diff --git a/checks.nix b/checks.nix
index 65d3493..9505c35 100644
--- a/checks.nix
+++ b/checks.nix
@@ -1,20 +1,20 @@
-{ self
-, flake-utils
-, nixpkgs
-, ...
+{
+  self,
+  flake-utils,
+  nixpkgs,
+  ...
 }:
-(flake-utils.lib.eachDefaultSystem (system:
+(flake-utils.lib.eachDefaultSystem (
+  system:
   let
     pkgs = nixpkgs.legacyPackages.${system};
     formatter = self.formatter.${system};
   in
   {
     checks = {
-      format = pkgs.runCommand
-        "check-format"
-        {
-          buildInputs = [ formatter ];
-        }
-        "${formatter}/bin/nixpkgs-fmt --check ${./.} && touch $out";
+      format = pkgs.runCommand "check-format" {
+        buildInputs = [ formatter ];
+      } "${formatter}/bin/nixpkgs-fmt --check ${./.} && touch $out";
     };
-  })).checks
+  }
+)).checks
diff --git a/flake.nix b/flake.nix
index 801e5a2..0cc4b5c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -40,5 +40,5 @@
     };
   };
 
-  outputs = { ... } @ args: import ./outputs.nix args;
+  outputs = { ... }@args: import ./outputs.nix args;
 }
diff --git a/home/dconf.nix b/home/dconf.nix
index db5ca18..5238c97 100644
--- a/home/dconf.nix
+++ b/home/dconf.nix
@@ -33,8 +33,20 @@ with lib.hm.gvariant;
       current = mkUint32 0;
       per-window = false;
       show-all-sources = true;
-      sources = [ (mkTuple [ "xkb" "eu" ]) (mkTuple [ "xkb" "de" ]) ];
-      xkb-options = [ "lv3:ralt_switch" "caps:escape" ];
+      sources = [
+        (mkTuple [
+          "xkb"
+          "eu"
+        ])
+        (mkTuple [
+          "xkb"
+          "de"
+        ])
+      ];
+      xkb-options = [
+        "lv3:ralt_switch"
+        "caps:escape"
+      ];
     };
 
     "org/gnome/desktop/interface" = {
@@ -127,7 +139,10 @@ with lib.hm.gvariant;
       composer-attribution-language = "de_DE";
       composer-reply-start-bottom = false;
       composer-signature-in-new-only = true;
-      composer-spell-languages = [ "de" "en_US" ];
+      composer-spell-languages = [
+        "de"
+        "en_US"
+      ];
       composer-top-signature = false;
       composer-unicode-smileys = false;
       composer-visually-wrap-long-lines = true;
diff --git a/home/modules.nix b/home/modules.nix
index 0e295c9..0a6c961 100644
--- a/home/modules.nix
+++ b/home/modules.nix
@@ -1,8 +1,13 @@
 { lib, ... }:
-with lib; let
-  modules' = dir: filterAttrs (name: type: (hasSuffix ".nix" name) || (type == "directory"))
-    (builtins.readDir dir);
-  modules = dir: mapAttrs' (name: _: nameValuePair (removeSuffix ".nix" name) (import (dir + "/${name}")))
-    (modules' dir);
+with lib;
+let
+  modules' =
+    dir:
+    filterAttrs (name: type: (hasSuffix ".nix" name) || (type == "directory")) (builtins.readDir dir);
+  modules =
+    dir:
+    mapAttrs' (name: _: nameValuePair (removeSuffix ".nix" name) (import (dir + "/${name}"))) (
+      modules' dir
+    );
 in
 (modules ./modules)
diff --git a/home/modules/alacritty/default.nix b/home/modules/alacritty/default.nix
index 086b945..da9f503 100644
--- a/home/modules/alacritty/default.nix
+++ b/home/modules/alacritty/default.nix
@@ -1,9 +1,11 @@
-{ pkgs
-, lib
-, config
-, ...
+{
+  pkgs,
+  lib,
+  config,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.home.alacritty;
 in
 {
diff --git a/home/modules/colors.nix b/home/modules/colors.nix
index 5c197a1..a4dc5c7 100644
--- a/home/modules/colors.nix
+++ b/home/modules/colors.nix
@@ -1,8 +1,10 @@
-{ config
-, lib
-, ...
+{
+  config,
+  lib,
+  ...
 }:
-with lib; {
+with lib;
+{
   options.dadada.home.colors = mkOption {
     type = types.attrs;
     description = "Color scheme";
diff --git a/home/modules/direnv.nix b/home/modules/direnv.nix
index cf36bf1..27a0907 100644
--- a/home/modules/direnv.nix
+++ b/home/modules/direnv.nix
@@ -1,9 +1,11 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.home.direnv;
 in
 {
diff --git a/home/modules/git.nix b/home/modules/git.nix
index 7762612..92c4c12 100644
--- a/home/modules/git.nix
+++ b/home/modules/git.nix
@@ -1,9 +1,11 @@
-{ config
-, lib
-, pkgs
-, ...
+{
+  config,
+  lib,
+  pkgs,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.home.git;
   allowedSigners = pkgs.writeTextFile {
     name = "allowed-signers";
diff --git a/home/modules/gpg.nix b/home/modules/gpg.nix
index d1af776..baa17dd 100644
--- a/home/modules/gpg.nix
+++ b/home/modules/gpg.nix
@@ -1,8 +1,10 @@
-{ config
-, lib
-, ...
+{
+  config,
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.home.gpg;
 in
 {
diff --git a/home/modules/gtk.nix b/home/modules/gtk.nix
index eb6dae8..5dcd2e6 100644
--- a/home/modules/gtk.nix
+++ b/home/modules/gtk.nix
@@ -1,9 +1,11 @@
-{ config
-, lib
-, pkgs
-, ...
+{
+  config,
+  lib,
+  pkgs,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.home.gtk;
 in
 {
diff --git a/home/modules/helix/default.nix b/home/modules/helix/default.nix
index 2ffdc51..7717423 100644
--- a/home/modules/helix/default.nix
+++ b/home/modules/helix/default.nix
@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   cfg = config.dadada.home.helix;
 in
diff --git a/home/modules/keyring.nix b/home/modules/keyring.nix
index e82d476..48b8b54 100644
--- a/home/modules/keyring.nix
+++ b/home/modules/keyring.nix
@@ -1,8 +1,10 @@
-{ config
-, lib
-, ...
+{
+  config,
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.home.keyring;
 in
 {
diff --git a/home/modules/session.nix b/home/modules/session.nix
index 879400d..ba5c941 100644
--- a/home/modules/session.nix
+++ b/home/modules/session.nix
@@ -1,8 +1,10 @@
-{ config
-, lib
-, ...
+{
+  config,
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.home.session;
 in
 {
diff --git a/home/modules/ssh.nix b/home/modules/ssh.nix
index 96f4ed3..b8aab54 100644
--- a/home/modules/ssh.nix
+++ b/home/modules/ssh.nix
@@ -1,8 +1,10 @@
-{ config
-, lib
-, ...
+{
+  config,
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.home.ssh;
 in
 {
diff --git a/home/modules/syncthing.nix b/home/modules/syncthing.nix
index fd566b4..8095904 100644
--- a/home/modules/syncthing.nix
+++ b/home/modules/syncthing.nix
@@ -1,9 +1,11 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.home.syncthing;
 in
 {
diff --git a/home/modules/tmux.nix b/home/modules/tmux.nix
index 70f2974..063b8f2 100644
--- a/home/modules/tmux.nix
+++ b/home/modules/tmux.nix
@@ -1,8 +1,10 @@
-{ config
-, lib
-, ...
+{
+  config,
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.home.tmux;
 in
 {
diff --git a/home/modules/xdg.nix b/home/modules/xdg.nix
index cccf70e..02cadaf 100644
--- a/home/modules/xdg.nix
+++ b/home/modules/xdg.nix
@@ -1,9 +1,11 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   apps = {
     "x-scheme-handler/mailto" = "evolution.desktop";
     "message/rfc822" = "evolution.desktop";
diff --git a/home/modules/zsh.nix b/home/modules/zsh.nix
index a095bff..96364ff 100644
--- a/home/modules/zsh.nix
+++ b/home/modules/zsh.nix
@@ -1,9 +1,11 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.home.zsh;
 in
 {
@@ -45,8 +47,7 @@ in
         PROMPT="%F{red}%?%f %F{green}%m%f:%F{blue}%~%f"$'\n'"╰─> "
         RPROMPT='$(git_super_status)'
       '';
-      profileExtra = ''
-      '';
+      profileExtra = '''';
       shellAliases = {
         ga = "git add";
         gc = "git commit";
diff --git a/home/nixpkgs-config.nix b/home/nixpkgs-config.nix
index 83fcdbc..6a29a63 100644
--- a/home/nixpkgs-config.nix
+++ b/home/nixpkgs-config.nix
@@ -1,4 +1,5 @@
-{ pkgs }: {
+{ pkgs }:
+{
   allowUnfree = true;
   allowUnfreePredicate = pkg: true;
   allowBroken = false;
diff --git a/home/pkgs.nix b/home/pkgs.nix
index 0facf12..8fd23e8 100644
--- a/home/pkgs.nix
+++ b/home/pkgs.nix
@@ -1,5 +1,6 @@
 { pkgs }:
-with pkgs; [
+with pkgs;
+[
   anki
   aqbanking
   aria2
@@ -105,7 +106,10 @@ with pkgs; [
   prusa-slicer
   pv
   pwgen
-  (python3.withPackages (pkgs: [pkgs.pandas pkgs.requests]))
+  (python3.withPackages (pkgs: [
+    pkgs.pandas
+    pkgs.requests
+  ]))
   ranger
   reptyr
   ripgrep
diff --git a/hydra-jobs.nix b/hydra-jobs.nix
index 1d7dde7..3369943 100644
--- a/hydra-jobs.nix
+++ b/hydra-jobs.nix
@@ -1,5 +1,4 @@
 { self, nixpkgs, ... }:
-(nixpkgs.lib.mapAttrs'
-  (name: config: nixpkgs.lib.nameValuePair name config.config.system.build.toplevel)
-  self.nixosConfigurations
-)
+(nixpkgs.lib.mapAttrs' (
+  name: config: nixpkgs.lib.nameValuePair name config.config.system.build.toplevel
+) self.nixosConfigurations)
diff --git a/nixos/agares/configuration.nix b/nixos/agares/configuration.nix
index c8ab058..ba00c29 100644
--- a/nixos/agares/configuration.nix
+++ b/nixos/agares/configuration.nix
@@ -1,7 +1,8 @@
-{ config
-, modulesPath
-, pkgs
-, ...
+{
+  config,
+  modulesPath,
+  pkgs,
+  ...
 }:
 {
   imports = [
@@ -30,7 +31,10 @@
   fileSystems."/swap" = {
     device = "/dev/sda1";
     fsType = "btrfs";
-    options = [ "subvol=/root/swap" "noatime" ];
+    options = [
+      "subvol=/root/swap"
+      "noatime"
+    ];
   };
 
   #swapDevices = [{
@@ -49,7 +53,14 @@
   networking.hostName = "agares";
   networking.domain = "bs.dadada.li";
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ehci_pci" "usb_storage" "sd_mod" "sdhci_pci" ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "ehci_pci"
+    "usb_storage"
+    "sd_mod"
+    "sdhci_pci"
+  ];
   boot.initrd.kernelModules = [ "dm-snapshot" ];
 
   # Use the GRUB 2 boot loader.
diff --git a/nixos/agares/dns.nix b/nixos/agares/dns.nix
index 7e52d8b..fe2843f 100644
--- a/nixos/agares/dns.nix
+++ b/nixos/agares/dns.nix
@@ -66,7 +66,10 @@
       ];
       stub-zone =
         let
-          stubZone = name: addrs: { name = "${name}"; stub-addr = addrs; };
+          stubZone = name: addrs: {
+            name = "${name}";
+            stub-addr = addrs;
+          };
         in
         [
           #(stubZone "li.dadada.bs" ["192.168.128.220" "2a01:4f8:c010:a710::1"])
diff --git a/nixos/agares/network.nix b/nixos/agares/network.nix
index af15e05..6d86d22 100644
--- a/nixos/agares/network.nix
+++ b/nixos/agares/network.nix
@@ -10,7 +10,10 @@ in
     enable = true;
     links = {
       "10-persistent" = {
-        matchConfig.OriginalName = [ "enp1s0" "enp2s0" ]; # takes search domains from the [Network]
+        matchConfig.OriginalName = [
+          "enp1s0"
+          "enp2s0"
+        ]; # takes search domains from the [Network]
         linkConfig.MACAddressPolicy = "persistent";
       };
     };
@@ -49,19 +52,21 @@ in
           PrivateKeyFile = config.age.secrets."wg-privkey-vpn-dadada-li".path;
           ListenPort = 51234;
         };
-        wireguardPeers = [{
-          wireguardPeerConfig =
-            let
-              peerAddresses = i: [
-                "${ipv4Prefix}.120.${i}/32"
-                "${ulaPrefix}:120::${i}/128"
-              ];
-            in
-            {
-              PublicKey = "0eWP1hzkyoXlrjPSOq+6Y1u8tnFH+SejBJs8f8lf+iU=";
-              AllowedIPs = peerAddresses "3";
-            };
-        }];
+        wireguardPeers = [
+          {
+            wireguardPeerConfig =
+              let
+                peerAddresses = i: [
+                  "${ipv4Prefix}.120.${i}/32"
+                  "${ulaPrefix}:120::${i}/128"
+                ];
+              in
+              {
+                PublicKey = "0eWP1hzkyoXlrjPSOq+6Y1u8tnFH+SejBJs8f8lf+iU=";
+                AllowedIPs = peerAddresses "3";
+              };
+          }
+        ];
       };
       "20-wg0" = {
         netdevConfig = {
@@ -137,7 +142,10 @@ in
         "10-mgmt" = lib.mkMerge [
           (subnet "enp1s0" "100")
           {
-            networkConfig.VLAN = [ "lan.10" "ff.11" ];
+            networkConfig.VLAN = [
+              "lan.10"
+              "ff.11"
+            ];
             dhcpServerStaticLeases = [
               {
                 # legion
@@ -158,13 +166,24 @@ in
         ];
         "30-wg0" = {
           matchConfig.Name = "wg0";
-          address = [ "10.3.3.2/32" "fd42:9c3b:f96d:121::2/128" ];
+          address = [
+            "10.3.3.2/32"
+            "fd42:9c3b:f96d:121::2/128"
+          ];
           DHCP = "no";
           networkConfig.IPv6AcceptRA = false;
           linkConfig.RequiredForOnline = false;
           routes = [
-            { routeConfig = { Destination = "10.3.3.1/24"; }; }
-            { routeConfig = { Destination = "fd42:9c3b:f96d:121::1/64"; }; }
+            {
+              routeConfig = {
+                Destination = "10.3.3.1/24";
+              };
+            }
+            {
+              routeConfig = {
+                Destination = "fd42:9c3b:f96d:121::1/64";
+              };
+            }
           ];
         };
         "30-lan" = subnet "lan.10" "101" // {
@@ -266,10 +285,14 @@ in
           linkConfig.RequiredForOnline = false;
           routes = [
             {
-              routeConfig = { Destination = "${ipv4Prefix}.120.1/24"; };
+              routeConfig = {
+                Destination = "${ipv4Prefix}.120.1/24";
+              };
             }
             {
-              routeConfig = { Destination = "${ulaPrefix}::120:1/64"; };
+              routeConfig = {
+                Destination = "${ulaPrefix}::120:1/64";
+              };
             }
           ];
         };
diff --git a/nixos/agares/ppp.nix b/nixos/agares/ppp.nix
index dc26e46..ffa5bc4 100644
--- a/nixos/agares/ppp.nix
+++ b/nixos/agares/ppp.nix
@@ -1,4 +1,9 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 let
   secretsPath = config.dadada.secrets.path;
 in
diff --git a/nixos/gorgon/configuration.nix b/nixos/gorgon/configuration.nix
index 13b861a..9c8b8e3 100644
--- a/nixos/gorgon/configuration.nix
+++ b/nixos/gorgon/configuration.nix
@@ -1,7 +1,8 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
 let
   xilinxJtag = pkgs.writeTextFile {
@@ -104,13 +105,18 @@ in
     passwordFile = config.age.secrets.paperless.path;
   };
 
-  systemd.tmpfiles.rules = let cfg = config.services.paperless; in [
-    (if cfg.consumptionDirIsPublic then
-      "d '${cfg.consumptionDir}' 777 - - - -"
-    else
-      "d '${cfg.consumptionDir}' 770 ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
-    )
-  ];
+  systemd.tmpfiles.rules =
+    let
+      cfg = config.services.paperless;
+    in
+    [
+      (
+        if cfg.consumptionDirIsPublic then
+          "d '${cfg.consumptionDir}' 777 - - - -"
+        else
+          "d '${cfg.consumptionDir}' 770 ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
+      )
+    ];
 
   age.secrets.paperless = {
     file = "${config.dadada.secrets.path}/paperless.age";
@@ -130,12 +136,14 @@ in
     ];
   };
 
-  hardware.printers.ensurePrinters = [{
-    name = "Brother_HL-L2300D";
-    model = "everywhere";
-    location = "BS";
-    deviceUri = "ipp://192.168.101.29:631/printers/Brother_HL-L2300D";
-  }];
+  hardware.printers.ensurePrinters = [
+    {
+      name = "Brother_HL-L2300D";
+      model = "everywhere";
+      location = "BS";
+      deviceUri = "ipp://192.168.101.29:631/printers/Brother_HL-L2300D";
+    }
+  ];
 
   environment.systemPackages = with pkgs; [
     android-studio
@@ -175,7 +183,7 @@ in
     saleaeLogic
     keychron
     pkgs.libsigrok
-  ]; #noMtpUdevRules ];
+  ]; # noMtpUdevRules ];
 
   virtualisation.libvirtd.enable = true;
 
@@ -187,7 +195,20 @@ in
   users.users = {
     dadada = {
       isNormalUser = true;
-      extraGroups = [ "wheel" "networkmanager" "libvirtd" "adbusers" "kvm" "video" "scanner" "lp" "docker" "dialout" "wireshark" "paperless" ];
+      extraGroups = [
+        "wheel"
+        "networkmanager"
+        "libvirtd"
+        "adbusers"
+        "kvm"
+        "video"
+        "scanner"
+        "lp"
+        "docker"
+        "dialout"
+        "wireshark"
+        "paperless"
+      ];
       shell = "/run/current-system/sw/bin/zsh";
     };
   };
diff --git a/nixos/gorgon/hardware-configuration.nix b/nixos/gorgon/hardware-configuration.nix
index 4155fae..30d7447 100644
--- a/nixos/gorgon/hardware-configuration.nix
+++ b/nixos/gorgon/hardware-configuration.nix
@@ -1,17 +1,26 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config
-, lib
-, pkgs
-, modulesPath
-, ...
-}: {
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+{
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = [ "nvme" "ehci_pci" "xhci_pci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "ehci_pci"
+    "xhci_pci"
+    "usb_storage"
+    "sd_mod"
+    "rtsx_pci_sdmmc"
+  ];
   boot.initrd.kernelModules = [ "dm-snapshot" ];
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
diff --git a/nixos/modules/admin.nix b/nixos/modules/admin.nix
index 873832d..07323da 100644
--- a/nixos/modules/admin.nix
+++ b/nixos/modules/admin.nix
@@ -1,11 +1,16 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.admin;
-  extraGroups = [ "wheel" "libvirtd" ];
+  extraGroups = [
+    "wheel"
+    "libvirtd"
+  ];
 
   shells = {
     "bash" = pkgs.bashInteractive;
@@ -16,22 +21,32 @@ with lib; let
   shellNames = builtins.attrNames shells;
 
   adminOpts =
-    { name
-    , config
-    , ...
-    }: {
+    {
+      name,
+      config,
+      ...
+    }:
+    {
       options = {
         keys = mkOption {
           type = types.listOf types.str;
           default = [ ];
-          apply = x: assert (builtins.length x > 0 || abort "Please specify at least one key to be able to log in"); x;
+          apply =
+            x:
+            assert (builtins.length x > 0 || abort "Please specify at least one key to be able to log in");
+            x;
           description = ''
             The keys that should be able to access the account.
           '';
         };
         shell = mkOption {
           type = types.nullOr types.str;
-          apply = x: assert (builtins.elem x shellNames || abort "Please specify one of ${builtins.toString shellNames}"); x;
+          apply =
+            x:
+            assert (
+              builtins.elem x shellNames || abort "Please specify one of ${builtins.toString shellNames}"
+            );
+            x;
           default = "zsh";
           defaultText = literalExpression "zsh";
           example = literalExpression "bash";
@@ -81,15 +96,12 @@ in
     security.sudo.wheelNeedsPassword = false;
     services.openssh.openFirewall = true;
 
-    users.users =
-      mapAttrs
-        (user: keys: {
-          shell = shells."${keys.shell}";
-          extraGroups = extraGroups;
-          isNormalUser = true;
-          openssh.authorizedKeys.keys = keys.keys;
-        })
-        cfg.users;
+    users.users = mapAttrs (user: keys: {
+      shell = shells."${keys.shell}";
+      extraGroups = extraGroups;
+      isNormalUser = true;
+      openssh.authorizedKeys.keys = keys.keys;
+    }) cfg.users;
 
     nix.settings.trusted-users = builtins.attrNames cfg.users;
 
@@ -103,7 +115,7 @@ in
     services.tor.relay.onionServices = {
       "rat" = mkIf cfg.rat.enable {
         name = "rat";
-        map = [{ port = 22; }];
+        map = [ { port = 22; } ];
       };
     };
   };
diff --git a/nixos/modules/backup.nix b/nixos/modules/backup.nix
index 0ec680f..095fd35 100644
--- a/nixos/modules/backup.nix
+++ b/nixos/modules/backup.nix
@@ -1,9 +1,11 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   backupExcludes = [
     "/backup"
     "/dev"
diff --git a/nixos/modules/borg-server.nix b/nixos/modules/borg-server.nix
index c1aceeb..594f356 100644
--- a/nixos/modules/borg-server.nix
+++ b/nixos/modules/borg-server.nix
@@ -1,6 +1,11 @@
 { config, lib, ... }:
 let
-  inherit (lib) mkEnableOption mkIf mkOption types;
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    types
+    ;
   cfg = config.dadada.borgServer;
 in
 {
@@ -20,31 +25,41 @@ in
     services.borgbackup.repos = {
       "metis" = {
         allowSubRepos = false;
-        authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDnc1gCi8lbhlLmPKvaExtCxVaAni8RrOuHUQO6wTbzR root@metis" ];
+        authorizedKeysAppendOnly = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDnc1gCi8lbhlLmPKvaExtCxVaAni8RrOuHUQO6wTbzR root@metis"
+        ];
         path = "${cfg.path}/metis";
         quota = "1T";
       };
       "gorgon" = {
         allowSubRepos = false;
-        authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP6p9b2D7y2W+9BGee2yk2xsCRewNNaE6oS3CqlW61ti root@gorgon" ];
+        authorizedKeysAppendOnly = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP6p9b2D7y2W+9BGee2yk2xsCRewNNaE6oS3CqlW61ti root@gorgon"
+        ];
         path = "${cfg.path}/gorgon";
         quota = "1T";
       };
       "surgat" = {
         allowSubRepos = false;
-        authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINGhatanrNG+M6jAkU7Yi44mJmTreJkqyZ6Z+qiEgV7O root@surgat" ];
+        authorizedKeysAppendOnly = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINGhatanrNG+M6jAkU7Yi44mJmTreJkqyZ6Z+qiEgV7O root@surgat"
+        ];
         path = "${cfg.path}/surgat";
         quota = "50G";
       };
       "pruflas" = {
         allowSubRepos = false;
-        authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBk7f9DSnXCOIUsxFsjCKG23vHShV4TSzzPJunPOwa1I root@pruflas" ];
+        authorizedKeysAppendOnly = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBk7f9DSnXCOIUsxFsjCKG23vHShV4TSzzPJunPOwa1I root@pruflas"
+        ];
         path = "${cfg.path}/pruflas";
         quota = "50G";
       };
       "wohnzimmerpi" = {
         allowSubRepos = false;
-        authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK6uZ8mPQJWOL984gZKKPyxp7VLcxk42TpTh5iPP6N6k root@wohnzimmerpi" ];
+        authorizedKeysAppendOnly = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK6uZ8mPQJWOL984gZKKPyxp7VLcxk42TpTh5iPP6N6k root@wohnzimmerpi"
+        ];
         path = "${cfg.path}/wohnzimmerpi";
         quota = "50G";
       };
diff --git a/nixos/modules/ddns.nix b/nixos/modules/ddns.nix
index af7d725..594be6d 100644
--- a/nixos/modules/ddns.nix
+++ b/nixos/modules/ddns.nix
@@ -1,52 +1,70 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.ddns;
-  ddnsConfig = { domains, credentialsPath, interface }: {
-    systemd.timers = listToAttrs (forEach domains (domain:
-      nameValuePair "ddns-${domain}"
-        {
-          wantedBy = [ "timers.target" ];
-          partOf = [ "ddns-${domain}.service" ];
-          timerConfig.OnCalendar = "hourly";
-        }));
+  ddnsConfig =
+    {
+      domains,
+      credentialsPath,
+      interface,
+    }:
+    {
+      systemd.timers = listToAttrs (
+        forEach domains (
+          domain:
+          nameValuePair "ddns-${domain}" {
+            wantedBy = [ "timers.target" ];
+            partOf = [ "ddns-${domain}.service" ];
+            timerConfig.OnCalendar = "hourly";
+          }
+        )
+      );
 
-    systemd.services = listToAttrs (forEach domains (domain:
-      nameValuePair "ddns-${domain}"
-        {
-          serviceConfig = {
-            Type = "oneshot";
-            PrivateTmp = true;
-            PrivateDevices = true;
-            PrivateUsers = true;
-            PrivateMounts = true;
-            PrivateIPC = true;
-            ProtectHome = true;
-            ProtectSystem = "strict";
-            ProtectKernelTunables = true;
-            BindReadOnlyPaths = [ credentialsPath ];
-            NoNewPrivileges = true;
-            CapabilitBoundingSet = [ ];
-          };
-          script = ''
-            function url() {
-              echo "https://svc.joker.com/nic/update?username=$1&password=$2&hostname=$3"
-            }
+      systemd.services = listToAttrs (
+        forEach domains (
+          domain:
+          nameValuePair "ddns-${domain}" {
+            serviceConfig = {
+              Type = "oneshot";
+              PrivateTmp = true;
+              PrivateDevices = true;
+              PrivateUsers = true;
+              PrivateMounts = true;
+              PrivateIPC = true;
+              ProtectHome = true;
+              ProtectSystem = "strict";
+              ProtectKernelTunables = true;
+              BindReadOnlyPaths = [ credentialsPath ];
+              NoNewPrivileges = true;
+              CapabilitBoundingSet = [ ];
+            };
+            script = ''
+              function url() {
+                echo "https://svc.joker.com/nic/update?username=$1&password=$2&hostname=$3"
+              }
 
-            IFS=':'
-            read -r user password < ${credentialsPath}
-            unset IFS
+              IFS=':'
+              read -r user password < ${credentialsPath}
+              unset IFS
 
-            curl_url=$(url "$user" "$password" ${domain})
+              curl_url=$(url "$user" "$password" ${domain})
 
-            ${pkgs.curl}/bin/curl --ipv4 "$curl_url" ${if interface == null then "" else "--interface ${interface}"} || true
-            ${pkgs.curl}/bin/curl --ipv6 "$curl_url" ${if interface == null then "" else "--interface ${interface}"}
-          '';
-        }));
-  };
+              ${pkgs.curl}/bin/curl --ipv4 "$curl_url" ${
+                if interface == null then "" else "--interface ${interface}"
+              } || true
+              ${pkgs.curl}/bin/curl --ipv6 "$curl_url" ${
+                if interface == null then "" else "--interface ${interface}"
+              }
+            '';
+          }
+        )
+      );
+    };
 in
 {
   options = {
diff --git a/nixos/modules/default.nix b/nixos/modules/default.nix
index d0554cc..fa94c8c 100644
--- a/nixos/modules/default.nix
+++ b/nixos/modules/default.nix
@@ -1,8 +1,16 @@
 { lib, ... }:
-with lib; let
-  modules' = dir: filterAttrs (name: type: (name != "default.nix" && name != "profiles" && ((hasSuffix ".nix" name) || (type == "directory"))))
-    (builtins.readDir dir);
-  modules = dir: mapAttrs' (name: _: nameValuePair (removeSuffix ".nix" name) (import (dir + "/${name}")))
-    (modules' dir);
+with lib;
+let
+  modules' =
+    dir:
+    filterAttrs (
+      name: type:
+      (name != "default.nix" && name != "profiles" && ((hasSuffix ".nix" name) || (type == "directory")))
+    ) (builtins.readDir dir);
+  modules =
+    dir:
+    mapAttrs' (name: _: nameValuePair (removeSuffix ".nix" name) (import (dir + "/${name}"))) (
+      modules' dir
+    );
 in
 (modules ./.)
diff --git a/nixos/modules/element.nix b/nixos/modules/element.nix
index 2a45da1..2fcefec 100644
--- a/nixos/modules/element.nix
+++ b/nixos/modules/element.nix
@@ -1,7 +1,8 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
 let
   cfg = config.dadada.element;
diff --git a/nixos/modules/fileShare.nix b/nixos/modules/fileShare.nix
index 5b6a0f2..a3a72ba 100644
--- a/nixos/modules/fileShare.nix
+++ b/nixos/modules/fileShare.nix
@@ -1,8 +1,10 @@
-{ config
-, lib
-, ...
+{
+  config,
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.fileShare;
   sharePath = "/mnt/storage/share";
   ipv6 = "fd42:dead:beef::/48";
diff --git a/nixos/modules/gitea.nix b/nixos/modules/gitea.nix
index 259815a..783bf6f 100644
--- a/nixos/modules/gitea.nix
+++ b/nixos/modules/gitea.nix
@@ -1,7 +1,8 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
 let
   cfg = config.dadada.forgejo;
diff --git a/nixos/modules/headphones.nix b/nixos/modules/headphones.nix
index 585a5dd..877be07 100644
--- a/nixos/modules/headphones.nix
+++ b/nixos/modules/headphones.nix
@@ -1,9 +1,11 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.headphones;
 in
 {
diff --git a/nixos/modules/homepage.nix b/nixos/modules/homepage.nix
index b04c3b2..193e71e 100644
--- a/nixos/modules/homepage.nix
+++ b/nixos/modules/homepage.nix
@@ -1,11 +1,13 @@
-{ config
-, lib
-, ...
+{
+  config,
+  lib,
+  ...
 }:
 let
   cfg = config.dadada.homepage;
 in
-with lib; {
+with lib;
+{
   options.dadada.homepage = {
     enable = mkEnableOption "Enable home page";
     package = mkOption {
diff --git a/nixos/modules/inputs.nix b/nixos/modules/inputs.nix
index 4db219c..9d18883 100644
--- a/nixos/modules/inputs.nix
+++ b/nixos/modules/inputs.nix
@@ -1,7 +1,8 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
 let
   cfg = config.dadada.inputs;
diff --git a/nixos/modules/profiles/backup.nix b/nixos/modules/profiles/backup.nix
index a5ad0eb..d333804 100644
--- a/nixos/modules/profiles/backup.nix
+++ b/nixos/modules/profiles/backup.nix
@@ -21,6 +21,8 @@ in
     sshIdentityFile = config.age.secrets."${config.networking.hostName}-backup-ssh-key".path;
   };
 
-  age.secrets."${config.networking.hostName}-backup-passphrase".file = "${secretsPath}/${config.networking.hostName}-backup-passphrase.age";
-  age.secrets."${config.networking.hostName}-backup-ssh-key".file = "${secretsPath}/${config.networking.hostName}-backup-ssh-key.age";
+  age.secrets."${config.networking.hostName}-backup-passphrase".file =
+    "${secretsPath}/${config.networking.hostName}-backup-passphrase.age";
+  age.secrets."${config.networking.hostName}-backup-ssh-key".file =
+    "${secretsPath}/${config.networking.hostName}-backup-ssh-key.age";
 }
diff --git a/nixos/modules/profiles/base.nix b/nixos/modules/profiles/base.nix
index bc08040..b681d72 100644
--- a/nixos/modules/profiles/base.nix
+++ b/nixos/modules/profiles/base.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   mkDefault = lib.mkDefault;
   inputs = config.dadada.inputs;
@@ -27,7 +32,7 @@ in
 
   nix.package = pkgs.lix;
 
-  nix.settings.substituters = [ https://cache.nixos.org/ ];
+  nix.settings.substituters = [ "https://cache.nixos.org/" ];
 
   nix.settings.trusted-public-keys = [
     "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
@@ -56,7 +61,10 @@ in
 
   services.resolved = {
     enable = mkDefault true;
-    fallbackDns = [ "9.9.9.9#dns.quad9.net" "2620:fe::fe:11#dns11.quad9.net" ];
+    fallbackDns = [
+      "9.9.9.9#dns.quad9.net"
+      "2620:fe::fe:11#dns11.quad9.net"
+    ];
   };
 
   programs.zsh.enable = mkDefault true;
@@ -64,4 +72,3 @@ in
   # Avoid some bots
   services.openssh.ports = [ 2222 ];
 }
-
diff --git a/nixos/modules/profiles/cloud.nix b/nixos/modules/profiles/cloud.nix
index ba131e1..de57714 100644
--- a/nixos/modules/profiles/cloud.nix
+++ b/nixos/modules/profiles/cloud.nix
@@ -21,14 +21,13 @@ in
       hostKeys = [
         config.age.secrets."${initrdHostKey}".path
       ];
-      authorizedKeys = with lib;
-        concatLists (mapAttrsToList
-          (name: user:
-            if elem "wheel" user.extraGroups then
-              user.openssh.authorizedKeys.keys
-            else
-              [ ])
-          config.users.users);
+      authorizedKeys =
+        with lib;
+        concatLists (
+          mapAttrsToList (
+            name: user: if elem "wheel" user.extraGroups then user.openssh.authorizedKeys.keys else [ ]
+          ) config.users.users
+        );
     };
     postCommands = ''
       echo 'cryptsetup-askpass' >> /root/.profile
@@ -36,7 +35,9 @@ in
   };
 
   assertions = lib.singleton {
-    assertion = (config.boot.initrd.network.ssh.hostKeys != [ ]) -> config.boot.loader.supportsInitrdSecrets == true;
+    assertion =
+      (config.boot.initrd.network.ssh.hostKeys != [ ])
+      -> config.boot.loader.supportsInitrdSecrets == true;
     message = "Refusing to store private keys in store";
   };
 
diff --git a/nixos/modules/profiles/laptop.nix b/nixos/modules/profiles/laptop.nix
index bdba617..d9f0bde 100644
--- a/nixos/modules/profiles/laptop.nix
+++ b/nixos/modules/profiles/laptop.nix
@@ -1,12 +1,14 @@
-{ config
-, lib
-, ...
+{
+  config,
+  lib,
+  ...
 }:
 let
   inputs = config.dadada.inputs;
   secretsPath = config.dadada.secrets.path;
 in
-with lib; {
+with lib;
+{
   imports = [
     ./backup.nix
     ./base.nix
@@ -53,5 +55,6 @@ with lib; {
     passphrasePath = config.age.secrets."${config.networking.hostName}-backup-passphrase-gs".path;
   };
 
-  age.secrets."${config.networking.hostName}-backup-passphrase-gs".file = "${secretsPath}/${config.networking.hostName}-backup-passphrase-gs.age";
+  age.secrets."${config.networking.hostName}-backup-passphrase-gs".file =
+    "${secretsPath}/${config.networking.hostName}-backup-passphrase-gs.age";
 }
diff --git a/nixos/modules/profiles/server.nix b/nixos/modules/profiles/server.nix
index 1aeab43..724655f 100644
--- a/nixos/modules/profiles/server.nix
+++ b/nixos/modules/profiles/server.nix
@@ -1,9 +1,11 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
-with lib; {
+with lib;
+{
   imports = [
     ./backup.nix
     ./base.nix
@@ -16,7 +18,9 @@ with lib; {
   documentation.enable = mkDefault false;
   documentation.nixos.enable = mkDefault false;
 
-  services.btrfs.autoScrub.enable = mkDefault ((filterAttrs (name: fs: fs.fsType == "btrfs") config.fileSystems) != { });
+  services.btrfs.autoScrub.enable = mkDefault (
+    (filterAttrs (name: fs: fs.fsType == "btrfs") config.fileSystems) != { }
+  );
 
   services.journald.extraConfig = ''
     SystemKeepFree = 2G
diff --git a/nixos/modules/profiles/upgrade-pg-cluster.nix b/nixos/modules/profiles/upgrade-pg-cluster.nix
index 3042265..486bf29 100644
--- a/nixos/modules/profiles/upgrade-pg-cluster.nix
+++ b/nixos/modules/profiles/upgrade-pg-cluster.nix
@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 {
   environment.systemPackages = lib.mkIf config.services.postgresql.enable [
     (
diff --git a/nixos/modules/share.nix b/nixos/modules/share.nix
index a4e5f9c..7c7410b 100644
--- a/nixos/modules/share.nix
+++ b/nixos/modules/share.nix
@@ -1,9 +1,11 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.share;
 in
 {
diff --git a/nixos/modules/steam.nix b/nixos/modules/steam.nix
index 82944eb..b6b0846 100644
--- a/nixos/modules/steam.nix
+++ b/nixos/modules/steam.nix
@@ -1,9 +1,11 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.steam;
 in
 {
diff --git a/nixos/modules/vpnServer.nix b/nixos/modules/vpnServer.nix
index 6c0513f..ee2298e 100644
--- a/nixos/modules/vpnServer.nix
+++ b/nixos/modules/vpnServer.nix
@@ -1,28 +1,32 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.vpnServer;
-  wgPeer = { name, ... }: {
-    options = {
-      name = mkOption {
-        internal = true;
-        default = name;
-      };
-      id = mkOption {
-        description = "VPN client id";
-        default = 0;
-        type = types.str;
-      };
-      key = mkOption {
-        description = "VPN client public key";
-        default = "";
-        type = types.str;
+  wgPeer =
+    { name, ... }:
+    {
+      options = {
+        name = mkOption {
+          internal = true;
+          default = name;
+        };
+        id = mkOption {
+          description = "VPN client id";
+          default = 0;
+          type = types.str;
+        };
+        key = mkOption {
+          description = "VPN client public key";
+          default = "";
+          type = types.str;
+        };
       };
     };
-  };
 in
 {
   options.dadada.vpnServer = {
@@ -41,13 +45,10 @@ in
         privateKeyFile = "/var/lib/wireguard/wg0-key";
         ips = [ "fd42:9c3b:f96d:0201::0/64" ];
         listenPort = 51234;
-        peers =
-          map
-            (peer: {
-              allowedIPs = [ "fd42:9c3b:f96d:0201::${peer.id}/128" ];
-              publicKey = peer.key;
-            })
-            (attrValues cfg.peers);
+        peers = map (peer: {
+          allowedIPs = [ "fd42:9c3b:f96d:0201::${peer.id}/128" ];
+          publicKey = peer.key;
+        }) (attrValues cfg.peers);
         postSetup = ''
           wg set wg0 fwmark 51234
           ip -6 route add table 2468 fd42:9c3b:f96d::/48 dev ens3
diff --git a/nixos/modules/weechat.nix b/nixos/modules/weechat.nix
index e3d8f48..6ff0106 100644
--- a/nixos/modules/weechat.nix
+++ b/nixos/modules/weechat.nix
@@ -1,9 +1,11 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.weechat;
 in
 {
diff --git a/nixos/modules/yubikey.nix b/nixos/modules/yubikey.nix
index 77f4394..4be4492 100644
--- a/nixos/modules/yubikey.nix
+++ b/nixos/modules/yubikey.nix
@@ -1,9 +1,11 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   yubikey = config.dadada.yubikey;
 in
 {
diff --git a/nixos/ninurta/configuration.nix b/nixos/ninurta/configuration.nix
index 15c8a24..d4eed97 100644
--- a/nixos/ninurta/configuration.nix
+++ b/nixos/ninurta/configuration.nix
@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   hostAliases = [
     "ifrit.dadada.li"
@@ -37,7 +42,10 @@ in
     };
   };
 
-  services.openssh.ports = [ 22 2222 ];
+  services.openssh.ports = [
+    22
+    2222
+  ];
 
   dadada.backupClient.bs.enable = false;
   dadada.backupClient.backup1.enable = false;
@@ -59,7 +67,9 @@ in
   boot.loader.efi.canTouchEfiVariables = true;
 
   assertions = lib.singleton {
-    assertion = (config.boot.initrd.network.ssh.hostKeys != [ ]) -> config.boot.loader.supportsInitrdSecrets == true;
+    assertion =
+      (config.boot.initrd.network.ssh.hostKeys != [ ])
+      -> config.boot.loader.supportsInitrdSecrets == true;
     message = "Refusing to store private keys in store";
   };
 
@@ -183,7 +193,12 @@ in
     {
       hostName = "localhost";
       system = "x86_64-linux";
-      supportedFeatures = [ "kvm" "nixos-test" "big-parallel" "benchmark" ];
+      supportedFeatures = [
+        "kvm"
+        "nixos-test"
+        "big-parallel"
+        "benchmark"
+      ];
       maxJobs = 16;
     }
   ];
@@ -277,26 +292,48 @@ in
       };
       "30-wg0" = {
         matchConfig.Name = "wg0";
-        address = [ "10.3.3.3/32" "fd42:9c3b:f96d:121::3/128" ];
+        address = [
+          "10.3.3.3/32"
+          "fd42:9c3b:f96d:121::3/128"
+        ];
         DHCP = "no";
         networkConfig.IPv6AcceptRA = false;
         linkConfig.RequiredForOnline = false;
         routes = [
-          { routeConfig = { Destination = "10.3.3.1/24"; }; }
-          { routeConfig = { Destination = "fd42:9c3b:f96d:121::1/64"; }; }
+          {
+            routeConfig = {
+              Destination = "10.3.3.1/24";
+            };
+          }
+          {
+            routeConfig = {
+              Destination = "fd42:9c3b:f96d:121::1/64";
+            };
+          }
         ];
       };
       "30-uwu" = {
         matchConfig.Name = "uwu";
-        address = [ "10.11.0.39/24" "fc00:1337:dead:beef::10.11.0.39/128" ];
+        address = [
+          "10.11.0.39/24"
+          "fc00:1337:dead:beef::10.11.0.39/128"
+        ];
         dns = [ "10.11.0.1%uwu#uwu" ];
         domains = [ "uwu" ];
         DHCP = "no";
         networkConfig.IPv6AcceptRA = false;
         linkConfig.RequiredForOnline = false;
         routes = [
-          { routeConfig = { Destination = "10.11.0.0/22"; }; }
-          { routeConfig = { Destination = "fc00:1337:dead:beef::10.11.0.0/118"; }; }
+          {
+            routeConfig = {
+              Destination = "10.11.0.0/22";
+            };
+          }
+          {
+            routeConfig = {
+              Destination = "fc00:1337:dead:beef::10.11.0.0/118";
+            };
+          }
         ];
       };
       "20-br0" = {
@@ -337,7 +374,10 @@ in
           {
             wireguardPeerConfig = {
               PublicKey = "KzL+PKlv4LktIqqTqC9Esw8dkSZN2qSn/vq76UHbOlY=";
-              AllowedIPs = [ "10.3.3.1/32" "fd42:9c3b:f96d:121::1/128" ];
+              AllowedIPs = [
+                "10.3.3.1/32"
+                "fd42:9c3b:f96d:121::1/128"
+              ];
               PersistentKeepalive = 25;
               Endpoint = "surgat.dadada.li:51235";
             };
@@ -345,7 +385,10 @@ in
           {
             wireguardPeerConfig = {
               PublicKey = "INfv++4R+Kd2jdh/3CooM70ZeeoN6aeU6mo+T4C8gWU=";
-              AllowedIPs = [ "10.3.3.2/32" "fd42:9c3b:f96d:121::2/128" ];
+              AllowedIPs = [
+                "10.3.3.2/32"
+                "fd42:9c3b:f96d:121::2/128"
+              ];
               Endpoint = "192.168.101.1:51235";
             };
           }
@@ -359,15 +402,21 @@ in
         wireguardConfig = {
           PrivateKeyFile = config.age.secrets.${uwuPrivKey}.path;
         };
-        wireguardPeers = [{
-          wireguardPeerConfig = {
-            PublicKey = "tuoiOWqgHz/lrgTcLjX+xIhvxh9jDH6gmDw2ZMvX5T8=";
-            AllowedIPs = [ "10.11.0.0/22" "fc00:1337:dead:beef::10.11.0.0/118" "192.168.178.0/23" ];
-            PersistentKeepalive = 25;
-            PresharedKeyFile = config.age.secrets.${uwuPresharedKey}.path;
-            Endpoint = "53c70r.de:51820";
-          };
-        }];
+        wireguardPeers = [
+          {
+            wireguardPeerConfig = {
+              PublicKey = "tuoiOWqgHz/lrgTcLjX+xIhvxh9jDH6gmDw2ZMvX5T8=";
+              AllowedIPs = [
+                "10.11.0.0/22"
+                "fc00:1337:dead:beef::10.11.0.0/118"
+                "192.168.178.0/23"
+              ];
+              PersistentKeepalive = 25;
+              PresharedKeyFile = config.age.secrets.${uwuPresharedKey}.path;
+              Endpoint = "53c70r.de:51820";
+            };
+          }
+        ];
       };
     };
   };
diff --git a/nixos/ninurta/hardware-configuration.nix b/nixos/ninurta/hardware-configuration.nix
index 8de34e8..cd6b64b 100644
--- a/nixos/ninurta/hardware-configuration.nix
+++ b/nixos/ninurta/hardware-configuration.nix
@@ -1,89 +1,115 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, modulesPath, ... }:
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [
-      (modulesPath + "/installer/scan/not-detected.nix")
-    ];
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
 
-  boot.initrd.availableKernelModules = [ "igc" "xhci_pci" "thunderbolt" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "igc"
+    "xhci_pci"
+    "thunderbolt"
+    "ahci"
+    "nvme"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
-    {
-      device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
-      fsType = "btrfs";
-      options = [ "compress=zstd" ];
-    };
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
+    fsType = "btrfs";
+    options = [ "compress=zstd" ];
+  };
 
   boot.initrd.luks.devices."luks".device = "/dev/disk/by-uuid/bac4ee0e-e393-414f-ac3e-1ec20739abae";
 
-  fileSystems."/swap" =
+  fileSystems."/swap" = {
+    device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
+    fsType = "btrfs";
+    options = [
+      "subvol=swap"
+      "noatime"
+    ];
+  };
+
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
+    fsType = "btrfs";
+    options = [
+      "subvol=nix"
+      "noatime"
+      "compress=zstd"
+    ];
+  };
+
+  fileSystems."/var" = {
+    device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
+    fsType = "btrfs";
+    options = [
+      "subvol=var"
+      "compress=zstd"
+    ];
+  };
+
+  fileSystems."/home" = {
+    device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
+    fsType = "btrfs";
+    options = [
+      "subvol=home"
+      "compress=zstd"
+    ];
+  };
+
+  fileSystems."/root" = {
+    device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
+    fsType = "btrfs";
+    options = [
+      "subvol=root"
+      "compress=zstd"
+    ];
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/2E20-49CB";
+    fsType = "vfat";
+  };
+
+  swapDevices = [
     {
-      device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
-      fsType = "btrfs";
-      options = [ "subvol=swap" "noatime" ];
-    };
+      device = "/swap/swapfile";
+      size = 32 * 1024; # 32 GByte
+    }
+  ];
 
-  fileSystems."/nix" =
-    {
-      device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
-      fsType = "btrfs";
-      options = [ "subvol=nix" "noatime" "compress=zstd" ];
-    };
+  fileSystems."/mnt/storage" = {
+    device = "/dev/disk/by-uuid/ce483e75-5886-4b03-a3f9-675b80560ac9";
+    fsType = "btrfs";
+    options = [
+      "subvol=root"
+      "compress=zstd"
+    ];
+  };
 
-  fileSystems."/var" =
-    {
-      device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
-      fsType = "btrfs";
-      options = [ "subvol=var" "compress=zstd" ];
-    };
-
-  fileSystems."/home" =
-    {
-      device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
-      fsType = "btrfs";
-      options = [ "subvol=home" "compress=zstd" ];
-    };
-
-  fileSystems."/root" =
-    {
-      device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
-      fsType = "btrfs";
-      options = [ "subvol=root" "compress=zstd" ];
-    };
-
-  fileSystems."/boot" =
-    {
-      device = "/dev/disk/by-uuid/2E20-49CB";
-      fsType = "vfat";
-    };
-
-  swapDevices = [{
-    device = "/swap/swapfile";
-    size = 32 * 1024; # 32 GByte
-  }];
-
-
-  fileSystems."/mnt/storage" =
-    {
-      device = "/dev/disk/by-uuid/ce483e75-5886-4b03-a3f9-675b80560ac9";
-      fsType = "btrfs";
-      options = [ "subvol=root" "compress=zstd" ];
-    };
-
-
-  fileSystems."/mnt/storage/backups" =
-    {
-      device = "/dev/disk/by-uuid/ce483e75-5886-4b03-a3f9-675b80560ac9";
-      fsType = "btrfs";
-      options = [ "subvol=backups" "noatime" ];
-    };
+  fileSystems."/mnt/storage/backups" = {
+    device = "/dev/disk/by-uuid/ce483e75-5886-4b03-a3f9-675b80560ac9";
+    fsType = "btrfs";
+    options = [
+      "subvol=backups"
+      "noatime"
+    ];
+  };
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
diff --git a/nixos/surgat/configuration.nix b/nixos/surgat/configuration.nix
index f2c7ba2..5cd9596 100644
--- a/nixos/surgat/configuration.nix
+++ b/nixos/surgat/configuration.nix
@@ -1,6 +1,7 @@
-{ config
-, pkgs
-, ...
+{
+  config,
+  pkgs,
+  ...
 }:
 let
   hostName = "surgat";
@@ -85,14 +86,29 @@ in
       };
       "10-ninurta" = {
         matchConfig.Name = "ninurta";
-        address = [ "10.3.3.1/32" "fd42:9c3b:f96d:121::1/128" ];
+        address = [
+          "10.3.3.1/32"
+          "fd42:9c3b:f96d:121::1/128"
+        ];
         DHCP = "no";
         networkConfig.IPv6AcceptRA = false;
         linkConfig.RequiredForOnline = "no";
         routes = [
-          { routeConfig = { Destination = "10.3.3.3/24"; }; }
-          { routeConfig = { Destination = "fd42:9c3b:f96d:121::/64"; }; }
-          { routeConfig = { Destination = "fd42:9c3b:f96d:101::/64"; }; }
+          {
+            routeConfig = {
+              Destination = "10.3.3.3/24";
+            };
+          }
+          {
+            routeConfig = {
+              Destination = "fd42:9c3b:f96d:121::/64";
+            };
+          }
+          {
+            routeConfig = {
+              Destination = "fd42:9c3b:f96d:101::/64";
+            };
+          }
         ];
       };
     };
@@ -106,12 +122,18 @@ in
           PrivateKeyFile = "/var/lib/wireguard/hydra";
           ListenPort = 51235;
         };
-        wireguardPeers = [{
-          wireguardPeerConfig = {
-            PublicKey = "Kw2HVRb1zeA7NAzBvI3UzmOj45VqM358EBuZWdlAUDE=";
-            AllowedIPs = [ "10.3.3.3/32" "fd42:9c3b:f96d:121::3/128" "fd42:9c3b:f96d:101:4a21:bff:fe3e:9cfe/128" ];
-          };
-        }];
+        wireguardPeers = [
+          {
+            wireguardPeerConfig = {
+              PublicKey = "Kw2HVRb1zeA7NAzBvI3UzmOj45VqM358EBuZWdlAUDE=";
+              AllowedIPs = [
+                "10.3.3.3/32"
+                "fd42:9c3b:f96d:121::3/128"
+                "fd42:9c3b:f96d:101:4a21:bff:fe3e:9cfe/128"
+              ];
+            };
+          }
+        ];
       };
     };
   };
@@ -143,7 +165,10 @@ in
 
   services.resolved = {
     enable = true;
-    fallbackDns = [ "9.9.9.9" "2620:fe::fe" ];
+    fallbackDns = [
+      "9.9.9.9"
+      "2620:fe::fe"
+    ];
   };
 
   system.autoUpgrade.allowReboot = false;
diff --git a/nixos/surgat/hardware-configuration.nix b/nixos/surgat/hardware-configuration.nix
index 71b7257..8476779 100644
--- a/nixos/surgat/hardware-configuration.nix
+++ b/nixos/surgat/hardware-configuration.nix
@@ -1,17 +1,25 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config
-, lib
-, pkgs
-, modulesPath
-, ...
-}: {
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+{
   imports = [
     (modulesPath + "/profiles/qemu-guest.nix")
   ];
 
-  boot.initrd.availableKernelModules = [ "ata_piix" "virtio_pci" "xhci_pci" "sd_mod" "sr_mod" ];
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "virtio_pci"
+    "xhci_pci"
+    "sd_mod"
+    "sr_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
diff --git a/outputs.nix b/outputs.nix
index d588f6e..aea7953 100644
--- a/outputs.nix
+++ b/outputs.nix
@@ -26,7 +26,7 @@
       in
       import ./devshell.nix { inherit pkgs extraModules; };
 
-    formatter = pkgs.nixpkgs-fmt;
+    formatter = pkgs.nixfmt-tree;
 
     packages = import ./pkgs { inherit pkgs; } // {
       installer-iso = self.nixosConfigurations.installer.config.system.build.isoImage;
diff --git a/overlays.nix b/overlays.nix
index 2c63c08..ffcd441 100644
--- a/overlays.nix
+++ b/overlays.nix
@@ -1,2 +1 @@
-{
-}
+{ }
diff --git a/pkgs/default.nix b/pkgs/default.nix
index c78fe50..9fce6e9 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -1,2 +1 @@
-{ pkgs }:
-{ }
+{ pkgs }: { }
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 946d855..1da186e 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -9,30 +9,82 @@ let
     surgat = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOOJ9UgAle5sX0pAawfRztckVwaQm2U8o0Bawv7cZfXE root@surgat";
   };
   backupSecrets = hostName: {
-    "${hostName}-backup-passphrase.age".publicKeys = [ systems.${hostName} dadada ];
-    "${hostName}-backup-ssh-key.age".publicKeys = [ systems.${hostName} dadada ];
+    "${hostName}-backup-passphrase.age".publicKeys = [
+      systems.${hostName}
+      dadada
+    ];
+    "${hostName}-backup-ssh-key.age".publicKeys = [
+      systems.${hostName}
+      dadada
+    ];
   };
 in
 {
-  "pruflas-wg0-key.age".publicKeys = [ systems.ninurta dadada ];
-  "pruflas-wg0-preshared-key.age".publicKeys = [ systems.ninurta dadada ];
-  "pruflas-wg-hydra-key.age".publicKeys = [ systems.ninurta dadada ];
-  "hydra-github-authorization.age".publicKeys = [ systems.ninurta dadada ];
-  "miniflux-admin-credentials.age".publicKeys = [ systems.surgat dadada ];
-  "gorgon-backup-passphrase-gs.age".publicKeys = [ systems.gorgon dadada ];
-  "paperless.age".publicKeys = [ systems.gorgon dadada ];
-  "initrd-surgat-ssh_host_ed25519_key.age".publicKeys = [ systems.surgat dadada ];
-  "surgat-ssh_host_ed25519_key.age".publicKeys = [ systems.surgat dadada ];
-  "ninurta-initrd-ssh-key.age".publicKeys = [ systems.ninurta dadada ];
-  "ddns-credentials.age".publicKeys = [ systems.agares systems.ninurta dadada ];
-  "etc-ppp-chap-secrets.age".publicKeys = [ systems.agares dadada ];
-  "etc-ppp-telekom-secret.age".publicKeys = [ systems.agares dadada ];
-  "wg-privkey-vpn-dadada-li.age".publicKeys = [ systems.agares dadada ];
-  "agares-wg0-key.age".publicKeys = [ systems.agares dadada ];
-} //
-backupSecrets "ninurta" //
-backupSecrets "gorgon" //
-backupSecrets "ifrit" //
-backupSecrets "pruflas" //
-backupSecrets "surgat" //
-backupSecrets "agares"
+  "pruflas-wg0-key.age".publicKeys = [
+    systems.ninurta
+    dadada
+  ];
+  "pruflas-wg0-preshared-key.age".publicKeys = [
+    systems.ninurta
+    dadada
+  ];
+  "pruflas-wg-hydra-key.age".publicKeys = [
+    systems.ninurta
+    dadada
+  ];
+  "hydra-github-authorization.age".publicKeys = [
+    systems.ninurta
+    dadada
+  ];
+  "miniflux-admin-credentials.age".publicKeys = [
+    systems.surgat
+    dadada
+  ];
+  "gorgon-backup-passphrase-gs.age".publicKeys = [
+    systems.gorgon
+    dadada
+  ];
+  "paperless.age".publicKeys = [
+    systems.gorgon
+    dadada
+  ];
+  "initrd-surgat-ssh_host_ed25519_key.age".publicKeys = [
+    systems.surgat
+    dadada
+  ];
+  "surgat-ssh_host_ed25519_key.age".publicKeys = [
+    systems.surgat
+    dadada
+  ];
+  "ninurta-initrd-ssh-key.age".publicKeys = [
+    systems.ninurta
+    dadada
+  ];
+  "ddns-credentials.age".publicKeys = [
+    systems.agares
+    systems.ninurta
+    dadada
+  ];
+  "etc-ppp-chap-secrets.age".publicKeys = [
+    systems.agares
+    dadada
+  ];
+  "etc-ppp-telekom-secret.age".publicKeys = [
+    systems.agares
+    dadada
+  ];
+  "wg-privkey-vpn-dadada-li.age".publicKeys = [
+    systems.agares
+    dadada
+  ];
+  "agares-wg0-key.age".publicKeys = [
+    systems.agares
+    dadada
+  ];
+}
+// backupSecrets "ninurta"
+// backupSecrets "gorgon"
+// backupSecrets "ifrit"
+// backupSecrets "pruflas"
+// backupSecrets "surgat"
+// backupSecrets "agares"