unstable,
       self,
       ...
-  } @ inputs: let
+    }@inputs:
+    let
       overlays = [
         (final: _: {
           unstable = nixpkgs-unstable.legacyPackages.${final.system};
@@ -33,7 +35,9 @@
             inputs.satisfactory-server.nixosModules.default
             inputs.valheim-server.nixosModules.default
           ];
-          specialArgs = {inherit inputs;};
+          specialArgs = {
+            inherit inputs;
+          };
         };
 
         checks = builtins.mapAttrs (_: deployLib: deployLib.deployChecks self.deploy) inputs.deploy-rs.lib;
@@ -47,17 +51,17 @@
         };
       };
 
-      perSystem = {
+      perSystem =
+        {
           config,
           inputs',
           pkgs,
           self',
           system,
           ...
-      }: {
+        }:
-        _module.args.pkgs = import nixpkgs {
+        {
-          inherit overlays system;
+          _module.args.pkgs = import nixpkgs { inherit overlays system; };
-        };
 
           devShells.default = pkgs.mkShell {
             inherit (config.pre-commit.devShell) shellHook;
@@ -71,24 +75,28 @@
             ];
           };
 
-        formatter = pkgs.alejandra;
+          formatter = pkgs.nixfmt-rfc-style;
 
           pre-commit = {
             check.enable = true;
             settings.excludes = [ "_sources/" ];
             settings.hooks = {
-            alejandra.enable = true;
               commitizen.enable = true;
-            deadnix.enable = true;
               editorconfig-checker.enable = true;
               nil.enable = true;
+              nixfmt-rfc-style.enable = true;
               shellcheck.enable = true;
             };
           };
         };
 
       imports = [ inputs.pre-commit-hooks.flakeModule ];
-      systems = ["x86_64-linux" "aarch64-linux" "aarch64-darwin" "x86_64-darwin"];
+      systems = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "aarch64-darwin"
+        "x86_64-darwin"
+      ];
     };
 
   inputs = {

hosts/main-node/default.nix

@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   imports = [ ./hardware-configuration.nix ];
 
   boot = {

hosts/main-node/hardware-configuration.nix

@@ -3,12 +3,18 @@
   lib,
   modulesPath,
   ...
-}: {
+}:
-  imports = [
+{
-    (modulesPath + "/profiles/qemu-guest.nix")
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-  ];
 
-  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];

modules/default.nix

@@ -1,5 +1 @@
-{
+{ imports = [ ./wakapi.nix ]; }
-  imports = [
-    ./wakapi.nix
-  ];
-}

modules/wakapi.nix

@@ -3,7 +3,8 @@
   lib,
   pkgs,
   ...
-}: let
+}:
+let
   cfg = config.services.wakapi;
   settingsFormat = pkgs.formats.yaml { };
   inherit (lib) types;
@@ -36,7 +37,11 @@
         ProtectKernelTunables = true;
         ProtectProc = "invisible";
         ProtectSystem = "strict";
-        RestrictAddressFamilies = ["AF_INET" "AF_INET6" "AF_UNIX"];
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
         RestrictNamespaces = true;
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
@@ -97,7 +102,8 @@
       public_url = lib.mkDefault cfg.domain;
     };
   };
-in {
+in
+{
   options.services.wakapi = {
     enable = lib.mkEnableOption "Wakapi";
     package = lib.mkPackageOption pkgs "wakapi" { };
@@ -185,9 +191,11 @@ in {
     };
   };
 
-  config = lib.mkIf cfg.enable (lib.mkMerge [
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
       databaseConfig
       nginxConfig
       serviceConfig
-  ]);
+    ]
+  );
 }

pkgs/prometheus-fail2ban-exporter/default.nix

@@ -2,7 +2,8 @@
   buildGoModule,
   fetchFromGitLab,
   lib,
-}: let
+}:
+let
   version = "0.10.1";
 in
 buildGoModule {