fmt

common/hardware/laptop.nix

@@ -56,9 +56,7 @@ in
       };
 
       boot = {
-        kernelParams = [
+        kernelParams = [ "quiet" ];
-          "quiet"
-        ];
         loader.efi.canTouchEfiVariables = true;
         initrd.availableKernelModules = [
           "xhci_pci"

common/hardware/tlp.nix

@@ -83,9 +83,7 @@ in
 
       services.power-profiles-daemon.enable = false;
       services.upower.enable = true;
-      boot.extraModulePackages = [
+      boot.extraModulePackages = [ cpupower ] ++ optional enable_perf_policy x86_energy_perf_policy;
-        cpupower
-      ] ++ optional enable_perf_policy x86_energy_perf_policy;
 
       services.tlp = {
         enable = true;

common/tooling/python.nix

@@ -17,7 +17,11 @@ in
 
       programs.xonsh = {
         enable = true;
-        config = lib.concatLines (lib.mapAttrsToList (name: value: ''aliases["${name}"] = "${value}"'') config.environment.shellAliases);
+        config = lib.concatLines (
+          lib.mapAttrsToList (
+            name: value: ''aliases["${name}"] = "${value}"''
+          ) config.environment.shellAliases
+        );
         package = pkgs.xonsh.override {
           extraPackages =
             ps: with ps; [

fake_flake.nix

@@ -9,12 +9,17 @@ let
   nivSources = import ./nix/sources.nix;
   asGithubRef = src: "github:${src.owner}/${src.repo}/${src.rev}";
 
-  build_target = let env_host = builtins.getEnv "NIXOS_TARGET_HOST"; in if env_host != "" then env_host else builtins.replaceStrings ["\n"] [""] (lib.toLower (builtins.readFile /proc/sys/kernel/hostname));
+  build_target =
+    let
+      env_host = builtins.getEnv "NIXOS_TARGET_HOST";
+    in
+    if env_host != "" then
+      env_host
+    else
+      builtins.replaceStrings [ "\n" ] [ "" ] (lib.toLower (builtins.readFile /proc/sys/kernel/hostname));
 
   host_modules = {
-    grimmauld-nixos = [
+    grimmauld-nixos = [ ./specific/grimm-nixos-laptop/configuration.nix ];
-      ./specific/grimm-nixos-laptop/configuration.nix
-    ];
 
     grimmauld-nixos-server = [
       ./specific/grimmauld-nixos-server/configuration.nix

modules/discord-matrix-bridge.nix

@@ -1,22 +1,40 @@
-{ config, lib, pkgs, ...}: let
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
   bridge_port = 9005; # netstat -nlp | grep 9005
-in {
+in
-  nixpkgs.overlays = [ (final: prev: { matrix-appservice-discord = prev.matrix-appservice-discord.overrideAttrs (old: {
+{
+  nixpkgs.overlays = [
+    (final: prev: {
+      matrix-appservice-discord = prev.matrix-appservice-discord.overrideAttrs (old: {
         src = pkgs.fetchFromGitHub {
           owner = "t2bot";
           repo = "matrix-appservice-discord";
           rev = "8361ca6121bf1f0902154baa538cb6d5766e477f";
           hash = "sha256-oXon6pFJgqQ1uBLtsSVNH7XSOpxxJYqpW2n9cFrs3sU=";
         };
-      patches = (let oldPatches = old.patches or []; in if oldPatches == null then [] else oldPatches) ++ [ ./patch_bridge_perms.patch ];
+        patches =
+          (
+            let
+              oldPatches = old.patches or [ ];
+            in
+            if oldPatches == null then [ ] else oldPatches
+          )
+          ++ [ ./patch_bridge_perms.patch ];
         doCheck = false;
-    });})
+      });
+    })
   ];
 
-
   age.secrets.matrix_discord_bridge_token.file = ../secrets/matrix_discord_bridge_token.age;
 
-  services.matrix-synapse-next.settings.app_service_config_files = [ "/var/lib/matrix-synapse/discord-registration.yaml" ];
+  services.matrix-synapse-next.settings.app_service_config_files = [
+    "/var/lib/matrix-synapse/discord-registration.yaml"
+  ];
 
   services.matrix-appservice-discord = {
     enable = true;
@@ -31,13 +49,12 @@ in {
         disablePresence = true;
         disableTypingNotifications = true;
       };
-#      logging.console = "silly";
+      #      logging.console = "silly";
     };
-    serviceDependencies = ["matrix-synapse.target"];
+    serviceDependencies = [ "matrix-synapse.target" ];
     port = bridge_port;
     localpart = "_discord_";
     package = pkgs.matrix-appservice-discord;
     environmentFile = config.age.secrets.matrix_discord_bridge_token.path;
   };
 }
-

modules/email.nix

@@ -2,10 +2,11 @@
 let
   inherit (config.networking) domain;
   mail_host = "mail.${domain}";
-in {
+in
+{
   security.acme.certs."${domain}".extraDomainNames = [ mail_host ];
 
-#  services.dovecot2.sieve.extensions = [ "fileinto" ]; # sives break without this for some reason
+  #  services.dovecot2.sieve.extensions = [ "fileinto" ]; # sives break without this for some reason
   mailserver = {
     enable = true;
     fqdn = mail_host;
@@ -16,7 +17,7 @@ in {
     loginAccounts = {
       "contact@${domain}" = {
         hashedPasswordFile = ./mailpass/contact;
-        aliases = ["kontakt@${domain}"];
+        aliases = [ "kontakt@${domain}" ];
       };
       "admin@${domain}" = {
         hashedPasswordFile = ./mailpass/admin;
@@ -35,7 +36,8 @@ in {
 
   services.nginx = {
     enable = true;
-    virtualHosts."${mail_host}" = { # you should NOT be here from a browser :P
+    virtualHosts."${mail_host}" = {
+      # you should NOT be here from a browser :P
       serverName = mail_host;
       forceSSL = true;
       useACMEHost = domain;

modules/fail2ban.nix

@@ -1,10 +1,13 @@
-{ ... }: {
+{ ... }:
+{
   services.fail2ban = {
     enable = true;
     maxretry = 5;
     ignoreIP = [
       # Whitelist some subnets
-      "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16"
+      "10.0.0.0/8"
+      "172.16.0.0/12"
+      "192.168.0.0/16"
       "matrix.org"
       "app.element.io" # don't ratelimit matrix users
     ];

modules/gitea.nix

@@ -1,10 +1,17 @@
-{ lib, config, inputs, pkgs, ... }:
+{
+  lib,
+  config,
+  inputs,
+  pkgs,
+  ...
+}:
 let
   inherit (config.networking) domain;
   gitea_host = "git.${domain}";
   gitea_port = 8081;
   gitea_ssh_port = 2222;
-in {
+in
+{
   services.gitea = {
     enable = true;
     settings = {
@@ -17,22 +24,19 @@ in {
         START_SSH_SERVER = true;
         BUILTIN_SSH_SERVER_USER = "git";
         SSH_PORT = gitea_ssh_port;
-#        SSH_LISTEN_HOST="::"; # fixme?
+        #        SSH_LISTEN_HOST="::"; # fixme?
-#         SSH_AUTHORIZED_PRINCIPALS_ALLOW="username";
+        #         SSH_AUTHORIZED_PRINCIPALS_ALLOW="username";
       };
-#      log.LEVEL = "Debug";
+      #      log.LEVEL = "Debug";
       "ssh.minimum_key_sizes".RSA = 2048;
       "git.timeout".MIGRATE = 6000;
     };
     lfs.enable = true;
   };
 
-  environment.systemPackages = with pkgs; [
+  environment.systemPackages = with pkgs; [ gitea ];
-    gitea
-  ];
 
-
+  security.acme.certs."${domain}".extraDomainNames = [ gitea_host ];
-  security.acme.certs."${domain}".extraDomainNames = [ gitea_host];
   networking.firewall.allowedTCPPorts = [ gitea_ssh_port ];
 
   services.nginx = {
@@ -47,4 +51,3 @@ in {
     };
   };
 }
-

modules/grafana.nix

@@ -3,7 +3,8 @@ let
   inherit (config.networking) domain;
   grafana_host = "grafana.${domain}";
   grafana_port = 8082;
-in {
+in
+{
   age.secrets.grafana_admin_pass = {
     file = ../secrets/grafana_admin_pass.age;
     owner = "grafana";

modules/letsencrypt.nix

@@ -1,8 +1,15 @@
-{ lib, config, inputs, pkgs, ... }:
+{
+  lib,
+  config,
+  inputs,
+  pkgs,
+  ...
+}:
 let
   inherit (config.networking) domain;
   root_email = "contact@${domain}";
-in {
+in
+{
   security.acme = {
     acceptTerms = true;
     defaults.email = root_email;

modules/mastodon.nix

@@ -1,8 +1,9 @@
-{ config, ... } :
+{ config, ... }:
 let
   inherit (config.networking) domain;
   mastodon_host = "mastodon.${domain}";
-in {
+in
+{
   security.acme.certs."${domain}".extraDomainNames = [ mastodon_host ];
   services.mastodon = {
     enable = true;

modules/matrix.nix

@@ -1,9 +1,16 @@
-{ lib, config, inputs, pkgs, ... }:
+{
+  lib,
+  config,
+  inputs,
+  pkgs,
+  ...
+}:
 let
   inherit (config.networking) domain;
   matrix_host = "matrix.${domain}";
-in {
+in
-services.postgresql = {
+{
+  services.postgresql = {
     enable = true;
     # CREATE DATABASE synapse ENCODING 'UTF8' LC_COLLATE='C' LC_CTYPE='C' template=template0 OWNER synapse;
     ensureDatabases = [ "synapse" ];
@@ -16,15 +23,15 @@ services.postgresql = {
     ];
     authentication = pkgs.lib.mkOverride 10 ''
             #type database  DBuser  auth-method
-local   all             postgres                                peer
+      local   all             postgres                                peer
-local   all             all                                     peer
+      local   all             all                                     peer
-host    all             all             127.0.0.1/32            md5
+      host    all             all             127.0.0.1/32            md5
-host    synapse         matrix-synapse         ::1/128                 md5
+      host    synapse         matrix-synapse         ::1/128                 md5
-host    nextcloud       nextcloud       ::1/128                 md5
+      host    nextcloud       nextcloud       ::1/128                 md5
-host    all             all             ::1/128                 md5
+      host    all             all             ::1/128                 md5
-local   replication     all                                     peer
+      local   replication     all                                     peer
-host    replication     all             127.0.0.1/32            md5
+      host    replication     all             127.0.0.1/32            md5
-host    replication     all             ::1/128                 md5
+      host    replication     all             ::1/128                 md5
     '';
     identMap = ''
       # ArbitraryMapName systemUser DBUser
@@ -37,9 +44,11 @@ host    replication     all             ::1/128                 md5
     '';
   };
 
-  systemd.services.postgresql.postStart = let
+  systemd.services.postgresql.postStart =
+    let
       password_file_path = config.age.secrets.synapse_db_pass.path;
-  in ''
+    in
+    ''
       $PSQL -tA <<'EOF'
         DO $$
         DECLARE password TEXT;
@@ -71,10 +80,10 @@ host    replication     all             ::1/128                 md5
       enable_registration = true;
       registration_requires_token = true;
       registration_shared_secret_path = config.age.secrets.synapse_registration_shared_secret.path;
-#      enable_registration_without_verification = true;
+      #      enable_registration_without_verification = true;
-#      mainLogConfig = ./matrix_synapse_log_config.yaml;
+      #      mainLogConfig = ./matrix_synapse_log_config.yaml;
 
-#      registrations_require_3pid = [ "email" ];
+      #      registrations_require_3pid = [ "email" ];
 
       database = {
         name = "psycopg2";
@@ -125,16 +134,16 @@ host    replication     all             ::1/128                 md5
       locations."/.well-known/matrix/server" = {
         return = "200 '{\"m.server\":\"${matrix_host}:443\"}'";
         extraConfig = ''
-default_type application/json;
+          default_type application/json;
-add_header Access-Control-Allow-Origin *;
+          add_header Access-Control-Allow-Origin *;
-add_header Accept-Ranges bytes;'';
+          add_header Accept-Ranges bytes;'';
       };
       locations."/.well-known/matrix/client" = {
         return = "200 '{\"m.homeserver\": {\"base_url\": \"https://${matrix_host}\"}}'";
         extraConfig = ''
-add_header Access-Control-Allow-Origin *;
+          add_header Access-Control-Allow-Origin *;
-default_type application/json;
+          default_type application/json;
-'';
+        '';
       };
       locations."/_matrix" = {
         proxyPass = "http://$synapse_backend";
@@ -171,5 +180,5 @@ default_type application/json;
       };
     };
   };
-#  networking.firewall.allowedTCPPorts = [ 8448 8008 ];
+  #  networking.firewall.allowedTCPPorts = [ 8448 8008 ];
 }

modules/mjolnir.nix

@@ -1,7 +1,7 @@
-{ config, ... } : 
+{ config, ... }:
 let
-
+in
-in {
+{
   age.secrets = {
     matrix_mjolnir_pass = {
       file = ../secrets/matrix_mjolnir_pass.age;
@@ -22,9 +22,7 @@ in {
   services.mjolnir = {
     enable = true;
     homeserverUrl = config.services.matrix-synapse-next.settings.public_baseurl;
-    protectedRooms = [
+    protectedRooms = [ "https://matrix.to/#/!zDkrFrfuMIKbqYFbFv:grimmauld.de" ];
-      "https://matrix.to/#/!zDkrFrfuMIKbqYFbFv:grimmauld.de"
-    ];
     managementRoom = "!kgfXXqEYHGgToIwhMP:grimmauld.de";
     pantalaimon = {
       enable = true;
@@ -37,23 +35,25 @@ in {
   };
 
   services.logrotate.checkConfig = false; # needed or this explodes
-  containers.mjolnirtle = let 
+  containers.mjolnirtle =
+    let
       baseurl = config.services.matrix-synapse-next.settings.public_baseurl;
       pass_file = config.age.secrets.matrix_mjolnir_tle_pass.path;
-  in {
+    in
+    {
       privateNetwork = false; # don't want nat
       autoStart = true;
       bindMounts."${pass_file}".isReadOnly = true;
-    config = { config, ... }: {
+      config =
+        { config, ... }:
+        {
           system.stateVersion = "unstable";
           # tle mjolnir  
           services.logrotate.checkConfig = false;
           services.mjolnir = {
             enable = true;
             homeserverUrl = baseurl;
-    protectedRooms = [
+            protectedRooms = [ "https://matrix.to/#/!BgDBnHgMgilMMnPMyp:grimmauld.de" ];
-      "https://matrix.to/#/!BgDBnHgMgilMMnPMyp:grimmauld.de"
-    ];
             managementRoom = "!NQedmlMeoQErGgAwxm:grimmauld.de";
             pantalaimon = {
               enable = true;

modules/nextcloud.nix

@@ -1,9 +1,15 @@
-{ lib, pkgs, config, ...} :
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
 let
   inherit (config.networking) domain;
   nextcloud_host = "cloud.${domain}";
   nextcloud_port = 8083;
-in {
+in
+{
   services.postgresql = {
     enable = true;
     ensureDatabases = [ "nextcloud" ];
@@ -46,13 +52,13 @@ in {
     package = pkgs.nextcloud28;
     caching.redis = true;
 
-#    extraApps = with config.services.nextcloud.package.packages.apps; [
+    #    extraApps = with config.services.nextcloud.package.packages.apps; [
-#      news contacts calendar tasks;
+    #      news contacts calendar tasks;
-#    ];
+    #    ];
     config = {
       adminpassFile = config.age.secrets.nextcloud_admin_pass.path;
       dbuser = "nextcloud";
-      dbhost= "localhost:${builtins.toString config.services.postgresql.settings.port}";
+      dbhost = "localhost:${builtins.toString config.services.postgresql.settings.port}";
       dbtype = "pgsql";
     };
     settings = {
@@ -64,7 +70,6 @@ in {
         port = 6379;
         timeout = 0.0;
       };
-
     };
     phpOptions = {
       "opcache.interned_strings_buffer" = "12";

modules/prometheus.nix

@@ -1,10 +1,11 @@
-{ config, ... } :
+{ config, ... }:
 let
   inherit (config.networking) domain;
   prometheus_host = "prometheus.${domain}";
   prometheus_port = 9090; # netstat -nlp | grep 9090
-in {
+in
-  security.acme.certs."${domain}".extraDomainNames = [ prometheus_host];
+{
+  security.acme.certs."${domain}".extraDomainNames = [ prometheus_host ];
 
   services.prometheus = {
     enable = true;
@@ -13,13 +14,15 @@ in {
     scrapeConfigs = [
       {
         job_name = "chrysalis";
-        static_configs = [{
+        static_configs = [
+          {
             targets = [
               "127.0.0.1:${toString config.services.prometheus.exporters.node.port}"
               "127.0.0.1:${toString config.services.prometheus.exporters.nginx.port}"
               "127.0.0.1:${toString config.services.prometheus.exporters.postgres.port}"
             ];
-        }];
+          }
+        ];
       }
     ];
     exporters = {
@@ -44,7 +47,7 @@ in {
       forceSSL = true;
       useACMEHost = domain;
       locations."/" = {
-#        proxyPass = "http://127.0.0.1:${builtins.toString config.services.prometheus.port}";
+        #        proxyPass = "http://127.0.0.1:${builtins.toString config.services.prometheus.port}";
         return = "307 https://${domain}"; # nuh uh, no raw prometheus access for you!
       };
     };

modules/ptero.nix

@@ -1,4 +1,5 @@
-{config, pkgs, ...}: let
+{ config, pkgs, ... }:
+let
   inherit (config.networking) domain;
   root_email = "contact@${domain}";
   ptero_host = "ptero.${domain}";
@@ -7,13 +8,14 @@
   local_bridge = "ptero-local-br";
   ptero_ver = "1.11.5";
   ptero_port = "8042";
-in {
+in
+{
   users.users.${panel_user} = {
     isSystemUser = true;
-    extraGroups = ["docker"];
+    extraGroups = [ "docker" ];
     group = panel_user;
   };
-  users.groups.${panel_user} = {};
+  users.groups.${panel_user} = { };
 
   age.secrets.ptero_env = {
     file = ../secrets/ptero_env.age;
@@ -24,15 +26,15 @@ in {
     wantedBy = [ "multi-user.target" ];
 
     serviceConfig.Type = "oneshot";
-    script =''
+    script = ''
-mkdir -p ${DATA_DIR}/database
+      mkdir -p ${DATA_DIR}/database
-mkdir -p ${DATA_DIR}/cache
+      mkdir -p ${DATA_DIR}/cache
-mkdir -p ${DATA_DIR}/panel/var
+      mkdir -p ${DATA_DIR}/panel/var
-mkdir -p ${DATA_DIR}/panel/logs
+      mkdir -p ${DATA_DIR}/panel/logs
-mkdir -p ${DATA_DIR}/panel/nginx
+      mkdir -p ${DATA_DIR}/panel/nginx
-chown ${panel_user}:${panel_user} -R ${DATA_DIR}
+      chown ${panel_user}:${panel_user} -R ${DATA_DIR}
-chmod +777 -R ${DATA_DIR}
+      chmod +777 -R ${DATA_DIR}
-'';
+    '';
   };
 
   virtualisation.oci-containers.backend = "podman";
@@ -43,8 +45,11 @@ chmod +777 -R ${DATA_DIR}
     wantedBy = [ "multi-user.target" ];
 
     serviceConfig.Type = "oneshot";
-    script = let podmancli = "${config.virtualisation.podman.package}/bin/podman";
+    script =
-           in ''
+      let
+        podmancli = "${config.virtualisation.podman.package}/bin/podman";
+      in
+      ''
         check=$(${podmancli} pod ls | grep "ptero" || true)
         if [ -z "$check" ]; then
           ${podmancli} pod create -p "${ptero_port}:80" ptero
@@ -54,7 +59,6 @@ chmod +777 -R ${DATA_DIR}
       '';
   };
 
-
   virtualisation.oci-containers.containers."ptero-mysql" = {
     image = "library/mysql:8.0";
     workdir = "${DATA_DIR}/database";
@@ -64,14 +68,17 @@ chmod +777 -R ${DATA_DIR}
       "MYSQL_DATABASE" = "panel";
     };
     environmentFiles = [ config.age.secrets.ptero_env.path ];
-    volumes = ["${DATA_DIR}/database:/var/lib/mysql" "${DATA_DIR}/database:${DATA_DIR}/database"];
+    volumes = [
-    cmd=["--default-authentication-plugin=mysql_native_password"];
+      "${DATA_DIR}/database:/var/lib/mysql"
+      "${DATA_DIR}/database:${DATA_DIR}/database"
+    ];
+    cmd = [ "--default-authentication-plugin=mysql_native_password" ];
   };
 
   virtualisation.oci-containers.containers."ptero-cache" = {
     image = "redis:alpine";
     workdir = "${DATA_DIR}/cache";
-    volumes = ["${DATA_DIR}/cache:${DATA_DIR}/cache"];
+    volumes = [ "${DATA_DIR}/cache:${DATA_DIR}/cache" ];
     extraOptions = [ "--pod=ptero" ];
   };
 
@@ -96,8 +103,8 @@ chmod +777 -R ${DATA_DIR}
       "MAIL_PASSWORD" = "";
       "MAIL_ENCRYPTION" = "true";
 
-      "APP_ENV"= "production";
+      "APP_ENV" = "production";
-      "APP_ENVIRONMENT_ONLY"= "false";
+      "APP_ENVIRONMENT_ONLY" = "false";
       "CACHE_DRIVER" = "redis";
       "SESSION_DRIVER" = "redis";
       "QUEUE_DRIVER" = "redis";
@@ -106,7 +113,7 @@ chmod +777 -R ${DATA_DIR}
       "TRUSTED_PROXIES" = "*";
     };
     labels = {
-      "traefik.http.routers.pterodactyl_panel.entrypoints"="web";
+      "traefik.http.routers.pterodactyl_panel.entrypoints" = "web";
     };
     environmentFiles = [ config.age.secrets.ptero_env.path ];
   };

modules/puffer.nix

@@ -1,4 +1,10 @@
-{ lib, config, inputs, pkgs, ... }:
+{
+  lib,
+  config,
+  inputs,
+  pkgs,
+  ...
+}:
 let
   inherit (config.networking) domain;
   puffer_port = 8080;
@@ -6,14 +12,15 @@ let
   puffer_host = "puffer.${domain}";
   tlemap_host = "tlemap.${domain}";
   tlemap_port = 8100;
-in {
+in
+{
   services.pufferpanel = {
     enable = true;
     environment = {
       PUFFER_WEB_HOST = ":${builtins.toString puffer_port}";
       PUFFER_DAEMON_SFTP_HOST = ":${builtins.toString puffer_sftp_port}";
     };
-    extraPackages = with pkgs; [];
+    extraPackages = with pkgs; [ ];
     extraGroups = [ "docker" ];
   };
 
@@ -35,12 +42,21 @@ in {
         proxyPass = "http://127.0.0.1:${builtins.toString tlemap_port}";
       };
     };
-
   };
-  security.acme.certs."${domain}".extraDomainNames = [ puffer_host tlemap_host ];
+  security.acme.certs."${domain}".extraDomainNames = [
-  networking.firewall.allowedTCPPorts = [ puffer_sftp_port 25565 25566 25567 25568 7270 ];
+    puffer_host
+    tlemap_host
+  ];
+  networking.firewall.allowedTCPPorts = [
+    puffer_sftp_port
+    25565
+    25566
+    25567
+    25568
+    7270
+  ];
 
-#  virtualisation.podman.enable = true;
+  #  virtualisation.podman.enable = true;
   virtualisation.docker.enable = true;
 
   environment.systemPackages = with pkgs; [

modules/toolchains.nix

@@ -1,6 +1,8 @@
-{config, pkgs, ...}: let
+{ config, pkgs, ... }:
+let
   git_user = "Grimmauld";
-in {
+in
+{
   environment.systemPackages = with pkgs; [
     (writeShellScriptBin "silent-add" "git add --intent-to-add $@ ; git update-index --assume-unchanged $@")
     (writeShellScriptBin "systemd-owner" "systemctl show -pUser,UID $@")
@@ -39,7 +41,12 @@ in {
       '';
       packages.myVimPackage = with pkgs.vimPlugins; {
         # loaded on launch
-        start = [ vim-nix vim-scala fugitive autoclose-nvim ];
+        start = [
+          vim-nix
+          vim-scala
+          fugitive
+          autoclose-nvim
+        ];
         # manually loadable by calling `:packadd $plugin-name`
         opt = [ ];
       };

secrets/secrets.nix

@@ -6,7 +6,10 @@ let
   contabo_nix_pub = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDCCsCsjhJleQCBm0gwnUj5R7zewC0SoRvth1qhXtUCeWM3KHkX+CjiHvVaHs+ftYE9uCe5jwVMB+b4UPkNU8EfQeL99iOYtkcn+fEQqjUJe/x/Pn0NxfS1DCvFpI6s3485ysDmagi640XN9S+eIiiMZIqWTsIlUtkEwGF0wuv+xqzbBOlUtIkL2AMpMeFCFovOcpu2JwEAIpDUiW+FanAFImw6rvNmpAtaaFGheYOGJwnpVfdaIeRPqEN3fqtIRBIQVgxt25BGYX83vaIH3Y/OaEKMGUa/4Fe/PRpGJyhCtdae6kcVfx57hs0e7/HezjgfS90HTu2cy6BrJOvGUspCjCbdElddfboE9wtBeNYsgjUOdU926m2M1tTn7Ex6ZMOQRKRlVFac6Yo+CedRTe4u6lkrWcsDdmnajel7uxoW8VMEre/CBCtK+ZlGaDwJjIVNCn7J3KZBKeaB/t/1iSr7/buaXYh5VV1Q0gv0mtvx+D7YLngaTv3sLFpLV8Wk1mgXt9R2hHxcRBKGJYx5RWa8aMHK62RP1GRc5yCzREj2Mc5qUJyd8oirnQYms/BsaDybUJde9IL4REeMzIBYyi/MG/+OAIUSAtdYygABWco+Swv4jP52UODHikcmyejHdFhRngsb4IYzGZXbS5pobkCyqCMJ20v5BG3WNFmujAlXRw==";
 in
 {
-  "nextcloud_pass.age".publicKeys = [ laptop_pub laptop_pub_ed ];
+  "nextcloud_pass.age".publicKeys = [
+    laptop_pub
+    laptop_pub_ed
+  ];
 
   # "duckdns_token.age".publicKeys = [ contabo_nix_pub ];
   "synapse_db_pass.age".publicKeys = [ contabo_nix_pub ];

specific/grimmauld-nixos-server/configuration.nix

@@ -1,12 +1,20 @@
-{ lib, config, inputs, pkgs, ... }:
+{
+  lib,
+  config,
+  inputs,
+  pkgs,
+  ...
+}:
 let
   inherit (config.networking) domain;
-in {
+in
-  imports = [
+{
-    ./hardware-configuration.nix    
+  imports = [ ./hardware-configuration.nix ];
-  ]; 
 
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
   networking.hostName = "grimmauld-nixos-server";
   networking.domain = "grimmauld.de";
   services.openssh.enable = true;

specific/grimmauld-nixos-server/hardware-configuration.nix

@@ -2,12 +2,19 @@
 {
   imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
   boot.loader.grub.device = "/dev/sda";
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "xen_blkfront"
+    "vmw_pvscsi"
+  ];
   boot.initrd.kernelModules = [ "nvme" ];
-  fileSystems."/" = { device = "/dev/sda3"; fsType = "ext4"; };
+  fileSystems."/" = {
+    device = "/dev/sda3";
+    fsType = "ext4";
+  };
 
   environment.sessionVariables = {
     OMP_NUM_THREADS = "8";
   };
-  
 }

users.nix

@@ -35,7 +35,9 @@
       { remote = "Videos"; }
     ];
 
-    packages = with pkgs; lib.optionals config.grimmShared.graphical [
+    packages =
+      with pkgs;
+      lib.optionals config.grimmShared.graphical [
         webcord
         discord
         obs-studio