chore: reformat

checks.nix

@@ -1,20 +1,20 @@
-{ self
+{
-, flake-utils
+  self,
-, nixpkgs
+  flake-utils,
-, ...
+  nixpkgs,
+  ...
 }:
-(flake-utils.lib.eachDefaultSystem (system:
+(flake-utils.lib.eachDefaultSystem (
+  system:
   let
     pkgs = nixpkgs.legacyPackages.${system};
     formatter = self.formatter.${system};
   in
   {
     checks = {
-      format = pkgs.runCommand
+      format = pkgs.runCommand "check-format" {
-        "check-format"
-        {
         buildInputs = [ formatter ];
-        }
+      } "${formatter}/bin/nixpkgs-fmt --check ${./.} && touch $out";
-        "${formatter}/bin/nixpkgs-fmt --check ${./.} && touch $out";
     };
-  })).checks
+  }
+)).checks

flake.nix

@@ -40,5 +40,5 @@
     };
   };
 
-  outputs = { ... } @ args: import ./outputs.nix args;
+  outputs = { ... }@args: import ./outputs.nix args;
 }

home/dconf.nix

@@ -33,8 +33,20 @@ with lib.hm.gvariant;
       current = mkUint32 0;
       per-window = false;
       show-all-sources = true;
-      sources = [ (mkTuple [ "xkb" "eu" ]) (mkTuple [ "xkb" "de" ]) ];
+      sources = [
-      xkb-options = [ "lv3:ralt_switch" "caps:escape" ];
+        (mkTuple [
+          "xkb"
+          "eu"
+        ])
+        (mkTuple [
+          "xkb"
+          "de"
+        ])
+      ];
+      xkb-options = [
+        "lv3:ralt_switch"
+        "caps:escape"
+      ];
     };
 
     "org/gnome/desktop/interface" = {
@@ -127,7 +139,10 @@ with lib.hm.gvariant;
       composer-attribution-language = "de_DE";
       composer-reply-start-bottom = false;
       composer-signature-in-new-only = true;
-      composer-spell-languages = [ "de" "en_US" ];
+      composer-spell-languages = [
+        "de"
+        "en_US"
+      ];
       composer-top-signature = false;
       composer-unicode-smileys = false;
       composer-visually-wrap-long-lines = true;

home/modules.nix

@@ -1,8 +1,13 @@
 { lib, ... }:
-with lib; let
+with lib;
-  modules' = dir: filterAttrs (name: type: (hasSuffix ".nix" name) || (type == "directory"))
+let
-    (builtins.readDir dir);
+  modules' =
-  modules = dir: mapAttrs' (name: _: nameValuePair (removeSuffix ".nix" name) (import (dir + "/${name}")))
+    dir:
-    (modules' dir);
+    filterAttrs (name: type: (hasSuffix ".nix" name) || (type == "directory")) (builtins.readDir dir);
+  modules =
+    dir:
+    mapAttrs' (name: _: nameValuePair (removeSuffix ".nix" name) (import (dir + "/${name}"))) (
+      modules' dir
+    );
 in
 (modules ./modules)

home/modules/alacritty/default.nix

@@ -1,9 +1,11 @@
-{ pkgs
+{
-, lib
+  pkgs,
-, config
+  lib,
-, ...
+  config,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.home.alacritty;
 in
 {

home/modules/colors.nix

@@ -1,8 +1,10 @@
-{ config
+{
-, lib
+  config,
-, ...
+  lib,
+  ...
 }:
-with lib; {
+with lib;
+{
   options.dadada.home.colors = mkOption {
     type = types.attrs;
     description = "Color scheme";

home/modules/direnv.nix

@@ -1,9 +1,11 @@
-{ config
+{
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.home.direnv;
 in
 {

home/modules/git.nix

@@ -1,9 +1,11 @@
-{ config
+{
-, lib
+  config,
-, pkgs
+  lib,
-, ...
+  pkgs,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.home.git;
   allowedSigners = pkgs.writeTextFile {
     name = "allowed-signers";

home/modules/gpg.nix

@@ -1,8 +1,10 @@
-{ config
+{
-, lib
+  config,
-, ...
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.home.gpg;
 in
 {

home/modules/gtk.nix

@@ -1,9 +1,11 @@
-{ config
+{
-, lib
+  config,
-, pkgs
+  lib,
-, ...
+  pkgs,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.home.gtk;
 in
 {

home/modules/helix/default.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   cfg = config.dadada.home.helix;
 in

home/modules/keyring.nix

@@ -1,8 +1,10 @@
-{ config
+{
-, lib
+  config,
-, ...
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.home.keyring;
 in
 {

home/modules/session.nix

@@ -1,8 +1,10 @@
-{ config
+{
-, lib
+  config,
-, ...
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.home.session;
 in
 {

home/modules/ssh.nix

@@ -1,8 +1,10 @@
-{ config
+{
-, lib
+  config,
-, ...
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.home.ssh;
 in
 {

home/modules/syncthing.nix

@@ -1,9 +1,11 @@
-{ config
+{
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.home.syncthing;
 in
 {

home/modules/tmux.nix

@@ -1,8 +1,10 @@
-{ config
+{
-, lib
+  config,
-, ...
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.home.tmux;
 in
 {

home/modules/xdg.nix

@@ -1,9 +1,11 @@
-{ config
+{
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   apps = {
     "x-scheme-handler/mailto" = "evolution.desktop";
     "message/rfc822" = "evolution.desktop";

home/modules/zsh.nix

@@ -1,9 +1,11 @@
-{ config
+{
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.home.zsh;
 in
 {
@@ -45,8 +47,7 @@ in
         PROMPT="%F{red}%?%f %F{green}%m%f:%F{blue}%~%f"$'\n'"╰─> "
         RPROMPT='$(git_super_status)'
       '';
-      profileExtra = ''
+      profileExtra = '''';
-      '';
       shellAliases = {
         ga = "git add";
         gc = "git commit";

home/nixpkgs-config.nix

@@ -1,4 +1,5 @@
-{ pkgs }: {
+{ pkgs }:
+{
   allowUnfree = true;
   allowUnfreePredicate = pkg: true;
   allowBroken = false;

home/pkgs.nix

@@ -1,5 +1,6 @@
 { pkgs }:
-with pkgs; [
+with pkgs;
+[
   anki
   aqbanking
   aria2
@@ -105,7 +106,10 @@ with pkgs; [
   prusa-slicer
   pv
   pwgen
-  (python3.withPackages (pkgs: [pkgs.pandas pkgs.requests]))
+  (python3.withPackages (pkgs: [
+    pkgs.pandas
+    pkgs.requests
+  ]))
   ranger
   reptyr
   ripgrep

hydra-jobs.nix

@@ -1,5 +1,4 @@
 { self, nixpkgs, ... }:
-(nixpkgs.lib.mapAttrs'
+(nixpkgs.lib.mapAttrs' (
-  (name: config: nixpkgs.lib.nameValuePair name config.config.system.build.toplevel)
+  name: config: nixpkgs.lib.nameValuePair name config.config.system.build.toplevel
-  self.nixosConfigurations
+) self.nixosConfigurations)
-)

nixos/agares/configuration.nix

@@ -1,7 +1,8 @@
-{ config
+{
-, modulesPath
+  config,
-, pkgs
+  modulesPath,
-, ...
+  pkgs,
+  ...
 }:
 {
   imports = [
@@ -30,7 +31,10 @@
   fileSystems."/swap" = {
     device = "/dev/sda1";
     fsType = "btrfs";
-    options = [ "subvol=/root/swap" "noatime" ];
+    options = [
+      "subvol=/root/swap"
+      "noatime"
+    ];
   };
 
   #swapDevices = [{
@@ -49,7 +53,14 @@
   networking.hostName = "agares";
   networking.domain = "bs.dadada.li";
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ehci_pci" "usb_storage" "sd_mod" "sdhci_pci" ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "ehci_pci"
+    "usb_storage"
+    "sd_mod"
+    "sdhci_pci"
+  ];
   boot.initrd.kernelModules = [ "dm-snapshot" ];
 
   # Use the GRUB 2 boot loader.

nixos/agares/dns.nix

@@ -66,7 +66,10 @@
       ];
       stub-zone =
         let
-          stubZone = name: addrs: { name = "${name}"; stub-addr = addrs; };
+          stubZone = name: addrs: {
+            name = "${name}";
+            stub-addr = addrs;
+          };
         in
         [
           #(stubZone "li.dadada.bs" ["192.168.128.220" "2a01:4f8:c010:a710::1"])

nixos/agares/network.nix

@@ -10,7 +10,10 @@ in
     enable = true;
     links = {
       "10-persistent" = {
-        matchConfig.OriginalName = [ "enp1s0" "enp2s0" ]; # takes search domains from the [Network]
+        matchConfig.OriginalName = [
+          "enp1s0"
+          "enp2s0"
+        ]; # takes search domains from the [Network]
         linkConfig.MACAddressPolicy = "persistent";
       };
     };
@@ -49,7 +52,8 @@ in
           PrivateKeyFile = config.age.secrets."wg-privkey-vpn-dadada-li".path;
           ListenPort = 51234;
         };
-        wireguardPeers = [{
+        wireguardPeers = [
+          {
             wireguardPeerConfig =
               let
                 peerAddresses = i: [
@@ -61,7 +65,8 @@ in
                 PublicKey = "0eWP1hzkyoXlrjPSOq+6Y1u8tnFH+SejBJs8f8lf+iU=";
                 AllowedIPs = peerAddresses "3";
               };
-        }];
+          }
+        ];
       };
       "20-wg0" = {
         netdevConfig = {
@@ -137,7 +142,10 @@ in
         "10-mgmt" = lib.mkMerge [
           (subnet "enp1s0" "100")
           {
-            networkConfig.VLAN = [ "lan.10" "ff.11" ];
+            networkConfig.VLAN = [
+              "lan.10"
+              "ff.11"
+            ];
             dhcpServerStaticLeases = [
               {
                 # legion
@@ -158,13 +166,24 @@ in
         ];
         "30-wg0" = {
           matchConfig.Name = "wg0";
-          address = [ "10.3.3.2/32" "fd42:9c3b:f96d:121::2/128" ];
+          address = [
+            "10.3.3.2/32"
+            "fd42:9c3b:f96d:121::2/128"
+          ];
           DHCP = "no";
           networkConfig.IPv6AcceptRA = false;
           linkConfig.RequiredForOnline = false;
           routes = [
-            { routeConfig = { Destination = "10.3.3.1/24"; }; }
+            {
-            { routeConfig = { Destination = "fd42:9c3b:f96d:121::1/64"; }; }
+              routeConfig = {
+                Destination = "10.3.3.1/24";
+              };
+            }
+            {
+              routeConfig = {
+                Destination = "fd42:9c3b:f96d:121::1/64";
+              };
+            }
           ];
         };
         "30-lan" = subnet "lan.10" "101" // {
@@ -266,10 +285,14 @@ in
           linkConfig.RequiredForOnline = false;
           routes = [
             {
-              routeConfig = { Destination = "${ipv4Prefix}.120.1/24"; };
+              routeConfig = {
+                Destination = "${ipv4Prefix}.120.1/24";
+              };
             }
             {
-              routeConfig = { Destination = "${ulaPrefix}::120:1/64"; };
+              routeConfig = {
+                Destination = "${ulaPrefix}::120:1/64";
+              };
             }
           ];
         };

nixos/agares/ppp.nix

@@ -1,4 +1,9 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 let
   secretsPath = config.dadada.secrets.path;
 in

nixos/gorgon/configuration.nix

@@ -1,7 +1,8 @@
-{ config
+{
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
+  ...
 }:
 let
   xilinxJtag = pkgs.writeTextFile {
@@ -104,8 +105,13 @@ in
     passwordFile = config.age.secrets.paperless.path;
   };
 
-  systemd.tmpfiles.rules = let cfg = config.services.paperless; in [
+  systemd.tmpfiles.rules =
-    (if cfg.consumptionDirIsPublic then
+    let
+      cfg = config.services.paperless;
+    in
+    [
+      (
+        if cfg.consumptionDirIsPublic then
           "d '${cfg.consumptionDir}' 777 - - - -"
         else
           "d '${cfg.consumptionDir}' 770 ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
@@ -130,12 +136,14 @@ in
     ];
   };
 
-  hardware.printers.ensurePrinters = [{
+  hardware.printers.ensurePrinters = [
+    {
       name = "Brother_HL-L2300D";
       model = "everywhere";
       location = "BS";
       deviceUri = "ipp://192.168.101.29:631/printers/Brother_HL-L2300D";
-  }];
+    }
+  ];
 
   environment.systemPackages = with pkgs; [
     android-studio
@@ -175,7 +183,7 @@ in
     saleaeLogic
     keychron
     pkgs.libsigrok
-  ]; #noMtpUdevRules ];
+  ]; # noMtpUdevRules ];
 
   virtualisation.libvirtd.enable = true;
 
@@ -187,7 +195,20 @@ in
   users.users = {
     dadada = {
       isNormalUser = true;
-      extraGroups = [ "wheel" "networkmanager" "libvirtd" "adbusers" "kvm" "video" "scanner" "lp" "docker" "dialout" "wireshark" "paperless" ];
+      extraGroups = [
+        "wheel"
+        "networkmanager"
+        "libvirtd"
+        "adbusers"
+        "kvm"
+        "video"
+        "scanner"
+        "lp"
+        "docker"
+        "dialout"
+        "wireshark"
+        "paperless"
+      ];
       shell = "/run/current-system/sw/bin/zsh";
     };
   };

nixos/gorgon/hardware-configuration.nix

@@ -1,17 +1,26 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config
+{
-, lib
+  config,
-, pkgs
+  lib,
-, modulesPath
+  pkgs,
-, ...
+  modulesPath,
-}: {
+  ...
+}:
+{
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = [ "nvme" "ehci_pci" "xhci_pci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "ehci_pci"
+    "xhci_pci"
+    "usb_storage"
+    "sd_mod"
+    "rtsx_pci_sdmmc"
+  ];
   boot.initrd.kernelModules = [ "dm-snapshot" ];
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];

nixos/modules/admin.nix

@@ -1,11 +1,16 @@
-{ config
+{
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.admin;
-  extraGroups = [ "wheel" "libvirtd" ];
+  extraGroups = [
+    "wheel"
+    "libvirtd"
+  ];
 
   shells = {
     "bash" = pkgs.bashInteractive;
@@ -16,22 +21,32 @@ with lib; let
   shellNames = builtins.attrNames shells;
 
   adminOpts =
-    { name
+    {
-    , config
+      name,
-    , ...
+      config,
-    }: {
+      ...
+    }:
+    {
       options = {
         keys = mkOption {
           type = types.listOf types.str;
           default = [ ];
-          apply = x: assert (builtins.length x > 0 || abort "Please specify at least one key to be able to log in"); x;
+          apply =
+            x:
+            assert (builtins.length x > 0 || abort "Please specify at least one key to be able to log in");
+            x;
           description = ''
             The keys that should be able to access the account.
           '';
         };
         shell = mkOption {
           type = types.nullOr types.str;
-          apply = x: assert (builtins.elem x shellNames || abort "Please specify one of ${builtins.toString shellNames}"); x;
+          apply =
+            x:
+            assert (
+              builtins.elem x shellNames || abort "Please specify one of ${builtins.toString shellNames}"
+            );
+            x;
           default = "zsh";
           defaultText = literalExpression "zsh";
           example = literalExpression "bash";
@@ -81,15 +96,12 @@ in
     security.sudo.wheelNeedsPassword = false;
     services.openssh.openFirewall = true;
 
-    users.users =
+    users.users = mapAttrs (user: keys: {
-      mapAttrs
-        (user: keys: {
       shell = shells."${keys.shell}";
       extraGroups = extraGroups;
       isNormalUser = true;
       openssh.authorizedKeys.keys = keys.keys;
-        })
+    }) cfg.users;
-        cfg.users;
 
     nix.settings.trusted-users = builtins.attrNames cfg.users;
 
@@ -103,7 +115,7 @@ in
     services.tor.relay.onionServices = {
       "rat" = mkIf cfg.rat.enable {
         name = "rat";
-        map = [{ port = 22; }];
+        map = [ { port = 22; } ];
       };
     };
   };

nixos/modules/backup.nix

@@ -1,9 +1,11 @@
-{ config
+{
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   backupExcludes = [
     "/backup"
     "/dev"

nixos/modules/borg-server.nix

@@ -1,6 +1,11 @@
 { config, lib, ... }:
 let
-  inherit (lib) mkEnableOption mkIf mkOption types;
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    types
+    ;
   cfg = config.dadada.borgServer;
 in
 {
@@ -20,31 +25,41 @@ in
     services.borgbackup.repos = {
       "metis" = {
         allowSubRepos = false;
-        authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDnc1gCi8lbhlLmPKvaExtCxVaAni8RrOuHUQO6wTbzR root@metis" ];
+        authorizedKeysAppendOnly = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDnc1gCi8lbhlLmPKvaExtCxVaAni8RrOuHUQO6wTbzR root@metis"
+        ];
         path = "${cfg.path}/metis";
         quota = "1T";
       };
       "gorgon" = {
         allowSubRepos = false;
-        authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP6p9b2D7y2W+9BGee2yk2xsCRewNNaE6oS3CqlW61ti root@gorgon" ];
+        authorizedKeysAppendOnly = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP6p9b2D7y2W+9BGee2yk2xsCRewNNaE6oS3CqlW61ti root@gorgon"
+        ];
         path = "${cfg.path}/gorgon";
         quota = "1T";
       };
       "surgat" = {
         allowSubRepos = false;
-        authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINGhatanrNG+M6jAkU7Yi44mJmTreJkqyZ6Z+qiEgV7O root@surgat" ];
+        authorizedKeysAppendOnly = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINGhatanrNG+M6jAkU7Yi44mJmTreJkqyZ6Z+qiEgV7O root@surgat"
+        ];
         path = "${cfg.path}/surgat";
         quota = "50G";
       };
       "pruflas" = {
         allowSubRepos = false;
-        authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBk7f9DSnXCOIUsxFsjCKG23vHShV4TSzzPJunPOwa1I root@pruflas" ];
+        authorizedKeysAppendOnly = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBk7f9DSnXCOIUsxFsjCKG23vHShV4TSzzPJunPOwa1I root@pruflas"
+        ];
         path = "${cfg.path}/pruflas";
         quota = "50G";
       };
       "wohnzimmerpi" = {
         allowSubRepos = false;
-        authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK6uZ8mPQJWOL984gZKKPyxp7VLcxk42TpTh5iPP6N6k root@wohnzimmerpi" ];
+        authorizedKeysAppendOnly = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK6uZ8mPQJWOL984gZKKPyxp7VLcxk42TpTh5iPP6N6k root@wohnzimmerpi"
+        ];
         path = "${cfg.path}/wohnzimmerpi";
         quota = "50G";
       };

nixos/modules/ddns.nix

@@ -1,22 +1,34 @@
-{ config
+{
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.ddns;
-  ddnsConfig = { domains, credentialsPath, interface }: {
+  ddnsConfig =
-    systemd.timers = listToAttrs (forEach domains (domain:
-      nameValuePair "ddns-${domain}"
     {
+      domains,
+      credentialsPath,
+      interface,
+    }:
+    {
+      systemd.timers = listToAttrs (
+        forEach domains (
+          domain:
+          nameValuePair "ddns-${domain}" {
             wantedBy = [ "timers.target" ];
             partOf = [ "ddns-${domain}.service" ];
             timerConfig.OnCalendar = "hourly";
-        }));
+          }
+        )
+      );
 
-    systemd.services = listToAttrs (forEach domains (domain:
+      systemd.services = listToAttrs (
-      nameValuePair "ddns-${domain}"
+        forEach domains (
-        {
+          domain:
+          nameValuePair "ddns-${domain}" {
             serviceConfig = {
               Type = "oneshot";
               PrivateTmp = true;
@@ -42,10 +54,16 @@ with lib; let
 
               curl_url=$(url "$user" "$password" ${domain})
 
-            ${pkgs.curl}/bin/curl --ipv4 "$curl_url" ${if interface == null then "" else "--interface ${interface}"} || true
+              ${pkgs.curl}/bin/curl --ipv4 "$curl_url" ${
-            ${pkgs.curl}/bin/curl --ipv6 "$curl_url" ${if interface == null then "" else "--interface ${interface}"}
+                if interface == null then "" else "--interface ${interface}"
+              } || true
+              ${pkgs.curl}/bin/curl --ipv6 "$curl_url" ${
+                if interface == null then "" else "--interface ${interface}"
+              }
             '';
-        }));
+          }
+        )
+      );
     };
 in
 {

nixos/modules/default.nix

@@ -1,8 +1,16 @@
 { lib, ... }:
-with lib; let
+with lib;
-  modules' = dir: filterAttrs (name: type: (name != "default.nix" && name != "profiles" && ((hasSuffix ".nix" name) || (type == "directory"))))
+let
-    (builtins.readDir dir);
+  modules' =
-  modules = dir: mapAttrs' (name: _: nameValuePair (removeSuffix ".nix" name) (import (dir + "/${name}")))
+    dir:
-    (modules' dir);
+    filterAttrs (
+      name: type:
+      (name != "default.nix" && name != "profiles" && ((hasSuffix ".nix" name) || (type == "directory")))
+    ) (builtins.readDir dir);
+  modules =
+    dir:
+    mapAttrs' (name: _: nameValuePair (removeSuffix ".nix" name) (import (dir + "/${name}"))) (
+      modules' dir
+    );
 in
 (modules ./.)

nixos/modules/element.nix

@@ -1,7 +1,8 @@
-{ config
+{
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
+  ...
 }:
 let
   cfg = config.dadada.element;

nixos/modules/fileShare.nix

@@ -1,8 +1,10 @@
-{ config
+{
-, lib
+  config,
-, ...
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.fileShare;
   sharePath = "/mnt/storage/share";
   ipv6 = "fd42:dead:beef::/48";

nixos/modules/gitea.nix

@@ -1,7 +1,8 @@
-{ config
+{
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
+  ...
 }:
 let
   cfg = config.dadada.forgejo;

nixos/modules/headphones.nix

@@ -1,9 +1,11 @@
-{ config
+{
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.headphones;
 in
 {

nixos/modules/homepage.nix

@@ -1,11 +1,13 @@
-{ config
+{
-, lib
+  config,
-, ...
+  lib,
+  ...
 }:
 let
   cfg = config.dadada.homepage;
 in
-with lib; {
+with lib;
+{
   options.dadada.homepage = {
     enable = mkEnableOption "Enable home page";
     package = mkOption {

nixos/modules/inputs.nix

@@ -1,7 +1,8 @@
-{ config
+{
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
+  ...
 }:
 let
   cfg = config.dadada.inputs;

nixos/modules/profiles/backup.nix

@@ -21,6 +21,8 @@ in
     sshIdentityFile = config.age.secrets."${config.networking.hostName}-backup-ssh-key".path;
   };
 
-  age.secrets."${config.networking.hostName}-backup-passphrase".file = "${secretsPath}/${config.networking.hostName}-backup-passphrase.age";
+  age.secrets."${config.networking.hostName}-backup-passphrase".file =
-  age.secrets."${config.networking.hostName}-backup-ssh-key".file = "${secretsPath}/${config.networking.hostName}-backup-ssh-key.age";
+    "${secretsPath}/${config.networking.hostName}-backup-passphrase.age";
+  age.secrets."${config.networking.hostName}-backup-ssh-key".file =
+    "${secretsPath}/${config.networking.hostName}-backup-ssh-key.age";
 }

nixos/modules/profiles/base.nix

@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   mkDefault = lib.mkDefault;
   inputs = config.dadada.inputs;
@@ -27,7 +32,7 @@ in
 
   nix.package = pkgs.lix;
 
-  nix.settings.substituters = [ https://cache.nixos.org/ ];
+  nix.settings.substituters = [ "https://cache.nixos.org/" ];
 
   nix.settings.trusted-public-keys = [
     "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
@@ -56,7 +61,10 @@ in
 
   services.resolved = {
     enable = mkDefault true;
-    fallbackDns = [ "9.9.9.9#dns.quad9.net" "2620:fe::fe:11#dns11.quad9.net" ];
+    fallbackDns = [
+      "9.9.9.9#dns.quad9.net"
+      "2620:fe::fe:11#dns11.quad9.net"
+    ];
   };
 
   programs.zsh.enable = mkDefault true;
@@ -64,4 +72,3 @@ in
   # Avoid some bots
   services.openssh.ports = [ 2222 ];
 }
-

nixos/modules/profiles/cloud.nix

@@ -21,14 +21,13 @@ in
       hostKeys = [
         config.age.secrets."${initrdHostKey}".path
       ];
-      authorizedKeys = with lib;
+      authorizedKeys =
-        concatLists (mapAttrsToList
+        with lib;
-          (name: user:
+        concatLists (
-            if elem "wheel" user.extraGroups then
+          mapAttrsToList (
-              user.openssh.authorizedKeys.keys
+            name: user: if elem "wheel" user.extraGroups then user.openssh.authorizedKeys.keys else [ ]
-            else
+          ) config.users.users
-              [ ])
+        );
-          config.users.users);
     };
     postCommands = ''
       echo 'cryptsetup-askpass' >> /root/.profile
@@ -36,7 +35,9 @@ in
   };
 
   assertions = lib.singleton {
-    assertion = (config.boot.initrd.network.ssh.hostKeys != [ ]) -> config.boot.loader.supportsInitrdSecrets == true;
+    assertion =
+      (config.boot.initrd.network.ssh.hostKeys != [ ])
+      -> config.boot.loader.supportsInitrdSecrets == true;
     message = "Refusing to store private keys in store";
   };
 

nixos/modules/profiles/laptop.nix

@@ -1,12 +1,14 @@
-{ config
+{
-, lib
+  config,
-, ...
+  lib,
+  ...
 }:
 let
   inputs = config.dadada.inputs;
   secretsPath = config.dadada.secrets.path;
 in
-with lib; {
+with lib;
+{
   imports = [
     ./backup.nix
     ./base.nix
@@ -53,5 +55,6 @@ with lib; {
     passphrasePath = config.age.secrets."${config.networking.hostName}-backup-passphrase-gs".path;
   };
 
-  age.secrets."${config.networking.hostName}-backup-passphrase-gs".file = "${secretsPath}/${config.networking.hostName}-backup-passphrase-gs.age";
+  age.secrets."${config.networking.hostName}-backup-passphrase-gs".file =
+    "${secretsPath}/${config.networking.hostName}-backup-passphrase-gs.age";
 }

nixos/modules/profiles/server.nix

@@ -1,9 +1,11 @@
-{ config
+{
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
+  ...
 }:
-with lib; {
+with lib;
+{
   imports = [
     ./backup.nix
     ./base.nix
@@ -16,7 +18,9 @@ with lib; {
   documentation.enable = mkDefault false;
   documentation.nixos.enable = mkDefault false;
 
-  services.btrfs.autoScrub.enable = mkDefault ((filterAttrs (name: fs: fs.fsType == "btrfs") config.fileSystems) != { });
+  services.btrfs.autoScrub.enable = mkDefault (
+    (filterAttrs (name: fs: fs.fsType == "btrfs") config.fileSystems) != { }
+  );
 
   services.journald.extraConfig = ''
     SystemKeepFree = 2G

nixos/modules/profiles/upgrade-pg-cluster.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 {
   environment.systemPackages = lib.mkIf config.services.postgresql.enable [
     (

nixos/modules/share.nix

@@ -1,9 +1,11 @@
-{ config
+{
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.share;
 in
 {

nixos/modules/steam.nix

@@ -1,9 +1,11 @@
-{ config
+{
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.steam;
 in
 {

nixos/modules/vpnServer.nix

@@ -1,11 +1,15 @@
-{ config
+{
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.vpnServer;
-  wgPeer = { name, ... }: {
+  wgPeer =
+    { name, ... }:
+    {
       options = {
         name = mkOption {
           internal = true;
@@ -41,13 +45,10 @@ in
         privateKeyFile = "/var/lib/wireguard/wg0-key";
         ips = [ "fd42:9c3b:f96d:0201::0/64" ];
         listenPort = 51234;
-        peers =
+        peers = map (peer: {
-          map
-            (peer: {
           allowedIPs = [ "fd42:9c3b:f96d:0201::${peer.id}/128" ];
           publicKey = peer.key;
-            })
+        }) (attrValues cfg.peers);
-            (attrValues cfg.peers);
         postSetup = ''
           wg set wg0 fwmark 51234
           ip -6 route add table 2468 fd42:9c3b:f96d::/48 dev ens3

nixos/modules/weechat.nix

@@ -1,9 +1,11 @@
-{ config
+{
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.dadada.weechat;
 in
 {

nixos/modules/yubikey.nix

@@ -1,9 +1,11 @@
-{ config
+{
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
+  ...
 }:
-with lib; let
+with lib;
+let
   yubikey = config.dadada.yubikey;
 in
 {

nixos/ninurta/configuration.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   hostAliases = [
     "ifrit.dadada.li"
@@ -37,7 +42,10 @@ in
     };
   };
 
-  services.openssh.ports = [ 22 2222 ];
+  services.openssh.ports = [
+    22
+    2222
+  ];
 
   dadada.backupClient.bs.enable = false;
   dadada.backupClient.backup1.enable = false;
@@ -59,7 +67,9 @@ in
   boot.loader.efi.canTouchEfiVariables = true;
 
   assertions = lib.singleton {
-    assertion = (config.boot.initrd.network.ssh.hostKeys != [ ]) -> config.boot.loader.supportsInitrdSecrets == true;
+    assertion =
+      (config.boot.initrd.network.ssh.hostKeys != [ ])
+      -> config.boot.loader.supportsInitrdSecrets == true;
     message = "Refusing to store private keys in store";
   };
 
@@ -183,7 +193,12 @@ in
     {
       hostName = "localhost";
       system = "x86_64-linux";
-      supportedFeatures = [ "kvm" "nixos-test" "big-parallel" "benchmark" ];
+      supportedFeatures = [
+        "kvm"
+        "nixos-test"
+        "big-parallel"
+        "benchmark"
+      ];
       maxJobs = 16;
     }
   ];
@@ -277,26 +292,48 @@ in
       };
       "30-wg0" = {
         matchConfig.Name = "wg0";
-        address = [ "10.3.3.3/32" "fd42:9c3b:f96d:121::3/128" ];
+        address = [
+          "10.3.3.3/32"
+          "fd42:9c3b:f96d:121::3/128"
+        ];
         DHCP = "no";
         networkConfig.IPv6AcceptRA = false;
         linkConfig.RequiredForOnline = false;
         routes = [
-          { routeConfig = { Destination = "10.3.3.1/24"; }; }
+          {
-          { routeConfig = { Destination = "fd42:9c3b:f96d:121::1/64"; }; }
+            routeConfig = {
+              Destination = "10.3.3.1/24";
+            };
+          }
+          {
+            routeConfig = {
+              Destination = "fd42:9c3b:f96d:121::1/64";
+            };
+          }
         ];
       };
       "30-uwu" = {
         matchConfig.Name = "uwu";
-        address = [ "10.11.0.39/24" "fc00:1337:dead:beef::10.11.0.39/128" ];
+        address = [
+          "10.11.0.39/24"
+          "fc00:1337:dead:beef::10.11.0.39/128"
+        ];
         dns = [ "10.11.0.1%uwu#uwu" ];
         domains = [ "uwu" ];
         DHCP = "no";
         networkConfig.IPv6AcceptRA = false;
         linkConfig.RequiredForOnline = false;
         routes = [
-          { routeConfig = { Destination = "10.11.0.0/22"; }; }
+          {
-          { routeConfig = { Destination = "fc00:1337:dead:beef::10.11.0.0/118"; }; }
+            routeConfig = {
+              Destination = "10.11.0.0/22";
+            };
+          }
+          {
+            routeConfig = {
+              Destination = "fc00:1337:dead:beef::10.11.0.0/118";
+            };
+          }
         ];
       };
       "20-br0" = {
@@ -337,7 +374,10 @@ in
           {
             wireguardPeerConfig = {
               PublicKey = "KzL+PKlv4LktIqqTqC9Esw8dkSZN2qSn/vq76UHbOlY=";
-              AllowedIPs = [ "10.3.3.1/32" "fd42:9c3b:f96d:121::1/128" ];
+              AllowedIPs = [
+                "10.3.3.1/32"
+                "fd42:9c3b:f96d:121::1/128"
+              ];
               PersistentKeepalive = 25;
               Endpoint = "surgat.dadada.li:51235";
             };
@@ -345,7 +385,10 @@ in
           {
             wireguardPeerConfig = {
               PublicKey = "INfv++4R+Kd2jdh/3CooM70ZeeoN6aeU6mo+T4C8gWU=";
-              AllowedIPs = [ "10.3.3.2/32" "fd42:9c3b:f96d:121::2/128" ];
+              AllowedIPs = [
+                "10.3.3.2/32"
+                "fd42:9c3b:f96d:121::2/128"
+              ];
               Endpoint = "192.168.101.1:51235";
             };
           }
@@ -359,15 +402,21 @@ in
         wireguardConfig = {
           PrivateKeyFile = config.age.secrets.${uwuPrivKey}.path;
         };
-        wireguardPeers = [{
+        wireguardPeers = [
+          {
             wireguardPeerConfig = {
               PublicKey = "tuoiOWqgHz/lrgTcLjX+xIhvxh9jDH6gmDw2ZMvX5T8=";
-            AllowedIPs = [ "10.11.0.0/22" "fc00:1337:dead:beef::10.11.0.0/118" "192.168.178.0/23" ];
+              AllowedIPs = [
+                "10.11.0.0/22"
+                "fc00:1337:dead:beef::10.11.0.0/118"
+                "192.168.178.0/23"
+              ];
               PersistentKeepalive = 25;
               PresharedKeyFile = config.age.secrets.${uwuPresharedKey}.path;
               Endpoint = "53c70r.de:51820";
             };
-        }];
+          }
+        ];
       };
     };
   };

nixos/ninurta/hardware-configuration.nix

@@ -1,21 +1,33 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, modulesPath, ... }:
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [
-    [
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = [ "igc" "xhci_pci" "thunderbolt" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "igc"
+    "xhci_pci"
+    "thunderbolt"
+    "ahci"
+    "nvme"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    {
     device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
     fsType = "btrfs";
     options = [ "compress=zstd" ];
@@ -23,66 +35,80 @@
 
   boot.initrd.luks.devices."luks".device = "/dev/disk/by-uuid/bac4ee0e-e393-414f-ac3e-1ec20739abae";
 
-  fileSystems."/swap" =
+  fileSystems."/swap" = {
-    {
     device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
     fsType = "btrfs";
-      options = [ "subvol=swap" "noatime" ];
+    options = [
+      "subvol=swap"
+      "noatime"
+    ];
   };
 
-  fileSystems."/nix" =
+  fileSystems."/nix" = {
-    {
     device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
     fsType = "btrfs";
-      options = [ "subvol=nix" "noatime" "compress=zstd" ];
+    options = [
+      "subvol=nix"
+      "noatime"
+      "compress=zstd"
+    ];
   };
 
-  fileSystems."/var" =
+  fileSystems."/var" = {
-    {
     device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
     fsType = "btrfs";
-      options = [ "subvol=var" "compress=zstd" ];
+    options = [
+      "subvol=var"
+      "compress=zstd"
+    ];
   };
 
-  fileSystems."/home" =
+  fileSystems."/home" = {
-    {
     device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
     fsType = "btrfs";
-      options = [ "subvol=home" "compress=zstd" ];
+    options = [
+      "subvol=home"
+      "compress=zstd"
+    ];
   };
 
-  fileSystems."/root" =
+  fileSystems."/root" = {
-    {
     device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
     fsType = "btrfs";
-      options = [ "subvol=root" "compress=zstd" ];
+    options = [
+      "subvol=root"
+      "compress=zstd"
+    ];
   };
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    {
     device = "/dev/disk/by-uuid/2E20-49CB";
     fsType = "vfat";
   };
 
-  swapDevices = [{
+  swapDevices = [
+    {
       device = "/swap/swapfile";
       size = 32 * 1024; # 32 GByte
-  }];
+    }
+  ];
 
-
+  fileSystems."/mnt/storage" = {
-  fileSystems."/mnt/storage" =
-    {
     device = "/dev/disk/by-uuid/ce483e75-5886-4b03-a3f9-675b80560ac9";
     fsType = "btrfs";
-      options = [ "subvol=root" "compress=zstd" ];
+    options = [
+      "subvol=root"
+      "compress=zstd"
+    ];
   };
 
-
+  fileSystems."/mnt/storage/backups" = {
-  fileSystems."/mnt/storage/backups" =
-    {
     device = "/dev/disk/by-uuid/ce483e75-5886-4b03-a3f9-675b80560ac9";
     fsType = "btrfs";
-      options = [ "subvol=backups" "noatime" ];
+    options = [
+      "subvol=backups"
+      "noatime"
+    ];
   };
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

nixos/surgat/configuration.nix

@@ -1,6 +1,7 @@
-{ config
+{
-, pkgs
+  config,
-, ...
+  pkgs,
+  ...
 }:
 let
   hostName = "surgat";
@@ -85,14 +86,29 @@ in
       };
       "10-ninurta" = {
         matchConfig.Name = "ninurta";
-        address = [ "10.3.3.1/32" "fd42:9c3b:f96d:121::1/128" ];
+        address = [
+          "10.3.3.1/32"
+          "fd42:9c3b:f96d:121::1/128"
+        ];
         DHCP = "no";
         networkConfig.IPv6AcceptRA = false;
         linkConfig.RequiredForOnline = "no";
         routes = [
-          { routeConfig = { Destination = "10.3.3.3/24"; }; }
+          {
-          { routeConfig = { Destination = "fd42:9c3b:f96d:121::/64"; }; }
+            routeConfig = {
-          { routeConfig = { Destination = "fd42:9c3b:f96d:101::/64"; }; }
+              Destination = "10.3.3.3/24";
+            };
+          }
+          {
+            routeConfig = {
+              Destination = "fd42:9c3b:f96d:121::/64";
+            };
+          }
+          {
+            routeConfig = {
+              Destination = "fd42:9c3b:f96d:101::/64";
+            };
+          }
         ];
       };
     };
@@ -106,12 +122,18 @@ in
           PrivateKeyFile = "/var/lib/wireguard/hydra";
           ListenPort = 51235;
         };
-        wireguardPeers = [{
+        wireguardPeers = [
+          {
             wireguardPeerConfig = {
               PublicKey = "Kw2HVRb1zeA7NAzBvI3UzmOj45VqM358EBuZWdlAUDE=";
-            AllowedIPs = [ "10.3.3.3/32" "fd42:9c3b:f96d:121::3/128" "fd42:9c3b:f96d:101:4a21:bff:fe3e:9cfe/128" ];
+              AllowedIPs = [
+                "10.3.3.3/32"
+                "fd42:9c3b:f96d:121::3/128"
+                "fd42:9c3b:f96d:101:4a21:bff:fe3e:9cfe/128"
+              ];
             };
-        }];
+          }
+        ];
       };
     };
   };
@@ -143,7 +165,10 @@ in
 
   services.resolved = {
     enable = true;
-    fallbackDns = [ "9.9.9.9" "2620:fe::fe" ];
+    fallbackDns = [
+      "9.9.9.9"
+      "2620:fe::fe"
+    ];
   };
 
   system.autoUpgrade.allowReboot = false;

nixos/surgat/hardware-configuration.nix

@@ -1,17 +1,25 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config
+{
-, lib
+  config,
-, pkgs
+  lib,
-, modulesPath
+  pkgs,
-, ...
+  modulesPath,
-}: {
+  ...
+}:
+{
   imports = [
     (modulesPath + "/profiles/qemu-guest.nix")
   ];
 
-  boot.initrd.availableKernelModules = [ "ata_piix" "virtio_pci" "xhci_pci" "sd_mod" "sr_mod" ];
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "virtio_pci"
+    "xhci_pci"
+    "sd_mod"
+    "sr_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];

outputs.nix

@@ -26,7 +26,7 @@
       in
       import ./devshell.nix { inherit pkgs extraModules; };
 
-    formatter = pkgs.nixpkgs-fmt;
+    formatter = pkgs.nixfmt-tree;
 
     packages = import ./pkgs { inherit pkgs; } // {
       installer-iso = self.nixosConfigurations.installer.config.system.build.isoImage;

overlays.nix

@@ -1,2 +1 @@
-{
+{ }
-}

pkgs/default.nix

@@ -1,2 +1 @@
-{ pkgs }:
+{ pkgs }: { }
-{ }

secrets/secrets.nix

@@ -9,30 +9,82 @@ let
     surgat = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOOJ9UgAle5sX0pAawfRztckVwaQm2U8o0Bawv7cZfXE root@surgat";
   };
   backupSecrets = hostName: {
-    "${hostName}-backup-passphrase.age".publicKeys = [ systems.${hostName} dadada ];
+    "${hostName}-backup-passphrase.age".publicKeys = [
-    "${hostName}-backup-ssh-key.age".publicKeys = [ systems.${hostName} dadada ];
+      systems.${hostName}
+      dadada
+    ];
+    "${hostName}-backup-ssh-key.age".publicKeys = [
+      systems.${hostName}
+      dadada
+    ];
   };
 in
 {
-  "pruflas-wg0-key.age".publicKeys = [ systems.ninurta dadada ];
+  "pruflas-wg0-key.age".publicKeys = [
-  "pruflas-wg0-preshared-key.age".publicKeys = [ systems.ninurta dadada ];
+    systems.ninurta
-  "pruflas-wg-hydra-key.age".publicKeys = [ systems.ninurta dadada ];
+    dadada
-  "hydra-github-authorization.age".publicKeys = [ systems.ninurta dadada ];
+  ];
-  "miniflux-admin-credentials.age".publicKeys = [ systems.surgat dadada ];
+  "pruflas-wg0-preshared-key.age".publicKeys = [
-  "gorgon-backup-passphrase-gs.age".publicKeys = [ systems.gorgon dadada ];
+    systems.ninurta
-  "paperless.age".publicKeys = [ systems.gorgon dadada ];
+    dadada
-  "initrd-surgat-ssh_host_ed25519_key.age".publicKeys = [ systems.surgat dadada ];
+  ];
-  "surgat-ssh_host_ed25519_key.age".publicKeys = [ systems.surgat dadada ];
+  "pruflas-wg-hydra-key.age".publicKeys = [
-  "ninurta-initrd-ssh-key.age".publicKeys = [ systems.ninurta dadada ];
+    systems.ninurta
-  "ddns-credentials.age".publicKeys = [ systems.agares systems.ninurta dadada ];
+    dadada
-  "etc-ppp-chap-secrets.age".publicKeys = [ systems.agares dadada ];
+  ];
-  "etc-ppp-telekom-secret.age".publicKeys = [ systems.agares dadada ];
+  "hydra-github-authorization.age".publicKeys = [
-  "wg-privkey-vpn-dadada-li.age".publicKeys = [ systems.agares dadada ];
+    systems.ninurta
-  "agares-wg0-key.age".publicKeys = [ systems.agares dadada ];
+    dadada
-} //
+  ];
-backupSecrets "ninurta" //
+  "miniflux-admin-credentials.age".publicKeys = [
-backupSecrets "gorgon" //
+    systems.surgat
-backupSecrets "ifrit" //
+    dadada
-backupSecrets "pruflas" //
+  ];
-backupSecrets "surgat" //
+  "gorgon-backup-passphrase-gs.age".publicKeys = [
-backupSecrets "agares"
+    systems.gorgon
+    dadada
+  ];
+  "paperless.age".publicKeys = [
+    systems.gorgon
+    dadada
+  ];
+  "initrd-surgat-ssh_host_ed25519_key.age".publicKeys = [
+    systems.surgat
+    dadada
+  ];
+  "surgat-ssh_host_ed25519_key.age".publicKeys = [
+    systems.surgat
+    dadada
+  ];
+  "ninurta-initrd-ssh-key.age".publicKeys = [
+    systems.ninurta
+    dadada
+  ];
+  "ddns-credentials.age".publicKeys = [
+    systems.agares
+    systems.ninurta
+    dadada
+  ];
+  "etc-ppp-chap-secrets.age".publicKeys = [
+    systems.agares
+    dadada
+  ];
+  "etc-ppp-telekom-secret.age".publicKeys = [
+    systems.agares
+    dadada
+  ];
+  "wg-privkey-vpn-dadada-li.age".publicKeys = [
+    systems.agares
+    dadada
+  ];
+  "agares-wg0-key.age".publicKeys = [
+    systems.agares
+    dadada
+  ];
+}
+// backupSecrets "ninurta"
+// backupSecrets "gorgon"
+// backupSecrets "ifrit"
+// backupSecrets "pruflas"
+// backupSecrets "surgat"
+// backupSecrets "agares"