@@ -801,11 +801,11 @@ "pre-commit-hooks": "pre-commit-hooks",
         "simple-css": "simple-css"
       },
       "locked": {
-        "lastModified": 1750843792,
-        "narHash": "sha256-dcoK1li0ZuSM6bldwxQevghxkN5M4F/rbCnM7W+LrTE=",
+        "lastModified": 1751357750,
+        "narHash": "sha256-U+o0yr9OYHXv8C5hotG7nMFiXtxQSf3KyKub2nulB1c=",
         "ref": "refs/heads/main",
-        "rev": "d8620522ba86ee6279d9b190899f7f424a206bec",
-        "revCount": 475,
+        "rev": "1685f383414d5a184376519fa81002a506712534",
+        "revCount": 477,
         "type": "git",
         "url": "https://git.alin.ovh/searchix"
       },

@@ -33,69 +33,80 @@ };
   };
 
   outputs =
-    inputs@
-    { self
-    , utils
-    , srvos
-    , nixpkgs
-    , nixos-hardware
-    , nur
-    , home-manager
-    , darwin
-    , nix-index-database
-    , nixvim
-    , angrr
-    , agenix
-    , deploy-rs
-    , elgit
-    , mycal
-    , searchix
-    , golink
-    , ...
+    inputs@{
+      self,
+      utils,
+      srvos,
+      nixpkgs,
+      nixos-hardware,
+      nur,
+      home-manager,
+      darwin,
+      nix-index-database,
+      nixvim,
+      angrr,
+      agenix,
+      deploy-rs,
+      elgit,
+      mycal,
+      searchix,
+      golink,
+      ...
     }:
     let
-      readOverlays = path:
-        let content = builtins.readDir path; in
-        map (n: import (path + ("/" + n)))
-          (builtins.filter
-            (n:
-              (builtins.match ".*\\.nix" n != null &&
-              # ignore Emacs lock files (.#foo.nix)
-              builtins.match "\\.#.*" n == null) ||
-              builtins.pathExists (path + ("/" + n + "/default.nix")))
-            (builtins.attrNames content));
+      readOverlays =
+        path:
+        let
+          content = builtins.readDir path;
+        in
+        map (n: import (path + ("/" + n))) (
+          builtins.filter (
+            n:
+            (
+              builtins.match ".*\\.nix" n != null
+              &&
+                # ignore Emacs lock files (.#foo.nix)
+                builtins.match "\\.#.*" n == null
+            )
+            || builtins.pathExists (path + ("/" + n + "/default.nix"))
+          ) (builtins.attrNames content)
+        );
 
-      mkHomeConfiguration = { modules, system }: home-manager.lib.homeManagerConfiguration {
-        pkgs = import nixpkgs {
-          inherit system;
-          overlays = readOverlays (toString ./overlays) ++ [
-            agenix.overlays.default
-            angrr.overlays.default
-            (self: super: {
-              personal = import ./packages/overlay.nix self super;
-            })
-          ];
-        };
+      mkHomeConfiguration =
+        { modules, system }:
+        home-manager.lib.homeManagerConfiguration {
+          pkgs = import nixpkgs {
+            inherit system;
+            overlays = readOverlays (toString ./overlays) ++ [
+              agenix.overlays.default
+              angrr.overlays.default
+              (self: super: {
+                personal = import ./packages/overlay.nix self super;
+              })
+            ];
+          };
 
-        inherit modules;
-        extraSpecialArgs = {
-          inherit inputs system;
+          inherit modules;
+          extraSpecialArgs = {
+            inherit inputs system;
+          };
         };
-      };
     in
     {
       nixosConfigurations.prefect = nixpkgs.lib.nixosSystem {
         system = utils.lib.system.x86_64-linux;
         specialArgs = { inherit inputs; };
-        modules = [
-          ./system/prefect.nix
-        ] ++ (with nixos-hardware.nixosModules; [
-          common-cpu-amd
-          common-cpu-amd-pstate
-          common-pc-ssd
-          common-pc
-          common-gpu-nvidia-nonprime
-        ]);
+        modules =
+          [
+            ./system/prefect.nix
+          ]
+          ++ (with nixos-hardware.nixosModules; [
+            common-cpu-amd
+            common-cpu-amd-pstate
+            common-pc-ssd
+            common-pc
+            common-gpu-nvidia-nonprime
+          ]);
       };
       nixosConfigurations.nano = nixpkgs.lib.nixosSystem {
         system = utils.lib.system.aarch64-linux;
@@ -193,13 +204,15 @@ hostname = "linde";
           profiles.system = {
             user = "root";
             sshUser = "root";
-            path = deploy-rs.lib.${utils.lib.system.aarch64-linux}.activate.nixos
-              self.nixosConfigurations.linde;
+            path =
+              deploy-rs.lib.${utils.lib.system.aarch64-linux}.activate.nixos
+                self.nixosConfigurations.linde;
           };
           profiles.alan = {
             user = "alan";
-            path = deploy-rs.lib.${utils.lib.system.aarch64-linux}.activate.home-manager
-              self.homeConfigurations."alan@linde";
+            path =
+              deploy-rs.lib.${utils.lib.system.aarch64-linux}.activate.home-manager
+                self.homeConfigurations."alan@linde";
           };
         };
         nodes.nano = {
@@ -207,30 +220,34 @@ hostname = "nano";
           profiles.system = {
             user = "root";
             sshUser = "root";
-            path = deploy-rs.lib.${utils.lib.system.aarch64-linux}.activate.nixos
-              self.nixosConfigurations.nano;
+            path = deploy-rs.lib.${utils.lib.system.aarch64-linux}.activate.nixos self.nixosConfigurations.nano;
           };
           profiles.alan = {
             user = "alan";
             sshUser = "alan";
-            path = deploy-rs.lib.${utils.lib.system.aarch64-linux}.activate.home-manager
-              self.homeConfigurations."alan@nano";
+            path =
+              deploy-rs.lib.${utils.lib.system.aarch64-linux}.activate.home-manager
+                self.homeConfigurations."alan@nano";
           };
         };
       };
-    } // utils.lib.eachDefaultSystem (system:
-    let
-      pkgs = import nixpkgs { inherit system; };
-    in
-    {
-      devShells = {
-        default = pkgs.mkShell {
-          packages = with pkgs; [
-            nixos-rebuild
-            deploy-rs.packages.${system}.default
-            agenix.packages.${system}.default
-          ];
+    }
+    // utils.lib.eachDefaultSystem (
+      system:
+      let
+        pkgs = import nixpkgs { inherit system; };
+      in
+      {
+        devShells = {
+          default = pkgs.mkShell {
+            packages = with pkgs; [
+              nixos-rebuild
+              deploy-rs.packages.${system}.default
+              agenix.packages.${system}.default
+            ];
+          };
         };
-      };
-    });
+        formatter = pkgs.nixfmt-tree;
+      }
+    );
 }

@@ -1,31 +1,27 @@
-{ lib
-, ...
+{
+  lib,
+  ...
 }:
 rec {
-  subValue = v:
-    if builtins.isList v
-    then
-      builtins.concatStringsSep " "
-        (builtins.map
-          (v:
-            (if lib.strings.hasPrefix "http" v
-            then v
-            else "'${v}'"))
-          v)
-    else toString v;
+  subValue =
+    v:
+    if builtins.isList v then
+      builtins.concatStringsSep " " (
+        builtins.map (v: (if lib.strings.hasPrefix "http" v then v else "'${v}'")) v
+      )
+    else
+      toString v;
 
-  headerValue = sep: val:
-    if builtins.isAttrs val
-    then
-      builtins.concatStringsSep "; "
-        (lib.attrsets.mapAttrsToList
-          (k: v:
-            if builtins.isBool v then k else
-            "${k}${sep}${subValue v}"
-          )
-          val)
-    else toString val;
-  genHeader = header:
+  headerValue =
+    sep: val:
+    if builtins.isAttrs val then
+      builtins.concatStringsSep "; " (
+        lib.attrsets.mapAttrsToList (k: v: if builtins.isBool v then k else "${k}${sep}${subValue v}") val
+      )
+    else
+      toString val;
+  genHeader =
+    header:
     let
       sep = if header == "content-security-policy" then " " else "=";
     in
@@ -33,15 +29,22 @@ value: "${header} \"${headerValue sep value}\"";
 
   headers = matcher: headers: ''
     header ${matcher} {
-      ${builtins.concatStringsSep "\n"
-        (lib.attrsets.mapAttrsToList genHeader headers)}
+      ${builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList genHeader headers)}
     }
   '';
-  security-headers = { matcher ? "", overrides ? { } }: headers matcher ({
-    strict-transport-security = {
-      max-age = 2 * 365 * 24 * 60 * 60;
-    };
-    x-content-type-options = "nosniff";
-    x-frame-options = "DENY";
-  } // overrides);
+  security-headers =
+    {
+      matcher ? "",
+      overrides ? { },
+    }:
+    headers matcher (
+      {
+        strict-transport-security = {
+          max-age = 2 * 365 * 24 * 60 * 60;
+        };
+        x-content-type-options = "nosniff";
+        x-frame-options = "DENY";
+      }
+      // overrides
+    );
 }

@@ -1,4 +1,6 @@
 self: super: {
   firefox-bin-unwrapped = super.firefox-bin-unwrapped.override { systemLocale = "en-GB"; };
-  firefox-devedition-bin-unwrapped = super.firefox-devedition-bin-unwrapped.override { systemLocale = "en-GB"; };
+  firefox-devedition-bin-unwrapped = super.firefox-devedition-bin-unwrapped.override {
+    systemLocale = "en-GB";
+  };
 }

@@ -11,7 +11,10 @@ nano = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICHevZUbjDEt2bPnoLmv9wH5vTh/BeKddwnFD3f3QtMz";
   };
 
   secrets = with machines; {
-    acme = [ linde nano ];
+    acme = [
+      linde
+      nano
+    ];
 
     redis-website = [ linde ];
 
@@ -31,10 +34,8 @@ syncthing = [ nano ];
   };
 in
 builtins.listToAttrs (
-  map
-    (secretName: {
-      name = "${secretName}.age";
-      value.publicKeys = secrets.${secretName} ++ users.alan;
-    })
-    (builtins.attrNames secrets)
+  map (secretName: {
+    name = "${secretName}.age";
+    value.publicKeys = secrets.${secretName} ++ users.alan;
+  }) (builtins.attrNames secrets)
 )

@@ -1,31 +1,43 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
-    ];
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" "sr_mod" ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "virtio_pci"
+    "virtio_scsi"
+    "usbhid"
+    "sr_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/09c12218-c189-439a-9ef1-846b87538841";
-      fsType = "ext4";
-    };
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/09c12218-c189-439a-9ef1-846b87538841";
+    fsType = "ext4";
+  };
 
-  fileSystems."/boot/efi" =
-    { device = "/dev/disk/by-uuid/1C43-4EC4";
-      fsType = "vfat";
-    };
+  fileSystems."/boot/efi" = {
+    device = "/dev/disk/by-uuid/1C43-4EC4";
+    fsType = "vfat";
+  };
 
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/29793e8e-5c0d-4e5b-80e0-11252d786294"; }
-    ];
+  swapDevices = [
+    { device = "/dev/disk/by-uuid/29793e8e-5c0d-4e5b-80e0-11252d786294"; }
+  ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's

@@ -2,7 +2,12 @@ # Edit this configuration file to define what should be installed on
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running `nixos-help`).
 
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 with lib;
 let
@@ -20,14 +25,13 @@ email = "alan@alanpearce.eu";
   ts-domain = "fin-marlin.ts.net";
 in
 {
-  imports =
-    [
-      # Include the results of the hardware scan.
-      ./linde-hardware.nix
+  imports = [
+    # Include the results of the hardware scan.
+    ./linde-hardware.nix
 
-      ./settings/configuration/nix-linux.nix
-      ./settings/services/git-server.nix
-    ];
+    ./settings/configuration/nix-linux.nix
+    ./settings/services/git-server.nix
+  ];
   age.secrets = {
     paperless =
       let
@@ -47,14 +51,18 @@ redis-website.file = ../secrets/redis-website.age;
     cifs-paperless.file = ../secrets/cifs-paperless.age;
     cifs-transmission.file = ../secrets/cifs-transmission.age;
     forgejo-actions-runner.file = ../secrets/forgejo-actions-runner.age;
-    golink = let golink = config.services.golink; in {
-      # hope this doesn't collide...
-      path = "${golink.dataDir}/.config/tsnet-golink/auth.key";
-      owner = golink.user;
-      mode = "400";
-      symlink = false;
-      file = ../secrets/golink.age;
-    };
+    golink =
+      let
+        golink = config.services.golink;
+      in
+      {
+        # hope this doesn't collide...
+        path = "${golink.dataDir}/.config/tsnet-golink/auth.key";
+        owner = golink.user;
+        mode = "400";
+        symlink = false;
+        file = ../secrets/golink.age;
+      };
     rauthy.file = ../secrets/rauthy.age;
   };
 
@@ -104,7 +112,10 @@
   nix = {
     settings = {
       max-jobs = 2;
-      trusted-users = [ "root" "nixremote" ];
+      trusted-users = [
+        "root"
+        "nixremote"
+      ];
     };
     gc = {
       dates = "08:15";
@@ -147,8 +158,16 @@ "1.1.1.1"
       "1.0.0.1"
     ];
     hosts = lib.mkForce {
-      ${net-ip4} = [ "${hostname}.${domain}" hostname "redis" ];
-      ${net-ip6} = [ "${hostname}.${domain}" hostname "redis" ];
+      ${net-ip4} = [
+        "${hostname}.${domain}"
+        hostname
+        "redis"
+      ];
+      ${net-ip6} = [
+        "${hostname}.${domain}"
+        hostname
+        "redis"
+      ];
     };
     defaultGateway = {
       address = net-gw;
@@ -161,15 +180,24 @@ };
     interfaces.${netif} = {
       ipv4 = {
         addresses = [
-          { address = net-ip4; prefixLength = net-mask4; }
+          {
+            address = net-ip4;
+            prefixLength = net-mask4;
+          }
         ];
         routes = [
-          { address = net-gw; prefixLength = 32; }
+          {
+            address = net-gw;
+            prefixLength = 32;
+          }
         ];
       };
       ipv6 = {
         addresses = [
-          { address = net-ip6; prefixLength = net-mask6; }
+          {
+            address = net-ip6;
+            prefixLength = net-mask6;
+          }
         ];
       };
     };
@@ -197,7 +225,10 @@ 6885 # DHT
         6922
         config.services.transmission.settings.peer-port
       ];
-      trustedInterfaces = [ "tailscale0" "podman0" ];
+      trustedInterfaces = [
+        "tailscale0"
+        "podman0"
+      ];
     };
     resolvconf = {
       enable = false;
@@ -216,7 +247,10 @@ services.tailscale = {
     enable = true;
     openFirewall = true;
     extraUpFlags = [ "--accept-routes" ];
-    extraSetFlags = [ "--advertise-exit-node" "--ssh" ];
+    extraSetFlags = [
+      "--advertise-exit-node"
+      "--ssh"
+    ];
     useRoutingFeatures = "both";
   };
   services.golink = {
@@ -298,7 +332,14 @@ ];
   };
   users.users.alan = {
     shell = "/run/current-system/sw/bin/fish";
-    extraGroups = [ "wheel" "caddy" "docker" "podman" "laminar" "transmission" ];
+    extraGroups = [
+      "wheel"
+      "caddy"
+      "docker"
+      "podman"
+      "laminar"
+      "transmission"
+    ];
     isNormalUser = true;
     home = "/home/alan";
     createHome = true;
@@ -496,6 +537,7 @@ acl sniff_https req.ssl_hello_type 1
         acl sniff_ssh req.payload(0,7) -m str "SSH-2.0"
         tcp-request content accept if sniff_https
         use_backend ssh if sniff_ssh
+        use_backend ssh if { req_ssl_sni -i ssh.alin.ovh }
 
         default_backend caddy
 
@@ -533,7 +575,7 @@ "${hostname}.${domain}" = {
           serverAliases = [ "https://" ];
           extraConfig = ''
             respond * 204
-            ${security-headers {}}
+            ${security-headers { }}
           '';
         };
         "pdns.${domain}" = {
@@ -553,7 +595,7 @@ };
         "files.${domain}" = {
           extraConfig = ''
             encode zstd gzip
-            ${security-headers {}}
+            ${security-headers { }}
             root * /srv/http/files
             file_server browse
           '';
@@ -642,7 +684,7 @@ };
         "go.${domain}" = {
           extraConfig = ''
             encode zstd gzip
-            ${security-headers {}}
+            ${security-headers { }}
             root * /srv/http/go.alin.ovh
             file_server
           '';
@@ -650,7 +692,7 @@ };
         "go.${oldDomain}" = {
           extraConfig = ''
             encode zstd gzip
-            ${security-headers {}}
+            ${security-headers { }}
             root * /srv/http/go
             file_server
           '';
@@ -662,7 +704,7 @@ in
           {
             extraConfig = ''
               encode zstd gzip
-              ${security-headers{}}
+              ${security-headers { }}
               reverse_proxy ${srv.listenAddress}:${toString srv.port}
             '';
           };
@@ -690,7 +732,10 @@ group = "paperless";
     uid = config.ids.uids.paperless;
     home = "/srv/paperless";
   };
-  users.groups.paperless.members = [ "alan" "syncthing" ];
+  users.groups.paperless.members = [
+    "alan"
+    "syncthing"
+  ];
 
   fileSystems."/srv/paperless" = {
     device = "//u439959-sub3.your-storagebox.de/u439959-sub3";
@@ -706,7 +751,8 @@ "x-systemd.mount-timeout=5s"
         ];
         uid = config.ids.uids.paperless;
       in
-      automount_opts ++ [
+      automount_opts
+      ++ [
         "credentials=${config.age.secrets.cifs-paperless.path}"
         "seal"
         "multichannel"
@@ -732,9 +778,11 @@ enableTun = true;
       privateNetwork = true;
       hostAddress6 = "fc00::1";
       inherit localAddress6;
-      forwardPorts = [{
-        hostPort = tsPort;
-      }];
+      forwardPorts = [
+        {
+          hostPort = tsPort;
+        }
+      ];
       bindMounts = {
         ${config.services.paperless.dataDir} = {
           hostPath = hostConfig.services.paperless.dataDir;
@@ -745,105 +793,115 @@ hostPath = externalDir;
           isReadOnly = false;
         };
       };
-      config = { config, pkgs, ... }: {
-        environment.systemPackages = with pkgs; [
-          lsof
-        ];
-        networking = {
-          useHostResolvConf = false;
-          resolvconf.enable = false;
-          firewall.trustedInterfaces = [ "tailscale0" ];
-          firewall.rejectPackets = true;
-          nameservers = hostConfig.networking.nameservers;
-        };
-        services.resolved = {
-          enable = true;
-          llmnr = "false";
-        };
-        services.tailscale = {
-          enable = true;
-          openFirewall = true;
-          permitCertUid = "caddy";
-          port = tsPort;
-        };
-        services.tailscaleAuth = {
-          enable = true;
-          group = "caddy";
-        };
-        services.caddy = {
-          enable = true;
-          email = "caddy@alanpearce.eu";
-          virtualHosts = {
-            "http://" = {
-              # avoid logging to an awkward file name based on the attribute name i.e. http://
-              hostName = "papers";
-              extraConfig = ''
-                redir ${tsHostname}{uri}
-              '';
-            };
-            ${tsHostname} = {
-              extraConfig = ''
-                encode zstd gzip
-                tls {
-                  get_certificate tailscale
-                }
-                handle_path /static/* {
-                  root * ${config.services.paperless.package}/lib/paperless-ngx/static
-                  file_server
-                }
-                forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
-                  uri /auth
-                  header_up Expected-Tailnet "${ts-domain}."
-                  header_up Remote-Addr {remote_host}
-                  header_up Remote-Port {remote_port}
-                  header_up Original-URI {uri}
-                  copy_headers {
-                    Tailscale-User>X-Webauth-User
-                    Tailscale-Name>X-Webauth-Name
-                    Tailscale-Login>X-Webauth-Login
-                    Tailscale-Tailnet>X-Webauth-Tailnet
-                    Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+      config =
+        { config, pkgs, ... }:
+        {
+          environment.systemPackages = with pkgs; [
+            lsof
+          ];
+          networking = {
+            useHostResolvConf = false;
+            resolvconf.enable = false;
+            firewall.trustedInterfaces = [ "tailscale0" ];
+            firewall.rejectPackets = true;
+            nameservers = hostConfig.networking.nameservers;
+          };
+          services.resolved = {
+            enable = true;
+            llmnr = "false";
+          };
+          services.tailscale = {
+            enable = true;
+            openFirewall = true;
+            permitCertUid = "caddy";
+            port = tsPort;
+          };
+          services.tailscaleAuth = {
+            enable = true;
+            group = "caddy";
+          };
+          services.caddy = {
+            enable = true;
+            email = "caddy@alanpearce.eu";
+            virtualHosts = {
+              "http://" = {
+                # avoid logging to an awkward file name based on the attribute name i.e. http://
+                hostName = "papers";
+                extraConfig = ''
+                  redir ${tsHostname}{uri}
+                '';
+              };
+              ${tsHostname} = {
+                extraConfig = ''
+                  encode zstd gzip
+                  tls {
+                    get_certificate tailscale
                   }
-                }
-                reverse_proxy [::1]:${toString config.services.paperless.port}
-              '';
+                  handle_path /static/* {
+                    root * ${config.services.paperless.package}/lib/paperless-ngx/static
+                    file_server
+                  }
+                  forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+                    uri /auth
+                    header_up Expected-Tailnet "${ts-domain}."
+                    header_up Remote-Addr {remote_host}
+                    header_up Remote-Port {remote_port}
+                    header_up Original-URI {uri}
+                    copy_headers {
+                      Tailscale-User>X-Webauth-User
+                      Tailscale-Name>X-Webauth-Name
+                      Tailscale-Login>X-Webauth-Login
+                      Tailscale-Tailnet>X-Webauth-Tailnet
+                      Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+                    }
+                  }
+                  reverse_proxy [::1]:${toString config.services.paperless.port}
+                '';
+              };
             };
           };
-        };
-        services.paperless = {
-          enable = true;
-          address = "::1";
-          mediaDir = "${externalDir}/media";
-          settings = {
-            PAPERLESS_DBENGINE = "sqlite";
-            PAPERLESS_TIME_ZONE = "Europe/Berlin";
+          services.paperless = {
+            enable = true;
+            address = "::1";
+            mediaDir = "${externalDir}/media";
+            settings = {
+              PAPERLESS_DBENGINE = "sqlite";
+              PAPERLESS_TIME_ZONE = "Europe/Berlin";
 
-            PAPERLESS_URL = "https://${tsHostname}";
-            PAPERLESS_TRUSTED_PROXIES = "::1";
-            PAPERLESS_USE_X_FORWARD_HOST = true;
-            PAPERLESS_USE_X_FORWARD_PORT = true;
-            PAPERLESS_PROXY_SSL_HEADER = [ "HTTP_X_FORWARDED_PROTO" "https" ];
-            PAPERLESS_ENABLE_COMPRESSION = false; # let caddy do it
+              PAPERLESS_URL = "https://${tsHostname}";
+              PAPERLESS_TRUSTED_PROXIES = "::1";
+              PAPERLESS_USE_X_FORWARD_HOST = true;
+              PAPERLESS_USE_X_FORWARD_PORT = true;
+              PAPERLESS_PROXY_SSL_HEADER = [
+                "HTTP_X_FORWARDED_PROTO"
+                "https"
+              ];
+              PAPERLESS_ENABLE_COMPRESSION = false; # let caddy do it
 
-            PAPERLESS_ENABLE_HTTP_REMOTE_USER = true;
-            PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME = "HTTP_X_WEBAUTH_LOGIN";
+              PAPERLESS_ENABLE_HTTP_REMOTE_USER = true;
+              PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME = "HTTP_X_WEBAUTH_LOGIN";
 
-            PAPERLESS_OCR_SKIP_ARCHIVE_FILE = "with_text";
-            PAPERLESS_OCR_LANGUAGE = "deu+eng";
-            PAPERLESS_IGNORE_DATES = "09.08.90";
+              PAPERLESS_OCR_SKIP_ARCHIVE_FILE = "with_text";
+              PAPERLESS_OCR_LANGUAGE = "deu+eng";
+              PAPERLESS_IGNORE_DATES = "09.08.90";
 
-            PAPERLESS_TASK_WORKERS = 2;
-            PAPERLESS_THREADS_PER_WORKER = 1;
-            PAPERLESS_NUMBER_OF_SUGGESTED_DATES = 4;
+              PAPERLESS_TASK_WORKERS = 2;
+              PAPERLESS_THREADS_PER_WORKER = 1;
+              PAPERLESS_NUMBER_OF_SUGGESTED_DATES = 4;
 
-            PAPERLESS_CONSUMER_IGNORE_PATTERN = [ ".DS_STORE/*" "desktop.ini" ".stfolder/*" ".stversions/*" ];
+              PAPERLESS_CONSUMER_IGNORE_PATTERN = [
+                ".DS_STORE/*"
+                "desktop.ini"
+                ".stfolder/*"
+                ".stversions/*"
+              ];
 
-            PAPERLESS_FILENAME_FORMAT = "{correspondent}/{created} {title} {asn}";
-            PAPERLESS_FILENAME_FORMAT_REMOVE_NONE = true;
+              PAPERLESS_FILENAME_FORMAT = "{correspondent}/{created} {title} {asn}";
+              PAPERLESS_FILENAME_FORMAT_REMOVE_NONE = true;
+            };
           };
+          system.stateVersion = "24.11";
         };
-        system.stateVersion = "24.11";
-      };
     };
 
   users.groups.rauthy = { };
@@ -1105,7 +1163,7 @@
   virtualisation.containers = {
     enable = true;
     policy = {
-      default = [{ type = "insecureAcceptAnything"; }];
+      default = [ { type = "insecureAcceptAnything"; } ];
     };
   };
   virtualisation.podman = {
@@ -1127,7 +1185,8 @@ "x-systemd.idle-timeout=1h"
           "x-systemd.mount-timeout=5s"
         ];
       in
-      automount_opts ++ [
+      automount_opts
+      ++ [
         "credentials=${config.age.secrets.cifs-transmission.path}"
         "seal"
         "multichannel"
@@ -1168,68 +1227,75 @@ hostPath = externalDir;
           isReadOnly = false;
         };
       };
-      config = { config, lib, pkgs, ... }: {
-        system.stateVersion = "24.11";
-        networking = {
-          useHostResolvConf = false;
-          resolvconf.enable = false;
-          firewall.trustedInterfaces = [ "tailscale0" ];
-          firewall.rejectPackets = true;
-          nameservers = hostConfig.networking.nameservers;
-        };
-        services.resolved = {
-          enable = true;
-          llmnr = "false";
-        };
-        services.tailscale = {
-          enable = true;
-          openFirewall = true;
-          permitCertUid = "caddy";
-          port = tsPort;
-        };
-        services.caddy = {
-          enable = true;
-          email = "caddy@alanpearce.eu";
-          virtualHosts = {
-            "http://" = {
-              hostName = "bt";
-              extraConfig = ''
-                redir ${tsHostname}{uri}
-              '';
-            };
-            ${tsHostname} = {
-              extraConfig = ''
-                encode zstd gzip
-                tls {
-                  get_certificate tailscale
-                }
-                reverse_proxy localhost:${toString config.services.transmission.settings.rpc-port}
-              '';
+      config =
+        {
+          config,
+          lib,
+          pkgs,
+          ...
+        }:
+        {
+          system.stateVersion = "24.11";
+          networking = {
+            useHostResolvConf = false;
+            resolvconf.enable = false;
+            firewall.trustedInterfaces = [ "tailscale0" ];
+            firewall.rejectPackets = true;
+            nameservers = hostConfig.networking.nameservers;
+          };
+          services.resolved = {
+            enable = true;
+            llmnr = "false";
+          };
+          services.tailscale = {
+            enable = true;
+            openFirewall = true;
+            permitCertUid = "caddy";
+            port = tsPort;
+          };
+          services.caddy = {
+            enable = true;
+            email = "caddy@alanpearce.eu";
+            virtualHosts = {
+              "http://" = {
+                hostName = "bt";
+                extraConfig = ''
+                  redir ${tsHostname}{uri}
+                '';
+              };
+              ${tsHostname} = {
+                extraConfig = ''
+                  encode zstd gzip
+                  tls {
+                    get_certificate tailscale
+                  }
+                  reverse_proxy localhost:${toString config.services.transmission.settings.rpc-port}
+                '';
+              };
             };
           };
-        };
-        services.transmission = {
-          enable = true;
-          openFirewall = true;
-          webHome = pkgs.flood-for-transmission;
-          settings = {
-            utp-enabled = true;
-            incomplete-dir-enabled = true;
-            incomplete-dir = "/srv/transmission/leeching";
-            download-dir = "/srv/transmission/seeding";
-            watch-dir = "/srv/transmission/watch";
-            watch-dir-enabled = true;
-            rpc-bind-address = "::1";
-            rpc-whitelist-enabled = false;
-            rpc-host-whitelist = tsHostname;
-            rpc-host-whitelist-enabled = true;
+          services.transmission = {
+            enable = true;
+            openFirewall = true;
+            webHome = pkgs.flood-for-transmission;
+            settings = {
+              utp-enabled = true;
+              incomplete-dir-enabled = true;
+              incomplete-dir = "/srv/transmission/leeching";
+              download-dir = "/srv/transmission/seeding";
+              watch-dir = "/srv/transmission/watch";
+              watch-dir-enabled = true;
+              rpc-bind-address = "::1";
+              rpc-whitelist-enabled = false;
+              rpc-host-whitelist = tsHostname;
+              rpc-host-whitelist-enabled = true;
+            };
           };
-        };
-        systemd.services.transmission = {
-          serviceConfig = {
-            RootDirectory = lib.mkForce "";
+          systemd.services.transmission = {
+            serviceConfig = {
+              RootDirectory = lib.mkForce "";
+            };
           };
         };
-      };
     };
 }

@@ -1,7 +1,9 @@
-{ pkgs
-, lib
-, ...
-}: {
+{
+  pkgs,
+  lib,
+  ...
+}:
+{
   imports = [
     ./settings/darwin.nix
     ./settings/dev.nix

@@ -1,31 +1,37 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [
-      (modulesPath + "/installer/scan/not-detected.nix")
-    ];
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
 
   boot.initrd.availableKernelModules = [ "nvme" ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
-    {
-      device = "/dev/disk/by-uuid/7c2a0514-b94f-4369-8898-4d038740a2cd";
-      fsType = "ext4";
-    };
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/7c2a0514-b94f-4369-8898-4d038740a2cd";
+    fsType = "ext4";
+  };
 
-  fileSystems."/boot" =
-    {
-      device = "/dev/disk/by-uuid/EFF6-3E55";
-      fsType = "vfat";
-      options = [ "fmask=0027" "dmask=0027" ];
-    };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/EFF6-3E55";
+    fsType = "vfat";
+    options = [
+      "fmask=0027"
+      "dmask=0027"
+    ];
+  };
 
   nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
 }

@@ -1,5 +1,10 @@
 # vim: si ai sts=2 sw=2
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   wan = "wan0";
@@ -56,8 +61,14 @@ networking = {
     useDHCP = false;
     inherit domain hostName;
     hosts = {
-      "fd7a:115c:a1e0::53" = [ "tailscale" "ts" ];
-      "192.168.100.1" = [ "modem" "pyur" ];
+      "fd7a:115c:a1e0::53" = [
+        "tailscale"
+        "ts"
+      ];
+      "192.168.100.1" = [
+        "modem"
+        "pyur"
+      ];
     };
     nameservers = [
       "9.9.9.11"
@@ -169,12 +180,14 @@ };
         ipv6AcceptRAConfig = {
           UseDNS = false;
         };
-        addresses = [{
-          Address = "192.168.100.10/24";
-          Peer = "192.168.100.1/32";
-          Label = "${wan}:0";
-          Scope = "link";
-        }];
+        addresses = [
+          {
+            Address = "192.168.100.10/24";
+            Peer = "192.168.100.1/32";
+            Label = "${wan}:0";
+            Scope = "link";
+          }
+        ];
         cakeConfig = {
           Bandwidth = "24M";
           OverheadBytes = 18;
@@ -385,7 +398,10 @@ systemd.services.backup-golink = {
     enable = true;
     startAt = "daily";
     description = "Export short links from golink";
-    path = with pkgs; [ curl gitMinimal ];
+    path = with pkgs; [
+      curl
+      gitMinimal
+    ];
     script = ''
       [ -d golink ] || git init --quiet golink --initial-branch=main --shared=world
       git config --global user.email linde@alanpearce.eu
@@ -449,19 +465,21 @@ dataDir = "/srv/syncthing";
     user = "syncthing";
     group = "syncthing";
     key = config.age.secrets.syncthing.path;
-    cert = toString (pkgs.writeText "syncthing.crt" ''
-      -----BEGIN CERTIFICATE-----
-      MIIBmjCCASCgAwIBAgIIUOEmXGFrrX0wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ
-      c3luY3RoaW5nMB4XDTIyMDcxMzEwMzIxOVoXDTQ5MTIzMTIzNTk1OVowFDESMBAG
-      A1UEAxMJc3luY3RoaW5nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEPiJT41NqucQf
-      UXiBwt+yPYnMg9G8oTt9XNA72V99K46D7mIs1F/5oESlDiCSAngXPsajxRY7wyZV
-      VoiWegfiaBOGZmq+TyaLlQ5bq/hm/Mp/jVED/rUA+BggohoZZMa2oz8wPTAOBgNV
-      HQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1Ud
-      EwEB/wQCMAAwCgYIKoZIzj0EAwIDaAAwZQIwLp4Gv5EEmjRO9EphbYJ4jxEJks7E
-      oblgnTmhfWmVWmf9avJyeGB212VYu4X8cCKDAjEAn7tTB9Y6LZvYPaLSwUKY3EzF
-      hKTYCb7VA/P1dU3tTR1vSQxnu1DsiliD/XcKe2IK
-      -----END CERTIFICATE-----
-    '');
+    cert = toString (
+      pkgs.writeText "syncthing.crt" ''
+        -----BEGIN CERTIFICATE-----
+        MIIBmjCCASCgAwIBAgIIUOEmXGFrrX0wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ
+        c3luY3RoaW5nMB4XDTIyMDcxMzEwMzIxOVoXDTQ5MTIzMTIzNTk1OVowFDESMBAG
+        A1UEAxMJc3luY3RoaW5nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEPiJT41NqucQf
+        UXiBwt+yPYnMg9G8oTt9XNA72V99K46D7mIs1F/5oESlDiCSAngXPsajxRY7wyZV
+        VoiWegfiaBOGZmq+TyaLlQ5bq/hm/Mp/jVED/rUA+BggohoZZMa2oz8wPTAOBgNV
+        HQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1Ud
+        EwEB/wQCMAAwCgYIKoZIzj0EAwIDaAAwZQIwLp4Gv5EEmjRO9EphbYJ4jxEJks7E
+        oblgnTmhfWmVWmf9avJyeGB212VYu4X8cCKDAjEAn7tTB9Y6LZvYPaLSwUKY3EzF
+        hKTYCb7VA/P1dU3tTR1vSQxnu1DsiliD/XcKe2IK
+        -----END CERTIFICATE-----
+      ''
+    );
     overrideFolders = false;
     overrideDevices = false;
     settings = {

@@ -1,33 +1,39 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
 
   boot.initrd.availableKernelModules = [ "nvme" ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/6adfb32b-ebe9-4116-86e8-829d2c9dc79d";
-      fsType = "ext4";
-    };
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/6adfb32b-ebe9-4116-86e8-829d2c9dc79d";
+    fsType = "ext4";
+  };
 
-  fileSystems."/mnt/sd" =
-    { device = "/dev/disk/by-uuid/79d9c190-1728-42ae-8cfd-b03d4a10bdb3";
-      fsType = "ext4";
-    };
+  fileSystems."/mnt/sd" = {
+    device = "/dev/disk/by-uuid/79d9c190-1728-42ae-8cfd-b03d4a10bdb3";
+    fsType = "ext4";
+  };
 
-  fileSystems."/boot" =
-    { device = "/mnt/sd/boot";
-      fsType = "none";
-      options = [ "bind" ];
-    };
+  fileSystems."/boot" = {
+    device = "/mnt/sd/boot";
+    fsType = "none";
+    options = [ "bind" ];
+  };
 
   swapDevices = [ ];
 

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   imports = [
     ./settings/base.nix
     ./settings/configuration/berlin.nix
@@ -66,16 +68,28 @@ boot.extraModulePackages = with config.boot.kernelPackages; [
     zenpower
   ];
 
-  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "ahci"
+    "usbhid"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-amd" ];
 
-  boot.initrd.supportedFilesystems = [ "xfs" "ext4" ];
+  boot.initrd.supportedFilesystems = [
+    "xfs"
+    "ext4"
+  ];
   fileSystems = {
     "/" = {
       device = "/dev/disk/by-partlabel/nixos";
       fsType = "xfs";
-      options = [ "lazytime" "nodiscard" ];
+      options = [
+        "lazytime"
+        "nodiscard"
+      ];
     };
 
     "/boot" = {
@@ -86,13 +100,21 @@
     "/home" = {
       device = "/dev/disk/by-partlabel/home";
       fsType = "ext4";
-      options = [ "lazytime" "nodiscard" ];
+      options = [
+        "lazytime"
+        "nodiscard"
+      ];
     };
 
     "/mnt/data" = {
       device = "/dev/disk/by-partlabel/data";
       fsType = "ntfs3";
-      options = [ "uid=1000" "gid=100" "x-systemd-automount" "nofail" ];
+      options = [
+        "uid=1000"
+        "gid=100"
+        "x-systemd-automount"
+        "nofail"
+      ];
     };
   };
 
@@ -145,8 +167,14 @@ interfaces.enp7s0 = {
       useDHCP = true;
     };
     hosts = {
-      "fd7a:115c:a1e0::53" = [ "tailscale" "ts" ];
-      "::1" = [ "alanpearce.test" "alanpearce.localhost" ];
+      "fd7a:115c:a1e0::53" = [
+        "tailscale"
+        "ts"
+      ];
+      "::1" = [
+        "alanpearce.test"
+        "alanpearce.localhost"
+      ];
     };
 
     nftables = {
@@ -192,7 +220,10 @@ ''
   ];
 
   boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
-  nix.settings.trusted-users = [ "root" "nixremote" ];
+  nix.settings.trusted-users = [
+    "root"
+    "nixremote"
+  ];
   services.displayManager.hiddenUsers = [ "nixremote" ];
   users.users.nixremote = {
     shell = "/bin/sh";

@@ -1,7 +1,8 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
 {
   boot.loader.timeout = lib.mkDefault 1;

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   time.timeZone = "Europe/Berlin";
   location = {
     latitude = 52.586;

@@ -1,6 +1,8 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   i18n.defaultLocale = "en_GB.UTF-8";
 }

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   imports = [
     ./nix.nix
   ];

@@ -1,8 +1,10 @@
-{ inputs
-, pkgs
-, lib
-, ...
-}: {
+{
+  inputs,
+  pkgs,
+  lib,
+  ...
+}:
+{
   nix = {
     package = pkgs.lix;
     settings = {
@@ -30,14 +32,16 @@ options = lib.mkDefault "--delete-older-than 14d";
     };
 
     registry =
-      if pkgs.stdenv.isDarwin
-      then {
-        nixpkgs.flake = inputs.nixpkgs;
-      } else {
-        nixpkgs.to = {
-          type = "path";
-          path = pkgs.path;
+      if pkgs.stdenv.isDarwin then
+        {
+          nixpkgs.flake = inputs.nixpkgs;
+        }
+      else
+        {
+          nixpkgs.to = {
+            type = "path";
+            path = pkgs.path;
+          };
         };
-      };
   };
 }

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   users.extraUsers.alan = {
     description = "Alan Pearce";
     isNormalUser = true;

@@ -1,8 +1,10 @@
-{ config
-, pkgs
-, lib
-, ...
-}: {
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
   imports = [
     ./configuration/nix.nix
   ];
@@ -10,10 +12,15 @@ services.nix-daemon = {
     enableSocketListener = false;
   };
 
-  environment.profiles = with lib; mkMerge [
-    (mkOrder 800 [ "\${XDG_STATE_HOME:-$HOME/.local/state}/nix/profile" ])
-    [ "/run/current-system/sw" "/nix/var/nix/profiles/default" ]
-  ];
+  environment.profiles =
+    with lib;
+    mkMerge [
+      (mkOrder 800 [ "\${XDG_STATE_HOME:-$HOME/.local/state}/nix/profile" ])
+      [
+        "/run/current-system/sw"
+        "/nix/var/nix/profiles/default"
+      ]
+    ];
 
   nix = {
     settings.extra-platforms = "aarch64-darwin x86_64-darwin";

@@ -1,7 +1,8 @@
-{ config
-, lib
-, pkgs
-, ...
+{
+  config,
+  lib,
+  pkgs,
+  ...
 }:
 with lib;
 
@@ -125,9 +126,10 @@ };
 
     services.dnsmasq = mkIf pkgs.stdenv.isDarwin {
       enable = true;
+      bind = "::1";
       addresses = {
-        localhost = "127.0.0.1";
-        test = "127.0.0.1";
+        localhost = "::1";
+        test = "::1";
       };
     };
   };

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   security.rtkit.enable = true;
   programs.steam.enable = true;
   programs.gamemode = {

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   programs.adb.enable = true;
   users.groups.adbusers = { };
 

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   services.pipewire = {
     enable = true;
     audio.enable = true;

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   environment.systemPackages = with pkgs; [
     exfat
     efibootmgr
@@ -48,6 +50,12 @@ algorithm = "zstd";
   };
   boot.tmp.useTmpfs = true;
 
-  fileSystems."/".options = [ "noatime" "nodiratime" ];
-  fileSystems."/home".options = [ "noatime" "nodiratime" ];
+  fileSystems."/".options = [
+    "noatime"
+    "nodiratime"
+  ];
+  fileSystems."/home".options = [
+    "noatime"
+    "nodiratime"
+  ];
 }

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   hardware = {
     bluetooth = {
       package = pkgs.bluezFull;

@@ -1,8 +1,10 @@
-{ config
-, pkgs
-, lib
-, ...
-}: {
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
   hardware = {
     bluetooth = {
       enable = true;

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   services.connman = {
     enable = true;
     enableVPN = false;

@@ -1,8 +1,10 @@
-{ config
-, pkgs
-, lib
-, ...
-}: {
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
   boot.loader = {
     grub = {
       enable = true;

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   networking.wireless.iwd = {
     enable = true;
   };

@@ -1,4 +1,5 @@
-{ ... }: {
+{ ... }:
+{
   systemd.tmpfiles.settings."fix-lofree-keyboard" = {
     "/sys/module/hid_apple/parameters/fnmode" = {
       w = {

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   services.xserver.xkb = {
     layout = "us,de";
     variant = "intl-unicode,nodeadkeys";

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   services.udev.extraRules = ''
     SUBSYSTEMS=="usb", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="2300", SYMLINK+="model01", ENV{ID_MM_DEVICE_IGNORE}:="1", ENV{ID_MM_CANDIDATE}:="0"
     SUBSYSTEMS=="usb", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="2301", SYMLINK+="model01", ENV{ID_MM_DEVICE_IGNORE}:="1", ENV{ID_MM_CANDIDATE}:="0"

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   services.libinput = {
     enable = true;
     mouse = {

@@ -1,8 +1,10 @@
-{ config
-, pkgs
-, lib
-, ...
-}: {
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
   hardware.nitrokey = {
     enable = true;
   };

@@ -1,7 +1,8 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
 {
   services.xserver.videoDrivers = [ "nvidia" ];

@@ -1,8 +1,10 @@
-{ config
-, pkgs
-, lib
-, ...
-}: {
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
   services.printing.enable = true;
   systemd.services.cups.wantedBy = lib.mkForce [ ];
   systemd.sockets.cups.wantedBy = [ "sockets.target" ];

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   boot.loader.systemd-boot = {
     enable = true;
     editor = false; # Don't allow modification

@@ -1,11 +1,18 @@
-{ config
-, lib
-, pkgs
-, ...
-}: {
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
   services.trezord.enable = true;
   environment.systemPackages = with pkgs; [
-    (python3.withPackages (ps: with ps; [ trezor_agent wheel ]))
+    (python3.withPackages (
+      ps: with ps; [
+        trezor_agent
+        wheel
+      ]
+    ))
     trezor-suite
   ];
 }

@@ -1,10 +1,14 @@
-{ pkgs, ... }: {
-  environment.systemPackages = with pkgs; [
-    brotli
-    lzop
-    zstd
-    pwgen-secure
-  ] ++ (lib.optionals (stdenv.isLinux) [
-    psmisc
-  ]);
+{ pkgs, ... }:
+{
+  environment.systemPackages =
+    with pkgs;
+    [
+      brotli
+      lzop
+      zstd
+      pwgen-secure
+    ]
+    ++ (lib.optionals (stdenv.isLinux) [
+      psmisc
+    ]);
 }

@@ -1,4 +1,5 @@
-{ pkgs, ... }: {
+{ pkgs, ... }:
+{
   virtualisation.containers = {
     enable = true;
   };

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   services.xserver.windowManager = {
     i3 = {
       enable = true;

@@ -1,7 +1,8 @@
-{ config
-, lib
-, pkgs
-, ...
+{
+  config,
+  lib,
+  pkgs,
+  ...
 }:
 {
   services = {
@@ -18,13 +19,16 @@
     physlock.enable = lib.mkForce false;
   };
 
-  environment.systemPackages = with pkgs; [
-    kde-gtk-config
-    plasma-browser-integration
-  ] ++ (with libsForQt5; [
-    merkuro
-    kmail
-  ]);
+  environment.systemPackages =
+    with pkgs;
+    [
+      kde-gtk-config
+      plasma-browser-integration
+    ]
+    ++ (with libsForQt5; [
+      merkuro
+      kmail
+    ]);
 
   services.picom.enable = false;
   services.blueman.enable = false;

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   programs.fish = {
     enable = true;
     useBabelfish = true;

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   services.pipewire.systemWide = false;
   services.shairport-sync = {
     enable = true;

@@ -1,10 +1,16 @@
-{ config
-, lib
-, pkgs
-, ...
+{
+  config,
+  lib,
+  pkgs,
+  ...
 }:
 let
-  inherit (lib) pipe flatten concatMapAttrs mapAttrsToList;
+  inherit (lib)
+    pipe
+    flatten
+    concatMapAttrs
+    mapAttrsToList
+    ;
   inherit (import ../../../lib/caddy.nix { inherit lib; }) security-headers;
 
   domain = "alin.ovh";
@@ -28,22 +34,41 @@ };
   };
 
   repoMirrors = {
-    nixfiles = [ "sourcehut" "codeberg" ];
-    searchix = [ "sourcehut" "codeberg" ];
+    nixfiles = [
+      "sourcehut"
+      "codeberg"
+    ];
+    searchix = [
+      "sourcehut"
+      "codeberg"
+    ];
     website = [ "sourcehut" ];
     homestead = [ "sourcehut" ];
     legit = [ "github" ];
     elgit = [ "codeberg" ];
-    gomponents = [ "sourcehut" "github" ];
-    nix-packages = [ "sourcehut" "github" ];
-    zola-bearblog = [ "sourcehut" "codeberg" ];
+    gomponents = [
+      "sourcehut"
+      "github"
+    ];
+    nix-packages = [
+      "sourcehut"
+      "github"
+    ];
+    zola-bearblog = [
+      "sourcehut"
+      "codeberg"
+    ];
   };
 
   createMirrorService =
-    name: { hostname, username }:
+    name:
+    { hostname, username }:
     {
       "mirror-to-${name}@" = {
-        path = with pkgs; [ gitMinimal openssh ];
+        path = with pkgs; [
+          gitMinimal
+          openssh
+        ];
         serviceConfig = {
           Type = "oneshot";
           User = "gitolite";
@@ -57,7 +82,9 @@ };
       };
     };
 
-  createMirrorPath = name: { ... }:
+  createMirrorPath =
+    name:
+    { ... }:
     {
       "mirror-to-${name}@" = {
         pathConfig = {
@@ -67,7 +94,6 @@ StartLimitBurst = 5;
         };
       };
     };
-
 
   mkMirrorWants = repo: map (target: "mirror-to-${target}@${repo}.path");
 in
@@ -141,8 +167,7 @@ systemd.services = concatMapAttrs createMirrorService mirrors;
   systemd.paths = concatMapAttrs createMirrorPath mirrors;
   systemd.targets.git-mirroring = {
     wantedBy = [ "multi-user.target" ];
-    wants = pipe
-      repoMirrors [
+    wants = pipe repoMirrors [
       (mapAttrsToList mkMirrorWants)
       flatten
     ];

@@ -1,6 +1,7 @@
-{ config
-, pkgs
-, ...
+{
+  config,
+  pkgs,
+  ...
 }:
 let
   workgroup = "WORKGROUP";

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   services.syncthing = {
     enable = true;
     user = "alan";

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   virtualisation.libvirtd = {
     enable = true;
     onBoot = "ignore";

@@ -1,9 +1,11 @@
-{ config
-, lib
-, pkgs
-, ...
+{
+  config,
+  lib,
+  pkgs,
+  ...
 }:
-with lib; {
+with lib;
+{
   services.xserver = {
     enable = true;
     exportConfiguration = true;
@@ -49,7 +51,8 @@ </match>
         </fontconfig>
       '';
     };
-    packages = with pkgs;
+    packages =
+      with pkgs;
       [
         corefonts
         xorg.fontmiscmisc

@@ -1,8 +1,10 @@
-{ config
-, pkgs
-, lib
-, ...
-}: {
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
   services.avahi = {
     enable = true;
     nssmdns4 = true;

@@ -1,8 +1,10 @@
-{ config
-, pkgs
-, lib
-, ...
-}: {
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
   documentation.info.enable = true;
 
   environment.systemPackages = with pkgs; [

@@ -3,12 +3,14 @@ let
   inherit (pkgs) lib;
 in
 {
-  allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
-    "beeper"
-    "discord"
-    "input-fonts"
-    "tabnine"
-  ];
+  allowUnfreePredicate =
+    pkg:
+    builtins.elem (lib.getName pkg) [
+      "beeper"
+      "discord"
+      "input-fonts"
+      "tabnine"
+    ];
   input-fonts.acceptLicense = true;
   permittedInsecurePackages = [ ];
 }

@@ -1,4 +1,5 @@
-{ config, pkgs, ... }: {
+{ config, pkgs, ... }:
+{
   imports = [
     ./settings/base.nix
     ./settings/development/base.nix
@@ -42,7 +43,10 @@ launchd.agents = {
     ollama = {
       enable = true;
       config = {
-        ProgramArguments = [ "${pkgs.ollama}/bin/ollama" "serve" ];
+        ProgramArguments = [
+          "${pkgs.ollama}/bin/ollama"
+          "serve"
+        ];
         RunAtLoad = true;
         KeepAlive = true;
         WorkingDirectory = "/Users/alan";
@@ -61,7 +65,10 @@
   launchd.agents.colima = {
     enable = true;
     config = {
-      ProgramArguments = [ "/Users/alan/.local/state/nix/profile/bin/colima" "start" ];
+      ProgramArguments = [
+        "/Users/alan/.local/state/nix/profile/bin/colima"
+        "start"
+      ];
       RunAtLoad = true;
       # It doesn't run in the foreground, yet...
       # KeepAlive = true;

@@ -1,9 +1,11 @@
-{ config
-, lib
-, pkgs
-, ...
+{
+  config,
+  lib,
+  pkgs,
+  ...
 }:
-with lib; let
+with lib;
+let
   cfg = config.programs.emacs;
 in
 {

@@ -1,9 +1,11 @@
-{ config
-, lib
-, pkgs
-, ...
+{
+  config,
+  lib,
+  pkgs,
+  ...
 }:
-with lib; let
+with lib;
+let
   inherit (pkgs) stdenv;
   tomlFormat = pkgs.formats.toml { };
   cfg = config.programs.tabnine;
@@ -15,9 +17,7 @@
     configDir = mkOption {
       type = types.str;
       default =
-        if stdenv.isDarwin
-        then "Library/Preferences/TabNine"
-        else "${config.xdg.configHome}/TabNine";
+        if stdenv.isDarwin then "Library/Preferences/TabNine" else "${config.xdg.configHome}/TabNine";
       description = ''
         Location of TabNine configuration directory relative to \$HOME
       '';

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   imports = [
     ./settings/base.nix
     ./settings/dunst.nix

@@ -1,5 +1,6 @@
-{ config
-, ...
+{
+  config,
+  ...
 }:
 {
   imports = [

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   home.packages = with pkgs; [
     ledger
     hledger
@@ -9,10 +11,14 @@ bean-add
     beancount
     reckon
   ];
-  programs.emacs.extraPackages = epkgs: (with epkgs; [
-    (treesit-grammars.with-grammars (grammars: with grammars; [
-      tree-sitter-beancount
-      tree-sitter-ledger
-    ]))
-  ]);
+  programs.emacs.extraPackages =
+    epkgs:
+    (with epkgs; [
+      (treesit-grammars.with-grammars (
+        grammars: with grammars; [
+          tree-sitter-beancount
+          tree-sitter-ledger
+        ]
+      ))
+    ]);
 }

@@ -1,8 +1,10 @@
-{ config
-, lib
-, pkgs
-, ...
-}: {
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
   home.packages = with pkgs; [
     (aider-chat.withOptional { withPlaywright = true; })
   ];
@@ -12,20 +14,22 @@ let
       yaml = pkgs.formats.yaml { };
     in
     {
-      source = (yaml.generate "aider.conf.yml" {
-        alias = [
-          "general:ollama_chat/gemma3:27b"
-          "editor:openrouter/openai/gpt-4o-mini"
-        ];
-        model = "editor";
-        editor-model = "editor";
-        light-mode = true;
-        gitignore = false;
-        check-update = false;
-        attribute-author = false;
-        attribute-committer = false;
-        analytics-disable = true;
-      });
+      source = (
+        yaml.generate "aider.conf.yml" {
+          alias = [
+            "general:ollama_chat/gemma3:27b"
+            "editor:openrouter/openai/gpt-4o-mini"
+          ];
+          model = "editor";
+          editor-model = "editor";
+          light-mode = true;
+          gitignore = false;
+          check-update = false;
+          attribute-author = false;
+          attribute-committer = false;
+          analytics-disable = true;
+        }
+      );
     };
 
   programs.git.ignores = [

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   imports = [
     ./neovim.nix
     ./shell.nix
@@ -37,9 +39,10 @@ };
   xdg = {
     enable = true;
     cacheHome =
-      if pkgs.stdenv.isDarwin
-      then "${config.home.homeDirectory}/Library/Caches/XDG"
-      else "${config.home.homeDirectory}/.cache";
+      if pkgs.stdenv.isDarwin then
+        "${config.home.homeDirectory}/Library/Caches/XDG"
+      else
+        "${config.home.homeDirectory}/.cache";
     configHome = "${config.home.homeDirectory}/.config";
     dataHome = "${config.home.homeDirectory}/.local/share";
     stateHome = "${config.home.homeDirectory}/.local/state";
@@ -60,7 +63,8 @@ arguments = [
       "--smart-case"
     ];
   };
-  home.packages = with pkgs;
+  home.packages =
+    with pkgs;
     [
       pv
       fd
@@ -71,13 +75,16 @@ dateutils
       moreutils
       tree
       abduco
-    ] ++ (
-      if !stdenv.isDarwin
-      then [
-        file
-        lsof
-        unar
-        zip
-      ] else [ ]
+    ]
+    ++ (
+      if !stdenv.isDarwin then
+        [
+          file
+          lsof
+          unar
+          zip
+        ]
+      else
+        [ ]
     );
 }

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   home.packages = with pkgs; [
     signal-desktop
     wire-desktop

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   home.packages = with pkgs; [
     darwin.trash
     maid
@@ -28,11 +30,13 @@ "-14 days"
         ];
         KeepAlive = false;
         RunAtLoad = false;
-        StartCalendarInterval = [{
-          Hour = 12;
-          Minute = 00;
-          Weekday = 6; # Saturday
-        }];
+        StartCalendarInterval = [
+          {
+            Hour = 12;
+            Minute = 0;
+            Weekday = 6; # Saturday
+          }
+        ];
         ProcessType = "Background";
         LowPriorityBackgroundIO = true;
       };
@@ -62,8 +66,8 @@ RunAtLoad = true;
         KeepAlive = false;
         ProgramArguments = [
           "/bin/sh"
-          (toString (pkgs.writeShellScript "toggle-dark-light-mode"
-            ''
+          (toString (
+            pkgs.writeShellScript "toggle-dark-light-mode" ''
               wait4path /nix
               if defaults read -g AppleInterfaceStyle &>/dev/null ; then
                 MODE="dark"

@@ -1,10 +1,12 @@
-{ config
-, pkgs
-, ...
+{
+  config,
+  pkgs,
+  ...
 }:
 {
   imports = [ ../../modules/tabnine.nix ];
-  home.packages = with pkgs;
+  home.packages =
+    with pkgs;
     [
       shellcheck
       shfmt
@@ -33,7 +35,8 @@
       skopeo
       docker-credential-helpers
       dive
-    ] ++ (lib.optionals stdenv.isDarwin [
+    ]
+    ++ (lib.optionals stdenv.isDarwin [
       lima
       colima
       docker-client
@@ -44,16 +47,20 @@ FLY_NO_UPDATE_CHECK = "1";
     LIMA_INSTANCE = "nixos";
   };
 
-  programs.emacs.extraPackages = epkgs: (with epkgs; [
-    (treesit-grammars.with-grammars (grammars: with grammars; [
-      tree-sitter-bash
-      tree-sitter-fish
-      tree-sitter-just
-      tree-sitter-make
-      tree-sitter-dockerfile
-      tree-sitter-sql
-    ]))
-  ]);
+  programs.emacs.extraPackages =
+    epkgs:
+    (with epkgs; [
+      (treesit-grammars.with-grammars (
+        grammars: with grammars; [
+          tree-sitter-bash
+          tree-sitter-fish
+          tree-sitter-just
+          tree-sitter-make
+          tree-sitter-dockerfile
+          tree-sitter-sql
+        ]
+      ))
+    ]);
 
   programs.nixvim.plugins = {
     lsp.servers = {
@@ -95,10 +102,18 @@ };
   };
 
   programs.fish.shellAbbrs = {
-    b = { function = "projectdo_build"; };
-    r = { function = "projectdo_run"; };
-    t = { function = "projectdo_test"; };
-    p = { function = "projectdo_tool"; };
+    b = {
+      function = "projectdo_build";
+    };
+    r = {
+      function = "projectdo_run";
+    };
+    t = {
+      function = "projectdo_test";
+    };
+    p = {
+      function = "projectdo_tool";
+    };
     ciq = "laminarc queue $(basename $PWD) ref=refs/heads/$(git branch --show-current) rev=$(git rev-parse @)";
   };
   home.shellAliases = {

@@ -1,16 +1,22 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   home.packages = with pkgs; [
     clojure
     cljfmt
   ];
-  programs.emacs.extraPackages = epkgs: (with epkgs; [
-    cider
-    clojure-mode
-    (treesit-grammars.with-grammars (grammars: with grammars; [
-      tree-sitter-clojure
-    ]))
-  ]);
+  programs.emacs.extraPackages =
+    epkgs:
+    (with epkgs; [
+      cider
+      clojure-mode
+      (treesit-grammars.with-grammars (
+        grammars: with grammars; [
+          tree-sitter-clojure
+        ]
+      ))
+    ]);
 }

@@ -1,4 +1,5 @@
-{ pkgs, ... }: {
+{ pkgs, ... }:
+{
   home.packages = with pkgs; [
     go
     gopls
@@ -26,17 +27,21 @@ gog = "go get";
     gogu = "go get -u";
   };
   home.sessionVariables.GOTOOLCHAIN = "local"; # use installed go tools
-  programs.emacs.extraPackages = epkgs: (with epkgs; [
-    go-eldoc
-    go-tag
-    templ-ts-mode
-    (treesit-grammars.with-grammars (grammars: with grammars; [
-      tree-sitter-go
-      tree-sitter-gowork
-      tree-sitter-gomod
-      tree-sitter-templ
-    ]))
-  ]);
+  programs.emacs.extraPackages =
+    epkgs:
+    (with epkgs; [
+      go-eldoc
+      go-tag
+      templ-ts-mode
+      (treesit-grammars.with-grammars (
+        grammars: with grammars; [
+          tree-sitter-go
+          tree-sitter-gowork
+          tree-sitter-gomod
+          tree-sitter-templ
+        ]
+      ))
+    ]);
   programs.nixvim.plugins.lsp.servers = {
     gopls.enable = true;
     golangci_lint_ls.enable = true;

@@ -1,14 +1,18 @@
-{ config
-, pkgs
-, ...
+{
+  config,
+  pkgs,
+  ...
 }:
 {
-  home.packages = with pkgs.nodePackages; [
-    node2nix
-    typescript-language-server
-  ] ++ (with pkgs; [
-    vtsls
-  ]);
+  home.packages =
+    with pkgs.nodePackages;
+    [
+      node2nix
+      typescript-language-server
+    ]
+    ++ (with pkgs; [
+      vtsls
+    ]);
 
   home.sessionVariables = {
     NO_UPDATE_NOTIFIER = "1"; # stop npm update-notifier
@@ -24,17 +28,21 @@ };
     };
   };
 
-  programs.emacs.extraPackages = epkgs: (with epkgs; [
-    astro-ts-mode
-    svelte-mode
-    (treesit-grammars.with-grammars (grammars: with grammars; [
-      tree-sitter-jsdoc
-      tree-sitter-svelte
-      tree-sitter-tsx
-      tree-sitter-typescript
-      tree-sitter-javascript
-    ]))
-  ]);
+  programs.emacs.extraPackages =
+    epkgs:
+    (with epkgs; [
+      astro-ts-mode
+      svelte-mode
+      (treesit-grammars.with-grammars (
+        grammars: with grammars; [
+          tree-sitter-jsdoc
+          tree-sitter-svelte
+          tree-sitter-tsx
+          tree-sitter-typescript
+          tree-sitter-javascript
+        ]
+      ))
+    ]);
 
   home.shellAliases = {
     bn = "bun";

@@ -1,21 +1,30 @@
-{ config
-, pkgs
-, ...
-}: {
-  home.packages = with pkgs; [
-    clisp
-    sbcl
-    asdf
-    cl-launch
-  ] ++ lib.optionals pkgs.stdenv.hostPlatform.isLinux [
-    ccl
-  ];
+{
+  config,
+  pkgs,
+  ...
+}:
+{
+  home.packages =
+    with pkgs;
+    [
+      clisp
+      sbcl
+      asdf
+      cl-launch
+    ]
+    ++ lib.optionals pkgs.stdenv.hostPlatform.isLinux [
+      ccl
+    ];
 
-  programs.emacs.extraPackages = epkgs: (with epkgs; [
-    (treesit-grammars.with-grammars (grammars: with grammars; [
-      tree-sitter-commonlisp
-    ]))
-  ]);
+  programs.emacs.extraPackages =
+    epkgs:
+    (with epkgs; [
+      (treesit-grammars.with-grammars (
+        grammars: with grammars; [
+          tree-sitter-commonlisp
+        ]
+      ))
+    ]);
 
   programs.git.attributes = [
     "*.lisp diff=common-lisp"

@@ -1,13 +1,17 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   home.packages = with pkgs; [
     nim
     nimble
     nimlsp
   ];
-  programs.emacs.extraPackages = epkgs: (with epkgs; [
-    nim-mode
-  ]);
+  programs.emacs.extraPackages =
+    epkgs:
+    (with epkgs; [
+      nim-mode
+    ]);
 }

@@ -1,13 +1,19 @@
-{ pkgs
-, ...
-}: {
+{
+  pkgs,
+  ...
+}:
+{
   home.packages = with pkgs; [
     ty
     uv
   ];
-  programs.emacs.extraPackages = epkgs: (with epkgs; [
-    (treesit-grammars.with-grammars (grammars: with grammars; [
-      tree-sitter-python
-    ]))
-  ]);
+  programs.emacs.extraPackages =
+    epkgs:
+    (with epkgs; [
+      (treesit-grammars.with-grammars (
+        grammars: with grammars; [
+          tree-sitter-python
+        ]
+      ))
+    ]);
 }

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   home.packages = with pkgs; [
     cargo
     cargo-edit
@@ -10,9 +12,13 @@ rustfmt
     rust-analyzer
     clippy
   ];
-  programs.emacs.extraPackages = epkgs: (with epkgs; [
-    (treesit-grammars.with-grammars (grammars: with grammars; [
-      tree-sitter-rust
-    ]))
-  ]);
+  programs.emacs.extraPackages =
+    epkgs:
+    (with epkgs; [
+      (treesit-grammars.with-grammars (
+        grammars: with grammars; [
+          tree-sitter-rust
+        ]
+      ))
+    ]);
 }

@@ -1,10 +1,14 @@
-{ pkgs
-, ...
-}: {
+{
+  pkgs,
+  ...
+}:
+{
   home.packages = with pkgs; [
     vlang
   ];
-  programs.emacs.extraPackages = epkgs: (with epkgs; [
-    v-mode
-  ]);
+  programs.emacs.extraPackages =
+    epkgs:
+    (with epkgs; [
+      v-mode
+    ]);
 }

@@ -1,17 +1,22 @@
-{ config
-, pkgs
-, lib
-, ...
-}: {
-  home.packages = with pkgs.nodePackages; [
-    vscode-langservers-extracted
-    csslint
-    stylelint
-  ] ++ (with pkgs; [
-    emmet-language-server
-    flyctl
-    personal.htmlformat
-  ]);
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
+  home.packages =
+    with pkgs.nodePackages;
+    [
+      vscode-langservers-extracted
+      csslint
+      stylelint
+    ]
+    ++ (with pkgs; [
+      emmet-language-server
+      flyctl
+      personal.htmlformat
+    ]);
   home.shellAliases = {
     # 0.2.25 current completion command only affects `flyctl`, although `fly` is a link to `flyctl`
     fly = "flyctl";
@@ -93,16 +98,20 @@ MoreFromMozilla = false;
       };
     };
   };
-  programs.emacs.extraPackages = epkgs: (with epkgs; [
-    caddyfile-mode
-    emmet-mode
-    nginx-mode
-    web-mode
-    (treesit-grammars.with-grammars (grammars: with grammars; [
-      tree-sitter-css
-      tree-sitter-html
-    ]))
-  ]);
+  programs.emacs.extraPackages =
+    epkgs:
+    (with epkgs; [
+      caddyfile-mode
+      emmet-mode
+      nginx-mode
+      web-mode
+      (treesit-grammars.with-grammars (
+        grammars: with grammars; [
+          tree-sitter-css
+          tree-sitter-html
+        ]
+      ))
+    ]);
   programs.nixvim.plugins = {
     lsp.servers = {
       emmet_language_server.enable = true;

@@ -1,13 +1,17 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   home.packages = with pkgs; [
     zls
   ];
-  programs.emacs.extraPackages = epkgs: (with epkgs; [
-    zig-mode
-  ]);
+  programs.emacs.extraPackages =
+    epkgs:
+    (with epkgs; [
+      zig-mode
+    ]);
   programs.nixvim.plugins = {
     zig.enable = true;
     lsp.servers.zls.enable = true;

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   services.dunst = {
     enable = true;
     settings = {

@@ -1,7 +1,8 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
 let
   inherit (pkgs) stdenv;
@@ -64,8 +65,9 @@ cdg = "cd (project-root)";
       };
     };
 
-    extraPackages = epkgs: (with epkgs;
-      [
+    extraPackages =
+      epkgs:
+      (with epkgs; [
         ace-link
         apheleia
         avy
@@ -153,14 +155,16 @@ treemacs-evil
         treemacs-magit
         treemacs-nerd-icons
         treesit-auto
-        (treesit-grammars.with-grammars (grammars: with grammars; [
-          tree-sitter-nix
-          tree-sitter-markdown
-          tree-sitter-json
-          tree-sitter-json5
-          tree-sitter-toml
-          tree-sitter-yaml
-        ]))
+        (treesit-grammars.with-grammars (
+          grammars: with grammars; [
+            tree-sitter-nix
+            tree-sitter-markdown
+            tree-sitter-json
+            tree-sitter-json5
+            tree-sitter-toml
+            tree-sitter-yaml
+          ]
+        ))
         try
         ultra-scroll
         vc-msg
@@ -203,20 +207,24 @@ lsp-mode = self.melpaPackages.lsp-mode.overrideAttrs {
         LSP_USE_PLISTS = "true"; # must be set in early-init
       };
       tabnine = self.melpaPackages.tabnine.overrideAttrs (attrs: {
-        postPatch = (attrs.postPatch or "") + ''
-          substituteInPlace tabnine-core.el \
-            --replace '(tabnine--executable-path)' '"${pkgs.tabnine}/bin/TabNine"'
-        '';
+        postPatch =
+          (attrs.postPatch or "")
+          + ''
+            substituteInPlace tabnine-core.el \
+              --replace '(tabnine--executable-path)' '"${pkgs.tabnine}/bin/TabNine"'
+          '';
       });
     };
-    extraConfig = ''
-      (with-eval-after-load 'editorconfig
-        (setq editorconfig-exec-path "${pkgs.editorconfig-core-c}/bin/editorconfig"))
-    '' + lib.optionalString stdenv.isDarwin ''
-      (with-eval-after-load 'dired
-        (setq insert-directory-program "${pkgs.coreutils-prefixed}/bin/gls"
-              dired-use-ls-dired t))
-    '';
+    extraConfig =
+      ''
+        (with-eval-after-load 'editorconfig
+          (setq editorconfig-exec-path "${pkgs.editorconfig-core-c}/bin/editorconfig"))
+      ''
+      + lib.optionalString stdenv.isDarwin ''
+        (with-eval-after-load 'dired
+          (setq insert-directory-program "${pkgs.coreutils-prefixed}/bin/gls"
+                dired-use-ls-dired t))
+      '';
   };
   home.packages = with pkgs; [
     editorScript

@@ -1,15 +1,21 @@
-{ pkgs
-, lib
-, ...
-}: {
+{
+  pkgs,
+  lib,
+  ...
+}:
+{
   home.shell.enableFishIntegration = true;
   programs.fish = {
     enable = true;
     plugins =
       let
-        fromNixpkgs = pkg: { name = pkg.name; src = pkg.src; };
+        fromNixpkgs = pkg: {
+          name = pkg.name;
+          src = pkg.src;
+        };
       in
-      with pkgs.fishPlugins; [
+      with pkgs.fishPlugins;
+      [
         (fromNixpkgs fzf-fish)
         (fromNixpkgs autopair)
         (fromNixpkgs hydro)

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   programs.git = {
     enable = true;
     userName = "Alan Pearce";

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   programs.gpg = {
     enable = true;
     homedir = "${config.xdg.dataHome}/gnupg";
@@ -11,9 +13,6 @@ };
   };
   services.gpg-agent = {
     enable = true;
-    pinentryPackage = with pkgs;
-      if stdenv.isDarwin
-      then pinentry_mac
-      else pinentry-qt;
+    pinentryPackage = with pkgs; if stdenv.isDarwin then pinentry_mac else pinentry-qt;
   };
 }

@@ -1,8 +1,10 @@
-{ config
-, pkgs
-, lib
-, ...
-}: {
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
   xdg.configFile.i3status = {
     recursive = true;
     source = ../i3/i3status;

@@ -1,6 +1,7 @@
-{ config
-, pkgs
-, ...
+{
+  config,
+  pkgs,
+  ...
 }:
 {
   programs.kitty = {
@@ -35,22 +36,23 @@ RunAtLoad = true;
       KeepAlive = false;
       ProgramArguments = [
         "/bin/sh"
-        (toString (pkgs.writeShellScript "toggle-dark-light-mode" ''
-          wait4path /nix
-          if defaults read -g AppleInterfaceStyle &>/dev/null ; then
-            MODE="dark"
-          else
-            MODE="light"
-          fi
-          kitty="${pkgs.kitty}/bin/kitty +kitten themes --config-file-name=theme.conf --reload-in=all --cache-age=-1"
-          if pgrep -q kitty; then
-            if [[  $MODE == "dark"  ]]; then
-              $kitty 'Modus Vivendi'
-            elif [[ $MODE == "light" ]]; then
-              $kitty 'Modus Operandi'
+        (toString (
+          pkgs.writeShellScript "toggle-dark-light-mode" ''
+            wait4path /nix
+            if defaults read -g AppleInterfaceStyle &>/dev/null ; then
+              MODE="dark"
+            else
+              MODE="light"
+            fi
+            kitty="${pkgs.kitty}/bin/kitty +kitten themes --config-file-name=theme.conf --reload-in=all --cache-age=-1"
+            if pgrep -q kitty; then
+              if [[  $MODE == "dark"  ]]; then
+                $kitty 'Modus Vivendi'
+              elif [[ $MODE == "light" ]]; then
+                $kitty 'Modus Operandi'
+              fi
             fi
-          fi
-        ''
+          ''
         ))
       ];
     };

@@ -1,13 +1,17 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   home.file.".ledgerrc".text = ''
     --date-format %F
     --start-of-week 1
   '';
-  programs.emacs.extraPackages = epkgs: (with epkgs; [
-    evil-ledger
-    ledger-mode
-  ]);
+  programs.emacs.extraPackages =
+    epkgs:
+    (with epkgs; [
+      evil-ledger
+      ledger-mode
+    ]);
 }

@@ -1,8 +1,10 @@
-{ config
-, lib
-, pkgs
-, ...
-}: {
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
   home.packages = [
     pkgs.html2text
   ];

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   home.packages = with pkgs; [
     (beets.override {
       pluginOverrides = {

@@ -1,6 +1,8 @@
-{ pkgs
-, ...
-}: {
+{
+  pkgs,
+  ...
+}:
+{
   home.packages = with pkgs; [
     sonixd
   ];
@@ -9,7 +11,10 @@ xdg.desktopEntries.sonixd = {
     name = "sonixd";
     exec = "sonixd";
     comment = "Sonixd Music Player";
-    categories = [ "Audio" "AudioVideo" ];
+    categories = [
+      "Audio"
+      "AudioVideo"
+    ];
     genericName = "Music Player";
   };
 }

@@ -1,6 +1,8 @@
-{ config
-, ...
-}: {
+{
+  config,
+  ...
+}:
+{
   home.sessionVariables = {
     MANPAGER = "nvim +Man!";
   };

@@ -1,7 +1,8 @@
-{ config
-, pkgs
-, lib
-, ...
+{
+  config,
+  pkgs,
+  lib,
+  ...
 }:
 let
   toml = pkgs.formats.toml { };
@@ -26,6 +27,7 @@ };
 
   home.packages = with pkgs; [
     cached-nix-shell
+    nil
     nixd
     angrr
     nix-update
@@ -36,10 +38,12 @@ nixpkgs-lint
     nixpkgs-review
     lixPackageSet.nix-fast-build
   ];
-  programs.emacs.extraPackages = epkgs: (with epkgs; [
-    nix-mode
-    nix-update
-  ]);
+  programs.emacs.extraPackages =
+    epkgs:
+    (with epkgs; [
+      nix-mode
+      nix-update
+    ]);
   programs.nixvim.plugins = {
     nix.enable = true;
     lsp.servers.nixd.enable = true;

@@ -1,4 +1,5 @@
-{ ... }: {
+{ ... }:
+{
   imports = [
     ./nix.nix
     ./nixpkgs.nix

@@ -1,6 +1,7 @@
-{ config
-, pkgs
-, ...
+{
+  config,
+  pkgs,
+  ...
 }:
 let
   inherit (pkgs) stdenv;

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   home.packages = with pkgs; [
     keepassxc
     pwgen

@@ -1,8 +1,10 @@
-{ config
-, lib
-, pkgs
-, ...
-}: {
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
   xdg.configFile."networkmanager-dmenu/config.ini".text = ''
     [dmenu]
     dmenu_command = ${pkgs.rofi}/bin/dmenu

@@ -1,18 +1,13 @@
-{ config
-, lib
-, pkgs
-, ...
+{
+  config,
+  lib,
+  pkgs,
+  ...
 }:
 let
   inherit (pkgs) stdenv;
-  lsOptions =
-    if stdenv.isDarwin
-    then "-p"
-    else "-v --group-directories-first --hyperlink=auto";
-  lsIsoDate =
-    if stdenv.isDarwin
-    then ""
-    else "--time-style=long-iso";
+  lsOptions = if stdenv.isDarwin then "-p" else "-v --group-directories-first --hyperlink=auto";
+  lsIsoDate = if stdenv.isDarwin then "" else "--time-style=long-iso";
 in
 {
   home = {

@@ -1,4 +1,5 @@
-{ ... }: {
+{ ... }:
+{
   programs.ssh = {
     enable = true;
     compression = true;

@@ -1,6 +1,7 @@
-{ config
-, pkgs
-, ...
+{
+  config,
+  pkgs,
+  ...
 }:
 let
   pamixer = "${pkgs.pamixer}/bin/pamixer";

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   home.packages = with pkgs; [
     tabnine
   ];

@@ -1,6 +1,7 @@
-{ pkgs
-, lib
-, ...
+{
+  pkgs,
+  lib,
+  ...
 }:
 let
   inherit (pkgs) stdenv;
@@ -24,21 +25,25 @@ keepassxc
       ];
     };
   };
-  home.packages = (with pkgs.nerd-fonts; [
-    blex-mono
-    jetbrains-mono
-    recursive-mono
-    symbols-only
-  ])
-  ++ lib.optionals (!stdenv.isDarwin) (with pkgs; [
-    (discord.override { withOpenASAR = true; })
+  home.packages =
+    (with pkgs.nerd-fonts; [
+      blex-mono
+      jetbrains-mono
+      recursive-mono
+      symbols-only
+    ])
+    ++ lib.optionals (!stdenv.isDarwin) (
+      with pkgs;
+      [
+        (discord.override { withOpenASAR = true; })
 
-    zeal
-    falkon
-    beeper
-    kdePackages.neochat
-    kdePackages.kleopatra
-  ]);
+        zeal
+        falkon
+        beeper
+        kdePackages.neochat
+        kdePackages.kleopatra
+      ]
+    );
   services.lorri.enableNotifications = true;
   services.emacs.startWithUserSession = "graphical";
 }

@@ -1,24 +1,29 @@
-{ config
-, lib
-, pkgs
-, ...
-}: {
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
   imports = [
     ./yazi.nix
   ];
 
   programs.ripgrep.package = pkgs.ripgrep.override { withPCRE2 = true; };
 
-  home.packages = with pkgs; [
-    walk
-    nuspell
-    git-extras # delete-merged-branches and friends
-    git-worktree-switcher
-    gitui
-  ] ++ (with pkgs.hunspellDicts; [
-    en-gb-large
-    de-de
-  ]);
+  home.packages =
+    with pkgs;
+    [
+      walk
+      nuspell
+      git-extras # delete-merged-branches and friends
+      git-worktree-switcher
+      gitui
+    ]
+    ++ (with pkgs.hunspellDicts; [
+      en-gb-large
+      de-de
+    ]);
 
   programs.nix-index-database = {
     comma.enable = true;
@@ -52,7 +57,12 @@ name = config.programs.git.userName;
         email = config.programs.git.userEmail;
       };
       ui = {
-        "diff.tool" = [ "${pkgs.difftastic}/bin/difft" "--color=always" "$left" "$right" ];
+        "diff.tool" = [
+          "${pkgs.difftastic}/bin/difft"
+          "--color=always"
+          "$left"
+          "$right"
+        ];
       };
     };
   };

@@ -1,7 +1,9 @@
-{ config
-, pkgs
-, ...
-}: {
+{
+  config,
+  pkgs,
+  ...
+}:
+{
   home.file.".xresources" = {
     recursive = true;
     source = ../xresources;

@@ -1,6 +1,8 @@
-{ pkgs
-, ...
-}: {
+{
+  pkgs,
+  ...
+}:
+{
   programs.yazi = {
     enable = true;
     enableFishIntegration = true;