@@ -1,31 +1,27 @@
-{ lib
-, ...
+{
+  lib,
+  ...
 }:
 rec {
-  subValue = v:
-    if builtins.isList v
-    then
-      builtins.concatStringsSep " "
-        (builtins.map
-          (v:
-            (if lib.strings.hasPrefix "http" v
-            then v
-            else "'${v}'"))
-          v)
-    else toString v;
+  subValue =
+    v:
+    if builtins.isList v then
+      builtins.concatStringsSep " " (
+        builtins.map (v: (if lib.strings.hasPrefix "http" v then v else "'${v}'")) v
+      )
+    else
+      toString v;
 
-  headerValue = sep: val:
-    if builtins.isAttrs val
-    then
-      builtins.concatStringsSep "; "
-        (lib.attrsets.mapAttrsToList
-          (k: v:
-            if builtins.isBool v then k else
-            "${k}${sep}${subValue v}"
-          )
-          val)
-    else toString val;
-  genHeader = header:
+  headerValue =
+    sep: val:
+    if builtins.isAttrs val then
+      builtins.concatStringsSep "; " (
+        lib.attrsets.mapAttrsToList (k: v: if builtins.isBool v then k else "${k}${sep}${subValue v}") val
+      )
+    else
+      toString val;
+  genHeader =
+    header:
     let
       sep = if header == "content-security-policy" then " " else "=";
     in
@@ -33,15 +29,22 @@ value: "${header} \"${headerValue sep value}\"";
 
   headers = matcher: headers: ''
     header ${matcher} {
-      ${builtins.concatStringsSep "\n"
-        (lib.attrsets.mapAttrsToList genHeader headers)}
+      ${builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList genHeader headers)}
     }
   '';
-  security-headers = { matcher ? "", overrides ? { } }: headers matcher ({
-    strict-transport-security = {
-      max-age = 2 * 365 * 24 * 60 * 60;
-    };
-    x-content-type-options = "nosniff";
-    x-frame-options = "DENY";
-  } // overrides);
+  security-headers =
+    {
+      matcher ? "",
+      overrides ? { },
+    }:
+    headers matcher (
+      {
+        strict-transport-security = {
+          max-age = 2 * 365 * 24 * 60 * 60;
+        };
+        x-content-type-options = "nosniff";
+        x-frame-options = "DENY";
+      }
+      // overrides
+    );
 }