nixfmt

common/cloudsync.nix

@@ -57,7 +57,7 @@ in
                 let
                   remote_clean = lib.strings.concatStrings (builtins.match "/*(.+)" remote);
                 in
-                "${cloud_cmd} /${remote_clean} ${local} ${sync_server}"
+                "${cloud_cmd} /${remote_clean} ${local} ${sync_server} 1> /dev/null"
               ) paths
             );
           in

common/firefox.nix

@@ -38,11 +38,13 @@ in
       policies = {
         ExtensionSettings =
           # (mkIf firefox.disableUserPlugins { "*".installation_mode = "blocked"; }) // 
-          (mapAttrs (guid: shortId: {
+          (
+            mapAttrs (guid: shortId: {
               # explicit plugins by config 
               install_url = "https://addons.mozilla.org/en-US/firefox/downloads/latest/${shortId}/latest.xpi";
               installation_mode = "force_installed";
-          }) config.grimmShared.firefox.plugins);
+            }) config.grimmShared.firefox.plugins
+          );
         DisableTelemetry = true;
         DisableFirefoxStudies = true;
         EnableTrackingProtection = {

common/graphics/opengl.nix

@@ -50,7 +50,9 @@ in
       ];
     };
 
-    environment.sessionVariables = { LIBVA_DRIVER_NAME = "iHD"; }; # Force intel-media-driver
+    environment.sessionVariables = {
+      LIBVA_DRIVER_NAME = "iHD";
+    }; # Force intel-media-driver
 
     #    chaotic.mesa-git.enable = true;
     boot.kernelParams = [ "nouveau.config=NvGspRm=1" ];

common/graphics/sway.nix

@@ -87,7 +87,9 @@ let
         export SWAYSOCK="/run/user/$uid/sway-ipc.$uid.$pid.sock"
         if [[ -e "$SWAYSOCK" ]] ; then
           echo "sock is $SWAYSOCK"
-          ${getExe' config.programs.sway.package "swaymsg"} '${concatMapStrings (s: s + " ; ") output_def}'
+          ${getExe' config.programs.sway.package "swaymsg"} '${
+            concatMapStrings (s: s + " ; ") output_def
+          }'
         fi
       done
     '';

common/hardware/laptop.nix

@@ -32,6 +32,9 @@ in
     # hardware.i2c.enable = true;
     services.libinput.enable = true;
     hardware.opentabletdriver.enable = true;
+
+    systemd.user.services.opentabletdriver.after = [ "local-fs.target" ];
+
     services.udisks2.enable = true;
 
     #services.udev.extraRules = ''
@@ -42,25 +45,29 @@ in
     #    ENV{SYSTEMD_WANTS}+="ddcci@$kernel.service"
     #'';
 
-    systemd.services."ddcci@" = {
+    # systemd.services."ddcci@" = {
-      scriptArgs = "%i";
+    #  scriptArgs = "%i";
-      script = ''
+    #  script = ''
-        sleep 20
+    #    sleep 20
-        echo Trying to attach ddcci to $1
+    #    echo Trying to attach ddcci to $1
-        i=0
+    #    i=0
-        id=$(echo $1 | cut -d "-" -f 2)
+    #    id=$(echo $1 | cut -d "-" -f 2)
-        if ${lib.getExe' pkgs.ddcutil "ddcutil"} getvcp 10 -b $id; then
+    #    if ${lib.getExe' pkgs.ddcutil "ddcutil"} getvcp 10 -b $id; then
-          echo ddcci 0x37 > /sys/bus/i2c/devices/$1/new_device
+    #      echo ddcci 0x37 > /sys/bus/i2c/devices/$1/new_device
-        fi
+    #    fi
-      '';
+    #  '';
-      serviceConfig.Type = "oneshot";
+    #  serviceConfig.Type = "oneshot";
-    };
+    #};
 
     systemd.enableCgroupAccounting = true;
     # systemd.enableUnifiedCgroupHierarchy = false;
 
     boot = {
-      kernelParams = [ "intel_iommu=on" "nohibernate" ];
+      kernelParams = [
+        "intel_iommu=on"
+        "nohibernate"
+        "pcie_aspm=off"
+      ];
       loader.efi.canTouchEfiVariables = true;
       initrd.availableKernelModules = [
         "xhci_pci"
@@ -74,8 +81,8 @@ in
       loader.systemd-boot.enable = true;
       #      extraModulePackages = [ config.boot.kernelPackages.ddcci-driver ];
       kernelModules = [
-        "ddcci_backlight"
+        #        "ddcci_backlight"
-        "i2c-dev"
+        #        "i2c-dev"
         "ec_sys"
       ];
     };

common/sound/spotifyd.nix

@@ -61,9 +61,17 @@ in
         password_cmd =
           let
             pass = spotify.spotifyd.pass;
-            inherit (lib) isPath isString getExe getExe';
+            inherit (lib)
+              isPath
+              isString
+              getExe
+              getExe'
+              ;
           in
-          if (isPath pass || isString pass) then "${getExe' pkgs.coreutils-full "cat"} ${pass}" else (getExe pass);
+          if (isPath pass || isString pass) then
+            "${getExe' pkgs.coreutils-full "cat"} ${pass}"
+          else
+            (getExe pass);
         device_type = "computer";
         dbus_type = "system";
         device = "default";

common/tooling/apparmor/apparmor-d-module.nix

@@ -5,7 +5,13 @@
   ...
 }:
 let
-  inherit (lib) mkIf mapAttrs assertMsg pathIsRegularFile mkForce;
+  inherit (lib)
+    mkIf
+    mapAttrs
+    assertMsg
+    pathIsRegularFile
+    mkForce
+    ;
 
   cfg = config.security.apparmor_d;
   apparmor-d = pkgs.callPackage ./apparmor-d-package.nix { };
@@ -15,7 +21,13 @@ let
     enable = mkEnableOption "enable apparmor.d support";
 
     profiles = mkOption {
-      type = types.attrsOf (types.enum [ "disable" "complain" "enforce" ]);
+      type = types.attrsOf (
+        types.enum [
+          "disable"
+          "complain"
+          "enforce"
+        ]
+      );
       default = { };
       description = "set of apparmor profiles to include from apparmor.d";
     };
@@ -25,7 +37,8 @@ let
     security.apparmor.packages = [ apparmor-d ];
     security.apparmor.policies = mapAttrs (name: state: {
       inherit state;
-      path = let
+      path =
+        let
           file = "${apparmor-d}/etc/apparmor.d/${name}";
         in
         assert assertMsg (pathIsRegularFile file) "profile ${name} not found in apparmor.d path (${file})";

common/tooling/apparmor/apparmor-d-package.nix

@@ -1,4 +1,10 @@
-{ buildGoModule, fetchFromGitHub, git, lib, unstableGitUpdater }: 
+{
+  buildGoModule,
+  fetchFromGitHub,
+  git,
+  lib,
+  unstableGitUpdater,
+}:
 buildGoModule {
   pname = "apparmor-d";
   version = "unstable-2024-10-12";

common/tooling/apparmor/default.nix

@@ -51,7 +51,6 @@ in
       };
     };
 
-
     security.apparmor.includes = {
       "abstractions/base" = ''
         /nix/store/*/bin/** mr,
@@ -67,7 +66,6 @@ in
       #        alias /bin/ -> /nix/store/*/bin/,
       #      '';
 
-
       "local/speech-dispatcher" = ''
         @{nix_store}/libexec/speech-dispatcher-modules/* ix,
         @{PROC}/@{pid}/stat r,
@@ -218,7 +216,6 @@ in
       #}        '';
       #      };
 
-
       sleep = {
         state = "enforce";
         profile = ''

common/tooling/nix.nix

@@ -11,6 +11,7 @@
     nix-output-monitor
     nix-search-cli
     niv
+    nvd
     vulnix
     nix-init
   ];

common/tooling/opensnitch/block_lists.nix

@@ -1,4 +1,8 @@
-{ stdenv, fetchFromGitHub, lib }:
+{
+  stdenv,
+  fetchFromGitHub,
+  lib,
+}:
 stdenv.mkDerivation rec {
   pname = "stevenblack_block";
   version = "3.14.116";

common/tooling/security.nix

@@ -70,7 +70,9 @@ in
       enableSSHSupport = true;
     };
 
-    grimmShared.firefox.plugins = mkIf (tooling.enable && tooling.pass) { "passff@invicem.pro" = "passff"; };
+    grimmShared.firefox.plugins = mkIf (tooling.enable && tooling.pass) {
+      "passff@invicem.pro" = "passff";
+    };
   };
 
   options.grimmShared.tooling.pass = mkEnableOption "Enables password-store, gnupg and such secret handling";

common/tooling/wine.nix

@@ -1,4 +1,9 @@
-{ pkgs, config, lib, ... }:
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
 let
   inherit (config.grimmShared) enable tooling;
   inherit (lib)
@@ -22,7 +27,6 @@ in
     #      };
     #    };
 
-  
     environment.systemPackages = with pkgs; [
       winetricks
       wineWow64Packages.stagingFull

custom/ncspot/package.nix

@@ -1,22 +1,32 @@
-{ stdenv
+{
-, lib
+  stdenv,
-, fetchFromGitHub
+  lib,
-, rustPlatform
+  fetchFromGitHub,
-, pkg-config
+  rustPlatform,
-, ncurses
+  pkg-config,
-, openssl
+  ncurses,
-, darwin
+  openssl,
-, withALSA ? stdenv.isLinux, alsa-lib
+  darwin,
-, withClipboard ? true, libxcb, python3
+  withALSA ? stdenv.isLinux,
-, withCover ? false, ueberzug
+  alsa-lib,
-, withPulseAudio ? stdenv.isLinux, libpulseaudio
+  withClipboard ? true,
-, withPortAudio ? stdenv.isDarwin, portaudio
+  libxcb,
-, withMPRIS ? stdenv.isLinux, withNotify ? true, dbus
+  python3,
-, withCrossterm ? true
+  withCover ? false,
-, nix-update-script
+  ueberzug,
-, testers
+  withPulseAudio ? stdenv.isLinux,
-, ncspot
+  libpulseaudio,
-}: let 
+  withPortAudio ? stdenv.isDarwin,
+  portaudio,
+  withMPRIS ? stdenv.isLinux,
+  withNotify ? true,
+  dbus,
+  withCrossterm ? true,
+  nix-update-script,
+  testers,
+  ncspot,
+}:
+let
   inherit (darwin.apple_sdk.frameworks) Cocoa;
 in
 rustPlatform.buildRustPackage rec {
@@ -37,10 +47,10 @@ rustPlatform.buildRustPackage rec {
     };
   };
 
-  nativeBuildInputs = [ pkg-config ]
+  nativeBuildInputs = [ pkg-config ] ++ lib.optional withClipboard python3;
-    ++ lib.optional withClipboard python3;
 
-  buildInputs = [ ncurses ]
+  buildInputs =
+    [ ncurses ]
     ++ lib.optional stdenv.isLinux openssl
     ++ lib.optional withALSA alsa-lib
     ++ lib.optional withClipboard libxcb
@@ -54,7 +64,8 @@ rustPlatform.buildRustPackage rec {
 
   buildNoDefaultFeatures = true;
 
-  buildFeatures = [ "cursive/pancurses-backend" ]
+  buildFeatures =
+    [ "cursive/pancurses-backend" ]
     ++ lib.optional withALSA "alsa_backend"
     ++ lib.optional withClipboard "share_clipboard"
     ++ lib.optional withCover "cover"

flake.nix

@@ -34,7 +34,18 @@
     };
   };
 
-  outputs = inputs @ { self, agenix, nixpkgs, chaotic, aagl-gtk-on-nix, nixos-mailserver, nixos-matrix-modules, aa-alias-manager, ... }:
+  outputs =
+    inputs@{
+      self,
+      agenix,
+      nixpkgs,
+      chaotic,
+      aagl-gtk-on-nix,
+      nixos-mailserver,
+      nixos-matrix-modules,
+      aa-alias-manager,
+      ...
+    }:
     let
       patches = [
         ./aa_mod.patch
@@ -44,7 +55,8 @@
         }
       ];
 
-      customNixosSystem = system: definitions:
+      customNixosSystem =
+        system: definitions:
         let
           unpatched = nixpkgs.legacyPackages.${system};
           patched = unpatched.applyPatches {
@@ -54,10 +66,15 @@
           };
           nixosSystem = import (patched + "/nixos/lib/eval-config.nix");
         in
-        nixosSystem ({
+        nixosSystem (
+          {
             inherit system;
-          specialArgs = { inherit inputs system; };
+            specialArgs = {
-        } // definitions);
+              inherit inputs system;
+            };
+          }
+          // definitions
+        );
     in
     {
       nixosConfigurations = {

modules/matrix_legacy.nix

@@ -11,7 +11,9 @@ let
   fqdn = vhosts.matrix_host.host;
   base_url = "https://${fqdn}";
 
-  clientConfig."m.homeserver" = {inherit base_url; }; # = "https://${vhosts.matrix_host.host}";
+  clientConfig."m.homeserver" = {
+    inherit base_url;
+  }; # = "https://${vhosts.matrix_host.host}";
   serverConfig."m.server" = "${vhosts.matrix_host.host}:443";
   mkWellKnown = data: ''
     default_type application/json;
@@ -33,7 +35,6 @@ in
     ];
   };
 
-  
   services.matrix-synapse = {
     enable = true;
     settings.server_name = domain;
@@ -43,21 +44,30 @@ in
     # in client applications.
     settings.public_baseurl = base_url;
     settings.listeners = [
-      { port = 8008;
+      {
+        port = 8008;
         bind_addresses = [ "::1" ];
         type = "http";
         tls = false;
         x_forwarded = true;
-        resources = [ {
+        resources = [
-          names = [ "client" "federation" ];
+          {
+            names = [
+              "client"
+              "federation"
+            ];
             compress = true;
-        } ];
+          }
+        ];
       }
     ];
 
     settings.database = {
       name = "psycopg2";
-      args = { user="synapse"; database= "synapse"; };
+      args = {
+        user = "synapse";
+        database = "synapse";
+      };
     };
     settings.log_config = ./matrix_synapse_log_config.yaml;
     settings.enable_registration = false;
@@ -141,7 +151,6 @@ in
     matrix-synapse
   ];
 
-
   services.nginx = {
     enable = true;
     recommendedTlsSettings = true;

modules/wireguard.nix

@@ -1,7 +1,10 @@
- {pkgs, ...}: {
+{ pkgs, ... }:
+{
   # enable NAT
-  networking.nat.enable = true; networking.nat.externalInterface = "eth0"; 
+  networking.nat.enable = true;
-  networking.nat.internalInterfaces = [ "wg0" ]; networking.firewall = {
+  networking.nat.externalInterface = "eth0";
+  networking.nat.internalInterfaces = [ "wg0" ];
+  networking.firewall = {
     allowedUDPPorts = [ 51820 ];
   };
 
@@ -18,10 +21,12 @@
       # This allows the wireguard server to route your traffic to the internet and 
       # hence be like a VPN For this to work you have to set the dnsserver IP of 
       # your router (or dnsserver of choice) in your clients
-      postSetup = '' ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o ens18 -j MASQUERADE
+      postSetup = ''
+        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o ens18 -j MASQUERADE
       '';
       # This undoes the above command
-      postShutdown = '' ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o ens18 -j MASQUERADE
+      postShutdown = ''
+        ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o ens18 -j MASQUERADE
       '';
 
       generatePrivateKeyFile = true;
@@ -29,7 +34,8 @@
         {
           publicKey = "2aANdnPYtf78iXfwNVAtYjIlE5k/yDWvbdXZ2jw0hXk=";
           allowedIPs = [ "10.100.0.2/32" ];
- } ];
+        }
+      ];
     };
   };
   environment.systemPackages = with pkgs; [ wireguard-tools ];

overlays/factorio.nix

@@ -4,6 +4,9 @@ let
 in
 {
   factorio = prev.factorio.override (
-    { versionsJson = ./versions.json; } // lib.optionalAttrs (builtins.pathExists loginFile) (import loginFile)
+    {
+      versionsJson = ./versions.json;
+    }
+    // lib.optionalAttrs (builtins.pathExists loginFile) (import loginFile)
   );
 }

specific/grimm-nixos-laptop/configuration.nix

@@ -9,7 +9,6 @@
 
   age.identityPaths = [ "/home/grimmauld/.ssh/id_ed25519" ];
 
-
   services.zfs.trim.enable = true;
   boot.supportedFilesystems.zfs = true;
   networking.hostId = "2ea79333";

specific/grimm-nixos-ssd/configuration.nix

@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 {
   imports = [
     # Include the results of the hardware scan.
@@ -14,7 +19,8 @@
 
   # security.pam.yubico.control = "required";
 
-  services.udev.extraRules = let 
+  services.udev.extraRules =
+    let
       inherit (lib) getExe' getExe;
       inherit (pkgs) procps writeShellScriptBin;
       exitSway = writeShellScriptBin "kill-sway" ''
@@ -28,7 +34,8 @@
           fi
         done
       '';
-  in ''
+    in
+    ''
             ACTION=="remove",\
              ENV{SUBSYSTEM}=="usb",\
              ENV{PRODUCT}=="1050/407/543",\

specific/grimm-nixos-ssd/hardware-configuration.nix

@@ -1,15 +1,36 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+    (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "uas" "sd_mod" "kvm-intel" ];
+  boot.initrd.availableKernelModules = [
-  boot.initrd.kernelModules = [ "zfs" "nls_cp437" "nls_iso8859-1" "usbhid" "usb_storage" "nvme" ];
+    "xhci_pci"
+    "ahci"
+    "nvme"
+    "usbhid"
+    "uas"
+    "sd_mod"
+    "kvm-intel"
+  ];
+  boot.initrd.kernelModules = [
+    "zfs"
+    "nls_cp437"
+    "nls_iso8859-1"
+    "usbhid"
+    "usb_storage"
+    "nvme"
+  ];
   boot.zfs = {
     forceImportRoot = false;
     requestEncryptionCredentials = false; # none of the zfs datasets that should be mounted are encrypted. User homes happen later.
@@ -29,23 +50,23 @@
   boot.kernelParams = [ "mds=full,nosmt" ];
   services.homed.enable = true;
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "zpool/root";
+    device = "zpool/root";
     fsType = "zfs";
   };
 
-  fileSystems."/nix" =
+  fileSystems."/nix" = {
-    { device = "zpool/nix";
+    device = "zpool/nix";
     fsType = "zfs";
   };
 
-  fileSystems."/var" =
+  fileSystems."/var" = {
-    { device = "zpool/var";
+    device = "zpool/var";
     fsType = "zfs";
   };
 
-  fileSystems."/etc/nixos" =
+  fileSystems."/etc/nixos" = {
-    { device = "zpool/nix_conf";
+    device = "zpool/nix_conf";
     fsType = "zfs";
     options = [ "noacl" ];
   };
@@ -55,13 +76,16 @@
   #      fsType = "zfs";
   #    };
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    { device = "/dev/disk/by-uuid/12CE-A600";
+    device = "/dev/disk/by-uuid/12CE-A600";
     fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" "umask=077" ];
+    options = [
+      "fmask=0022"
+      "dmask=0022"
+      "umask=077"
+    ];
   };
 
-
   grimmShared = {
     screens = {
       external = {
@@ -80,7 +104,6 @@
     laptop_hardware.enable = true;
   };
 
-
   #  fileSystems."/crypt-storage" =
   #     { device = "/dev/disk/by-uuid/6f0d65a8-24f0-439d-b5ee-03c0ef051fcb";
   #      fsType = "ext4";

sway/default.nix

@@ -1,4 +1,9 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 {
   imports = [ ./bar ];
 
@@ -51,7 +56,8 @@
           urgentcol = "#9e3c3c";
           realwhite = "#C7D3E3";
         };
-        keybinds = {
+        keybinds =
+          {
             "$mod+d" = "exec $menu";
             "$mod+Shift+d" = "exec $menu_run";
             "$mod+Shift+s" = ''exec ${getExe grim} -g "$(${getExe slurp} -d)" - | wl-copy'';
@@ -154,10 +160,18 @@
               in
               "exec ${getExe open}";
             # XF86Bluetooth = "exec blueman-manager";
-        } // (let inherit (builtins) toString; in lib.mergeAttrsList (map (n: {
+          }
+          // (
+            let
+              inherit (builtins) toString;
+            in
+            lib.mergeAttrsList (
+              map (n: {
                 "$mod+${toString n}" = "workspace number ${toString n}";
                 "$mod+Shift+${toString n}" = "move container to workspace number ${toString n}";
-        }) (lib.range 0 9)));
+              }) (lib.range 0 9)
+            )
+          );
         autolaunch = [
           (getExe' pkgs.dbus "dbus-update-activation-environment")
           (getExe' pkgs.xdg-user-dirs "xdg-user-dirs-update")

users.nix

@@ -10,7 +10,6 @@
     # shell = pkgs.xonsh;
     description = "grimmauld";
 
-
     openssh.authorizedKeys.keys = (import ./authorizedKeys.nix);
     extraGroups = lib.intersectLists (lib.attrNames config.users.groups) [
       "networkmanager"