chore(repo): reformat with nixfmt-rfc-style

18 files changed, 498 insertions, 366 deletions

diff --git a/os/kay/modules/acme.nix b/os/kay/modules/acme.nix
index 00819e7..60e40a8 100644
--- a/os/kay/modules/acme.nix
+++ b/os/kay/modules/acme.nix
@@ -1,10 +1,11 @@
-{ config, pkgs, ... }: let
+{ config, pkgs, ... }:
+let
   email = config.global.userdata.email;
   domain = config.global.userdata.domain;
 
-  environmentFile =
-    pkgs.writeText "acme-dns" "RFC2136_NAMESERVER='[2001:470:ee65::1]:53'";
-in {
+  environmentFile = pkgs.writeText "acme-dns" "RFC2136_NAMESERVER='[2001:470:ee65::1]:53'";
+in
+{
   security.acme = {
     acceptTerms = true;
     defaults.email = email;
diff --git a/os/kay/modules/alina.nix b/os/kay/modules/alina.nix
index ef6331b..6f8fac4 100644
--- a/os/kay/modules/alina.nix
+++ b/os/kay/modules/alina.nix
@@ -1,14 +1,18 @@
-{ config, pkgs, ... }: let
+{ config, pkgs, ... }:
+let
   domain = "alinafs.com";
-in {
-  sops.secrets."misc/alina" = {};
+in
+{
+  sops.secrets."misc/alina" = { };
 
   services.postgresql = {
     ensureDatabases = [ "alina" ];
-    ensureUsers = [{
-      name = "alina";
-      ensureDBOwnership = true;
-    }];
+    ensureUsers = [
+      {
+        name = "alina";
+        ensureDBOwnership = true;
+      }
+    ];
   };
 
   services.alina = {
@@ -17,7 +21,7 @@ in {
     environmentFile = config.sops.secrets."misc/alina".path;
     settings.server = {
       data = "/hdd/alina";
-      file_size_limit = 1024 * 1024 * 1024; /* 1GB */
+      file_size_limit = 1024 * 1024 * 1024; # 1GB
       public_url = "https://${domain}";
     };
   };
diff --git a/os/kay/modules/dns/default.nix b/os/kay/modules/dns/default.nix
index 357cddd..6179527 100644
--- a/os/kay/modules/dns/default.nix
+++ b/os/kay/modules/dns/default.nix
@@ -1,5 +1,6 @@
-{ config, pkgs, ... }: let
-  listen_addr =  [
+{ config, pkgs, ... }:
+let
+  listen_addr = [
     "137.59.84.126"
     "2001:470:ee65::1"
   ];
@@ -16,7 +17,8 @@
 
         IN	NS	ns1.sinanmohd.com.
   '';
-in {
+in
+{
   imports = [ ./ddns.nix ];
 
   networking.firewall = {
@@ -39,39 +41,55 @@ in {
       remote = [
         {
           id = "ns1.he.net";
-          address = [ "2001:470:100::2" "216.218.130.2" ];
+          address = [
+            "2001:470:100::2"
+            "216.218.130.2"
+          ];
           via = "2001:470:ee65::1";
         }
         {
           id = "m.gtld-servers.net";
-          address = [ "2001:501:b1f9::30"  "192.55.83.30" ];
+          address = [
+            "2001:501:b1f9::30"
+            "192.55.83.30"
+          ];
         }
       ];
 
-      submission = [{
-        id = "gtld-servers.net";
-        parent = "m.gtld-servers.net";
-      }];
+      submission = [
+        {
+          id = "gtld-servers.net";
+          parent = "m.gtld-servers.net";
+        }
+      ];
 
-      policy = [{
-        id = "gtld-servers.net";
-        algorithm = "ecdsap384sha384";
-        ksk-lifetime = "365d";
-        ksk-submission = "gtld-servers.net";
-      }];
+      policy = [
+        {
+          id = "gtld-servers.net";
+          algorithm = "ecdsap384sha384";
+          ksk-lifetime = "365d";
+          ksk-submission = "gtld-servers.net";
+        }
+      ];
 
       # generate TSIG key with keymgr -t name
       acl = [
         {
           id = "ns1.he.net";
           key = "ns1.he.net";
-          address = [ "2001:470:600::2" "216.218.133.2" ];
+          address = [
+            "2001:470:600::2"
+            "216.218.133.2"
+          ];
           action = "transfer";
         }
         {
           id = "ddns";
           address = listen_addr;
-          update-type = [ "A" "AAAA" ];
+          update-type = [
+            "A"
+            "AAAA"
+          ];
           action = "update";
         }
         {
@@ -82,11 +100,13 @@ in {
         }
       ];
 
-      mod-rrl = [{
-        id = "default";
-        rate-limit = 200;
-        slip = 2;
-      }];
+      mod-rrl = [
+        {
+          id = "default";
+          rate-limit = 200;
+          slip = 2;
+        }
+      ];
 
       template = [
         {
@@ -102,7 +122,10 @@ in {
           dnssec-policy = "gtld-servers.net";
 
           notify = [ "ns1.he.net" ];
-          acl = [ "ns1.he.net" "ddns" ];
+          acl = [
+            "ns1.he.net"
+            "ddns"
+          ];
 
           zonefile-sync = "-1";
           zonefile-load = "difference";
diff --git a/os/kay/modules/home-assistant.nix b/os/kay/modules/home-assistant.nix
index 2376997..65807f7 100644
--- a/os/kay/modules/home-assistant.nix
+++ b/os/kay/modules/home-assistant.nix
@@ -1,21 +1,26 @@
-{ pkgs, ... }: {
+{ pkgs, ... }:
+{
   services.postgresql = {
     enable = true;
 
     ensureDatabases = [ "hass" ];
-    ensureUsers = [{
-      name = "hass";
-      ensureDBOwnership = true;
-    }];
+    ensureUsers = [
+      {
+        name = "hass";
+        ensureDBOwnership = true;
+      }
+    ];
   };
 
   services.home-assistant = {
     enable = true;
-    package = (pkgs.home-assistant.override {
-      extraPackages = py: with py; [ psycopg2 ];
-    }).overrideAttrs (oldAttrs: {
-      doInstallCheck = false;
-    });
+    package =
+      (pkgs.home-assistant.override {
+        extraPackages = py: with py; [ psycopg2 ];
+      }).overrideAttrs
+        (oldAttrs: {
+          doInstallCheck = false;
+        });
 
     extraComponents = [
       "analytics"
@@ -29,7 +34,7 @@
     ];
 
     config = {
-      default_config = {};
+      default_config = { };
 
       recorder.db_url = "postgresql://@/hass";
       http = {
diff --git a/os/kay/modules/hurricane.nix b/os/kay/modules/hurricane.nix
index 511b213..e815136 100644
--- a/os/kay/modules/hurricane.nix
+++ b/os/kay/modules/hurricane.nix
@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 let
   iface = "hurricane";
@@ -10,12 +15,15 @@ let
   prefix64 = "2001:470:36:72a::/64";
   prefix48 = "2001:470:ee65::/48";
 
-  makeAddr = prefix: host: let
-    split = lib.strings.splitString "/" prefix;
-  in {
-    address = "${lib.head split}${host}";
-    prefixLength = lib.toInt (lib.last split);
-  };
+  makeAddr =
+    prefix: host:
+    let
+      split = lib.strings.splitString "/" prefix;
+    in
+    {
+      address = "${lib.head split}${host}";
+      prefixLength = lib.toInt (lib.last split);
+    };
 in
 {
   networking = {
@@ -43,17 +51,15 @@ in
     };
 
     firewall = {
-      extraCommands =
-      "iptables -A INPUT --proto 41 --source ${remote} --jump ACCEPT";
-      extraStopCommands =
-      "iptables -D INPUT --proto 41 --source ${remote} --jump ACCEPT";
+      extraCommands = "iptables -A INPUT --proto 41 --source ${remote} --jump ACCEPT";
+      extraStopCommands = "iptables -D INPUT --proto 41 --source ${remote} --jump ACCEPT";
     };
   };
 
   sops.secrets = {
-    "hurricane/username" = {};
-    "hurricane/update_key" = {};
-    "hurricane/tunnel_id" = {};
+    "hurricane/username" = { };
+    "hurricane/update_key" = { };
+    "hurricane/tunnel_id" = { };
   };
 
   systemd.services."network-route-${iface}" = {
@@ -64,7 +70,10 @@ in
     ];
     before = [ "network-setup.service" ];
     bindsTo = [ "network-addresses-hurricane.service" ];
-    after = [ "network-pre.target" "network-addresses-hurricane.service" ];
+    after = [
+      "network-pre.target"
+      "network-addresses-hurricane.service"
+    ];
     # restart rather than stop+start this unit to prevent the
     # network from dying during switch-to-configuration.
     stopIfChanged = false;
@@ -95,9 +104,13 @@ in
     '';
   };
 
-
   services.pppd.script."01-${iface}" = {
-    runtimeInputs = with pkgs; [ curl coreutils iproute2 iputils ];
+    runtimeInputs = with pkgs; [
+      curl
+      coreutils
+      iproute2
+      iputils
+    ];
     text = ''
       wan_ip="$4"
       username="$(cat ${config.sops.secrets."hurricane/username".path})"
diff --git a/os/kay/modules/mail.nix b/os/kay/modules/mail.nix
index a418a86..57912ac 100644
--- a/os/kay/modules/mail.nix
+++ b/os/kay/modules/mail.nix
@@ -1,4 +1,5 @@
-{ config, pkgs, ... }: let
+{ config, pkgs, ... }:
+let
   ipv6 = "2001:470:ee65::1337";
   domain = config.global.userdata.domain;
   username = config.global.userdata.name;
@@ -15,12 +16,13 @@
   ];
 
   credentials_directory = "/run/credentials/stalwart-mail.service";
-in {
+in
+{
   security.acme.certs.${domain}.postRun = "systemctl restart stalwart-mail.service";
   sops.secrets = {
-    "mail.${domain}/dkim_rsa" = {};
-    "mail.${domain}/dkim_ed25519" = {};
-    "mail.${domain}/password" = {};
+    "mail.${domain}/dkim_rsa" = { };
+    "mail.${domain}/dkim_ed25519" = { };
+    "mail.${domain}/password" = { };
   };
 
   systemd.services.stalwart-mail.serviceConfig.LoadCredential = [
@@ -35,10 +37,12 @@ in {
 
   services.postgresql = {
     ensureDatabases = [ "stalwart" ];
-    ensureUsers = [{
-      name = "stalwart";
-      ensureDBOwnership = true;
-    }];
+    ensureUsers = [
+      {
+        name = "stalwart";
+        ensureDBOwnership = true;
+      }
+    ];
   };
 
   services.stalwart-mail = {
@@ -70,7 +74,10 @@ in {
 
       server.listener = {
         smtp = {
-          bind = [ "[${ipv6}]:25" "0.0.0.0:25" ];
+          bind = [
+            "[${ipv6}]:25"
+            "0.0.0.0:25"
+          ];
           protocol = "smtp";
         };
         submission = {
@@ -98,7 +105,13 @@ in {
           private-key = "%{file:${credentials_directory}/dkim_rsa}%";
           inherit domain;
           selector = "rsa";
-          headers = ["From" "To" "Date" "Subject" "Message-ID"];
+          headers = [
+            "From"
+            "To"
+            "Date"
+            "Subject"
+            "Message-ID"
+          ];
           algorithm = "rsa-sha-256";
           canonicalization = "simple/simple";
 
@@ -110,7 +123,13 @@ in {
           private-key = "%{file:${credentials_directory}/dkim_ed25519}%";
           inherit domain;
           selector = "ed25519";
-          headers = ["From" "To" "Date" "Subject" "Message-ID"];
+          headers = [
+            "From"
+            "To"
+            "Date"
+            "Subject"
+            "Message-ID"
+          ];
           algorithm = "ed25519-sha256";
           canonicalization = "simple/simple";
 
@@ -152,7 +171,8 @@ in {
             secret = "%{file:${credentials_directory}/password}%";
             inherit email;
           }
-          { # for mta-sts & dmarc reports
+          {
+            # for mta-sts & dmarc reports
             class = "individual";
             name = "reports";
             secret = "%{file:${credentials_directory}/password}%";
diff --git a/os/kay/modules/matrix/default.nix b/os/kay/modules/matrix/default.nix
index f81d0d9..1b9564d 100644
--- a/os/kay/modules/matrix/default.nix
+++ b/os/kay/modules/matrix/default.nix
@@ -1,12 +1,14 @@
-{ config, ... }: let
+{ config, ... }:
+let
   domain = config.global.userdata.domain;
-in {
+in
+{
   imports = [
     ./dendrite.nix
     ./matrix-sliding-sync.nix
   ];
 
-  sops.secrets."matrix-${domain}/sliding_sync" = {};
+  sops.secrets."matrix-${domain}/sliding_sync" = { };
 
   services.matrix-sliding-sync-dirty = {
     enable = true;
diff --git a/os/kay/modules/matrix/dendrite.nix b/os/kay/modules/matrix/dendrite.nix
index 3f4a879..e66c5a5 100644
--- a/os/kay/modules/matrix/dendrite.nix
+++ b/os/kay/modules/matrix/dendrite.nix
@@ -10,16 +10,18 @@ let
   };
 in
 {
-  sops.secrets."matrix-${domain}/key" = {};
+  sops.secrets."matrix-${domain}/key" = { };
   systemd.services.dendrite.after = [ "postgresql.service" ];
 
   services = {
     postgresql = {
       ensureDatabases = [ "dendrite" ];
-      ensureUsers = [{
-        name = "dendrite";
-        ensureDBOwnership = true;
-      }];
+      ensureUsers = [
+        {
+          name = "dendrite";
+          ensureDBOwnership = true;
+        }
+      ];
     };
 
     dendrite = {
@@ -43,10 +45,12 @@ in
           ];
           inherit database;
         };
-        logging = [{
-          type = "std";
-          level = "warn";
-        }];
+        logging = [
+          {
+            type = "std";
+            level = "warn";
+          }
+        ];
         mscs = {
           inherit database;
           mscs = [ "msc2836" ];
@@ -63,19 +67,21 @@ in
         federation_api = {
           inherit database;
           send_max_retries = 8;
-          key_perspectives = [{
-            server_name = "matrix.org";
-            keys = [
-              {
-                key_id = "ed25519:auto";
-                public_key = "Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw";
-              }
-              {
-                key_id = "ed25519:a_RXGa";
-                public_key = "l8Hft5qXKn1vfHrg3p4+W8gELQVo8N13JkluMfmn2sQ";
-              }
-            ];
-          }];
+          key_perspectives = [
+            {
+              server_name = "matrix.org";
+              keys = [
+                {
+                  key_id = "ed25519:auto";
+                  public_key = "Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw";
+                }
+                {
+                  key_id = "ed25519:a_RXGa";
+                  public_key = "l8Hft5qXKn1vfHrg3p4+W8gELQVo8N13JkluMfmn2sQ";
+                }
+              ];
+            }
+          ];
         };
 
         app_service_api = {
diff --git a/os/kay/modules/matrix/matrix-sliding-sync.nix b/os/kay/modules/matrix/matrix-sliding-sync.nix
index f4c1426..63d95ad 100644
--- a/os/kay/modules/matrix/matrix-sliding-sync.nix
+++ b/os/kay/modules/matrix/matrix-sliding-sync.nix
@@ -1,12 +1,20 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.services.matrix-sliding-sync-dirty;
-  matrix-sliding-sync = pkgs.callPackage ../../pkgs/matrix-sliding-sync.nix {};
+  matrix-sliding-sync = pkgs.callPackage ../../pkgs/matrix-sliding-sync.nix { };
 in
 {
   imports = [
-    (lib.mkRenamedOptionModule [ "services" "matrix-synapse" "sliding-sync" ] [ "services" "matrix-sliding-sync" ])
+    (lib.mkRenamedOptionModule
+      [ "services" "matrix-synapse" "sliding-sync" ]
+      [ "services" "matrix-sliding-sync" ]
+    )
   ];
 
   options.services.matrix-sliding-sync-dirty = {
@@ -40,7 +48,14 @@ in
           };
 
           SYNCV3_LOG_LEVEL = lib.mkOption {
-            type = lib.types.enum [ "trace" "debug" "info" "warn" "error" "fatal" ];
+            type = lib.types.enum [
+              "trace"
+              "debug"
+              "info"
+              "warn"
+              "error"
+              "fatal"
+            ];
             default = "info";
             description = "The level of verbosity for messages logged.";
           };
@@ -77,10 +92,12 @@ in
     services.postgresql = lib.optionalAttrs cfg.createDatabase {
       enable = true;
       ensureDatabases = [ "matrix-sliding-sync" ];
-      ensureUsers = [ {
-        name = "matrix-sliding-sync";
-        ensureDBOwnership = true;
-      } ];
+      ensureUsers = [
+        {
+          name = "matrix-sliding-sync";
+          ensureDBOwnership = true;
+        }
+      ];
     };
 
     systemd.services.matrix-sliding-sync = rec {
diff --git a/os/kay/modules/network.nix b/os/kay/modules/network.nix
index 22d132b..1315289 100644
--- a/os/kay/modules/network.nix
+++ b/os/kay/modules/network.nix
@@ -3,7 +3,10 @@
 let
   inetVlan = 1003;
   wanInterface = "enp3s0";
-  nameServer = [ "1.0.0.1" "1.1.1.1" ];
+  nameServer = [
+    "1.0.0.1"
+    "1.1.1.1"
+  ];
 in
 {
   imports = [
@@ -12,9 +15,9 @@ in
   ];
 
   sops.secrets = {
-    "ppp/chap-secrets" = {};
-    "ppp/pap-secrets" = {};
-    "ppp/username" = {};
+    "ppp/chap-secrets" = { };
+    "ppp/pap-secrets" = { };
+    "ppp/username" = { };
   };
 
   networking = {
diff --git a/os/kay/modules/observability/prometheus.nix b/os/kay/modules/observability/prometheus.nix
index d9b6071..1810f9e 100644
--- a/os/kay/modules/observability/prometheus.nix
+++ b/os/kay/modules/observability/prometheus.nix
@@ -4,36 +4,38 @@
     enable = true;
     port = 9001;
 
-    scrapeConfigs = [{
-      job_name = "kay";
-      scrape_interval = "1s";
-      static_configs = [
-        {
-          targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ];
-        }
-        {
-          targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.wireguard.port}" ];
-        }
-        {
-          targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.dnsmasq.port}" ];
-        }
-        {
-          targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.nginx.port}" ];
-        }
-        {
-          targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.nginxlog.port}" ];
-        }
-        {
-          targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.postgres.port}" ];
-        }
-        {
-          targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.snmp.port}" ];
-        }
-        {
-          targets = [ "127.0.0.1:${toString config.services.dendrite.httpPort}" ];
-        }
-      ];
-    }];
+    scrapeConfigs = [
+      {
+        job_name = "kay";
+        scrape_interval = "1s";
+        static_configs = [
+          {
+            targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ];
+          }
+          {
+            targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.wireguard.port}" ];
+          }
+          {
+            targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.dnsmasq.port}" ];
+          }
+          {
+            targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.nginx.port}" ];
+          }
+          {
+            targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.nginxlog.port}" ];
+          }
+          {
+            targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.postgres.port}" ];
+          }
+          {
+            targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.snmp.port}" ];
+          }
+          {
+            targets = [ "127.0.0.1:${toString config.services.dendrite.httpPort}" ];
+          }
+        ];
+      }
+    ];
 
     exporters = {
       node = {
diff --git a/os/kay/modules/postgresql.nix b/os/kay/modules/postgresql.nix
index 79d0b12..6ba5398 100644
--- a/os/kay/modules/postgresql.nix
+++ b/os/kay/modules/postgresql.nix
@@ -1,15 +1,21 @@
-{ config, lib, pkgs, ... }: {
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
   services.postgresql = {
     enable = true;
     package = with pkgs; postgresql_15;
     authentication = lib.mkForce ''
-        #type database DBuser  origin-address auth-method
-        # unix socket
-        local all      all                    trust
-        # ipv4
-        host  all      all     127.0.0.1/32   trust
-        # ipv6
-        host  all      all     ::1/128        trust
+      #type database DBuser  origin-address auth-method
+      # unix socket
+      local all      all                    trust
+      # ipv4
+      host  all      all     127.0.0.1/32   trust
+      # ipv6
+      host  all      all     ::1/128        trust
     '';
 
     settings.log_timezone = config.time.timeZone;
diff --git a/os/kay/modules/router.nix b/os/kay/modules/router.nix
index bb8cd3b..7280401 100644
--- a/os/kay/modules/router.nix
+++ b/os/kay/modules/router.nix
@@ -1,4 +1,5 @@
-{ ... }: let
+{ ... }:
+let
   wanInterface = "ppp0";
 
   gponInterface = "enp3s0";
@@ -15,7 +16,8 @@
 
   wapMac = "40:86:cb:d7:40:49";
   wapIp = "192.168.43.2";
-in {
+in
+{
   imports = [
     ./wireguard.nix
     ./iperf3.nix
@@ -30,17 +32,24 @@ in {
       internalInterfaces = [ bridgeInterface ];
     };
     interfaces = {
-      ${bridgeInterface}.ipv4.addresses = [{
+      ${bridgeInterface}.ipv4.addresses = [
+        {
           address = host;
-          prefixLength  = prefix;
-      }];
-      ${gponInterface}.ipv4.addresses = [{
+          prefixLength = prefix;
+        }
+      ];
+      ${gponInterface}.ipv4.addresses = [
+        {
           address = gponHost;
-          prefixLength  = gponPrefix;
-      }];
+          prefixLength = gponPrefix;
+        }
+      ];
     };
     firewall = {
-      allowedUDPPorts = [ 53 67 ];
+      allowedUDPPorts = [
+        53
+        67
+      ];
       allowedTCPPorts = [ 53 ];
       extraCommands = ''
         iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
@@ -57,7 +66,7 @@ in {
 
   services.dnsmasq.settings = {
     dhcp-range = [ "${leaseRangeStart},${leaseRangeEnd}" ];
-    dhcp-host= "${wapMac},${wapIp}";
+    dhcp-host = "${wapMac},${wapIp}";
     interface = [ bridgeInterface ];
   };
 
diff --git a/os/kay/modules/sftp.nix b/os/kay/modules/sftp.nix
index 45ed151..b740fd6 100644
--- a/os/kay/modules/sftp.nix
+++ b/os/kay/modules/sftp.nix
@@ -7,7 +7,7 @@ let
 in
 {
   users = {
-    groups."sftp".members = [];
+    groups."sftp".members = [ ];
 
     users."sftp" = {
       group = "sftp";
@@ -42,7 +42,7 @@ in
     };
 
     # sandboxing
-    extraConfig  = ''
+    extraConfig = ''
       Match Group sftp
       # chroot dir should be owned by root
       # and sub dirs by %u
diff --git a/os/kay/modules/sshfwd.nix b/os/kay/modules/sshfwd.nix
index d70b893..fcafd17 100644
--- a/os/kay/modules/sshfwd.nix
+++ b/os/kay/modules/sshfwd.nix
@@ -1,21 +1,24 @@
-{ ... }: let
+{ ... }:
+let
   group = "sshfwd";
-in {
+in
+{
   networking.firewall.allowedTCPPorts = [ 2222 ];
 
   users = {
-    groups.${group}.members = [];
+    groups.${group}.members = [ ];
 
     users."lia" = {
       inherit group;
       isSystemUser = true;
 
-      openssh.authorizedKeys.keys
-        = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAe7fJlh9L+9JSq0+hK7jNZjszmZqNXwzqcZ+zx0yJyU lia" ];
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAe7fJlh9L+9JSq0+hK7jNZjszmZqNXwzqcZ+zx0yJyU lia"
+      ];
     };
   };
 
-  services.openssh.extraConfig  = ''
+  services.openssh.extraConfig = ''
     Match Group ${group}
     ForceCommand echo 'this account is only usable for remote forwarding'
     PermitTunnel no
diff --git a/os/kay/modules/wireguard.nix b/os/kay/modules/wireguard.nix
index 21cec06..ae42930 100644
--- a/os/kay/modules/wireguard.nix
+++ b/os/kay/modules/wireguard.nix
@@ -1,4 +1,10 @@
-{ config, pkgs, lib, ... }: let
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
   wgInterface = "wg";
   wanInterface = "ppp0";
   subnet = "10.0.1.0";
@@ -10,13 +16,17 @@
     Address = 10.0.1.1/24
     MTU = 1412
     ListenPort = 51820
-    PostUp = ${lib.getExe (pkgs.writeShellApplication {
-      name = "wg_set_key";
-      runtimeInputs = with pkgs; [ wireguard-tools ];
-      text = ''
-        wg set ${wgInterface} private-key <(cat ${config.sops.secrets."misc/wireguard".path})
-      '';
-    })}
+    PostUp = ${
+      lib.getExe (
+        pkgs.writeShellApplication {
+          name = "wg_set_key";
+          runtimeInputs = with pkgs; [ wireguard-tools ];
+          text = ''
+            wg set ${wgInterface} private-key <(cat ${config.sops.secrets."misc/wireguard".path})
+          '';
+        }
+      )
+    }
 
     [Peer]
     # friendly_name = cez
@@ -43,8 +53,9 @@
     PublicKey = U6+PzFuM6lKVx0TnDWuWJMsP6Tj8o1a9zjRcD7gV53o=
     AllowedIPs = 10.0.1.6/32
   '';
-in {
-  sops.secrets."misc/wireguard" = {};
+in
+{
+  sops.secrets."misc/wireguard" = { };
 
   networking = {
     nat = {
@@ -59,7 +70,7 @@ in {
 
   services.dnsmasq.settings = {
     no-dhcp-interface = wgInterface;
-    interface = [ wgInterface  ];
+    interface = [ wgInterface ];
   };
 
   services.prometheus.exporters.wireguard = {
diff --git a/os/kay/modules/www.nix b/os/kay/modules/www.nix
index 54ff8d2..4f894c5 100644
--- a/os/kay/modules/www.nix
+++ b/os/kay/modules/www.nix
@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 let
   domain = config.global.userdata.domain;
@@ -12,7 +17,10 @@ in
 
   security.acme.certs.${domain}.postRun = "systemctl reload nginx.service";
   networking.firewall = {
-    allowedTCPPorts = [ 80 443 ];
+    allowedTCPPorts = [
+      80
+      443
+    ];
     allowedUDPPorts = [ 443 ];
   };
 
@@ -27,7 +35,7 @@ in
     };
   };
 
-  services.nginx = { 
+  services.nginx = {
     enable = true;
     statusPage = true;
     package = pkgs.nginxQuic;
@@ -48,218 +56,216 @@ in
       add_header Alt-Svc 'h3=":443"; ma=2592000; persist=1';
     '';
 
-    virtualHosts = let
-      defaultOpts = {
-        # reuseport = true;
-        quic = true;
-        http3 = true;
-        forceSSL = true;
-        useACMEHost = domain;
-      };
-    in {
-      "${domain}" = defaultOpts // {
-        default = true;
-        globalRedirect = "www.${domain}";
+    virtualHosts =
+      let
+        defaultOpts = {
+          # reuseport = true;
+          quic = true;
+          http3 = true;
+          forceSSL = true;
+          useACMEHost = domain;
+        };
+      in
+      {
+        "${domain}" = defaultOpts // {
+          default = true;
+          globalRedirect = "www.${domain}";
+
+          extraConfig = ''
+            proxy_buffering off;
+            proxy_request_buffering off;
+            client_max_body_size 0;
+          '';
 
-        extraConfig = ''
-          proxy_buffering off;
-          proxy_request_buffering off;
-          client_max_body_size 0;
-        '';
+          locations = {
+            "/.well-known/matrix/server".return = ''
+              200 '{ "m.server": "${domain}:443" }'
+            '';
 
-        locations = {
-          "/.well-known/matrix/server".return = ''
-            200 '{ "m.server": "${domain}:443" }'
-          '';
+            "/.well-known/matrix/client".return = ''
+              200 '${
+                builtins.toJSON {
+                  "m.homeserver".base_url = "https://${domain}";
+                  "org.matrix.msc3575.proxy".url = "https://sliding.${domain}";
+                  "m.identity_server".base_url = "https://vector.im";
+                }
+              }'
+            '';
+
+            "~ ^(\\/_matrix|\\/_synapse\\/client)".proxyPass =
+              "http://127.0.0.1:${toString config.services.dendrite.httpPort}";
+          };
+        };
 
-          "/.well-known/matrix/client".return = ''
-            200 '${builtins.toJSON {
-                "m.homeserver".base_url = "https://${domain}";
-                "org.matrix.msc3575.proxy".url = "https://sliding.${domain}";
-                "m.identity_server".base_url = "https://vector.im";
-            }}'
+        "sliding.${domain}" = defaultOpts // {
+          extraConfig = ''
+            proxy_buffering off;
+            proxy_request_buffering off;
+            client_max_body_size 0;
           '';
 
-          "~ ^(\\/_matrix|\\/_synapse\\/client)".proxyPass = "http://127.0.0.1:${toString
-            config.services.dendrite.httpPort
-          }";
+          locations."/" = {
+            proxyWebsockets = true;
+            proxyPass = "http://${config.services.matrix-sliding-sync-dirty.settings.SYNCV3_BINDADDR}";
+          };
         };
-      };
 
-      "sliding.${domain}" = defaultOpts // {
-        extraConfig = ''
-          proxy_buffering off;
-          proxy_request_buffering off;
-          client_max_body_size 0;
-        '';
+        "${config.services.grafana.settings.server.domain}" = defaultOpts // {
+          extraConfig = ''
+            proxy_buffering off;
+            proxy_request_buffering off;
+            client_max_body_size 0;
+          '';
 
-        locations."/" = {
-          proxyWebsockets = true;
-          proxyPass =
-            "http://${config.services.matrix-sliding-sync-dirty.settings.SYNCV3_BINDADDR}";
+          locations."/" = {
+            proxyWebsockets = true;
+            proxyPass = "http://${config.services.grafana.settings.server.http_addr}:${builtins.toString config.services.grafana.settings.server.http_port}";
+          };
         };
-      };
 
-      "${config.services.grafana.settings.server.domain}" = defaultOpts // {
-        extraConfig = ''
-          proxy_buffering off;
-          proxy_request_buffering off;
-          client_max_body_size 0;
-        '';
+        "www.${domain}" = defaultOpts // {
+          extraConfig = ''
+            ssl_early_data on;
+          '';
 
-        locations."/" = {
-          proxyWebsockets = true;
-          proxyPass =
-            "http://${config.services.grafana.settings.server.http_addr}:${builtins.toString config.services.grafana.settings.server.http_port}";
+          root = "/var/www/${domain}";
         };
-      };
-
-      "www.${domain}" = defaultOpts // {
-        extraConfig = ''
-          ssl_early_data on;
-        '';
 
-        root = "/var/www/${domain}";
-      };
+        "git.${domain}" = defaultOpts // {
+          extraConfig = ''
+            ssl_early_data on;
+          '';
+        };
 
-      "git.${domain}" = defaultOpts // {
-        extraConfig = ''
-          ssl_early_data on;
-        '';
-      };
+        "bin.${domain}" = defaultOpts // {
+          extraConfig = ''
+            ssl_early_data on;
+          '';
+          root = "${storage}/bin";
+          locations."= /".return = "307 https://www.${domain}";
+        };
 
-      "bin.${domain}" = defaultOpts // {
-        extraConfig = ''
-          ssl_early_data on;
-        '';
-        root = "${storage}/bin";
-        locations."= /".return = "307 https://www.${domain}";
-      };
+        "static.${domain}" = defaultOpts // {
+          extraConfig = ''
+            ssl_early_data on;
+          '';
+          root = "${storage}/static";
+          locations."= /".return = "301 https://www.${domain}";
+        };
 
-      "static.${domain}" = defaultOpts // {
-        extraConfig = ''
-          ssl_early_data on;
-        '';
-        root = "${storage}/static";
-        locations."= /".return = "301 https://www.${domain}";
-      };
+        "home.${domain}" = defaultOpts // {
+          locations."/" = {
+            proxyWebsockets = true;
+            proxyPass = "http://127.0.0.1:${builtins.toString config.services.home-assistant.config.http.server_port}";
+          };
+        };
 
-      "home.${domain}" = defaultOpts // {
-        locations."/" = {
-          proxyWebsockets = true;
-          proxyPass = "http://127.0.0.1:${
-            builtins.toString config.services.home-assistant.config.http.server_port
-          }";
+        "mail.${domain}" = defaultOpts // {
+          locations."/" = {
+            proxyWebsockets = true;
+            proxyPass = "http://127.0.0.1:8085";
+          };
         };
-      };
 
-      "mail.${domain}" = defaultOpts // {
-        locations."/" = {
-          proxyWebsockets = true;
-          proxyPass = "http://127.0.0.1:8085";
+        "mta-sts.${domain}" = defaultOpts // {
+          extraConfig = ''
+            ssl_early_data on;
+          '';
+          locations."= /.well-known/mta-sts.txt".return = ''200 "${
+            lib.strings.concatStringsSep "\\n" [
+              "version: STSv1"
+              "mode: enforce"
+              "mx: mail.${domain}"
+              "max_age: 86400"
+            ]
+          }"'';
         };
-      };
 
-      "mta-sts.${domain}" = defaultOpts // {
-        extraConfig = ''
-          ssl_early_data on;
-        '';
-        locations."= /.well-known/mta-sts.txt".return = ''200 "${
-          lib.strings.concatStringsSep "\\n" [
-            "version: STSv1"
-            "mode: enforce"
-            "mx: mail.${domain}"
-            "max_age: 86400"
-          ]
-        }"'';
-      };
+        "immich.${domain}" = defaultOpts // {
+          locations."/" = {
+            proxyWebsockets = true;
+            proxyPass = "http://${config.services.immich.host}:${builtins.toString config.services.immich.port}";
+          };
 
-      "immich.${domain}" = defaultOpts // {
-        locations."/" = {
-          proxyWebsockets = true;
-          proxyPass = "http://${config.services.immich.host}:${builtins.toString config.services.immich.port}";
+          extraConfig = ''
+            proxy_buffering off;
+            proxy_request_buffering off;
+            client_max_body_size 0;
+          '';
         };
 
-        extraConfig = ''
-          proxy_buffering off;
-          proxy_request_buffering off;
-          client_max_body_size 0;
-        '';
-      };
-
-      "nixbin.${domain}" = defaultOpts // {
-        extraConfig = ''
-          proxy_buffering off;
-          proxy_request_buffering off;
-          client_max_body_size 0;
-        '';
+        "nixbin.${domain}" = defaultOpts // {
+          extraConfig = ''
+            proxy_buffering off;
+            proxy_request_buffering off;
+            client_max_body_size 0;
+          '';
 
-        locations = {
-          "= /files".return = "301 https://nixbin.${domain}/files/";
-          "/files/" = {
+          locations = {
+            "= /files".return = "301 https://nixbin.${domain}/files/";
+            "/files/" = {
               alias = "/nix/store/";
               extraConfig = "autoindex on;";
+            };
+
+            "= /" = {
+              extraConfig = ''
+                add_header Content-Type text/html;
+                add_header Alt-Svc 'h3=":443"; ma=2592000; persist=1';
+              '';
+              return = ''
+                200
+                              '<!DOCTYPE html>
+                              <html lang="en">
+                                <head>
+                                  <meta charset="UTF-8">
+                                  <title>Nix Cache</title>
+                                </head>
+                                <body>
+                                  <center>
+                                    <h1 style="font-size: 8em">
+                                      ❄️ Nix Cache
+                                    </h1>
+                                    <p style="font-weight: bold">
+                                      Public Key: nixbin.sinanmohd.com:dXV3KDPVrm+cGJ2M1ZmTeQJqFGaEapqiVoWHgYDh03k=
+                                    </p>
+                                  </center>
+                                </body>
+                              </html>'
+              '';
+            };
+
+            "/".proxyPass =
+              "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
           };
-
-          "= /" = {
-            extraConfig = ''
-              add_header Content-Type text/html;
-              add_header Alt-Svc 'h3=":443"; ma=2592000; persist=1';
-            '';
-            return = ''200
-              '<!DOCTYPE html>
-              <html lang="en">
-                <head>
-                  <meta charset="UTF-8">
-                  <title>Nix Cache</title>
-                </head>
-                <body>
-                  <center>
-                    <h1 style="font-size: 8em">
-                      ❄️ Nix Cache
-                    </h1>
-                    <p style="font-weight: bold">
-                      Public Key: nixbin.sinanmohd.com:dXV3KDPVrm+cGJ2M1ZmTeQJqFGaEapqiVoWHgYDh03k=
-                    </p>
-                  </center>
-                </body>
-              </html>'
-            '';
-          };
-
-          "/".proxyPass = "http://${config.services.nix-serve.bindAddress}:${
-              toString config.services.nix-serve.port
-          }";
         };
-      };
-
-
-      "www.alinafs.com" = defaultOpts // {
-        useACMEHost = null;
-        enableACME = true;
-        globalRedirect = "alinafs.com/home";
-        extraConfig = ''
-          ssl_early_data on;
-        '';
-      };
-      "alinafs.com" = defaultOpts // {
-        useACMEHost = null;
-        enableACME = true;
 
-        locations = {
-          "/metrics".return = "307 /home/";
-          "/" = {
-            proxyWebsockets = true;
-            proxyPass = "http://127.0.0.1:${builtins.toString config.services.alina.port}";
-          };
+        "www.alinafs.com" = defaultOpts // {
+          useACMEHost = null;
+          enableACME = true;
+          globalRedirect = "alinafs.com/home";
+          extraConfig = ''
+            ssl_early_data on;
+          '';
         };
+        "alinafs.com" = defaultOpts // {
+          useACMEHost = null;
+          enableACME = true;
+
+          locations = {
+            "/metrics".return = "307 /home/";
+            "/" = {
+              proxyWebsockets = true;
+              proxyPass = "http://127.0.0.1:${builtins.toString config.services.alina.port}";
+            };
+          };
 
-        extraConfig = ''
-          proxy_buffering off;
-          proxy_request_buffering off;
-          client_max_body_size 0;
-        '';
+          extraConfig = ''
+            proxy_buffering off;
+            proxy_request_buffering off;
+            client_max_body_size 0;
+          '';
+        };
       };
-    };
   };
 }
diff --git a/os/kay/pkgs/matrix-sliding-sync.nix b/os/kay/pkgs/matrix-sliding-sync.nix
index 17051dc..2095817 100644
--- a/os/kay/pkgs/matrix-sliding-sync.nix
+++ b/os/kay/pkgs/matrix-sliding-sync.nix
@@ -1,6 +1,7 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
 }:
 
 buildGoModule rec {