formatting

flake.nix

@@ -8,7 +8,8 @@
     };
   };
 
-  outputs = inputs @ { self, nixpkgs, nixos-unstable, home-manager }: let
+  outputs = inputs@{ self, nixpkgs, nixos-unstable, home-manager }:
+    let
       system = "x86_64-linux";
 
       pkgs = import nixpkgs {
@@ -22,15 +23,33 @@
         config.allowUnfree = true;
       };
 
-    utils = import ./lib { inherit pkgs unstable nixpkgs nixos-unstable home-manager; };
+      utils = import ./lib {
+        inherit pkgs unstable nixpkgs nixos-unstable home-manager;
+      };
 
       inherit (utils) host;
       inherit (utils) user;
     in {
       nixosConfigurations = {
-      architect = host.mkHost { name = "architect"; users = [ { user = "giulio"; roles = [ "git" ]; } ]; };
+        architect = host.mkHost {
-      gAluminum = host.mkHost { name = "gAluminum"; users = [ { user = "giulio"; roles = [ "desktop" "ssh" "git" ]; } ]; roles = [ "gnome" ]; };
+          name = "architect";
-      proxy = host.mkHost { name = "proxy"; users = []; };
+          users = [{
+            user = "giulio";
+            roles = [ "git" ];
+          }];
+        };
+        gAluminum = host.mkHost {
+          name = "gAluminum";
+          users = [{
+            user = "giulio";
+            roles = [ "desktop" "ssh" "git" ];
+          }];
+          roles = [ "gnome" ];
+        };
+        proxy = host.mkHost {
+          name = "proxy";
+          users = [ ];
+        };
       };
     };
 }

hosts/architect/backup.nix

@@ -1,4 +1,4 @@
-{config, lib, ...} :
+{ config, lib, ... }:
 
 {
   services.restic.backups = {

hosts/architect/bazarr.nix

@@ -1,5 +1,4 @@
-with import ./network.nix;
+with import ./network.nix; {
-{
   services = {
     bazarr.enable = true;
 
@@ -22,5 +21,5 @@ with import ./network.nix;
     ${architect-wg} ${bazarrdomain}
   '';
 
-  users.groups.media.members = ["bazarr"];
+  users.groups.media.members = [ "bazarr" ];
 }

hosts/architect/dns.nix

@@ -4,7 +4,7 @@
   services = {
     dnsmasq = {
       enable = true;
-      servers     = ["127.0.0.1#5300"];
+      servers = [ "127.0.0.1#5300" ];
       extraConfig = ''
         localise-queries
         min-cache-ttl=120
@@ -13,14 +13,14 @@
     };
 
     adguardhome = {
-      enable= true;
+      enable = true;
       port = 3031;
     };
 
     dnscrypt-proxy2 = {
       enable = true;
       settings = {
-        listen_addresses   = ["127.0.0.1:5353"];
+        listen_addresses = [ "127.0.0.1:5353" ];
         ipv4_servers = true;
         ipv6_servers = false;
         block_ipv6 = true;
@@ -32,7 +32,7 @@
         lb_strategy = "p4";
         lb_estimator = true;
         ignore_system_dns = true;
-        fallback_resolvers = ["1.1.1.1:53" "9.9.9.9:53"];
+        fallback_resolvers = [ "1.1.1.1:53" "9.9.9.9:53" ];
         cache_min_ttl = 450;
         cache_max_ttl = 2400;
       };

hosts/architect/fail2ban.nix

@@ -1,5 +1,4 @@
-{ config, pkgs, ... }:
+{ config, pkgs, ... }: {
-{
   services.fail2ban = {
     enable = true;
     package = pkgs.fail2ban;
@@ -7,7 +6,7 @@
     banaction = "nftables-multiport";
     banaction-allports = "nftables-allport";
     bantime-increment.enable = true;
-#    ignoreIP = [ "10.0.0.0/24" "10.3.0.0/24" ];
+    #    ignoreIP = [ "10.0.0.0/24" "10.3.0.0/24" ];
     daemonConfig = ''
       [Definition]
       loglevel     = INFO

hosts/architect/firewall.nix

@@ -1,4 +1,4 @@
-{config, lib, ...} :
+{ config, lib, ... }:
 
 with import ./network.nix;
 
@@ -50,7 +50,9 @@ in {
 
                   chain POSTROUTING {
                     type nat hook postrouting priority srcnat; policy accept;
-            oifname ${wan-if} ip saddr {${lib.concatStringsSep "," towan-wg}} masquerade
+                    oifname ${wan-if} ip saddr {${
+                      lib.concatStringsSep "," towan-wg
+                    }} masquerade
                   }
                 }
 
@@ -132,14 +134,22 @@ in {
                     ct state established,related accept
 
                     # client to client
-            ip saddr {${lib.concatStringsSep "," c2c-wg}} ip daddr {${lib.concatStringsSep "," c2c-wg}} accept
+                    ip saddr {${lib.concatStringsSep "," c2c-wg}} ip daddr {${
+                      lib.concatStringsSep "," c2c-wg
+                    }} accept
                     
                     # gdevices talking to everyone in VPN
-            ip saddr {${lib.concatStringsSep "," gdevices-wg}} ip daddr ${vpn-net} accept
+                    ip saddr {${
-            ip saddr {${lib.concatStringsSep "," gamenet-wg}} ip daddr {${lib.concatStringsSep "," gamenet-wg}} accept
+                      lib.concatStringsSep "," gdevices-wg
+                    }} ip daddr ${vpn-net} accept
+                    ip saddr {${
+                      lib.concatStringsSep "," gamenet-wg
+                    }} ip daddr {${lib.concatStringsSep "," gamenet-wg}} accept
                     
                     # nat to wan
-            oifname ${wan-if} ip saddr {${lib.concatStringsSep "," towan-wg}} accept
+                    oifname ${wan-if} ip saddr {${
+                      lib.concatStringsSep "," towan-wg
+                    }} accept
                     
                     jump filter_drop
                   }

hosts/architect/gitea.nix

@@ -1,5 +1,4 @@
-with import ./network.nix;
+with import ./network.nix; {
-{
   services.gitea = {
     enable = true;
     database.type = "sqlite3";

hosts/architect/hardware.nix

@@ -4,46 +4,47 @@
 { config, lib, pkgs, modulesPath, ... }:
 
 {
-  imports =
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-  ];
 
-  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.availableKernelModules =
+    [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "zpool/nixos/root";
+    device = "zpool/nixos/root";
     fsType = "zfs";
   };
 
-  fileSystems."/home" =
+  fileSystems."/home" = {
-    { device = "zpool/data/home";
+    device = "zpool/data/home";
     fsType = "zfs";
   };
 
-  fileSystems."/media" =
+  fileSystems."/media" = {
-    { device = "datapool/media";
+    device = "datapool/media";
     fsType = "zfs";
   };
 
-  fileSystems."/secrets" =
+  fileSystems."/secrets" = {
-    { device = "backedpool/secrets";
+    device = "backedpool/secrets";
     fsType = "zfs";
   };
 
-  fileSystems."/var/lib" =
+  fileSystems."/var/lib" = {
-    { device = "backedpool/services";
+    device = "backedpool/services";
     fsType = "zfs";
   };
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    { device = "/dev/disk/by-uuid/AF19-5616";
+    device = "/dev/disk/by-uuid/AF19-5616";
     fsType = "vfat";
   };
 
-
+  swapDevices = [{
-  swapDevices = [ { device = "/dev/zpool/data/swap"; size = 40000; } ];
+    device = "/dev/zpool/data/swap";
+    size = 40000;
+  }];
 
 }

hosts/architect/jellyfin.nix

@@ -1,11 +1,8 @@
 { pkgs, ... }:
 
-with import ./network.nix;
+with import ./network.nix; {
-{
+  disabledModules = [ "services/misc/jellyfin.nix" ];
-  disabledModules = ["services/misc/jellyfin.nix"];
+  imports = [ ./modules/jellyfin.nix ];
-  imports = [
-    ./modules/jellyfin.nix
-  ];
 
   services = {
     jellyfin = {
@@ -32,7 +29,7 @@ with import ./network.nix;
     ${architect-wg} ${mediadomain}
   '';
 
-    users.groups.media.members = ["jellyfin"];
+  users.groups.media.members = [ "jellyfin" ];
-    users.groups.video.members = ["jellyfin"];
+  users.groups.video.members = [ "jellyfin" ];
-    users.groups.render.members = ["jellyfin"];
+  users.groups.render.members = [ "jellyfin" ];
 }

hosts/architect/matrix.nix

@@ -1,7 +1,6 @@
 { pkgs, config, tmp, ... }:
 
-with import ./network.nix;
+with import ./network.nix; {
-{
   services = {
     matrix-synapse = {
       enable = true;
@@ -10,7 +9,7 @@ with import ./network.nix;
       public_baseurl = "https://${matrixdomain}";
       registration_shared_secret = "runas!";
       dynamic_thumbnails = true;
-#      enable_registration = true;
+      #      enable_registration = true;
       app_service_config_files = [
         "/var/lib/matrix-synapse/discord-registration.yaml"
         "/var/lib/matrix-synapse/telegram-registration.yaml"
@@ -22,21 +21,17 @@ with import ./network.nix;
           - "#gaming:matrix.giugl.io"
           - "#movies:matrix.giugl.io"
       '';
-      listeners = [
+      listeners = [{
-        {
         port = 8008;
         bind_address = "::1";
         type = "http";
         tls = false;
         x_forwarded = true;
-          resources = [
+        resources = [{
-            {
           names = [ "client" "federation" ];
           compress = false;
-            }
+        }];
-          ];
+      }];
-        }
-      ];
       turn_uris = [
         "turns:turn.giugl.io:5349?transport=udp"
         "turns:turn.giugl.io:5349?transport=tcp"
@@ -48,14 +43,10 @@ with import ./network.nix;
     postgresql = {
       enable = true;
       ensureDatabases = [ "synapse" ];
-      ensureUsers = [
+      ensureUsers = [{
-        {
         name = "matrix-synapse";
-          ensurePermissions = {
+        ensurePermissions = { "DATABASE synapse" = "ALL PRIVILEGES"; };
-            "DATABASE synapse" = "ALL PRIVILEGES";
+      }];
-          };
-        }
-      ];
     };
 
     nginx.virtualHosts = {
@@ -64,15 +55,13 @@ with import ./network.nix;
         enableACME = true;
         forceSSL = true;
         locations."= /.well-known/matrix/server".extraConfig =
-          let
+          let server = { "m.server" = "${matrixdomain}:443"; };
-            server = { "m.server" = "${matrixdomain}:443"; };
           in ''
             add_header Content-Type application/json;
             return 200 '${builtins.toJSON server}';
           '';
 
-          locations."= /.well-known/matrix/client".extraConfig =
+        locations."= /.well-known/matrix/client".extraConfig = let
-            let
           client = {
             "m.homeserver" = { "base_url" = "https://${matrixdomain}:443"; };
             "m.identity_server" = { "base_url" = "https://vector.im"; };
@@ -84,7 +73,6 @@ with import ./network.nix;
           return 200 '${builtins.toJSON client}';
         '';
 
-
         locations."/".extraConfig = ''
           return 404;
         '';
@@ -174,16 +162,16 @@ with import ./network.nix;
       };
     };
 
-};
+  };
 
-systemd.services.mautrix-telegram.path = with pkgs; [
+  systemd.services.mautrix-telegram.path = with pkgs; [
     lottieconverter # for animated stickers conversion, unfree package
     ffmpeg # if converting animated stickers to webm (very slow!)
-];
+  ];
 
-networking.extraHosts = ''
+  networking.extraHosts = ''
     ${architect-lan} ${matrixdomain} ${matrixwebdomain}
     ${architect-wg} ${matrixdomain} ${matrixwebdomain}
-'';
+  '';
 
 }

hosts/architect/minecraft.nix

@@ -1,14 +1,11 @@
-{config, pkgs, ...}:
+{ config, pkgs, ... }:
 
-with import ./network.nix;
+with import ./network.nix; {
-{
   services.minecraft-server = {
     enable = true;
     eula = true;
     declarative = true;
-    serverProperties = {
+    serverProperties = { motd = "Welcome on the RuNas server!"; };
-      motd = "Welcome on the RuNas server!";
-    };
   };
 
   networking.extraHosts = ''

hosts/architect/minio.nix

@@ -1,5 +1,4 @@
-with import ./network.nix;
+with import ./network.nix; {
-{
   services = {
     minio.enable = true;
 

hosts/architect/modules/jellyfin.nix

@@ -2,10 +2,8 @@
 
 with lib;
 
-let
+let cfg = config.services.jellyfin;
-  cfg = config.services.jellyfin;
+in {
-in
-{
   options = {
     services.jellyfin = {
       enable = mkEnableOption "Jellyfin Media Server";
@@ -56,7 +54,8 @@ in
         SupplementaryGroups = [ "video" ];
         StateDirectory = "jellyfin";
         CacheDirectory = "jellyfin";
-        ExecStart = "${cfg.package}/bin/jellyfin --datadir '/var/lib/${StateDirectory}' --cachedir '/var/cache/${CacheDirectory}'";
+        ExecStart =
+          "${cfg.package}/bin/jellyfin --datadir '/var/lib/${StateDirectory}' --cachedir '/var/cache/${CacheDirectory}'";
         Restart = "on-failure";
 
         # Security options:
@@ -67,40 +66,40 @@ in
         CapabilityBoundingSet = "";
 
         # ProtectClock= adds DeviceAllow=char-rtc r
-#        DeviceAllow = [
+        #        DeviceAllow = [
-#          "char-drm r" 
+        #          "char-drm r" 
-#          "/dev/nvidia0 r" 
+        #          "/dev/nvidia0 r" 
-#          "/dev/nvidiactl r"
+        #          "/dev/nvidiactl r"
-#          "/dev/nvidia-uvm r"
+        #          "/dev/nvidia-uvm r"
-#          "/dev/nvidia-uvm-tools r"
+        #          "/dev/nvidia-uvm-tools r"
-#        ];
+        #        ];
 
-#        LockPersonality = true;
+        #        LockPersonality = true;
-#
+        #
         PrivateTmp = true;
-#        PrivateUsers = true;
+        #        PrivateUsers = true;
-#
+        #
-#        ProtectClock = true;
+        #        ProtectClock = true;
-#        ProtectControlGroups = true;
+        #        ProtectControlGroups = true;
-#        ProtectHostname = true;
+        #        ProtectHostname = true;
-#        ProtectKernelLogs = true;
+        #        ProtectKernelLogs = true;
-#        ProtectKernelModules = true;
+        #        ProtectKernelModules = true;
-#        ProtectKernelTunables = true;
+        #        ProtectKernelTunables = true;
-#
+        #
-#        RemoveIPC = true;
+        #        RemoveIPC = true;
-#
+        #
-#        RestrictNamespaces = true;
+        #        RestrictNamespaces = true;
-#        # AF_NETLINK needed because Jellyfin monitors the network connection
+        #        # AF_NETLINK needed because Jellyfin monitors the network connection
-#        RestrictAddressFamilies = [ "AF_NETLINK" "AF_INET" "AF_INET6" ];
+        #        RestrictAddressFamilies = [ "AF_NETLINK" "AF_INET" "AF_INET6" ];
-#        RestrictRealtime = true;
+        #        RestrictRealtime = true;
-#        RestrictSUIDSGID = true;
+        #        RestrictSUIDSGID = true;
-#
+        #
-#        SystemCallArchitectures = "native";
+        #        SystemCallArchitectures = "native";
-#        SystemCallErrorNumber = "EPERM";
+        #        SystemCallErrorNumber = "EPERM";
-#        SystemCallFilter = [
+        #        SystemCallFilter = [
-#          "@system-service"
+        #          "@system-service"
-#          "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@obsolete" "~@privileged" "~@setuid"
+        #          "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@obsolete" "~@privileged" "~@setuid"
-#        ];
+        #        ];
       };
     };
 
@@ -111,9 +110,7 @@ in
       };
     };
 
-    users.groups = mkIf (cfg.group == "jellyfin") {
+    users.groups = mkIf (cfg.group == "jellyfin") { jellyfin = { }; };
-      jellyfin = {};
-    };
 
     networking.firewall = mkIf cfg.openFirewall {
       # from https://jellyfin.org/docs/general/networking/index.html

hosts/architect/network.nix

@@ -51,11 +51,22 @@ rec {
   wolfsonhouse-wg = "10.3.0.203";
 
   # groups
-  gdevices-wg      = [ galuminum-wg oneplus-wg ipad-wg gbeast-wg peppiniell-wg padulino-wg ];
+  gdevices-wg =
+    [ galuminum-wg oneplus-wg ipad-wg gbeast-wg peppiniell-wg padulino-wg ];
   routers-wg = [ hotpottino-wg angellane-wg dodino-wg wolfsonhouse-wg ];
   c2c-wg = [ ] ++ gdevices-wg;
-  towan-wg         = [ shield-wg parisaphone-wg parisapc-wg ] ++ gdevices-wg ++ routers-wg;
+  towan-wg = [ shield-wg parisaphone-wg parisapc-wg ] ++ gdevices-wg
-  gamenet-wg       = [ andrew-wg galuminum-wg gbeast-wg mikey-wg andrewdesktop-wg mikeylaptop-wg flavio-wg salvatore-wg ];
+    ++ routers-wg;
+  gamenet-wg = [
+    andrew-wg
+    galuminum-wg
+    gbeast-wg
+    mikey-wg
+    andrewdesktop-wg
+    mikeylaptop-wg
+    flavio-wg
+    salvatore-wg
+  ];
 
   # domains
   sonarrdomain = "htson.giugl.io";

hosts/architect/nextcloud.nix

@@ -1,7 +1,6 @@
-{pkgs, ...}:
+{ pkgs, ... }:
 
-with import ./network.nix;
+with import ./network.nix; {
-{
   services = {
     mysql.enable = true;
     mysql.package = pkgs.unstable.mysql80;
@@ -29,14 +28,14 @@ with import ./network.nix;
         dbpassFile = "/secrets/nextcloud/dbpass.txt";
         adminpassFile = "/secrets/nextcloud/adminpass.txt";
         adminuser = "giulio";
-        extraTrustedDomains = ["${nextclouddomain}"];
+        extraTrustedDomains = [ "${nextclouddomain}" ];
       };
     };
   };
 
   systemd.services."nextcloud-setup" = {
-    requires = ["mysql.service"];
+    requires = [ "mysql.service" ];
-    after = ["mysql.service"];
+    after = [ "mysql.service" ];
   };
 
   networking.extraHosts = ''

hosts/architect/nginx.nix

@@ -1,4 +1,4 @@
-{services, ...}:
+{ services, ... }:
 
 {
   services.nginx = {
@@ -8,28 +8,28 @@
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
 
-#    virtualHosts."giugl.io" = {
+    #    virtualHosts."giugl.io" = {
-#      default = true;
+    #      default = true;
-#      enableACME = true;
+    #      enableACME = true;
-#      addSSL = true;
+    #      addSSL = true;
-#      root = "/var/lib/nginx/error_pages";
+    #      root = "/var/lib/nginx/error_pages";
-#      extraConfig = "error_page 404 /index.htm;";
+    #      extraConfig = "error_page 404 /index.htm;";
-#
+    #
-#      locations = {
+    #      locations = {
-#        "/" = {
+    #        "/" = {
-#          return = "404";
+    #          return = "404";
-#        };
+    #        };
-#
+    #
-#        "/index.htm" = {
+    #        "/index.htm" = {
-#        };
+    #        };
-#
+    #
-#        "/style.css" = {
+    #        "/style.css" = {
-#        };
+    #        };
-#
+    #
-#        "/wat.jpg" = {
+    #        "/wat.jpg" = {
-#        };
+    #        };
-#      };
+    #      };
-#    };
+    #    };
   };
 
   users.groups.acme.members = [ "nginx" ];

hosts/architect/nzbget.nix

@@ -1,5 +1,4 @@
-with import ./network.nix;
+with import ./network.nix; {
-{
   services = {
     nzbget.enable = true;
 
@@ -22,5 +21,5 @@ with import ./network.nix;
     ${architect-wg} ${nzbgetdomain}
   '';
 
-  users.groups.media.members = ["nzbget"];
+  users.groups.media.members = [ "nzbget" ];
 }

hosts/architect/overseerr.nix

@@ -1,4 +1,4 @@
-{...}:
+{ ... }:
 
 {
   virtualisation.oci-containers.containers."overseerr" = {

hosts/architect/plex.nix

@@ -1,7 +1,6 @@
-{ pkgs, ...}:
+{ pkgs, ... }:
 
-with import ./network.nix;
+with import ./network.nix; {
-{
   services.plex = {
     enable = true;
     package = pkgs.unstable.plex;
@@ -75,9 +74,7 @@ with import ./network.nix;
           proxy_redirect off;
           proxy_buffering off;
       '';
-      locations."/" = {
+      locations."/" = { proxyPass = "http://localhost:32400"; };
-        proxyPass = "http://localhost:32400";
-      };
     };
   };
 
@@ -86,6 +83,6 @@ with import ./network.nix;
     ${architect-wg} ${mediadomain}
   '';
 
-  users.groups.media.members = ["plex"];
+  users.groups.media.members = [ "plex" ];
 
 }

hosts/architect/prowlarr.nix

@@ -1,7 +1,6 @@
-{ pkgs, ...}:
+{ pkgs, ... }:
 
-with import ./network.nix;
+with import ./network.nix; {
-{
   services = {
     prowlarr.enable = true;
 
@@ -17,13 +16,13 @@ with import ./network.nix;
         '';
       };
 
-#      locations."/api" = {
+      #      locations."/api" = {
-#        proxyPass = "http://127.0.0.1:9696/prowlarr/api";
+      #        proxyPass = "http://127.0.0.1:9696/prowlarr/api";
-#      };
+      #      };
-#
+      #
-#      locations."/Content" = {
+      #      locations."/Content" = {
-#        proxyPass = "http://127.0.0.1:9696/prowlarr/Content";
+      #        proxyPass = "http://127.0.0.1:9696/prowlarr/Content";
-#      };
+      #      };
     };
   };
 
@@ -32,5 +31,5 @@ with import ./network.nix;
     ${architect-wg} ${prowlarrdomain}
   '';
 
-  users.groups.media.members = ["prowlarr"];
+  users.groups.media.members = [ "prowlarr" ];
 }

hosts/architect/radarr.nix

@@ -1,5 +1,4 @@
-with import ./network.nix;
+with import ./network.nix; {
-{
   services = {
     radarr.enable = true;
 
@@ -22,5 +21,5 @@ with import ./network.nix;
     ${architect-wg} ${radarrdomain}
   '';
 
-  users.groups.media.members = ["radarr"];
+  users.groups.media.members = [ "radarr" ];
 }

hosts/architect/sonarr.nix

@@ -1,5 +1,4 @@
-with import ./network.nix;
+with import ./network.nix; {
-{
   services = {
     sonarr.enable = true;
 
@@ -22,5 +21,5 @@ with import ./network.nix;
     ${architect-wg} ${sonarrdomain}
   '';
 
-  users.groups.media.members = ["sonarr"];
+  users.groups.media.members = [ "sonarr" ];
 }

hosts/architect/transmission.nix

@@ -1,7 +1,6 @@
 with import ./network.nix;
 
-let
+let domain = "httra.giugl.io";
-  domain = "httra.giugl.io";
 in {
   services = {
     transmission = {
@@ -37,5 +36,5 @@ in {
     ${architect-wg} ${domain}
   '';
 
-  users.groups.media.members = ["transmission"];
+  users.groups.media.members = [ "transmission" ];
 }

hosts/architect/wireguard.nix

@@ -1,5 +1,4 @@
-with import ./network.nix;
+with import ./network.nix; {
-{
   networking = {
     extraHosts = ''
       ${architect-wg} architect.devs.giugl.io
@@ -35,222 +34,209 @@ with import ./network.nix;
 
     wireguard = {
       interfaces.${proxy-if} = {
-        ips = ["10.4.0.2/32"];
+        ips = [ "10.4.0.2/32" ];
         privateKeyFile = "/secrets/wireguard/proxy.key";
-        peers = [
+        peers = [{
-          {
           publicKey = "WmJBpXpYebcmJEF8nVTKMqQK01KyBe42vzc38K66rVs=";
-            allowedIPs = ["10.4.0.1/32"];
+          allowedIPs = [ "10.4.0.1/32" ];
           endpoint = "giugl.io:1195";
           persistentKeepalive = 21;
-          }
+        }];
-        ];
       };
 
       interfaces.${vpn-if} = {
         listenPort = 1194;
-        ips = ["10.3.0.1/24"];
+        ips = [ "10.3.0.1/24" ];
         privateKeyFile = "/secrets/wireguard/server.key";
 
         peers = [
           {
             # gAluminum
-          allowedIPs = [galuminum-wg];
+            allowedIPs = [ galuminum-wg ];
             publicKey = "pEEgSs7xmO0cfyvoQlU8lfwqdYM1ISgmPAunPtF+0xw=";
           }
 
           {
             # OnePlus
-          allowedIPs = [oneplus-wg];
+            allowedIPs = [ oneplus-wg ];
             publicKey = "zynSERy6VhxN5zBf1ih3BOAHxvigDixHB9YKnSBgYFs=";
           }
 
           {
             # iPad
-          allowedIPs = [ipad-wg];
+            allowedIPs = [ ipad-wg ];
             publicKey = "DPpd+P/hV1XLuvdcrCRv1sgz8BeZt1y5D6VehNuhjSQ=";
           }
 
-
           {
             # Manduria
-          allowedIPs = [manduria-wg];
+            allowedIPs = [ manduria-wg ];
             publicKey = "wT38oXvDQ8g0hI+pAXQobOWf/Wott2zhwo8TLvXK400=";
           }
 
-
           {
             # Antonio
-          allowedIPs = [antonio-wg];
+            allowedIPs = [ antonio-wg ];
             publicKey = "SPndCvEzuLHtGAQV8u/4dfLlFHoPcXS3L98oFOwTljc=";
           }
 
-
           {
             # Eleonora
-          allowedIPs = [eleonora-wg];
+            allowedIPs = [ eleonora-wg ];
             publicKey = "SL54f1ZeieFyn5X5UAPmypP10GV/c419O94vCzGHFhg=";
           }
 
-
           {
             # padulino
-          allowedIPs = [padulino-wg];
+            allowedIPs = [ padulino-wg ];
             publicKey = "sk2Wr2OesND9jcuP/8k7BirSpR4pNNbS9gBkbOxZxwg=";
           }
 
-
           {
             # GBEAST
-          allowedIPs = [gbeast-wg];
+            allowedIPs = [ gbeast-wg ];
             publicKey = "XiK+wk+DErz0RmCWRxuaJN1cvdj+3DoiU6tcR+uZfAI=";
           }
 
-
           {
             # parisa-phone
-          allowedIPs = [parisaphone-wg];
+            allowedIPs = [ parisaphone-wg ];
             publicKey = "t9EUnIkfr1b2HPlTXi17+AKMMe5VfeKq7exRVAwaai0=";
           }
 
-
           {
             # parisa-pc
-          allowedIPs = [parisapc-wg];
+            allowedIPs = [ parisapc-wg ];
             publicKey = "b2QzZDTgGQbNXSCLYB4KUzq0/099pH2T8H5BckfNSTQ=";
           }
 
-
           {
             # peppiniell
-         allowedIPs = [peppiniell-wg];
+            allowedIPs = [ peppiniell-wg ];
             publicKey = "bzoW3Rx+7Un9hx/2opgBQJmmnZ/hgj1lQ2FnonCHjTc=";
           }
 
-
           {
             # angellane
-          allowedIPs = [angellane-wg];
+            allowedIPs = [ angellane-wg ];
             publicKey = "MZ+nZklHpBxTL7QN9QJpBBx7yOYRZLONfvqAnuk85x0=";
           }
 
-
           {
             # hotpottino
-          allowedIPs = [hotpottino-wg];
+            allowedIPs = [ hotpottino-wg ];
             publicKey = "YqtzTWqGBs2GwSPNO0aRSV4nvJDW3UHHt6fV4UC7vnU=";
           }
 
-
           {
             # shield
-          allowedIPs = [shield-wg];
+            allowedIPs = [ shield-wg ];
             publicKey = "1GaV/M48sHqQTrBVRQ+jrFU2pUMmv2xkguncVcwPCFs=";
           }
 
           {
             # pepos
-          allowedIPs = [pepos-wg];
+            allowedIPs = [ pepos-wg ];
             publicKey = "mb1VaMLML5J24oCMBuhqvBrT6S4tAqWERn30z+h/LwM=";
           }
 
           {
             # salvatore
-          allowedIPs = [salvatore-wg];
+            allowedIPs = [ salvatore-wg ];
             publicKey = "fhlnBHeMyHZKLUCTSA9kmkKoM5x/qzz/rnCJrUh3Gzs=";
           }
 
           {
             # papa
-          allowedIPs = [papa-wg];
+            allowedIPs = [ papa-wg ];
             publicKey = "oGHygt02Oni3IFbScKD0NVEfHKCp6bpw68aq5g4RrAA=";
           }
 
           {
             # defy
-          allowedIPs = [defy-wg];
+            allowedIPs = [ defy-wg ];
             publicKey = "Cvi/eto7E6Ef+aiL81ou7x12fJCeuXrf/go9fxEqXG4=";
           }
 
           {
             # germano
-          allowedIPs = [germano-wg];
+            allowedIPs = [ germano-wg ];
             publicKey = "gi4o+pZWKItzVs7vY8fvXh98jX6CNeCwc1YDzhc3mA4=";
           }
 
           {
             # flavio
-          allowedIPs = [flavio-wg];
+            allowedIPs = [ flavio-wg ];
             publicKey = "Yg0P+yHi/9SZHyoel8jT9fmmu+irLYmT8yMp/CZoaSg=";
           }
 
           {
             # dodino
-          allowedIPs = [dodino-wg];
+            allowedIPs = [ dodino-wg ];
             publicKey = "JHkqlADQpY1CUcivraG9i6rIzCzLVFcl8HP5uIk35lk=";
           }
 
           {
             # tommy
-          allowedIPs = [tommy-wg];
+            allowedIPs = [ tommy-wg ];
             publicKey = "tytknU7wql1d0A2provX3RP7CNcEIajfgBJKoSyVLgo=";
           }
 
           {
             # alain
-          allowedIPs = [alain-wg];
+            allowedIPs = [ alain-wg ];
             publicKey = "/o2msFJoUL4yovcIQJTU8c1faFtekrjSBBWJABouWno=";
           }
 
           {
             # dima
-          allowedIPs = [dima-wg];
+            allowedIPs = [ dima-wg ];
             publicKey = "svzWYIZ6v+cLCp/emGG7mx2YpBJqw2fqjVuHZy7b6H0=";
           }
 
           {
             # wolfsonhouse
-          allowedIPs = [wolfsonhouse-wg];
+            allowedIPs = [ wolfsonhouse-wg ];
             publicKey = "UJRJcAOcnEjEB3o4K2I7gEM97SrhENEesZNf28z+EBQ=";
           }
 
           {
             # mikey
-          allowedIPs = [mikey-wg];
+            allowedIPs = [ mikey-wg ];
             publicKey = "ewbDdX3z7nxG2aPIf9TogXkhxPlGipLFcy6XfyDC6gI=";
           }
 
           {
             # andrew
-          allowedIPs = [andrew-wg];
+            allowedIPs = [ andrew-wg ];
             publicKey = "LP/FgST9fmBQSoKQFq9sFGvjRFOtRooMcuEcjuqaoWM=";
           }
 
           {
             # mikey laptop
-          allowedIPs = [mikeylaptop-wg];
+            allowedIPs = [ mikeylaptop-wg ];
             publicKey = "kz/pY/PgV+dwF1JZ2It4r5B5QfRSQM7HkbFCdvd5Yxk=";
           }
 
           {
             # andrew desktop
-          allowedIPs = [andrewdesktop-wg];
+            allowedIPs = [ andrewdesktop-wg ];
             publicKey = "rpYr3JNLIzxpxzFuQuaHFEl/XvPEPfwLbDETBP8KYXI=";
           }
 
           {
             # laptop desktop
-          allowedIPs = [jacopo-wg];
+            allowedIPs = [ jacopo-wg ];
             publicKey = "W/taWI79bPIKOolVVu5xZfiJnPw9K91Xn1zhcM0+4g0=";
           }
 
           {
             # frznn
-          allowedIPs = [frznn-wg];
+            allowedIPs = [ frznn-wg ];
             publicKey = "dXcrdME6VnnE5PBYwvUmayf7cn2wpcExeCR9gIXOO0o=";
           }
         ];
       };
     };
-};
+  };
 }

hosts/gAluminum/default.nix

@@ -1,12 +1,8 @@
 { config, pkgs, ... }:
 
-let
+let hostname = "gAluminum";
-  hostname = "gAluminum";
 in {
-  imports = [ 
+  imports = [ ./hardware.nix ./wireguard.nix ];
-    ./hardware.nix 
-    ./wireguard.nix
-  ];
 
   boot = {
     supportedFilesystems = [ "ntfs" ];
@@ -51,4 +47,3 @@ in {
   environment.systemPackages = with pkgs; [ efibootmgr ];
   system.stateVersion = "21.05"; # Did you read the comment?
 }
-

hosts/gAluminum/hardware.nix

@@ -4,22 +4,21 @@
 { config, lib, pkgs, modulesPath, ... }:
 
 {
-  imports =
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
+  boot.initrd.availableKernelModules =
+    [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
   boot.initrd.kernelModules = [ "dm-snapshot" ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "/dev/disk/by-uuid/92ad62ff-627e-4fd7-9ced-0c0716d3f848";
+    device = "/dev/disk/by-uuid/92ad62ff-627e-4fd7-9ced-0c0716d3f848";
     fsType = "ext4";
   };
 
-  fileSystems."/boot/efi" =
+  fileSystems."/boot/efi" = {
-    { device = "/dev/disk/by-uuid/3008-4A28";
+    device = "/dev/disk/by-uuid/3008-4A28";
     fsType = "vfat";
   };
 

hosts/gAluminum/wireguard.nix

@@ -1,17 +1,15 @@
 {
   networking.wg-quick.interfaces = {
     giupi = {
-      address = ["10.3.0.2/32"];
+      address = [ "10.3.0.2/32" ];
       privateKeyFile = "/etc/wireguard/giupi.key";
-      dns = ["10.3.0.1"];
+      dns = [ "10.3.0.1" ];
-      peers = [
+      peers = [{
-        {
         publicKey = "I4glUMvIGjjhvQMKhwGc8copPl2t9Us/YYRjT0BKuiw=";
-          allowedIPs = ["0.0.0.0/0"];
+        allowedIPs = [ "0.0.0.0/0" ];
         endpoint = "architect.devs.giugl.io:1194";
         persistentKeepalive = 25;
-        }
+      }];
-      ];
     };
   };
 }

hosts/proxy/coturn.nix

@@ -1,4 +1,4 @@
-{pkgs, config, ...}:
+{ pkgs, config, ... }:
 
 let
   public_ip = "23.88.108.216";
@@ -50,12 +50,11 @@ in {
   };
   networking.firewall = {
     interfaces.ens3 = let
-      range = with config.services.coturn; [ {
+      range = with config.services.coturn; [{
         from = min-port;
         to = max-port;
-    } ];
+      }];
-    in
+    in {
-    {
       allowedUDPPortRanges = range;
       allowedUDPPorts = [ 5349 ];
       #allowedTCPPortRanges = range;

hosts/proxy/default.nix

@@ -1,12 +1,8 @@
 { config, pkgs, ... }:
 
 {
-  imports = [ 
+  imports =
-    ./hardware-configuration.nix
+    [ ./hardware-configuration.nix ./coturn.nix ./wireguard.nix ./ssh.nix ];
-    ./coturn.nix
-    ./wireguard.nix
-    ./ssh.nix
-  ];
 
   boot.loader.grub = {
     enable = true;
@@ -28,4 +24,3 @@
     "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCuURERnIFe2XbNu6AsPe2DO11RuaHxVGUcaoJUsIB1F+VOggOVLhxSenOPYLm6NvvGeXVi95G5Sm1UZRcJEEkvxus4bSViV4t/Q2azfYFE27yRH/IeMMoWNPGYNm5Bok2qFb4vHifra9FffwXnOzr0nDDTdHXCft4TO5nsenLJwqu5zOO1CR7J52otY7LheNPyzbGxgIkB3Y7LeOj1+/xXSOJ379NOL2RQBobsg7k442WCX7tU6AC1ct3W+93tcJUUdzJKTT9TJ+XmhdjXNWhDd+QZUNAMr+nKoEdExHp0H40/wIhcLD2OV95gX4i/YBzCg4OQOqZqWiibiEQfGTSAh5aD+nX/PqjXf0XSLEUOA81biLFu28oO8gocjwnhgqmlghvO4SG1rs6uZ8EyPyWsrVMjy8B9FX4aloKqua3aicgC+upjLl3x+KkMJizlMB5Ew7KOjPsjXwMqeJmeBOEd6TSEctttR+lIp+/368FtwXeBxzx9MBT4620mnjWtVKM= giulio@gAluminum"
   ];
 }
-

hosts/proxy/hardware-configuration.nix

@@ -4,17 +4,16 @@
 { config, lib, pkgs, modulesPath, ... }:
 
 {
-  imports =
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-    [ (modulesPath + "/profiles/qemu-guest.nix")
-    ];
 
-  boot.initrd.availableKernelModules = [ "ata_piix" "virtio_pci" "virtio_scsi" "xhci_pci" "sd_mod" "sr_mod" ];
+  boot.initrd.availableKernelModules =
+    [ "ata_piix" "virtio_pci" "virtio_scsi" "xhci_pci" "sd_mod" "sr_mod" ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "/dev/disk/by-uuid/8b5bcd4a-02b8-4e11-b856-eda792b8b7b8";
+    device = "/dev/disk/by-uuid/8b5bcd4a-02b8-4e11-b856-eda792b8b7b8";
     fsType = "ext4";
   };
 

hosts/proxy/ssh.nix

@@ -1,4 +1,4 @@
-{ config, ...}:
+{ config, ... }:
 
 {
   services = {

hosts/proxy/wireguard.nix

@@ -1,4 +1,4 @@
-{ config, ...}:
+{ config, ... }:
 
 let
   wg_if = "wg0";
@@ -11,13 +11,11 @@ in {
       enable = true;
       externalInterface = wan_if;
       internalInterfaces = [ wg_if ];
-      forwardPorts = [
+      forwardPorts = [{
-        {
         destination = "10.4.0.2:1194";
         proto = "udp";
         sourcePort = 1194;
-        }
+      }];
-      ];
     };
 
     wireguard = {
@@ -34,12 +32,10 @@ in {
           /run/current-system/sw/bin/iptables -t nat -D POSTROUTING -o ${wg_if} -j MASQUERADE
         '';
 
-        peers = [
+        peers = [{
-          {
           allowedIPs = [ "10.4.0.2" "10.3.0.0/24" ];
           publicKey = "73oFhyQA3mgX4GmN6ul5HuOsgxa4INlzCPsyuXna0AA=";
-          }
+        }];
-        ];
       };
     };
   };

lib/default.nix

@@ -1,5 +1,6 @@
-{ pkgs, unstable, nixpkgs, nixos-unstable, home-manager, ...}:
+{ pkgs, unstable, nixpkgs, nixos-unstable, home-manager, ... }: rec {
-rec {
   user = import ./user.nix { inherit pkgs; };
-  host = import ./host.nix { inherit pkgs nixpkgs unstable nixos-unstable home-manager user; };
+  host = import ./host.nix {
+    inherit pkgs nixpkgs unstable nixos-unstable home-manager user;
+  };
 }

lib/user.nix

@@ -1,23 +1,26 @@
-{ pkgs, ...}:
+{ pkgs, ... }:
 
 {
-  mkUser = { name, roles ? [] }: 
+  mkUser = { name, roles ? [ ] }:
     let
       mkRole = role: import (../roles/home + "/${role}.nix");
       roles_mod = (map (r: mkRole r) roles);
     in {
+      users.groups.plugdev = { };
+
       fileSystems."/home/${name}/Downloads" = {
         device = "tmpfs";
         fsType = "tmpfs";
-      options = ["size=3G"];
+        options = [ "size=3G" ];
       };
 
       users.users.${name} = {
         isNormalUser = true;
         shell = pkgs.zsh;
-      extraGroups = [ "wheel" ];
+        extraGroups = [ "wheel" "plugdev" ];
       };
 
-    home-manager.users.${name}.imports = [ ../roles/home/common.nix ] ++ roles_mod;
+      home-manager.users.${name}.imports = [ ../roles/home/common.nix ]
+        ++ roles_mod;
     };
 }

roles/acme.nix

@@ -1,5 +1,4 @@
-{ ... }:
+{ ... }: {
-{
   security.acme.acceptTerms = true;
   security.acme.email = "sysadmin@giugl.io";
 }

roles/common.nix

@@ -22,13 +22,9 @@
     };
   };
 
-  nixpkgs = {
+  nixpkgs = { config = { allowUnfree = true; }; };
-    config = {
-      allowUnfree = true;
-    };
-  };
 
-  fonts.fonts = with pkgs; [cascadia-code];
+  fonts.fonts = with pkgs; [ cascadia-code ];
 
   environment.systemPackages = with pkgs; [
     file

roles/home/common.nix

@@ -15,7 +15,12 @@
 
   programs.neovim = {
     enable = true;
-    extraPackages = with pkgs; [ nodePackages.prettier cmake-format clang-tools rustfmt ];
+    extraPackages = with pkgs; [
+      nodePackages.prettier
+      cmake-format
+      clang-tools
+      rustfmt
+    ];
     extraConfig = ''
       " syntax
       syntax enable

roles/home/desktop.nix

@@ -9,8 +9,7 @@ let
     name = "guake";
     package = pkgs.guake;
   });
-in 
+in {
-  {
   imports = [ ./gnome.nix ];
 
   nixpkgs.config.allowUnfree = true;
@@ -39,4 +38,4 @@ in
     albert_autostart
     guake_autostart
   ];
-  }
+}

roles/home/gnome.nix

@@ -43,7 +43,7 @@
       screensaver = [ "<Primary><Alt>l" ];
 
       # disable screenshot
-      screenshot  = [];
+      screenshot = [ ];
     };
 
     "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0" =

roles/home/ssh.nix

@@ -144,9 +144,7 @@
         identityFile = "~/.ssh/imacmanduria";
       };
 
-      "bitbucket.org" = {
+      "bitbucket.org" = { identityFile = "~/.ssh/bitbucket"; };
-        identityFile = "~/.ssh/bitbucket";
-      };
 
       "the.al" = {
         user = "git";