diff --git a/ceph/home.nix b/ceph/home.nix
index 3813c09..4b36ff2 100644
--- a/ceph/home.nix
+++ b/ceph/home.nix
@@ -1,10 +1,11 @@
 {
   fsid = "749bf0ea-acf5-4a5e-b33e-9a057455c06b";
   clusterName = "home";
-  initialMonitors = [{
-    hostname = "myself.thehellings.lan";
-    ipAddress = "10.42.1.6";
-  }
+  initialMonitors = [
+    {
+      hostname = "myself.thehellings.lan";
+      ipAddress = "10.42.1.6";
+    }
     {
       hostname = "jeremiah.thehellings.lan";
       ipAddress = "10.42.1.8";
@@ -12,11 +13,14 @@
     {
       hostname = "hosea.thehellings.lan";
       ipAddress = "10.42.1.7";
-    }];
-  mdsNodes = [{
-    hostname = "jeremiah.thehellings.lan";
-    ipAddress = "10.42.1.8";
-  }];
+    }
+  ];
+  mdsNodes = [
+    {
+      hostname = "jeremiah.thehellings.lan";
+      ipAddress = "10.42.1.8";
+    }
+  ];
   publicNetworks = [ "10.42.0.0/16" ];
   clusterNetworks = [ "10.201.0.0/16" ];
   adminKeyring = ../secrets/home.client.admin.keyring;
diff --git a/hardware-configuration.nix b/hardware-configuration.nix
index cd6c064..d57844c 100644
--- a/hardware-configuration.nix
+++ b/hardware-configuration.nix
@@ -1,31 +1,37 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, modulesPath, ... }:
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [
-      (modulesPath + "/installer/scan/not-detected.nix")
-    ];
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "uas" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "thunderbolt"
+    "nvme"
+    "uas"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
-    {
-      device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
-      fsType = "btrfs";
-      options = [ "subvol=@" ];
-    };
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
+    fsType = "btrfs";
+    options = [ "subvol=@" ];
+  };
 
-  fileSystems."/boot" =
-    {
-      device = "/dev/disk/by-uuid/B31C-C1F4";
-      fsType = "vfat";
-    };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/B31C-C1F4";
+    fsType = "vfat";
+  };
 
   swapDevices = [ ];
 
diff --git a/home/home.nix b/home/home.nix
index a6bbaee..e268953 100644
--- a/home/home.nix
+++ b/home/home.nix
@@ -1,8 +1,9 @@
-{ pkgs
-, lib
-, host ? "most"
-, nixvim
-, ...
+{
+  pkgs,
+  lib,
+  host ? "most",
+  nixvim,
+  ...
 }:
 
 {
@@ -12,15 +13,12 @@
     ./modules
   ] ++ lib.optionals (builtins.pathExists ./hosts/${host}) [ ./hosts/${host} ];
 
-
   programs.tmux = {
     enable = true;
     keyMode = "vi";
     terminal = "xterm-256color";
     customPaneNavigationAndResize = true;
-    extraConfig = (lib.strings.concatStringsSep "\n" [
-      "bind P paste-buffer"
-    ]);
+    extraConfig = (lib.strings.concatStringsSep "\n" [ "bind P paste-buffer" ]);
   };
 
   home.stateVersion = "23.05";
diff --git a/home/hosts/icdm-root/default.nix b/home/hosts/icdm-root/default.nix
index 5bd3e36..04618ac 100644
--- a/home/hosts/icdm-root/default.nix
+++ b/home/hosts/icdm-root/default.nix
@@ -1,3 +1,4 @@
 { ... }:
 
-{ }
+{
+}
diff --git a/home/hosts/work/default.nix b/home/hosts/work/default.nix
index aec6038..e9d6627 100644
--- a/home/hosts/work/default.nix
+++ b/home/hosts/work/default.nix
@@ -3,7 +3,5 @@
 {
   greg.vscodium.enable = true;
 
-  home.packages = with pkgs; [
-    brew
-  ];
+  home.packages = with pkgs; [ brew ];
 }
diff --git a/home/modules/baseline/ssh.nix b/home/modules/baseline/ssh.nix
index 04e4bf3..8ac26a7 100644
--- a/home/modules/baseline/ssh.nix
+++ b/home/modules/baseline/ssh.nix
@@ -15,16 +15,18 @@
 
     matchBlocks =
       let
-        nas = { user = "admin"; };
-        owned = { user = "greg"; };
+        nas = {
+          user = "admin";
+        };
+        owned = {
+          user = "greg";
+        };
       in
       {
         inherit nas;
 
         "*" = {
-          dynamicForwards = [{
-            port = 10240;
-          }];
+          dynamicForwards = [ { port = 10240; } ];
         };
 
         "10.42.1.4" = lib.hm.dag.entryBefore [ "10.42.*" ] nas;
@@ -33,7 +35,10 @@
         chronicles = nas;
         "chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan" ] nas;
 
-        gh = { user = "git"; hostname = "github.com"; };
+        gh = {
+          user = "git";
+          hostname = "github.com";
+        };
         "src" = {
           user = "gitlab";
           hostname = "git.thehellings.lan";
diff --git a/home/modules/baseline/vim.nix b/home/modules/baseline/vim.nix
index bbf1af5..c14dc5d 100644
--- a/home/modules/baseline/vim.nix
+++ b/home/modules/baseline/vim.nix
@@ -1,9 +1,16 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 {
   # The Hack font is used in the Fugitive sidebars
   fonts.fontconfig.enable = true;
   home.packages = [ (pkgs.nerdfonts.override { fonts = [ "Hack" ]; }) ];
 
-  programs.nixvim = (import ./vim/config.nix { inherit config pkgs lib; }) // { enable = true; };
+  programs.nixvim = (import ./vim/config.nix { inherit config pkgs lib; }) // {
+    enable = true;
+  };
 }
diff --git a/home/modules/baseline/xonsh.nix b/home/modules/baseline/xonsh.nix
index 7690bf9..efa29d4 100644
--- a/home/modules/baseline/xonsh.nix
+++ b/home/modules/baseline/xonsh.nix
@@ -67,9 +67,11 @@
     };
 
     configHeader = builtins.readFile ./xonsh_header.xsh;
-    configFooter = (builtins.readFile ./xonsh_footer.xsh) + (builtins.concatStringsSep "\n" [
-      "with open('${pkgs.stdenv.cc}/nix-support/dynamic-linker', 'r') as fp:"
-      "    $NIX_LD = fp.read().strip()"
-    ]);
+    configFooter =
+      (builtins.readFile ./xonsh_footer.xsh)
+      + (builtins.concatStringsSep "\n" [
+        "with open('${pkgs.stdenv.cc}/nix-support/dynamic-linker', 'r') as fp:"
+        "    $NIX_LD = fp.read().strip()"
+      ]);
   };
 }
diff --git a/home/modules/development.nix b/home/modules/development.nix
index fb86eda..61a1c1c 100644
--- a/home/modules/development.nix
+++ b/home/modules/development.nix
@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   packages = with pkgs; [
     bruno # but let's not talk about it
@@ -16,10 +21,9 @@ let
     zed-editor
   ];
 in
-with lib; {
+with lib;
+{
   options.greg.development = mkEnableOption "Setup necessary development packages";
 
-  config = mkIf config.greg.development {
-    home.packages = packages;
-  };
+  config = mkIf config.greg.development { home.packages = packages; };
 }
diff --git a/home/modules/gnome.nix b/home/modules/gnome.nix
index 4b5eacf..ebdc05b 100644
--- a/home/modules/gnome.nix
+++ b/home/modules/gnome.nix
@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 let
   cfg = config.greg.gnome;
@@ -6,115 +11,123 @@ in
 {
   options.greg.gnome = lib.mkEnableOption "Enable Gnome support and settings";
 
-  config = (lib.mkIf cfg {
-    programs.gnome-terminal = lib.mkIf (pkgs.system != "x86_64-darwin") {
-      enable = true;
-      showMenubar = true;
-      themeVariant = "dark";
-      profile."95f3c68e-82f3-4f44-ac85-6e075fed80b0" = {
-        default = true;
-        customCommand = "xonsh -st best";
-        loginShell = true;
-        scrollbackLines = 65535;
-        transparencyPercent = 50;
-        visibleName = "greg";
+  config = (
+    lib.mkIf cfg {
+      programs.gnome-terminal = lib.mkIf (pkgs.system != "x86_64-darwin") {
+        enable = true;
+        showMenubar = true;
+        themeVariant = "dark";
+        profile."95f3c68e-82f3-4f44-ac85-6e075fed80b0" = {
+          default = true;
+          customCommand = "xonsh -st best";
+          loginShell = true;
+          scrollbackLines = 65535;
+          transparencyPercent = 50;
+          visibleName = "greg";
+        };
       };
-    };
 
-    dconf.settings = {
-      "org/gnome/Disks" = {
-        image-dir-uri = "file:///home/greg/Downloads";
+      dconf.settings = {
+        "org/gnome/Disks" = {
+          image-dir-uri = "file:///home/greg/Downloads";
+        };
+        "org/gnome/desktop/interface" = {
+          clock-show-weekday = true;
+          color-scheme = "default";
+          cursor-size = 24;
+          toolbar-style = "text";
+        };
+        "org/gnome/desktop/screensaver" = {
+          lock-delay = "uint32 0";
+          lock-enabled = false;
+        };
+        "org/gnome/desktop/wm/keybindings" = {
+          switch-applications = [ ];
+          switch-applications-backward = [ ];
+          switch-windows = [ "<Alt>Tab" ];
+          switch-windows-backward = [ "<Shift><Alt>Tab" ];
+        };
+        "org/gnome/desktop/wm/preferences" = {
+          button-layout = "icon:minimize,maximize,close";
+        };
+        "org/gnome/file-roller/listing" = {
+          list-mode = "as-folder";
+          name-coloumn-width = 302;
+          show-path = true;
+          sort-method = "name";
+          sort-type = "ascending";
+        };
+        "org/gnome/nautilus/preferences" = {
+          default-folder-viewer = "icon-view";
+          search-filter-time-type = "last_modified";
+          search-view = "list-view";
+        };
+        "org/gnome/shell" = {
+          enabled-extensions = [
+            "appindicatorsupport@rgcjonas.gmail.com"
+            "Vitals@CoreCoding.com"
+            "window-list@gnome-shell-extensions.gcampax.github.com"
+            "gsconnect@andyholmes.github.io"
+          ];
+          favorite-apps = [
+            "org.gnome.Calendar.desktop"
+            "org.gnome.Nautilus.desktop"
+            "org.gnome.Terminal.desktop"
+            "firefox.desktop"
+            "vlc.desktop"
+          ];
+          remember-mount-password = true;
+        };
+        "org/gnome/shell/extensions/vitals" = {
+          hot-sensors = [
+            "_memory_usage_"
+            "_system_load_1m_"
+            "__network-rx_max__"
+            "_temperature_k10temp_tccd1_"
+            "_temperature_k10temp_tctl_"
+          ];
+        };
+        "org/gnome/shell/overrides" = {
+          attach-modal-dialogs = true;
+          dynamic-workspaces = true;
+          edge-tiling = true;
+          focus-change-on-pointer-rest = true;
+          workspaces-only-on-primary = true;
+        };
+        "org/gnome/shell/weather" = {
+          automation-location = true;
+          locations = "[<(uint32 2, <('Midlothian / Waxahachie, Mid-Way Regional Airport', 'KJWY', false, [(0.5664611473274288, -1.691437359323684)], @a(dd) [])>)>]";
+        };
+        "org/gnome/shell/window-switcher" = {
+          app-icon-mode = "both";
+          current-workspace-only = true;
+        };
+        "org/gtk/settings/file-chooser" = {
+          location-mode = "path-bar";
+          show-hidden = false;
+          show-size-column = true;
+          sort-column = "modified";
+          sort-directories-first = false;
+          sort-order = "descending";
+        };
+        "org/virt-manager/virt-manager/confirm" = {
+          delete-storage = true;
+          forcepoweroff = false;
+        };
+        "org/virt-manager/virt-manager/details" = {
+          show-toolbar = true;
+        };
+        "org/virt-manager/virt-manager/connections" = {
+          autoconnect = [
+            "qemu:///session"
+            "qemu:///system"
+          ];
+          uris = [
+            "qemu:///session"
+            "qemu:///system"
+          ];
+        };
       };
-      "org/gnome/desktop/interface" = {
-        clock-show-weekday = true;
-        color-scheme = "default";
-        cursor-size = 24;
-        toolbar-style = "text";
-      };
-      "org/gnome/desktop/screensaver" = {
-        lock-delay = "uint32 0";
-        lock-enabled = false;
-      };
-      "org/gnome/desktop/wm/keybindings" = {
-        switch-applications = [ ];
-        switch-applications-backward = [ ];
-        switch-windows = [ "<Alt>Tab" ];
-        switch-windows-backward = [ "<Shift><Alt>Tab" ];
-      };
-      "org/gnome/desktop/wm/preferences" = {
-        button-layout = "icon:minimize,maximize,close";
-      };
-      "org/gnome/file-roller/listing" = {
-        list-mode = "as-folder";
-        name-coloumn-width = 302;
-        show-path = true;
-        sort-method = "name";
-        sort-type = "ascending";
-      };
-      "org/gnome/nautilus/preferences" = {
-        default-folder-viewer = "icon-view";
-        search-filter-time-type = "last_modified";
-        search-view = "list-view";
-      };
-      "org/gnome/shell" = {
-        enabled-extensions = [
-          "appindicatorsupport@rgcjonas.gmail.com"
-          "Vitals@CoreCoding.com"
-          "window-list@gnome-shell-extensions.gcampax.github.com"
-          "gsconnect@andyholmes.github.io"
-        ];
-        favorite-apps = [
-          "org.gnome.Calendar.desktop"
-          "org.gnome.Nautilus.desktop"
-          "org.gnome.Terminal.desktop"
-          "firefox.desktop"
-          "vlc.desktop"
-        ];
-        remember-mount-password = true;
-      };
-      "org/gnome/shell/extensions/vitals" = {
-        hot-sensors = [
-          "_memory_usage_"
-          "_system_load_1m_"
-          "__network-rx_max__"
-          "_temperature_k10temp_tccd1_"
-          "_temperature_k10temp_tctl_"
-        ];
-      };
-      "org/gnome/shell/overrides" = {
-        attach-modal-dialogs = true;
-        dynamic-workspaces = true;
-        edge-tiling = true;
-        focus-change-on-pointer-rest = true;
-        workspaces-only-on-primary = true;
-      };
-      "org/gnome/shell/weather" = {
-        automation-location = true;
-        locations = "[<(uint32 2, <('Midlothian / Waxahachie, Mid-Way Regional Airport', 'KJWY', false, [(0.5664611473274288, -1.691437359323684)], @a(dd) [])>)>]";
-      };
-      "org/gnome/shell/window-switcher" = {
-        app-icon-mode = "both";
-        current-workspace-only = true;
-      };
-      "org/gtk/settings/file-chooser" = {
-        location-mode = "path-bar";
-        show-hidden = false;
-        show-size-column = true;
-        sort-column = "modified";
-        sort-directories-first = false;
-        sort-order = "descending";
-      };
-      "org/virt-manager/virt-manager/confirm" = {
-        delete-storage = true;
-        forcepoweroff = false;
-      };
-      "org/virt-manager/virt-manager/details" = {
-        show-toolbar = true;
-      };
-      "org/virt-manager/virt-manager/connections" = {
-        autoconnect = [ "qemu:///session" "qemu:///system" ];
-        uris = [ "qemu:///session" "qemu:///system" ];
-      };
-    };
-  });
+    }
+  );
 }
diff --git a/home/modules/python.nix b/home/modules/python.nix
index a9e3b23..fdbd210 100644
--- a/home/modules/python.nix
+++ b/home/modules/python.nix
@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 {
   options.greg.pypackage = lib.mkOption {
     description = "Enable Gnome support and settings";
diff --git a/home/modules/sway.nix b/home/modules/sway.nix
index 4dcbc78..9a8112a 100644
--- a/home/modules/sway.nix
+++ b/home/modules/sway.nix
@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 let
   cfg = config.greg.sway;
@@ -9,98 +14,102 @@ let
   term = "${pkgs.alacritty}/bin/alacritty";
   msg = "${pkgs.sway}/bin/swaymsg";
   sleep = "${pkgs.coreutils}/bin/sleep";
-  workstation1 = pkgs.writeScriptBin "workstation1" (builtins.concatStringsSep "\n" [
-    "${msg} \"workspace 1 ; exec ${pkgs.firefox}/bin/firefox ; split horizontal ; exec ${pkgs.element-desktop}/bin/element-desktop \""
-    "${sleep} 1"
-    "${msg} '[app_id=\"firefox\"]' move left"
-    "${msg} '[instance=\"element\"]' \"layout tabbed ; exec ${term} \""
-    "${msg} '[app_id=\"firefox\"]' move left"
-    "${sleep} 0.3"
-    "${msg} '[app_id=\"Alacritty\" workspace=\"1\"]' move right"
-    "${msg} '[app_id=\"firefox\"]' resize grow width 300 px"
-  ]);
-  workstation2 = pkgs.writeScriptBin "workstation2" (builtins.concatStringsSep "\n" [
-    "${sleep} 5"
-    "${msg} \"workspace 2 ; exec ${term} ; layout tabbed\""
-  ]);
+  workstation1 = pkgs.writeScriptBin "workstation1" (
+    builtins.concatStringsSep "\n" [
+      "${msg} \"workspace 1 ; exec ${pkgs.firefox}/bin/firefox ; split horizontal ; exec ${pkgs.element-desktop}/bin/element-desktop \""
+      "${sleep} 1"
+      "${msg} '[app_id=\"firefox\"]' move left"
+      "${msg} '[instance=\"element\"]' \"layout tabbed ; exec ${term} \""
+      "${msg} '[app_id=\"firefox\"]' move left"
+      "${sleep} 0.3"
+      "${msg} '[app_id=\"Alacritty\" workspace=\"1\"]' move right"
+      "${msg} '[app_id=\"firefox\"]' resize grow width 300 px"
+    ]
+  );
+  workstation2 = pkgs.writeScriptBin "workstation2" (
+    builtins.concatStringsSep "\n" [
+      "${sleep} 5"
+      "${msg} \"workspace 2 ; exec ${term} ; layout tabbed\""
+    ]
+  );
 in
 {
   options.greg.sway = lib.mkEnableOption "Enable Sway support and settings";
 
-  config = (lib.mkIf cfg {
-    programs.swaylock.enable = true;
+  config = (
+    lib.mkIf cfg {
+      programs.swaylock.enable = true;
 
-    wayland.windowManager.sway =
-      let
-        mod = config.wayland.windowManager.sway.config.modifier;
-      in
-      {
-        enable = true;
-        config = rec {
-          #fonts.size = 10.0;
-          keybindings = lib.mkOptionDefault {
-            "Mod4+l" = "exec ${pkgs.swaylock}/bin/swaylock -c 000000";
-            "Mod4+h" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/headphones.qpwgraph -m";
-            "Mod4+m" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/monitor.qpwgraph -m";
-            "Mod4+b" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/both.qpwgraph -m";
+      wayland.windowManager.sway =
+        let
+          mod = config.wayland.windowManager.sway.config.modifier;
+        in
+        {
+          enable = true;
+          config = rec {
+            #fonts.size = 10.0;
+            keybindings = lib.mkOptionDefault {
+              "Mod4+l" = "exec ${pkgs.swaylock}/bin/swaylock -c 000000";
+              "Mod4+h" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/headphones.qpwgraph -m";
+              "Mod4+m" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/monitor.qpwgraph -m";
+              "Mod4+b" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/both.qpwgraph -m";
 
-            "${mod}+Shift+Return" = file_browser.path;
-          };
-          modifier = "Mod1";
-          output = {
-            "Samsung Electric Company S24E650 H4ZN600985" = {
-              mode = "1920x1200";
-              transform = "90";
-              pos = "0 0";
+              "${mod}+Shift+Return" = file_browser.path;
             };
-            "ViewSonic Corporation VA2252 Series VMT201800925" = {
-              mode = "1920x1080";
-              pos = "200 1920";
+            modifier = "Mod1";
+            output = {
+              "Samsung Electric Company S24E650 H4ZN600985" = {
+                mode = "1920x1200";
+                transform = "90";
+                pos = "0 0";
+              };
+              "ViewSonic Corporation VA2252 Series VMT201800925" = {
+                mode = "1920x1080";
+                pos = "200 1920";
+              };
             };
+            terminal = term;
+            startup = [
+              { command = "${workstation1}/bin/workstation1"; }
+              { command = "${workstation2}/bin/workstation2"; }
+            ];
+          };
+          extraOptions = [ "--unsupported-gpu" ];
+          extraSessionCommands = ''
+            export WLR_NO_HARDWARE_CURSORS=1
+          '';
+          systemd.enable = true;
+          wrapperFeatures = {
+            base = true;
+            gtk = true;
           };
-          terminal = term;
-          startup = [
-            { command = "${workstation1}/bin/workstation1"; }
-            { command = "${workstation2}/bin/workstation2"; }
-          ];
         };
-        extraOptions = [
-          "--unsupported-gpu"
-        ];
-        extraSessionCommands = ''
-          				export WLR_NO_HARDWARE_CURSORS=1
-          			'';
-        systemd.enable = true;
-        wrapperFeatures = {
-          base = true;
-          gtk = true;
+
+      home.pointerCursor = {
+        name = "Adwaita";
+        package = pkgs.gnome.adwaita-icon-theme;
+        size = 12;
+        x11 = {
+          enable = true;
+          defaultCursor = "Adwaita";
         };
       };
 
-    home.pointerCursor = {
-      name = "Adwaita";
-      package = pkgs.gnome.adwaita-icon-theme;
-      size = 12;
-      x11 = {
-        enable = true;
-        defaultCursor = "Adwaita";
-      };
-    };
-
-    home.packages = with pkgs; [
-      arj
-      dpkg
-      kate
-      kget
-      krename
-      file_browser.pkg
-      p7zip
-      plocate
-      rpm
-      qpwgraph
-      xorg.xev
-      xorg.xmodmap
-      xxdiff
-    ];
-  });
+      home.packages = with pkgs; [
+        arj
+        dpkg
+        kate
+        kget
+        krename
+        file_browser.pkg
+        p7zip
+        plocate
+        rpm
+        qpwgraph
+        xorg.xev
+        xorg.xmodmap
+        xxdiff
+      ];
+    }
+  );
 }
diff --git a/home/modules/xonsh.nix b/home/modules/xonsh.nix
index 82126e7..2437e6d 100644
--- a/home/modules/xonsh.nix
+++ b/home/modules/xonsh.nix
@@ -4,7 +4,8 @@ let
   cfg = config.programs.xonsh;
 
 in
-with lib; {
+with lib;
+{
   options = {
     programs.xonsh = {
       enable = mkEnableOption "Enable the xonsh program";
@@ -12,34 +13,36 @@ with lib; {
       sessionVariables = mkOption {
         type = types.attrs;
         default = { };
-        example = { XONSH_TRACE_SUBPROC = true; };
+        example = {
+          XONSH_TRACE_SUBPROC = true;
+        };
         description = ''
-          					Environment variables that will be set for the Xonsh session.
-          				'';
+          Environment variables that will be set for the Xonsh session.
+        '';
       };
 
       aliases = mkOption {
         type = types.attrsOf types.str;
         default = { };
         example = literalExpression ''
-          					{
-          						ll = "ls -l";
-          						la = "ls -a";
-          					}
-          				'';
+          {
+          	ll = "ls -l";
+          	la = "ls -a";
+          }
+        '';
         description = ''
-          					An attribute set that maps aliases (the top level attribute names in
-          					this option) to command strings or directly to build outputs.
-          				'';
+          An attribute set that maps aliases (the top level attribute names in
+          this option) to command strings or directly to build outputs.
+        '';
       };
 
       configHeader = mkOption {
         type = types.lines;
         default = "";
         example = literalExpression ''
-          					import os
-          					import sys
-          				'';
+          import os
+          import sys
+        '';
         description = "An arbitrary string to put at the top of the config file";
       };
 
@@ -47,11 +50,11 @@ with lib; {
         type = types.lines;
         default = "";
         example = literalExpression ''
-          					def _some_method(args):
-          						do_command()
-          						some_other_thing()
-          					aliases['some_method'] = _some_method
-          				'';
+          def _some_method(args):
+          	do_command()
+          	some_other_thing()
+          aliases['some_method'] = _some_method
+        '';
         description = "An arbitrary string to put at the end of the config file";
       };
     };
@@ -59,29 +62,26 @@ with lib; {
 
   config =
     let
-      shortAliases = concatStringsSep "\n" (
-        mapAttrsToList (k: v: "aliases['${k}']=r'${v}'") cfg.aliases
-      );
+      shortAliases = concatStringsSep "\n" (mapAttrsToList (k: v: "aliases['${k}']=r'${v}'") cfg.aliases);
 
       listToPythonList =
         let
-          listInternals = args:
-            concatStringsSep "\n" (map (v: "'${v}'") args);
+          listInternals = args: concatStringsSep "\n" (map (v: "'${v}'") args);
         in
         list: "[${listInternals list}]";
 
       sessionVars = concatStringsSep "\n" (
-        mapAttrsToList
-          (k: v:
-            if builtins.typeOf v == "string" then
-              "\$${k} = '${v}'"
-            else if builtins.typeOf v == "list" then
-              "\$${k} = ${listToPythonList}"
-            else if builtins.typeOf v == "int" then
-              "\$${k} = ${toString v}"
-            else ""
-          )
-          cfg.sessionVariables
+        mapAttrsToList (
+          k: v:
+          if builtins.typeOf v == "string" then
+            "\$${k} = '${v}'"
+          else if builtins.typeOf v == "list" then
+            "\$${k} = ${listToPythonList}"
+          else if builtins.typeOf v == "int" then
+            "\$${k} = ${toString v}"
+          else
+            ""
+        ) cfg.sessionVariables
       );
 
     in
diff --git a/hosts/exodus/hardware-configuration.nix b/hosts/exodus/hardware-configuration.nix
index cd6c064..d57844c 100644
--- a/hosts/exodus/hardware-configuration.nix
+++ b/hosts/exodus/hardware-configuration.nix
@@ -1,31 +1,37 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, modulesPath, ... }:
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [
-      (modulesPath + "/installer/scan/not-detected.nix")
-    ];
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "uas" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "thunderbolt"
+    "nvme"
+    "uas"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
-    {
-      device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
-      fsType = "btrfs";
-      options = [ "subvol=@" ];
-    };
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
+    fsType = "btrfs";
+    options = [ "subvol=@" ];
+  };
 
-  fileSystems."/boot" =
-    {
-      device = "/dev/disk/by-uuid/B31C-C1F4";
-      fsType = "vfat";
-    };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/B31C-C1F4";
+    fsType = "vfat";
+  };
 
   swapDevices = [ ];
 
diff --git a/hosts/genesis/acme.nix b/hosts/genesis/acme.nix
index 314ddad..6eb15fd 100644
--- a/hosts/genesis/acme.nix
+++ b/hosts/genesis/acme.nix
@@ -1,9 +1,16 @@
-{ pkgs, config, lib, ... }:
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
 
 let
   address = (builtins.elemAt config.networking.interfaces.ens18.ipv4.addresses 0).address;
   root_ca = pkgs.writeText "root_ca.crt" (builtins.readFile ../../ca/root_ca.crt);
-  intermediate_ca = pkgs.writeText "intermediate_ca.crt" (builtins.readFile ../../ca/intermediate_ca.crt);
+  intermediate_ca = pkgs.writeText "intermediate_ca.crt" (
+    builtins.readFile ../../ca/intermediate_ca.crt
+  );
 in
 {
   age.secrets.acme_password = {
@@ -13,7 +20,10 @@ in
     file = ../../secrets/ca/intermediate_key.age;
   };
   age.secrets.root_ca_key.file = ../../secrets/ca/root_key.age;
-  systemd.services.step-ca.serviceConfig.Environment = lib.mkForce [ "STEPDEBUG=1" "HOME=%S/step-ca" ];
+  systemd.services.step-ca.serviceConfig.Environment = lib.mkForce [
+    "STEPDEBUG=1"
+    "HOME=%S/step-ca"
+  ];
   services.step-ca = {
     inherit address;
     enable = false;
@@ -35,20 +45,22 @@ in
         dataSource = "/var/lib/step-ca/db";
         badgerFileLoadingMode = "";
       };
-      authority.provisioners = [{
-        type = "JWK";
-        name = "greg@thehellings.com";
-        key = {
-          use = "sig";
-          kty = "EC";
-          kid = "1GOpOttYLZtx7XiG79ZycbGcG4ptL0czfohK35SZOEI";
-          crv = "P-256";
-          alg = "ES256";
-          x = "YEWVj5CCoqWQXWqmL0UuORlFY9IEOLcg1jpG1o-wGx4";
-          y = "MEpqnJp60VV-SpFtb6m8U-VAYut7R_PKFm07xl7MjBk";
-        };
-        encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoieWdfb0lfbWgwbHhPRXdjUTBsd0FnUSJ9.ivdQUFEhs2U8PUBYr8AhQl3hHdb4spF4jvXgqY_hiVgpjB-z3Nn9Uw.u7vrNht_3WD1G97q.mbydlpAQxjtKLkOmmDOUczqscRDPqrUyoPJ1uqXcJDH3vs4KiYlrKRcFLjPy9sWzEL1iIrqjwf3U-3AAx1KNAg7frs2D__MGfOO-U5SdQDVJVAND7KpWOJGJVSb0xioCA6-8ldlP_REqu4ENmkkdw0_6Is2b0p7ZFKqke_fqOOs7osqFAfbMb_WzEWrACLn5A5-Teh2rpEgR-z9zipN6MSEqE6VIQ2BXuv70aHWhslNe1MK1OgTYm9CqA47EMYvQ7HQLPDZAbP56WK84yJLktoXMmnkaKeTtvER0dh4ufyjJHBhecnEranbR5rHc_jV8_qvyWhlqbCrOU_8bWrk.a9SH_q3GKIUsOUSRWkDxQg";
-      }];
+      authority.provisioners = [
+        {
+          type = "JWK";
+          name = "greg@thehellings.com";
+          key = {
+            use = "sig";
+            kty = "EC";
+            kid = "1GOpOttYLZtx7XiG79ZycbGcG4ptL0czfohK35SZOEI";
+            crv = "P-256";
+            alg = "ES256";
+            x = "YEWVj5CCoqWQXWqmL0UuORlFY9IEOLcg1jpG1o-wGx4";
+            y = "MEpqnJp60VV-SpFtb6m8U-VAYut7R_PKFm07xl7MjBk";
+          };
+          encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoieWdfb0lfbWgwbHhPRXdjUTBsd0FnUSJ9.ivdQUFEhs2U8PUBYr8AhQl3hHdb4spF4jvXgqY_hiVgpjB-z3Nn9Uw.u7vrNht_3WD1G97q.mbydlpAQxjtKLkOmmDOUczqscRDPqrUyoPJ1uqXcJDH3vs4KiYlrKRcFLjPy9sWzEL1iIrqjwf3U-3AAx1KNAg7frs2D__MGfOO-U5SdQDVJVAND7KpWOJGJVSb0xioCA6-8ldlP_REqu4ENmkkdw0_6Is2b0p7ZFKqke_fqOOs7osqFAfbMb_WzEWrACLn5A5-Teh2rpEgR-z9zipN6MSEqE6VIQ2BXuv70aHWhslNe1MK1OgTYm9CqA47EMYvQ7HQLPDZAbP56WK84yJLktoXMmnkaKeTtvER0dh4ufyjJHBhecnEranbR5rHc_jV8_qvyWhlqbCrOU_8bWrk.a9SH_q3GKIUsOUSRWkDxQg";
+        }
+      ];
       tls = {
         cipherSuites = [
           "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
diff --git a/hosts/genesis/hardware-configuration.nix b/hosts/genesis/hardware-configuration.nix
index 794a842..43e7ae9 100644
--- a/hosts/genesis/hardware-configuration.nix
+++ b/hosts/genesis/hardware-configuration.nix
@@ -4,24 +4,25 @@
 { lib, modulesPath, ... }:
 
 {
-  imports =
-    [
-      (modulesPath + "/profiles/qemu-guest.nix")
-    ];
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
 
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "sr_mod"
+    "virtio_blk"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
-    {
-      device = "/dev/disk/by-uuid/a13f941e-4985-47ab-a8c6-374a627c5ce1";
-      fsType = "ext4";
-    };
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/a13f941e-4985-47ab-a8c6-374a627c5ce1";
+    fsType = "ext4";
+  };
 
-  swapDevices =
-    [{ device = "/dev/disk/by-uuid/ac4557de-1ad5-4d3c-b9f4-5ec50dbf76f1"; }];
+  swapDevices = [ { device = "/dev/disk/by-uuid/ac4557de-1ad5-4d3c-b9f4-5ec50dbf76f1"; } ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
diff --git a/hosts/genesis/home-assistant.nix b/hosts/genesis/home-assistant.nix
index 9ab6aaa..5df1e87 100755
--- a/hosts/genesis/home-assistant.nix
+++ b/hosts/genesis/home-assistant.nix
@@ -26,16 +26,17 @@
       "wyoming"
       "zwave_js"
     ];
-    customComponents = with pkgs.home-assistant-custom-components; [
-      smartthinq-sensors
-    ];
+    customComponents = with pkgs.home-assistant-custom-components; [ smartthinq-sensors ];
 
     config = {
       default_config = { };
-      tts = [{ platform = "google_translate"; }];
+      tts = [ { platform = "google_translate"; } ];
       http = {
         use_x_forwarded_for = true;
-        trusted_proxies = [ "127.0.0.1" "::1" ];
+        trusted_proxies = [
+          "127.0.0.1"
+          "::1"
+        ];
         server_host = "127.0.0.1";
       };
       #"automation manual" = *nix config here* and so on
@@ -75,7 +76,10 @@
     containers.zwave = {
       autoStart = false; # We will try to start it with udev.extraRules listed below, as this option starts it too quickly
       image = "zwavejs/zwave-js-ui:latest";
-      ports = [ "8091:8091" "3000:3000" ];
+      ports = [
+        "8091:8091"
+        "3000:3000"
+      ];
       volumes = [ "/var/lib/zwave:/usr/src/app/store" ];
       extraOptions = [
         "--device"
@@ -93,8 +97,12 @@
   # the container. So we add the creation of /var/lib/{zwave,hass} to the systemd Unit files
   systemd.services = {
     "podman-zwave" = {
-      after = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
-      wantedBy = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
+      after = [
+        "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device"
+      ];
+      wantedBy = [
+        "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device"
+      ];
       serviceConfig = {
         StateDirectory = "zwave";
         StateDirectoryMode = pkgs.lib.mkForce "0777";
@@ -103,9 +111,8 @@
   };
 
   services.udev.extraRules = ''
-    	SUBSYSTEM=="tty", KERNEL=="ttyACM0", TAG+="systemd"
-    	'';
-
+    SUBSYSTEM=="tty", KERNEL=="ttyACM0", TAG+="systemd"
+  '';
 
   greg.proxies = {
     "smart.home".target = "http://127.0.0.1:8123/";
@@ -116,7 +123,10 @@
   # Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect
   # directly for troubleshooting Nginx configuration
   networking.firewall = {
-    allowedTCPPorts = [ 80 443 ];
+    allowedTCPPorts = [
+      80
+      443
+    ];
   };
 
   greg.backup.jobs.zwave = {
diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix
index f26fdc3..1913ec1 100644
--- a/hosts/genesis/networking.nix
+++ b/hosts/genesis/networking.nix
@@ -37,18 +37,22 @@ in
       # This is our LAN port
       "${lan}" = {
         useDHCP = false;
-        ipv4.addresses = [{
-          address = "${lanIP}";
-          prefixLength = 16;
-        }];
+        ipv4.addresses = [
+          {
+            address = "${lanIP}";
+            prefixLength = 16;
+          }
+        ];
       };
 
       "${iot}" = {
         useDHCP = false;
-        ipv4.addresses = [{
-          address = "${iotIP}";
-          prefixLength = 24;
-        }];
+        ipv4.addresses = [
+          {
+            address = "${iotIP}";
+            prefixLength = 24;
+          }
+        ];
       };
     };
     firewall = {
@@ -90,15 +94,19 @@ in
     ########
     _3proxy = {
       enable = true;
-      services = [{
-        type = "socks";
-        auth = [ "strong" ];
-        bindPort = proxyPort;
-        acl = [{
-          rule = "allow";
-          users = [ "greg" ];
-        }];
-      }];
+      services = [
+        {
+          type = "socks";
+          auth = [ "strong" ];
+          bindPort = proxyPort;
+          acl = [
+            {
+              rule = "allow";
+              users = [ "greg" ];
+            }
+          ];
+        }
+      ];
       #usersFile = "/run/agenix/3proxy";
       denyPrivate = false;
     };
@@ -140,7 +148,7 @@ in
           "4c:a1:61:05:cd:52,192.168.66.61" # Rainbird
           "48:d6:d5:5d:81:21,192.168.66.65" # Google Home
           "6c:29:90:3e:e2:02,192.168.66.66" # wiz
-          "28:87:ba:0e:ca:da,192.168.66.74" #
+          "28:87:ba:0e:ca:da,192.168.66.74"
           "28:87:ba:0e:c9:fd,192.168.66.75" # Master closet
           "54:af:97:c2:0f:a1,192.168.66.76" # Master toilet
           "54:af:97:83:ed:33,192.168.66.80"
@@ -174,9 +182,7 @@ in
     # Update adblock list
     cron = {
       enable = true;
-      systemCronJobs = [
-        "* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log"
-      ];
+      systemCronJobs = [ "* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log" ];
     };
   }; # End of services configuration
 
diff --git a/hosts/hosea/bitcoin.nix b/hosts/hosea/bitcoin.nix
index 587a670..05915b9 100644
--- a/hosts/hosea/bitcoin.nix
+++ b/hosts/hosea/bitcoin.nix
@@ -41,9 +41,7 @@ in
       listen = true;
       rpc = {
         address = ip;
-        allowip = [
-          "100.1.1.1/8"
-        ];
+        allowip = [ "100.1.1.1/8" ];
       };
     };
     clightning = {
@@ -74,6 +72,5 @@ in
     };
   };
 
-  environment.systemPackages = with pkgs; [
-  ];
+  environment.systemPackages = with pkgs; [ ];
 }
diff --git a/hosts/hosea/hardware-configuration.nix b/hosts/hosea/hardware-configuration.nix
index 2f43041..645a26f 100644
--- a/hosts/hosea/hardware-configuration.nix
+++ b/hosts/hosea/hardware-configuration.nix
@@ -1,31 +1,38 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, modulesPath, ... }:
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [
-      (modulesPath + "/installer/scan/not-detected.nix")
-    ];
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "uas" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "nvme"
+    "usbhid"
+    "uas"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
-    {
-      device = "/dev/disk/by-uuid/d4ac74f7-62bb-421a-aad8-566277c9d8ba";
-      fsType = "btrfs";
-      options = [ "subvol=@" ];
-    };
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/d4ac74f7-62bb-421a-aad8-566277c9d8ba";
+    fsType = "btrfs";
+    options = [ "subvol=@" ];
+  };
 
-  fileSystems."/boot" =
-    {
-      device = "/dev/disk/by-uuid/1F51-B638";
-      fsType = "vfat";
-    };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/1F51-B638";
+    fsType = "vfat";
+  };
 
   fileSystems."/chain" = {
     device = "/dev/sda1";
diff --git a/hosts/icdm-root/default.nix b/hosts/icdm-root/default.nix
index dea1755..c4ea82e 100644
--- a/hosts/icdm-root/default.nix
+++ b/hosts/icdm-root/default.nix
@@ -19,7 +19,10 @@
   users.users.greg = {
     isNormalUser = true;
     description = "Gregory Hellings";
-    extraGroups = [ "networkmanager" "wheel" ];
+    extraGroups = [
+      "networkmanager"
+      "wheel"
+    ];
     packages = with pkgs; [ ];
   };
 }
diff --git a/hosts/icdm-root/filesystem.nix b/hosts/icdm-root/filesystem.nix
index fd2169f..f6b543f 100644
--- a/hosts/icdm-root/filesystem.nix
+++ b/hosts/icdm-root/filesystem.nix
@@ -1,7 +1,8 @@
 { ... }:
 
 let
-in {
+in
+{
   fileSystems."serve" = {
     #device = "10.42.1.4:/volume1/icdm-mysql/";
     #fsType = "nfs";
diff --git a/hosts/icdm-root/hardware-configuration.nix b/hosts/icdm-root/hardware-configuration.nix
index e4147fc..3c850c2 100644
--- a/hosts/icdm-root/hardware-configuration.nix
+++ b/hosts/icdm-root/hardware-configuration.nix
@@ -1,40 +1,45 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, modulesPath, ... }:
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [
-      (modulesPath + "/installer/scan/not-detected.nix")
-    ];
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ehci_pci"
+    "ahci"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
-    {
-      device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b";
-      fsType = "btrfs";
-      options = [ "subvol=@" ];
-    };
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b";
+    fsType = "btrfs";
+    options = [ "subvol=@" ];
+  };
 
-  fileSystems."/boot" =
-    {
-      device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32";
-      fsType = "ext4";
-    };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32";
+    fsType = "ext4";
+  };
 
-  fileSystems."/var" =
-    {
-      device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65";
-      fsType = "btrfs";
-    };
+  fileSystems."/var" = {
+    device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65";
+    fsType = "btrfs";
+  };
 
-  swapDevices =
-    [{ device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; }];
+  swapDevices = [ { device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; } ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
diff --git a/hosts/icdm-root/networking.nix b/hosts/icdm-root/networking.nix
index c4c7037..66951e6 100644
--- a/hosts/icdm-root/networking.nix
+++ b/hosts/icdm-root/networking.nix
@@ -1,8 +1,6 @@
 { ... }:
 let
-  dnsHosts = builtins.concatStringsSep "\n" [
-    "wiki.icdm.lan 10.42.101.1"
-  ];
+  dnsHosts = builtins.concatStringsSep "\n" [ "wiki.icdm.lan 10.42.101.1" ];
 in
 {
   # If we have to do proxying in Bayonnais, we can start to work on that here
@@ -11,24 +9,32 @@ in
     hostName = "icdm-root";
     useDHCP = false;
     defaultGateway = "10.42.1.1";
-    nameservers = [ "100.100.100.100" "10.42.1.2" ];
+    nameservers = [
+      "100.100.100.100"
+      "10.42.1.2"
+    ];
     enableIPv6 = false;
 
     interfaces = {
-      eno1.ipv4.addresses = [{
-        address = "10.42.101.1";
-        prefixLength = 16;
-      }
+      eno1.ipv4.addresses = [
+        {
+          address = "10.42.101.1";
+          prefixLength = 16;
+        }
         {
           address = "10.77.1.2";
           prefixLength = 16;
-        }];
+        }
+      ];
     };
     # Allow traffic through
     firewall = {
       enable = true;
       allowedTCPPorts = [ 53 ];
-      allowedUDPPorts = [ 53 67 ];
+      allowedUDPPorts = [
+        53
+        67
+      ];
     };
 
     extraHosts = "${dnsHosts}";
@@ -38,9 +44,7 @@ in
     enable = true;
     settings = {
       domain = "icdm.lan";
-      dhcp-range = [
-        "eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h"
-      ];
+      dhcp-range = [ "eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h" ];
       dhcp-option = [
         "eno1,option:router,10.77.1.1"
         "eno1,option:dns-server,10.77.1.2,1.1.1.1"
diff --git a/hosts/iso/default.nix b/hosts/iso/default.nix
index 7108e93..bbb5e8e 100644
--- a/hosts/iso/default.nix
+++ b/hosts/iso/default.nix
@@ -1,4 +1,9 @@
-{ pkgs, lib, modulesPath, ... }:
+{
+  pkgs,
+  lib,
+  modulesPath,
+  ...
+}:
 {
 
   imports = [
@@ -9,7 +14,5 @@
   networking.networkmanager.enable = lib.mkForce false;
   users.users.greg.initialPassword = "";
   #services.getty.autologinUser = lib.mkForce "greg";
-  environment.systemPackages = with pkgs; [
-    tree
-  ];
+  environment.systemPackages = with pkgs; [ tree ];
 }
diff --git a/hosts/jeremiah/default.nix b/hosts/jeremiah/default.nix
index 4d6fd34..42a0851 100644
--- a/hosts/jeremiah/default.nix
+++ b/hosts/jeremiah/default.nix
@@ -2,16 +2,20 @@
 # your system.	Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 {
-  imports =
-    [
-      # Include the results of the hardware scan.
-      ./ceph.nix
-      ./hardware-configuration.nix
-      ./minio.nix
-    ];
+  imports = [
+    # Include the results of the hardware scan.
+    ./ceph.nix
+    ./hardware-configuration.nix
+    ./minio.nix
+  ];
 
   # Bootloader.
   boot.loader.systemd-boot.enable = true;
@@ -32,25 +36,27 @@
     };
     interfaces = {
       enp68s0 = {
-        ipv4.addresses = [{
-          address = "10.42.1.8";
-          prefixLength = 16;
-        }
+        ipv4.addresses = [
+          {
+            address = "10.42.1.8";
+            prefixLength = 16;
+          }
           {
             address = "10.42.100.1";
             prefixLength = 16;
-          }];
+          }
+        ];
       };
       san = {
-        ipv4.addresses = [{
-          address = "10.201.1.2";
-          prefixLength = 24;
-        }];
+        ipv4.addresses = [
+          {
+            address = "10.201.1.2";
+            prefixLength = 24;
+          }
+        ];
       };
     };
-    nameservers = [
-      "10.42.1.5"
-    ];
+    nameservers = [ "10.42.1.5" ];
   };
   greg = {
     home = true;
diff --git a/hosts/jeremiah/hardware-configuration.nix b/hosts/jeremiah/hardware-configuration.nix
index 9f4d0a7..c0c7635 100644
--- a/hosts/jeremiah/hardware-configuration.nix
+++ b/hosts/jeremiah/hardware-configuration.nix
@@ -1,30 +1,37 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, modulesPath, ... }:
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [
-      (modulesPath + "/installer/scan/not-detected.nix")
-    ];
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
 
-  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "uas" "usbhid" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "ahci"
+    "uas"
+    "usbhid"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
-    {
-      device = "/dev/disk/by-uuid/ffc167f5-d9e4-4b11-a5f1-f7da0550ad24";
-      fsType = "ext4";
-    };
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/ffc167f5-d9e4-4b11-a5f1-f7da0550ad24";
+    fsType = "ext4";
+  };
 
-  fileSystems."/boot" =
-    {
-      device = "/dev/disk/by-uuid/3047-870E";
-      fsType = "vfat";
-    };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/3047-870E";
+    fsType = "vfat";
+  };
 
   swapDevices = [ ];
 
diff --git a/hosts/jude/boot.nix b/hosts/jude/boot.nix
index a4136c7..67e0017 100644
--- a/hosts/jude/boot.nix
+++ b/hosts/jude/boot.nix
@@ -12,23 +12,28 @@
         enable = true;
         configurationLimit = 20;
         extraEntries = {
-          "Windows.conf" = (lib.strings.concatStringsSep "\n" [
-            "title Windows"
-            "efi /EFI/Microsoft/EFI/bootmgfw.efi"
-          ]);
-          "Win2.conf" = (lib.strings.concatStringsSep "\n" [
-            "title Windows 11"
-            "efi /shellx64.efi"
-            "options -nointerrupt -noconsolein -noconsoleout windows11.nsh"
-          ]);
-          "Shell.conf" = (lib.strings.concatStringsSep "\n" [
-            "title EFI Shell"
-            "efi /shell.efi"
-          ]);
+          "Windows.conf" = (
+            lib.strings.concatStringsSep "\n" [
+              "title Windows"
+              "efi /EFI/Microsoft/EFI/bootmgfw.efi"
+            ]
+          );
+          "Win2.conf" = (
+            lib.strings.concatStringsSep "\n" [
+              "title Windows 11"
+              "efi /shellx64.efi"
+              "options -nointerrupt -noconsolein -noconsoleout windows11.nsh"
+            ]
+          );
+          "Shell.conf" = (
+            lib.strings.concatStringsSep "\n" [
+              "title EFI Shell"
+              "efi /shell.efi"
+            ]
+          );
         };
         extraFiles = {
-          "windows11.nsh" = (pkgs.writeText "windows11.nsh" (lib.strings.concatStringsSep "\n" [
-          ]));
+          "windows11.nsh" = (pkgs.writeText "windows11.nsh" (lib.strings.concatStringsSep "\n" [ ]));
           "shell.efi" = "${pkgs.edk2-uefi-shell}/shell.efi";
         };
       };
@@ -38,11 +43,11 @@
         useOSProber = true;
         efiSupport = true;
         extraEntries = ''
-          				menuentry "Windows" --class windows --class os {
-          				  insmod ntfs
-          				  chainloader (hd0,0)/EFI/Windows/bootmgfw.efi
-          				}
-          				'';
+          menuentry "Windows" --class windows --class os {
+            insmod ntfs
+            chainloader (hd0,0)/EFI/Windows/bootmgfw.efi
+          }
+        '';
       };
       #efi.canTouchEfiVariables = true;
     };
diff --git a/hosts/jude/default.nix b/hosts/jude/default.nix
index 75d99a6..8a546aa 100644
--- a/hosts/jude/default.nix
+++ b/hosts/jude/default.nix
@@ -25,7 +25,10 @@
     firewall = {
       enable = false;
       allowedTCPPorts = [ 21000 ];
-      allowedUDPPorts = [ 21000 21010 ];
+      allowedUDPPorts = [
+        21000
+        21010
+      ];
     };
   };
   greg = {
@@ -38,48 +41,50 @@
 
   boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
 
-  environment.systemPackages = with pkgs; lib.mkMerge [
-    [
-      # for Immersed
-      cudatoolkit
-      immersed-vr
-      libva
-    ]
-    [
-      bind # For things like nslookup
-      create_ssl
-      distrobox
-      expect
-      gimp
-      go
-      gparted
-      gnucash
-      graphviz
-      flock
-      ffmpeg
-      handbrake
-      imagemagick
-      libtheora
-      libxml2
-      linode-cli
-      makemkv
-      oathToolkit
-      usbutils
-      vagrant
-      ventoy
-    ]
+  environment.systemPackages =
+    with pkgs;
+    lib.mkMerge [
+      [
+        # for Immersed
+        cudatoolkit
+        immersed-vr
+        libva
+      ]
+      [
+        bind # For things like nslookup
+        create_ssl
+        distrobox
+        expect
+        gimp
+        go
+        gparted
+        gnucash
+        graphviz
+        flock
+        ffmpeg
+        handbrake
+        imagemagick
+        libtheora
+        libxml2
+        linode-cli
+        makemkv
+        oathToolkit
+        usbutils
+        vagrant
+        ventoy
+      ]
 
-    [
-      # Video/Audio data composition framework tools like "gst-inspect", "gst-launch" ...
-      gst_all_1.gstreamer
-      gst_all_1.gst-plugins-base
-      gst_all_1.gst-plugins-good
-      gst_all_1.gst-plugins-bad
-      gst_all_1.gst-plugins-ugly
-      gst_all_1.gst-libav
-      gst_all_1.gst-vaapi
-    ]
-  ];
+      [
+        # Video/Audio data composition framework tools like "gst-inspect", "gst-launch" ...
+        gst_all_1.gstreamer
+        gst_all_1.gst-plugins-base
+        gst_all_1.gst-plugins-good
+        gst_all_1.gst-plugins-bad
+        gst_all_1.gst-plugins-ugly
+        gst_all_1.gst-libav
+        gst_all_1.gst-vaapi
+      ]
+    ];
   fileSystems = {
     "/boot" = {
       device = "/dev/nvme0n1p1";
diff --git a/hosts/jude/hardware-configuration.nix b/hosts/jude/hardware-configuration.nix
index 41db3ff..10d765f 100644
--- a/hosts/jude/hardware-configuration.nix
+++ b/hosts/jude/hardware-configuration.nix
@@ -1,25 +1,33 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, modulesPath, ... }:
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [
-      (modulesPath + "/installer/scan/not-detected.nix")
-    ];
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
 
-  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "ahci"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
-    {
-      #device = "/dev/disk/by-uuid/27ae91ed-32e9-411e-8227-0d99e360fbbf";
-      device = "/dev/nvme0n1p4";
-      fsType = "btrfs";
-    };
+  fileSystems."/" = {
+    #device = "/dev/disk/by-uuid/27ae91ed-32e9-411e-8227-0d99e360fbbf";
+    device = "/dev/nvme0n1p4";
+    fsType = "btrfs";
+  };
 
   swapDevices = [ ];
 
diff --git a/hosts/linode/default.nix b/hosts/linode/default.nix
index cd6205a..5ede3a1 100644
--- a/hosts/linode/default.nix
+++ b/hosts/linode/default.nix
@@ -1,4 +1,9 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 
 {
   imports = [
@@ -29,9 +34,7 @@
     networkmanager.enable = lib.mkForce false;
     hostName = "linode";
     domain = "thehellings.com";
-    nameservers = [
-      "100.88.91.27"
-    ];
+    nameservers = [ "100.88.91.27" ];
   };
 
   age.secrets.runner-deployer = {
@@ -58,17 +61,21 @@
     User = "gitlab-runner";
   };
 
-  security.sudo.extraRules = [{
-    users = [ "gitlab-runner" ];
-    commands = [{
-      command = "/run/current-system/sw/bin/systemctl";
-      options = [ "NOPASSWD" ];
+  security.sudo.extraRules = [
+    {
+      users = [ "gitlab-runner" ];
+      commands = [
+        {
+          command = "/run/current-system/sw/bin/systemctl";
+          options = [ "NOPASSWD" ];
+        }
+        {
+          command = "/run/current-system/sw/bin/podman";
+          options = [ "NOPASSWD" ];
+        }
+      ];
     }
-      {
-        command = "/run/current-system/sw/bin/podman";
-        options = [ "NOPASSWD" ];
-      }];
-  }];
+  ];
 
   environment.systemPackages = with pkgs; [
     bind
diff --git a/hosts/linode/git.nix b/hosts/linode/git.nix
index 8d54b09..64ab313 100644
--- a/hosts/linode/git.nix
+++ b/hosts/linode/git.nix
@@ -10,9 +10,9 @@ in
     ssl = true;
     genAliases = false;
     extraConfig = ''
-      		proxy_set_header X-Forwarded-Proto https;
-      		proxy_set_header X-Forwarded-Ssl on;
-      		'';
+      proxy_set_header X-Forwarded-Proto https;
+      proxy_set_header X-Forwarded-Ssl on;
+    '';
   };
   greg.proxies."registry.thehellings.com" = {
     target = "https://registry.thehellings.lan:5000";
diff --git a/hosts/linode/hardware-configuration.nix b/hosts/linode/hardware-configuration.nix
index 34ec318..302e5f0 100644
--- a/hosts/linode/hardware-configuration.nix
+++ b/hosts/linode/hardware-configuration.nix
@@ -1,14 +1,22 @@
 # Do not modify this file!  It was generated by "nixos-generate-config"
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, modulesPath, ... }:
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
 
-  boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_scsi" "ahci" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "virtio_pci"
+    "virtio_scsi"
+    "ahci"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
@@ -18,9 +26,7 @@
     fsType = "ext4";
   };
 
-  swapDevices = [
-    { device = "/dev/sdb"; }
-  ];
+  swapDevices = [ { device = "/dev/sdb"; } ];
 
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
diff --git a/hosts/linode/matrix.nix b/hosts/linode/matrix.nix
index 487420f..45c146d 100644
--- a/hosts/linode/matrix.nix
+++ b/hosts/linode/matrix.nix
@@ -19,7 +19,9 @@ in
         # the actual application server at matrix.thehellings.com
         locations."= /.well-known/matrix/server".extraConfig =
           let
-            server = { "m.server" = "${fqdn}:443"; };
+            server = {
+              "m.server" = "${fqdn}:443";
+            };
           in
           ''
             add_header Content-Type application/json;
@@ -29,8 +31,12 @@ in
         locations."= /.well-known/matrix/client".extraConfig =
           let
             client = {
-              "m.homeserver" = { "base_url" = "https://${fqdn}"; };
-              "m.identity_server" = { "base_url" = "https://vector.im"; };
+              "m.homeserver" = {
+                "base_url" = "https://${fqdn}";
+              };
+              "m.identity_server" = {
+                "base_url" = "https://vector.im";
+              };
             };
           in
           ''
@@ -58,6 +64,9 @@ in
   # Open networking ports for the server
   networking.firewall = {
     enable = true;
-    allowedTCPPorts = [ 80 443 ];
+    allowedTCPPorts = [
+      80
+      443
+    ];
   };
 }
diff --git a/hosts/linode/postgres.nix b/hosts/linode/postgres.nix
index 99f30fe..d43bdc3 100644
--- a/hosts/linode/postgres.nix
+++ b/hosts/linode/postgres.nix
@@ -1,26 +1,24 @@
 { config, pkgs, ... }:
 
 {
-  environment.systemPackages = [
-    pkgs.upgrade-pg-cluster
-  ];
+  environment.systemPackages = [ pkgs.upgrade-pg-cluster ];
 
   services.postgresql = {
     enable = true;
     package = pkgs.postgresql_15;
     checkConfig = true;
-    ensureDatabases = [
-      "nextcloud"
-    ];
+    ensureDatabases = [ "nextcloud" ];
     #initialScript = pkgs.writeText "create-matrix-db.sql" ''
     #	CREATE ROLE "matrix-synapse" WITH LOGIN;
     #	CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
     #	GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
     #'';  # These are done manually in order to set the LC_COLLATE values properly
-    ensureUsers = [{
-      name = "nextcloud";
-      ensureDBOwnership = true;
-    }];
+    ensureUsers = [
+      {
+        name = "nextcloud";
+        ensureDBOwnership = true;
+      }
+    ];
     settings = {
       log_connections = true;
       log_statement = "all";
@@ -34,9 +32,7 @@
 
   services.postgresqlBackup = {
     enable = true;
-    databases = [
-      "nextcloud"
-    ];
+    databases = [ "nextcloud" ];
   };
 
   services.logrotate = {
diff --git a/hosts/myself/container-git.nix b/hosts/myself/container-git.nix
index 42f03ac..e6babe1 100644
--- a/hosts/myself/container-git.nix
+++ b/hosts/myself/container-git.nix
@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   registryPort = 5000;
   vpnIp = "100.78.226.76";
@@ -8,7 +13,12 @@ in
   age.secretsMountPoint = "/run/derp";
   age.secrets =
     let
-      cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "gitlab"; group = "gitlab"; mode = "0444"; };
+      cfg = n: {
+        file = ../../secrets/gitlab/${n}.age;
+        owner = "gitlab";
+        group = "gitlab";
+        mode = "0444";
+      };
     in
     {
       gitlab-secret = cfg "secret";
@@ -32,16 +42,19 @@ in
       };
     };
 
-  networking.firewall.allowedTCPPorts = [ 80 registryPort ];
+  networking.firewall.allowedTCPPorts = [
+    80
+    registryPort
+  ];
 
   greg.proxies =
     let
       t = {
         target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
         extraConfig = ''
-          			proxy_set_header X-Forwarded-Proto https;
-          			proxy_set_header X-Forwarded-Ssl on;
-          			'';
+          proxy_set_header X-Forwarded-Proto https;
+          proxy_set_header X-Forwarded-Ssl on;
+        '';
       };
     in
     {
@@ -115,33 +128,45 @@ in
             provider = "AWS";
             endpoint = "http://s3.thehellings.lan:9000";
             region = "us-east-1";
-            aws_access_key_id = { _secret = config.age.secrets.minio_access_key_id.path; };
-            aws_secret_access_key = { _secret = config.age.secrets.minio_secret_access_key.path; };
+            aws_access_key_id = {
+              _secret = config.age.secrets.minio_access_key_id.path;
+            };
+            aws_secret_access_key = {
+              _secret = config.age.secrets.minio_secret_access_key.path;
+            };
             path_style = true; # True for MinIO
             aws_signature_version = 2;
           };
           #storage_options = ...;
-          objects = builtins.listToAttrs (builtins.map (x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }) [
-            "artifacts"
-            "ci_secure_files"
-            "dependency_proxy"
-            "external_diffs"
-            "lfs"
-            "packages"
-            "pages"
-            "terraform_state"
-            "uploads"
-          ]);
+          objects = builtins.listToAttrs (
+            builtins.map
+              (
+                x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }
+              )
+              [
+                "artifacts"
+                "ci_secure_files"
+                "dependency_proxy"
+                "external_diffs"
+                "lfs"
+                "packages"
+                "pages"
+                "terraform_state"
+                "uploads"
+              ]
+          );
         };
       };
     };
 
     nginx.virtualHosts."gitlab.shire-zebra.ts.net" = {
-      listen = [{
-        addr = vpnIp;
-        port = registryPort;
-        ssl = true;
-      }];
+      listen = [
+        {
+          addr = vpnIp;
+          port = registryPort;
+          ssl = true;
+        }
+      ];
       locations."/" = {
         proxyPass = "http://127.0.0.1:5000/";
         recommendedProxySettings = true;
@@ -156,17 +181,21 @@ in
     # Fetch the SSL certificates for nginx to use
     cron = {
       enable = true;
-      systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ];
+      systemCronJobs = [
+        "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx"
+      ];
     };
 
     postgresql = {
       enable = true;
       checkConfig = true;
       ensureDatabases = [ "gitlab" ];
-      ensureUsers = [{
-        name = "gitlab";
-        ensureDBOwnership = true;
-      }];
+      ensureUsers = [
+        {
+          name = "gitlab";
+          ensureDBOwnership = true;
+        }
+      ];
       settings = {
         log_connections = true;
         log_statement = "all";
@@ -186,9 +215,7 @@ in
   # to the 100.* addresses
   systemd.services = {
     nginx = rec {
-      after = [
-        "network-online.target"
-      ];
+      after = [ "network-online.target" ];
       wants = after;
       serviceConfig = {
         RestartMaxDelaySec = "30s";
diff --git a/hosts/myself/hardware-configuration.nix b/hosts/myself/hardware-configuration.nix
index a45886d..58cdcef 100644
--- a/hosts/myself/hardware-configuration.nix
+++ b/hosts/myself/hardware-configuration.nix
@@ -1,44 +1,50 @@
 # Do not modify this file!	It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.	Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, modulesPath, ... }:
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [
-      (modulesPath + "/installer/scan/not-detected.nix")
-    ];
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
 
-  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "ahci"
+    "usb_storage"
+    "usbhid"
+    "sd_mod"
+    "sr_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
-    {
-      device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
-      fsType = "btrfs";
-      options = [ "subvol=nixos" ];
-    };
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
+    fsType = "btrfs";
+    options = [ "subvol=nixos" ];
+  };
 
-  fileSystems."/home" =
-    {
-      device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
-      fsType = "btrfs";
-      options = [ "subvol=home" ];
-    };
+  fileSystems."/home" = {
+    device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
+    fsType = "btrfs";
+    options = [ "subvol=home" ];
+  };
 
-  fileSystems."/boot" =
-    {
-      device = "/dev/disk/by-uuid/29E7-E20C";
-      fsType = "vfat";
-    };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/29E7-E20C";
+    fsType = "vfat";
+  };
 
-  fileSystems."/myvol" =
-    {
-      device = "/dev/nvme0n1p1";
-      fsType = "btrfs";
-    };
+  fileSystems."/myvol" = {
+    device = "/dev/nvme0n1p1";
+    fsType = "btrfs";
+  };
 
   swapDevices = [ ];
 
diff --git a/hosts/myself/matrix.nix b/hosts/myself/matrix.nix
index 1893655..0c0f870 100644
--- a/hosts/myself/matrix.nix
+++ b/hosts/myself/matrix.nix
@@ -8,82 +8,92 @@ in
   greg.containers.matrix = {
     tailscale = true;
     subnet = "204";
-    builder = { config, ... }: {
-      networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ];
+    builder =
+      { config, ... }:
+      {
+        networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ];
 
-      # Environment secrets
-      age = {
-        secrets.dendrite = {
-          file = ../../secrets/dendrite.age;
-          owner = "dendrite";
+        # Environment secrets
+        age = {
+          secrets.dendrite = {
+            file = ../../secrets/dendrite.age;
+            owner = "dendrite";
+          };
+          secrets.dendrite_key = {
+            file = ../../secrets/dendrite_key.age;
+            owner = "dendrite";
+          };
         };
-        secrets.dendrite_key = {
-          file = ../../secrets/dendrite_key.age;
-          owner = "dendrite";
+
+        users.users.dendrite = {
+          isSystemUser = true;
+          group = "dendrite";
         };
-      };
+        users.groups.dendrite = { };
 
-      users.users.dendrite = {
-        isSystemUser = true;
-        group = "dendrite";
-      };
-      users.groups.dendrite = { };
+        systemd.services.dendrite.serviceConfig = {
+          User = "dendrite";
+        };
 
-      systemd.services.dendrite.serviceConfig = {
-        User = "dendrite";
-      };
+        greg.databases.dendrite = { };
 
-      greg.databases.dendrite = { };
-
-      services.dendrite = {
-        enable = true;
-        environmentFile = config.age.secrets.dendrite.path;
-        httpPort = 8448;
-        # Identify ourselves as the root of our own domain
-        settings = (
-          (builtins.listToAttrs (
-            (map (x: { name = x; value = { database.connection_string = conn; }; }) [
-              "app_service_api"
-              "federation_api"
-              "key_server"
-              "media_api"
-              "mscs"
-              "relay_api"
-              "room_server"
-              "sync_api"
-            ])
-          )) //
-          {
-            user_api.account_database.connection_string = conn;
-            user_api.device_database.connection_string = conn;
-            global = {
-              database = {
-                connection_string = conn;
-                max_open_conns = 25;
-                max_idle_conns = 5;
-                conn_max_lifetime = -1;
+        services.dendrite = {
+          enable = true;
+          environmentFile = config.age.secrets.dendrite.path;
+          httpPort = 8448;
+          # Identify ourselves as the root of our own domain
+          settings = (
+            (builtins.listToAttrs (
+              (map
+                (x: {
+                  name = x;
+                  value = {
+                    database.connection_string = conn;
+                  };
+                })
+                [
+                  "app_service_api"
+                  "federation_api"
+                  "key_server"
+                  "media_api"
+                  "mscs"
+                  "relay_api"
+                  "room_server"
+                  "sync_api"
+                ]
+              )
+            ))
+            // {
+              user_api.account_database.connection_string = conn;
+              user_api.device_database.connection_string = conn;
+              global = {
+                database = {
+                  connection_string = conn;
+                  max_open_conns = 25;
+                  max_idle_conns = 5;
+                  conn_max_lifetime = -1;
+                };
+                server_name = "thehellings.com";
+                trusted_third_party_id_servers = [
+                  "matrix.org"
+                  "vector.im"
+                  "jupiterbroadcasting.com"
+                ];
+                # Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem
+                private_key = config.age.secrets.dendrite_key.path;
               };
-              server_name = "thehellings.com";
-              trusted_third_party_id_servers = [
-                "matrix.org"
-                "vector.im"
-                "jupiterbroadcasting.com"
-              ];
-              # Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem
-              private_key = config.age.secrets.dendrite_key.path;
-            };
-            client_api = {
-              registration_enabled = false;
-              registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}";
-            };
-          }
-        );
-      };
+              client_api = {
+                registration_enabled = false;
+                registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}";
+              };
+            }
+          );
+        };
 
-      systemd.services.dendrite = {
-        after = [ "postgresql.service" ];
-        requires = [ "postgresql.service" ];
+        systemd.services.dendrite = {
+          after = [ "postgresql.service" ];
+          requires = [ "postgresql.service" ];
+        };
       };
-    };
   };
 }
diff --git a/modules/darwin/default.nix b/modules/darwin/default.nix
index 55edd6c..4a212d7 100644
--- a/modules/darwin/default.nix
+++ b/modules/darwin/default.nix
@@ -1,8 +1,6 @@
 { ... }:
 {
-  imports = [
-    ../baseline.nix
-  ];
+  imports = [ ../baseline.nix ];
   system.stateVersion = 4;
   home-manager = {
     useGlobalPkgs = true;
diff --git a/modules/nixos/backup.nix b/modules/nixos/backup.nix
index 8c9cfc4..2604fae 100644
--- a/modules/nixos/backup.nix
+++ b/modules/nixos/backup.nix
@@ -1,4 +1,9 @@
-{ lib, config, pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.greg.backup;
@@ -14,7 +19,8 @@ let
     type = "sendonly";
   };
 
-  makeRestic = _: job:
+  makeRestic =
+    _: job:
     let
       who = "${config.services.syncthing.user}:${config.services.syncthing.group}";
     in
@@ -27,48 +33,50 @@ let
     };
 
 in
-with lib; {
+with lib;
+{
   options = {
     greg.backup = {
       jobs = mkOption {
         default = { };
 
-        type = with types; attrsOf (submodule (
-          { ... }:
-          {
-            options = {
-              src = mkOption {
-                type = types.str;
-                description = "Local path (string form) to backup from";
-              };
+        type =
+          with types;
+          attrsOf (
+            submodule (
+              { ... }:
+              {
+                options = {
+                  src = mkOption {
+                    type = types.str;
+                    description = "Local path (string form) to backup from";
+                  };
 
-              dest = mkOption {
-                type = types.str;
-              };
+                  dest = mkOption { type = types.str; };
 
-              id = mkOption {
-                type = types.str;
-                description = "The unique folder ID for this";
-              };
-            };
-          }
-        ));
+                  id = mkOption {
+                    type = types.str;
+                    description = "The unique folder ID for this";
+                  };
+                };
+              }
+            )
+          );
       };
     };
   };
 
-  config = mkIf ((attrValues cfg.jobs) != [ ])
-    {
-      age.secrets = {
-        restic-pw.file = ../../secrets/restic-pw.age;
-        restic-env.file = ../../secrets/restic-env.age;
-      };
-      greg.syncthing = {
-        enable = true;
-      };
-      services = {
-        syncthing.settings.folders = mapAttrs makeSyncFolders cfg.jobs;
-        restic.backups = mapAttrs makeRestic cfg.jobs;
-      };
+  config = mkIf ((attrValues cfg.jobs) != [ ]) {
+    age.secrets = {
+      restic-pw.file = ../../secrets/restic-pw.age;
+      restic-env.file = ../../secrets/restic-env.age;
     };
+    greg.syncthing = {
+      enable = true;
+    };
+    services = {
+      syncthing.settings.folders = mapAttrs makeSyncFolders cfg.jobs;
+      restic.backups = mapAttrs makeRestic cfg.jobs;
+    };
+  };
 }
diff --git a/modules/nixos/ceph.nix b/modules/nixos/ceph.nix
index 7bd4cf1..2ddf2d0 100644
--- a/modules/nixos/ceph.nix
+++ b/modules/nixos/ceph.nix
@@ -1,6 +1,11 @@
 # This is a good source for a Ceph dealio
 # https://gist.github.com0/nh2/13425a1f18b4c1ce82edb63c10b163c9
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 with lib;
 
@@ -8,13 +13,12 @@ let
   cfg = config.services.ceph-benaco;
   commaSep = builtins.concatStringsSep ",";
 
-  ensureUnitExists = c': name:
+  ensureUnitExists =
+    c': name:
     let
-      #unitName = (builtins.elemAt (builtins.split "\\." name) 0);
     in
-    if c'.systemd.services ? unitName
-    then name
-    else name; # "Unable to locate ${name} at ${commaSep (builtins.attrNames c')}";
+    #unitName = (builtins.elemAt (builtins.split "\\." name) 0);
+    if c'.systemd.services ? unitName then name else name; # "Unable to locate ${name} at ${commaSep (builtins.attrNames c')}";
 in
 
 {
@@ -46,36 +50,40 @@ in
       };
 
       initialMonitors = mkOption {
-        type = types.listOf (types.submodule {
-          options = {
-            hostname = mkOption {
-              type = types.str;
-              description = "Initial monitor hostname.";
-            };
+        type = types.listOf (
+          types.submodule {
+            options = {
+              hostname = mkOption {
+                type = types.str;
+                description = "Initial monitor hostname.";
+              };
 
-            ipAddress = mkOption {
-              type = types.str;
-              description = "Initial monitor IP address.";
+              ipAddress = mkOption {
+                type = types.str;
+                description = "Initial monitor IP address.";
+              };
             };
-          };
-        });
+          }
+        );
         description = "Initial monitors.";
       };
 
       mdsNodes = mkOption {
-        type = types.listOf (types.submodule {
-          options = {
-            hostname = mkOption {
-              type = types.str;
-              description = "MDS hostname.";
-            };
+        type = types.listOf (
+          types.submodule {
+            options = {
+              hostname = mkOption {
+                type = types.str;
+                description = "MDS hostname.";
+              };
 
-            ipAddress = mkOption {
-              type = types.str;
-              description = "MDS IP address.";
+              ipAddress = mkOption {
+                type = types.str;
+                description = "MDS IP address.";
+              };
             };
-          };
-        });
+          }
+        );
         description = "MDS nodes.";
       };
 
@@ -177,123 +185,125 @@ in
           current machine only, used only to name the systemd service
           for that OSD.
         '';
-        type = types.attrsOf (types.submodule {
-          options = {
+        type = types.attrsOf (
+          types.submodule {
+            options = {
 
-            enable = mkEnableOption "Activate a Ceph OSD on this machine.";
+              enable = mkEnableOption "Activate a Ceph OSD on this machine.";
+
+              bootstrapKeyring = mkOption {
+                type = types.path;
+                description = "Ceph OSD bootstrap keyring.";
+                example = "/path/to/ceph.client.bootstrap-osd.keyring";
+              };
+
+              id = mkOption {
+                type = types.int;
+                description = "The ID of this OSD. Must be unique in the Ceph cluster.";
+                example = 1;
+              };
+
+              uuid = mkOption {
+                type = types.str;
+                description = "The UUID of this OSD. Must be unique in the Ceph cluster.";
+                example = "abcdef12-abcd-1234-abcd-1234567890ab";
+              };
+
+              systemdExtraRequiresAfter = mkOption {
+                type = types.listOf types.str;
+                default = [ ];
+                description = ''
+                  Add the specified systemd units to the "requires" and "after"
+                  lists of the systemd service of this OSD.
+
+                  Useful, for example, to decrypt the underlying block devices with LUKS first.
+
+                  NixOS modules allow override those lists from outside, but for that
+                  the names of the systemd services for the OSDs need to be known;
+                  this option is a convenience to not have to know them from outside.
+                '';
+                example = "decrypt-my-disk.service";
+              };
+
+              skipZap = mkOption {
+                type = types.bool;
+                default = false;
+                description = ''
+                  Whether to skip the zapping of the the OSD device on initial OSD
+                  installation.
+
+                  Skipping is needed because <command>ceph-volume</command> cannot
+                  zap device-mapper devices:
+                  <link xlink:href="https://tracker.ceph.com/issues/24504" />
+
+                  In that case you need to wipe the device manually.
+
+                  In the common case of placing the OSD on a cryptsetup LUKS device
+                  (which is a device-mapper device), re-creating the encryption
+                  from scratch with a new key zaps anything anyway, in which case
+                  zapping can be skipped here.
+                '';
+              };
+
+              blockDevice = mkOption {
+                type = types.str;
+                description = "The block device used to store the OSD.";
+                example = "/dev/sdb";
+              };
+
+              blockDeviceUdevRuleMatcher = mkOption {
+                type = types.str;
+                description = ''
+                  An udev rule matcher matching the block device used to store the OSD.
+                  Will be spliced into the udev rule that is
+                  used to set access permissions to the ceph user via an udev rule.
+
+                  This is a matcher instead of just a device name to allow flexibility:
+                  Normal disks can be easily matched with <code>KERNEL=="sda1"</code>, but
+                  device-mapper may not; for example, decrypted cryptsetup LUKS devices
+                  have a less useful <code>KERNEL=="dm-4"</code> and may better be matched
+                  using <code>ENV{DM_NAME}=="mydisk-decrypted"</code>.
+                '';
+                example = ''KERNEL=="sdb"'';
+              };
+
+              dbBlockDevice = mkOption {
+                type = types.nullOr types.str;
+                default = null;
+                description = ''
+                  The block device used to store the OSD's BlueStore DB device.
+
+                  Put this on a faster device than <option>blockDevice</option> to improve performance.
+
+                  See <link xlink:href="http://docs.ceph.com/docs/master/rados/configuration/bluestore-config-ref/" />
+                  for details.
+                '';
+                example = "/dev/sdc";
+              };
+
+              dbBlockDeviceUdevRuleMatcher = mkOption {
+                type = types.nullOr types.str;
+                default = null;
+                description = ''
+                  Like <option>blockDeviceUdevRuleMatcher</option> but for the
+                  <option>dbBlockDevice</option>.
+                '';
+                example = ''KERNEL=="sdc"'';
+              };
+
+              clusterAddress = mkOption {
+                type = types.nullOr types.str;
+                default = null;
+                description = ''
+                  The IP address on the dedicated cluster network that
+                  is used by the backend communication for OSD communication.
+                '';
+                example = "10.1.0.1f";
+              };
 
-            bootstrapKeyring = mkOption {
-              type = types.path;
-              description = "Ceph OSD bootstrap keyring.";
-              example = "/path/to/ceph.client.bootstrap-osd.keyring";
             };
-
-            id = mkOption {
-              type = types.int;
-              description = "The ID of this OSD. Must be unique in the Ceph cluster.";
-              example = 1;
-            };
-
-            uuid = mkOption {
-              type = types.str;
-              description = "The UUID of this OSD. Must be unique in the Ceph cluster.";
-              example = "abcdef12-abcd-1234-abcd-1234567890ab";
-            };
-
-            systemdExtraRequiresAfter = mkOption {
-              type = types.listOf types.str;
-              default = [ ];
-              description = ''
-                Add the specified systemd units to the "requires" and "after"
-                lists of the systemd service of this OSD.
-
-                Useful, for example, to decrypt the underlying block devices with LUKS first.
-
-                NixOS modules allow override those lists from outside, but for that
-                the names of the systemd services for the OSDs need to be known;
-                this option is a convenience to not have to know them from outside.
-              '';
-              example = "decrypt-my-disk.service";
-            };
-
-            skipZap = mkOption {
-              type = types.bool;
-              default = false;
-              description = ''
-                Whether to skip the zapping of the the OSD device on initial OSD
-                installation.
-
-                Skipping is needed because <command>ceph-volume</command> cannot
-                zap device-mapper devices:
-                <link xlink:href="https://tracker.ceph.com/issues/24504" />
-
-                In that case you need to wipe the device manually.
-
-                In the common case of placing the OSD on a cryptsetup LUKS device
-                (which is a device-mapper device), re-creating the encryption
-                from scratch with a new key zaps anything anyway, in which case
-                zapping can be skipped here.
-              '';
-            };
-
-            blockDevice = mkOption {
-              type = types.str;
-              description = "The block device used to store the OSD.";
-              example = "/dev/sdb";
-            };
-
-            blockDeviceUdevRuleMatcher = mkOption {
-              type = types.str;
-              description = ''
-                An udev rule matcher matching the block device used to store the OSD.
-                Will be spliced into the udev rule that is
-                used to set access permissions to the ceph user via an udev rule.
-
-                This is a matcher instead of just a device name to allow flexibility:
-                Normal disks can be easily matched with <code>KERNEL=="sda1"</code>, but
-                device-mapper may not; for example, decrypted cryptsetup LUKS devices
-                have a less useful <code>KERNEL=="dm-4"</code> and may better be matched
-                using <code>ENV{DM_NAME}=="mydisk-decrypted"</code>.
-              '';
-              example = ''KERNEL=="sdb"'';
-            };
-
-            dbBlockDevice = mkOption {
-              type = types.nullOr types.str;
-              default = null;
-              description = ''
-                The block device used to store the OSD's BlueStore DB device.
-
-                Put this on a faster device than <option>blockDevice</option> to improve performance.
-
-                See <link xlink:href="http://docs.ceph.com/docs/master/rados/configuration/bluestore-config-ref/" />
-                for details.
-              '';
-              example = "/dev/sdc";
-            };
-
-            dbBlockDeviceUdevRuleMatcher = mkOption {
-              type = types.nullOr types.str;
-              default = null;
-              description = ''
-                Like <option>blockDeviceUdevRuleMatcher</option> but for the
-                <option>dbBlockDevice</option>.
-              '';
-              example = ''KERNEL=="sdc"'';
-            };
-
-            clusterAddress = mkOption {
-              type = types.nullOr types.str;
-              default = null;
-              description = ''
-                The IP address on the dedicated cluster network that
-                is used by the backend communication for OSD communication.
-              '';
-              example = "10.1.0.1f";
-            };
-
-          };
-        });
+          }
+        );
       };
 
       mds = {
@@ -367,10 +377,12 @@ in
           sudoersExtraRule = {
             # entry for `security.sudo.extraRules`
             users = [ config.users.users.ceph.name ];
-            commands = [{
-              command = "${lib.getBin pkgs.smartmontools}/bin/smartctl -x --json=o /dev/*";
-              options = [ "NOPASSWD" ];
-            }];
+            commands = [
+              {
+                command = "${lib.getBin pkgs.smartmontools}/bin/smartctl -x --json=o /dev/*";
+                options = [ "NOPASSWD" ];
+              }
+            ];
           };
         }
         {
@@ -378,24 +390,30 @@ in
           sudoersExtraRule = {
             # entry for `security.sudo.extraRules`
             users = [ config.users.users.ceph.name ];
-            commands = [{
-              command = "${lib.getBin pkgs.nvme-cli}/bin/nvme * smart-log-add --json /dev/*";
-              options = [ "NOPASSWD" ];
-            }];
+            commands = [
+              {
+                command = "${lib.getBin pkgs.nvme-cli}/bin/nvme * smart-log-add --json /dev/*";
+                options = [ "NOPASSWD" ];
+              }
+            ];
           };
         }
       ];
 
-      cephDeviceHealthMonitoringPathsOrPackages = with pkgs; [
-        # Contains `sudo`. Ceph wraps this around the other health check programs.
-        # Cannot use `pkgs.sudo` because that one is not SUID, see:
-        # https://discourse.nixos.org/t/sudo-uid-issues/9133
-        "/run/wrappers" # `systemd.services.<name>.path` adds the `bin/` subdir of this
-      ] ++ map ({ package, ... }: package) cephMonitoringSudoersCommandsAndPackages;
+      cephDeviceHealthMonitoringPathsOrPackages =
+        with pkgs;
+        [
+          # Contains `sudo`. Ceph wraps this around the other health check programs.
+          # Cannot use `pkgs.sudo` because that one is not SUID, see:
+          # https://discourse.nixos.org/t/sudo-uid-issues/9133
+          "/run/wrappers" # `systemd.services.<name>.path` adds the `bin/` subdir of this
+        ]
+        ++ map ({ package, ... }: package) cephMonitoringSudoersCommandsAndPackages;
 
       # Unused localOsdServiceName in the following line
       # deadnix: skip
-      makeCephOsdSetupSystemdService = localOsdServiceName: osdConfig:
+      makeCephOsdSetupSystemdService =
+        _localOsdServiceName: osdConfig:
         let
           osdExistenceFile = "/var/lib/ceph/osd/.${toString osdConfig.id}.${osdConfig.uuid}.nix-existence";
         in
@@ -414,60 +432,66 @@ in
           # TODO Use `udevadm trigger --settle` instead of the separate `udevadm settle`
           #      once that feature is available to us with systemd >= 238;
           #      see https://github.com/systemd/systemd/commit/792cc203a67edb201073351f5c766fce3d5eab45
-          preStart = ''
-            set -x
-            ${ensureCephDirs}
-            install -m 755 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph/bootstrap-osd
-            # `install` is not atomic, see
-            # https://lists.gnu.org/archive/html/bug-coreutils/2010-02/msg00243.html
-            # so use `mktemp` + `mv` to make it atomic.
-            TMPFILE=$(mktemp --tmpdir=/var/lib/ceph/bootstrap-osd/)
-            install -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} ${osdConfig.bootstrapKeyring} "$TMPFILE"
-            mv "$TMPFILE" /var/lib/ceph/bootstrap-osd/ceph.keyring
-
-            # Trigger udev rules for permissions of block devices and wait for them to settle.
-            udevadm trigger --name-match=${osdConfig.blockDevice}
-          '' + lib.optionalString (osdConfig.dbBlockDevice != null) ''
-            udevadm trigger --name-match=${osdConfig.dbBlockDevice}
-          '' +
-          ''
-            udevadm settle
-          '' + (optionalString (!osdConfig.skipZap) (
+          preStart =
             ''
-              # Zap OSD block devices, otherwise `ceph-osd` below will try to fsck if there's some old
-              # ceph data on the block device (see https://tracker.ceph.com/issues/24099).
-              ${cfg.package}/bin/ceph-volume lvm zap ${osdConfig.blockDevice}
-            '' + lib.optionalString (osdConfig.dbBlockDevice != null) ''
-              ${cfg.package}/bin/ceph-volume lvm zap ${osdConfig.dbBlockDevice}
+              set -x
+              ${ensureCephDirs}
+              install -m 755 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph/bootstrap-osd
+              # `install` is not atomic, see
+              # https://lists.gnu.org/archive/html/bug-coreutils/2010-02/msg00243.html
+              # so use `mktemp` + `mv` to make it atomic.
+              TMPFILE=$(mktemp --tmpdir=/var/lib/ceph/bootstrap-osd/)
+              install -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} ${osdConfig.bootstrapKeyring} "$TMPFILE"
+              mv "$TMPFILE" /var/lib/ceph/bootstrap-osd/ceph.keyring
+
+              # Trigger udev rules for permissions of block devices and wait for them to settle.
+              udevadm trigger --name-match=${osdConfig.blockDevice}
             ''
-          ));
+            + lib.optionalString (osdConfig.dbBlockDevice != null) ''
+              udevadm trigger --name-match=${osdConfig.dbBlockDevice}
+            ''
+            + ''
+              udevadm settle
+            ''
+            + (optionalString (!osdConfig.skipZap) (
+              ''
+                # Zap OSD block devices, otherwise `ceph-osd` below will try to fsck if there's some old
+                # ceph data on the block device (see https://tracker.ceph.com/issues/24099).
+                ${cfg.package}/bin/ceph-volume lvm zap ${osdConfig.blockDevice}
+              ''
+              + lib.optionalString (osdConfig.dbBlockDevice != null) ''
+                ${cfg.package}/bin/ceph-volume lvm zap ${osdConfig.dbBlockDevice}
+              ''
+            ));
 
-          script = ''
-            set -euo pipefail
-            set -x
-            until [ -f /etc/ceph/${cfg.clusterName}.client.admin.keyring ]
-            do
-              sleep 1
-            done
+          script =
+            ''
+              set -euo pipefail
+              set -x
+              until [ -f /etc/ceph/${cfg.clusterName}.client.admin.keyring ]
+              do
+                sleep 1
+              done
 
-            OSD_SECRET=$(${cfg.package}/bin/ceph-authtool --gen-print-key)
-            echo "{\"cephx_secret\": \"$OSD_SECRET\"}" | \
-              ${cfg.package}/bin/ceph --cluster ${cfg.clusterName} osd new ${osdConfig.uuid} ${toString osdConfig.id} -i - \
-              -n client.bootstrap-osd -k ${osdConfig.bootstrapKeyring}
-            mkdir -p /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id}
+              OSD_SECRET=$(${cfg.package}/bin/ceph-authtool --gen-print-key)
+              echo "{\"cephx_secret\": \"$OSD_SECRET\"}" | \
+                ${cfg.package}/bin/ceph --cluster ${cfg.clusterName} osd new ${osdConfig.uuid} ${toString osdConfig.id} -i - \
+                -n client.bootstrap-osd -k ${osdConfig.bootstrapKeyring}
+              mkdir -p /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id}
 
-            ln -s ${osdConfig.blockDevice} /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id}/block
-          '' + lib.optionalString (osdConfig.dbBlockDevice != null) ''
-            ln -s ${osdConfig.dbBlockDevice} /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id}/block.db
-          '' +
-          ''
+              ln -s ${osdConfig.blockDevice} /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id}/block
+            ''
+            + lib.optionalString (osdConfig.dbBlockDevice != null) ''
+              ln -s ${osdConfig.dbBlockDevice} /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id}/block.db
+            ''
+            + ''
 
-        ${cfg.package}/bin/ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${toString osdConfig.id}/keyring \
-          --name osd.${toString osdConfig.id} --add-key $OSD_SECRET
+              ${cfg.package}/bin/ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${toString osdConfig.id}/keyring \
+                --name osd.${toString osdConfig.id} --add-key $OSD_SECRET
 
-        ${cfg.package}/bin/ceph-osd -i ${toString osdConfig.id} --mkfs --osd-uuid ${osdConfig.uuid} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} --osd-objectstore bluestore
-        touch ${osdExistenceFile}
-      '';
+              ${cfg.package}/bin/ceph-osd -i ${toString osdConfig.id} --mkfs --osd-uuid ${osdConfig.uuid} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} --osd-objectstore bluestore
+              touch ${osdExistenceFile}
+            '';
 
           serviceConfig = {
             Type = "oneshot";
@@ -481,64 +505,64 @@ in
           };
         };
 
-      makeCephOsdSystemdService = localOsdServiceName: osdConfig: mkIf osdConfig.enable {
-        description = "Ceph OSD";
+      makeCephOsdSystemdService =
+        localOsdServiceName: osdConfig:
+        mkIf osdConfig.enable {
+          description = "Ceph OSD";
 
-        # Note we do not have to add `osdConfig.systemdExtraRequiresAfter` here because
-        # that's already a dependency of our dependency `ceph-osd-setup-*`.
-        requires = [
-          (ensureUnitExists config "ceph-osd-setup-${localOsdServiceName}.service")
-        ];
-        requiredBy = [ "multi-user.target" ];
-        after = [
-          "network.target"
-          "local-fs.target"
-          "time-sync.target"
-          (ensureUnitExists config "ceph-osd-setup-${localOsdServiceName}.service")
-        ];
-        wants = [
-          "network.target"
-          "local-fs.target"
-          "time-sync.target"
-        ];
+          # Note we do not have to add `osdConfig.systemdExtraRequiresAfter` here because
+          # that's already a dependency of our dependency `ceph-osd-setup-*`.
+          requires = [ (ensureUnitExists config "ceph-osd-setup-${localOsdServiceName}.service") ];
+          requiredBy = [ "multi-user.target" ];
+          after = [
+            "network.target"
+            "local-fs.target"
+            "time-sync.target"
+            (ensureUnitExists config "ceph-osd-setup-${localOsdServiceName}.service")
+          ];
+          wants = [
+            "network.target"
+            "local-fs.target"
+            "time-sync.target"
+          ];
 
-        path = [
-          # TODO: use wrapProgram in the ceph package for this in the future
-          pkgs.getopt
-        ]
-        ++ cephDeviceHealthMonitoringPathsOrPackages
-        ;
+          path = [
+            # TODO: use wrapProgram in the ceph package for this in the future
+            pkgs.getopt
+          ] ++ cephDeviceHealthMonitoringPathsOrPackages;
 
-        restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ];
+          restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ];
 
-        preStart = ''
-          ${ensureTransientCephDirs}
-          ${lib.getLib cfg.package}/libexec/ceph/ceph-osd-prestart.sh --cluster ${cfg.clusterName} --id ${toString osdConfig.id}
-        '';
+          preStart = ''
+            ${ensureTransientCephDirs}
+            ${lib.getLib cfg.package}/libexec/ceph/ceph-osd-prestart.sh --cluster ${cfg.clusterName} --id ${toString osdConfig.id}
+          '';
 
-        serviceConfig =
-          let
-            clusterIpArg = lib.optionalString (osdConfig.clusterAddress != null) "--cluster_addr=${osdConfig.clusterAddress}";
-          in
-          {
-            LimitNOFILE = "1048576";
-            LimitNPROC = "1048576";
+          serviceConfig =
+            let
+              clusterIpArg = lib.optionalString (
+                osdConfig.clusterAddress != null
+              ) "--cluster_addr=${osdConfig.clusterAddress}";
+            in
+            {
+              LimitNOFILE = "1048576";
+              LimitNPROC = "1048576";
 
-            ExecStart = ''
-              ${cfg.package}/bin/ceph-osd -f --cluster ${cfg.clusterName} --id ${toString osdConfig.id} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} "--public_bind_addr=${cfg.osdBindAddr}" "--public_addr=${cfg.osdAdvertisedPublicAddr}" "${clusterIpArg}"
-            '';
-            ExecReload = ''
-              ${pkgs.coreutils}/bin/kill -HUP $MAINPID
-            '';
-            Restart = "on-failure";
-            ProtectHome = "true";
-            ProtectSystem = "full";
-            PrivateTmp = "true";
-            TasksMax = "infinity";
-            # StartLimitBurst="3";
-          };
-        # startLimitIntervalSec = 30 * 60;
-      };
+              ExecStart = ''
+                ${cfg.package}/bin/ceph-osd -f --cluster ${cfg.clusterName} --id ${toString osdConfig.id} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} "--public_bind_addr=${cfg.osdBindAddr}" "--public_addr=${cfg.osdAdvertisedPublicAddr}" "${clusterIpArg}"
+              '';
+              ExecReload = ''
+                ${pkgs.coreutils}/bin/kill -HUP $MAINPID
+              '';
+              Restart = "on-failure";
+              ProtectHome = "true";
+              ProtectSystem = "full";
+              PrivateTmp = "true";
+              TasksMax = "infinity";
+              # StartLimitBurst="3";
+            };
+          # startLimitIntervalSec = 30 * 60;
+        };
 
     in
     mkIf cfg.enable {
@@ -551,7 +575,10 @@ in
           3300 # ceph msgr-v2
         ];
         allowedTCPPortRanges = [
-          { from = 6800; to = 7300; } # https://docs.ceph.com/en/pacific/rados/configuration/network-config-ref/
+          {
+            from = 6800;
+            to = 7300;
+          } # https://docs.ceph.com/en/pacific/rados/configuration/network-config-ref/
         ];
       };
 
@@ -565,63 +592,62 @@ in
       #   if you want to override an option you've set in `global`.
       #
       # Sample: https://github.com/ceph/ceph/blob/master/src/sample.ceph.conf
-      environment.etc."ceph/${cfg.clusterName}.conf".text =
-        ''
-          [global]
-          fsid = ${cfg.fsid}
-          mon_initial_members = ${commaSep (map (mon: mon.hostname) cfg.initialMonitors)}
-          mon_host = ${commaSep (map (mon: mon.ipAddress) cfg.initialMonitors)}
+      environment.etc."ceph/${cfg.clusterName}.conf".text = ''
+        [global]
+        fsid = ${cfg.fsid}
+        mon_initial_members = ${commaSep (map (mon: mon.hostname) cfg.initialMonitors)}
+        mon_host = ${commaSep (map (mon: mon.ipAddress) cfg.initialMonitors)}
 
-          # Ceph clusters go into WARN health mode, until
-          # the following setting is made strict by setting it to `false`:
-          # See: https://docs.ceph.com/en/latest/security/CVE-2021-20288/#recommendations
-          # As of writing, this setting is not documented outside of the CVE note :(
-          #
-          # While for new clusters the warning no longer seems to appear, it still
-          # appears in our existing clusters unless this option is set, see:
-          # https://tracker.ceph.com/issues/53751#note-7
-          auth_allow_insecure_global_id_reclaim = false
+        # Ceph clusters go into WARN health mode, until
+        # the following setting is made strict by setting it to `false`:
+        # See: https://docs.ceph.com/en/latest/security/CVE-2021-20288/#recommendations
+        # As of writing, this setting is not documented outside of the CVE note :(
+        #
+        # While for new clusters the warning no longer seems to appear, it still
+        # appears in our existing clusters unless this option is set, see:
+        # https://tracker.ceph.com/issues/53751#note-7
+        auth_allow_insecure_global_id_reclaim = false
 
-          # Disable dirfrag prefetch on MDS restart to prevent out-of-memory after
-          # many files were opened.
-          # Note this option has no effect on Ceph < 15, because it doesn't exist there.
-          # TODO: Remove this once we're on a Ceph version that includes this default,
-          #       see https://github.com/ceph/ceph/pull/44667.
-          #       This is assuming that the commit fixes existing clusters, see
-          #       https://github.com/ceph/ceph/pull/44667#issuecomment-1036103397
-          #       If it doesn't this can only be removed once we have no existing
-          #       cluster with the old default.
-          mds_oft_prefetch_dirfrags = false
+        # Disable dirfrag prefetch on MDS restart to prevent out-of-memory after
+        # many files were opened.
+        # Note this option has no effect on Ceph < 15, because it doesn't exist there.
+        # TODO: Remove this once we're on a Ceph version that includes this default,
+        #       see https://github.com/ceph/ceph/pull/44667.
+        #       This is assuming that the commit fixes existing clusters, see
+        #       https://github.com/ceph/ceph/pull/44667#issuecomment-1036103397
+        #       If it doesn't this can only be removed once we have no existing
+        #       cluster with the old default.
+        mds_oft_prefetch_dirfrags = false
 
-          # Disable sleep between HDD recovery operations, otherwise recovery
-          # will take forever when small objects (e.g. CephFS files) are on HDD.
-          # See https://tracker.ceph.com/issues/23595#note-12
-          osd_recovery_sleep_hdd = 0.0
+        # Disable sleep between HDD recovery operations, otherwise recovery
+        # will take forever when small objects (e.g. CephFS files) are on HDD.
+        # See https://tracker.ceph.com/issues/23595#note-12
+        osd_recovery_sleep_hdd = 0.0
 
-          # Increase scrub intervals by 4x.
-          # Since we store many small files on HDD, and scrubbing apparently
-          # iterates over all objects
-          # we have no chance to scrub at the default intervals.
-          #
-          # (This was written when we had 400M files across 30 HDDs.)
-          # Change this back once we have reduced our number of files per disk.
-          osd_scrub_min_interval = 345600
-          osd_scrub_max_interval = 2419200
-          osd_deep_scrub_interval = 2419200
+        # Increase scrub intervals by 4x.
+        # Since we store many small files on HDD, and scrubbing apparently
+        # iterates over all objects
+        # we have no chance to scrub at the default intervals.
+        #
+        # (This was written when we had 400M files across 30 HDDs.)
+        # Change this back once we have reduced our number of files per disk.
+        osd_scrub_min_interval = 345600
+        osd_scrub_max_interval = 2419200
+        osd_deep_scrub_interval = 2419200
 
-          public_network = ${commaSep cfg.publicNetworks}
-          cluster_network = ${commaSep cfg.clusterNetworks}
-          auth_cluster_required = cephx
-          auth_service_required = cephx
-          auth_client_required = cephx
+        public_network = ${commaSep cfg.publicNetworks}
+        cluster_network = ${commaSep cfg.clusterNetworks}
+        auth_cluster_required = cephx
+        auth_service_required = cephx
+        auth_client_required = cephx
 
-          # Enforce on-wire transport encryption.
-          ms_cluster_mode = secure
-          ms_service_mode = secure
-          ms_client_mode = secure
+        # Enforce on-wire transport encryption.
+        ms_cluster_mode = secure
+        ms_service_mode = secure
+        ms_client_mode = secure
 
-          ${cfg.extraConfig}
-        '';
+        ${cfg.extraConfig}
+      '';
 
       environment.etc."ceph/${cfg.clusterName}.client.admin.keyring" = {
         source = cfg.adminKeyring;
@@ -649,215 +675,255 @@ in
       };
 
       # Allow ceph daemons (which run as user ceph) to collect device health metrics.
-      security.sudo.extraRules =
-        map ({ sudoersExtraRule, ... }: sudoersExtraRule) cephMonitoringSudoersCommandsAndPackages;
+      security.sudo.extraRules = map (
+        { sudoersExtraRule, ... }: sudoersExtraRule
+      ) cephMonitoringSudoersCommandsAndPackages;
 
       # The udevadm trigger/settle in `makeCephOsdSetupSystemdService` waits for these rules rule to be applied.
-      services.udev.extraRules =
-        lib.concatStringsSep "\n" (
-          lib.mapAttrsToList
-            (_localOsdServiceName: osdConfig:
-              ''
-                SUBSYSTEM=="block", ${osdConfig.blockDeviceUdevRuleMatcher}, OWNER="${config.users.users.ceph.name}", GROUP="${config.users.groups.ceph.name}", MODE="0660"
-              ''
-              + lib.optionalString (osdConfig.dbBlockDeviceUdevRuleMatcher != null) (
-                ''
-                  SUBSYSTEM=="block", ${osdConfig.dbBlockDeviceUdevRuleMatcher}, OWNER="${config.users.users.ceph.name}", GROUP="${config.users.groups.ceph.name}", MODE="0660"
-                ''
-              )
-            )
-            cfg.osds
-        );
+      services.udev.extraRules = lib.concatStringsSep "\n" (
+        lib.mapAttrsToList (
+          _localOsdServiceName: osdConfig:
+          ''
+            SUBSYSTEM=="block", ${osdConfig.blockDeviceUdevRuleMatcher}, OWNER="${config.users.users.ceph.name}", GROUP="${config.users.groups.ceph.name}", MODE="0660"
+          ''
+          + lib.optionalString (osdConfig.dbBlockDeviceUdevRuleMatcher != null) (''
+            SUBSYSTEM=="block", ${osdConfig.dbBlockDeviceUdevRuleMatcher}, OWNER="${config.users.users.ceph.name}", GROUP="${config.users.groups.ceph.name}", MODE="0660"
+          '')
+        ) cfg.osds
+      );
 
-      systemd.services = {
+      systemd.services =
+        {
 
-        ceph-mon-setup = mkIf cfg.monitor.enable {
-          description = "Initialize ceph monitor";
+          ceph-mon-setup = mkIf cfg.monitor.enable {
+            description = "Initialize ceph monitor";
 
-          preStart = ensureCephDirs;
+            preStart = ensureCephDirs;
 
-          script =
-            let
-              # `--addv` seems currently required to get msgr-v2 working, see:
-              #     https://tracker.ceph.com/issues/53751#note-11
-              monmapNodes = builtins.concatStringsSep " " (lib.concatMap (mon: [ "--addv" mon.hostname "[v2:${mon.ipAddress}:3300,v1:${mon.ipAddress}:6789]" ]) cfg.initialMonitors);
+            script =
+              let
+                # `--addv` seems currently required to get msgr-v2 working, see:
+                #     https://tracker.ceph.com/issues/53751#note-11
+                monmapNodes = builtins.concatStringsSep " " (
+                  lib.concatMap (mon: [
+                    "--addv"
+                    mon.hostname
+                    "[v2:${mon.ipAddress}:3300,v1:${mon.ipAddress}:6789]"
+                  ]) cfg.initialMonitors
+                );
+              in
               # Monitors cannot simply be changed in config, one has to update the monmap, see note [replacing-ceph-monmap-ips-for-existing-cluster]
-            in
-            ''
+              ''
+                set -euo pipefail
+                rm -rf "${monDir}" # Start from scratch.
+                echo "Initializing monitor."
+                MONMAP_DIR=`mktemp -d`
+                ${cfg.package}/bin/monmaptool --create ${monmapNodes} --fsid ${cfg.fsid} "$MONMAP_DIR/monmap"
+                ${cfg.package}/bin/ceph-mon --cluster ${cfg.clusterName} --mkfs -i ${cfg.monitor.nodeName} --monmap "$MONMAP_DIR/monmap" --keyring ${cfg.monitor.initialKeyring}
+                rm -r "$MONMAP_DIR"
+                touch ${monDir}/done
+              '';
+
+            serviceConfig = {
+              Type = "oneshot";
+              RemainAfterExit = true;
+              PermissionsStartOnly = true; # only run the script as ceph
+              User = config.users.users.ceph.name;
+              Group = config.users.groups.ceph.name;
+            };
+            unitConfig = {
+              ConditionPathExists = "!${monDir}/done";
+            };
+          };
+
+          ceph-mon = mkIf cfg.monitor.enable {
+            description = "Ceph monitor";
+
+            requires = [ (ensureUnitExists config "ceph-mon-setup.service") ];
+            requiredBy = [ "multi-user.target" ];
+            after = [
+              "network.target"
+              "local-fs.target"
+              "time-sync.target"
+              (ensureUnitExists config "ceph-mon-setup.service")
+            ];
+            wants = [
+              "network.target"
+              "local-fs.target"
+              "time-sync.target"
+            ];
+
+            restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ];
+
+            path = cephDeviceHealthMonitoringPathsOrPackages;
+
+            preStart = ensureTransientCephDirs;
+
+            serviceConfig = {
+              LimitNOFILE = "1048576";
+              LimitNPROC = "1048576";
+              ExecStart = ''
+                ${cfg.package}/bin/ceph-mon -f --cluster ${cfg.clusterName} --id ${cfg.monitor.nodeName} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} "--public_bind_addr=${cfg.monitor.bindAddr}" "--public_addr=${cfg.monitor.advertisedPublicAddr}"
+              '';
+              ExecReload = ''
+                ${pkgs.coreutils}/bin/kill -HUP $MAINPID
+              '';
+              PrivateDevices = "yes";
+              ProtectHome = "true";
+              ProtectSystem = "full";
+              PrivateTmp = "true";
+              TasksMax = "infinity";
+              Restart = "on-failure";
+              # StartLimitBurst="5";
+              RestartSec = "10";
+            };
+            # startLimitIntervalSec = 30 * 60;
+          };
+
+          ceph-mgr-setup = mkIf cfg.manager.enable {
+            description = "Initialize Ceph manager";
+
+            preStart = ensureCephDirs;
+
+            script = ''
               set -euo pipefail
-              rm -rf "${monDir}" # Start from scratch.
-              echo "Initializing monitor."
-              MONMAP_DIR=`mktemp -d`
-              ${cfg.package}/bin/monmaptool --create ${monmapNodes} --fsid ${cfg.fsid} "$MONMAP_DIR/monmap"
-              ${cfg.package}/bin/ceph-mon --cluster ${cfg.clusterName} --mkfs -i ${cfg.monitor.nodeName} --monmap "$MONMAP_DIR/monmap" --keyring ${cfg.monitor.initialKeyring}
-              rm -r "$MONMAP_DIR"
-              touch ${monDir}/done
+              mkdir -p ${mgrDir}
+              until [ -f /etc/ceph/${cfg.clusterName}.client.admin.keyring ]
+              do
+                sleep 1
+              done
+              ${cfg.package}/bin/ceph auth get-or-create mgr.${cfg.manager.nodeName} mon 'allow profile mgr' mds 'allow *' osd 'allow *' -o ${mgrDir}/keyring
+              touch "${mgrDir}/.nix_done"
             '';
 
-          serviceConfig = {
-            Type = "oneshot";
-            RemainAfterExit = true;
-            PermissionsStartOnly = true; # only run the script as ceph
-            User = config.users.users.ceph.name;
-            Group = config.users.groups.ceph.name;
+            serviceConfig = {
+              Type = "oneshot";
+              RemainAfterExit = true;
+              PermissionsStartOnly = true; # only run the script as ceph
+              User = config.users.users.ceph.name;
+              Group = config.users.groups.ceph.name;
+            };
+            unitConfig = {
+              ConditionPathExists = "!${mgrDir}/.nix_done";
+            };
           };
-          unitConfig = {
-            ConditionPathExists = "!${monDir}/done";
+
+          ceph-mgr = mkIf cfg.manager.enable {
+            description = "Ceph manager";
+
+            requires = [ (ensureUnitExists config "ceph-mgr-setup.service") ];
+            requiredBy = [ "multi-user.target" ];
+            after = [
+              "network.target"
+              "local-fs.target"
+              "time-sync.target"
+              (ensureUnitExists config "ceph-mgr-setup.service")
+            ];
+            wants = [
+              "network.target"
+              "local-fs.target"
+              "time-sync.target"
+            ];
+
+            restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ];
+
+            preStart = ensureTransientCephDirs;
+
+            serviceConfig = {
+              LimitNOFILE = "1048576";
+              LimitNPROC = "1048576";
+
+              ExecStart = ''
+                ${cfg.package}/bin/ceph-mgr -f --cluster ${cfg.clusterName} --id ${cfg.manager.nodeName} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name}
+              '';
+              ExecReload = ''
+                ${pkgs.coreutils}/bin/kill -HUP $MAINPID
+              '';
+              Restart = "on-failure";
+              RestartSec = 10;
+              # StartLimitBurst="3";
+            };
+            # startLimitIntervalSec = 30 * 60;
           };
-        };
 
-        ceph-mon = mkIf cfg.monitor.enable {
-          description = "Ceph monitor";
+          ceph-mds-setup = mkIf cfg.mds.enable {
+            description = "Initialize Ceph MDS";
 
-          requires = [ (ensureUnitExists config "ceph-mon-setup.service") ];
-          requiredBy = [ "multi-user.target" ];
-          after = [ "network.target" "local-fs.target" "time-sync.target" (ensureUnitExists config "ceph-mon-setup.service") ];
-          wants = [ "network.target" "local-fs.target" "time-sync.target" ];
+            preStart = ensureCephDirs;
 
-          restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ];
-
-          path = cephDeviceHealthMonitoringPathsOrPackages;
-
-          preStart = ensureTransientCephDirs;
-
-          serviceConfig = {
-            LimitNOFILE = "1048576";
-            LimitNPROC = "1048576";
-            ExecStart = ''
-              ${cfg.package}/bin/ceph-mon -f --cluster ${cfg.clusterName} --id ${cfg.monitor.nodeName} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} "--public_bind_addr=${cfg.monitor.bindAddr}" "--public_addr=${cfg.monitor.advertisedPublicAddr}"
+            script = ''
+              set -euo pipefail
+              mkdir -p ${mdsDir}
+              until [ -f /etc/ceph/${cfg.clusterName}.client.admin.keyring ]
+              do
+                sleep 1
+              done
+              ${cfg.package}/bin/ceph auth get-or-create mds.${cfg.mds.nodeName} osd 'allow rwx' mds 'allow' mon 'allow profile mds' -o ${mdsDir}/keyring
+              touch "${mdsDir}/.nix_done"
             '';
-            ExecReload = ''
-              ${pkgs.coreutils}/bin/kill -HUP $MAINPID
-            '';
-            PrivateDevices = "yes";
-            ProtectHome = "true";
-            ProtectSystem = "full";
-            PrivateTmp = "true";
-            TasksMax = "infinity";
-            Restart = "on-failure";
-            # StartLimitBurst="5";
-            RestartSec = "10";
+
+            serviceConfig = {
+              Type = "oneshot";
+              RemainAfterExit = true;
+              PermissionsStartOnly = true; # only run the script as ceph
+              User = config.users.users.ceph.name;
+              Group = config.users.groups.ceph.name;
+            };
+            unitConfig = {
+              ConditionPathExists = "!${mdsDir}/.nix_done";
+            };
           };
-          # startLimitIntervalSec = 30 * 60;
-        };
 
-        ceph-mgr-setup = mkIf cfg.manager.enable {
-          description = "Initialize Ceph manager";
+          ceph-mds = mkIf cfg.mds.enable {
+            description = "Ceph MDS";
 
-          preStart = ensureCephDirs;
+            requires = [ (ensureUnitExists config "ceph-mds-setup.service") ];
+            requiredBy = [ "multi-user.target" ];
+            after = [
+              "network.target"
+              "local-fs.target"
+              "time-sync.target"
+              (ensureUnitExists config "ceph-mds-setup.service")
+            ];
+            wants = [
+              "network.target"
+              "local-fs.target"
+              "time-sync.target"
+            ];
 
-          script = ''
-            set -euo pipefail
-            mkdir -p ${mgrDir}
-            until [ -f /etc/ceph/${cfg.clusterName}.client.admin.keyring ]
-            do
-              sleep 1
-            done
-            ${cfg.package}/bin/ceph auth get-or-create mgr.${cfg.manager.nodeName} mon 'allow profile mgr' mds 'allow *' osd 'allow *' -o ${mgrDir}/keyring
-            touch "${mgrDir}/.nix_done"
-          '';
+            restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ];
 
-          serviceConfig = {
-            Type = "oneshot";
-            RemainAfterExit = true;
-            PermissionsStartOnly = true; # only run the script as ceph
-            User = config.users.users.ceph.name;
-            Group = config.users.groups.ceph.name;
+            preStart = ensureTransientCephDirs;
+
+            serviceConfig = {
+              LimitNOFILE = "1048576";
+              LimitNPROC = "1048576";
+
+              ExecStart = ''
+                ${cfg.package}/bin/ceph-mds -f --cluster ${cfg.clusterName} --id ${cfg.mds.nodeName} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} "--public_addr=${cfg.mds.listenAddr}"
+              '';
+              ExecReload = ''
+                ${pkgs.coreutils}/bin/kill -HUP $MAINPID
+              '';
+              Restart = "on-failure";
+              # StartLimitBurst="3";
+            };
+            # startLimitIntervalSec = 30 * 60;
           };
-          unitConfig = {
-            ConditionPathExists = "!${mgrDir}/.nix_done";
-          };
-        };
 
-        ceph-mgr = mkIf cfg.manager.enable {
-          description = "Ceph manager";
-
-          requires = [ (ensureUnitExists config "ceph-mgr-setup.service") ];
-          requiredBy = [ "multi-user.target" ];
-          after = [ "network.target" "local-fs.target" "time-sync.target" (ensureUnitExists config "ceph-mgr-setup.service") ];
-          wants = [ "network.target" "local-fs.target" "time-sync.target" ];
-
-          restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ];
-
-          preStart = ensureTransientCephDirs;
-
-          serviceConfig = {
-            LimitNOFILE = "1048576";
-            LimitNPROC = "1048576";
-
-            ExecStart = ''
-              ${cfg.package}/bin/ceph-mgr -f --cluster ${cfg.clusterName} --id ${cfg.manager.nodeName} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name}
-            '';
-            ExecReload = ''
-              ${pkgs.coreutils}/bin/kill -HUP $MAINPID
-            '';
-            Restart = "on-failure";
-            RestartSec = 10;
-            # StartLimitBurst="3";
-          };
-          # startLimitIntervalSec = 30 * 60;
-        };
-
-        ceph-mds-setup = mkIf cfg.mds.enable {
-          description = "Initialize Ceph MDS";
-
-          preStart = ensureCephDirs;
-
-          script = ''
-            set -euo pipefail
-            mkdir -p ${mdsDir}
-            until [ -f /etc/ceph/${cfg.clusterName}.client.admin.keyring ]
-            do
-              sleep 1
-            done
-            ${cfg.package}/bin/ceph auth get-or-create mds.${cfg.mds.nodeName} osd 'allow rwx' mds 'allow' mon 'allow profile mds' -o ${mdsDir}/keyring
-            touch "${mdsDir}/.nix_done"
-          '';
-
-          serviceConfig = {
-            Type = "oneshot";
-            RemainAfterExit = true;
-            PermissionsStartOnly = true; # only run the script as ceph
-            User = config.users.users.ceph.name;
-            Group = config.users.groups.ceph.name;
-          };
-          unitConfig = {
-            ConditionPathExists = "!${mdsDir}/.nix_done";
-          };
-        };
-
-        ceph-mds = mkIf cfg.mds.enable {
-          description = "Ceph MDS";
-
-          requires = [ (ensureUnitExists config "ceph-mds-setup.service") ];
-          requiredBy = [ "multi-user.target" ];
-          after = [ "network.target" "local-fs.target" "time-sync.target" (ensureUnitExists config "ceph-mds-setup.service") ];
-          wants = [ "network.target" "local-fs.target" "time-sync.target" ];
-
-          restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ];
-
-          preStart = ensureTransientCephDirs;
-
-          serviceConfig = {
-            LimitNOFILE = "1048576";
-            LimitNPROC = "1048576";
-
-            ExecStart = ''
-              ${cfg.package}/bin/ceph-mds -f --cluster ${cfg.clusterName} --id ${cfg.mds.nodeName} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} "--public_addr=${cfg.mds.listenAddr}"
-            '';
-            ExecReload = ''
-              ${pkgs.coreutils}/bin/kill -HUP $MAINPID
-            '';
-            Restart = "on-failure";
-            # StartLimitBurst="3";
-          };
-          # startLimitIntervalSec = 30 * 60;
-        };
-
-      }
-      # Make one OSD service for each configured OSD.
-      // lib.mapAttrs' (localOsdServiceName: osdConfig: nameValuePair "ceph-osd-setup-${localOsdServiceName}" (makeCephOsdSetupSystemdService localOsdServiceName osdConfig)) cfg.osds
-      // lib.mapAttrs' (localOsdServiceName: osdConfig: nameValuePair "ceph-osd-${localOsdServiceName}" (makeCephOsdSystemdService localOsdServiceName osdConfig)) cfg.osds;
+        }
+        # Make one OSD service for each configured OSD.
+        // lib.mapAttrs' (
+          localOsdServiceName: osdConfig:
+          nameValuePair "ceph-osd-setup-${localOsdServiceName}" (
+            makeCephOsdSetupSystemdService localOsdServiceName osdConfig
+          )
+        ) cfg.osds
+        // lib.mapAttrs' (
+          localOsdServiceName: osdConfig:
+          nameValuePair "ceph-osd-${localOsdServiceName}" (
+            makeCephOsdSystemdService localOsdServiceName osdConfig
+          )
+        ) cfg.osds;
     };
 }
-
diff --git a/modules/nixos/db.nix b/modules/nixos/db.nix
index 4142226..ed7c835 100644
--- a/modules/nixos/db.nix
+++ b/modules/nixos/db.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.greg.databases;
@@ -7,12 +12,17 @@ in
 {
   options.greg.databases = lib.mkOption {
     default = { };
-    type = with lib.types; attrsOf (submodule (
-      { ... }: {
-        # Options reserved for future expansion
-        options = { };
-      }
-    ));
+    type =
+      with lib.types;
+      attrsOf (
+        submodule (
+          { ... }:
+          {
+            # Options reserved for future expansion
+            options = { };
+          }
+        )
+      );
   };
 
   config = lib.mkIf (dbs != [ ]) {
@@ -22,7 +32,10 @@ in
         package = pkgs.postgresql_15;
         checkConfig = true;
         ensureDatabases = dbs;
-        ensureUsers = map (db: { name = db; ensureDBOwnership = true; }) dbs;
+        ensureUsers = map (db: {
+          name = db;
+          ensureDBOwnership = true;
+        }) dbs;
         settings = {
           log_connections = true;
           log_statement = "all";
diff --git a/modules/nixos/gnome.nix b/modules/nixos/gnome.nix
index 1b4a385..5026e84 100644
--- a/modules/nixos/gnome.nix
+++ b/modules/nixos/gnome.nix
@@ -1,10 +1,16 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 let
   cfg = config.greg.gnome;
 
 in
-with lib; {
+with lib;
+{
   options = {
     greg.gnome.enable = mkEnableOption "Enable my default Gnome3 setup";
   };
@@ -24,9 +30,7 @@ with lib; {
         xkb.layout = "us";
       };
 
-      udev.packages = with pkgs; [
-        gnome-settings-daemon
-      ];
+      udev.packages = with pkgs; [ gnome-settings-daemon ];
 
       pipewire.enable = true;
 
diff --git a/modules/nixos/kde.nix b/modules/nixos/kde.nix
index 9b08a21..2187821 100644
--- a/modules/nixos/kde.nix
+++ b/modules/nixos/kde.nix
@@ -1,37 +1,46 @@
-{ config, pkgs, lib, options, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  options,
+  ...
+}:
 
 let
   cfg = config.greg.kde;
 
 in
-with lib; {
+with lib;
+{
   options = {
     greg.kde.enable = mkEnableOption "Enable my default KDE setup";
   };
 
   config = mkIf cfg.enable {
     # Sets up a basic KDE installation
-    services = {
-      xserver = {
-        enable = true;
-        xkb.layout = "us";
-        # Trackpad support
-        libinput.enable = true;
-      };
+    services =
+      {
+        xserver = {
+          enable = true;
+          xkb.layout = "us";
+          # Trackpad support
+          libinput.enable = true;
+        };
 
-      pipewire = {
-        enable = true;
-        alsa.enable = true;
-        alsa.support32Bit = true;
-        pulse.enable = true;
-      };
-    } // (optionalAttrs (builtins.hasAttr "plasma6" options.services.xserver.desktopManager) {
-      desktopManager.plasma6.enable = true;
-      displayManager = {
-        defaultSession = "plasma";
-        sddm.enable = true;
-      };
-    });
+        pipewire = {
+          enable = true;
+          alsa.enable = true;
+          alsa.support32Bit = true;
+          pulse.enable = true;
+        };
+      }
+      // (optionalAttrs (builtins.hasAttr "plasma6" options.services.xserver.desktopManager) {
+        desktopManager.plasma6.enable = true;
+        displayManager = {
+          defaultSession = "plasma";
+          sddm.enable = true;
+        };
+      });
 
     programs.dconf.enable = true;
     programs.sway.enable = true; # Gives us Wayland
diff --git a/modules/nixos/kiwix-serve.nix b/modules/nixos/kiwix-serve.nix
index 3565dd5..793b8b7 100644
--- a/modules/nixos/kiwix-serve.nix
+++ b/modules/nixos/kiwix-serve.nix
@@ -1,9 +1,15 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 let
   cfg = config.services.kiwix-serve;
 in
-with lib; {
+with lib;
+{
   options.services.kiwix-serve = {
     enable = mkEnableOption "Enable the Kiwix web server";
 
@@ -22,16 +28,15 @@ with lib; {
     proxy = mkOption {
       type = types.str;
       default = "";
-      description = ''Upstream proxy, if any, to configure with kiwix. Specify
-				host and port. E.g. "localhost:8080"
-			'';
+      description = ''
+        Upstream proxy, if any, to configure with kiwix. Specify
+        				host and port. E.g. "localhost:8080"
+        			'';
     };
   };
 
   config = mkIf cfg.enable {
-    environment.systemPackages = [
-      pkgs.kiwix-tools
-    ];
+    environment.systemPackages = [ pkgs.kiwix-tools ];
 
     systemd.services.kiwix-serve = {
       enable = true;
diff --git a/modules/nixos/linode.nix b/modules/nixos/linode.nix
index f474ab2..cfb0500 100644
--- a/modules/nixos/linode.nix
+++ b/modules/nixos/linode.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.greg.linode;
diff --git a/modules/nixos/print.nix b/modules/nixos/print.nix
index 985e499..1eeb99b 100644
--- a/modules/nixos/print.nix
+++ b/modules/nixos/print.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.greg.print;
@@ -16,19 +21,19 @@ with lib;
     # ipp://printer.thehellings.lan:631/ - generic postscript printer
     services.printing = {
       enable = true;
-      drivers = with pkgs; [
-        gutenprint
-      ] ++ (lib.optional pkgs.stdenv.isx86_64 gutenprintBin);
+      drivers = with pkgs; [ gutenprint ] ++ (lib.optional pkgs.stdenv.isx86_64 gutenprintBin);
     };
 
-    hardware.printers.ensurePrinters = [{
-      name = "HomeLexmarkColorPrinter";
-      location = "Home office";
-      deviceUri = "ipp://printer.thehellings.lan:631/";
-      model = "drv:///sample.drv/generic.ppd";
-      ppdOptions = {
-        PageSize = "Letter";
-      };
-    }];
+    hardware.printers.ensurePrinters = [
+      {
+        name = "HomeLexmarkColorPrinter";
+        location = "Home office";
+        deviceUri = "ipp://printer.thehellings.lan:631/";
+        model = "drv:///sample.drv/generic.ppd";
+        ppdOptions = {
+          PageSize = "Letter";
+        };
+      }
+    ];
   };
 }
diff --git a/modules/nixos/proxy.nix b/modules/nixos/proxy.nix
index 9aea945..fa2fc8f 100644
--- a/modules/nixos/proxy.nix
+++ b/modules/nixos/proxy.nix
@@ -10,69 +10,76 @@ let
     enableACME = dest.ssl;
     locations."${dest.path}" = {
       proxyPass = dest.target;
-      extraConfig = ''
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection $connection_upgrade;
-      '' + dest.extraConfig;
+      extraConfig =
+        ''
+          proxy_http_version 1.1;
+          proxy_set_header Upgrade $http_upgrade;
+          proxy_set_header Connection $connection_upgrade;
+        ''
+        + dest.extraConfig;
     };
     serverAliases = lib.mkIf dest.genAliases [ "${alias name}" ];
   };
 
 in
-with lib; {
+with lib;
+{
   options = {
     greg.proxies = mkOption {
       default = { };
       example = literalExpression ''
-        				{ host-name = {
-        					target = proxyLocation;
-        					ssl = true;
-        				};
-        			'';
+        { host-name = {
+        	target = proxyLocation;
+        	ssl = true;
+        };
+      '';
       description = ''
-        				Quick and simple Nginx proxy configurations.
-        				Use this to configure a very simple proxy that does not
-        				need any extra customization options other than SSL
-        				enablement.
-        			'';
+        Quick and simple Nginx proxy configurations.
+        Use this to configure a very simple proxy that does not
+        need any extra customization options other than SSL
+        enablement.
+      '';
 
-      type = with types; attrsOf (submodule (
-        { ... }:
-        {
-          options = {
-            genAliases = mkOption {
-              type = types.bool;
-              description = "Whether to auto-generate short alias name";
-              default = true;
-            };
+      type =
+        with types;
+        attrsOf (
+          submodule (
+            { ... }:
+            {
+              options = {
+                genAliases = mkOption {
+                  type = types.bool;
+                  description = "Whether to auto-generate short alias name";
+                  default = true;
+                };
 
-            target = mkOption {
-              type = types.str;
-              description = ''The destination that is being proxied.'';
-              example = "http://localhost:8080";
-            };
+                target = mkOption {
+                  type = types.str;
+                  description = ''The destination that is being proxied.'';
+                  example = "http://localhost:8080";
+                };
 
-            ssl = mkOption {
-              type = types.bool;
-              description = "Whether to enable SSL in front of the proxy";
-              default = false;
-            };
+                ssl = mkOption {
+                  type = types.bool;
+                  description = "Whether to enable SSL in front of the proxy";
+                  default = false;
+                };
 
-            path = mkOption {
-              type = types.str;
-              description = "The path prefix for this proxy";
-              default = "/";
-            };
+                path = mkOption {
+                  type = types.str;
+                  description = "The path prefix for this proxy";
+                  default = "/";
+                };
 
-            extraConfig = mkOption {
-              type = types.str;
-              description = "Extra nginx config options";
-              default = "";
-            };
-          };
-        }
-      ));
+                extraConfig = mkOption {
+                  type = types.str;
+                  description = "Extra nginx config options";
+                  default = "";
+                };
+              };
+            }
+          )
+        );
     };
   };
 
diff --git a/modules/nixos/router.nix b/modules/nixos/router.nix
index 15a2f36..79d5c6b 100644
--- a/modules/nixos/router.nix
+++ b/modules/nixos/router.nix
@@ -1,22 +1,39 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   names = mylist: (lib.strings.concatMapStringsSep "," (x: ''"${x}"'') mylist);
   # Pass the names of the wan/lan ports
   nftConfig =
-    { wan
-    , lan
-    , limitedLan ? [ ]
-    , openPorts ? [ "ssh" "67" "53" ]
-    , # ssh, dhcpd, dns
-      openUDPPorts ? [ "67" "53" ] # dhcpd, dns
+    {
+      wan,
+      lan,
+      limitedLan ? [ ],
+      openPorts ? [
+        "ssh"
+        "67"
+        "53"
+      ],
+      # ssh, dhcpd, dns
+      openUDPPorts ? [
+        "67"
+        "53"
+      ], # dhcpd, dns
     }:
     let
       lanList = names lan;
       allLan = names (lan ++ limitedLan);
       wanName = names wan;
-      portsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${toString x} accept") openPorts;
-      udpPortsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept") openUDPPorts;
+      portsString = lib.strings.concatMapStringsSep "\n" (
+        x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${toString x} accept"
+      ) openPorts;
+      udpPortsString = lib.strings.concatMapStringsSep "\n" (
+        x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept"
+      ) openUDPPorts;
     in
     lib.strings.concatStringsSep "\n" [
       "table ip filter {"
@@ -61,7 +78,8 @@ let
   cfg = config.greg.router;
 
 in
-with lib; {
+with lib;
+{
   options.greg.router = {
     enable = mkEnableOption "Enable NFTables and routing";
     wan = mkOption {
@@ -82,11 +100,13 @@ with lib; {
   config = mkIf cfg.enable {
     networking.nftables = {
       enable = true;
-      ruleset = (nftConfig {
-        inherit (cfg) lan wan;
-        openPorts = config.networking.firewall.allowedTCPPorts;
-        openUDPPorts = config.networking.firewall.allowedUDPPorts;
-      });
+      ruleset = (
+        nftConfig {
+          inherit (cfg) lan wan;
+          openPorts = config.networking.firewall.allowedTCPPorts;
+          openUDPPorts = config.networking.firewall.allowedUDPPorts;
+        }
+      );
     };
 
     environment.systemPackages = [
diff --git a/modules/nixos/rpi4.nix b/modules/nixos/rpi4.nix
index 0de4593..832f0c2 100644
--- a/modules/nixos/rpi4.nix
+++ b/modules/nixos/rpi4.nix
@@ -1,10 +1,16 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.greg.rpi4;
 
 in
-with lib; {
+with lib;
+{
   options = {
     greg.rpi4 = {
       enable = mkEnableOption "Enable support for Raspberry Pi 4s";
diff --git a/modules/nixos/sway.nix b/modules/nixos/sway.nix
index bb26ab2..6ab8e5d 100644
--- a/modules/nixos/sway.nix
+++ b/modules/nixos/sway.nix
@@ -4,7 +4,8 @@ let
   cfg = config.greg.sway;
 
 in
-with lib; {
+with lib;
+{
   options = {
     greg.sway.enable = mkEnableOption "Enable my default Gnome3 setup";
   };
diff --git a/modules/nixos/syncthing.nix b/modules/nixos/syncthing.nix
index 79fd0dc..25f390d 100644
--- a/modules/nixos/syncthing.nix
+++ b/modules/nixos/syncthing.nix
@@ -3,7 +3,8 @@
 let
   cfg = config.greg.syncthing;
 in
-with lib; {
+with lib;
+{
   options.greg.syncthing = {
     enable = mkEnableOption "Setup my personal minimal configuration for Syncthing";
   };
diff --git a/modules/nixos/vmdev.nix b/modules/nixos/vmdev.nix
index 49af6c5..d2dfa78 100644
--- a/modules/nixos/vmdev.nix
+++ b/modules/nixos/vmdev.nix
@@ -1,4 +1,9 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 
 let
   cfg = config.greg.vmdev;
diff --git a/overlays/pipenv.nix b/overlays/pipenv.nix
index a821848..ea06e4c 100644
--- a/overlays/pipenv.nix
+++ b/overlays/pipenv.nix
@@ -1,24 +1,26 @@
-{ lib
-, stdenv
-, python3
-, fetchFromGitHub
-, installShellFiles
+{
+  lib,
+  stdenv,
+  python3,
+  fetchFromGitHub,
+  installShellFiles,
 }:
 
 with python3.pkgs;
 
 let
 
-  runtimeDeps = ps: with ps; [
-    certifi
-    setuptools
-    pip
-    virtualenv
-    virtualenv-clone
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isAndroid [
-    pyjnius
-  ];
+  runtimeDeps =
+    ps:
+    with ps;
+    [
+      certifi
+      setuptools
+      pip
+      virtualenv
+      virtualenv-clone
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isAndroid [ pyjnius ];
 
   pythonEnv = python3.withPackages runtimeDeps;
 
@@ -71,9 +73,7 @@ buildPythonApplication rec {
     "test_download_file"
   ];
 
-  disabledTestPaths = [
-    "tests/integration"
-  ];
+  disabledTestPaths = [ "tests/integration" ];
 
   postInstall = ''
     installShellCompletion --cmd pipenv \
diff --git a/overlays/xonsh-apipenv.nix b/overlays/xonsh-apipenv.nix
index a05c48f..97ad9e9 100644
--- a/overlays/xonsh-apipenv.nix
+++ b/overlays/xonsh-apipenv.nix
@@ -1,9 +1,9 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, toPythonModule
-, pipenv
-,
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  toPythonModule,
+  pipenv,
 }:
 
 buildPythonPackage rec {
@@ -19,9 +19,7 @@ buildPythonPackage rec {
 
   doCheck = false;
 
-  dependencies = [
-    (toPythonModule pipenv)
-  ];
+  dependencies = [ (toPythonModule pipenv) ];
 
   meta = with lib; {
     description = "Auto pipenv support for Xonsh";
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index ffa4907..017ad48 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -5,7 +5,14 @@ let
   genesis = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEI9jbTPmEWQ0F2bLYmnIOLmBnag1fkKxHRjz3X8lB/k root@genesis";
   hosea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLIwkTTXA56sUlUjEulXXZRvZy5H4a5ZwgKWLlpkQDz";
   jeremiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0";
-  systems = [ genesis linode jude myself hosea jeremiah ];
+  systems = [
+    genesis
+    linode
+    jude
+    myself
+    hosea
+    jeremiah
+  ];
 
   user_genesis_virt = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFWPSFQT0AH77wrwRhiskcBS0w4ZakBRdJywYYBsnm3S greg@genesis";
   user_ivr = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMYzms+KIe5/bYF3uCyFjA5e1AgMPLIA3c4k417coqBe gregory.hellings@ls23003";
@@ -44,7 +51,6 @@ in
   "restic-env.age".publicKeys = everyone;
   "restic-pw.age".publicKeys = everyone;
 
-
   "dendrite.age".publicKeys = everyone;
   "dendrite_key.age".publicKeys = everyone;
   "gitlab/secret.age".publicKeys = everyone;