stuff

2025-05-23 17:56:46 -07:00
parent bd4d27d948
commit 91a27769ba
54 changed files with 1278 additions and 1148 deletions
--- a/archive.nix
+++ b/archive.nix
@@ -25,18 +25,17 @@ let
    storeContents = pkgs.linkFarmFromDrvs "store-contents" pxeConfig.netboot.storeContents;
  };
  extraBuilds = { inherit isoContents pxeContents; };
-  buildListWithout = builtins.filter (v: !builtins.elem v ignoreList) (builtins.attrNames self.buildList);
+  buildListWithout = builtins.filter (v: !builtins.elem v ignoreList) (
+    builtins.attrNames self.buildList
+  );
  allBuilds = self.buildList // extraBuilds;
 in
 rec {
-  archiveList = map (
-    name:
-    {
+  archiveList = map (name: {
    inherit name;
    broken = builtins.elem name self.brokenBuilds;
    impure = builtins.elem name self.impureBuilds;
-    }
-  ) (buildListWithout ++ builtins.attrNames extraBuilds);
+  }) (buildListWithout ++ builtins.attrNames extraBuilds);

  drvs = allBuilds;
  buildDepsDrvs = builtins.mapAttrs (_: v: pkgs.closureInfo { rootPaths = [ v.drvPath ]; }) drvs;
--- a/common/defaultPackages.nix
+++ b/common/defaultPackages.nix
@@ -10,7 +10,8 @@ let
  enableFfmpegFull = enableFfmpeg && config.vacu.isGui;
  enableFfmpegHeadless = enableFfmpeg && !config.vacu.isGui;
 in
-{ vacu.packages = lib.mkMerge [
+{
+  vacu.packages = lib.mkMerge [
    {
      borgbackup.enable = config.vacu.isDev && (pkgs.system != "aarch64-linux"); # borgbackup build is borken on aarch64
      ffmpeg-vacu-full = {
@@ -87,8 +88,7 @@ in
        wl-clipboard
      ''
    )
-  (lib.mkIf config.vacu.isDev
-    ''
+    (lib.mkIf config.vacu.isDev ''
      cargo
      gnumake
      patchelf
@@ -96,9 +96,9 @@ in
      ruby
      rustc
      rust-script
+      shellcheck
      stdenv.cc
-    ''
-  )
+    '')
    (lib.mkIf (!config.vacu.isMinimal)
      # big pkgs for non-minimal systems
      ''
@@ -185,8 +185,7 @@ in
    ''
    # packages that are in [`requiredPackages`][1]  in nixos, but maybe not included in nix-on-droid
    # [1]: https://github.com/NixOS/nixpkgs/blob/26d499fc9f1d567283d5d56fcf367edd815dba1d/nixos/modules/config/system-path.nix#L11
-  (lib.optionalAttrs (vacuModuleType == "nix-on-droid")
-    ''
+    (lib.optionalAttrs (vacuModuleType == "nix-on-droid") ''
      acl
      attr
      bashInteractive
@@ -217,6 +216,6 @@ in
      which
      xz
      zstd
-    ''
-  )
-]; }
+    '')
+  ];
+}
--- a/common/hosts.nix
+++ b/common/hosts.nix
@@ -1,8 +1,4 @@
-{
-  lib,
-  vacuModules,
-  ...
-}:
+{ lib, vacuModules, ... }:
 {
  imports = [
    vacuModules.knownHosts
@@ -33,7 +29,10 @@

    #colin's stuff
    "servo" = {
-      altNames = [ "git.uninsane.org" "uninsane.org" ];
+      altNames = [
+        "git.uninsane.org"
+        "uninsane.org"
+      ];
      isLan = true;
      sshKeys = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfdSmFkrVT6DhpgvFeQKm3Fh9VKZ9DbLYOPOJWYQ0E8";
    };
@@ -135,9 +134,7 @@
      sshKeys = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA6lX25mCy35tf1NpcHMAdeRgvT7l0Dw0FWBH3eX4TE2";
    };
    legtop = {
-      altNames = [
-        "lt"
-      ];
+      altNames = [ "lt" ];
      isLan = true;
      sshKeys = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKvunOGsmHg8igMGo0FpoXaegYI20wZylG8nsMFY4+JL";
    };
--- a/common/nixos.nix
+++ b/common/nixos.nix
@@ -6,9 +6,7 @@
  ...
 }:
 lib.optionalAttrs (vacuModuleType == "nixos") {
-  imports = [
-    ../nixos-modules
-  ];
+  imports = [ ../nixos-modules ];
  options.vacu.underTest = lib.mkOption {
    default = false;
    type = lib.types.bool;
--- a/common/nixvim.nix
+++ b/common/nixvim.nix
@@ -22,9 +22,7 @@ in
  };
  config = {
    vacu.nixvimPkg = inputs.self.packages.${pkgs.system}.${nixvim-name};
-    vacu.shell.functions =
-      lib.mkIf (!config.vacu.isMinimal)
-        {
+    vacu.shell.functions = lib.mkIf (!config.vacu.isMinimal) {
      nvim-plain = ''${pkgs.neovim}/bin/nvim "$@"'';
      nvim-nixvim = ''${config.vacu.nixvimPkg}/bin/nvim "$@"'';
      nvim = ''nvim-nixvim "$@"'';
--- a/common/shell/not-aliases.nix
+++ b/common/shell/not-aliases.nix
@@ -7,9 +7,9 @@
 }:
 let
  script =
-    name:
-    content:
-    pkgs.writers.makeScriptWriter {
+    name: content:
+    pkgs.writers.makeScriptWriter
+      {
        interpreter = lib.getExe pkgs.bashInteractive;
        check = lib.escapeShellArgs [
          (lib.getExe pkgs.shellcheck)
@@ -17,17 +17,18 @@ let
          "--severity=info"
          pkgs.shellvaculib.file
        ];
-    } "/bin/${name}" ''
+      }
+      "/bin/${name}"
+      ''
        set -euo pipefail
        source ${lib.escapeShellArg pkgs.shellvaculib.file}
        ${content}
-    ''
-  ;
+      '';
  simple =
-    name:
-    args:
+    name: args:
    let
-      binContents = ''#!${lib.getExe pkgs.bash}
+      binContents = ''
+        #!${lib.getExe pkgs.bash}
                exec ${lib.escapeShellArgs args} "$@"'';
      funcContents = ''
        local aliasName=${lib.escapeShellArg name}
@@ -40,9 +41,7 @@ let
        _comp_command_offset 0
      '';
    in
-    pkgs.runCommandLocal name {
-      meta.mainProgram = name;
-    } ''
+    pkgs.runCommandLocal name { meta.mainProgram = name; } ''
      mkdir -p $out/bin
      echo ${lib.escapeShellArg binContents} > $out/bin/${name}
      out_base="$(dirname "$out")"
@@ -118,11 +117,29 @@ in
      nix shell "''${new_args[@]}"
    '')
    (simple "sc" [ systemctl ])
-    (simple "scs" [systemctl "status" "--lines=20" "--full"])
-    (simple "scc" [systemctl "cat"])
-    (simple "scr" [systemctl "restart"])
-    (simple "jc" [journalctl "--pager-end"])
-    (simple "jcu" [journalctl "--pager-end" "-u"])
+    (simple "scs" [
+      systemctl
+      "status"
+      "--lines=20"
+      "--full"
+    ])
+    (simple "scc" [
+      systemctl
+      "cat"
+    ])
+    (simple "scr" [
+      systemctl
+      "restart"
+    ])
+    (simple "jc" [
+      journalctl
+      "--pager-end"
+    ])
+    (simple "jcu" [
+      journalctl
+      "--pager-end"
+      "-u"
+    ])
    (script "list-auto-roots" ''
      auto_roots="/nix/var/nix/gcroots/auto"
      svl_exact_args $# 0
--- a/common/shell/vacuhistory.nix
+++ b/common/shell/vacuhistory.nix
@@ -1,7 +1,4 @@
-{
-  pkgs,
-  ...
-}:
+{ pkgs, ... }:
 {
  config.vacu = {
    shell.idempotentShellLines = ''
--- a/common/staticNames.nix
+++ b/common/staticNames.nix
@@ -9,27 +9,32 @@ let
  domainPartRegex = "[[:alnum:]]([[:alnum:]-]{0,61}[[:alnum:]])?";
  domainRegex = ''^${domainPartRegex}(\.${domainPartRegex})*$'';
  domainType = types.strMatching domainRegex;
-  hostsLines = 
-    lib.pipe config.vacu.staticNames [
+  hostsLines = lib.pipe config.vacu.staticNames [
    (lib.mapAttrsToList (k: v: [ k ] ++ v))
    (lib.filter (v: (builtins.length v) > 1))
    (map (lib.concatStringsSep " "))
    (lib.concatStringsSep "\n")
  ];
  ip4Seg = ''[0-9]{1,3}'';
-  ip4Regex = lib.concatStringsSep ''\.'' [ ip4Seg ip4Seg ip4Seg ip4Seg ];
+  ip4Regex = lib.concatStringsSep ''\.'' [
+    ip4Seg
+    ip4Seg
+    ip4Seg
+    ip4Seg
+  ];
  ip6Regex = ''[0-9a-fA-F:]+'';
  ipRegex = ''(${ip4Regex})|(${ip6Regex})'';
 in
 {
-  imports = [{
-    vacu.assertions = map (ip: 
+  imports =
+    [
      {
+        vacu.assertions = map (ip: {
          assertion = (builtins.match ipRegex ip) != null;
          message = ''config.vacu.staticNames: attr name "${ip}" is invalid'';
+        }) (builtins.attrNames config.vacu.staticNames);
      }
-    ) (builtins.attrNames config.vacu.staticNames);
-  }]
+    ]
    ++ lib.optional (vacuModuleType == "nixos") { networking.hosts = config.vacu.staticNames; }
    ++ lib.optional (vacuModuleType == "nix-on-droid") {
      environment.etc.hosts.text = ''
@@ -37,8 +42,7 @@ in
        ::1 localhost
        ${hostsLines}
      '';
-    }
-  ;
+    };

  options.vacu.staticNames = mkOption {
    type = types.attrsOf (types.listOf domainType);
@@ -46,14 +50,40 @@ in
  };

  config.vacu.staticNames = {
-    "205.201.63.13" = [ "prop" "prophecy" "prophecy.shelvacu-static" ];
+    "205.201.63.13" = [
+      "prop"
+      "prophecy"
+      "prophecy.shelvacu-static"
+    ];
    "10.78.79.22" = [ "prophecy.t2d.lan.shelvacu-static" ];
-    "178.128.79.152" = [ "liam" "liam.shelvacu-static" ];
-    "172.83.159.53" = [ "trip" "triple-dezert" "triple-dezert.shelvacu-static" ];
+    "178.128.79.152" = [
+      "liam"
+      "liam.shelvacu-static"
+    ];
+    "172.83.159.53" = [
+      "trip"
+      "triple-dezert"
+      "triple-dezert.shelvacu-static"
+    ];
    "10.78.79.237" = [ "triple-dezert.t2d.lan.shelvacu-static" ];
-    "205.201.63.12" = [ "servo" "uninsane-servo.shelvacu-static" ];
-    "10.78.79.1" = [ "vnopn" "vnopn.shelvacu-static" "vnopn.t2d.lan.shelvacu-static" ];
-    "10.78.79.11" = [ "mmm" "mmm.shelvacu-static" "mmm.t2d.lan.shelvacu-static" ];
-    "10.78.79.69" = [ "oeto" "oeto.shelvacu-static" "oeto.t2d.lan.shelvacu-static" ];
+    "205.201.63.12" = [
+      "servo"
+      "uninsane-servo.shelvacu-static"
+    ];
+    "10.78.79.1" = [
+      "vnopn"
+      "vnopn.shelvacu-static"
+      "vnopn.t2d.lan.shelvacu-static"
+    ];
+    "10.78.79.11" = [
+      "mmm"
+      "mmm.shelvacu-static"
+      "mmm.t2d.lan.shelvacu-static"
+    ];
+    "10.78.79.69" = [
+      "oeto"
+      "oeto.shelvacu-static"
+      "oeto.t2d.lan.shelvacu-static"
+    ];
  };
 }
--- a/dns/for.miras.pet.nix
+++ b/dns/for.miras.pet.nix
@@ -13,10 +13,13 @@ in
        "git".A = singleton dnsData.tripPublicV4;
        "auth".A = singleton dnsData.tripPublicV4;
        "wisdom".A = singleton dnsData.tripPublicV4;
-        "chat" = { ... }: {
+        "chat" =
+          { ... }:
+          {
            imports = [ dnsData.modules.liamMail ];
            config.A = singleton dnsData.tripPublicV4;
-          config.subdomains."duo-1745490301302-14f65157._domainkey".TXT = singleton "v=DKIM1; k=rsa; s=email; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDA/94Rh5eMPsKwGGolkleY1Rhh2Q6H22bfdGVu0lXpoHP1K7JxloWu/Ice2vVN/udztmPY+BK1x+5qubcGZKpPt1bC9amsXnyTXfKIMGD2CNd0tnaO54hmMOfv+lTA9YjF0X93tcQP3yUxJgJ9yPZcalFl/bBAqv4/lUVLYFeIVQIDAQAB";
+            config.subdomains."duo-1745490301302-14f65157._domainkey".TXT =
+              singleton "v=DKIM1; k=rsa; s=email; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDA/94Rh5eMPsKwGGolkleY1Rhh2Q6H22bfdGVu0lXpoHP1K7JxloWu/Ice2vVN/udztmPY+BK1x+5qubcGZKpPt1bC9amsXnyTXfKIMGD2CNd0tnaO54hmMOfv+lTA9YjF0X93tcQP3yUxJgJ9yPZcalFl/bBAqv4/lUVLYFeIVQIDAQAB";
          };
        "gabriel-dropout".A = singleton dnsData.tripPublicV4;
        "_acme-challenge".CNAME = singleton "199b8aa4-bc9f-4f43-88bf-3f613f62b663.auwwth.dis8.net.";
--- a/dns/shelvacu.com.nix
+++ b/dns/shelvacu.com.nix
@@ -1,4 +1,9 @@
-{ lib, config, dns, ... }:
+{
+  lib,
+  config,
+  dns,
+  ...
+}:
 let
  s = v: [ v ];
  inherit (config.vacu) dnsData;
--- a/flake.nix
+++ b/flake.nix
@@ -157,7 +157,10 @@
        }:
        let
          inputs = mkInputs { inherit unstable inp; };
-          pkgs = mkPkgs { useUnstable = unstable; inherit system; };
+          pkgs = mkPkgs {
+            useUnstable = unstable;
+            inherit system;
+          };
        in
        inputs.nixpkgs.lib.nixosSystem {
          specialArgs = {
@@ -193,7 +196,10 @@
      nixosConfigurations = {
        triple-dezert = mkNixosConfig {
          module = ./triple-dezert;
-          inp = [ "most-winningest" "sops-nix" ];
+          inp = [
+            "most-winningest"
+            "sops-nix"
+          ];
        };
        compute-deck = mkNixosConfig {
          module = ./compute-deck;
@@ -232,7 +238,10 @@
        prophecy = mkNixosConfig {
          module = ./prophecy;
          system = "x86_64-linux";
-          inp = [ "impermanence" "sops-nix" ];
+          inp = [
+            "impermanence"
+            "sops-nix"
+          ];
        };
      };

@@ -272,9 +281,7 @@
              imports = [
                commonTestModule
                ./tests/${name}
-                {
-                  node.specialArgs.inputs = self.nixosConfigurations.${name}._module.specialArgs.inputs;
-                }
+                { node.specialArgs.inputs = self.nixosConfigurations.${name}._module.specialArgs.inputs; }
              ];
            };
          checksFromConfig = plain.config.vacu.checks;
@@ -372,7 +379,14 @@
              imports = [ ./nixvim ];
              _module.args = { inherit pkgs-unstable; };
            };
-            extraSpecialArgs = { inherit unstable inputs system minimal; };
+            extraSpecialArgs = {
+              inherit
+                unstable
+                inputs
+                system
+                minimal
+                ;
+            };
          };
        nixpkgs-args = {
          inherit system;
@@ -384,11 +398,12 @@
        _plain = mkPlain pkgs-unstable;
        plain = _plain.config.vacu.withAsserts _plain;
        treefmtEval = inputs.treefmt-nix.lib.evalModule pkgs-unstable ./treefmt.nix;
+        formatter = treefmtEval.config.build.wrapper;
        vacuPackagePaths = import ./packages;
        vacuPackages = builtins.intersectAttrs vacuPackagePaths pkgs-stable;
      in
      {
-        formatter = treefmtEval.config.build.wrapper;
+        inherit formatter;
        apps.sops = {
          type = "app";
          program = lib.getExe self.packages.${system}.wrappedSops;
@@ -409,6 +424,7 @@
            inherit pkgs lib inputs;
            inherit (plain) config;
          };
+          inherit formatter;
          generated = pkgs-stable.linkFarm "generated" {
            nixpkgs = "${inputs.nixpkgs}";
            "liam-test/hints.py" = pkgs.writeText "hints.py" (
@@ -424,12 +440,26 @@
              builtins.dirOf self.checks.x86_64-linux.liam.nodes.checker.vacu.mailtest.smtp.interpreter
            );
          };
-          host-pxe-installer = pkgs.callPackage ./host-pxe-installer.nix { nixosInstaller = self.nixosConfigurations.shel-installer-pxe; };
+          host-pxe-installer = pkgs.callPackage ./host-pxe-installer.nix {
+            nixosInstaller = self.nixosConfigurations.shel-installer-pxe;
+          };
          liam-sieve-script = self.nixosConfigurations.liam.config.vacu.liam-sieve-script;
-          nixvim = mkNixvim { unstable = false; minimal = false; };
-          nixvim-unstable = mkNixvim { unstable = true; minimal = false; };
-          nixvim-minimal = mkNixvim { unstable = false; minimal = true; };
-          nixvim-unstable-minimal = mkNixvim { unstable = true; minimal = true; };
+          nixvim = mkNixvim {
+            unstable = false;
+            minimal = false;
+          };
+          nixvim-unstable = mkNixvim {
+            unstable = true;
+            minimal = false;
+          };
+          nixvim-minimal = mkNixvim {
+            unstable = false;
+            minimal = true;
+          };
+          nixvim-unstable-minimal = mkNixvim {
+            unstable = true;
+            minimal = true;
+          };
          sopsConfig = plain.config.vacu.sopsConfigFile;
          sourceTree = plain.config.vacu.sourceTree;
          units = plain.config.vacu.units.finalPackage;
--- a/fw/apex.nix
+++ b/fw/apex.nix
@@ -1,5 +1,10 @@
 # everything to interact with my apex flex, pcsc stuff, fido2 stuff, etc
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 let
  # to match package used in config.services.pcscd, unfortunately not exposed like usual
  pcsclite-pkg = if config.security.polkit.enable then pkgs.pcscliteWithPolkit else pkgs.pcsclite;
--- a/host-pxe-installer.nix
+++ b/host-pxe-installer.nix
@@ -15,7 +15,8 @@ in
 (linkFarm "host-pixie-installer" {
  "bin/host-pixie-installer" = "${script}/bin/host-pixie-installer";
  inherit (build) kernel netbootRamdisk;
-}).overrideAttrs (old: {
+}).overrideAttrs
+  (old: {
    meta = {
      mainProgram = "host-pixie-installer";
    };
--- a/installer/common/default.nix
+++ b/installer/common/default.nix
@@ -1,8 +1,4 @@
-{
-  config,
-  lib,
-  ...
-}:
+{ config, lib, ... }:
 {
  # this is an installer image, created anew every time. There's no state we need to worry about messing up
  system.stateVersion = config.system.nixos.version;
--- a/installer/iso.nix
+++ b/installer/iso.nix
@@ -1,7 +1,4 @@
-{
-  modulesPath,
-  ...
-}:
+{ modulesPath, ... }:
 {
  imports = [
    ./common
--- a/installer/pxe.nix
+++ b/installer/pxe.nix
@@ -1,7 +1,4 @@
-{
-  modulesPath,
-  ...
-}:
+{ modulesPath, ... }:
 {
  imports = [
    ./common
--- a/liam/sieve.nix
+++ b/liam/sieve.nix
@@ -487,10 +487,10 @@ let
        "X-GitLab-Project"
      ])}
      ${pure_flags [ "git-uninsane" "git" "not-spamish" "B" ] (envelope_is "git-uninsane@shelvacu.com")}
-      ${pure_flags [ "github" "git" "not-spamish" "B" ] (
-        header_matches "List-Id" "*<*.github.com>"
+      ${pure_flags [ "github" "git" "not-spamish" "B" ] (header_matches "List-Id" "*<*.github.com>")}
+      ${pure_flags [ "mailing-list-by-envelope" "not-spamish" "B" ] (
+        envelope_matches "*-ml@shelvacu.com"
      )}
-      ${pure_flags [ "mailing-list-by-envelope" "not-spamish" "B" ] (envelope_matches "*-ml@shelvacu.com")}
      
      ${pure_flags [ "discourse" "not-spamish" "B" ] (exists "X-Discourse-Post-Id")}
      ${pure_flags [ "agora" "not-spamish" ] (envelope_is "agora@shelvacu.com")}
@@ -530,8 +530,14 @@ let
      ${pure_flags [ "rsb" "B" ] (from_is "support@rapidseedbox.com")}
      ${pure_flags [ "fresh-avocado-dis8" "D" ] (envelope_is "fresh.avocado@dis8.net")}
      ${pure_flags [ "discord" "A" ] (envelope_matches "discord@*")}
-      ${pure_flags ["za-sa" "D"] (from_matches ["*@*.sa.com" "*@*.za.com"])}
-      ${pure_flags ["localdomain" "D"] (from_matches ["*@*.local" "*@*.localdomain"])}
+      ${pure_flags [ "za-sa" "D" ] (from_matches [
+        "*@*.sa.com"
+        "*@*.za.com"
+      ])}
+      ${pure_flags [ "localdomain" "D" ] (from_matches [
+        "*@*.local"
+        "*@*.localdomain"
+      ])}
      ${pure_flags [ "helium" "D" ] (envelope_is "creepyface@dis8.net")}
      ${pure_flags [ "sharkmood" "C" ] (envelope_is "sharkmood@dis8.net")}
      ${pure_flags [ "im-not-district-158" "D" ] (envelope_is [
@@ -548,14 +554,17 @@ let
        (subject_is "Your authentication code")
      ])}

-      ${pure_flags ["spamish-by-headers" "C"] [
+      ${pure_flags
+        [ "spamish-by-headers" "C" ]
+        [
          (anyof [
            (header_is "Precedence" "bulk")
            (exists "List-Unsubscribe")
            (exists "List-Unsubscribe-Post")
          ])
          ''not hasflag "not-spamish"''
-      ]}
+        ]
+      }

      if hasflag "agora" {
        ${fileinto "M.agora"}
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -1,5 +1,9 @@
 let
  directoryListing = builtins.removeAttrs (builtins.readDir ./.) [ "default.nix" ];
-  packagePaths = builtins.mapAttrs (k: v: assert v == "directory"; ./${k}/module.nix) directoryListing;
+  packagePaths = builtins.mapAttrs (
+    k: v:
+    assert v == "directory";
+    ./${k}/module.nix
+  ) directoryListing;
 in
 packagePaths
--- a/modules/knownHosts/module.nix
+++ b/modules/knownHosts/module.nix
@@ -10,11 +10,8 @@ let
  inherit (vaculib) mkOutOption;
  nameishRegex = ''[a-z0-9_\.-]+'';
  nameish = types.strMatching nameishRegex;
-  hostModule = {
-    name,
-    config,
-    ...
-  }:
+  hostModule =
+    { name, config, ... }:
    let
      fullLanNames = lib.optional (config.isLan) "${config.primaryName}.t2d.lan";
    in
@@ -48,9 +45,7 @@ let
          type = types.listOf nameish;
          readOnly = true;
        };
-      makeStaticHostsEntry = mkOption {
-        type = types.bool;
-      };
+        makeStaticHostsEntry = mkOption { type = types.bool; };
      };
      config = {
        finalNames = lib.unique ([ config.primaryName ] ++ config.altNames ++ fullLanNames);
@@ -75,8 +70,12 @@ in
    };
    etcHostsText = mkOutOption etcHostsText;
  };
-  config = {}
-    // lib.optionalAttrs (vacuModuleType == "nixos") { networking.extraHosts = config.vacu.etcHostsText; }
-    // lib.optionalAttrs (vacuModuleType == "nix-on-droid") { environment.etc.hosts.text = config.vacu.etcHostsText; }
-  ;
+  config =
+    { }
+    // lib.optionalAttrs (vacuModuleType == "nixos") {
+      networking.extraHosts = config.vacu.etcHostsText;
+    }
+    // lib.optionalAttrs (vacuModuleType == "nix-on-droid") {
+      environment.etc.hosts.text = config.vacu.etcHostsText;
+    };
 }
--- a/modules/packageSet/module.nix
+++ b/modules/packageSet/module.nix
@@ -42,15 +42,16 @@ let
  enable = lib.mkOverride 900 true; # more important than mkDefault, less important than setting explicitly
  nameToPackageSet =
    name:
-    let pieces = lib.splitString "." name; in
+    let
+      pieces = lib.splitString "." name;
+    in
    {
      name = lib.last pieces;
      value = {
        inherit enable;
        package = lib.mkDefault (lib.attrByPath pieces (throw "Could not find package pkgs.${name}") pkgs);
      };
-    }
-  ;
+    };
  listToPackageSet =
    from:
    lib.pipe from [
@@ -69,16 +70,9 @@ let
          }
      ))
      builtins.listToAttrs
-    ]
-  ;
-  removeComments = 
-    s:
-    builtins.head (lib.splitString "#" s)
-  ;
-  nonEmpty = 
-    s:
-    (builtins.stringLength s) > 0
-  ;
+    ];
+  removeComments = s: builtins.head (lib.splitString "#" s);
+  nonEmpty = s: (builtins.stringLength s) > 0;
  stringToPackageSet =
    from:
    lib.pipe from [
@@ -88,21 +82,16 @@ let
      (builtins.filter nonEmpty)
      (map nameToPackageSet)
      builtins.listToAttrs
-    ]
-  ;
-  listOrStringToPackageSet = from:
+    ];
+  listOrStringToPackageSet =
+    from:
    if builtins.isString from then
      stringToPackageSet from
    else if builtins.isList from then
      listToPackageSet from
    else
-      throw "this should never happen; should be a list or string"
-  ;
-  listTy =
-    types.listOf (
-      types.either types.str types.package
-    )
-  ;
+      throw "this should never happen; should be a list or string";
+  listTy = types.listOf (types.either types.str types.package);
 in
 {
  options = {
@@ -116,10 +105,14 @@ in
    };
  };

-  config = {
+  config =
+    {
      vacu.finalPackageList = enabledPkgs;
    }
-  // lib.optionalAttrs (vacuModuleType == "nixos") { environment.systemPackages = config.vacu.finalPackageList; }
-  // lib.optionalAttrs (vacuModuleType == "nix-on-droid") { environment.packages = config.vacu.finalPackageList; }
-  ;
+    // lib.optionalAttrs (vacuModuleType == "nixos") {
+      environment.systemPackages = config.vacu.finalPackageList;
+    }
+    // lib.optionalAttrs (vacuModuleType == "nix-on-droid") {
+      environment.packages = config.vacu.finalPackageList;
+    };
 }
--- a/modules/ssh/module.nix
+++ b/modules/ssh/module.nix
@@ -8,12 +8,11 @@
  ...
 }:
 let
-  inherit (lib)
-    mkOption
-    types
-    ;
+  inherit (lib) mkOption types;
  inherit (vaculib) mkOutOption;
-  knownHostsAddonModule = { config, ... }: {
+  knownHostsAddonModule =
+    { config, ... }:
+    {
      options = {
        sshKeys = mkOption {
          type = types.coercedTo types.str lib.singleton (types.listOf types.str);
@@ -27,16 +26,16 @@ let
          type = types.port;
          default = 22;
        };
-      sshHostname = mkOption {
-        type = types.str;
-      };
+        sshHostname = mkOption { type = types.str; };
        sshAliases = mkOption {
          type = types.listOf types.str;
          default = [ ];
        };
      };
      config = {
-      sshHostname = lib.mkDefault (if (config.primaryIp != null) then config.primaryIp else config.primaryName);
+        sshHostname = lib.mkDefault (
+          if (config.primaryIp != null) then config.primaryIp else config.primaryName
+        );
        altNames = [ config.sshHostname ];
        sshAliases = [ config.primaryName ];
      };
@@ -44,19 +43,17 @@ let
  knownHostsParts = lib.concatMap (
    hostMod:
    let
-      knownNames = map (name: if hostMod.sshPort == 22 then name else "[${name}]:${toString hostMod.sshPort}") (hostMod.finalNames ++ hostMod.finalIps);
+      knownNames = map (
+        name: if hostMod.sshPort == 22 then name else "[${name}]:${toString hostMod.sshPort}"
+      ) (hostMod.finalNames ++ hostMod.finalIps);
    in
-    map (
-      sshKey:
-      lib.concatStringsSep "," knownNames
-      + " "
-      + sshKey
-    ) hostMod.sshKeys
+    map (sshKey: lib.concatStringsSep "," knownNames + " " + sshKey) hostMod.sshKeys
  ) (builtins.attrValues config.vacu.hosts);
  knownHostsText = lib.concatStringsSep "\n" knownHostsParts;
  hostConfigParts = builtins.concatMap (
    hostMod:
-    map (name:
+    map (
+      name:
      "Host ${name}\n"
      + lib.optionalString (hostMod.sshUsername != null) "  User ${hostMod.sshUsername}\n"
      + lib.optionalString (hostMod.sshHostname != name) "  HostName ${hostMod.sshHostname}\n"
@@ -76,7 +73,8 @@ in
    };
    vacu.ssh.config = mkOption { type = types.lines; };
  };
-  config = {
+  config =
+    {
      vacu.ssh.config = lib.mkMerge [
        (lib.mkBefore hostConfigText)
        (lib.mkAfter ''
@@ -86,7 +84,10 @@ in
        '')
      ];
    }
-  // lib.optionalAttrs (vacuModuleType == "nixos") { environment.etc."ssh/ssh_config".text = lib.mkForce config.vacu.ssh.config; }
-  // lib.optionalAttrs (vacuModuleType == "nix-on-droid") { environment.etc."ssh/ssh_config".text = config.vacu.ssh.config; }
-  ;
+    // lib.optionalAttrs (vacuModuleType == "nixos") {
+      environment.etc."ssh/ssh_config".text = lib.mkForce config.vacu.ssh.config;
+    }
+    // lib.optionalAttrs (vacuModuleType == "nix-on-droid") {
+      environment.etc."ssh/ssh_config".text = config.vacu.ssh.config;
+    };
 }
--- a/modules/systemKind/module.nix
+++ b/modules/systemKind/module.nix
@@ -23,6 +23,8 @@ in
    vacu.isContainer = mkOutOption (systemKind == "container");
    vacu.isMinimal = mkOutOption (systemKind == "minimal" || systemKind == "container");
    vacu.isGui = mkOutOption (systemKind == "desktop" || systemKind == "laptop");
-    vacu.isDev = mkOutOption (systemKind == "desktop" || systemKind == "laptop" || systemKind == "server");
+    vacu.isDev = mkOutOption (
+      systemKind == "desktop" || systemKind == "laptop" || systemKind == "server"
+    );
  };
 }
--- a/nixos-modules/default.nix
+++ b/nixos-modules/default.nix
@@ -1,5 +1 @@
-{
-  imports = [
-    ./genieacs.nix
-  ];
-}
+{ imports = [ ./genieacs.nix ]; }
--- a/nixos-modules/genieacs.nix
+++ b/nixos-modules/genieacs.nix
@@ -5,12 +5,18 @@
  ...
 }:
 let
-  inherit (lib) mkEnableOption mkOption types flip;
+  inherit (lib)
+    mkEnableOption
+    mkOption
+    types
+    flip
+    ;
  cfg = config.services.genieacs;
  enableAny = cfg.cwmp.enable || cfg.nbi.enable || cfg.fs.enable || cfg.ui.enable;
  extensionsPkg = pkgs.linkFarmFromDrvs "genieacs-extensions" cfg.extensions;
  envVarsType = types.attrsOf (types.nullOr (types.either types.str types.int));
-  commonOptsModule = { serviceShortName, config, ... }: 
+  commonOptsModule =
+    { serviceShortName, config, ... }:
    let
      environmentVarsUnprefixed = {
        WORKER_PROCESSES = config.workerProcesses;
@@ -22,7 +28,9 @@ let
        LOG_FILE = config.eventLogFile;
      };
      serviceNameCaps = lib.toUpper serviceShortName;
-    environmentVars = lib.concatMapAttrs (key: val: { "GENIEACS_${serviceNameCaps}_${key}" = val; }) environmentVarsUnprefixed;
+      environmentVars = lib.concatMapAttrs (key: val: {
+        "GENIEACS_${serviceNameCaps}_${key}" = val;
+      }) environmentVarsUnprefixed;
    in
    {
      options = {
@@ -98,7 +106,12 @@ let
    fs = envAll // cfg.fs.asEnvironmentVars // { GENIEACS_FS_URL_PREFIX = cfg.urlPrefix; };
    ui = envAll // cfg.ui.asEnvironmentVars;
  };
-  serviceNames = [ "cwmp" "nbi" "fs" "ui" ];
+  serviceNames = [
+    "cwmp"
+    "nbi"
+    "fs"
+    "ui"
+  ];
  services = map (name: {
    inherit name;
    config = cfg.${name};
@@ -152,17 +165,26 @@ in
      description = "File to dump CPE debug log. No debug log is dumped if set to `null`. This sets `GENIEACS_DEBUG_FILE`";
    };
    debugFormat = mkOption {
-      type = types.enum [ "yaml" "json" ];
+      type = types.enum [
+        "yaml"
+        "json"
+      ];
      default = "yaml";
      description = "Debug log format. This sets `GENIEACS_DEBUG_FORMAT`";
    };
    eventLogFormat = mkOption {
-      type = types.enum [ "simple" "json" ];
+      type = types.enum [
+        "simple"
+        "json"
+      ];
      default = "simple";
      description = "The format used for the log entries in {option}`eventLogFile`. This sets `GENIEACS_LOG_FORMAT`";
    };
    accessLogFormat = mkOption {
-      type = types.enum [ "simple" "json" ];
+      type = types.enum [
+        "simple"
+        "json"
+      ];
      default = "simple";
      description = "The format used for the log entries in {option}`accessLogFile`. This sets `GENIEACS_ACCESS_LOG_FORMAT`";
    };
@@ -187,25 +209,31 @@ in
      default = true;
    };

-
    cwmp = mkServiceOption "cwmp";
    nbi = mkServiceOption "nbi";
    fs = mkServiceOption "fs";
    ui = mkServiceOption "ui";
  };

-  config = lib.mkMerge ([
+  config = lib.mkMerge (
+    [
      {
-      assertions = [
+        assertions =
+          [
            {
              assertion =
                let
                  allPorts = builtins.concatMap ({ config, ... }: lib.optional config.enable config.port) services;
                in
                lib.allUnique allPorts;
-          message = "services.genieacs: All enabled genieacs services must listen on unique ports. Current ports assignments: " + (lib.concatMapStringsSep " " ({name, config, ...}: lib.optionalString config.enable "${name}=${config.port}") services);
+              message =
+                "services.genieacs: All enabled genieacs services must listen on unique ports. Current ports assignments: "
+                + (lib.concatMapStringsSep " " (
+                  { name, config, ... }: lib.optionalString config.enable "${name}=${config.port}"
+                ) services);
            }
-      ] ++ flip lib.map services (
+          ]
+          ++ flip lib.map services (
            { name, config, ... }:
            {
              assertion = (config.sslCert == null) == (config.sslKey == null);
@@ -247,8 +275,13 @@ in
          serviceConfig.BindPaths = [ (builtins.dirOf cfg.jwtSecret.path) ];
        };
      })
-  ] ++ flip map services (
-    {name, config, env}:
+    ]
+    ++ flip map services (
+      {
+        name,
+        config,
+        env,
+      }:
      lib.mkIf config.enable {
        # for those of you ripgrepping, this is what makes genieacs-cwmp.service, genieacs-nbi.service, genieacs-fs.service, and genieacs-ui.service
        systemd.services."genieacs-${name}" = {
@@ -270,10 +303,10 @@ in
              "-/etc/hosts"
              "-/etc/localtime"
            ];
-          BindPaths = []
+            BindPaths =
+              [ ]
              ++ lib.optional (config.accessLogFile != null) (builtins.dirOf config.accessLogFile)
-            ++ lib.optional (config.eventLogFile != null) (builtins.dirOf config.eventLogFile)
-          ;
+              ++ lib.optional (config.eventLogFile != null) (builtins.dirOf config.eventLogFile);
            CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
            AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];

@@ -295,7 +328,10 @@ in
            ProtectKernelModules = true;
            ProtectKernelTunables = true;
            ProtectProc = "invisible";
-          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+            RestrictAddressFamilies = [
+              "AF_INET"
+              "AF_INET6"
+            ];
            RestrictNamespaces = true;
            RestrictRealtime = true;
            RestrictSUIDSGID = true;
@@ -307,5 +343,6 @@ in
          };
        };
      }
-  ));
+    )
+  );
 }
--- a/nixvim/default.nix
+++ b/nixvim/default.nix
@@ -1,4 +1,9 @@
-{ config, lib, minimal, ... }:
+{
+  config,
+  lib,
+  minimal,
+  ...
+}:
 {
  imports = [ ./lean.nix ];
  opts = {
--- a/overlays/newPackages.nix
+++ b/overlays/newPackages.nix
@@ -1,5 +1,4 @@
 let
  newPackagePaths = import ../packages;
 in
-self: _super:
-builtins.mapAttrs (_: path: self.callPackage path { }) newPackagePaths
+self: _super: builtins.mapAttrs (_: path: self.callPackage path { }) newPackagePaths
--- a/packages/default.nix
+++ b/packages/default.nix
@@ -1,5 +1,9 @@
 let
  directoryListing = builtins.removeAttrs (builtins.readDir ./.) [ "default.nix" ];
-  packagePaths = builtins.mapAttrs (k: v: assert v == "directory"; ./${k}/package.nix) directoryListing;
+  packagePaths = builtins.mapAttrs (
+    k: v:
+    assert v == "directory";
+    ./${k}/package.nix
+  ) directoryListing;
 in
 packagePaths
--- a/packages/leanLatest/package.nix
+++ b/packages/leanLatest/package.nix
@@ -1,4 +1,8 @@
-{ lean4, fetchFromGitHub, cadical }:
+{
+  lean4,
+  fetchFromGitHub,
+  cadical,
+}:
 lean4
 # lean4.overrideAttrs (
 #   final: prev: {
--- a/packages/shellvaculib/package.nix
+++ b/packages/shellvaculib/package.nix
@@ -1,13 +1,8 @@
-{
-  runCommandLocal,
-  writeText,
-}:
+{ runCommandLocal, writeText }:
 let
  filePkg = writeText "shellvaculib.bash" (builtins.readFile ./shellvaculib.bash);
 in
-runCommandLocal "shellvaculib" {
-  passthru.file = filePkg;
-} ''
+runCommandLocal "shellvaculib" { passthru.file = filePkg; } ''
  mkdir -p $out/share
  mkdir -p $out/bin
  ln -s ${filePkg} $out/share/shellvaculib.bash
--- a/packages/vacu-history/package.nix
+++ b/packages/vacu-history/package.nix
@@ -1,7 +1,4 @@
-{
-  rustPlatform,
-  sqlite,
-}:
+{ rustPlatform, sqlite }:
 rustPlatform.buildRustPackage {
  pname = "vacu-history";
  version = "1.0.0";
--- a/prophecy/btrfs.nix
+++ b/prophecy/btrfs.nix
@@ -1,7 +1,4 @@
-{
-  pkgs,
-  ...
-}:
+{ pkgs, ... }:
 let
  btrfs-progs = pkgs.btrfs-progs;
  btrfs = "${btrfs-progs}/bin/btrfs";
@@ -18,7 +15,10 @@ in
  boot.initrd.systemd.services."vacu-impermanence-setup" = {
    enable = true;
    wantedBy = [ "initrd-root-device.target" ];
-    before = [ "sysroot.mount" "create-needed-for-boot-dirs.service" ];
+    before = [
+      "sysroot.mount"
+      "create-needed-for-boot-dirs.service"
+    ];
    serviceConfig.Type = "oneshot";
    script = ''
      set -euo pipefail
--- a/prophecy/default.nix
+++ b/prophecy/default.nix
@@ -1,6 +1,4 @@
-{
-  ...
-}:
+{ ... }:
 {
  imports = [
    ./impermanence.nix
@@ -10,16 +8,23 @@
    ./networking.nix
    ./doof.nix
    ./sops.nix
-    ({ config, lib, pkgs, ... }: {
+    (
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
        options.vacu.initramContents = lib.mkOption {
-        default =
-        pkgs.runCommand "initram-contents" {} ''
+          default = pkgs.runCommand "initram-contents" { } ''
            mkdir -p $out
            cd $out
            ${pkgs.zstd}/bin/zstdcat ${config.system.build.initialRamdisk}/initrd | ${pkgs.cpio}/bin/cpio -idmv
          '';
        };
-    })
+      }
+    )
  ];
  boot.loader.systemd-boot.enable = true;
  boot.loader.systemd-boot.memtest86.enable = true;
--- a/prophecy/doof.nix
+++ b/prophecy/doof.nix
@@ -1,8 +1,4 @@
-{
-  lib,
-  config,
-  ...
-}:
+{ lib, config, ... }:
 let
  inherit (lib) mkOption types;
  cfg = config.vacu.network;
@@ -10,9 +6,7 @@ let
  tunnelName = "doofTun";
 in
 {
-  options.vacu.network.doofPubKey = mkOption {
-    type = types.str;
-  };
+  options.vacu.network.doofPubKey = mkOption { type = types.str; };
  config = {
    vacu.network.ips = {
      doofStatic4 = "205.201.63.13";
@@ -38,7 +32,10 @@ in
      wireguardPeers = lib.singleton {
        PublicKey = cfg.doofPubKey;
        Endpoint = "tun-sea.doof.net:53263";
-        AllowedIPs = [ "0.0.0.0/0" "::/0" ];
+        AllowedIPs = [
+          "0.0.0.0/0"
+          "::/0"
+        ];
        PersistentKeepalive = 5;
      };
    };
@@ -75,4 +72,3 @@ in
    };
  };
 }
-
--- a/prophecy/genieacs.nix
+++ b/prophecy/genieacs.nix
@@ -1,7 +1,4 @@
-{
-  config,
-  ...
-}:
+{ config, ... }:
 {
  services.mongodb = {
    enable = true;
--- a/prophecy/hardware.nix
+++ b/prophecy/hardware.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
  wdc_sn530 = "/dev/disk/by-id/nvme-WDC_PC_SN530_SDBPNPZ-1T00-1006_214628801678";
  seagate_ironwolf = "/dev/disk/by-id/nvme-Seagate_IronWolf510_ZP960NM30001-2S9302_7PK0052S";
@@ -10,7 +15,14 @@ let
  md_dev = "/dev/disk/by-id/md-name-prophecy-root-crypt";
 in
 {
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "nvme"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
  boot.initrd.kernelModules = [ "raid1" ];
  boot.kernelModules = [ "kvm-amd" ];
  boot.extraModulePackages = [ ];
@@ -37,13 +49,19 @@ in
  fileSystems."/boot" = {
    device = "${wdc_sn530}-part1";
    fsType = "vfat";
-    options = [ "umask=0077" "nofail" ];
+    options = [
+      "umask=0077"
+      "nofail"
+    ];
  };

  fileSystems."/boot-alt" = {
    device = "${seagate_ironwolf}-part1";
    fsType = "vfat";
-    options = [ "umask=0077" "nofail" ];
+    options = [
+      "umask=0077"
+      "nofail"
+    ];
  };

  swapDevices = [ ];
@@ -58,4 +76,3 @@ in
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
-
--- a/prophecy/impermanence.nix
+++ b/prophecy/impermanence.nix
@@ -1,8 +1,6 @@
 { inputs, ... }:
 {
-  imports = [
-    inputs.impermanence.nixosModules.impermanence
-  ];
+  imports = [ inputs.impermanence.nixosModules.impermanence ];
  environment.persistence."/persistent" = {
    enable = true;
    hideMounts = true;
@@ -21,8 +19,6 @@
  };
  environment.persistence."/persistent-cache" = {
    enable = true;
-    directories = [
-      "/var/cache"
-    ];
+    directories = [ "/var/cache" ];
  };
 }
--- a/prophecy/networking.nix
+++ b/prophecy/networking.nix
@@ -28,7 +28,11 @@ in
  config = {
    vacu.network.ips = {
      t2dLANStatic = "10.78.79.22";
-      t2dSubnets = [ "10.78.76.0/22" "205.201.63.12/32" "172.83.159.53/32" ];
+      t2dSubnets = [
+        "10.78.76.0/22"
+        "205.201.63.12/32"
+        "172.83.159.53/32"
+      ];
      t2dRouter = "10.78.79.1";
    };
    networking.useNetworkd = true;
@@ -49,10 +53,10 @@ in
    systemd.network.networks.${cfg.lan_bridge_network} = {
      name = bridge;
      DHCP = "no";
-      address = [
-        "${cfg.ips.t2dLANStatic}/22"
-      ];
-      routes = [lan_route] ++ (lib.concatMap (subnet: [
+      address = [ "${cfg.ips.t2dLANStatic}/22" ];
+      routes =
+        [ lan_route ]
+        ++ (lib.concatMap (subnet: [
          {
            Scope = "link";
            Destination = subnet;
@@ -79,4 +83,3 @@ in
    };
  };
 }
-
--- a/scripts/archive/archive.py
+++ b/scripts/archive/archive.py
@@ -6,6 +6,7 @@ from typing import Any
 from dataclasses import dataclass
 from collections.abc import Callable

+
@dataclass
 class ProcessResult[T]:
    stdout: T
@@ -18,34 +19,35 @@ class ProcessResult[T]:
        new_stdout: U = f(self.stdout)
        return ProcessResult(stdout=new_stdout, returncode=self.returncode)

+
 def run(*cmd: str) -> ProcessResult[str]:
    print(f"running {cmd!r}")
    proc = subprocess.Popen(
-        cmd,
-        stdout=subprocess.PIPE,
-        stderr=None,
-        stdin=subprocess.DEVNULL,
-        text=True
+        cmd, stdout=subprocess.PIPE, stderr=None, stdin=subprocess.DEVNULL, text=True
    )
    (stdout_data, _) = proc.communicate()
    print(f"finished, exit code {proc.returncode}")
    return ProcessResult(stdout=stdout_data, returncode=proc.returncode)

+
 def must_succeed(*cmd: str) -> str:
    res = run(*cmd)
    assert res.success()
    return res.stdout

+
 def parse_maybe_json(maybe_json: str) -> Any:
    if maybe_json.strip() == "":
        return None
    else:
        return json.loads(maybe_json)

+
 def run_json(*cmd: str) -> ProcessResult[Any]:
    res = run(*cmd)
    return res.map(parse_maybe_json)

+
 def do_build(installable: str, impure: bool) -> bool:
    eval_command = ["nix", "derivation", "show", installable]
    if impure:
@@ -56,7 +58,15 @@ def do_build(installable: str, impure: bool) -> bool:
    drv_paths = list(res.stdout.keys())
    for drv_path in drv_paths:
        print(f"{installable=} {drv_path=}")
-        res = run_json("nix", "build", "-j1", "--keep-going", "--no-link", "--json", drv_path + "^*")
+        res = run_json(
+            "nix",
+            "build",
+            "-j1",
+            "--keep-going",
+            "--no-link",
+            "--json",
+            drv_path + "^*",
+        )
        if not res.success():
            return False
        builds = res.stdout
@@ -68,6 +78,7 @@ def do_build(installable: str, impure: bool) -> bool:
                    return False
    return True

+
 res = run_json("nix", "eval", ".#.", "--json", "--apply", "f: f.archival.archiveList")
 assert res.success()
 build_list = res.stdout
--- a/scripts/archive/default.nix
+++ b/scripts/archive/default.nix
@@ -1,4 +1 @@
-{
-  writers,
-}:
-writers.writePython3Bin "vacu-flake-archive" { } (builtins.readFile ./archive.py)
+{ writers }: writers.writePython3Bin "vacu-flake-archive" { } (builtins.readFile ./archive.py)
--- a/tests/liam/default.nix
+++ b/tests/liam/default.nix
@@ -264,10 +264,12 @@ in
        };
      };
      environment.systemPackages = [
-        (lib.hiPrio (pkgs.writeScriptBin "borg" ''
+        (lib.hiPrio (
+          pkgs.writeScriptBin "borg" ''
            echo "bad: called plain bin/borg" >&2
            exit 1
-        ''))
+          ''
+        ))
        (pkgs.writeScriptBin "borg14" ''
          exec ${lib.getExe pkgs.borgbackup} "$@"
        '')
--- a/tests/liam/testScript/main.py
+++ b/tests/liam/testScript/main.py
@@ -286,9 +286,7 @@ d = Defaults(
    username="shelvacu",
 )
 # test refilter
-d.make_tester().smtp_accepted().imap_move_to("MagicRefilter").imap_found_in(
-    "B"
-)
+d.make_tester().smtp_accepted().imap_move_to("MagicRefilter").imap_found_in("B")
 # refilter doesnt activate on other folders
 d.make_tester().smtp_accepted().imap_move_to("testFolder").imap_found_in("testFolder")
 d.make_tester().smtp_accepted().imap_move_to("INBOX").imap_found_in("INBOX")
@@ -309,9 +307,7 @@ d.make_tester().smtp_accepted(
    mailfrom="shipment-tracking@amazon.com",
    rcptto="amznbsns@shelvacu.com",
    subject="Your Amazon.com order has shipped (#123-1234)",
-).imap_expect(
-    mailbox="C", flags=["amazon-ignore"]
-)
+).imap_expect(mailbox="C", flags=["amazon-ignore"])

 TesterThing().smtp_accepted(
    rcptto="shelvacu@shelvacu.com", username="shelvacu", smtp_starttls=True
--- a/4
+++ b/4
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash

-set -e
+set -euo pipefail

 function fail() {
  msg="$1"
@@ -11,7 +11,7 @@ function fail() {
 git add .
 declare -a flake_archive_cmd=(nix flake archive --json)
 declare -a prefix
-if [ "$HOST" != "triple-dezert" ]; then
+if [[ ${HOST-x} != "triple-dezert" ]]; then
  flake_archive_cmd+=(--to "ssh://trip")
  prefix+=(ssh trip -- sudo)
 fi
--- a/treefmt.nix
+++ b/treefmt.nix
@@ -1,4 +1,4 @@
-{ ... }:
+{ pkgs, ... }:
 let
  shellFiles = [
    "*.sh"
@@ -15,8 +15,17 @@ in
  projectRootFile = "flake.nix";
  programs.nixfmt.enable = true;
  programs.nixfmt.strict = true;
-  programs.shellcheck.enable = true;
-  programs.shellcheck.includes = shellFiles;
+  programs.shellcheck = {
+    enable = true;
+    includes = shellFiles;
+  };
+  settings.formatter.shellcheck.options = [
+    "--external-sources"
+    "--norc"
+    "--source-path=${pkgs.shellvaculib}/bin"
+    "--enable=all"
+    "--exclude=SC2250"
+  ];
  programs.shfmt.enable = true;
  programs.shfmt.includes = shellFiles;
  programs.deno.enable = true;
--- a/triple-dezert/default.nix
+++ b/triple-dezert/default.nix
@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 {
  imports = [
    ./hardware-configuration.nix
--- a/triple-dezert/proxied/services/jl-stats.nix
+++ b/triple-dezert/proxied/services/jl-stats.nix
@@ -1,4 +1,9 @@
-{ config, inputs, pkgs, ... }:
+{
+  config,
+  inputs,
+  pkgs,
+  ...
+}:
 let
  name = "jl-stats";
  contain = config.containers.${name};
--- a/triple-dezert/proxied/services/mira/mira-chat.nix
+++ b/triple-dezert/proxied/services/mira/mira-chat.nix
@@ -1,4 +1,9 @@
-{ lib, pkgs, config, ... }:
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
 let
  domain = "chat.for.miras.pet";
  port = 3169;
--- a/triple-dezert/sops.nix
+++ b/triple-dezert/sops.nix
@@ -1,4 +1,9 @@
-{ inputs, config, lib, ... }:
+{
+  inputs,
+  config,
+  lib,
+  ...
+}:
 {
  imports = [ inputs.sops-nix.nixosModules.sops ];

--- a/validate-matrix-user-id.nix
+++ b/validate-matrix-user-id.nix
@@ -1,33 +0,0 @@
-{ lib }:
-let
-  inherit (lib) length isString substring optional elemAt match;
-in
-userId:
-assert isString userId;
-let
-  splitOnColon = lib.splitString ":" userId;
-  # https://spec.matrix.org/v1.14/appendices/#user-identifiers
-  errors = []
-    # "The length of a user ID, including the @ sigil and the domain, MUST NOT exceed 255 bytes."
-    ++ optional ((length userId) > 255) "must be 255 bytes or shorter"
-    ++ optional ((substring 0 1 userId) != "@") "must start with an @ symbol"
-    ++ optional ((length splitOnColon) < 2) "must have a : inbetween the username and the server"
-    ++ optional ((length splitOnColon) > 3) "too many : symbols"
-    ++ if (length splitOnColon) < 2 || (length splitOnColon) > 3 then [] else (
-      let
-        localpart_with_at = elemAt splitOnColon 0;
-        localpart = substring 1 -1 localpart_with_at;
-        domain = elemAt splitOnColon 1;
-        port = if (length splitOnColon) == 3 then elemAt splitOnColon 2 else null;
-      in
-      []
-      ++ optional ((length localpart) == 0) "username is missing"
-      ++ optional ((match "[0-9a-z+/_=.-]+" localpart) == null) "username must only contain digits 0-9, lowercase letters a-z, and any of the symbols +/_=.-"
-      ++ optional (
-    )
-  ;
-in
-{
-  inherit errors;
-  valid = (length errors) == 0;
-}