tree-wide: reformat using alejandra after enabling trivionomicon

author: Alejandro Soto <alejandro@34project.org> 2025-08-24 18:55:06 -0600
committer: Alejandro Soto <alejandro@34project.org> 2025-08-24 18:55:06 -0600
commit: d7ac88762db111a7962c4e14b5f4e37ab85ccac7 (patch)
tree: 0c2c8c4383bef74215e3b7c48a2f6b0117f084bc
parent: 504589d1035f27b766bd33040b415b2725ece4ca (diff)
130 files changed, 3210 insertions, 2665 deletions
diff --git a/flake.nix b/flake.nix
index 4f9c5b0..3c17abc 100644
--- a/flake.nix
+++ b/flake.nix
@@ -39,21 +39,22 @@
     vpsadminos.url = "github:vpsfreecz/vpsadminos";
   };
 
-  outputs = flakes: flakes.trivionomicon.lib.mkSystemFlake {
-    inherit flakes;
+  outputs = flakes:
+    flakes.trivionomicon.lib.mkSystemFlake {
+      inherit flakes;
 
-    system = "x86_64-linux";
-    doctrinePrefix = "local";
+      system = "x86_64-linux";
+      doctrinePrefix = "local";
 
-    paths = {
-      localOverlay = "pkgs";
-      nixpkgsConfig = "pkgs/config";
+      paths = {
+        localOverlay = "pkgs";
+        nixpkgsConfig = "pkgs/config";
 
-      nixosSource = "sys";
-      nixosPlatforms = "sys/platform";
+        nixosSource = "sys";
+        nixosPlatforms = "sys/platform";
 
-      hmSource = "home";
-      hmPlatforms = "home/platform";
+        hmSource = "home";
+        hmPlatforms = "home/platform";
+      };
     };
-  };
 }
diff --git a/home/baseline/default.nix b/home/baseline/default.nix
index a859fb7..046a475 100644
--- a/home/baseline/default.nix
+++ b/home/baseline/default.nix
@@ -1,8 +1,12 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.baseline;
-in
-{
+in {
   imports = [
     ./git.nix
     ./graphics.nix
diff --git a/home/baseline/git.nix b/home/baseline/git.nix
index faad082..9707f44 100644
--- a/home/baseline/git.nix
+++ b/home/baseline/git.nix
@@ -1,8 +1,11 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   cfg = config.local;
-in
-{
+in {
   config = {
     programs.git = {
       enable = true;
diff --git a/home/baseline/graphics.nix b/home/baseline/graphics.nix
index 5948dd0..0e349c6 100644
--- a/home/baseline/graphics.nix
+++ b/home/baseline/graphics.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; {
   config = {
     dconf.settings = {
diff --git a/home/baseline/nvim.nix b/home/baseline/nvim.nix
index 882788d..edcabe8 100644
--- a/home/baseline/nvim.nix
+++ b/home/baseline/nvim.nix
@@ -1,8 +1,11 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   cfg = config.local.baseline;
-in
-{
+in {
   config = {
     home.sessionVariables.EDITOR = "nvim";
 
diff --git a/home/baseline/zsh.nix b/home/baseline/zsh.nix
index 48fdd4a..2be24b7 100644
--- a/home/baseline/zsh.nix
+++ b/home/baseline/zsh.nix
@@ -1,8 +1,12 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.baseline;
-in
-{
+in {
   config = {
     programs.zsh = {
       enable = true;
diff --git a/home/baseline/zshrc.nix b/home/baseline/zshrc.nix
index fe8ec9d..b963649 100644
--- a/home/baseline/zshrc.nix
+++ b/home/baseline/zshrc.nix
@@ -1,4 +1,8 @@
-{ grml-zsh-config, local, ... }: ''
+{
+  grml-zsh-config,
+  local,
+  ...
+}: ''
   source ${grml-zsh-config}/etc/zsh/zshrc
 
   export PATH="$PATH:$HOME/.cargo/bin"
@@ -45,7 +49,7 @@
     _GRML_NIX_SHELL="{''${INSTALLABLES[@]}} "
   fi
 
-  unset INSTALLABLES PATH_ITEM 
+  unset INSTALLABLES PATH_ITEM
 
   function grml_nix_shell() {
     REPLY="$_GRML_NIX_SHELL"
diff --git a/home/default.nix b/home/default.nix
index 38963ef..67bc37b 100644
--- a/home/default.nix
+++ b/home/default.nix
@@ -1,4 +1,4 @@
-{ flakes, ... }: {
+{flakes, ...}: {
   imports = [
     flakes.hm-isolation.homeManagerModule
     flakes.impermanence.nixosModules.home-manager.impermanence
diff --git a/home/desktop/default.nix b/home/desktop/default.nix
index 1608693..d46e97e 100644
--- a/home/desktop/default.nix
+++ b/home/desktop/default.nix
@@ -1,8 +1,12 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.desktop;
-in
-{
+in {
   imports = [
     ./firefox.nix
     ./sway.nix
diff --git a/home/desktop/firefox.nix b/home/desktop/firefox.nix
index a074ac0..f19b3ad 100644
--- a/home/desktop/firefox.nix
+++ b/home/desktop/firefox.nix
@@ -1,14 +1,18 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.desktop;
-in
-{
+in {
   config = mkIf cfg.enable {
     programs.firefox = {
       enable = true;
 
       package = pkgs.firefox.override {
-        nativeMessagingHosts = [ pkgs.passff-host ];
+        nativeMessagingHosts = [pkgs.passff-host];
       };
 
       profiles."main.profile" = {
diff --git a/home/desktop/sway.nix b/home/desktop/sway.nix
index a1fdc6f..d363e11 100644
--- a/home/desktop/sway.nix
+++ b/home/desktop/sway.nix
@@ -1,8 +1,12 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.desktop;
-in
-{
+in {
   config = mkIf cfg.enable {
     home.packages = [
       pkgs.wlr-randr
@@ -19,14 +23,17 @@ in
         enable = true;
 
         timeouts = [
-          { timeout = 600; command = "${getExe pkgs.gtklock} -d"; }
+          {
+            timeout = 600;
+            command = "${getExe pkgs.gtklock} -d";
+          }
         ];
       };
     };
 
     systemd.user.services.wl-gammarelay-rs = {
-      Unit.After = [ "sway-session.target" ];
-      Install.WantedBy = [ "sway-session.target" ];
+      Unit.After = ["sway-session.target"];
+      Install.WantedBy = ["sway-session.target"];
 
       Service.ExecStart = getExe pkgs.wl-gammarelay-rs;
     };
@@ -40,7 +47,7 @@ in
 
         fonts = {
           size = 11.0;
-          names = [ "DejaVu Sans Mono" ];
+          names = ["DejaVu Sans Mono"];
           style = "Bold Semi-Condensed";
         };
 
@@ -49,13 +56,12 @@ in
           position = "top";
         };
 
-        keybindings =
-          let
-            mod = config.wayland.windowManager.sway.config.modifier;
-            wofi = config.programs.wofi.package;
+        keybindings = let
+          mod = config.wayland.windowManager.sway.config.modifier;
+          wofi = config.programs.wofi.package;
 
-            grimshot = getExe pkgs.sway-contrib.grimshot;
-          in
+          grimshot = getExe pkgs.sway-contrib.grimshot;
+        in
           mkOptionDefault {
             "${mod}+a" = "focus parent";
             "${mod}+c" = "focus child";
diff --git a/home/environ/default.nix b/home/environ/default.nix
index 53841f1..fcd4dd0 100644
--- a/home/environ/default.nix
+++ b/home/environ/default.nix
@@ -1,4 +1,4 @@
-{ lib, ... }:
+{lib, ...}:
 with lib; {
   imports = [
     ./gpg.nix
diff --git a/home/environ/gpg.nix b/home/environ/gpg.nix
index 91feee6..a8173b7 100644
--- a/home/environ/gpg.nix
+++ b/home/environ/gpg.nix
@@ -1,8 +1,12 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.environ;
-in
-{
+in {
   config = mkIf cfg.enable {
     programs.gpg = {
       enable = true;
diff --git a/home/environ/pass.nix b/home/environ/pass.nix
index 0762432..cd431a2 100644
--- a/home/environ/pass.nix
+++ b/home/environ/pass.nix
@@ -1,21 +1,27 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.environ;
-in
-{
+in {
   config = mkIf cfg.enable {
     programs.password-store = {
       enable = true;
-      package = pkgs.pass.withExtensions (exts: (with exts; [
-        pass-audit
-        pass-genphrase
-        pass-otp
-        pass-tomb
-        pass-update
-      ]) ++ [
-        pkgs.local.pass-bcr
-        pkgs.local.pass-tail
-      ]);
+      package = pkgs.pass.withExtensions (exts:
+        (with exts; [
+          pass-audit
+          pass-genphrase
+          pass-otp
+          pass-tomb
+          pass-update
+        ])
+        ++ [
+          pkgs.local.pass-bcr
+          pkgs.local.pass-tail
+        ]);
 
       settings = {
         PASSWORD_STORE_DIR = "${config.home.homeDirectory}/pass";
diff --git a/home/environ/path.nix b/home/environ/path.nix
index 912f781..9fc0a94 100644
--- a/home/environ/path.nix
+++ b/home/environ/path.nix
@@ -1,10 +1,14 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.environ;
 
   py = pkgs.python3Packages;
-in
-{
+in {
   config = mkIf cfg.enable {
     home.packages = [
       pkgs.calc
@@ -13,8 +17,8 @@ in
       pkgs.local.athena-bccr.latest.firmador
       pkgs.gcc
       pkgs.gnome-screenshot
-      (pkgs.gajim.overrideAttrs (super: { buildInputs = super.buildInputs ++ [ pkgs.gsound ]; }))
-      (pkgs.local.athena-bccr.latest.gaudi.override { gaudiHash = "sha256-0nuku63USr5rC0rIwUC6toDN46qu8/KkezDTsVz9uJo="; })
+      (pkgs.gajim.overrideAttrs (super: {buildInputs = super.buildInputs ++ [pkgs.gsound];}))
+      (pkgs.local.athena-bccr.latest.gaudi.override {gaudiHash = "sha256-0nuku63USr5rC0rIwUC6toDN46qu8/KkezDTsVz9uJo=";})
       pkgs.gnucash
       pkgs.gruvbox-dark-icons-gtk
       pkgs.hack-font
diff --git a/home/environ/source.nix b/home/environ/source.nix
index ed9f53c..57b990e 100644
--- a/home/environ/source.nix
+++ b/home/environ/source.nix
@@ -1,10 +1,14 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.environ;
 
   py = pkgs.python3Packages;
-in
-{
+in {
   config = mkIf cfg.enable {
     nix.registry."system".to = {
       type = "path";
diff --git a/home/environ/ssh.nix b/home/environ/ssh.nix
index 6426dc8..d363baf 100644
--- a/home/environ/ssh.nix
+++ b/home/environ/ssh.nix
@@ -1,8 +1,12 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.environ;
-in
-{
+in {
   config = mkIf cfg.enable {
     programs.ssh = {
       enable = true;
diff --git a/home/environ/tmux.nix b/home/environ/tmux.nix
index 223851d..8d7b96f 100644
--- a/home/environ/tmux.nix
+++ b/home/environ/tmux.nix
@@ -1,8 +1,12 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.environ;
-in
-{
+in {
   options.local.environ.tmuxPass = {
     enable = mkEnableOption "tmux-pass plugin";
   };
diff --git a/home/environ/units.nix b/home/environ/units.nix
index bb039b7..ae4e680 100644
--- a/home/environ/units.nix
+++ b/home/environ/units.nix
@@ -1,13 +1,17 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.environ;
-in
-{
+in {
   config = mkIf cfg.enable {
     systemd.user = {
       timers = {
         units-cur = {
-          Install.WantedBy = [ "timers.target" ];
+          Install.WantedBy = ["timers.target"];
           Timer.OnCalendar = "daily";
           Unit.Description = "Update currency information for 'units'";
         };
diff --git a/home/environ/vtmp.nix b/home/environ/vtmp.nix
index 9481b6f..bd02699 100644
--- a/home/environ/vtmp.nix
+++ b/home/environ/vtmp.nix
@@ -1,8 +1,11 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   cfg = config.local.environ;
-in
-{
+in {
   config = mkIf cfg.enable {
     systemd.user.tmpfiles.rules = [
       "d %t/vtmp 0700"
diff --git a/home/isolation/default.nix b/home/isolation/default.nix
index d5d2979..aff006c 100644
--- a/home/isolation/default.nix
+++ b/home/isolation/default.nix
@@ -1,8 +1,11 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   cfg = config.local.shenvs;
-in
-{
+in {
   options.local.shenvs = {
     enable = mkEnableOption "hm-isolation shenvs";
   };
diff --git a/home/pim/dav.nix b/home/pim/dav.nix
index c19b2ed..a0759e2 100644
--- a/home/pim/dav.nix
+++ b/home/pim/dav.nix
@@ -1,8 +1,12 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.dav;
-in
-{
+in {
   options.local.dav = with types; {
     enable = mkEnableOption "Web/Card/CalDAV";
   };
@@ -42,7 +46,7 @@ in
         };
 
         Install = {
-          WantedBy = [ "sockets.target" ];
+          WantedBy = ["sockets.target"];
         };
       };
     };
diff --git a/home/pim/syncthing.nix b/home/pim/syncthing.nix
index e234c42..9ed1708 100644
--- a/home/pim/syncthing.nix
+++ b/home/pim/syncthing.nix
@@ -1,8 +1,11 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   cfg = config.local.syncthing;
-in
-{
+in {
   options.local.syncthing = {
     enable = mkEnableOption "syncthing";
   };
diff --git a/pkgs/athena-bccr/default.nix b/pkgs/athena-bccr/default.nix
index f9276c1..a5f79ca 100644
--- a/pkgs/athena-bccr/default.nix
+++ b/pkgs/athena-bccr/default.nix
@@ -1,32 +1,30 @@
-{ callPackage
-, lib
-}:
-let
+{
+  callPackage,
+  lib,
+}: let
   latest = "deb64-rev26";
 
-  releases = lib.mapAttrs (name: release: release // { name = name; }) (import ./releases.nix);
+  releases = lib.mapAttrs (name: release: release // {name = name;}) (import ./releases.nix);
 
-  overrideUnwrapped = default: new:
-    let
-      args = default // new;
-      unwrappedPkgs = lib.filterAttrs (name: _: ! lib.elem name [ "override" "overrideDerivation" ]) (callPackage ./unwrapped.nix args);
-    in
-    lib.fix (unwrapped: lib.mapAttrs (_: pkg: callPackage pkg unwrapped) unwrappedPkgs) // {
+  overrideUnwrapped = default: new: let
+    args = default // new;
+    unwrappedPkgs = lib.filterAttrs (name: _: ! lib.elem name ["override" "overrideDerivation"]) (callPackage ./unwrapped.nix args);
+  in
+    lib.fix (unwrapped: lib.mapAttrs (_: pkg: callPackage pkg unwrapped) unwrappedPkgs)
+    // {
       override = overrideUnwrapped args;
     };
 
-  pkgsForRelease = release:
-    let
-      ase-pkcs11 = unwrapped.ase-idprotect.lib;
-      libasep11 = "${ase-pkcs11}/lib/x64-athena/libASEP11.so";
-      unwrapped = overrideUnwrapped { inherit release; } { };
-    in
-    {
-      inherit ase-pkcs11 libasep11;
-      inherit (unwrapped) ase-idprotect bccr-cacerts;
+  pkgsForRelease = release: let
+    ase-pkcs11 = unwrapped.ase-idprotect.lib;
+    libasep11 = "${ase-pkcs11}/lib/x64-athena/libASEP11.so";
+    unwrapped = overrideUnwrapped {inherit release;} {};
+  in {
+    inherit ase-pkcs11 libasep11;
+    inherit (unwrapped) ase-idprotect bccr-cacerts;
 
-      gaudi = callPackage ./gaudi-env.nix { inherit unwrapped; };
-      firmador = callPackage ./firmador.nix { inherit libasep11; };
-    };
+    gaudi = callPackage ./gaudi-env.nix {inherit unwrapped;};
+    firmador = callPackage ./firmador.nix {inherit libasep11;};
+  };
 in
-lib.mapAttrs (_: pkgsForRelease) (releases // { latest = releases.${latest}; })
+  lib.mapAttrs (_: pkgsForRelease) (releases // {latest = releases.${latest};})
diff --git a/pkgs/athena-bccr/firmador.nix b/pkgs/athena-bccr/firmador.nix
index eef413b..d280b56 100644
--- a/pkgs/athena-bccr/firmador.nix
+++ b/pkgs/athena-bccr/firmador.nix
@@ -1,58 +1,57 @@
-{ fetchgit
-, lib
-, makeWrapper
-, maven
-, openjdk
-, wrapGAppsHook
-
-, libasep11 ? null
-}:
-let
+{
+  fetchgit,
+  lib,
+  makeWrapper,
+  maven,
+  openjdk,
+  wrapGAppsHook,
+  libasep11 ? null,
+}: let
   jdk = openjdk.override {
     enableJavaFX = true;
   };
 
   version = "1.9.8";
 in
-maven.buildMavenPackage {
-  pname = "firmador";
-  inherit version;
-
-  src = fetchgit {
-    url = "https://codeberg.org/firmador/firmador";
-    rev = version;
-    hash = "sha256-xdiVPjihRADPK4nG+WQHWsDzVYLCeN6ouQ6SDtjf1qQ=";
-  };
+  maven.buildMavenPackage {
+    pname = "firmador";
+    inherit version;
 
-  patches = [
-    ./0001-Remove-CheckUpdatePlugin-from-default-list.patch
-  ];
+    src = fetchgit {
+      url = "https://codeberg.org/firmador/firmador";
+      rev = version;
+      hash = "sha256-xdiVPjihRADPK4nG+WQHWsDzVYLCeN6ouQ6SDtjf1qQ=";
+    };
 
-  mvnHash = "sha256-h1zoStTgaE7toWWKq0Y0ahOORyltChwjmaMYjLgs1VE=";
+    patches = [
+      ./0001-Remove-CheckUpdatePlugin-from-default-list.patch
+    ];
 
-  nativeBuildInputs = [
-    makeWrapper
-    wrapGAppsHook
-  ];
+    mvnHash = "sha256-h1zoStTgaE7toWWKq0Y0ahOORyltChwjmaMYjLgs1VE=";
 
-  postPatch = lib.optionalString (libasep11 != null) ''
-    sed -i 's@/usr/lib/x64-athena/libASEP11.so@${libasep11}@g' src/main/java/cr/libre/firmador/CRSigner.java
-  '';
+    nativeBuildInputs = [
+      makeWrapper
+      wrapGAppsHook
+    ];
 
-  installPhase = ''
-    runHook preInstall
+    postPatch = lib.optionalString (libasep11 != null) ''
+      sed -i 's@/usr/lib/x64-athena/libASEP11.so@${libasep11}@g' src/main/java/cr/libre/firmador/CRSigner.java
+    '';
 
-    mkdir -p $out/bin $out/share/java
-    install -Dm644 target/firmador.jar $out/share/java
+    installPhase = ''
+      runHook preInstall
 
-    makeWrapper ${jdk}/bin/java $out/bin/firmador \
-      --add-flags "-jar $out/share/java/firmador.jar"
+      mkdir -p $out/bin $out/share/java
+      install -Dm644 target/firmador.jar $out/share/java
 
-    runHook postInstall
-  '';
+      makeWrapper ${jdk}/bin/java $out/bin/firmador \
+        --add-flags "-jar $out/share/java/firmador.jar"
 
-  meta = {
-    homepage = "https://firmador.libre.cr";
-    license = lib.licenses.gpl3Plus;
-  };
-}
+      runHook postInstall
+    '';
+
+    meta = {
+      homepage = "https://firmador.libre.cr";
+      license = lib.licenses.gpl3Plus;
+    };
+  }
diff --git a/pkgs/athena-bccr/gaudi-env.nix b/pkgs/athena-bccr/gaudi-env.nix
index 1ced54e..0ca1b82 100644
--- a/pkgs/athena-bccr/gaudi-env.nix
+++ b/pkgs/athena-bccr/gaudi-env.nix
@@ -1,63 +1,62 @@
-{ buildFHSEnv
-, curl
-, lib
-, writeShellScriptBin
-
-, gaudiHash ? null
-, unwrapped
-}:
-let
-  unwrappedWithGaudi = unwrapped.override { inherit gaudiHash; };
+{
+  buildFHSEnv,
+  curl,
+  lib,
+  writeShellScriptBin,
+  gaudiHash ? null,
+  unwrapped,
+}: let
+  unwrappedWithGaudi = unwrapped.override {inherit gaudiHash;};
 in
-buildFHSEnv {
-  name = "gaudi";
+  buildFHSEnv {
+    name = "gaudi";
 
-  targetPkgs = pkgs: [
-    unwrappedWithGaudi.ase-idprotect.lib
-    unwrappedWithGaudi.gaudi
+    targetPkgs = pkgs: [
+      unwrappedWithGaudi.ase-idprotect.lib
+      unwrappedWithGaudi.gaudi
 
-    (writeShellScriptBin "launch-gaudi" ''
-      set -o errexit
-      set -o pipefail
-      set -o nounset
+      (writeShellScriptBin "launch-gaudi" ''
+        set -o errexit
+        set -o pipefail
+        set -o nounset
 
-      PATH="${lib.makeBinPath [ curl ]}:$PATH"
+        PATH="${lib.makeBinPath [curl]}:$PATH"
 
-      echo "$0: testing for incompatible releases..." >&2
+        echo "$0: testing for incompatible releases..." >&2
 
-      jar_name=bccr-firma-fva-clienteMultiplataforma.jar
-      url="https://www.firmadigital.go.cr/Bccr.Firma.Fva.Actualizador.ClienteFirmadorJava//recursosLiberica17/actualizador/$jar_name"
-      ca_file="${unwrappedWithGaudi.bccr-cacerts}/root-ca.pem"
-      url_hash=$(curl -sS --cacert "$ca_file" "$url" | sha256sum | cut -d' ' -f1)
-      jar_path="${unwrappedWithGaudi.gaudi}/share/java/$jar_name"
-      jar_hash=$(sha256sum "$jar_path" | cut -d' ' -f1)
+        jar_name=bccr-firma-fva-clienteMultiplataforma.jar
+        url="https://www.firmadigital.go.cr/Bccr.Firma.Fva.Actualizador.ClienteFirmadorJava//recursosLiberica17/actualizador/$jar_name"
+        ca_file="${unwrappedWithGaudi.bccr-cacerts}/root-ca.pem"
+        url_hash=$(curl -sS --cacert "$ca_file" "$url" | sha256sum | cut -d' ' -f1)
+        jar_path="${unwrappedWithGaudi.gaudi}/share/java/$jar_name"
+        jar_hash=$(sha256sum "$jar_path" | cut -d' ' -f1)
 
-      if [ "$url_hash" != "$jar_hash" ]; then
-        last_modified=$(curl -sS --head --cacert "$ca_file" "$url" | grep -i '^last-modified:' | head -1)
+        if [ "$url_hash" != "$jar_hash" ]; then
+          last_modified=$(curl -sS --head --cacert "$ca_file" "$url" | grep -i '^last-modified:' | head -1)
 
-        echo "$0: sha256 mismatch for $jar_path due to server-side update" >&2
-        echo "$0:   expected:      $url_hash" >&2
-        echo "$0:   actual:        $jar_hash" >&2
-        echo "$0:   $last_modified" >&2
-        echo "$0: run the following to download the new client JAR, then update your derivation:" >&2
-        echo "$0: \$ ${unwrappedWithGaudi.update-gaudi}" >&2
+          echo "$0: sha256 mismatch for $jar_path due to server-side update" >&2
+          echo "$0:   expected:      $url_hash" >&2
+          echo "$0:   actual:        $jar_hash" >&2
+          echo "$0:   $last_modified" >&2
+          echo "$0: run the following to download the new client JAR, then update your derivation:" >&2
+          echo "$0: \$ ${unwrappedWithGaudi.update-gaudi}" >&2
 
-        exit 1
-      fi
+          exit 1
+        fi
 
-      cache_path_1="''${XDG_CACHE_HOME:-$HOME/.cache}/Agente-GAUDI"
-      cache_path_2="''${XDG_CACHE_HOME:-$HOME/.cache}/Firmador-BCCR"
+        cache_path_1="''${XDG_CACHE_HOME:-$HOME/.cache}/Agente-GAUDI"
+        cache_path_2="''${XDG_CACHE_HOME:-$HOME/.cache}/Firmador-BCCR"
 
-      for cache_path in "$cache_path_1" "$cache_path_2"; do
-        mkdir -p "$cache_path"
-        ln -sf -- ${unwrappedWithGaudi.gaudi}/share/java/bccr-firma-fva-clienteMultiplataforma.jar "$cache_path"
-      done
+        for cache_path in "$cache_path_1" "$cache_path_2"; do
+          mkdir -p "$cache_path"
+          ln -sf -- ${unwrappedWithGaudi.gaudi}/share/java/bccr-firma-fva-clienteMultiplataforma.jar "$cache_path"
+        done
 
-      cp -f --no-preserve=mode -t "$cache_path_1" -- "${unwrappedWithGaudi.gaudi}/share/java/config.properties"
+        cp -f --no-preserve=mode -t "$cache_path_1" -- "${unwrappedWithGaudi.gaudi}/share/java/config.properties"
 
-      exec gaudi
-    '')
-  ];
+        exec gaudi
+      '')
+    ];
 
-  runScript = "launch-gaudi";
-}
+    runScript = "launch-gaudi";
+  }
diff --git a/pkgs/athena-bccr/unwrapped.nix b/pkgs/athena-bccr/unwrapped.nix
index 55ef107..d6f3f38 100644
--- a/pkgs/athena-bccr/unwrapped.nix
+++ b/pkgs/athena-bccr/unwrapped.nix
@@ -1,11 +1,10 @@
-{ lib
-, requireFile
-
-, release
-, gaudiHash ? null
-, ...
-}:
-let
+{
+  lib,
+  requireFile,
+  release,
+  gaudiHash ? null,
+  ...
+}: let
   inherit (release) srcPaths;
 
   src = requireFile {
@@ -15,40 +14,47 @@ let
     inherit (release) hash;
   };
 
-  gaudiUpdateSrc = { update-gaudi }: requireFile {
-    url = "${update-gaudi}";
-    name = "gaudi-update-${release.name}.zip";
+  gaudiUpdateSrc = {update-gaudi}:
+    requireFile {
+      url = "${update-gaudi}";
+      name = "gaudi-update-${release.name}.zip";
 
-    hash = gaudiHash;
-  };
+      hash = gaudiHash;
+    };
 
-  moduleFromDeb = name: args@{ stdenv, dpkg, unzip, srcPath, ... }:
+  moduleFromDeb = name: args @ {
+    stdenv,
+    dpkg,
+    unzip,
+    srcPath,
+    ...
+  }:
     stdenv.mkDerivation ({
-      pname = "${name}-unwrapped";
-      version = release.name;
-
-      inherit src;
-
-      nativeBuildInputs = [ dpkg unzip ] ++ (args.nativeBuildInputs or [ ]);
-
-      postUnpack = ''
-        dpkg -x ${lib.escapeShellArg "${release.basename}/${srcPath}"} ${lib.escapeShellArg release.basename}
-      '';
-    } // lib.removeAttrs args [ "stdenv" "dpkg" "unzip" "srcPath" "nativeBuildInputs" ]);
-in
-{
-  ase-idprotect =
-    { autoPatchelfHook
-    , dpkg
-    , fontconfig
-    , freetype
-    , pcsclite
-    , stdenv
-    , unzip
-    , xorg
-    , zlib
-    , ...
-    }:
+        pname = "${name}-unwrapped";
+        version = release.name;
+
+        inherit src;
+
+        nativeBuildInputs = [dpkg unzip] ++ (args.nativeBuildInputs or []);
+
+        postUnpack = ''
+          dpkg -x ${lib.escapeShellArg "${release.basename}/${srcPath}"} ${lib.escapeShellArg release.basename}
+        '';
+      }
+      // lib.removeAttrs args ["stdenv" "dpkg" "unzip" "srcPath" "nativeBuildInputs"]);
+in {
+  ase-idprotect = {
+    autoPatchelfHook,
+    dpkg,
+    fontconfig,
+    freetype,
+    pcsclite,
+    stdenv,
+    unzip,
+    xorg,
+    zlib,
+    ...
+  }:
     moduleFromDeb "ase-idprotect" {
       inherit dpkg stdenv unzip;
       srcPath = srcPaths.idprotect;
@@ -67,7 +73,7 @@ in
         autoPatchelfHook
       ];
 
-      outputs = [ "out" "lib" ];
+      outputs = ["out" "lib"];
 
       installPhase = ''
         runHook preInstall
@@ -85,28 +91,26 @@ in
       '';
     };
 
-  gaudi =
-    { autoPatchelfHook
-    , dpkg
-    , makeWrapper
-    , openjdk
-    , pkgs
-    , stdenv
-    , unzip
-    , writeShellScriptBin
-
-    , update-gaudi
-    , ...
-    }:
-    let
-      jdk = openjdk.override {
-        enableJavaFX = true;
-        openjfx_jdk = pkgs."openjfx${lib.head (lib.splitString "." openjdk.version)}".override { withWebKit = true; };
-      };
-
-      fakeSudo = writeShellScriptBin "sudo" "";
-      gaudiUpdate = gaudiUpdateSrc { inherit update-gaudi; };
-    in
+  gaudi = {
+    autoPatchelfHook,
+    dpkg,
+    makeWrapper,
+    openjdk,
+    pkgs,
+    stdenv,
+    unzip,
+    writeShellScriptBin,
+    update-gaudi,
+    ...
+  }: let
+    jdk = openjdk.override {
+      enableJavaFX = true;
+      openjfx_jdk = pkgs."openjfx${lib.head (lib.splitString "." openjdk.version)}".override {withWebKit = true;};
+    };
+
+    fakeSudo = writeShellScriptBin "sudo" "";
+    gaudiUpdate = gaudiUpdateSrc {inherit update-gaudi;};
+  in
     moduleFromDeb "gaudi" {
       inherit dpkg stdenv unzip;
       srcPath = srcPaths.gaudi;
@@ -159,12 +163,12 @@ in
       '';
     };
 
-  bccr-cacerts =
-    { openssl
-    , stdenv
-    , unzip
-    , ...
-    }:
+  bccr-cacerts = {
+    openssl,
+    stdenv,
+    unzip,
+    ...
+  }:
     stdenv.mkDerivation {
       pname = "bccr-cacerts";
       version = release.name;
@@ -182,14 +186,13 @@ in
       '';
     };
 
-  update-gaudi =
-    { wget
-    , writeShellScript
-    , zip
-
-    , bccr-cacerts
-    , ...
-    }:
+  update-gaudi = {
+    wget,
+    writeShellScript,
+    zip,
+    bccr-cacerts,
+    ...
+  }:
     writeShellScript "update-gaudi" ''
       set -o errexit
       set -o pipefail
@@ -199,7 +202,7 @@ in
       trap 'cd / && rm -rf -- "$temp_dir"' EXIT
       cd "$temp_dir"
 
-      PATH="${lib.makeBinPath [ wget zip ]}:$PATH"
+      PATH="${lib.makeBinPath [wget zip]}:$PATH"
       ca_cert="${bccr-cacerts}/root-ca.pem"
       base_url="https://www.firmadigital.go.cr/Bccr.Firma.Fva.Actualizador.ClienteFirmadorJava//recursosLiberica17/actualizador"
 
diff --git a/pkgs/btclone/btclone.nix b/pkgs/btclone/btclone.nix
index 6b8e809..68673a7 100755
--- a/pkgs/btclone/btclone.nix
+++ b/pkgs/btclone/btclone.nix
@@ -1,13 +1,13 @@
 ''
   usage() { echo "Usage: $0 <subvolume> <target> [<up-to>]" >&2; exit 1; }
-  
+
   [[ $# -ge 2 && $# -le 3 && ( $# -ne 3 || $(("$3" + 0)) = "$3" ) ]] || usage
   [[ $UID -eq 0 ]] || { echo "$0: requires root privileges" >&2; exit 1; }
-  
+
   SOURCE="$1"
   TARGET="$2"
   [ $# -ge 3 ] && UP_TO="$3" || UP_TO=
-  
+
   get_snapshots() {
       FILTER="\$1 > 0"
       [[ -n "$UP_TO" ]] && FILTER="\$1 > 0 && \$1 <= $UP_TO"
@@ -15,7 +15,7 @@
       find "$1" -follow -maxdepth 1 -printf '%f\n' \
           | sed 's@/$@@g' | awk "$FILTER { print }" | sort -n
   }
-  
+
   clone() {
       if [[ -n "$2" ]]; then
           echo "Cloning $1 (incremental from $2)..." >&2
@@ -24,44 +24,44 @@
           echo "Cloning $1 (non-incremental)..." >&2
           PARENT_ARG="--"
       fi
-  
+
       FROM="$SOURCE/$1"
       INTO="$TARGET/$1"
-  
+
       [[ -d "$INTO" ]] || mkdir "$INTO"
       btrfs send "$PARENT_ARG" "$FROM/snapshot" | pv | btrfs receive "$INTO"
       cp -a "$FROM/info.xml" "$INTO/"
   }
-  
+
   cleanup() {
       echo "Removing $1..." >&2
-  
+
       AT="$TARGET/$1"
       [[ -d "$AT/snapshot" ]] && btrfs subvolume delete "$AT/snapshot"
       rm -f "$AT/info.xml"
       rmdir "$AT"
   }
-  
+
   while true; do
       ls -- "$SOURCE/" "$TARGET/" >/dev/null
       mapfile -t SNAPSHOTS < <(get_snapshots "$SOURCE")
       [[ ''${#SNAPSHOTS} -eq 0 ]] && { echo "$0: nothing to do" >&2; exit; }
       mapfile -t EXISTENT < <(get_snapshots "$TARGET")
-  
+
       RESET=0
       PARENT=
       ALL_ARE_BAD=0
       for SNAPSHOT in "''${SNAPSHOTS[@]}"; do
           if [[ ! -e "$SOURCE/$SNAPSHOT" ]]; then
               echo "Notice: resetting listings due to time lapse" >&2
-  
+
               RESET=1
               break
           elif [[ ! -s "$SOURCE/$SNAPSHOT/info.xml" ]]; then
               echo "Warning: skipping source $SNAPSHOT due to invalid info.xml" >&2
               continue
           fi
-  
+
           CLONE=0
           if [[ ! -e "$TARGET/$SNAPSHOT" ]]; then
               CLONE=1
@@ -69,25 +69,25 @@
               echo -n "Warning: bad copy $SNAPSHOT (" >&2
               [[ $ALL_ARE_BAD -eq 1 ]] && echo -n "bad chain" >&2 || echo -n "incomplete" >&2
               echo "), recreating..." >&2
-  
+
               cleanup "$SNAPSHOT"
-  
+
               CLONE=1
               ALL_ARE_BAD=1
           fi
-  
+
           if [[ $CLONE -eq 1 ]]; then
               clone "$SNAPSHOT" "$PARENT"
           elif [[ -z "$PARENT" ]]; then
               echo "Initial snapshot present, all copies will be incremental" >&2
           fi
-  
+
           chmod 750 "$TARGET/$SNAPSHOT"
           PARENT="$SNAPSHOT"
       done
-  
+
       [[ $RESET -eq 1 ]] && continue
-  
+
       echo "Copies updated, cleaning up..." >&2
       for SNAPSHOT in "''${EXISTENT[@]}"; do
           FOUND=""
@@ -100,9 +100,9 @@
 
           [ -n "$FOUND" ] || cleanup "$SNAPSHOT"
       done
-  
+
       break
   done
-  
+
   echo "Done" >&2
 ''
diff --git a/pkgs/btclone/default.nix b/pkgs/btclone/default.nix
index bb207ef..2484f33 100644
--- a/pkgs/btclone/default.nix
+++ b/pkgs/btclone/default.nix
@@ -1,6 +1,11 @@
-{ btrfs-progs, pv, writeShellApplication, ... }:
+{
+  btrfs-progs,
+  pv,
+  writeShellApplication,
+  ...
+}:
 writeShellApplication {
   name = "btclone";
-  runtimeInputs = [ btrfs-progs pv ];
+  runtimeInputs = [btrfs-progs pv];
   text = import ./btclone.nix;
 }
diff --git a/pkgs/cocotb/default.nix b/pkgs/cocotb/default.nix
index 1fe3d98..12aebf4 100644
--- a/pkgs/cocotb/default.nix
+++ b/pkgs/cocotb/default.nix
@@ -1,4 +1,8 @@
-{ cocotb, fetchFromGitHub, find-libpython }:
+{
+  cocotb,
+  fetchFromGitHub,
+  find-libpython,
+}:
 cocotb.overridePythonAttrs (prev: {
   version = "master-2023-03-16";
 
@@ -10,6 +14,6 @@ cocotb.overridePythonAttrs (prev: {
     sha256 = "sha256-7IlEaGSnd47tTxRu8QGW9mExCCZe47S41tlQatACLxU=";
   };
 
-  propagatedBuildInputs = [ find-libpython ];
+  propagatedBuildInputs = [find-libpython];
   doCheck = false;
 })
diff --git a/pkgs/cocotb/exts/wishbone.nix b/pkgs/cocotb/exts/wishbone.nix
index 5dd375b..44baa12 100644
--- a/pkgs/cocotb/exts/wishbone.nix
+++ b/pkgs/cocotb/exts/wishbone.nix
@@ -1,4 +1,11 @@
-{ buildPythonPackage, cocotb, cocotb-bus, fetchFromGitHub, git, setuptools-scm }:
+{
+  buildPythonPackage,
+  cocotb,
+  cocotb-bus,
+  fetchFromGitHub,
+  git,
+  setuptools-scm,
+}:
 buildPythonPackage {
   pname = "cocotbext-wishbone";
   version = "master-2022-04-26";
@@ -13,6 +20,6 @@ buildPythonPackage {
     leaveDotGit = true;
   };
 
-  nativeBuildInputs = [ git setuptools-scm ];
-  propagatedBuildInputs = [ cocotb cocotb-bus setuptools-scm ];
+  nativeBuildInputs = [git setuptools-scm];
+  propagatedBuildInputs = [cocotb cocotb-bus setuptools-scm];
 }
diff --git a/pkgs/config/default.nix b/pkgs/config/default.nix
index 03972e8..9fc9c79 100644
--- a/pkgs/config/default.nix
+++ b/pkgs/config/default.nix
@@ -1,4 +1,4 @@
-{ lib }: {
+{lib}: {
   android_sdk.accept_license = true;
   allowUnfreePredicate = pkg: import ./unfree.nix lib (lib.getName pkg);
 }
diff --git a/pkgs/default.nix b/pkgs/default.nix
index 82927a4..93d34b8 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -1,31 +1,30 @@
 final: prev:
 with prev.lib; let
   inherit (final) callPackage fetchpatch;
-in
-{
-  lib = callPackage ./lib { };
+in {
+  lib = callPackage ./lib {};
 
-  athena-bccr = callPackage ./athena-bccr { };
-  btclone = callPackage ./btclone { };
-  gem5 = callPackage ./gem5.nix { gem5ISA = "x86"; };
-  git-aliases = callPackage ./git-aliases.nix { };
-  increment-zone-serials = callPackage ./increment-zone-serials { };
-  kbuild-standalone = callPackage ./kbuild-standalone.nix { };
-  mssql-tools = callPackage ./mssql-tools.nix { };
-  oregano = callPackage ./oregano { };
-  pass-bcr = callPackage ./pass-bcr { };
-  pass-tail = callPackage ./pass-tail { };
-  rqlite = callPackage ./rqlite.nix { };
-  rv8 = callPackage ./rv8.nix { };
-  scripts = callPackage ./scripts { };
-  simple-scalar = callPackage ./simple-scalar { };
-  spliit = callPackage ./spliit { };
-  tmux-lift = callPackage ./tmux-lift { };
-  tmux-open = callPackage ./tmux-open { };
-  tmux-pass = callPackage ./tmux-pass.nix { };
+  athena-bccr = callPackage ./athena-bccr {};
+  btclone = callPackage ./btclone {};
+  gem5 = callPackage ./gem5.nix {gem5ISA = "x86";};
+  git-aliases = callPackage ./git-aliases.nix {};
+  increment-zone-serials = callPackage ./increment-zone-serials {};
+  kbuild-standalone = callPackage ./kbuild-standalone.nix {};
+  mssql-tools = callPackage ./mssql-tools.nix {};
+  oregano = callPackage ./oregano {};
+  pass-bcr = callPackage ./pass-bcr {};
+  pass-tail = callPackage ./pass-tail {};
+  rqlite = callPackage ./rqlite.nix {};
+  rv8 = callPackage ./rv8.nix {};
+  scripts = callPackage ./scripts {};
+  simple-scalar = callPackage ./simple-scalar {};
+  spliit = callPackage ./spliit {};
+  tmux-lift = callPackage ./tmux-lift {};
+  tmux-open = callPackage ./tmux-open {};
+  tmux-pass = callPackage ./tmux-pass.nix {};
 
   st = prev.st.override {
-    conf = import ./st.nix { };
+    conf = import ./st.nix {};
 
     patches = [
       (fetchpatch {
@@ -35,55 +34,58 @@ in
     ];
   };
 
-  override = {
-    home-assistant-custom-components = prev.home-assistant-custom-components // {
-      dreame_vacuum = final.home-assistant.python.pkgs.callPackage ./dreame-vacuum.nix { };
-      smartthinq_sensors = final.home-assistant.python.pkgs.callPackage ./smartthinq-sensors.nix { };
-    };
+  override =
+    {
+      home-assistant-custom-components =
+        prev.home-assistant-custom-components
+        // {
+          dreame_vacuum = final.home-assistant.python.pkgs.callPackage ./dreame-vacuum.nix {};
+          smartthinq_sensors = final.home-assistant.python.pkgs.callPackage ./smartthinq-sensors.nix {};
+        };
 
-    home-assistant-custom-lovelace-modules = prev.home-assistant-custom-lovelace-modules // {
-      xiaomi-vacuum-map-card = final.callPackage ./lovelace-xiaomi-vacuum-map-card { };
-    };
+      home-assistant-custom-lovelace-modules =
+        prev.home-assistant-custom-lovelace-modules
+        // {
+          xiaomi-vacuum-map-card = final.callPackage ./lovelace-xiaomi-vacuum-map-card {};
+        };
 
-    # Tomado de all-packages.nix
-    msmtp = callPackage ./msmtp {
-      inherit (final.darwin.apple_sdk.frameworks) Security;
-      autoreconfHook = final.buildPackages.autoreconfHook269;
-    };
+      # Tomado de all-packages.nix
+      msmtp = callPackage ./msmtp {
+        inherit (final.darwin.apple_sdk.frameworks) Security;
+        autoreconfHook = final.buildPackages.autoreconfHook269;
+      };
 
-    postfix = callPackage ./postfix { inherit (prev) postfix; };
-    xandikos = final.python3Packages.callPackage ./xandikos { inherit (prev) xandikos; };
-  } // (
-    let
-      makePyOverrides = version:
-        let
+      postfix = callPackage ./postfix {inherit (prev) postfix;};
+      xandikos = final.python3Packages.callPackage ./xandikos {inherit (prev) xandikos;};
+    }
+    // (
+      let
+        makePyOverrides = version: let
           name = "python3${toString version}";
-        in
-        {
+        in {
           inherit name;
 
           value = prev.${name}.override {
             packageOverrides = nextPy: prevPy: {
-              cocotb = nextPy.callPackage ./cocotb { inherit (prevPy) cocotb; };
-              cocotbext-wishbone = nextPy.callPackage ./cocotb/exts/wishbone.nix { };
-              find-libpython = nextPy.callPackage ./find-libpython.nix { };
-              hdl-convertor = nextPy.callPackage ./hdl-convertor { };
-              hdl-convertor-ast = nextPy.callPackage ./hdl-convertor/ast.nix { };
-              iced-x86 = nextPy.callPackage ./iced-x86 { };
+              cocotb = nextPy.callPackage ./cocotb {inherit (prevPy) cocotb;};
+              cocotbext-wishbone = nextPy.callPackage ./cocotb/exts/wishbone.nix {};
+              find-libpython = nextPy.callPackage ./find-libpython.nix {};
+              hdl-convertor = nextPy.callPackage ./hdl-convertor {};
+              hdl-convertor-ast = nextPy.callPackage ./hdl-convertor/ast.nix {};
+              iced-x86 = nextPy.callPackage ./iced-x86 {};
             };
           };
         };
 
-      pyVersionRange' = start: end:
-        let
+        pyVersionRange' = start: end: let
           next = end + 1;
         in
-        if prev ? "python3${toString next}"
-        then pyVersionRange' start next
-        else range start end;
+          if prev ? "python3${toString next}"
+          then pyVersionRange' start next
+          else range start end;
 
-      pyVersionRange = start: pyVersionRange' start start;
-    in
-    listToAttrs (map makePyOverrides (pyVersionRange 9))
-  );
+        pyVersionRange = start: pyVersionRange' start start;
+      in
+        listToAttrs (map makePyOverrides (pyVersionRange 9))
+    );
 }
diff --git a/pkgs/dreame-vacuum.nix b/pkgs/dreame-vacuum.nix
index 1039405..1dd7255 100644
--- a/pkgs/dreame-vacuum.nix
+++ b/pkgs/dreame-vacuum.nix
@@ -1,40 +1,40 @@
-{ buildHomeAssistantComponent
-, callPackage
-, fetchFromGitHub
-, numpy
-, paho-mqtt
-, pillow
-, pybase64
-, pycryptodome
-, python-miio
-, requests
-}:
-let
+{
+  buildHomeAssistantComponent,
+  callPackage,
+  fetchFromGitHub,
+  numpy,
+  paho-mqtt,
+  pillow,
+  pybase64,
+  pycryptodome,
+  python-miio,
+  requests,
+}: let
   version = "2.0.0b15";
 in
-buildHomeAssistantComponent {
-  owner = "tasshack";
-  domain = "dreame_vacuum";
-  inherit version;
+  buildHomeAssistantComponent {
+    owner = "tasshack";
+    domain = "dreame_vacuum";
+    inherit version;
 
-  src = fetchFromGitHub {
-    repo = "dreame-vacuum";
-    owner = "Tasshack";
+    src = fetchFromGitHub {
+      repo = "dreame-vacuum";
+      owner = "Tasshack";
 
-    rev = "v${version}";
-    hash = "sha256-ydWirMQsO6DYU5UdygHRXCx8I3M7haYX9zPLela9H7E=";
-  };
+      rev = "v${version}";
+      hash = "sha256-ydWirMQsO6DYU5UdygHRXCx8I3M7haYX9zPLela9H7E=";
+    };
 
-  dontBuild = true;
+    dontBuild = true;
 
-  propagatedBuildInputs = [
-    numpy
-    paho-mqtt
-    pillow
-    pybase64
-    pycryptodome
-    python-miio
-    requests
-    (callPackage ./py-mini-racer.nix { })
-  ];
-}
+    propagatedBuildInputs = [
+      numpy
+      paho-mqtt
+      pillow
+      pybase64
+      pycryptodome
+      python-miio
+      requests
+      (callPackage ./py-mini-racer.nix {})
+    ];
+  }
diff --git a/pkgs/find-libpython.nix b/pkgs/find-libpython.nix
index 80da67f..cc351c3 100644
--- a/pkgs/find-libpython.nix
+++ b/pkgs/find-libpython.nix
@@ -1,13 +1,15 @@
-{ buildPythonPackage, fetchPypi }:
-let
+{
+  buildPythonPackage,
+  fetchPypi,
+}: let
   pname = "find_libpython";
   version = "0.3.0";
 in
-buildPythonPackage {
-  inherit pname version;
-
-  src = fetchPypi {
+  buildPythonPackage {
     inherit pname version;
-    sha256 = "sha256-bn/l2a9/rW3AZstVFaDpyQpx8f6yuy+OTNu0+DJ26eU=";
-  };
-}
+
+    src = fetchPypi {
+      inherit pname version;
+      sha256 = "sha256-bn/l2a9/rW3AZstVFaDpyQpx8f6yuy+OTNu0+DJ26eU=";
+    };
+  }
diff --git a/pkgs/force-riscv/default.nix b/pkgs/force-riscv/default.nix
index 35907ce..097fb8d 100644
--- a/pkgs/force-riscv/default.nix
+++ b/pkgs/force-riscv/default.nix
@@ -1,40 +1,46 @@
-{ fetchFromGitHub, lib, makeWrapper, python3, stdenv }:
-with lib; stdenv.mkDerivation {
-  pname = "force-riscv";
-  version = "master-2023-01-31";
+{
+  fetchFromGitHub,
+  lib,
+  makeWrapper,
+  python3,
+  stdenv,
+}:
+with lib;
+  stdenv.mkDerivation {
+    pname = "force-riscv";
+    version = "master-2023-01-31";
 
-  src = fetchFromGitHub {
-    repo = "force-riscv";
-    owner = "openhwgroup";
+    src = fetchFromGitHub {
+      repo = "force-riscv";
+      owner = "openhwgroup";
 
-    rev = "192bcc15e0dde8aaf25621da4317569b3f374047";
-    sha256 = "sha256-Eol973IMGRVAuw/rsYiK61+KVYkmbqq9yudaNbMCzJ0=";
-  };
+      rev = "192bcc15e0dde8aaf25621da4317569b3f374047";
+      sha256 = "sha256-Eol973IMGRVAuw/rsYiK61+KVYkmbqq9yudaNbMCzJ0=";
+    };
 
-  buildInputs = [ python3 ];
-  nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [python3];
+    nativeBuildInputs = [makeWrapper];
 
-  patches = [
-    ./remove-pyeval-initthreads.patch
-    ./wno-error-range-loop-construct.patch
-    ./imageio-include-string.patch
-    ./testio-include-string.patch
-    ./urbg-static-constexpr-min-max.patch
-  ];
+    patches = [
+      ./remove-pyeval-initthreads.patch
+      ./wno-error-range-loop-construct.patch
+      ./imageio-include-string.patch
+      ./testio-include-string.patch
+      ./urbg-static-constexpr-min-max.patch
+    ];
 
-  postPatch = ''
-    patchShebangs utils/ fpix/utils/
-  '';
+    postPatch = ''
+      patchShebangs utils/ fpix/utils/
+    '';
 
-  makeFlags = [
-    "FORCE_CC=${stdenv.cc.targetPrefix}c++"
-    "FORCE_PYTHON_LIB=${python3}/lib"
-    "FORCE_PYTHON_INC=${python3}/include/${python3.libPrefix}"
-  ];
+    makeFlags = [
+      "FORCE_CC=${stdenv.cc.targetPrefix}c++"
+      "FORCE_PYTHON_LIB=${python3}/lib"
+      "FORCE_PYTHON_INC=${python3}/include/${python3.libPrefix}"
+    ];
 
-  # Ver setenv.bash
-  installPhase =
-    let
+    # Ver setenv.bash
+    installPhase = let
       paths = [
         "3rd_party/py"
         "utils"
@@ -45,8 +51,7 @@ with lib; stdenv.mkDerivation {
       ];
 
       pythonPath = concatStringsSep ":" (map (p: "$out/${p}") paths);
-    in
-    ''
+    in ''
       mkdir -p $out/ $out/fpix/ $out/riscv/ $out/3rd_party/
 
       # SimApiHANDCAR.so queda en bin (?), al parecer es así
@@ -64,4 +69,4 @@ with lib; stdenv.mkDerivation {
       cp -r config/ utils/ $out/
       cp -r riscv/arch_data/ $out/riscv/
     '';
-}
+  }
diff --git a/pkgs/gem5.nix b/pkgs/gem5.nix
index 3174553..9795c0e 100644
--- a/pkgs/gem5.nix
+++ b/pkgs/gem5.nix
@@ -1,65 +1,66 @@
-{ boost
-, lib
-, fetchFromGitHub
-, gnum4
-, gperftools
-, hdf5-cpp
-, libpng
-, protobuf
-, python3
-, scons
-, stdenv
-, zlib
-, enableHdf5 ? true
-, enableLibpng ? true
-, enableTrace ? true
-, enableSystemC ? true
-, enableTcmalloc ? true
-, gem5ISA
-}:
-let
+{
+  boost,
+  lib,
+  fetchFromGitHub,
+  gnum4,
+  gperftools,
+  hdf5-cpp,
+  libpng,
+  protobuf,
+  python3,
+  scons,
+  stdenv,
+  zlib,
+  enableHdf5 ? true,
+  enableLibpng ? true,
+  enableTrace ? true,
+  enableSystemC ? true,
+  enableTcmalloc ? true,
+  gem5ISA,
+}: let
   version = "22.1.0.0";
 
-  isa = assert lib.assertMsg (lib.elem gem5ISA [ "arm" "null" "mips" "power" "x86" ])
-    "${gem5ISA} is not a valid gem5 target ISA";
+  isa = assert lib.assertMsg (lib.elem gem5ISA ["arm" "null" "mips" "power" "x86"])
+  "${gem5ISA} is not a valid gem5 target ISA";
     lib.toUpper gem5ISA;
 
   target = "build/${isa}/gem5.opt";
 in
-stdenv.mkDerivation {
-  pname = "gem5";
-  version = "${gem5ISA}-${version}";
+  stdenv.mkDerivation {
+    pname = "gem5";
+    version = "${gem5ISA}-${version}";
 
-  src = fetchFromGitHub {
-    repo = "gem5";
-    owner = "gem5";
+    src = fetchFromGitHub {
+      repo = "gem5";
+      owner = "gem5";
 
-    rev = "v${version}";
-    sha256 = "sha256-Yxag8emR6hf7oX4GAtQi/YYcKrpXicUoQg5+rjKyjc0=";
-  };
+      rev = "v${version}";
+      sha256 = "sha256-Yxag8emR6hf7oX4GAtQi/YYcKrpXicUoQg5+rjKyjc0=";
+    };
 
-  buildInputs = [ zlib ]
-    ++ lib.optional enableHdf5 hdf5-cpp
-    ++ lib.optional enableLibpng libpng
-    ++ lib.optional enableTrace boost
-    ++ lib.optional enableSystemC protobuf
-    ++ lib.optional enableTcmalloc gperftools;
+    buildInputs =
+      [zlib]
+      ++ lib.optional enableHdf5 hdf5-cpp
+      ++ lib.optional enableLibpng libpng
+      ++ lib.optional enableTrace boost
+      ++ lib.optional enableSystemC protobuf
+      ++ lib.optional enableTcmalloc gperftools;
 
-  nativeBuildInputs = [ gnum4 scons ];
+    nativeBuildInputs = [gnum4 scons];
 
-  sconsFlags = [ target ];
+    sconsFlags = [target];
 
-  enableParallelBuilding = true;
+    enableParallelBuilding = true;
 
-  # Without this we get "ValueError: invalid width 0 (must be > 0)" 
-  COLUMNS = 80;
+    # Without this we get "ValueError: invalid width 0 (must be > 0)"
+    COLUMNS = 80;
 
-  postPatch = ''
-    patchShebangs util/
-  '';
+    postPatch = ''
+      patchShebangs util/
+    '';
 
-  installPhase = ''
-    mkdir -p $out/bin/
-    cp ${target} $out/bin/
-  '';
-}
+    installPhase = ''
+      mkdir -p $out/bin/
+      cp ${target} $out/bin/
+    '';
+  }
diff --git a/pkgs/git-aliases.nix b/pkgs/git-aliases.nix
index aa72ab1..0b88f12 100644
--- a/pkgs/git-aliases.nix
+++ b/pkgs/git-aliases.nix
@@ -1,4 +1,4 @@
-{ writeText, ... }:
+{writeText, ...}:
 writeText "git-aliases.zsh" ''
   alias g='git'
   alias ga='git add'
diff --git a/pkgs/hdl-convertor/ast.nix b/pkgs/hdl-convertor/ast.nix
index 52bd656..d6f833b 100644
--- a/pkgs/hdl-convertor/ast.nix
+++ b/pkgs/hdl-convertor/ast.nix
@@ -1,4 +1,8 @@
-{ lib, buildPythonPackage, fetchFromGitHub }:
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+}:
 buildPythonPackage {
   pname = "hdl-convertor-ast";
   version = "master-2022-07-25";
diff --git a/pkgs/hdl-convertor/default.nix b/pkgs/hdl-convertor/default.nix
index 08e16d6..12581aa 100644
--- a/pkgs/hdl-convertor/default.nix
+++ b/pkgs/hdl-convertor/default.nix
@@ -1,12 +1,13 @@
-{ antlr
-, buildPythonPackage
-, cmake
-, cython
-, fetchFromGitHub
-, hdl-convertor-ast
-, jre
-, python3
-, scikit-build
+{
+  antlr,
+  buildPythonPackage,
+  cmake,
+  cython,
+  fetchFromGitHub,
+  hdl-convertor-ast,
+  jre,
+  python3,
+  scikit-build,
 }:
 buildPythonPackage {
   pname = "hdl-convertor";
@@ -20,9 +21,9 @@ buildPythonPackage {
     sha256 = "sha256-Ketz5r7Z8kjshr7mjfdqF+QAOHGM/iTDpT6TMbYl6QU=";
   };
 
-  nativeBuildInputs = [ antlr cmake jre cython ];
-  propagatedBuildInputs = [ antlr.runtime.cpp hdl-convertor-ast ];
-  propagatedNativeBuildInputs = [ scikit-build ];
+  nativeBuildInputs = [antlr cmake jre cython];
+  propagatedBuildInputs = [antlr.runtime.cpp hdl-convertor-ast];
+  propagatedNativeBuildInputs = [scikit-build];
 
   postPatch = ''
     sed -i 's/antlr4\(-complete\)/${antlr.name}\1/g' src/CMake_antlr4.txt
diff --git a/pkgs/iced-x86/default.nix b/pkgs/iced-x86/default.nix
index 6f7652d..ac1ad06 100644
--- a/pkgs/iced-x86/default.nix
+++ b/pkgs/iced-x86/default.nix
@@ -1,5 +1,12 @@
-{ buildPythonPackage, cargo, lib, fetchPypi, setuptools-rust, rustc, rustPlatform }:
-let
+{
+  buildPythonPackage,
+  cargo,
+  lib,
+  fetchPypi,
+  setuptools-rust,
+  rustc,
+  rustPlatform,
+}: let
   pname = "iced-x86";
   version = "1.19.0";
 
@@ -8,22 +15,22 @@ let
     sha256 = "sha256-YljWeJNOk7eF1iPymarxNLj3rLnXJGC/Qsajb9YWXnE=";
   };
 in
-buildPythonPackage {
-  inherit pname src version;
+  buildPythonPackage {
+    inherit pname src version;
 
-  nativeBuildInputs = [
-    cargo
-    rustc
-    rustPlatform.cargoSetupHook
-    setuptools-rust
-  ];
+    nativeBuildInputs = [
+      cargo
+      rustc
+      rustPlatform.cargoSetupHook
+      setuptools-rust
+    ];
 
-  # Esta gente no le puso Cargo.lock
-  cargoDeps = rustPlatform.importCargoLock {
-    lockFile = ./Cargo.lock;
-  };
+    # Esta gente no le puso Cargo.lock
+    cargoDeps = rustPlatform.importCargoLock {
+      lockFile = ./Cargo.lock;
+    };
 
-  patches = [
-    ./0001-add-Cargo.lock.patch
-  ];
-}
+    patches = [
+      ./0001-add-Cargo.lock.patch
+    ];
+  }
diff --git a/pkgs/increment-zone-serials/default.nix b/pkgs/increment-zone-serials/default.nix
index b5b6cd6..f2d6f02 100644
--- a/pkgs/increment-zone-serials/default.nix
+++ b/pkgs/increment-zone-serials/default.nix
@@ -1,12 +1,13 @@
-{ python3
-, stdenv
+{
+  python3,
+  stdenv,
 }:
 stdenv.mkDerivation {
   pname = "increment-zone-serials";
   version = "1.0.0";
 
   propagatedBuildInputs = [
-    (python3.withPackages (py: [ ]))
+    (python3.withPackages (py: []))
   ];
 
   dontUnpack = true;
diff --git a/pkgs/kbuild-standalone.nix b/pkgs/kbuild-standalone.nix
index 9f82883..2296b50 100644
--- a/pkgs/kbuild-standalone.nix
+++ b/pkgs/kbuild-standalone.nix
@@ -1,26 +1,36 @@
-{ autoreconfHook, bison, fetchFromGitHub, flex, ncurses, lib, pkg-config, stdenv }:
-with lib; stdenv.mkDerivation {
-  pname = "kbuild-standalone";
-  version = "6.0";
+{
+  autoreconfHook,
+  bison,
+  fetchFromGitHub,
+  flex,
+  ncurses,
+  lib,
+  pkg-config,
+  stdenv,
+}:
+with lib;
+  stdenv.mkDerivation {
+    pname = "kbuild-standalone";
+    version = "6.0";
 
-  src = fetchFromGitHub {
-    repo = "kbuild-standalone";
-    owner = "WangNan0";
+    src = fetchFromGitHub {
+      repo = "kbuild-standalone";
+      owner = "WangNan0";
 
-    rev = "5e8d3496b69162684d682bda8a165cecdb66bfec";
-    sha256 = "sha256-OugvJToOiczFM6G6GkcoN8GdjOd3wLhPhh7huBGA8io=";
-  };
+      rev = "5e8d3496b69162684d682bda8a165cecdb66bfec";
+      sha256 = "sha256-OugvJToOiczFM6G6GkcoN8GdjOd3wLhPhh7huBGA8io=";
+    };
 
-  buildInputs = [ ncurses ];
-  nativeBuildInputs = [ autoreconfHook bison flex pkg-config ];
+    buildInputs = [ncurses];
+    nativeBuildInputs = [autoreconfHook bison flex pkg-config];
 
-  preBuild = ''
-    mkdir -p $out/lib/pkgconfig $out/share
+    preBuild = ''
+      mkdir -p $out/lib/pkgconfig $out/share
 
-    patchShebangs kbuild/_fixdep
-    cp kbuild-standalone.pc $out/lib/pkgconfig/
-    export PKG_CONFIG_PATH="$PKG_CONFIG_PATH:$out/lib/pkgconfig"
+      patchShebangs kbuild/_fixdep
+      cp kbuild-standalone.pc $out/lib/pkgconfig/
+      export PKG_CONFIG_PATH="$PKG_CONFIG_PATH:$out/lib/pkgconfig"
 
-    cp -r kbuild/ $out/share/kbuild-standalone/
-  '';
-}
+      cp -r kbuild/ $out/share/kbuild-standalone/
+    '';
+  }
diff --git a/pkgs/lib/default.nix b/pkgs/lib/default.nix
index a273758..e3ab56e 100644
--- a/pkgs/lib/default.nix
+++ b/pkgs/lib/default.nix
@@ -1,4 +1,3 @@
-{ callPackage }:
-{
-  importAll = callPackage ./importAll.nix { };
+{callPackage}: {
+  importAll = callPackage ./importAll.nix {};
 }
diff --git a/pkgs/lib/importAll.nix b/pkgs/lib/importAll.nix
index 30a1dd9..6acabe9 100644
--- a/pkgs/lib/importAll.nix
+++ b/pkgs/lib/importAll.nix
@@ -1,17 +1,20 @@
-{ lib }:
-{ root, exclude ? [ ] }:
-with builtins; with lib;
-
+{lib}: {
+  root,
+  exclude ? [],
+}:
+with builtins;
+with lib;
 # http://chriswarbo.net/projects/nixos/useful_hacks.html
-let
-  basename = removeSuffix ".nix";
+  let
+    basename = removeSuffix ".nix";
 
-  isMatch = name: type: (hasSuffix ".nix" name || type == "directory")
-    && ! elem name (map basename exclude);
+    isMatch = name: type:
+      (hasSuffix ".nix" name || type == "directory")
+      && ! elem name (map basename exclude);
 
-  entry = name: _: {
-    name = basename name;
-    value = import (root + "/${name}");
-  };
-in
-mapAttrs' entry (filterAttrs isMatch (readDir root))
+    entry = name: _: {
+      name = basename name;
+      value = import (root + "/${name}");
+    };
+  in
+    mapAttrs' entry (filterAttrs isMatch (readDir root))
diff --git a/pkgs/lovelace-xiaomi-vacuum-map-card/default.nix b/pkgs/lovelace-xiaomi-vacuum-map-card/default.nix
index 2fa048d..4b837de 100644
--- a/pkgs/lovelace-xiaomi-vacuum-map-card/default.nix
+++ b/pkgs/lovelace-xiaomi-vacuum-map-card/default.nix
@@ -1,39 +1,39 @@
-{ buildNpmPackage
-, fetchFromGitHub
-}:
-let
+{
+  buildNpmPackage,
+  fetchFromGitHub,
+}: let
   pname = "lovelace-xiaomi-vacuum-map-card";
   version = "2.2.4";
 in
-buildNpmPackage rec {
-  inherit pname version;
+  buildNpmPackage rec {
+    inherit pname version;
 
-  src = fetchFromGitHub {
-    repo = pname;
-    owner = "PiotrMachowski";
+    src = fetchFromGitHub {
+      repo = pname;
+      owner = "PiotrMachowski";
 
-    rev = "v${version}";
-    hash = "sha256-ameZzwhs1XRB31w2993MiP03hAUvf4aLM1syDmPZF60=";
-  };
+      rev = "v${version}";
+      hash = "sha256-ameZzwhs1XRB31w2993MiP03hAUvf4aLM1syDmPZF60=";
+    };
 
-  npmDepsHash = "sha256-H72nYi+9zEC2daSbchfKcNECofw0eaLBTvLCsVAk9Hc=";
+    npmDepsHash = "sha256-H72nYi+9zEC2daSbchfKcNECofw0eaLBTvLCsVAk9Hc=";
 
-  patches = [
-    ./0001-Fix-error-during-rollup-c.patch
-  ];
+    patches = [
+      ./0001-Fix-error-during-rollup-c.patch
+    ];
 
-  postPatch = ''
-    cp -v ${./package-lock.json} package-lock.json
-  '';
+    postPatch = ''
+      cp -v ${./package-lock.json} package-lock.json
+    '';
 
-  installPhase = ''
-    runHook preInstall
+    installPhase = ''
+      runHook preInstall
 
-    mkdir $out
-    cp dist/xiaomi-vacuum-map-card.js $out
+      mkdir $out
+      cp dist/xiaomi-vacuum-map-card.js $out
 
-    runHook postInstall
-  '';
+      runHook postInstall
+    '';
 
-  passthru.entrypoint = "xiaomi-vacuum-map-card.js";
-}
+    passthru.entrypoint = "xiaomi-vacuum-map-card.js";
+  }
diff --git a/pkgs/msmtp/default.nix b/pkgs/msmtp/default.nix
index 18036f5..23559c5 100644
--- a/pkgs/msmtp/default.nix
+++ b/pkgs/msmtp/default.nix
@@ -1,28 +1,27 @@
-{ resholve
-, stdenv
-, symlinkJoin
-, lib
-, fetchFromGitHub
-, autoreconfHook
-, pkg-config
-, bash
-, coreutils
-, gnugrep
-, gnutls
-, gsasl
-, libidn2
-, netcat-gnu
-, texinfo
-, which
-, Security
-, withKeyring ? true
-, libsecret
-, withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd
-, systemd
-, withScripts ? true
-}:
-
-let
+{
+  resholve,
+  stdenv,
+  symlinkJoin,
+  lib,
+  fetchFromGitHub,
+  autoreconfHook,
+  pkg-config,
+  bash,
+  coreutils,
+  gnugrep,
+  gnutls,
+  gsasl,
+  libidn2,
+  netcat-gnu,
+  texinfo,
+  which,
+  Security,
+  withKeyring ? true,
+  libsecret,
+  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  systemd,
+  withScripts ? true,
+}: let
   inherit (lib) getBin getExe optionals;
 
   version = "1.8.22";
@@ -38,7 +37,7 @@ let
     description = "Simple and easy to use SMTP client with excellent sendmail compatibility";
     homepage = "https://marlam.de/msmtp/";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ peterhoeg ];
+    maintainers = with maintainers; [peterhoeg];
     platforms = platforms.unix;
     mainProgram = "msmtp";
   };
@@ -51,14 +50,16 @@ let
       ./0001-msmtp-run-passwordeval-if-tls_key_file-is-provided-e.patch
     ];
 
-    configureFlags = [ "--sysconfdir=/etc" "--with-libgsasl" ]
-      ++ optionals stdenv.isDarwin [ "--with-macosx-keyring" ];
+    configureFlags =
+      ["--sysconfdir=/etc" "--with-libgsasl"]
+      ++ optionals stdenv.isDarwin ["--with-macosx-keyring"];
 
-    buildInputs = [ gnutls gsasl libidn2 ]
-      ++ optionals stdenv.isDarwin [ Security ]
-      ++ optionals withKeyring [ libsecret ];
+    buildInputs =
+      [gnutls gsasl libidn2]
+      ++ optionals stdenv.isDarwin [Security]
+      ++ optionals withKeyring [libsecret];
 
-    nativeBuildInputs = [ autoreconfHook pkg-config texinfo ];
+    nativeBuildInputs = [autoreconfHook pkg-config texinfo];
 
     enableParallelBuilding = true;
 
@@ -72,11 +73,15 @@ let
     pname = "msmtp-scripts";
     inherit version src meta;
 
-    patches = [ ./paths.patch ];
+    patches = [./paths.patch];
 
     postPatch = ''
       substituteInPlace scripts/msmtpq/msmtpq \
-        --replace @journal@ ${if withSystemd then "Y" else "N"}
+        --replace @journal@ ${
+        if withSystemd
+        then "Y"
+        else "N"
+      }
     '';
 
     dontConfigure = true;
@@ -100,41 +105,47 @@ let
 
     solutions = {
       msmtpq = {
-        scripts = [ "bin/msmtpq" ];
+        scripts = ["bin/msmtpq"];
         interpreter = getExe bash;
-        inputs = [
-          binaries
-          coreutils
-          gnugrep
-          netcat-gnu
-          which
-        ] ++ optionals withSystemd [ systemd ];
-        execer = [
-          "cannot:${getBin binaries}/bin/msmtp"
-          "cannot:${getBin netcat-gnu}/bin/nc"
-        ] ++ optionals withSystemd [
-          "cannot:${getBin systemd}/bin/systemd-cat"
-        ];
-        fix."$MSMTP" = [ "msmtp" ];
-        fake.external = [ "ping" ]
-          ++ optionals (!withSystemd) [ "systemd-cat" ];
+        inputs =
+          [
+            binaries
+            coreutils
+            gnugrep
+            netcat-gnu
+            which
+          ]
+          ++ optionals withSystemd [systemd];
+        execer =
+          [
+            "cannot:${getBin binaries}/bin/msmtp"
+            "cannot:${getBin netcat-gnu}/bin/nc"
+          ]
+          ++ optionals withSystemd [
+            "cannot:${getBin systemd}/bin/systemd-cat"
+          ];
+        fix."$MSMTP" = ["msmtp"];
+        fake.external =
+          ["ping"]
+          ++ optionals (!withSystemd) ["systemd-cat"];
       };
 
       msmtp-queue = {
-        scripts = [ "bin/msmtp-queue" ];
+        scripts = ["bin/msmtp-queue"];
         interpreter = getExe bash;
-        inputs = [ "${placeholder "out"}/bin" ];
-        execer = [ "cannot:${placeholder "out"}/bin/msmtpq" ];
+        inputs = ["${placeholder "out"}/bin"];
+        execer = ["cannot:${placeholder "out"}/bin/msmtpq"];
       };
     };
   };
-
 in
-if withScripts then
-  symlinkJoin
-  {
-    name = "msmtp-${version}";
-    inherit version meta;
-    paths = [ binaries scripts ];
-    passthru = { inherit binaries scripts; };
-  } else binaries
+  if withScripts
+  then
+    symlinkJoin
+    {
+      name = "msmtp-${version}";
+      inherit version meta;
+      paths = [binaries scripts];
+      passthru = {inherit binaries scripts;};
+    }
+  else binaries
diff --git a/pkgs/mssql-tools.nix b/pkgs/mssql-tools.nix
index 9213c16..ecf2b37 100644
--- a/pkgs/mssql-tools.nix
+++ b/pkgs/mssql-tools.nix
@@ -1,52 +1,55 @@
 # Basado en derivación para skypeforlinux en nixpkgs
 # Ver environment.unixODBCDrivers
-
-{ lib, stdenv, fetchurl, dpkg, glibc, unixODBC }:
-let
+{
+  lib,
+  stdenv,
+  fetchurl,
+  dpkg,
+  glibc,
+  unixODBC,
+}: let
   version = "17.9.1.1-1";
   ubuntuRelease = "21.10";
 in
-stdenv.mkDerivation {
-  pname = "mssql-tools";
-  inherit version;
+  stdenv.mkDerivation {
+    pname = "mssql-tools";
+    inherit version;
 
-  system = "x86_64-linux";
+    system = "x86_64-linux";
 
-  src =
-    if stdenv.hostPlatform.system == "x86_64-linux" then
-      fetchurl
+    src =
+      if stdenv.hostPlatform.system == "x86_64-linux"
+      then
+        fetchurl
         {
           url = "https://packages.microsoft.com/ubuntu/${ubuntuRelease}/prod/pool/main/m/mssql-tools/mssql-tools_${version}_amd64.deb";
           sha256 = "0ya9643assr80yh6g0nd3i6iw819frhbb1m421khwplk9iq793kk";
         }
-    else
-      throw "mssql-tools is not supported on ${stdenv.hostPlatform.system}";
+      else throw "mssql-tools is not supported on ${stdenv.hostPlatform.system}";
 
-  buildInputs = [ dpkg ];
-  dontUnpack = true;
-  outputs = [ "out" "doc" ];
+    buildInputs = [dpkg];
+    dontUnpack = true;
+    outputs = ["out" "doc"];
 
-  installPhase = ''
-    mkdir -p $out
-    dpkg -x $src $out
-    mv $out/opt/mssql-tools/{bin,share} $out
-    mv $out/usr/share/doc/mssql-tools $doc
-    rm -r $out/opt $out/usr
-  '';
+    installPhase = ''
+      mkdir -p $out
+      dpkg -x $src $out
+      mv $out/opt/mssql-tools/{bin,share} $out
+      mv $out/usr/share/doc/mssql-tools $doc
+      rm -r $out/opt $out/usr
+    '';
 
-  postFixup =
-    let
-      rpath = lib.makeLibraryPath [ glibc stdenv.cc.cc unixODBC ];
-    in
-    ''
+    postFixup = let
+      rpath = lib.makeLibraryPath [glibc stdenv.cc.cc unixODBC];
+    in ''
       for file in $(find $out/bin -type f); do
         patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$file"
         patchelf --set-rpath ${rpath} $file
       done
     '';
 
-  meta = with lib; {
-    license = licenses.unfree;
-    platforms = [ "x86_64-linux" ];
-  };
-}
+    meta = with lib; {
+      license = licenses.unfree;
+      platforms = ["x86_64-linux"];
+    };
+  }
diff --git a/pkgs/oregano/default.nix b/pkgs/oregano/default.nix
index 5e2e872..14108d5 100644
--- a/pkgs/oregano/default.nix
+++ b/pkgs/oregano/default.nix
@@ -1,69 +1,75 @@
-{ fetchFromGitHub
-, glib
-, goocanvas2
-, gnucap
-, groff
-, gtk3
-, gtksourceview
-, intltool
-, libxml2
-, lib
-, makeWrapper
-, ngspice
-, perl
-, pkg-config
-, python3
-, stdenv
-, wafHook
-, wrapGAppsHook
-, useNgspice ? false
-}:
-let
+{
+  fetchFromGitHub,
+  glib,
+  goocanvas2,
+  gnucap,
+  groff,
+  gtk3,
+  gtksourceview,
+  intltool,
+  libxml2,
+  lib,
+  makeWrapper,
+  ngspice,
+  perl,
+  pkg-config,
+  python3,
+  stdenv,
+  wafHook,
+  wrapGAppsHook,
+  useNgspice ? false,
+}: let
   version = "0.84.43";
 in
-stdenv.mkDerivation {
-  pname = "oregano";
-  inherit version;
+  stdenv.mkDerivation {
+    pname = "oregano";
+    inherit version;
 
-  src = fetchFromGitHub {
-    owner = "drahnr";
-    repo = "oregano";
-    rev = "v${version}";
-    hash = "sha256-1GsL0N3O0clqdgkXoPKMhvW+y4Rzg4QSeOA54nH4kz4=";
-  };
+    src = fetchFromGitHub {
+      owner = "drahnr";
+      repo = "oregano";
+      rev = "v${version}";
+      hash = "sha256-1GsL0N3O0clqdgkXoPKMhvW+y4Rzg4QSeOA54nH4kz4=";
+    };
 
-  nativeBuildInputs = [ makeWrapper wafHook wrapGAppsHook ];
-  patches = [ ./check-cfg-gio-unix.patch ];
+    nativeBuildInputs = [makeWrapper wafHook wrapGAppsHook];
+    patches = [./check-cfg-gio-unix.patch];
 
-  buildInputs = [
-    glib
-    goocanvas2
-    groff
-    gtk3
-    gtksourceview
-    intltool
-    libxml2
-    perl
-    pkg-config
-    python3
-  ];
+    buildInputs = [
+      glib
+      goocanvas2
+      groff
+      gtk3
+      gtksourceview
+      intltool
+      libxml2
+      perl
+      pkg-config
+      python3
+    ];
 
-  postFixup = ''
-    wrapProgram $out/bin/oregano \
-      --suffix PATH : ${lib.makeBinPath [ (if useNgspice then ngspice else gnucap) ]}
-  '';
-
-  meta = with lib; {
-    description = "Schematic capture and circuit simulator";
-    longDescription = ''
-      Oregano is an application for schematic capture and simulation of
-      electronic circuits. The actual simulation is performed by Berkeley
-      Spice, GNUcap or the new generation ngspice.
+    postFixup = ''
+      wrapProgram $out/bin/oregano \
+        --suffix PATH : ${lib.makeBinPath [
+        (
+          if useNgspice
+          then ngspice
+          else gnucap
+        )
+      ]}
     '';
 
-    homepage = "https://github.com/drahnr/oregano/";
-    license = licenses.gpl2;
-    platforms = lib.platforms.linux;
-    maintainers = with maintainers; [ _3442 ];
-  };
-}
+    meta = with lib; {
+      description = "Schematic capture and circuit simulator";
+      longDescription = ''
+        Oregano is an application for schematic capture and simulation of
+        electronic circuits. The actual simulation is performed by Berkeley
+        Spice, GNUcap or the new generation ngspice.
+      '';
+
+      homepage = "https://github.com/drahnr/oregano/";
+      license = licenses.gpl2;
+      platforms = lib.platforms.linux;
+      maintainers = with maintainers; [_3442];
+    };
+  }
diff --git a/pkgs/pass-bcr/default.nix b/pkgs/pass-bcr/default.nix
index 6db814c..72d08fb 100644
--- a/pkgs/pass-bcr/default.nix
+++ b/pkgs/pass-bcr/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, ... }:
+{stdenv, ...}:
 stdenv.mkDerivation {
   pname = "pass-bcr";
   version = "1.0";
diff --git a/pkgs/pass-tail/default.nix b/pkgs/pass-tail/default.nix
index 61f207c..e664a93 100644
--- a/pkgs/pass-tail/default.nix
+++ b/pkgs/pass-tail/default.nix
@@ -1,6 +1,7 @@
-{ fetchFromGitHub
-, lib
-, stdenv
+{
+  fetchFromGitHub,
+  lib,
+  stdenv,
 }:
 stdenv.mkDerivation {
   pname = "pass-tail";
diff --git a/pkgs/postfix/default.nix b/pkgs/postfix/default.nix
index 39481e7..b625a71 100644
--- a/pkgs/postfix/default.nix
+++ b/pkgs/postfix/default.nix
@@ -1,7 +1,9 @@
-{ postfix }:
+{postfix}:
 postfix.overrideAttrs {
   # Nota: hay que cambiar prefix postfix/src/ -> src/ en el patch porque las release tarballs vienen así
-  patches = (postfix.patches or [ ]) ++ [
-    ./0001-smtpd-implement-CCERTS-action-for-access-5-tables.patch
-  ];
+  patches =
+    (postfix.patches or [])
+    ++ [
+      ./0001-smtpd-implement-CCERTS-action-for-access-5-tables.patch
+    ];
 }
diff --git a/pkgs/py-mini-racer.nix b/pkgs/py-mini-racer.nix
index 5f2bcbc..e51fbe8 100644
--- a/pkgs/py-mini-racer.nix
+++ b/pkgs/py-mini-racer.nix
@@ -1,20 +1,20 @@
-{ buildPythonPackage
-, fetchPypi
-, pytest
-, six
-, tox
-}:
-let
+{
+  buildPythonPackage,
+  fetchPypi,
+  pytest,
+  six,
+  tox,
+}: let
   pname = "py_mini_racer";
   version = "0.6.0";
 in
-buildPythonPackage {
-  inherit pname version;
-
-  src = fetchPypi {
+  buildPythonPackage {
     inherit pname version;
-    hash = "sha256-9x42tkPZR7ppjFfNm9IjLIPKmXsIAvwvf3lYI3cEDBE=";
-  };
 
-  doCheck = false;
-}
+    src = fetchPypi {
+      inherit pname version;
+      hash = "sha256-9x42tkPZR7ppjFfNm9IjLIPKmXsIAvwvf3lYI3cEDBE=";
+    };
+
+    doCheck = false;
+  }
diff --git a/pkgs/rqlite.nix b/pkgs/rqlite.nix
index 86468b4..4dd8f74 100644
--- a/pkgs/rqlite.nix
+++ b/pkgs/rqlite.nix
@@ -1,18 +1,21 @@
-{ lib, buildGoModule, fetchFromGitHub }:
-let
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}: let
   version = "7.5.0";
 in
-buildGoModule {
-  pname = "rqlite";
-  inherit version;
+  buildGoModule {
+    pname = "rqlite";
+    inherit version;
 
-  src = fetchFromGitHub {
-    owner = "rqlite";
-    repo = "rqlite";
-    rev = "v${version}";
-    sha256 = "0hi5kq8w26i8azlcxy750zmbciga6l5n090ir261n00djigm5m59";
-  };
+    src = fetchFromGitHub {
+      owner = "rqlite";
+      repo = "rqlite";
+      rev = "v${version}";
+      sha256 = "0hi5kq8w26i8azlcxy750zmbciga6l5n090ir261n00djigm5m59";
+    };
 
-  vendorHash = "sha256-YT1nK1vFmNCRJyWOiQhSJr83qW8uxkHXCZ81/Ch6qpg=";
-  doCheck = false;
-}
+    vendorHash = "sha256-YT1nK1vFmNCRJyWOiQhSJr83qW8uxkHXCZ81/Ch6qpg=";
+    doCheck = false;
+  }
diff --git a/pkgs/rv8.nix b/pkgs/rv8.nix
index 8527601..63579de 100644
--- a/pkgs/rv8.nix
+++ b/pkgs/rv8.nix
@@ -1,4 +1,11 @@
-{ callPackage, lib, fetchFromGitHub, stdenv, writeText, ... }:
+{
+  callPackage,
+  lib,
+  fetchFromGitHub,
+  stdenv,
+  writeText,
+  ...
+}:
 stdenv.mkDerivation {
   pname = "rv8";
   version = "master";
@@ -11,7 +18,7 @@ stdenv.mkDerivation {
     fetchSubmodules = true;
   };
 
-  makeFlags = [ "AR=${stdenv.cc.targetPrefix}ar" "DEST_DIR=$(out)" ];
+  makeFlags = ["AR=${stdenv.cc.targetPrefix}ar" "DEST_DIR=$(out)"];
 
   preInstall = ''
     mkdir -p $out/bin $out/lib
@@ -28,7 +35,7 @@ stdenv.mkDerivation {
        #include <map>
        #include <set>
       +#include <limits>
-     
+
        #include "util.h"
        #include "cmdline.h"
       diff --git a/src/gen/gen-fpu-test.cc b/src/gen/gen-fpu-test.cc
@@ -40,7 +47,7 @@ stdenv.mkDerivation {
        #include <map>
        #include <set>
       +#include <limits>
-     
+
        #include "util.h"
        #include "cmdline.h"
     '')
diff --git a/pkgs/scripts/clip.nix b/pkgs/scripts/clip.nix
index b801ccf..3e16e3e 100644
--- a/pkgs/scripts/clip.nix
+++ b/pkgs/scripts/clip.nix
@@ -1,44 +1,50 @@
-{ lib
-, writeShellScriptBin
-, gnome-screenshot
-, xclip
-, file
-, imagemagick
-, toPDF
-, ...
+{
+  lib,
+  writeShellScriptBin,
+  gnome-screenshot,
+  xclip,
+  file,
+  imagemagick,
+  toPDF,
+  ...
 }:
 with lib; let
-  name = if toPDF then "clip-pdf" else "clip";
+  name =
+    if toPDF
+    then "clip-pdf"
+    else "clip";
 
   pdfCmdline = optionalString toPDF ''
     if [ $# -lt 1 ]; then
       echo "Usage: $0 <out.pdf> [opts...]" >&2
       exit 1
     fi
-    
+
     OUT="$1"
     shift
   '';
 
   copyOut =
-    if toPDF then ''
+    if toPDF
+    then ''
       ${imagemagick}/bin/convert "$CLIP" "$OUT"
-    '' else ''
+    ''
+    else ''
       ${xclip}/bin/xclip -selection clipboard \
         -t $(${file}/bin/file -b --mime-type $CLIP) <"$CLIP"
     '';
 in
-writeShellScriptBin name ''
-  ${pdfCmdline}
+  writeShellScriptBin name ''
+    ${pdfCmdline}
+
+    OPTIONS=-a
+    if [ "x$@" != "x" ]; then
+      OPTIONS="$@"
+    fi
 
-  OPTIONS=-a
-  if [ "x$@" != "x" ]; then
-    OPTIONS="$@"
-  fi
-  
-  CLIP="$HOME/vtmp/$$.png"
-  ${gnome-screenshot}/bin/gnome-screenshot "$OPTIONS" -f "$CLIP"
-  ${copyOut}
+    CLIP="$HOME/vtmp/$$.png"
+    ${gnome-screenshot}/bin/gnome-screenshot "$OPTIONS" -f "$CLIP"
+    ${copyOut}
 
-  rm "$CLIP"
-''
+    rm "$CLIP"
+  ''
diff --git a/pkgs/scripts/default.nix b/pkgs/scripts/default.nix
index 43eae89..ed18647 100644
--- a/pkgs/scripts/default.nix
+++ b/pkgs/scripts/default.nix
@@ -1,9 +1,13 @@
-{ callPackage, symlinkJoin, ... }:
+{
+  callPackage,
+  symlinkJoin,
+  ...
+}:
 symlinkJoin {
   name = "scripts";
   paths = [
-    (callPackage ./clip.nix { toPDF = false; })
-    (callPackage ./clip.nix { toPDF = true; })
-    (callPackage ./merge-pdfs.nix { })
+    (callPackage ./clip.nix {toPDF = false;})
+    (callPackage ./clip.nix {toPDF = true;})
+    (callPackage ./merge-pdfs.nix {})
   ];
 }
diff --git a/pkgs/scripts/merge-pdfs.nix b/pkgs/scripts/merge-pdfs.nix
index 584505a..cb7d678 100644
--- a/pkgs/scripts/merge-pdfs.nix
+++ b/pkgs/scripts/merge-pdfs.nix
@@ -1,16 +1,20 @@
-{ writeShellScriptBin, pdftk, ... }:
+{
+  writeShellScriptBin,
+  pdftk,
+  ...
+}:
 writeShellScriptBin "merge-pdfs" ''
   set -e
   export PATH="$PATH:${pdftk}/bin"
-  
+
   if [ $# -lt 3 ]; then
     echo "Usage: $0 <output> <PDFs...>" >&2
     exit 1
   fi
-  
+
   OUTPUT="$1"
   shift
-  
+
   WORKDIR="$HOME/vtmp/merge-pdfs.$$"
   BOOKMARKS="$WORKDIR/bookmarks.txt"
   FMT="BookmarkBegin
@@ -18,9 +22,9 @@ writeShellScriptBin "merge-pdfs" ''
   BookmarkLevel: 1
   BookmarkPageNumber: 1
   "
- 
+
   mkdir "$WORKDIR"
- 
+
   N=0
   for SOURCE in "$@"; do
     BASE="$(basename "$SOURCE")"
@@ -28,7 +32,7 @@ writeShellScriptBin "merge-pdfs" ''
     pdftk "$SOURCE" update_info "$BOOKMARKS" output "$WORKDIR/"$(printf "%04d" $N).pdf
     N=$((N+1))
   done
- 
+
   pdftk "$WORKDIR"/*.pdf cat output "$OUTPUT"
   rm -r "$WORKDIR"
 ''
diff --git a/pkgs/simple-scalar/default.nix b/pkgs/simple-scalar/default.nix
index c0774d1..01e8ee4 100644
--- a/pkgs/simple-scalar/default.nix
+++ b/pkgs/simple-scalar/default.nix
@@ -1,5 +1,5 @@
-{ callPackage }: {
-  gcc-sslittle-na-sstrix = callPackage ./gcc-sslittle-na-sstrix.nix { };
-  simplesim = callPackage ./simplesim.nix { };
-  wattchg7 = callPackage ./simplesim.nix { isWattch = true; };
+{callPackage}: {
+  gcc-sslittle-na-sstrix = callPackage ./gcc-sslittle-na-sstrix.nix {};
+  simplesim = callPackage ./simplesim.nix {};
+  wattchg7 = callPackage ./simplesim.nix {isWattch = true;};
 }
diff --git a/pkgs/simple-scalar/gcc-sslittle-na-sstrix.nix b/pkgs/simple-scalar/gcc-sslittle-na-sstrix.nix
index 7ad3cbe..9cb6d30 100644
--- a/pkgs/simple-scalar/gcc-sslittle-na-sstrix.nix
+++ b/pkgs/simple-scalar/gcc-sslittle-na-sstrix.nix
@@ -1,35 +1,39 @@
 # https://www.cse.iitd.ac.in/~cs5070217/csl718/assignment1/ss_install_instructions.html
-{ bison, fetchurl, flex, multiStdenv, stdenv_32bit }:
-let
+{
+  bison,
+  fetchurl,
+  flex,
+  multiStdenv,
+  stdenv_32bit,
+}: let
   host = "i686-pc-linux";
   target = "sslittle-na-sstrix";
 
   gcc-version = "2.7.2.3";
   makeflags = "LANGUAGES=c CC=\"$CC -m32 $CFLAGS\" prefix=$out";
 in
-multiStdenv.mkDerivation {
-  pname = "gcc-sslittle-na-sstrix";
-  version = "1998-08-11"; # !!!
+  multiStdenv.mkDerivation {
+    pname = "gcc-sslittle-na-sstrix";
+    version = "1998-08-11"; # !!!
 
-  nativeBuildInputs = [ flex bison ];
+    nativeBuildInputs = [flex bison];
 
-  sourceRoot = ".";
+    sourceRoot = ".";
 
-  srcs = [
-    (fetchTarball {
-      name = "simpleutils-990811";
+    srcs = [
+      (fetchTarball {
+        name = "simpleutils-990811";
 
-      url = "https://www.cse.iitd.ac.in/~cs5070217/csl718/simpleutils-990811.tar.gz";
-      sha256 = "sha256:0w952z382s7ghrxwrad7fd058b1kj5ad1abh8idxwwk47va72cdf";
-    })
-  ];
+        url = "https://www.cse.iitd.ac.in/~cs5070217/csl718/simpleutils-990811.tar.gz";
+        sha256 = "sha256:0w952z382s7ghrxwrad7fd058b1kj5ad1abh8idxwwk47va72cdf";
+      })
+    ];
 
-  # El código es muy viejo y Nix usa opciones muy estrictas por defecto
-  CFLAGS = "-O3 -Wno-error=format-security";
+    # El código es muy viejo y Nix usa opciones muy estrictas por defecto
+    CFLAGS = "-O3 -Wno-error=format-security";
 
-  # Algunas tarballs vienen sin directorio de primer nivel y además requieren arreglos
-  postUnpack =
-    let
+    # Algunas tarballs vienen sin directorio de primer nivel y además requieren arreglos
+    postUnpack = let
       simpletools = fetchurl {
         url = "https://www.cse.iitd.ac.in/~cs5070217/csl718/simpletools-2v0.tgz";
         sha256 = "sha256-FTDTqyQWZCnuNPmTcu3Hcjgp4pHNoUcC0GOGhSJV9Iw=";
@@ -44,8 +48,7 @@ multiStdenv.mkDerivation {
         url = "https://www.cse.iitd.ac.in/~cs5070217/csl718/ar_and_ranlib.tar.gz";
         sha256 = "sha256-MRTO6cAg3WeXlk3jDy2lVuiSXDRz1+LLa2XDkBDygMU=";
       };
-    in
-    ''
+    in ''
       tar xf ${simpletools}
       rm -r gcc-2.6.3
 
@@ -57,50 +60,50 @@ multiStdenv.mkDerivation {
       chmod -R +w gcc-${gcc-version} ar-and-ranlib
     '';
 
-  patches = [
-    ./0001-fix-case-of-YY_CURRENT_BUFFER.patch
-    ./0002-define-sys_nerr.patch
-    ./0003-fix-obstack.h-post-increment.patch
-    ./0004-stdarg.h-instead-of-varargs.h.patch
-  ];
-
-  postPatch = ''
-    patchelf \
-      --set-interpreter "$(<${stdenv_32bit.cc}/nix-support/dynamic-linker-m32)" \
-      ar-and-ranlib/{ar,ranlib}
-  '';
-
-  configurePhase = ''
-    BUILD=$PWD
-
-    cd $BUILD/simpleutils-990811
-    ./configure --host=${host} --target=${target} --with-gnu-as --with-gnu-ld --prefix=$out
-
-    cd $BUILD/gcc-${gcc-version}
-    ./configure --host=${host} --target=${target} --with-gnu-as --with-gnu-ld --prefix=$out
-  '';
-
-  buildPhase = ''
-    make -C $BUILD/simpleutils-990811
-
-    # GCC necesita binutils para compilar
-    make -C $BUILD/simpleutils-990811 install
-    cp $BUILD/ar-and-ranlib/{ar,ranlib} $out/${target}/bin/
-
-    cd $BUILD/gcc-${gcc-version}
-
-    mkdir -p $out/lib
-    cp patched/sys/cdefs.h $BUILD/${target}/include/sys/cdefs.h
-    cp -r $BUILD/${target} $out/
-    cp $BUILD/${target}/lib/{libc.a,crt0.o} $out/lib/
-    sed -i '130s@-I/usr/include@-I./include@' Makefile
-
-    ! make ${makeflags}
-    sed -i 's/\(return "FIXME\\n\)/\1\\/g' insn-output.c
-    PATH="$out/${target}/bin:$PATH" make ${makeflags}
-  '';
-
-  installPhase = ''
-    PATH="$out/${target}/bin:$PATH" make -C $BUILD/gcc-${gcc-version} ${makeflags} install
-  '';
-}
+    patches = [
+      ./0001-fix-case-of-YY_CURRENT_BUFFER.patch
+      ./0002-define-sys_nerr.patch
+      ./0003-fix-obstack.h-post-increment.patch
+      ./0004-stdarg.h-instead-of-varargs.h.patch
+    ];
+
+    postPatch = ''
+      patchelf \
+        --set-interpreter "$(<${stdenv_32bit.cc}/nix-support/dynamic-linker-m32)" \
+        ar-and-ranlib/{ar,ranlib}
+    '';
+
+    configurePhase = ''
+      BUILD=$PWD
+
+      cd $BUILD/simpleutils-990811
+      ./configure --host=${host} --target=${target} --with-gnu-as --with-gnu-ld --prefix=$out
+
+      cd $BUILD/gcc-${gcc-version}
+      ./configure --host=${host} --target=${target} --with-gnu-as --with-gnu-ld --prefix=$out
+    '';
+
+    buildPhase = ''
+      make -C $BUILD/simpleutils-990811
+
+      # GCC necesita binutils para compilar
+      make -C $BUILD/simpleutils-990811 install
+      cp $BUILD/ar-and-ranlib/{ar,ranlib} $out/${target}/bin/
+
+      cd $BUILD/gcc-${gcc-version}
+
+      mkdir -p $out/lib
+      cp patched/sys/cdefs.h $BUILD/${target}/include/sys/cdefs.h
+      cp -r $BUILD/${target} $out/
+      cp $BUILD/${target}/lib/{libc.a,crt0.o} $out/lib/
+      sed -i '130s@-I/usr/include@-I./include@' Makefile
+
+      ! make ${makeflags}
+      sed -i 's/\(return "FIXME\\n\)/\1\\/g' insn-output.c
+      PATH="$out/${target}/bin:$PATH" make ${makeflags}
+    '';
+
+    installPhase = ''
+      PATH="$out/${target}/bin:$PATH" make -C $BUILD/gcc-${gcc-version} ${makeflags} install
+    '';
+  }
diff --git a/pkgs/simple-scalar/simplesim.nix b/pkgs/simple-scalar/simplesim.nix
index 3b73267..43bc656 100644
--- a/pkgs/simple-scalar/simplesim.nix
+++ b/pkgs/simple-scalar/simplesim.nix
@@ -1,19 +1,30 @@
-{ fetchFromGitHub, stdenv, isWattch ? false }:
+{
+  fetchFromGitHub,
+  stdenv,
+  isWattch ? false,
+}:
 stdenv.mkDerivation {
-  pname = if isWattch then "wattchg7" else "SimpleSim";
-  version = if isWattch then "master-2014-03-20" else "2003-10-08"; # !!!
+  pname =
+    if isWattch
+    then "wattchg7"
+    else "SimpleSim";
+  version =
+    if isWattch
+    then "master-2014-03-20"
+    else "2003-10-08"; # !!!
 
   src =
     if isWattch
     then
       fetchFromGitHub
-        {
-          repo = "wattchg7";
-          owner = "n-sreek";
+      {
+        repo = "wattchg7";
+        owner = "n-sreek";
 
-          rev = "b1c2c1447584b7e850c6dc0743a2209c9d021a39";
-          sha256 = "sha256-JMM2+6dgReSP3MKSC0ZOYt0Pcmef8DRzIkC26e4dk+Y=";
-        } else
+        rev = "b1c2c1447584b7e850c6dc0743a2209c9d021a39";
+        sha256 = "sha256-JMM2+6dgReSP3MKSC0ZOYt0Pcmef8DRzIkC26e4dk+Y=";
+      }
+    else
       fetchTarball {
         name = "simplesim-3.0";
 
@@ -25,11 +36,17 @@ stdenv.mkDerivation {
     make config-pisa
   '';
 
-  installPhase = ''
-    mkdir -p $out/bin
-  '' + (if isWattch then ''
-    cp sim-outorder $out/bin/wattch-outorder
-  '' else ''
-    cp {sim-{outorder,cache,profile,bpred,eio,safe,fast},sysprobe} $out/bin/
-  '');
+  installPhase =
+    ''
+      mkdir -p $out/bin
+    ''
+    + (
+      if isWattch
+      then ''
+        cp sim-outorder $out/bin/wattch-outorder
+      ''
+      else ''
+        cp {sim-{outorder,cache,profile,bpred,eio,safe,fast},sysprobe} $out/bin/
+      ''
+    );
 }
diff --git a/pkgs/smartthinq-sensors.nix b/pkgs/smartthinq-sensors.nix
index 20a2cdc..864df52 100644
--- a/pkgs/smartthinq-sensors.nix
+++ b/pkgs/smartthinq-sensors.nix
@@ -1,31 +1,31 @@
-{ buildHomeAssistantComponent
-, callPackage
-, fetchFromGitHub
-, charset-normalizer
-, pycountry
-, xmltodict
-}:
-let
+{
+  buildHomeAssistantComponent,
+  callPackage,
+  fetchFromGitHub,
+  charset-normalizer,
+  pycountry,
+  xmltodict,
+}: let
   version = "0.39.2";
 in
-buildHomeAssistantComponent {
-  owner = "ollo69";
-  domain = "smartthinq_sensors";
-  inherit version;
-
-  src = fetchFromGitHub {
-    repo = "ha-smartthinq-sensors";
+  buildHomeAssistantComponent {
     owner = "ollo69";
+    domain = "smartthinq_sensors";
+    inherit version;
+
+    src = fetchFromGitHub {
+      repo = "ha-smartthinq-sensors";
+      owner = "ollo69";
 
-    rev = "v${version}";
-    hash = "sha256-tLq4sqeKmjEDDaowA8ouH/mI7jQfq49kkt/a8+40rhQ=";
-  };
+      rev = "v${version}";
+      hash = "sha256-tLq4sqeKmjEDDaowA8ouH/mI7jQfq49kkt/a8+40rhQ=";
+    };
 
-  dontBuild = true;
+    dontBuild = true;
 
-  propagatedBuildInputs = [
-    charset-normalizer
-    pycountry
-    xmltodict
-  ];
-}
+    propagatedBuildInputs = [
+      charset-normalizer
+      pycountry
+      xmltodict
+    ];
+  }
diff --git a/pkgs/spliit/default.nix b/pkgs/spliit/default.nix
index 3f05ad2..5ac56b1 100644
--- a/pkgs/spliit/default.nix
+++ b/pkgs/spliit/default.nix
@@ -1,8 +1,9 @@
-{ buildNpmPackage
-, fetchFromGitHub
-, nodePackages
-, lib
-, writeShellScriptBin
+{
+  buildNpmPackage,
+  fetchFromGitHub,
+  nodePackages,
+  lib,
+  writeShellScriptBin,
 }:
 buildNpmPackage {
   pname = "spliit2";
@@ -17,7 +18,7 @@ buildNpmPackage {
   };
 
   npmDepsHash = "sha256-sd0/7ruNUFxUKTeTwx/v8Vc/G3llkXP6RSDE78h3qVU=";
-  npmRebuildFlags = [ "--ignore-scripts" ];
+  npmRebuildFlags = ["--ignore-scripts"];
 
   doCheck = false;
 
@@ -35,29 +36,29 @@ buildNpmPackage {
   '';
 
   postInstall = ''
-        install -Dvm755 -t $out/bin ${lib.getExe (writeShellScriptBin "spliit2" ''
-          set -euxo pipefail
-    	
-          cd @out@/lib/node_modules/spliit2
+    install -Dvm755 -t $out/bin ${lib.getExe (writeShellScriptBin "spliit2" ''
+      set -euxo pipefail
 
-          export PATH="$PWD/node_modules/.bin:$PATH"
-          export NEXT_TELEMETRY_DISABLED=1
+      cd @out@/lib/node_modules/spliit2
 
-          prisma migrate deploy
-          exec next start
-        '')}
+      export PATH="$PWD/node_modules/.bin:$PATH"
+      export NEXT_TELEMETRY_DISABLED=1
 
-        #kk?
-        #${lib.getExe nodePackages.prisma} migrate deploy
+      prisma migrate deploy
+      exec next start
+    '')}
 
-        substituteInPlace $out/bin/spliit2 \
-          --replace @out@ $out
+    #kk?
+    #${lib.getExe nodePackages.prisma} migrate deploy
+
+    substituteInPlace $out/bin/spliit2 \
+      --replace @out@ $out
   '';
 
   meta = {
     description = "Free and Open Source Alternative to Splitwise. Share expenses with your friends and family.";
     homepage = "https://spliit.app";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ ];
+    maintainers = with lib.maintainers; [];
   };
 }
diff --git a/pkgs/st.nix b/pkgs/st.nix
index 117b94c..11ae230 100644
--- a/pkgs/st.nix
+++ b/pkgs/st.nix
@@ -1,5 +1,4 @@
-{}:
-''
+{}: ''
   /* See LICENSE file for copyright and license details. */
 
   /*
diff --git a/pkgs/tmux-lift/default.nix b/pkgs/tmux-lift/default.nix
index 3c86176..3a00f97 100644
--- a/pkgs/tmux-lift/default.nix
+++ b/pkgs/tmux-lift/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, ... }:
+{stdenv, ...}:
 stdenv.mkDerivation {
   name = "tmux-lift";
   version = "1.0.0";
diff --git a/pkgs/tmux-open/default.nix b/pkgs/tmux-open/default.nix
index e2c799c..1f882b4 100644
--- a/pkgs/tmux-open/default.nix
+++ b/pkgs/tmux-open/default.nix
@@ -1,11 +1,12 @@
-{ jq
-, substituteAll
-, sway
-, tmux
-, writeShellScriptBin
-, ...
+{
+  jq,
+  substituteAll,
+  sway,
+  tmux,
+  writeShellScriptBin,
+  ...
 }:
 writeShellScriptBin "tmux-open" (builtins.readFile (substituteAll {
   src = ./tmux-open.sh;
-  env = { inherit jq sway tmux; };
+  env = {inherit jq sway tmux;};
 }))
diff --git a/pkgs/tmux-pass.nix b/pkgs/tmux-pass.nix
index 608ad95..0c079c2 100644
--- a/pkgs/tmux-pass.nix
+++ b/pkgs/tmux-pass.nix
@@ -1,7 +1,8 @@
-{ fetchFromGitHub
-, fzf
-, pass
-, tmuxPlugins
+{
+  fetchFromGitHub,
+  fzf,
+  pass,
+  tmuxPlugins,
 }:
 tmuxPlugins.mkTmuxPlugin {
   pluginName = "tmux-pass";
diff --git a/pkgs/xandikos/default.nix b/pkgs/xandikos/default.nix
index 0810efa..4c5d7d8 100644
--- a/pkgs/xandikos/default.nix
+++ b/pkgs/xandikos/default.nix
@@ -1,6 +1,7 @@
-{ xandikos
-, systemd
+{
+  xandikos,
+  systemd,
 }:
 xandikos.overridePythonAttrs (super: {
-  dependencies = super.dependencies ++ [ systemd ];
+  dependencies = super.dependencies ++ [systemd];
 })
diff --git a/pki/by-path.nix b/pki/by-path.nix
index baca142..ebc46ef 100644
--- a/pki/by-path.nix
+++ b/pki/by-path.nix
@@ -1,15 +1,18 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; {
   options.local.pki.byPath = mkOption {
     type = with lib.types; attrsOf unspecified;
     readOnly = true;
   };
 
-  config.local.pki.byPath =
-    let
-      caWithLeaves = ca:
-        singleton { "${ca.path}" = ca; }
-        ++ map (leaf: { "${leaf.path}" = leaf; }) (attrValues ca.leaves);
-    in
+  config.local.pki.byPath = let
+    caWithLeaves = ca:
+      singleton {"${ca.path}" = ca;}
+      ++ map (leaf: {"${leaf.path}" = leaf;}) (attrValues ca.leaves);
+  in
     mergeAttrsList (flatten (map caWithLeaves (attrValues config.local.pki.ca)));
 }
diff --git a/pki/ca.nix b/pki/ca.nix
index f0ca33d..f8e5847 100644
--- a/pki/ca.nix
+++ b/pki/ca.nix
@@ -1,105 +1,127 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.pki.ca;
 
   openssl = getExe pkgs.buildPackages.openssl;
 
-  certsType = leafOf: with lib.types; attrsOf (submodule ({ config, name, ... }: {
-    options = {
-      cert = mkOption {
-        type = path;
-        readOnly = true;
-      };
+  certsType = leafOf:
+    with lib.types;
+      attrsOf (submodule ({
+        config,
+        name,
+        ...
+      }: {
+        options =
+          {
+            cert = mkOption {
+              type = path;
+              readOnly = true;
+            };
 
-      fingerprint = {
-        sha1-lower = mkOption {
-          type = str;
-          readOnly = true;
-        };
+            fingerprint = {
+              sha1-lower = mkOption {
+                type = str;
+                readOnly = true;
+              };
 
-        sha256-bytes-upper = mkOption {
-          type = str;
-          readOnly = true;
-        };
-      };
+              sha256-bytes-upper = mkOption {
+                type = str;
+                readOnly = true;
+              };
+            };
 
-      fullchain = mkOption {
-        type = path;
-        readOnly = true;
-      };
+            fullchain = mkOption {
+              type = path;
+              readOnly = true;
+            };
 
-      issuer = mkOption {
-        type = nullOr str;
-        readOnly = true;
-      };
+            issuer = mkOption {
+              type = nullOr str;
+              readOnly = true;
+            };
 
-      path = mkOption {
-        type = str;
-        readOnly = true;
-      };
-    } // optionalAttrs (leafOf != null) {
-      commonName = mkOption {
-        type = str;
-        readOnly = true;
-      };
-    } // optionalAttrs (leafOf == null) {
-      crl = mkOption {
-        type = path;
-        readOnly = true;
-      };
+            path = mkOption {
+              type = str;
+              readOnly = true;
+            };
+          }
+          // optionalAttrs (leafOf != null) {
+            commonName = mkOption {
+              type = str;
+              readOnly = true;
+            };
+          }
+          // optionalAttrs (leafOf == null) {
+            crl = mkOption {
+              type = path;
+              readOnly = true;
+            };
 
-      certWithCrl = mkOption {
-        type = path;
-        readOnly = true;
-      };
+            certWithCrl = mkOption {
+              type = path;
+              readOnly = true;
+            };
 
-      leaves = mkOption {
-        type = certsType name;
-        readOnly = true;
-      };
-    };
+            leaves = mkOption {
+              type = certsType name;
+              readOnly = true;
+            };
+          };
 
-    config = {
-      fingerprint = {
-        sha1-lower = readFile (pkgs.runCommandNoCCLocal "cert-${config.path}-fprint-sha1-lower" { } ''
-          ${openssl} x509 -in ${config.cert} -noout -sha1 -fingerprint \
-            | sed 's/^.*=//' \
-            | tr -d $':\n' \
-            | tr '[A-Z]' '[a-z]' \
-            >>$out
-        '');
+        config =
+          {
+            fingerprint = {
+              sha1-lower = readFile (pkgs.runCommandNoCCLocal "cert-${config.path}-fprint-sha1-lower" {} ''
+                ${openssl} x509 -in ${config.cert} -noout -sha1 -fingerprint \
+                  | sed 's/^.*=//' \
+                  | tr -d $':\n' \
+                  | tr '[A-Z]' '[a-z]' \
+                  >>$out
+              '');
 
-        sha256-bytes-upper = readFile (pkgs.runCommandNoCCLocal "cert-${config.path}-fprint-sha256-bytes-upper" { } ''
-          ${openssl} x509 -in ${config.cert} -noout -sha256 -fingerprint \
-            | sed 's/^.*=//' \
-            | tr -d $'\n' \
-            >>$out
-        '');
-      };
+              sha256-bytes-upper = readFile (pkgs.runCommandNoCCLocal "cert-${config.path}-fprint-sha256-bytes-upper" {} ''
+                ${openssl} x509 -in ${config.cert} -noout -sha256 -fingerprint \
+                  | sed 's/^.*=//' \
+                  | tr -d $'\n' \
+                  >>$out
+              '');
+            };
 
-      fullchain = pkgs.writeText "${name}-fullchain-crl.pem"
-        (concatStrings (map readFile
-          (singleton (if leafOf != null then config.cert else config.certWithCrl)
-            ++ optional (config.issuer != null) cfg.${config.issuer}.fullchain)));
+            fullchain =
+              pkgs.writeText "${name}-fullchain-crl.pem"
+              (concatStrings (map readFile
+                (singleton (
+                    if leafOf != null
+                    then config.cert
+                    else config.certWithCrl
+                  )
+                  ++ optional (config.issuer != null) cfg.${config.issuer}.fullchain)));
 
-      path = optionalString (config.issuer != null) (cfg.${config.issuer}.path + ".") + name;
-    } // optionalAttrs (leafOf != null) {
-      commonName = readFile (pkgs.runCommandNoCCLocal "cert-${config.path}-common-name" { } ''
-        ${openssl} x509 -in ${config.cert} -noout -subject -nameopt multiline \
-          | grep commonName \
-          | sed 's/^.*=\s*//' \
-          | tr -d $'\n' \
-          >$out
-      '');
+            path = optionalString (config.issuer != null) (cfg.${config.issuer}.path + ".") + name;
+          }
+          // optionalAttrs (leafOf != null) {
+            commonName = readFile (pkgs.runCommandNoCCLocal "cert-${config.path}-common-name" {} ''
+              ${openssl} x509 -in ${config.cert} -noout -subject -nameopt multiline \
+                | grep commonName \
+                | sed 's/^.*=\s*//' \
+                | tr -d $'\n' \
+                >$out
+            '');
 
-      issuer = leafOf;
-    } // optionalAttrs (leafOf == null) {
-      certWithCrl = pkgs.writeText "${name}-cert-crl.pem"
-        (concatStrings (map readFile [ config.cert config.crl ]));
-    };
-  }));
-in
-{
+            issuer = leafOf;
+          }
+          // optionalAttrs (leafOf == null) {
+            certWithCrl =
+              pkgs.writeText "${name}-cert-crl.pem"
+              (concatStrings (map readFile [config.cert config.crl]));
+          };
+      }));
+in {
   options.local.pki.ca = mkOption {
     type = certsType null;
     readOnly = true;
diff --git a/sys/auth/login.nix b/sys/auth/login.nix
index 5bc8f2e..f252c1c 100644
--- a/sys/auth/login.nix
+++ b/sys/auth/login.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; {
   # TODO
   config = mkIf true {
diff --git a/sys/auth/oath.nix b/sys/auth/oath.nix
index 7030bab..6b00680 100644
--- a/sys/auth/oath.nix
+++ b/sys/auth/oath.nix
@@ -1,8 +1,12 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.auth.oath;
-in
-{
+in {
   options.local.auth.oath = {
     enable = lib.mkEnableOption "pam-oath";
   };
diff --git a/sys/auth/openssh.nix b/sys/auth/openssh.nix
index 07e6977..44fb49a 100644
--- a/sys/auth/openssh.nix
+++ b/sys/auth/openssh.nix
@@ -1,15 +1,22 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.auth.openssh;
   withOath = config.local.auth.oath.enable;
   withPassword = config.local.auth.openssh.passwordAuthentication;
 
-  port = if cfg.shiftPortNumber then 2234 else 22;
+  port =
+    if cfg.shiftPortNumber
+    then 2234
+    else 22;
   restrict = cfg.restrictListen;
 
   exemptList = optionals config.local.net.fail2ban.enable config.services.fail2ban.ignoreIP;
-in
-{
+in {
   options.local.auth.openssh = {
     enable = mkEnableOption "openssh";
     tunnel.enable = mkEnableOption "ssh tunnel user";
@@ -23,28 +30,29 @@ in
           type = types.bool;
           default = false;
         };
-      }) [ "ecdsa" "ed25519" "rsa" ]);
+      }) ["ecdsa" "ed25519" "rsa"]);
 
     restrictListen = mkOption {
       default = null;
 
-      type = with types; nullOr (submodule {
-        options = {
-          addresses = mkOption {
-            type = listOf str;
+      type = with types;
+        nullOr (submodule {
+          options = {
+            addresses = mkOption {
+              type = listOf str;
+            };
+
+            interface = mkOption {
+              type = nullOr str;
+              default = null;
+            };
+
+            vsockCid = mkOption {
+              type = nullOr ints.u32;
+              default = null;
+            };
           };
-
-          interface = mkOption {
-            type = nullOr str;
-            default = null;
-          };
-
-          vsockCid = mkOption {
-            type = nullOr ints.u32;
-            default = null;
-          };
-        };
-      });
+        });
     };
 
     passwordAuthentication = mkOption {
@@ -70,7 +78,7 @@ in
         message = "SSH tunnel requires oath";
       }
       {
-        assertion = restrict != null -> (restrict.vsockCid != null -> (restrict.interface == null && restrict.addresses == [ ]));
+        assertion = restrict != null -> (restrict.vsockCid != null -> (restrict.interface == null && restrict.addresses == []));
         message = "SSH vsock restrict requires disabling inet";
       }
       {
@@ -88,11 +96,11 @@ in
     ];
 
     local.boot.impermanence.files =
-      flatten (map (key: [ key.path "${key.path}.pub" ]) config.services.openssh.hostKeys);
+      flatten (map (key: [key.path "${key.path}.pub"]) config.services.openssh.hostKeys);
 
     networking.firewall = {
       interfaces = optionalAttrs (restrict != null && restrict.interface != null) {
-        ${restrict.interface}.allowedTCPPorts = [ port ];
+        ${restrict.interface}.allowedTCPPorts = [port];
       };
 
       allowedTCPPorts = optional (restrict == null || restrict.interface == null) port;
@@ -101,36 +109,41 @@ in
     services.openssh = {
       enable = true;
 
-      ports = optional (restrict != null -> restrict.addresses != [ ]) port;
+      ports = optional (restrict != null -> restrict.addresses != []) port;
       startWhenNeeded = mkDefault (!config.services.fail2ban.enable);
 
-      extraConfig = optionalString (exemptList != [ ]) ''
-        PerSourcePenaltyExemptList ${concatStringsSep "," exemptList}
-      '' + optionalString cfg.tunnel.enable ''
-        # User 'tunnel' has no password. Use PAM OATH
-        # and connect with -N, forward with -R.
-        Match User tunnel
-           AllowTcpForwarding remote
-           AllowStreamLocalForwarding no
-           X11Forwarding no
-           PermitTunnel no
-           GatewayPorts no
-           AllowAgentForwarding no
-           PermitOpen none
-           PermitListen 60220 60221 60222 60223 60224 60225 60226 60227 60228 60229
-
-           Banner ${pkgs.writeText "tunnel-banner" ''
-             This is a reverse tunnel
-           ''}
-      '';
-
-      hostKeys = map
-        (name: {
-          path = "/etc/ssh/ssh_host_${name}_key";
-          type = name;
-        } // optionalAttrs (name == "rsa") {
-          bits = 4096;
-        })
+      extraConfig =
+        optionalString (exemptList != []) ''
+          PerSourcePenaltyExemptList ${concatStringsSep "," exemptList}
+        ''
+        + optionalString cfg.tunnel.enable ''
+          # User 'tunnel' has no password. Use PAM OATH
+          # and connect with -N, forward with -R.
+          Match User tunnel
+             AllowTcpForwarding remote
+             AllowStreamLocalForwarding no
+             X11Forwarding no
+             PermitTunnel no
+             GatewayPorts no
+             AllowAgentForwarding no
+             PermitOpen none
+             PermitListen 60220 60221 60222 60223 60224 60225 60226 60227 60228 60229
+
+             Banner ${pkgs.writeText "tunnel-banner" ''
+            This is a reverse tunnel
+          ''}
+        '';
+
+      hostKeys =
+        map
+        (name:
+          {
+            path = "/etc/ssh/ssh_host_${name}_key";
+            type = name;
+          }
+          // optionalAttrs (name == "rsa") {
+            bits = 4096;
+          })
         (attrNames (filterAttrs (name: enable: enable) cfg.hostKeys));
 
       settings = {
@@ -139,26 +152,29 @@ in
         PasswordAuthentication = withOath || withPassword; # Necesario para oath, no reemplaza a oath
       };
 
-      listenAddresses = mkIf (restrict != null)
-        (map (addr: { inherit addr; }) restrict.addresses);
+      listenAddresses =
+        mkIf (restrict != null)
+        (map (addr: {inherit addr;}) restrict.addresses);
     };
 
     systemd.sockets = mkIf (restrict != null && restrict.vsockCid != null) {
-      sshd =
-        let
-          kernelMod = "modprobe@${if restrict.vsockCid == 2 then "vhost_" else ""}vsock.service";
-        in
-        {
-          after = [ kernelMod ];
-          wants = [ kernelMod ];
-
-          socketConfig.ListenStream = mkForce [ "vsock:${toString restrict.vsockCid}:${toString port}" ];
-        };
+      sshd = let
+        kernelMod = "modprobe@${
+          if restrict.vsockCid == 2
+          then "vhost_"
+          else ""
+        }vsock.service";
+      in {
+        after = [kernelMod];
+        wants = [kernelMod];
+
+        socketConfig.ListenStream = mkForce ["vsock:${toString restrict.vsockCid}:${toString port}"];
+      };
     };
 
     users.users = {
       root = mkIf cfg.withDeployKeys {
-        openssh.authorizedKeys.keyFiles = [ ./ssh-key.pub ];
+        openssh.authorizedKeys.keyFiles = [./ssh-key.pub];
       };
 
       tunnel = mkIf cfg.tunnel.enable {
diff --git a/sys/baseline/default.nix b/sys/baseline/default.nix
index 3a425f7..96654d8 100644
--- a/sys/baseline/default.nix
+++ b/sys/baseline/default.nix
@@ -1,4 +1,10 @@
-{ config, flakes, lib, pkgs, ... }:
+{
+  config,
+  flakes,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; {
   config = {
     # This value determines the NixOS release from which the default
@@ -10,30 +16,32 @@ with lib; {
     system.stateVersion = "21.11"; # Did you read the comment?
 
     environment = {
-      pathsToLink = [ "/share/zsh" ];
-
-      systemPackages = with pkgs; [
-        git
-      ] ++ optionals (!config.boot.isContainer) [
-        lm_sensors
-        lshw
-        parted
-        pciutils
-        smartmontools
-        usbutils
-      ];
+      pathsToLink = ["/share/zsh"];
+
+      systemPackages = with pkgs;
+        [
+          git
+        ]
+        ++ optionals (!config.boot.isContainer) [
+          lm_sensors
+          lshw
+          parted
+          pciutils
+          smartmontools
+          usbutils
+        ];
     };
 
     home-manager = {
       useGlobalPkgs = true;
       useUserPackages = true;
 
-      extraSpecialArgs = { inherit flakes; };
+      extraSpecialArgs = {inherit flakes;};
     };
 
     lib.local = pkgs.local.lib;
 
-    local.boot.impermanence.directories = [ "/var/lib/dhparams" ];
+    local.boot.impermanence.directories = ["/var/lib/dhparams"];
 
     nix = {
       package = pkgs.nix;
diff --git a/sys/boot/chain.nix b/sys/boot/chain.nix
index aeb3bbe..43edcb4 100644
--- a/sys/boot/chain.nix
+++ b/sys/boot/chain.nix
@@ -1,11 +1,15 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.boot;
-in
-{
+in {
   options.local.boot = {
     loader = mkOption {
-      type = types.enum [ "none" "grub" "systemd-boot" ];
+      type = types.enum ["none" "grub" "systemd-boot"];
     };
 
     kernel = mkOption {
@@ -18,13 +22,15 @@ in
       kernelPackages = cfg.kernel;
 
       loader =
-        if cfg.loader == "grub" then {
+        if cfg.loader == "grub"
+        then {
           grub = {
             enable = true;
             device = "nodev";
             efiSupport = true;
           };
-        } else {
+        }
+        else {
           systemd-boot = {
             enable = true;
             editor = true;
diff --git a/sys/boot/detached-luks.nix b/sys/boot/detached-luks.nix
index 8be7de1..78ae35c 100644
--- a/sys/boot/detached-luks.nix
+++ b/sys/boot/detached-luks.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.boot.detachedLuks;
 
@@ -6,8 +11,7 @@ with lib; let
   tpmInitrd = config.local.boot.tpm.initrd.enable;
 
   pcrList = concatStringsSep "," (map toString config.local.boot.tpm.initrd.pcrs);
-in
-{
+in {
   options.local.boot.detachedLuks = {
     enable = mkEnableOption "detached LUKS header in initrd";
 
@@ -30,43 +34,43 @@ in
   };
 
   config = mkIf cfg.enable {
-    boot.initrd =
-      let
-        headerPath = "/initrd-boot/${cfg.headerFromBoot}";
-        headerPathEscaped = escapeShellArg headerPath;
-
-        tpmPath = escapeShellArg "/initrd-boot/${cfg.tpmStorageFromBoot}";
-        hardwareKeyPath = "/tpm/unsealed.luks-key";
-      in
-      {
-        preDeviceCommands = ''
-          mkdir -p `dirname ${headerPathEscaped}`
-          touch ${headerPathEscaped}
-        '';
-
-        postDeviceCommands = mkIf (!config.boot.initrd.systemd.enable) ''
-          # Set the system time from the hardware clock to work around a
-          # bug in qemu-kvm > 1.5.2 (where the VM clock is initialised
-          # to the *boot time* of the host).
-          hwclock -s
-        '';
-
-        #FIXME: Demasiado vulgar
-        preLVMCommands = optionalString (config.local.boot.efi.enable && config.local.boot.efi.removable) ''
-          sleep 2
-        '';
-
-        luks.devices.${cfg.target} = {
-          device = cfg.crypt;
-          header = headerPath;
-          preLVM = false;
-
-          keyFile = mkIf tpmInitrd hardwareKeyPath;
-          fallbackToPassword = tpmInitrd;
-
-          preOpenCommands = ''
+    boot.initrd = let
+      headerPath = "/initrd-boot/${cfg.headerFromBoot}";
+      headerPathEscaped = escapeShellArg headerPath;
+
+      tpmPath = escapeShellArg "/initrd-boot/${cfg.tpmStorageFromBoot}";
+      hardwareKeyPath = "/tpm/unsealed.luks-key";
+    in {
+      preDeviceCommands = ''
+        mkdir -p `dirname ${headerPathEscaped}`
+        touch ${headerPathEscaped}
+      '';
+
+      postDeviceCommands = mkIf (!config.boot.initrd.systemd.enable) ''
+        # Set the system time from the hardware clock to work around a
+        # bug in qemu-kvm > 1.5.2 (where the VM clock is initialised
+        # to the *boot time* of the host).
+        hwclock -s
+      '';
+
+      #FIXME: Demasiado vulgar
+      preLVMCommands = optionalString (config.local.boot.efi.enable && config.local.boot.efi.removable) ''
+        sleep 2
+      '';
+
+      luks.devices.${cfg.target} = {
+        device = cfg.crypt;
+        header = headerPath;
+        preLVM = false;
+
+        keyFile = mkIf tpmInitrd hardwareKeyPath;
+        fallbackToPassword = tpmInitrd;
+
+        preOpenCommands =
+          ''
             mount -o ro -t ${bootFs.fsType} ${bootFs.device} /initrd-boot
-          '' + optionalString tpmInitrd ''
+          ''
+          + optionalString tpmInitrd ''
             mkdir /tpm
             touch ${escapeShellArg hardwareKeyPath}
 
@@ -92,18 +96,19 @@ in
             unseal_tpm_key
           '';
 
-          postOpenCommands = mkBefore (''
+        postOpenCommands = mkBefore (''
             umount /initrd-boot
-          '' + optionalString tpmInitrd ''
+          ''
+          + optionalString tpmInitrd ''
             rm -r /tpm
           '');
-        };
       };
+    };
 
     local.boot = {
       stack = {
         btrfsToplevelMultidrive.toplevel.device = "/dev/mapper/${cfg.target}";
-        luksExt4FscryptImpermanence = { inherit (cfg) target; };
+        luksExt4FscryptImpermanence = {inherit (cfg) target;};
       };
 
       tpm.initrd.enable = mkDefault config.local.boot.tpm.enable;
diff --git a/sys/boot/efi.nix b/sys/boot/efi.nix
index cbcefd9..71c42c8 100644
--- a/sys/boot/efi.nix
+++ b/sys/boot/efi.nix
@@ -1,14 +1,17 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   cfg = config.local.boot.efi;
-in
-{
+in {
   options.local.boot.efi = {
     enable = mkEnableOption "EFI with FAT32 system partition";
 
     esp = {
       mountpoint = mkOption {
-        type = types.enum [ "/boot" "/boot/efi" ];
+        type = types.enum ["/boot" "/boot/efi"];
         default = "/boot";
       };
 
@@ -24,7 +27,7 @@ in
 
   config = mkIf cfg.enable {
     boot = {
-      initrd.supportedFilesystems = [ "vfat" ];
+      initrd.supportedFilesystems = ["vfat"];
 
       loader = {
         efi = {
@@ -39,7 +42,7 @@ in
     fileSystems.${cfg.esp.mountpoint} = {
       device = "/dev/disk/by-uuid/${cfg.esp.uuid}";
       fsType = "vfat";
-      options = [ "noatime" "umask=027" "sync" ];
+      options = ["noatime" "umask=027" "sync"];
       neededForBoot = true;
     };
   };
diff --git a/sys/boot/firmware.nix b/sys/boot/firmware.nix
index 70a3c4b..b3598a7 100644
--- a/sys/boot/firmware.nix
+++ b/sys/boot/firmware.nix
@@ -1,15 +1,19 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.boot.firmware;
-in
-{
+in {
   options.local.boot.firmware = {
     mode = mkOption {
-      type = types.enum [ "none" "redistributable" "all" ];
+      type = types.enum ["none" "redistributable" "all"];
     };
 
     cpuVendor = mkOption {
-      type = types.enum [ "amd" "intel" ];
+      type = types.enum ["amd" "intel"];
     };
   };
 
diff --git a/sys/boot/fscrypt.nix b/sys/boot/fscrypt.nix
index e6a745c..459e02b 100644
--- a/sys/boot/fscrypt.nix
+++ b/sys/boot/fscrypt.nix
@@ -1,18 +1,25 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.boot.fscrypt;
-in
-{
+in {
   options.local.boot.fscrypt = {
     enable = mkEnableOption "fscrypt support";
   };
 
   config = mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.fscrypt-experimental ];
+    environment.systemPackages = [pkgs.fscrypt-experimental];
 
     local.boot.impermanence = {
       directories = [
-        { directory = "/.fscrypt"; mode = "u=rwx,g=rx,o=rx"; }
+        {
+          directory = "/.fscrypt";
+          mode = "u=rwx,g=rx,o=rx";
+        }
       ];
 
       files = [
diff --git a/sys/boot/impermanence.nix b/sys/boot/impermanence.nix
index 4902239..632094b 100644
--- a/sys/boot/impermanence.nix
+++ b/sys/boot/impermanence.nix
@@ -1,8 +1,11 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   cfg = config.local.boot.impermanence;
-in
-{
+in {
   options.local.boot.impermanence = {
     enable = mkEnableOption "root fs impermanence";
 
@@ -10,12 +13,12 @@ in
 
     directories = mkOption {
       type = with lib.types; listOf (either str attrs);
-      default = [ ];
+      default = [];
     };
 
     files = mkOption {
       type = with lib.types; listOf (either str attrs);
-      default = [ ];
+      default = [];
     };
   };
 
diff --git a/sys/boot/namespaced.nix b/sys/boot/namespaced.nix
index db01d55..3f95960 100644
--- a/sys/boot/namespaced.nix
+++ b/sys/boot/namespaced.nix
@@ -1,8 +1,12 @@
-{ config, lib, options, ... }:
+{
+  config,
+  lib,
+  options,
+  ...
+}:
 with lib; let
   cfg = config.local.boot.namespaced;
-in
-{
+in {
   options.local.boot.namespaced = {
     enable = mkEnableOption "system containerization";
   };
@@ -11,15 +15,16 @@ in
     boot.isContainer = true;
 
     local.boot = mkMerge ([
-      {
-        loader = mkForce "none";
+        {
+          loader = mkForce "none";
 
-        efi.enable = mkForce false;
-        firmware.mode = mkForce "none";
-        secureBoot.enable = mkForce false;
-        impermanence.enable = mkForce false;
-      }
-    ] ++ map
+          efi.enable = mkForce false;
+          firmware.mode = mkForce "none";
+          secureBoot.enable = mkForce false;
+          impermanence.enable = mkForce false;
+        }
+      ]
+      ++ map
       (name: {
         stack.${name}.enable = mkForce false;
       })
diff --git a/sys/boot/secure-boot.nix b/sys/boot/secure-boot.nix
index 3e874c3..b13ab7c 100644
--- a/sys/boot/secure-boot.nix
+++ b/sys/boot/secure-boot.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.boot.secureBoot;
 
@@ -6,8 +11,7 @@ with lib; let
     if cfg.legacyPath
     then "/etc/secureboot"
     else "/var/lib/sbctl";
-in
-{
+in {
   options.local.boot.secureBoot = {
     enable = mkEnableOption "secure boot";
 
@@ -42,6 +46,6 @@ in
       pkgs.sbctl
     ];
 
-    local.boot.impermanence.directories = [ pkiBundle ];
+    local.boot.impermanence.directories = [pkiBundle];
   };
 }
diff --git a/sys/boot/stack/btrfs-toplevel-multidrive.nix b/sys/boot/stack/btrfs-toplevel-multidrive.nix
index 1dbfa14..52db865 100644
--- a/sys/boot/stack/btrfs-toplevel-multidrive.nix
+++ b/sys/boot/stack/btrfs-toplevel-multidrive.nix
@@ -1,8 +1,11 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   cfg = config.local.boot.stack.btrfsToplevelMultidrive;
-in
-{
+in {
   options.local.boot.stack.btrfsToplevelMultidrive = {
     enable = mkEnableOption "filesystem stack: persistent btrfs toplevel with optional hdd drive";
 
@@ -80,15 +83,17 @@ in
         };
       };
 
-      snapper = optionalAttrs cfg.toplevel.snapshot
+      snapper =
+        optionalAttrs cfg.toplevel.snapshot
         {
           root = "/";
-        } // optionalAttrs cfg.secondary.snapshot {
-        home = "/home";
-      };
+        }
+        // optionalAttrs cfg.secondary.snapshot {
+          home = "/home";
+        };
     };
 
     # Asegura que /hdd sea descifrado antes de intentar montar /home
-    fileSystems."/home".depends = [ "/hdd" ];
+    fileSystems."/home".depends = ["/hdd"];
   };
 }
diff --git a/sys/boot/stack/luks-ext4-fscrypt-impermanence.nix b/sys/boot/stack/luks-ext4-fscrypt-impermanence.nix
index 72336d6..81feb60 100644
--- a/sys/boot/stack/luks-ext4-fscrypt-impermanence.nix
+++ b/sys/boot/stack/luks-ext4-fscrypt-impermanence.nix
@@ -1,8 +1,12 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.boot.stack.luksExt4FscryptImpermanence;
-in
-{
+in {
   options.local.boot.stack.luksExt4FscryptImpermanence = {
     enable = mkEnableOption "filesystem stack: whatever LUKS approach+ext4+impermanence with per-boot keys";
 
@@ -30,60 +34,58 @@ in
   #         - /toplevel/boots/...
   #         - /toplevel/boots/last -> 2000-01-01T00:00:00-06:00 (mounted as /)
   config = mkIf cfg.enable {
-    boot.initrd.luks.devices.${cfg.target}.postOpenCommands =
-      let
-        fscryptctl = "${pkgs.fscryptctl}/bin/fscryptctl";
-      in
-      ''
-        # FIXME: posiblemente algunos --make-* son innecesarios a partir de aquí
-        mkdir -p /mnt-root /mnt-toplevel
-        mount -o noatime /dev/mapper/${cfg.target} /mnt-toplevel
-        mount --make-private /mnt-toplevel
+    boot.initrd.luks.devices.${cfg.target}.postOpenCommands = let
+      fscryptctl = "${pkgs.fscryptctl}/bin/fscryptctl";
+    in ''
+      # FIXME: posiblemente algunos --make-* son innecesarios a partir de aquí
+      mkdir -p /mnt-root /mnt-toplevel
+      mount -o noatime /dev/mapper/${cfg.target} /mnt-toplevel
+      mount --make-private /mnt-toplevel
 
-        boot_stamp="$(date -Is)"
-        root_from_toplevel="/mnt-toplevel/boots/$boot_stamp"
+      boot_stamp="$(date -Is)"
+      root_from_toplevel="/mnt-toplevel/boots/$boot_stamp"
 
-        mkdir -p "$root_from_toplevel" /mnt-toplevel/boot-keys
-        chmod 700 /mnt-toplevel/boot-keys
+      mkdir -p "$root_from_toplevel" /mnt-toplevel/boot-keys
+      chmod 700 /mnt-toplevel/boot-keys
 
-        head -c64 /dev/urandom >/boot-key
-        key_id=$(${fscryptctl} add_key /mnt-toplevel </boot-key)
-        ${fscryptctl} set_policy "$key_id" "$root_from_toplevel"
-        (umask 077; test -f /mnt-toplevel/boot-archive.pub && \
-          ${pkgs.openssl}/bin/openssl pkeyutl -encrypt \
-          -in /boot-key -pubin -inkey /mnt-toplevel/boot-archive.pub \
-          -out "/mnt-toplevel/boot-keys/$boot_stamp.key.crypt")
-        rm -f /boot-key
+      head -c64 /dev/urandom >/boot-key
+      key_id=$(${fscryptctl} add_key /mnt-toplevel </boot-key)
+      ${fscryptctl} set_policy "$key_id" "$root_from_toplevel"
+      (umask 077; test -f /mnt-toplevel/boot-archive.pub && \
+        ${pkgs.openssl}/bin/openssl pkeyutl -encrypt \
+        -in /boot-key -pubin -inkey /mnt-toplevel/boot-archive.pub \
+        -out "/mnt-toplevel/boot-keys/$boot_stamp.key.crypt")
+      rm -f /boot-key
 
-        ln -Tsf "$boot_stamp" /mnt-toplevel/boots/last
-        ln -Tsf "$boot_stamp.key.crypt" /mnt-toplevel/boot-keys/last.key.crypt
+      ln -Tsf "$boot_stamp" /mnt-toplevel/boots/last
+      ln -Tsf "$boot_stamp.key.crypt" /mnt-toplevel/boot-keys/last.key.crypt
 
-        mount --bind "$root_from_toplevel" /mnt-root
-        mount --make-shared /mnt-root
+      mount --bind "$root_from_toplevel" /mnt-root
+      mount --make-shared /mnt-root
 
-        # mount --move es mala idea, ya que "moving a mount residing under a
-        # shared mount is unsupported"
-        mkdir -p /mnt-root/toplevel
-        mount --bind /mnt-toplevel /mnt-root/toplevel
-        mount --make-private /mnt-root/toplevel
-        umount /mnt-toplevel
-      '';
+      # mount --move es mala idea, ya que "moving a mount residing under a
+      # shared mount is unsupported"
+      mkdir -p /mnt-root/toplevel
+      mount --bind /mnt-toplevel /mnt-root/toplevel
+      mount --make-private /mnt-root/toplevel
+      umount /mnt-toplevel
+    '';
 
     fileSystems = {
       "/" = {
         device = "none";
         fsType = "ext4";
-        options = [ "remount" ];
+        options = ["remount"];
       };
 
       "/nix" = {
         device = "/persist/nix";
-        options = [ "bind" ];
+        options = ["bind"];
       };
 
       "/persist" = {
         device = "/toplevel/persist";
-        options = [ "bind" ];
+        options = ["bind"];
         neededForBoot = true;
       };
     };
diff --git a/sys/boot/tpm.nix b/sys/boot/tpm.nix
index 0e29066..ecc115b 100644
--- a/sys/boot/tpm.nix
+++ b/sys/boot/tpm.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.boot.tpm;
 
@@ -52,13 +57,12 @@ with lib; let
       openssl dgst -sha256 -sign /dev/stdin -out auth.sig auth.policy
     '';
   };
-in
-{
+in {
   options.local.boot.tpm = {
     enable = mkEnableOption "Trusted Platform Module 2.0";
 
     driver = mkOption {
-      type = types.enum [ "tis" "crb" ];
+      type = types.enum ["tis" "crb"];
     };
 
     initrd = {
@@ -81,7 +85,6 @@ in
           12 # kernel-config
           13 # sysexts
           14 # shim-policy
-
         ];
       };
     };
diff --git a/sys/btrfs/mounts.nix b/sys/btrfs/mounts.nix
index 133f08f..3863356 100644
--- a/sys/btrfs/mounts.nix
+++ b/sys/btrfs/mounts.nix
@@ -1,39 +1,47 @@
-{ lib, config, pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.btrfs;
-in
-{
+in {
   options.local.btrfs = {
     mounts = mkOption {
-      default = { };
+      default = {};
 
-      type = with lib.types; attrsOf (submodule {
-        options = {
-          ssd = mkOption {
-            type = bool;
-          };
+      type = with lib.types;
+        attrsOf (submodule {
+          options = {
+            ssd = mkOption {
+              type = bool;
+            };
 
-          device = mkOption {
-            type = str;
-          };
+            device = mkOption {
+              type = str;
+            };
 
-          subvol = mkOption {
-            type = str;
+            subvol = mkOption {
+              type = str;
+            };
           };
-        };
-      });
+        });
     };
   };
 
-  config = mkIf (cfg.mounts != { }) {
-    fileSystems =
-      let
-        btrfsMount = { device, subvol, ssd }: {
-          inherit device;
-          fsType = "btrfs";
-          options = [ "noatime" "compress=zstd" "subvol=${subvol}" ] ++ optional ssd "ssd";
-        };
-      in
+  config = mkIf (cfg.mounts != {}) {
+    fileSystems = let
+      btrfsMount = {
+        device,
+        subvol,
+        ssd,
+      }: {
+        inherit device;
+        fsType = "btrfs";
+        options = ["noatime" "compress=zstd" "subvol=${subvol}"] ++ optional ssd "ssd";
+      };
+    in
       mapAttrs (_: btrfsMount) cfg.mounts;
   };
 }
diff --git a/sys/btrfs/snapper.nix b/sys/btrfs/snapper.nix
index 27d2779..2d29aa4 100644
--- a/sys/btrfs/snapper.nix
+++ b/sys/btrfs/snapper.nix
@@ -1,73 +1,76 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.btrfs;
-in
-{
+in {
   options.local.btrfs = {
     snapper = mkOption {
       type = with lib.types; attrsOf str;
-      default = { };
+      default = {};
     };
   };
 
-  config = mkIf (cfg.snapper != { }) {
-    environment.systemPackages = [ pkgs.local.btclone ];
+  config = mkIf (cfg.snapper != {}) {
+    environment.systemPackages = [pkgs.local.btclone];
 
-    services.snapper.configs =
-      let
-        snapperConfig = _: subvolume: {
-          SUBVOLUME = subvolume;
+    services.snapper.configs = let
+      snapperConfig = _: subvolume: {
+        SUBVOLUME = subvolume;
 
-          # btrfs qgroup for space aware cleanup algorithms
-          QGROUP = "";
+        # btrfs qgroup for space aware cleanup algorithms
+        QGROUP = "";
 
-          # fraction of the filesystems space the snapshots may use
-          SPACE_LIMIT = "0.5";
+        # fraction of the filesystems space the snapshots may use
+        SPACE_LIMIT = "0.5";
 
-          # fraction of the filesystems space that should be free
-          FREE_LIMIT = "0.2";
+        # fraction of the filesystems space that should be free
+        FREE_LIMIT = "0.2";
 
-          # users and groups allowed to work with config
-          ALLOW_USERS = [ ];
-          ALLOW_GROUPS = [ ];
+        # users and groups allowed to work with config
+        ALLOW_USERS = [];
+        ALLOW_GROUPS = [];
 
-          # sync users and groups from ALLOW_USERS and ALLOW_GROUPS to .snapshots
-          # directory
-          SYNC_ACL = "no";
+        # sync users and groups from ALLOW_USERS and ALLOW_GROUPS to .snapshots
+        # directory
+        SYNC_ACL = "no";
 
-          # start comparing pre- and post-snapshot in background after creating
-          # post-snapshot
-          BACKGROUND_COMPARISON = "yes";
+        # start comparing pre- and post-snapshot in background after creating
+        # post-snapshot
+        BACKGROUND_COMPARISON = "yes";
 
-          # run daily number cleanup
-          NUMBER_CLEANUP = "yes";
+        # run daily number cleanup
+        NUMBER_CLEANUP = "yes";
 
-          # limit for number cleanup
-          NUMBER_MIN_AGE = "1800";
-          NUMBER_LIMIT = "100";
-          NUMBER_LIMIT_IMPORTANT = "10";
+        # limit for number cleanup
+        NUMBER_MIN_AGE = "1800";
+        NUMBER_LIMIT = "100";
+        NUMBER_LIMIT_IMPORTANT = "10";
 
-          # create hourly snapshots
-          TIMELINE_CREATE = true;
+        # create hourly snapshots
+        TIMELINE_CREATE = true;
 
-          # cleanup hourly snapshots after some time
-          TIMELINE_CLEANUP = true;
+        # cleanup hourly snapshots after some time
+        TIMELINE_CLEANUP = true;
 
-          # limits for timeline cleanup
-          TIMELINE_MIN_AGE = "1800";
-          TIMELINE_LIMIT_HOURLY = "24";
-          TIMELINE_LIMIT_DAILY = "7";
-          TIMELINE_LIMIT_WEEKLY = "4";
-          TIMELINE_LIMIT_MONTHLY = "12";
-          TIMELINE_LIMIT_YEARLY = "10";
+        # limits for timeline cleanup
+        TIMELINE_MIN_AGE = "1800";
+        TIMELINE_LIMIT_HOURLY = "24";
+        TIMELINE_LIMIT_DAILY = "7";
+        TIMELINE_LIMIT_WEEKLY = "4";
+        TIMELINE_LIMIT_MONTHLY = "12";
+        TIMELINE_LIMIT_YEARLY = "10";
 
-          # cleanup empty pre-post-pairs
-          EMPTY_PRE_POST_CLEANUP = "yes";
+        # cleanup empty pre-post-pairs
+        EMPTY_PRE_POST_CLEANUP = "yes";
 
-          # limits for empty pre-post-pair cleanup
-          EMPTY_PRE_POST_MIN_AGE = "1800";
-        };
-      in
+        # limits for empty pre-post-pair cleanup
+        EMPTY_PRE_POST_MIN_AGE = "1800";
+      };
+    in
       mapAttrs snapperConfig cfg.snapper;
   };
 }
diff --git a/sys/default.nix b/sys/default.nix
index 0ce00a1..131ddeb 100644
--- a/sys/default.nix
+++ b/sys/default.nix
@@ -1,4 +1,10 @@
-{ lib, config, flakes, pkgs, ... }:
+{
+  lib,
+  config,
+  flakes,
+  pkgs,
+  ...
+}:
 with lib; {
   imports = [
     flakes.nixpkgs.nixosModules.notDetected
diff --git a/sys/gitea/default.nix b/sys/gitea/default.nix
index 69dfbc2..212b9f1 100644
--- a/sys/gitea/default.nix
+++ b/sys/gitea/default.nix
@@ -1,8 +1,11 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   cfg = config.local.gitea;
-in
-{
+in {
   options.local.gitea = {
     enable = mkEnableOption "gitea";
   };
diff --git a/sys/hardware/altera.nix b/sys/hardware/altera.nix
index 2fc1bb6..fddd722 100644
--- a/sys/hardware/altera.nix
+++ b/sys/hardware/altera.nix
@@ -1,8 +1,11 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   cfg = config.local.hardware.altera;
-in
-{
+in {
   options.local.hardware.altera = {
     enable = mkEnableOption "Altera USB Blaster";
   };
diff --git a/sys/hardware/apc.nix b/sys/hardware/apc.nix
index 9614c48..97a5bb0 100644
--- a/sys/hardware/apc.nix
+++ b/sys/hardware/apc.nix
@@ -1,8 +1,11 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   cfg = config.local.hardware.apc;
-in
-{
+in {
   options.local.hardware.apc = {
     enable = mkEnableOption "APC UPS support";
   };
diff --git a/sys/hardware/athena.nix b/sys/hardware/athena.nix
index 06d10b3..755c184 100644
--- a/sys/hardware/athena.nix
+++ b/sys/hardware/athena.nix
@@ -1,10 +1,14 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.hardware.athena;
 
   athena = pkgs.local.athena-bccr.${cfg.release};
-in
-{
+in {
   options.local.hardware.athena = {
     enable = mkEnableOption "Athena ASEDrive III smartcard reader";
 
@@ -25,11 +29,11 @@ in
         '';
       };
 
-      systemPackages = [ athena.ase-pkcs11 ];
+      systemPackages = [athena.ase-pkcs11];
     };
 
     #FIXME: Extremadamente peligroso si BCCR o MICITT caen, investigar política nacional de root CA
-    security.pki.certificateFiles = [ "${athena.bccr-cacerts}/root-ca.pem" ];
+    security.pki.certificateFiles = ["${athena.bccr-cacerts}/root-ca.pem"];
 
     services = {
       pcscd.enable = true;
diff --git a/sys/hardware/bluetooth.nix b/sys/hardware/bluetooth.nix
index 0d53750..63e3f0c 100644
--- a/sys/hardware/bluetooth.nix
+++ b/sys/hardware/bluetooth.nix
@@ -1,8 +1,11 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   cfg = config.local.hardware.bluetooth;
-in
-{
+in {
   options.local.hardware.bluetooth = {
     enable = mkEnableOption "bluetooth services";
   };
diff --git a/sys/hardware/epson.nix b/sys/hardware/epson.nix
index 66304f9..30b1303 100644
--- a/sys/hardware/epson.nix
+++ b/sys/hardware/epson.nix
@@ -1,8 +1,12 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.hardware.epson;
-in
-{
+in {
   options.local.hardware.epson = {
     enable = mkEnableOption "Epson printers and scanners";
   };
diff --git a/sys/hardware/laptop.nix b/sys/hardware/laptop.nix
index d9ba753..3b5b772 100644
--- a/sys/hardware/laptop.nix
+++ b/sys/hardware/laptop.nix
@@ -1,8 +1,11 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   cfg = config.local.hardware.laptop;
-in
-{
+in {
   options.local.hardware.laptop = {
     enable = mkEnableOption "laptop stuff";
   };
diff --git a/sys/hardware/printing.nix b/sys/hardware/printing.nix
index 30c6962..e11a016 100644
--- a/sys/hardware/printing.nix
+++ b/sys/hardware/printing.nix
@@ -1,15 +1,18 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   cfg = config.local.hardware.printing;
   inherit (config.local.net) dhcpInterface;
-in
-{
+in {
   options.local.hardware.printing = {
     enable = mkEnableOption "print and scan services";
 
     users = mkOption {
       type = with types; listOf str;
-      default = [ ];
+      default = [];
     };
   };
 
@@ -32,7 +35,7 @@ in
     hardware.sane.enable = true;
 
     networking.firewall.interfaces = mkIf (dhcpInterface != null) {
-      ${dhcpInterface}.allowedUDPPorts = [ 5353 ];
+      ${dhcpInterface}.allowedUDPPorts = [5353];
     };
 
     services.printing.enable = true;
@@ -40,7 +43,7 @@ in
     users.users = listToAttrs (map
       (user: {
         name = user;
-        value.extraGroups = [ "scanner" "lp" ];
+        value.extraGroups = ["scanner" "lp"];
       })
       cfg.users);
   };
diff --git a/sys/hardware/thinkpad.nix b/sys/hardware/thinkpad.nix
index 7341e68..ab18694 100644
--- a/sys/hardware/thinkpad.nix
+++ b/sys/hardware/thinkpad.nix
@@ -1,8 +1,12 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.hardware.thinkpad;
-in
-{
+in {
   options.local.hardware.thinkpad = {
     enable = mkEnableOption "Thinkpad hardware support";
   };
@@ -13,18 +17,18 @@ in
     # Fingerprint sensor requires a firmware-update to work.
 
     boot = {
-      extraModulePackages = with config.boot.kernelPackages; [ acpi_call ];
+      extraModulePackages = with config.boot.kernelPackages; [acpi_call];
       extraModprobeConfig = "options iwlwifi 11n_disable=1 wd_disable=1";
 
       # acpi_call makes tlp work for newer thinkpads
-      kernelModules = [ "acpi_call" ];
+      kernelModules = ["acpi_call"];
 
       # Force use of the thinkpad_acpi driver for backlight control.
       # This allows the backlight save/load systemd service to work.
-      kernelParams = [ "acpi_backlight=native" ];
+      kernelParams = ["acpi_backlight=native"];
     };
 
-    hardware.firmware = [ pkgs.sof-firmware ];
+    hardware.firmware = [pkgs.sof-firmware];
 
     local.hardware.laptop.enable = true;
 
diff --git a/sys/hardware/yubico.nix b/sys/hardware/yubico.nix
index 0078210..0c8478c 100644
--- a/sys/hardware/yubico.nix
+++ b/sys/hardware/yubico.nix
@@ -1,8 +1,12 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.hardware.yubico;
-in
-{
+in {
   options.local.hardware.yubico = {
     enable = mkEnableOption "Yubico hardware support";
   };
@@ -14,7 +18,7 @@ in
 
     services = {
       pcscd.enable = true;
-      udev.packages = [ pkgs.yubikey-personalization ];
+      udev.packages = [pkgs.yubikey-personalization];
     };
   };
 }
diff --git a/sys/home-assistant/hass.nix b/sys/home-assistant/hass.nix
index 4a3ba31..7fd3251 100644
--- a/sys/home-assistant/hass.nix
+++ b/sys/home-assistant/hass.nix
@@ -1,8 +1,12 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.home-assistant;
-in
-{
+in {
   options.local.home-assistant = {
     enable = mkEnableOption "home-assistant";
   };
@@ -12,20 +16,25 @@ in
     environment.etc."fail2ban/filter.d/home-assistant.local".text = ''
       [Definition]
       failregex = ^.* \[homeassistant\.components\.http\.ban\] Login attempt or request with invalid authentication from <HOST>.*$
-      
+
       ignoreregex =
-      
+
       journalmatch = _SYSTEMD_UNIT=home-assistant.service + _COMM=home-assistant
-      
+
       datepattern = {^LN-BEG}
     '';
 
     local.boot.impermanence.directories = [
-      { directory = "/var/lib/hass"; user = "hass"; group = "hass"; mode = "u=rwx,g=,o="; }
+      {
+        directory = "/var/lib/hass";
+        user = "hass";
+        group = "hass";
+        mode = "u=rwx,g=,o=";
+      }
     ];
 
     services = {
-      fail2ban.jails.home-assistant = { };
+      fail2ban.jails.home-assistant = {};
 
       home-assistant = {
         enable = true;
@@ -43,7 +52,7 @@ in
         config = {
           # Includes dependencies for a basic setup
           # https://www.home-assistant.io/integrations/default_config/
-          default_config = { };
+          default_config = {};
 
           switch = [
             # Televisor 192.168.42.205
diff --git a/sys/home-assistant/yaml-extra.nix b/sys/home-assistant/yaml-extra.nix
index 6275e12..77d1ed2 100644
--- a/sys/home-assistant/yaml-extra.nix
+++ b/sys/home-assistant/yaml-extra.nix
@@ -1,22 +1,23 @@
-{ lib, ... }:
+{lib, ...}:
 with lib; {
   options.services.home-assistant = {
     config = mkOption {
-      type = with lib.types; nullOr (submodule {
-        options = {
-          http = {
-            use_x_forwarded_for = mkOption {
-              type = nullOr bool;
-              default = null;
-            };
+      type = with lib.types;
+        nullOr (submodule {
+          options = {
+            http = {
+              use_x_forwarded_for = mkOption {
+                type = nullOr bool;
+                default = null;
+              };
 
-            trusted_proxies = mkOption {
-              type = nullOr (either str (listOf str));
-              default = null;
+              trusted_proxies = mkOption {
+                type = nullOr (either str (listOf str));
+                default = null;
+              };
             };
           };
-        };
-      });
+        });
     };
   };
 }
diff --git a/sys/jobs/pki-expiry/default.nix b/sys/jobs/pki-expiry/default.nix
index b61d6f5..553cdc8 100644
--- a/sys/jobs/pki-expiry/default.nix
+++ b/sys/jobs/pki-expiry/default.nix
@@ -1,9 +1,13 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.jobs.pkiExpiry;
   inherit (config.local) pki;
-in
-{
+in {
   options.local.jobs.pkiExpiry = {
     enable = mkEnableOption "PKI expiration reminder";
   };
@@ -11,43 +15,40 @@ in
   config = mkIf cfg.enable {
     systemd = {
       services.pki-expiry = {
-        after = [ "postfix.service" ];
-        path = [ "/run/wrappers" ];
+        after = ["postfix.service"];
+        path = ["/run/wrappers"];
 
-        environment.PKI_PUBLIC =
-          let
-            mkdir = "mkdir -p $out/{ca,cert,crl}";
+        environment.PKI_PUBLIC = let
+          mkdir = "mkdir -p $out/{ca,cert,crl}";
 
-            cas = mapAttrsToList (_: ca: "ln -s ${ca.cert} $out/ca/${ca.path}") pki.ca;
-            crls = mapAttrsToList (_: ca: "ln -s ${ca.crl} $out/crl/${ca.path}") pki.ca;
+          cas = mapAttrsToList (_: ca: "ln -s ${ca.cert} $out/ca/${ca.path}") pki.ca;
+          crls = mapAttrsToList (_: ca: "ln -s ${ca.crl} $out/crl/${ca.path}") pki.ca;
 
-            certs = mapAttrsToList
-              (path: leaf: "ln -s ${leaf.cert} $out/cert/${path}")
-              (filterAttrs (_: object: ! object ? leaves) pki.byPath);
+          certs =
+            mapAttrsToList
+            (path: leaf: "ln -s ${leaf.cert} $out/cert/${path}")
+            (filterAttrs (_: object: ! object ? leaves) pki.byPath);
 
-            pkiPublic = pkgs.runCommandNoCCLocal "pki-public" { } (concatLines ([ mkdir ] ++ cas ++ crls ++ certs));
-          in
-          "${pkiPublic}";
+          pkiPublic = pkgs.runCommandNoCCLocal "pki-public" {} (concatLines ([mkdir] ++ cas ++ crls ++ certs));
+        in "${pkiPublic}";
 
         serviceConfig = {
           Type = "oneshot";
           StateDirectory = "pki-expiry";
           WorkingDirectory = "/var/lib/pki-expiry";
 
-          ExecStart =
-            let
-              script = pkgs.writeShellApplication {
-                name = "pki-expiry";
-                text = readFile ./pki-expiry.sh;
-                runtimeInputs = with pkgs; [ diffutils openssl ];
-              };
-            in
-            "${getExe script}";
+          ExecStart = let
+            script = pkgs.writeShellApplication {
+              name = "pki-expiry";
+              text = readFile ./pki-expiry.sh;
+              runtimeInputs = with pkgs; [diffutils openssl];
+            };
+          in "${getExe script}";
         };
       };
 
       timers.pki-expiry = {
-        wantedBy = [ "timers.target" ];
+        wantedBy = ["timers.target"];
 
         timerConfig = {
           OnStartupSec = "10m";
diff --git a/sys/kiosk/default.nix b/sys/kiosk/default.nix
index b450733..be20829 100644
--- a/sys/kiosk/default.nix
+++ b/sys/kiosk/default.nix
@@ -1,8 +1,11 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   cfg = config.local.kiosk;
-in
-{
+in {
   options.local.kiosk = {
     enable = mkEnableOption "kiosk mode";
 
@@ -26,7 +29,13 @@ in
         enable = true;
         inherit (cfg) program user;
 
-        extraArguments = [ (if cfg.allowVTSwitch then "-sd" else "-d") ];
+        extraArguments = [
+          (
+            if cfg.allowVTSwitch
+            then "-sd"
+            else "-d"
+          )
+        ];
       };
 
       physlock = {
diff --git a/sys/mail/default.nix b/sys/mail/default.nix
index 6eba9cd..f87b6fe 100644
--- a/sys/mail/default.nix
+++ b/sys/mail/default.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.mailHost;
   imapHostname = config.local.domains.imap.main;
@@ -6,8 +11,7 @@ with lib; let
   cert = config.security.acme.certs.${imapHostname}.directory;
 
   inherit (config.local) users virtual;
-in
-{
+in {
   options.local.mailHost = {
     enable = mkEnableOption "mailbox host service";
 
@@ -45,7 +49,7 @@ in
         mailUser = "vmail";
         mailGroup = "vmail";
         mailLocation = "maildir:~/mail";
-        mailPlugins.perProtocol.lmtp.enable = [ "sieve" ];
+        mailPlugins.perProtocol.lmtp.enable = ["sieve"];
 
         # https://github.com/NixOS/nixpkgs/issues/286859
         sieve.extensions = [
@@ -53,168 +57,164 @@ in
           "mailbox"
         ];
 
-        extraConfig =
-          let
-            inherit (config.networking) domain;
-
-            # https://dovecot.org/list/dovecot/2019-March/115250.html
-            # Otra solución posible (https://serverfault.com/a/1062274/980378):
-            #  auth_username_format = %{if;%d;eq;${domain};%Ln;%Lu}
-            localEntry = canonical: username: ''
-              ${username}:::::::user=${canonical} nopassword userdb_user=${canonical}
-            '';
-
-            localMailboxes =
-              pkgs.writeText "local-mailboxes"
-                (concatStrings
-                  (flatten (mapAttrsToList
-                    (canonical: user:
-                      map (localEntry canonical) ([ canonical ] ++ user.hardAliases))
-                    users)));
-
-            localCerts =
-              flatten (mapAttrsToList
-                (canonical: user:
-                  let
-                    certNames = {
-                      inherit canonical;
-                      logins = [ canonical ] ++ user.hardAliases;
-                    };
-                  in
-                  map (flip nameValuePair certNames) user.mail.certs)
-                users);
-
-            vmailCerts =
-              flatten (flatten (mapAttrsToList
-                (domain: virtual: mapAttrsToList
-                  (username: user:
-                    let
-                      address = "${username}@${domain}";
-
-                      certNames = {
-                        canonical = address;
-                        logins = [ address ];
-                      };
-                    in
-                    map (flip nameValuePair certNames) user.mail.certs)
-                  virtual.users)
-                virtual));
-
-            certLogins =
-              pkgs.writeText "cert-logins"
-                (concatLines (flatten (mapAttrsToList
-                  (certPath: names: map
-                    (addr: "${config.local.pki.byPath.${certPath}.commonName}@nodomain,${addr}:::::::user=${names.canonical}")
-                    names.logins)
-                  (listToAttrs (localCerts ++ vmailCerts)))));
-
-            vmailPath = "/var/lib/vmail/%{if;%d;ne;;%Ld;${domain}}";
-          in
-          ''
-            auth_mechanisms = plain login external
-
-            ssl_ca = <${config.local.pki.ca.mail.fullchain}
-            ssl_require_crl = yes
-            ssl_verify_client_cert = yes
-
-            # Esto descarta @domain.tld de locales explícitos, pero lo exige para los demás.
-            # Implicación: locales implícitos sin dominio fallan en autenticar
-            auth_username_format = %{if;%Ld;eq;${domain};%Ln;%{if;%d;ne;;%Lu;%Ln@nodomain}}
-            auth_ssl_username_from_cert = yes
-
-            # TODO: los defaults de nixpkgs dejan los sockets bajo
-            # /run/dovecot2 con demasiados permisos rwx, arreglar
-
-            service auth {
-              inet_listener mta-sasl {
-                port = ${toString cfg.saslPort}
-                address = ${cfg.mdaListen}
-              }
-            }
-
-            service lmtp {
-              inet_listener mta-lmtp {
-                port = ${toString cfg.lmtpPort}
-                address = ${cfg.mdaListen}
-              }
-            }
-
-            # FIXME: Esta cadena de passdbs hace que 'doveadm user lookup'
-            # falle para usuarios locales, pero todo lo demás sirve. Parece
-            # ser debido a que pam no puede enumerar.
-
-            passdb {
-              driver = static
-              args = nopassword
-
-              master = yes
-              mechanisms = external
-
-              result_success = continue-fail
-              result_failure = return-fail
-              result_internalfail = return-fail
-            }
-
-            passdb {
-              driver = passwd-file
-              args = scheme=PLAIN username_format=%{master_user},%Lu ${certLogins}
-
-              mechanisms = external
-              override_fields = nopassword
-
-              result_failure = return-fail
-              result_internalfail = return-fail
-            }
-
-            passdb {
-              driver = passwd-file
-              args = username_format=%Ln ${vmailPath}/passwd
-            }
-
-            passdb {
-              driver = passwd-file
-              args = scheme=PLAIN ${localMailboxes}
-
-              # Esta es una forma de determinar si se encontró el usuario en
-              # el passwd-file por medio de nopassword sin realmente
-              # autenticarlo. Cuidado con result_success, porque si eso se
-              # configura mal se permite inicio de sesión con cualquier
-              # contraseña (!!!).
-              result_success = continue
-              result_failure = return-fail
-              result_internalfail = return-fail
-
-              username_filter = !*@*
-            }
+        extraConfig = let
+          inherit (config.networking) domain;
 
-            passdb {
-              driver = pam
-              args = dovecot2
-              username_filter = !*@*
-              #TODO: algo como 'override_fields = allow_nets=...'
-            }
-
-            userdb {
-              driver = passwd-file
-              args = username_format=%Ln ${vmailPath}/passwd
-              override_fields = uid=vmail gid=vmail home=${vmailPath}/home/%Ln
-            }
-
-            userdb {
-              driver = passwd-file
-              args = ${localMailboxes}
+          # https://dovecot.org/list/dovecot/2019-March/115250.html
+          # Otra solución posible (https://serverfault.com/a/1062274/980378):
+          #  auth_username_format = %{if;%d;eq;${domain};%Ln;%Lu}
+          localEntry = canonical: username: ''
+            ${username}:::::::user=${canonical} nopassword userdb_user=${canonical}
+          '';
 
-              result_success = continue-ok
-              result_internalfail = return-fail
-              skip = found
+          localMailboxes =
+            pkgs.writeText "local-mailboxes"
+            (concatStrings
+              (flatten (mapAttrsToList
+                (canonical: user:
+                  map (localEntry canonical) ([canonical] ++ user.hardAliases))
+                users)));
+
+          localCerts = flatten (mapAttrsToList
+            (canonical: user: let
+              certNames = {
+                inherit canonical;
+                logins = [canonical] ++ user.hardAliases;
+              };
+            in
+              map (flip nameValuePair certNames) user.mail.certs)
+            users);
+
+          vmailCerts = flatten (flatten (mapAttrsToList
+            (domain: virtual:
+              mapAttrsToList
+              (username: user: let
+                address = "${username}@${domain}";
+
+                certNames = {
+                  canonical = address;
+                  logins = [address];
+                };
+              in
+                map (flip nameValuePair certNames) user.mail.certs)
+              virtual.users)
+            virtual));
+
+          certLogins =
+            pkgs.writeText "cert-logins"
+            (concatLines (flatten (mapAttrsToList
+              (certPath: names:
+                map
+                (addr: "${config.local.pki.byPath.${certPath}.commonName}@nodomain,${addr}:::::::user=${names.canonical}")
+                names.logins)
+              (listToAttrs (localCerts ++ vmailCerts)))));
+
+          vmailPath = "/var/lib/vmail/%{if;%d;ne;;%Ld;${domain}}";
+        in ''
+          auth_mechanisms = plain login external
+
+          ssl_ca = <${config.local.pki.ca.mail.fullchain}
+          ssl_require_crl = yes
+          ssl_verify_client_cert = yes
+
+          # Esto descarta @domain.tld de locales explícitos, pero lo exige para los demás.
+          # Implicación: locales implícitos sin dominio fallan en autenticar
+          auth_username_format = %{if;%Ld;eq;${domain};%Ln;%{if;%d;ne;;%Lu;%Ln@nodomain}}
+          auth_ssl_username_from_cert = yes
+
+          # TODO: los defaults de nixpkgs dejan los sockets bajo
+          # /run/dovecot2 con demasiados permisos rwx, arreglar
+
+          service auth {
+            inet_listener mta-sasl {
+              port = ${toString cfg.saslPort}
+              address = ${cfg.mdaListen}
             }
+          }
 
-            userdb {
-              driver = passwd
-              args = blocking=no
-              skip = notfound
+          service lmtp {
+            inet_listener mta-lmtp {
+              port = ${toString cfg.lmtpPort}
+              address = ${cfg.mdaListen}
             }
-          '';
+          }
+
+          # FIXME: Esta cadena de passdbs hace que 'doveadm user lookup'
+          # falle para usuarios locales, pero todo lo demás sirve. Parece
+          # ser debido a que pam no puede enumerar.
+
+          passdb {
+            driver = static
+            args = nopassword
+
+            master = yes
+            mechanisms = external
+
+            result_success = continue-fail
+            result_failure = return-fail
+            result_internalfail = return-fail
+          }
+
+          passdb {
+            driver = passwd-file
+            args = scheme=PLAIN username_format=%{master_user},%Lu ${certLogins}
+
+            mechanisms = external
+            override_fields = nopassword
+
+            result_failure = return-fail
+            result_internalfail = return-fail
+          }
+
+          passdb {
+            driver = passwd-file
+            args = username_format=%Ln ${vmailPath}/passwd
+          }
+
+          passdb {
+            driver = passwd-file
+            args = scheme=PLAIN ${localMailboxes}
+
+            # Esta es una forma de determinar si se encontró el usuario en
+            # el passwd-file por medio de nopassword sin realmente
+            # autenticarlo. Cuidado con result_success, porque si eso se
+            # configura mal se permite inicio de sesión con cualquier
+            # contraseña (!!!).
+            result_success = continue
+            result_failure = return-fail
+            result_internalfail = return-fail
+
+            username_filter = !*@*
+          }
+
+          passdb {
+            driver = pam
+            args = dovecot2
+            username_filter = !*@*
+            #TODO: algo como 'override_fields = allow_nets=...'
+          }
+
+          userdb {
+            driver = passwd-file
+            args = username_format=%Ln ${vmailPath}/passwd
+            override_fields = uid=vmail gid=vmail home=${vmailPath}/home/%Ln
+          }
+
+          userdb {
+            driver = passwd-file
+            args = ${localMailboxes}
+
+            result_success = continue-ok
+            result_internalfail = return-fail
+            skip = found
+          }
+
+          userdb {
+            driver = passwd
+            args = blocking=no
+            skip = notfound
+          }
+        '';
       };
 
       fail2ban.jails.dovecot.settings = {
@@ -225,12 +225,12 @@ in
 
     security = {
       # Necesario debido a 'enablePAM = false'
-      pam.services.dovecot2 = { };
+      pam.services.dovecot2 = {};
 
       acme.certs.${imapHostname} = {
         inherit (config.services.dovecot2) group;
 
-        reloadServices = [ "dovecot2.service" ];
+        reloadServices = ["dovecot2.service"];
       };
     };
 
@@ -239,7 +239,7 @@ in
       groups.${config.services.dovecot2.mailGroup}.gid = 993;
     };
 
-    networking.firewall.allowedTCPPorts = [ 143 993 ];
+    networking.firewall.allowedTCPPorts = [143 993];
 
     local.certs.imap.enable = true;
   };
diff --git a/sys/mta/default.nix b/sys/mta/default.nix
index 4305f70..57c1c27 100644
--- a/sys/mta/default.nix
+++ b/sys/mta/default.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.mta;
 
@@ -22,13 +27,12 @@ with lib; let
     if isPrimary
     then "lmtp:inet:${cfg.mdaAddr}:${toString cfg.lmtpPort}"
     else "error:bad transport";
-in
-{
+in {
   options.local.mta = {
     enable = mkEnableOption "mail transfer agent";
 
     mode = mkOption {
-      type = types.enum [ "primary" "backup" ];
+      type = types.enum ["primary" "backup"];
     };
 
     mdaAddr = mkOption {
@@ -58,7 +62,7 @@ in
         enable = true;
 
         group = "postfix";
-        domains = "csl:" + concatStringsSep "," ([ domain ] ++ attrNames virtualDomains);
+        domains = "csl:" + concatStringsSep "," ([domain] ++ attrNames virtualDomains);
         selector = "202408";
 
         configFile = pkgs.writeText "opendkim.conf" ''
@@ -76,7 +80,7 @@ in
         hostname = mtaDomain.main;
 
         #TODO: check_recipient_access para rechazar localhost desde afuera
-        destination = optionals isPrimary [ "localhost" "$mydomain" ];
+        destination = optionals isPrimary ["localhost" "$mydomain"];
         origin = "$mydomain";
 
         networksStyle = "host";
@@ -95,20 +99,25 @@ in
         # También es postmaster
         rootAlias = config.local.sysadmin;
 
-        extraAliases = optionalString isPrimary
+        extraAliases =
+          optionalString isPrimary
           (concatLines (flatten (mapAttrsToList
-            (name: user: map
+            (name: user:
+              map
               (alias: "${alias}: ${name}")
               user.hardAliases)
             users)));
 
-        localRecipients = optionals isPrimary
+        localRecipients =
+          optionals isPrimary
           (map (user: "${user}@${domain}")
             (attrNames (users // virtual.${domain}.users)));
 
-        virtual = optionalString isPrimary
+        virtual =
+          optionalString isPrimary
           (concatLines (flatten (mapAttrsToList
-            (name: virtual: mapAttrsToList
+            (name: virtual:
+              mapAttrsToList
               (alias: targets: "${alias}@${name} ${concatStringsSep ", " targets}")
               virtual.aliases)
             virtual)));
@@ -116,101 +125,108 @@ in
         mapFiles = optionalAttrs isPrimary {
           sender_ccerts =
             pkgs.writeText "postfix-sender_ccerts"
-              (concatLines (flatten (mapAttrsToList
-                (username: user: map
-                  (alias: "${alias}@${domain} CCERTS ${concatStringsSep ","
-				    (map (certPath: config.local.pki.byPath.${certPath}.fingerprint.sha256-bytes-upper)
-					     user.mail.certs)}")
-                  ([ username ] ++ user.hardAliases))
-                (filterAttrs (_: user: user.mail.certs != [ ]) users))));
+            (concatLines (flatten (mapAttrsToList
+              (username: user:
+                map
+                (alias: "${alias}@${domain} CCERTS ${concatStringsSep ","
+                  (map (certPath: config.local.pki.byPath.${certPath}.fingerprint.sha256-bytes-upper)
+                    user.mail.certs)}")
+                ([username] ++ user.hardAliases))
+              (filterAttrs (_: user: user.mail.certs != []) users))));
 
           sender_login =
             pkgs.writeText "postfix-sender_login"
-              (concatLines (flatten (mapAttrsToList
-                (username: user: map
-                  (alias: "${alias}@${domain} ${username}")
-                  ([ username ] ++ user.hardAliases))
-                users)));
+            (concatLines (flatten (mapAttrsToList
+              (username: user:
+                map
+                (alias: "${alias}@${domain} ${username}")
+                ([username] ++ user.hardAliases))
+              users)));
 
           virtual_recipients =
             pkgs.writeText "postfix-virtual_recipients"
-              (concatLines (flatten (mapAttrsToList
-                (virtualDomain: virtual: mapAttrsToList
-                  # El lado derecho de esta tabla debe existir pero nunca se usa
-                  (username: _: "${username}@${virtualDomain} foo")
-                  virtual.users)
-                virtualDomains)));
+            (concatLines (flatten (mapAttrsToList
+              (virtualDomain: virtual:
+                mapAttrsToList
+                # El lado derecho de esta tabla debe existir pero nunca se usa
+                (username: _: "${username}@${virtualDomain} foo")
+                virtual.users)
+              virtualDomains)));
 
           virtual_rules =
             pkgs.writeText "postfix-virtual_rules"
-              (concatLines (flatten (mapAttrsToList
-                (name: virtual: map
-                  (rule: "/^${rule.pattern}@${name}$/ ${concatStringsSep ", " rule.targets}")
-                  virtual.rules)
-                virtual)));
+            (concatLines (flatten (mapAttrsToList
+              (name: virtual:
+                map
+                (rule: "/^${rule.pattern}@${name}$/ ${concatStringsSep ", " rule.targets}")
+                virtual.rules)
+              virtual)));
         };
 
-        config = {
-          # user+extension@domain.tld
-          recipient_delimiter = optionalString isPrimary "+";
-
-          message_size_limit = toString (50 * 1048576);
-
-          local_transport = mdaTransport;
-          virtual_transport = mdaTransport;
-
-          smtpd_tls_auth_only = true;
-          # Nota: smtpd_tls_dh1024_param_file fue deprecado en 3.9
-
-          tls_append_default_CA = false; # Crítico
-
-          # https://linux-audit.com/postfix-hardening-guide-for-security-and-privacy/
-          smtpd_helo_required = true;
-          disable_vrfy_command = true;
-        } // optionalAttrs isPrimary {
-          virtual_alias_maps = mkAfter [ "pcre:/etc/postfix/virtual_rules" ];
-          virtual_mailbox_domains = attrNames virtualDomains;
-          virtual_mailbox_maps = [ "hash:/etc/postfix/virtual_recipients" ];
-
-          smtpd_sasl_type = "dovecot";
-          smtpd_sasl_path = "inet:${cfg.mdaAddr}:${toString cfg.saslPort}";
-          smtpd_sasl_local_domain = "$mydomain";
-          smtpd_sasl_security_options = [ "noanonymous" ];
-
-          smtpd_tls_CAfile = "${config.local.pki.ca.mail.fullchain}";
-          smtpd_tls_ccert_verifydepth = "1";
-
-          # Inventado, no es parámetro de postfix
-          local_submission_client_restrictions = [
-            "permit_tls_all_clientcerts"
-            "permit_sasl_authenticated"
-            "reject"
-          ];
-
-          smtpd_sender_login_maps = [ "hash:/etc/postfix/sender_login" ];
-
-          smtpd_relay_restrictions = [
-            "permit_mynetworks"
-            "permit_tls_all_clientcerts"
-            "permit_sasl_authenticated"
-            "reject_unauth_destination"
-          ];
-
-          smtpd_sender_restrictions = [
-            "check_sender_access hash:/etc/postfix/sender_ccerts"
-            "reject_sender_login_mismatch"
-          ];
-
-          smtpd_milters = "unix:/run/opendkim/opendkim.sock";
-          non_smtpd_milters = "$smtpd_milters";
-          milter_default_action = "accept";
-        } // optionalAttrs isBackup {
-          inet_interfaces = [ cfg.relayListen ];
-
-          smtpd_relay_restrictions = [
-            "reject_unauth_destination"
-          ];
-        };
+        config =
+          {
+            # user+extension@domain.tld
+            recipient_delimiter = optionalString isPrimary "+";
+
+            message_size_limit = toString (50 * 1048576);
+
+            local_transport = mdaTransport;
+            virtual_transport = mdaTransport;
+
+            smtpd_tls_auth_only = true;
+            # Nota: smtpd_tls_dh1024_param_file fue deprecado en 3.9
+
+            tls_append_default_CA = false; # Crítico
+
+            # https://linux-audit.com/postfix-hardening-guide-for-security-and-privacy/
+            smtpd_helo_required = true;
+            disable_vrfy_command = true;
+          }
+          // optionalAttrs isPrimary {
+            virtual_alias_maps = mkAfter ["pcre:/etc/postfix/virtual_rules"];
+            virtual_mailbox_domains = attrNames virtualDomains;
+            virtual_mailbox_maps = ["hash:/etc/postfix/virtual_recipients"];
+
+            smtpd_sasl_type = "dovecot";
+            smtpd_sasl_path = "inet:${cfg.mdaAddr}:${toString cfg.saslPort}";
+            smtpd_sasl_local_domain = "$mydomain";
+            smtpd_sasl_security_options = ["noanonymous"];
+
+            smtpd_tls_CAfile = "${config.local.pki.ca.mail.fullchain}";
+            smtpd_tls_ccert_verifydepth = "1";
+
+            # Inventado, no es parámetro de postfix
+            local_submission_client_restrictions = [
+              "permit_tls_all_clientcerts"
+              "permit_sasl_authenticated"
+              "reject"
+            ];
+
+            smtpd_sender_login_maps = ["hash:/etc/postfix/sender_login"];
+
+            smtpd_relay_restrictions = [
+              "permit_mynetworks"
+              "permit_tls_all_clientcerts"
+              "permit_sasl_authenticated"
+              "reject_unauth_destination"
+            ];
+
+            smtpd_sender_restrictions = [
+              "check_sender_access hash:/etc/postfix/sender_ccerts"
+              "reject_sender_login_mismatch"
+            ];
+
+            smtpd_milters = "unix:/run/opendkim/opendkim.sock";
+            non_smtpd_milters = "$smtpd_milters";
+            milter_default_action = "accept";
+          }
+          // optionalAttrs isBackup {
+            inet_interfaces = [cfg.relayListen];
+
+            smtpd_relay_restrictions = [
+              "reject_unauth_destination"
+            ];
+          };
 
         # Importante: existe submissionOptions por aparte, no son iguales
         submissionsOptions = optionalAttrs isPrimary {
@@ -223,19 +239,31 @@ in
     };
 
     #TODO: solo para las destination addresses necesarias
-    networking.firewall.allowedTCPPorts = optionals isPrimary [ 25 465 ];
+    networking.firewall.allowedTCPPorts = optionals isPrimary [25 465];
 
     local = {
-      boot.impermanence.directories = [
-        { directory = "/var/lib/postfix"; user = "root"; group = "root"; mode = "u=rwx,g=rx,o=rx"; }
-      ] ++ optionals isPrimary [
-        { directory = "/var/lib/opendkim"; user = "opendkim"; group = "postfix"; mode = "u=rwx,g=,o="; }
-      ];
+      boot.impermanence.directories =
+        [
+          {
+            directory = "/var/lib/postfix";
+            user = "root";
+            group = "root";
+            mode = "u=rwx,g=rx,o=rx";
+          }
+        ]
+        ++ optionals isPrimary [
+          {
+            directory = "/var/lib/opendkim";
+            user = "opendkim";
+            group = "postfix";
+            mode = "u=rwx,g=,o=";
+          }
+        ];
 
       certs.smtp.enable = isPrimary;
       certs.smtp-backup.enable = isBackup;
     };
 
-    security.acme.certs.${mtaDomain.main}.reloadServices = [ "postfix.service" ];
+    security.acme.certs.${mtaDomain.main}.reloadServices = ["postfix.service"];
   };
 }
diff --git a/sys/net/fail2ban.nix b/sys/net/fail2ban.nix
index 8d3aa3d..32197b6 100644
--- a/sys/net/fail2ban.nix
+++ b/sys/net/fail2ban.nix
@@ -1,9 +1,13 @@
-{ lib, config, pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.net.fail2ban;
   inherit (config.local) nets;
-in
-{
+in {
   options.local.net.fail2ban = {
     enable = mkEnableOption "fail2ban";
   };
diff --git a/sys/net/interfaces.nix b/sys/net/interfaces.nix
index 281f5ca..3b0abcd 100644
--- a/sys/net/interfaces.nix
+++ b/sys/net/interfaces.nix
@@ -1,8 +1,12 @@
-{ lib, config, pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.net;
-in
-{
+in {
   options.local.net = with lib.types; {
     enable = mkEnableOption "networking stack";
 
diff --git a/sys/net/options.nix b/sys/net/options.nix
index 11b913c..0608fb9 100644
--- a/sys/net/options.nix
+++ b/sys/net/options.nix
@@ -1,65 +1,71 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   v4PtrHierarchy = address: bits: reverseList (sublist 0 (bits / 8) (splitString "." address));
 
-  v6PtrHierarchy = address: bits:
-    let
-      separator = lists.findFirstIndex (hextet: hextet == "") null colonSplit;
-      colonSplit = splitString ":" address;
+  v6PtrHierarchy = address: bits: let
+    separator = lists.findFirstIndex (hextet: hextet == "") null colonSplit;
+    colonSplit = splitString ":" address;
 
-      zeroFill = replicate (8 - length colonSplit + 1) "0000";
-      leftSplit = sublist 0 separator colonSplit;
-      rightSplit = sublist (separator + 1) (length colonSplit - separator - 1) colonSplit;
+    zeroFill = replicate (8 - length colonSplit + 1) "0000";
+    leftSplit = sublist 0 separator colonSplit;
+    rightSplit = sublist (separator + 1) (length colonSplit - separator - 1) colonSplit;
 
-      fullSplit =
-        if separator != null
-        then leftSplit ++ zeroFill ++ rightSplit
-        else colonSplit;
+    fullSplit =
+      if separator != null
+      then leftSplit ++ zeroFill ++ rightSplit
+      else colonSplit;
 
-      padded = map (hextet: strings.replicate (4 - stringLength hextet) "0" + hextet) fullSplit;
-    in
+    padded = map (hextet: strings.replicate (4 - stringLength hextet) "0" + hextet) fullSplit;
+  in
     reverseList (sublist 0 (bits / 4) (flatten (map stringToCharacters padded)));
 
-  matchPtrRecordName = { splitter, netAddress, netBits, targetAddress, targetBits }:
-    let
-      netSplit = splitter netAddress netBits;
-      targetSplit = splitter targetAddress targetBits;
-
-      netLength = length netSplit;
-      lengthDelta = length targetSplit - netLength;
-
-      withinNet = lengthDelta >= 0 && sublist lengthDelta netLength targetSplit == netSplit;
-      throwMessage = "${targetAddress}/${toString targetBits} is not a subset of ${netAddress}/${toString netBits}";
-
-      recordHierarchy = sublist 0 lengthDelta targetSplit;
-
-      recordName =
-        if recordHierarchy != [ ]
-        then concatStringsSep "." recordHierarchy
-        else "@";
-    in
+  matchPtrRecordName = {
+    splitter,
+    netAddress,
+    netBits,
+    targetAddress,
+    targetBits,
+  }: let
+    netSplit = splitter netAddress netBits;
+    targetSplit = splitter targetAddress targetBits;
+
+    netLength = length netSplit;
+    lengthDelta = length targetSplit - netLength;
+
+    withinNet = lengthDelta >= 0 && sublist lengthDelta netLength targetSplit == netSplit;
+    throwMessage = "${targetAddress}/${toString targetBits} is not a subset of ${netAddress}/${toString netBits}";
+
+    recordHierarchy = sublist 0 lengthDelta targetSplit;
+
+    recordName =
+      if recordHierarchy != []
+      then concatStringsSep "." recordHierarchy
+      else "@";
+  in
     throwIfNot withinNet throwMessage recordName;
-in
-{
-  options.local.nets = with lib.types; mkOption {
-    readOnly = true;
+in {
+  options.local.nets = with lib.types;
+    mkOption {
+      readOnly = true;
 
-    type = attrsOf (submodule ({ config, ... }: {
-      options =
-        let
+      type = attrsOf (submodule ({config, ...}: {
+        options = let
           v4config = config.v4;
           v6config = config.v6;
-        in
-        {
+        in {
           hosts = mkOption {
-            default = { };
+            default = {};
 
             type = attrsOf (submodule {
               options = {
                 v4 = mkOption {
                   default = null;
 
-                  type = nullOr (submodule ({ config, ... }: {
+                  type = nullOr (submodule ({config, ...}: {
                     options = {
                       suffix = mkOption {
                         type = str;
@@ -98,7 +104,7 @@ in
                 v6 = mkOption {
                   default = null;
 
-                  type = nullOr (submodule ({ config, ... }: {
+                  type = nullOr (submodule ({config, ...}: {
                     options = {
                       suffix = mkOption {
                         type = str;
@@ -121,19 +127,21 @@ in
                     };
 
                     config = {
-                      address =
-                        let
-                          hextets = fragment: length (splitString ":" fragment);
-                          separator = if doubleColon then "::" else ":";
-                          doubleColon = hextets v6config.prefix + hextets config.suffix < 8;
-
-                          joined =
-                            if v6config.bits == 128
-                            then v6config.prefix
-                            else if v6config.bits == 0
-                            then config.suffix
-                            else "${v6config.prefix}${separator}${config.suffix}";
-                        in
+                      address = let
+                        hextets = fragment: length (splitString ":" fragment);
+                        separator =
+                          if doubleColon
+                          then "::"
+                          else ":";
+                        doubleColon = hextets v6config.prefix + hextets config.suffix < 8;
+
+                        joined =
+                          if v6config.bits == 128
+                          then v6config.prefix
+                          else if v6config.bits == 0
+                          then config.suffix
+                          else "${v6config.prefix}${separator}${config.suffix}";
+                      in
                         joined;
 
                       cidr = "${config.address}/${toString v6config.bits}";
@@ -148,10 +156,10 @@ in
           v4 = mkOption {
             default = null;
 
-            type = nullOr (submodule ({ config, ... }: {
+            type = nullOr (submodule ({config, ...}: {
               options = {
                 bits = mkOption {
-                  type = enum [ 0 8 16 24 32 ];
+                  type = enum [0 8 16 24 32];
                 };
 
                 prefix = mkOption {
@@ -189,15 +197,16 @@ in
 
                 ptrDomain = concatStrings (map (x: x + ".") (v4PtrHierarchy config.subnet config.bits)) + "in-addr.arpa";
 
-                ptrRecordName = address: bits: matchPtrRecordName {
-                  splitter = v4PtrHierarchy;
+                ptrRecordName = address: bits:
+                  matchPtrRecordName {
+                    splitter = v4PtrHierarchy;
 
-                  netBits = config.bits;
-                  netAddress = config.subnet;
+                    netBits = config.bits;
+                    netAddress = config.subnet;
 
-                  targetBits = bits;
-                  targetAddress = address;
-                };
+                    targetBits = bits;
+                    targetAddress = address;
+                  };
               };
             }));
           };
@@ -205,12 +214,14 @@ in
           v6 = mkOption {
             default = null;
 
-            type = nullOr (submodule ({ config, ... }: {
+            type = nullOr (submodule ({config, ...}: {
               options = {
                 bits = mkOption {
-                  type = addCheck (ints.between 0 128) (b: mod b 4 == 0) // {
-                    description = "IPv6 subnet bits at nibble boundary";
-                  };
+                  type =
+                    addCheck (ints.between 0 128) (b: mod b 4 == 0)
+                    // {
+                      description = "IPv6 subnet bits at nibble boundary";
+                    };
                 };
 
                 prefix = mkOption {
@@ -248,19 +259,20 @@ in
 
                 ptrDomain = concatStrings (map (x: x + ".") (v6PtrHierarchy config.subnet config.bits)) + "ip6.arpa";
 
-                ptrRecordName = address: bits: matchPtrRecordName {
-                  splitter = v6PtrHierarchy;
+                ptrRecordName = address: bits:
+                  matchPtrRecordName {
+                    splitter = v6PtrHierarchy;
 
-                  netBits = config.bits;
-                  netAddress = config.subnet;
+                    netBits = config.bits;
+                    netAddress = config.subnet;
 
-                  targetBits = bits;
-                  targetAddress = address;
-                };
+                    targetBits = bits;
+                    targetAddress = address;
+                  };
               };
             }));
           };
         };
-    }));
-  };
+      }));
+    };
 }
diff --git a/sys/net/vsock.nix b/sys/net/vsock.nix
index d1bd250..c6b0ad6 100644
--- a/sys/net/vsock.nix
+++ b/sys/net/vsock.nix
@@ -1,59 +1,63 @@
-{ lib, config, pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.net.vsock;
-in
-{
+in {
   options.local.net.vsock = {
     connect = mkOption {
-      default = { };
-      type = with lib.types; attrsOf (submodule ({ name, ... }: {
-        options = {
-          enable = mkEnableOption "vsock connect '${name}'";
+      default = {};
+      type = with lib.types;
+        attrsOf (submodule ({name, ...}: {
+          options = {
+            enable = mkEnableOption "vsock connect '${name}'";
 
-          cid = mkOption {
-            type = ints.u32;
-            default = 2;
-          };
+            cid = mkOption {
+              type = ints.u32;
+              default = 2;
+            };
 
-          localPort = mkOption {
-            type = port;
-          };
+            localPort = mkOption {
+              type = port;
+            };
 
-          vsockPort = mkOption {
-            type = port;
+            vsockPort = mkOption {
+              type = port;
+            };
           };
-        };
-      }));
+        }));
     };
   };
 
   config = {
-    systemd =
-      let
-        connects = mapAttrs
-          (_: connect: {
-            service.serviceConfig = {
-              Type = "simple";
-              ExecStart = "${getExe pkgs.socat} - VSOCK:${toString connect.cid}:${toString connect.vsockPort}";
-              StandardInput = "socket";
-            };
-
-            socket = {
-              wantedBy = [ "sockets.target" ];
+    systemd = let
+      connects =
+        mapAttrs
+        (_: connect: {
+          service.serviceConfig = {
+            Type = "simple";
+            ExecStart = "${getExe pkgs.socat} - VSOCK:${toString connect.cid}:${toString connect.vsockPort}";
+            StandardInput = "socket";
+          };
 
-              socketConfig = {
-                Accept = true;
-                ListenStream = "[::1]:${toString connect.localPort}";
-              };
+          socket = {
+            wantedBy = ["sockets.target"];
 
-              unitConfig.ConditionVirtualization = "kvm";
+            socketConfig = {
+              Accept = true;
+              ListenStream = "[::1]:${toString connect.localPort}";
             };
-          })
-          cfg.connect;
-      in
-      {
-        sockets = mapAttrs' (name: connect: nameValuePair "vsock-${name}" connect.socket) connects;
-        services = mapAttrs' (name: connect: nameValuePair "vsock-${name}@" connect.service) connects;
-      };
+
+            unitConfig.ConditionVirtualization = "kvm";
+          };
+        })
+        cfg.connect;
+    in {
+      sockets = mapAttrs' (name: connect: nameValuePair "vsock-${name}" connect.socket) connects;
+      services = mapAttrs' (name: connect: nameValuePair "vsock-${name}@" connect.service) connects;
+    };
   };
 }
diff --git a/sys/ns/mx.nix b/sys/ns/mx.nix
index 40a5574..892b684 100644
--- a/sys/ns/mx.nix
+++ b/sys/ns/mx.nix
@@ -1,33 +1,60 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   inherit (config.local) domains;
-in
-{
+in {
   options.local.ns.zones = mkOption {
-    type = with lib.types; attrsOf (submodule ({ config, name, ... }: {
-      options.localMX = {
-        enable = mkEnableOption "local MX settings";
-      };
+    type = with lib.types;
+      attrsOf (submodule ({
+        config,
+        name,
+        ...
+      }: {
+        options.localMX = {
+          enable = mkEnableOption "local MX settings";
+        };
 
-      config = mkIf config.localMX.enable {
-        mx = [
-          { name = "@"; priority = 10; host = "${domains.smtp.gated}."; }
-          { name = "@"; priority = 20; host = "${domains.smtp-backup.main}."; }
-          # Many thanks to junkemailfilter.com for all their years of service. RIP.
-          #{ name = "@"; priority = 30; host = "mxbackup1.junkemailfilter.com."; }
-          #{ name = "@"; priority = 40; host = "mxbackup2.junkemailfilter.com."; }
-        ];
+        config = mkIf config.localMX.enable {
+          mx = [
+            {
+              name = "@";
+              priority = 10;
+              host = "${domains.smtp.gated}.";
+            }
+            {
+              name = "@";
+              priority = 20;
+              host = "${domains.smtp-backup.main}.";
+            }
+            # Many thanks to junkemailfilter.com for all their years of service. RIP.
+            #{ name = "@"; priority = 30; host = "mxbackup1.junkemailfilter.com."; }
+            #{ name = "@"; priority = 40; host = "mxbackup2.junkemailfilter.com."; }
+          ];
 
-        txt = [
-          { name = "@"; text = "v=spf1 mx a -all"; }
-          { name = "_dmarc"; text = "v=DMARC1;p=reject;sp=reject;adkim=r;aspf=r;fo=1;rf=afrf;rua=mailto:postmaster@${name}"; }
-          { name = "_adsp._domainkey"; text = "dkim=all"; }
-        ] ++ map
-          (selector: {
-            name = "${toString selector}._domainkey";
-            text = readFile (./dkim + "/${toString selector}.txt");
-          }) [ 202001 202102 202402 202408 ];
-      };
-    }));
+          txt =
+            [
+              {
+                name = "@";
+                text = "v=spf1 mx a -all";
+              }
+              {
+                name = "_dmarc";
+                text = "v=DMARC1;p=reject;sp=reject;adkim=r;aspf=r;fo=1;rf=afrf;rua=mailto:postmaster@${name}";
+              }
+              {
+                name = "_adsp._domainkey";
+                text = "dkim=all";
+              }
+            ]
+            ++ map
+            (selector: {
+              name = "${toString selector}._domainkey";
+              text = readFile (./dkim + "/${toString selector}.txt");
+            }) [202001 202102 202402 202408];
+        };
+      }));
   };
 }
diff --git a/sys/ns/ns.nix b/sys/ns/ns.nix
index 1e74502..e5b30e8 100644
--- a/sys/ns/ns.nix
+++ b/sys/ns/ns.nix
@@ -1,130 +1,153 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   inherit (config.networking) domain;
   inherit (config.local.nets) gate-public;
   inherit (config.local.ns.server) tsigName;
 
   ptrNets = config.local.ns.ptr;
-in
-{
+in {
   options.local.ns.zones = mkOption {
-    type = with lib.types; attrsOf
+    type = with lib.types;
+      attrsOf
       (submodule
-        ({ config, name, ... }:
-          let
-            inherit (config.soa) primary;
-
-            cfg = config.localNS;
-            ptrDomain = cfg.ptrNet.v4 != null || cfg.ptrNet.v6 != null;
-          in
-          {
-            options.localNS = {
-              enable = mkEnableOption "local NS settings";
-
-              acme = mkOption {
-                default = { };
-                type = attrsOf str;
-              };
+        ({
+          config,
+          name,
+          ...
+        }: let
+          inherit (config.soa) primary;
+
+          cfg = config.localNS;
+          ptrDomain = cfg.ptrNet.v4 != null || cfg.ptrNet.v6 != null;
+        in {
+          options.localNS = {
+            enable = mkEnableOption "local NS settings";
+
+            acme = mkOption {
+              default = {};
+              type = attrsOf str;
+            };
 
-              ptrNet = {
-                v4 = mkOption {
-                  type = nullOr str;
-                  default = null;
-                };
+            ptrNet = {
+              v4 = mkOption {
+                type = nullOr str;
+                default = null;
+              };
 
-                v6 = mkOption {
-                  type = nullOr str;
-                  default = null;
-                };
+              v6 = mkOption {
+                type = nullOr str;
+                default = null;
               };
             };
-
-            config = mkIf cfg.enable
-              {
-                ptrName =
-                  let
-                    name =
-                      if cfg.ptrNet.v6 != null
-                      then "${cfg.ptrNet.v6}-v6"
-                      else "${cfg.ptrNet.v4}-v4";
-                  in
-                  mkIf ptrDomain name;
-
-                # https://docs.gandi.net/en/domain_names/advanced_users/secondary_nameserver.html
-                nsdConfig =
-                  let
-                    providerSecondary = [
-                      "37.205.15.45 ${tsigName}" # ns3.vpsfree.cz
-                      "37.205.11.85 ${tsigName}" # ns4.vpsfree.cz
-                      "2a03:3b40:fe:2be::1 ${tsigName}" # ns3.vpsfree.cz
-                      "2a03:3b40:101:4::1 ${tsigName}" # ns4.vpsfree.cz
-                    ];
-                  in
-                  {
-                    notify = providerSecondary;
-                    provideXFR = providerSecondary;
-                  };
-
-                ns = [
-                  { name = "@"; host = primary; }
-                  { name = "@"; host = "ns3.vpsfree.cz."; }
-                  { name = "@"; host = "ns4.vpsfree.cz."; }
+          };
+
+          config =
+            mkIf cfg.enable
+            {
+              ptrName = let
+                name =
+                  if cfg.ptrNet.v6 != null
+                  then "${cfg.ptrNet.v6}-v6"
+                  else "${cfg.ptrNet.v4}-v4";
+              in
+                mkIf ptrDomain name;
+
+              # https://docs.gandi.net/en/domain_names/advanced_users/secondary_nameserver.html
+              nsdConfig = let
+                providerSecondary = [
+                  "37.205.15.45 ${tsigName}" # ns3.vpsfree.cz
+                  "37.205.11.85 ${tsigName}" # ns4.vpsfree.cz
+                  "2a03:3b40:fe:2be::1 ${tsigName}" # ns3.vpsfree.cz
+                  "2a03:3b40:101:4::1 ${tsigName}" # ns4.vpsfree.cz
                 ];
+              in {
+                notify = providerSecondary;
+                provideXFR = providerSecondary;
+              };
 
-                a = optional (!ptrDomain)
-                  { name = primary; ipv4 = gate-public.hosts.gate.v4.address; ptr = null; };
-
-                aaaa = optional (!ptrDomain)
-                  { name = primary; ipv6 = gate-public.hosts.gate.v6.address; ptr = null; };
+              ns = [
+                {
+                  name = "@";
+                  host = primary;
+                }
+                {
+                  name = "@";
+                  host = "ns3.vpsfree.cz.";
+                }
+                {
+                  name = "@";
+                  host = "ns4.vpsfree.cz.";
+                }
+              ];
+
+              a =
+                optional (!ptrDomain)
+                {
+                  name = primary;
+                  ipv4 = gate-public.hosts.gate.v4.address;
+                  ptr = null;
+                };
 
-                ptr =
-                  let
-                    ptrsToRecords = mapAttrsToList (suffix: target: {
-                      name = suffix;
-                      inherit target;
-                    });
+              aaaa =
+                optional (!ptrDomain)
+                {
+                  name = primary;
+                  ipv6 = gate-public.hosts.gate.v6.address;
+                  ptr = null;
+                };
 
-                    v4Net = cfg.ptrNet.v4;
-                    v6Net = cfg.ptrNet.v6;
+              ptr = let
+                ptrsToRecords = mapAttrsToList (suffix: target: {
+                  name = suffix;
+                  inherit target;
+                });
 
-                    v4Records = optionals (v4Net != null) (ptrsToRecords ptrNets.${v4Net}.v4.targets);
-                    v6Records = optionals (v6Net != null) (ptrsToRecords ptrNets.${v6Net}.v6.targets);
-                  in
-                  v4Records ++ v6Records;
+                v4Net = cfg.ptrNet.v4;
+                v6Net = cfg.ptrNet.v6;
 
-                soa = mkIf ptrDomain {
-                  authorityZone = mkDefault "${domain}.";
-                };
+                v4Records = optionals (v4Net != null) (ptrsToRecords ptrNets.${v4Net}.v4.targets);
+                v6Records = optionals (v6Net != null) (ptrsToRecords ptrNets.${v6Net}.v6.targets);
+              in
+                v4Records ++ v6Records;
 
-                cname = mapAttrsToList
-                  (name: id: {
-                    name = "_acme-challenge" + optionalString (name != "@") ".${name}";
-                    target = "${id}.acme-challenge.${domain}.";
-                  })
-                  cfg.acme;
+              soa = mkIf ptrDomain {
+                authorityZone = mkDefault "${domain}.";
               };
-          }));
-  };
 
-  config =
-    {
-      assertions = mapAttrsToList
-        (name: zone: {
-          assertion = zone.localNS.ptrNet.v4 != null -> zone.localNS.ptrNet.v6 == null;
-          message = "zone '${name}' defined as both a v4 and v6 PTR zone";
-        })
-        config.local.ns.zones;
-
-      local.ns.ptr =
-        let
-          zonePtrNets = name: zone:
-            optionalAttrs (zone.localNS.ptrNet.v4 != null)
-              {
-                ${zone.localNS.ptrNet.v4}.v4.zone = name;
-              } // optionalAttrs (zone.localNS.ptrNet.v6 != null) {
-              ${zone.localNS.ptrNet.v6}.v6.zone = name;
+              cname =
+                mapAttrsToList
+                (name: id: {
+                  name = "_acme-challenge" + optionalString (name != "@") ".${name}";
+                  target = "${id}.acme-challenge.${domain}.";
+                })
+                cfg.acme;
             };
-        in
-        mkMerge (flatten (mapAttrsToList zonePtrNets (filterAttrs (_: zone: zone.localNS.enable) config.local.ns.zones)));
-    };
+        }));
+  };
+
+  config = {
+    assertions =
+      mapAttrsToList
+      (name: zone: {
+        assertion = zone.localNS.ptrNet.v4 != null -> zone.localNS.ptrNet.v6 == null;
+        message = "zone '${name}' defined as both a v4 and v6 PTR zone";
+      })
+      config.local.ns.zones;
+
+    local.ns.ptr = let
+      zonePtrNets = name: zone:
+        optionalAttrs (zone.localNS.ptrNet.v4 != null)
+        {
+          ${zone.localNS.ptrNet.v4}.v4.zone = name;
+        }
+        // optionalAttrs (zone.localNS.ptrNet.v6 != null) {
+          ${zone.localNS.ptrNet.v6}.v6.zone = name;
+        };
+    in
+      mkMerge (flatten (mapAttrsToList zonePtrNets (filterAttrs (_: zone: zone.localNS.enable) config.local.ns.zones)));
+  };
 }
diff --git a/sys/ns/nsd.nix b/sys/ns/nsd.nix
index 1dfa16b..d49e464 100644
--- a/sys/ns/nsd.nix
+++ b/sys/ns/nsd.nix
@@ -1,12 +1,15 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   inherit (config.networking) domain;
 
   cfg = config.local.ns.server;
 
   acmeChallengeDomain = "acme-challenge.${domain}";
-in
-{
+in {
   options. local. ns. server = {
     enable = mkEnableOption "nsd authoritative server";
 
@@ -34,14 +37,12 @@ in
       }
     ];
 
-    networking.firewall =
-      let
-        inherit (config.services.nsd) port;
-      in
-      {
-        allowedTCPPorts = [ port ];
-        allowedUDPPorts = [ port ];
-      };
+    networking.firewall = let
+      inherit (config.services.nsd) port;
+    in {
+      allowedTCPPorts = [port];
+      allowedUDPPorts = [port];
+    };
 
     services = {
       acme-dns = {
diff --git a/sys/ns/ptr/default.nix b/sys/ns/ptr/default.nix
index d583dd7..b4fba7e 100644
--- a/sys/ns/ptr/default.nix
+++ b/sys/ns/ptr/default.nix
@@ -1,8 +1,6 @@
-{ config, ... }:
-let
+{config, ...}: let
   inherit (config.local) nets;
-in
-{
+in {
   config.local.ns.zones = {
     ${nets.gate-public.v4.ptrDomain} = import ./gate-public-v4;
     ${nets.gate-public.v6.ptrDomain} = import ./gate-public-v6;
diff --git a/sys/ns/ptr/gate-public-v4/default.nix b/sys/ns/ptr/gate-public-v4/default.nix
index a2595d9..44c7f2e 100644
--- a/sys/ns/ptr/gate-public-v4/default.nix
+++ b/sys/ns/ptr/gate-public-v4/default.nix
@@ -1,8 +1,6 @@
-{ config, ... }:
-let
+{config, ...}: let
   inherit (config.local) nets;
-in
-{
+in {
   imports = [
     ./serial.nix
   ];
diff --git a/sys/ns/ptr/gate-public-v4/serial.nix b/sys/ns/ptr/gate-public-v4/serial.nix
index c3a41e9..008e5d8 100644
--- a/sys/ns/ptr/gate-public-v4/serial.nix
+++ b/sys/ns/ptr/gate-public-v4/serial.nix
@@ -4,4 +4,3 @@
     nullSerialHash = "sha256-afaedee02017aabd45b944a657ce91515866982c7cb900927edcee6d2b39c731";
   };
 }
-
diff --git a/sys/ns/ptr/gate-public-v6/default.nix b/sys/ns/ptr/gate-public-v6/default.nix
index 15a4095..674421f 100644
--- a/sys/ns/ptr/gate-public-v6/default.nix
+++ b/sys/ns/ptr/gate-public-v6/default.nix
@@ -1,8 +1,6 @@
-{ config, ... }:
-let
+{config, ...}: let
   inherit (config.local) nets;
-in
-{
+in {
   imports = [
     ./serial.nix
   ];
diff --git a/sys/ns/ptr/gate-public-v6/serial.nix b/sys/ns/ptr/gate-public-v6/serial.nix
index 2f1b4a9..126a17e 100644
--- a/sys/ns/ptr/gate-public-v6/serial.nix
+++ b/sys/ns/ptr/gate-public-v6/serial.nix
@@ -4,4 +4,3 @@
     nullSerialHash = "sha256-9a8ac8849ea6c8993e44feefe439b96c643e2ccf3a03d0d700558e9a188f57d7";
   };
 }
-
diff --git a/sys/ns/ptr/static-prefix-v6/default.nix b/sys/ns/ptr/static-prefix-v6/default.nix
index f02222c..7688b97 100644
--- a/sys/ns/ptr/static-prefix-v6/default.nix
+++ b/sys/ns/ptr/static-prefix-v6/default.nix
@@ -1,8 +1,6 @@
-{ config, ... }:
-let
+{config, ...}: let
   inherit (config.local) nets;
-in
-{
+in {
   imports = [
     ./serial.nix
   ];
diff --git a/sys/ns/ptr/static-prefix-v6/serial.nix b/sys/ns/ptr/static-prefix-v6/serial.nix
index 454b3dd..a7c214a 100644
--- a/sys/ns/ptr/static-prefix-v6/serial.nix
+++ b/sys/ns/ptr/static-prefix-v6/serial.nix
@@ -4,4 +4,3 @@
     nullSerialHash = "sha256-a5ce7781b014aa816998410db440dd40278d8b566d1de76e06776a83c9839b35";
   };
 }
-
diff --git a/sys/ns/rr.nix b/sys/ns/rr.nix
index e4fbe12..8b4d119 100644
--- a/sys/ns/rr.nix
+++ b/sys/ns/rr.nix
@@ -1,4 +1,10 @@
-{ config, lib, options, pkgs, ... }:
+{
+  config,
+  lib,
+  options,
+  pkgs,
+  ...
+}:
 with lib; let
   inherit (config.local) nets;
 
@@ -11,15 +17,13 @@ with lib; let
   domainRefType = lib.types.strMatching "@|${segmentRegex}\\.?";
   domainNameType = lib.types.strMatching "${segmentRegex}\\.";
 
-  zoneHashCheck = name: zone:
-    let
-      zoneHash = algorithm: "${algorithm}-${builtins.hashString algorithm cfg.nullSerialZones.${name}.content}";
-      expected = zoneHash "sha256";
-    in
-    {
-      inherit expected zone;
-      needsUpdate = zone.soa.serial == null || zone.nullSerialHash != expected;
-    };
+  zoneHashCheck = name: zone: let
+    zoneHash = algorithm: "${algorithm}-${builtins.hashString algorithm cfg.nullSerialZones.${name}.content}";
+    expected = zoneHash "sha256";
+  in {
+    inherit expected zone;
+    needsUpdate = zone.soa.serial == null || zone.nullSerialHash != expected;
+  };
 
   rrTypes = [
     "A"
@@ -32,8 +36,7 @@ with lib; let
     "SRV"
     "TXT"
   ];
-in
-{
+in {
   options.local.ns = {
     nullSerialZones = mkOption {
       type = options.local.ns.zones.type;
@@ -41,54 +44,62 @@ in
     };
 
     ptr = mkOption {
-      default = { };
+      default = {};
 
-      type = with lib.types; attrsOf (submodule {
-        options = {
-          v4 = {
-            zone = mkOption {
-              type = nullOr str;
-              default = null;
-            };
+      type = with lib.types;
+        attrsOf (submodule {
+          options = {
+            v4 = {
+              zone = mkOption {
+                type = nullOr str;
+                default = null;
+              };
 
-            targets = mkOption {
-              type = attrsOf str;
-              default = { };
+              targets = mkOption {
+                type = attrsOf str;
+                default = {};
+              };
             };
-          };
 
-          v6 = {
-            zone = mkOption {
-              type = nullOr str;
-              default = null;
-            };
+            v6 = {
+              zone = mkOption {
+                type = nullOr str;
+                default = null;
+              };
 
-            targets = mkOption {
-              type = attrsOf str;
-              default = { };
+              targets = mkOption {
+                type = attrsOf str;
+                default = {};
+              };
             };
           };
-        };
-      });
+        });
     };
 
     zones = mkOption {
-      default = { };
-
-      type = with lib.types; attrsOf (submodule ({ config, name, ... }:
-        let
-          nameOption = args@{ defaultZone ? "${name}.", permitRelative ? true, ... }:
-            mkOption (removeAttrs args [ "defaultZone" "permitRelative" ] // {
+      default = {};
+
+      type = with lib.types; attrsOf (submodule ({
+        config,
+        name,
+        ...
+      }: let
+        nameOption = args @ {
+          defaultZone ? "${name}.",
+          permitRelative ? true,
+          ...
+        }:
+          mkOption (removeAttrs args ["defaultZone" "permitRelative"]
+            // {
               type = domainRefType;
 
-              apply = value:
-                let
-                  zone =
-                    throwIfNot
-                      (hasSuffix "." defaultZone)
-                      "zone expression '${defaultZone}' must be absolute, not relative"
-                      defaultZone;
-                in
+              apply = value: let
+                zone =
+                  throwIfNot
+                  (hasSuffix "." defaultZone)
+                  "zone expression '${defaultZone}' must be absolute, not relative"
+                  defaultZone;
+              in
                 if value == "@"
                 then zone
                 else if hasSuffix "." value
@@ -98,401 +109,410 @@ in
                 else throw "zone expression '${value}' in zone '${zone}' must be absolute, not relative";
             });
 
-          rrType = options: mkOption {
-            default = [ ];
+        rrType = options:
+          mkOption {
+            default = [];
             type = listOf (submodule {
-              options = options // {
-                name = nameOption { };
-
-                ttl = mkOption {
-                  type = int;
-                  default = config.defaultTTL;
+              options =
+                options
+                // {
+                  name = nameOption {};
+
+                  ttl = mkOption {
+                    type = int;
+                    default = config.defaultTTL;
+                  };
                 };
-              };
             });
           };
 
-          rrConfig = { rrs, type, format, applyName ? (rr: rr.name) }: (map
-            (rr: {
-              inherit type;
-              inherit (rr) ttl;
+        rrConfig = {
+          rrs,
+          type,
+          format,
+          applyName ? (rr: rr.name),
+        }: (map
+          (rr: {
+            inherit type;
+            inherit (rr) ttl;
+
+            data = format rr;
+            name = applyName rr;
+          })
+          rrs);
+      in {
+        options = {
+          local = mkOption {
+            type = unspecified;
+            default = globalConfig.local;
+            readOnly = true;
+          };
 
-              data = format rr;
-              name = applyName rr;
-            })
-            rrs);
-        in
-        {
-          options = {
-            local = mkOption {
-              type = unspecified;
-              default = globalConfig.local;
-              readOnly = true;
-            };
+          defaultTTL = mkOption {
+            type = int;
+            default = 3600;
+          };
 
-            defaultTTL = mkOption {
-              type = int;
-              default = 3600;
+          ptrName = mkOption {
+            type = nullOr str;
+            default = null;
+          };
+
+          defaultPtr = {
+            v4 = mkOption {
+              type = nullOr str;
+              default = null;
             };
 
-            ptrName = mkOption {
+            v6 = mkOption {
               type = nullOr str;
               default = null;
             };
+          };
 
-            defaultPtr = {
-              v4 = mkOption {
-                type = nullOr str;
-                default = null;
-              };
+          nsdConfig = mkOption {
+            type = attrsOf unspecified;
+            default = {};
+          };
 
-              v6 = mkOption {
-                type = nullOr str;
-                default = null;
-              };
+          content = mkOption {
+            type = lines;
+            readOnly = true;
+          };
+
+          nullSerialHash = mkOption {
+            type = nullOr str;
+            default = null;
+          };
+
+          rr = mkOption {
+            default = [];
+            type =
+              listOf
+              (submodule {
+                options = {
+                  name = nameOption {};
+
+                  ttl = mkOption {
+                    type = int;
+                  };
+
+                  class = mkOption {
+                    type = enum ["IN"];
+                    default = "IN";
+                  };
+
+                  type = mkOption {
+                    type = enum rrTypes;
+                  };
+
+                  data = mkOption {
+                    type = listOf (either int str);
+                    default = [];
+                  };
+                };
+              });
+          };
+
+          soa = {
+            authorityZone = nameOption {
+              default = "@";
+              permitRelative = false;
+            };
+
+            ttl = mkOption {
+              type = int;
+              default = config.defaultTTL;
             };
 
-            nsdConfig = mkOption {
-              type = attrsOf unspecified;
-              default = { };
+            primary = nameOption {
+              default = "ns1";
+              defaultZone = config.soa.authorityZone;
             };
 
-            content = mkOption {
-              type = lines;
-              readOnly = true;
+            hostmaster = mkOption {
+              type = emailType;
+              default = "hostmaster";
+
+              apply = address: let
+                split = splitString "@" address;
+
+                user = head split;
+                domain =
+                  if length split == 2
+                  then head (tail split)
+                  else removeSuffix "." config.soa.authorityZone;
+              in
+                if hasSuffix "." address
+                then address
+                else "${replaceStrings ["."] ["\\."] user}.${domain}.";
             };
 
-            nullSerialHash = mkOption {
-              type = nullOr str;
+            serial = mkOption {
+              type = nullOr int;
               default = null;
             };
 
-            rr = mkOption {
-              default = [ ];
-              type = listOf
-                (submodule {
-                  options = {
-                    name = nameOption { };
-
-                    ttl = mkOption {
-                      type = int;
-                    };
-
-                    class = mkOption {
-                      type = enum [ "IN" ];
-                      default = "IN";
-                    };
-
-                    type = mkOption {
-                      type = enum rrTypes;
-                    };
-
-                    data = mkOption {
-                      type = listOf (either int str);
-                      default = [ ];
-                    };
-                  };
-                });
+            refresh = mkOption {
+              type = int;
+              default = 3 * 3600;
             };
 
-            soa = {
-              authorityZone = nameOption { default = "@"; permitRelative = false; };
-
-              ttl = mkOption {
-                type = int;
-                default = config.defaultTTL;
-              };
+            retry = mkOption {
+              type = int;
+              default = 3600;
+            };
 
-              primary = nameOption {
-                default = "ns1";
-                defaultZone = config.soa.authorityZone;
-              };
+            expire = mkOption {
+              type = int;
+              default = 7 * 24 * 3600;
+            };
 
-              hostmaster = mkOption {
-                type = emailType;
-                default = "hostmaster";
+            negativeTTL = mkOption {
+              type = int;
+              default = 3600;
+            };
+          };
 
-                apply = address:
-                  let
-                    split = splitString "@" address;
+          a = rrType {
+            ipv4 = mkOption {
+              type = str;
+            };
 
-                    user = head split;
-                    domain = if length split == 2 then head (tail split) else removeSuffix "." config.soa.authorityZone;
-                  in
-                  if hasSuffix "." address
-                  then address
-                  else "${replaceStrings [ "." ] [ "\\." ] user}.${domain}.";
-              };
+            ptr = mkOption {
+              type = nullOr str;
+              default = config.defaultPtr.v4;
+            };
+          };
 
-              serial = mkOption {
-                type = nullOr int;
-                default = null;
-              };
+          aaaa = rrType {
+            ipv6 = mkOption {
+              type = str;
+            };
 
-              refresh = mkOption {
-                type = int;
-                default = 3 * 3600;
-              };
+            ptr = mkOption {
+              type = nullOr str;
+              default = config.defaultPtr.v6;
+            };
+          };
 
-              retry = mkOption {
-                type = int;
-                default = 3600;
-              };
+          cname = rrType {
+            target = nameOption {};
+          };
 
-              expire = mkOption {
-                type = int;
-                default = 7 * 24 * 3600;
-              };
+          mx = rrType {
+            host = nameOption {};
 
-              negativeTTL = mkOption {
-                type = int;
-                default = 3600;
-              };
+            priority = mkOption {
+              type = int;
             };
+          };
 
-            a = rrType {
-              ipv4 = mkOption {
-                type = str;
-              };
+          ns = rrType {
+            host = nameOption {};
+          };
 
-              ptr = mkOption {
-                type = nullOr str;
-                default = config.defaultPtr.v4;
-              };
-            };
+          ptr = rrType {
+            target = nameOption {};
+          };
 
-            aaaa = rrType {
-              ipv6 = mkOption {
-                type = str;
-              };
+          srv = rrType {
+            host = nameOption {};
 
-              ptr = mkOption {
-                type = nullOr str;
-                default = config.defaultPtr.v6;
-              };
+            port = mkOption {
+              type = port;
             };
 
-            cname = rrType {
-              target = nameOption { };
+            priority = mkOption {
+              type = int;
             };
 
-            mx = rrType {
-              host = nameOption { };
+            proto = mkOption {
+              type = enum ["tcp" "udp"];
+            };
 
-              priority = mkOption {
-                type = int;
-              };
+            service = mkOption {
+              type = str;
             };
 
-            ns = rrType {
-              host = nameOption { };
+            weight = mkOption {
+              type = int;
             };
+          };
 
-            ptr = rrType {
-              target = nameOption { };
+          txt = rrType {
+            text = mkOption {
+              type = strMatching "[^\"\n\\]*\n?";
+              apply = removeSuffix "\n";
             };
+          };
+        };
 
-            srv = rrType {
-              host = nameOption { };
+        config = {
+          nsdConfig.data = config.content;
+
+          content = let
+            rrLine = rr: concatMapStringsSep " " toString ([rr.name rr.ttl rr.class rr.type] ++ rr.data);
+          in
+            ''
+              $ORIGIN ${name}.
+              $TTL ${toString config.defaultTTL}
+            ''
+            + concatLines (map rrLine config.rr);
+
+          rr = mkMerge [
+            (mkOrder 0 (singleton {
+              inherit (config.soa) ttl;
+
+              name = "${name}.";
+              type = "SOA";
+
+              data = with config.soa; [
+                primary
+                hostmaster
+                (throwIf (serial == null) "No serial defined for zone ${name}" serial)
+                refresh
+                retry
+                expire
+                negativeTTL
+              ];
+            }))
+
+            (mkOrder 1 (rrConfig {
+              rrs = config.ns;
+              type = "NS";
+              format = rr: [rr.host];
+            }))
+
+            (rrConfig {
+              rrs = config.a;
+              type = "A";
+              format = rr: [rr.ipv4];
+            })
 
-              port = mkOption {
-                type = port;
-              };
+            (rrConfig {
+              rrs = config.aaaa;
+              type = "AAAA";
+              format = rr: [rr.ipv6];
+            })
 
-              priority = mkOption {
-                type = int;
-              };
+            (rrConfig {
+              rrs = config.cname;
+              type = "CNAME";
+              format = rr: [rr.target];
+            })
 
-              proto = mkOption {
-                type = enum [ "tcp" "udp" ];
-              };
+            (rrConfig {
+              rrs = config.mx;
+              type = "MX";
+              format = rr: [rr.priority rr.host];
+            })
 
-              service = mkOption {
-                type = str;
-              };
+            (rrConfig {
+              rrs = config.ptr;
+              type = "PTR";
+              format = rr: [rr.target];
+            })
 
-              weight = mkOption {
-                type = int;
-              };
-            };
+            (rrConfig {
+              rrs = config.srv;
+              type = "SRV";
 
-            txt = rrType {
-              text = mkOption {
-                type = strMatching "[^\"\n\\]*\n?";
-                apply = removeSuffix "\n";
-              };
-            };
-          };
+              format = rr: [rr.priority rr.weight rr.port rr.host];
+              applyName = rr: "_${rr.service}._${rr.proto}.${rr.name}";
+            })
 
-          config = {
-            nsdConfig.data = config.content;
+            (rrConfig {
+              rrs = config.txt;
+              type = "TXT";
 
-            content =
-              let
-                rrLine = rr: concatMapStringsSep " " toString ([ rr.name rr.ttl rr.class rr.type ] ++ rr.data);
+              format = rr: let
+                # nsd-zonecheck: text string is longer than 255 characters, try splitting it into multiple parts
+                txtFragments = text: let
+                  max = 255;
+                  length = stringLength text;
+                in
+                  singleton (substring 0 max text) ++ optionals (length > max) (txtFragments (substring max length text));
               in
-              ''
-                $ORIGIN ${name}.
-                $TTL ${toString config.defaultTTL}
-              '' + concatLines (map rrLine config.rr);
-
-            rr = mkMerge [
-              (mkOrder 0 (singleton {
-                inherit (config.soa) ttl;
-
-                name = "${name}.";
-                type = "SOA";
-
-                data = with config.soa; [
-                  primary
-                  hostmaster
-                  (throwIf (serial == null) "No serial defined for zone ${name}" serial)
-                  refresh
-                  retry
-                  expire
-                  negativeTTL
-                ];
-              }))
-
-              (mkOrder 1 (rrConfig {
-                rrs = config.ns;
-                type = "NS";
-                format = rr: [ rr.host ];
-              }))
-
-              (rrConfig {
-                rrs = config.a;
-                type = "A";
-                format = rr: [ rr.ipv4 ];
-              })
-
-              (rrConfig {
-                rrs = config.aaaa;
-                type = "AAAA";
-                format = rr: [ rr.ipv6 ];
-              })
-
-              (rrConfig {
-                rrs = config.cname;
-                type = "CNAME";
-                format = rr: [ rr.target ];
-              })
-
-              (rrConfig {
-                rrs = config.mx;
-                type = "MX";
-                format = rr: [ rr.priority rr.host ];
-              })
-
-              (rrConfig {
-                rrs = config.ptr;
-                type = "PTR";
-                format = rr: [ rr.target ];
-              })
-
-              (rrConfig {
-                rrs = config.srv;
-                type = "SRV";
-
-                format = rr: [ rr.priority rr.weight rr.port rr.host ];
-                applyName = rr: "_${rr.service}._${rr.proto}.${rr.name}";
-              })
-
-              (rrConfig {
-                rrs = config.txt;
-                type = "TXT";
-
-                format = rr:
-                  let
-                    # nsd-zonecheck: text string is longer than 255 characters, try splitting it into multiple parts
-                    txtFragments = text:
-                      let
-                        max = 255;
-                        length = stringLength text;
-                      in
-                      singleton (substring 0 max text) ++ optionals (length > max) (txtFragments (substring max length text));
-                  in
-                  map (fragment: "\"${fragment}\"") (txtFragments rr.text);
-              })
-            ];
-          };
-        }));
+                map (fragment: "\"${fragment}\"") (txtFragments rr.text);
+            })
+          ];
+        };
+      }));
     };
   };
 
   config = {
-    assertions = [
-      (
-        let
-          badZones = attrNames (filterAttrs (name: zone: (zoneHashCheck name zone).needsUpdate) cfg.zones);
-        in
-        {
-          assertion = badZones == [ ];
-          message = "Update serials for these zones (null-serial hash mismatch): ${concatStringsSep ", " badZones}";
-        }
-      )
-    ] ++ flatten (mapAttrsToList
-      (name: ptr: [
-        {
-          assertion = ptr.v4.targets != { } -> ptr.v4.zone != null;
-          message = "undefined v4 PTR net '${name}': ${concatStringsSep ", " (attrValues ptr.v4.targets)}";
-        }
-        {
-          assertion = ptr.v6.targets != { } -> ptr.v6.zone != null;
-          message = "undefined v6 PTR net '${name}': ${concatStringsSep ", " (attrValues ptr.v6.targets)}";
-        }
-      ])
-      cfg.ptr);
-
-    lib.local.zoneSerialUpdates =
-      let
-        ptrChecks = filterAttrs (_: check: check.zone.ptrName != null) allZoneChecks;
-        zoneChecks = filterAttrs (_: check: check.zone.ptrName == null) allZoneChecks;
-        allZoneChecks = filterAttrs (_: check: check.needsUpdate) (mapAttrs zoneHashCheck cfg.zones);
-
-        updateInfo = name: check: {
-          inherit name;
-          inherit (check) expected;
-          inherit (check.zone.soa) serial;
-        };
-      in
-      {
-        ptr = mapAttrs (_: check: updateInfo check.zone.ptrName check) ptrChecks;
-        zones = mapAttrs updateInfo zoneChecks;
+    assertions =
+      [
+        (
+          let
+            badZones = attrNames (filterAttrs (name: zone: (zoneHashCheck name zone).needsUpdate) cfg.zones);
+          in {
+            assertion = badZones == [];
+            message = "Update serials for these zones (null-serial hash mismatch): ${concatStringsSep ", " badZones}";
+          }
+        )
+      ]
+      ++ flatten (mapAttrsToList
+        (name: ptr: [
+          {
+            assertion = ptr.v4.targets != {} -> ptr.v4.zone != null;
+            message = "undefined v4 PTR net '${name}': ${concatStringsSep ", " (attrValues ptr.v4.targets)}";
+          }
+          {
+            assertion = ptr.v6.targets != {} -> ptr.v6.zone != null;
+            message = "undefined v6 PTR net '${name}': ${concatStringsSep ", " (attrValues ptr.v6.targets)}";
+          }
+        ])
+        cfg.ptr);
+
+    lib.local.zoneSerialUpdates = let
+      ptrChecks = filterAttrs (_: check: check.zone.ptrName != null) allZoneChecks;
+      zoneChecks = filterAttrs (_: check: check.zone.ptrName == null) allZoneChecks;
+      allZoneChecks = filterAttrs (_: check: check.needsUpdate) (mapAttrs zoneHashCheck cfg.zones);
+
+      updateInfo = name: check: {
+        inherit name;
+        inherit (check) expected;
+        inherit (check.zone.soa) serial;
       };
+    in {
+      ptr = mapAttrs (_: check: updateInfo check.zone.ptrName check) ptrChecks;
+      zones = mapAttrs updateInfo zoneChecks;
+    };
 
     local.ns = {
-      nullSerialZones =
-        let
-          defaultAttrs = [ "defaultTTL" "defaultPtr" "ptrName" ];
-          filteredAttrs = defaultAttrs ++ map toLower rrTypes;
-        in
+      nullSerialZones = let
+        defaultAttrs = ["defaultTTL" "defaultPtr" "ptrName"];
+        filteredAttrs = defaultAttrs ++ map toLower rrTypes;
+      in
         mapAttrs
-          (_: zone: mkMerge [
+        (_: zone:
+          mkMerge [
             (filterAttrs (name: _: elem name filteredAttrs) zone)
-            { soa.serial = mkOverride 0 0; }
+            {soa.serial = mkOverride 0 0;}
           ])
-          cfg.zones;
-
-      ptr =
-        let
-          zonePtrs = zone:
-            let
-              v4Ptrs = map
-                (a: {
-                  ${a.ptr}.v4.targets.${nets.${a.ptr}.v4.ptrRecordName a.ipv4 32} = a.name;
-                })
-                (filter (a: a.ptr != null) zone.a);
-
-              v6Ptrs = map
-                (aaaa: {
-                  ${aaaa.ptr}.v6.targets.${nets.${aaaa.ptr}.v6.ptrRecordName aaaa.ipv6 128} = aaaa.name;
-                })
-                (filter (aaaa: aaaa.ptr != null) zone.aaaa);
-            in
-            v4Ptrs ++ v6Ptrs;
+        cfg.zones;
+
+      ptr = let
+        zonePtrs = zone: let
+          v4Ptrs =
+            map
+            (a: {
+              ${a.ptr}.v4.targets.${nets.${a.ptr}.v4.ptrRecordName a.ipv4 32} = a.name;
+            })
+            (filter (a: a.ptr != null) zone.a);
 
+          v6Ptrs =
+            map
+            (aaaa: {
+              ${aaaa.ptr}.v6.targets.${nets.${aaaa.ptr}.v6.ptrRecordName aaaa.ipv6 128} = aaaa.name;
+            })
+            (filter (aaaa: aaaa.ptr != null) zone.aaaa);
         in
+          v4Ptrs ++ v6Ptrs;
+      in
         mkMerge (flatten (mapAttrsToList (_: zonePtrs) cfg.zones));
     };
   };
diff --git a/sys/nspawn/dmz.nix b/sys/nspawn/dmz.nix
index fb3acea..805ca72 100644
--- a/sys/nspawn/dmz.nix
+++ b/sys/nspawn/dmz.nix
@@ -1,4 +1,10 @@
-{ lib, config, flakes, pkgs, ... }:
+{
+  lib,
+  config,
+  flakes,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.nspawn.dmz;
   inherit (config.local) mailHost;
@@ -7,8 +13,7 @@ with lib; let
 
   hassPort = config.services.home-assistant.config.http.server_port;
   hassEnable = config.local.home-assistant.enable;
-in
-{
+in {
   options.local.nspawn.dmz = {
     enable = mkEnableOption "DMZ services in a container";
 
@@ -60,71 +65,70 @@ in
       nspawn.dmz = {
         hostAddr6 = dmzNet.hosts.gateway.v6.address;
 
-        system =
-          let
-            containerModule = { ... }: {
-              #TODO: urgente: bloquear puertos de dovecot a non-postfix con iptables
-              config = {
-                local = {
-                  preset.dmz = {
-                    enable = true;
-                    container = true;
-                  };
+        system = let
+          containerModule = {...}: {
+            #TODO: urgente: bloquear puertos de dovecot a non-postfix con iptables
+            config = {
+              local = {
+                preset.dmz = {
+                  enable = true;
+                  container = true;
+                };
 
-                  mta = {
-                    mdaAddr = "[${mailHost.mdaListen}]";
-                    inherit (mailHost) saslPort lmtpPort;
-                  };
+                mta = {
+                  mdaAddr = "[${mailHost.mdaListen}]";
+                  inherit (mailHost) saslPort lmtpPort;
+                };
 
-                  web.sites = {
-                    home = {
-                      enable = hassEnable;
-                      proxyUrl = "http://[${cfg.hostAddr6}]:${toString hassPort}";
-                    };
+                web.sites = {
+                  home = {
+                    enable = hassEnable;
+                    proxyUrl = "http://[${cfg.hostAddr6}]:${toString hassPort}";
                   };
                 };
+              };
 
-                nixpkgs = {
-                  pkgs = mkDefault pkgs;
-                  localSystem = mkDefault pkgs.stdenv.hostPlatform;
-                };
+              nixpkgs = {
+                pkgs = mkDefault pkgs;
+                localSystem = mkDefault pkgs.stdenv.hostPlatform;
+              };
 
-                services.nginx.virtualHosts = {
-                  "${config.local.domains.imap.main}".locations."^~ /.well-known/acme-challenge/" = {
-                    root = "/var/lib/acme/acme-challenge";
+              services.nginx.virtualHosts = {
+                "${config.local.domains.imap.main}".locations."^~ /.well-known/acme-challenge/" = {
+                  root = "/var/lib/acme/acme-challenge";
 
-                    extraConfig = ''
-                      auth_basic off;
-                      auth_request off;
-                    '';
-                  };
+                  extraConfig = ''
+                    auth_basic off;
+                    auth_request off;
+                  '';
                 };
+              };
 
-                systemd.network.networks."40-host0" = {
-                  name = "host0";
+              systemd.network.networks."40-host0" = {
+                name = "host0";
 
-                  networkConfig = {
-                    DNS = [ cfg.dns64 ];
+                networkConfig = {
+                  DNS = [cfg.dns64];
 
-                    DHCP = "no";
-                    IPv6AcceptRA = "yes";
-                    LinkLocalAddressing = "ipv6";
-                  };
+                  DHCP = "no";
+                  IPv6AcceptRA = "yes";
+                  LinkLocalAddressing = "ipv6";
+                };
 
-                  ipv6AcceptRAConfig = {
-                    Token = [
-                      "static:::${dmzNet.hosts.dmz.v6.suffix}"
-                      "eui64"
-                      "static:::${dmzNet.hosts.mta.v6.suffix}"
-                      "static:::${dmzNet.hosts.web.v6.suffix}"
-                    ];
+                ipv6AcceptRAConfig = {
+                  Token = [
+                    "static:::${dmzNet.hosts.dmz.v6.suffix}"
+                    "eui64"
+                    "static:::${dmzNet.hosts.mta.v6.suffix}"
+                    "static:::${dmzNet.hosts.web.v6.suffix}"
+                  ];
 
-                    UseDNS = false;
-                  };
+                  UseDNS = false;
                 };
               };
             };
-          in
+          };
+        in
           # Tomado de la definición de pkgs.nixos junto con definición de nixpkgs.{pkgs,localSystem} arriba
           import "${flakes.nixpkgs}/nixos/lib/eval-config.nix" {
             modules = [
@@ -133,15 +137,15 @@ in
             ];
 
             system = null;
-            specialArgs = { inherit flakes; };
+            specialArgs = {inherit flakes;};
           };
       };
     };
 
     services = {
       home-assistant.config.http = mkIf hassEnable {
-        server_host = [ cfg.hostAddr6 ];
-        trusted_proxies = [ dmzNet.hosts.web.v6.address ];
+        server_host = [cfg.hostAddr6];
+        trusted_proxies = [dmzNet.hosts.web.v6.address];
         use_x_forwarded_for = true;
       };
     };
@@ -199,26 +203,27 @@ in
       };
 
       services = {
-        dovecot2.after = [ "systemd-nspawn@dmz.service" ];
+        dovecot2.after = ["systemd-nspawn@dmz.service"];
 
         "systemd-nspawn@dmz" = {
           overrideStrategy = "asDropin";
 
-          after = [ "network-online.target" ];
-          wants = [ "network-online.target" ];
-          wantedBy = [ "machines.target" ];
+          after = ["network-online.target"];
+          wants = ["network-online.target"];
+          wantedBy = ["machines.target"];
         };
       };
     };
 
     networking.firewall = {
-      allowedTCPPorts = [ 25 80 443 ];
+      allowedTCPPorts = [25 80 443];
 
       interfaces.ve-dmz = {
-        allowedTCPPorts = [ mailHost.saslPort mailHost.lmtpPort ]
+        allowedTCPPorts =
+          [mailHost.saslPort mailHost.lmtpPort]
           ++ optional hassEnable hassPort;
 
-        allowedUDPPorts = [ 67 ]; # DHCP
+        allowedUDPPorts = [67]; # DHCP
       };
     };
   };
diff --git a/sys/preset/dmz.nix b/sys/preset/dmz.nix
index d740d14..5a04c1e 100644
--- a/sys/preset/dmz.nix
+++ b/sys/preset/dmz.nix
@@ -1,8 +1,12 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.preset.dmz;
-in
-{
+in {
   options.local.preset.dmz = {
     enable = mkEnableOption "dmz preset";
 
@@ -48,7 +52,7 @@ in
     services = {
       resolved = {
         llmnr = "false";
-        fallbackDns = [ ]; # Disable the default systemd-resolved server list
+        fallbackDns = []; # Disable the default systemd-resolved server list
       };
     };
 
diff --git a/sys/preset/user.nix b/sys/preset/user.nix
index 886adae..fd9c5ff 100644
--- a/sys/preset/user.nix
+++ b/sys/preset/user.nix
@@ -1,9 +1,12 @@
-{ config, lib, pkgs, ... }:
-let
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
   inherit (lib) mkDefault;
   cfg = config.local.preset.user;
-in
-{
+in {
   options.local.preset.user = {
     enable = lib.mkEnableOption "user-like preset";
   };
diff --git a/sys/seat/default.nix b/sys/seat/default.nix
index be545e8..402047f 100644
--- a/sys/seat/default.nix
+++ b/sys/seat/default.nix
@@ -1,10 +1,14 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.seat;
 
   users = filterAttrs (_: user: user.install) config.local.users;
-in
-{
+in {
   options.local.seat = {
     enable = mkEnableOption "user seat";
 
@@ -23,9 +27,10 @@ in
     };
   };
 
-  config = mkIf cfg.enable
+  config =
+    mkIf cfg.enable
     (mkMerge [
-      ({
+      {
         hardware = {
           acpilight.enable = true;
         };
@@ -50,11 +55,14 @@ in
         };
 
         users = {
-          groups = mapAttrs (_: user: { inherit (user) gid; }) users // {
-            adbusers.gid = 1008;
-          };
+          groups =
+            mapAttrs (_: user: {inherit (user) gid;}) users
+            // {
+              adbusers.gid = 1008;
+            };
 
-          users = mapAttrs
+          users =
+            mapAttrs
             (username: user: {
               isNormalUser = true;
 
@@ -62,13 +70,16 @@ in
               description = user.gecos;
 
               group = username;
-              extraGroups = [ "users" ] ++ user.groups;
+              extraGroups = ["users"] ++ user.groups;
 
-              shell = if user.allowLogin then pkgs.zsh else null;
+              shell =
+                if user.allowLogin
+                then pkgs.zsh
+                else null;
             })
             users;
         };
-      })
+      }
       (mkIf cfg.graphical {
         environment = {
           sessionVariables.NIXOS_OZONE_WL = "1";
@@ -87,8 +98,8 @@ in
           gtklock = {
             enable = true;
 
-            config = { };
-            modules = [ ];
+            config = {};
+            modules = [];
           };
         };
 
@@ -101,7 +112,7 @@ in
 
           xserver = mkIf (!cfg.wayland) {
             enable = true;
-            videoDrivers = cfg.videoDrivers ++ [ "modesetting" "fbdev" ];
+            videoDrivers = cfg.videoDrivers ++ ["modesetting" "fbdev"];
             displayManager.startx.enable = mkDefault true;
           };
         };
@@ -109,18 +120,18 @@ in
         xdg.portal = {
           enable = true;
           wlr.enable = true;
-          extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
+          extraPortals = [pkgs.xdg-desktop-portal-gtk];
           xdgOpenUsePortal = true;
 
           # warning: xdg-desktop-portal 1.17 reworked how portal implementations are loaded, you
           # should either set `xdg.portal.config` or `xdg.portal.configPackages`
           # to specify which portal backend to use for the requested interface.
-          # 
+          #
           # https://github.com/flatpak/xdg-desktop-portal/blob/1.18.1/doc/portals.conf.rst.in
-          # 
+          #
           # If you simply want to keep the behaviour in < 1.17, which uses the first
           # portal implementation found in lexicographical order, use the following:
-          # 
+          #
           # xdg.portal.config.common.default = "*";
           config.common.default = "*";
         };
diff --git a/sys/syncthing/default.nix b/sys/syncthing/default.nix
index b87e683..951ad30 100644
--- a/sys/syncthing/default.nix
+++ b/sys/syncthing/default.nix
@@ -1,20 +1,23 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   cfg = config.local.syncthing;
-in
-{
+in {
   options.local.syncthing = {
     enable = mkEnableOption "syncthing server";
     openFirewall = mkEnableOption "syncthing firewall rules";
   };
 
   config = mkMerge [
-    ({
+    {
       networking.firewall = {
         allowedTCPPorts = optional cfg.openFirewall 22000;
         allowedUDPPorts = optional cfg.openFirewall 22000;
       };
-    })
+    }
     (mkIf cfg.enable {
       local.syncthing.openFirewall = true;
 
@@ -33,7 +36,7 @@ in
         relay = {
           enable = true;
 
-          pools = [ ];
+          pools = [];
           providedBy = "${config.networking.hostName}.${config.networking.domain}";
         };
       };
diff --git a/sys/virt/libvirt.nix b/sys/virt/libvirt.nix
index 1cc42a9..ebbfbcd 100644
--- a/sys/virt/libvirt.nix
+++ b/sys/virt/libvirt.nix
@@ -1,16 +1,22 @@
-{ config, flakes, lib, pkgs, ... }:
+{
+  config,
+  flakes,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.local.virt;
 
   inherit (config.lib.local) importAll;
 
-  doms = mapAttrs (_: dom: dom { inherit config lib pkgs; }) (importAll { root = ./dom; });
-in
-{
+  doms = mapAttrs (_: dom: dom {inherit config lib pkgs;}) (importAll {root = ./dom;});
+in {
   options.local.virt = {
     enable = mkEnableOption "hypervisor support";
 
-    dom = mapAttrs
+    dom =
+      mapAttrs
       (name: _: {
         enable = mkEnableOption "domain ${name}";
       })
@@ -19,21 +25,25 @@ in
 
   config = mkIf cfg.enable {
     local.boot.impermanence.directories = [
-      { directory = "/var/dom"; user = "root"; group = "qemu-libvirtd"; mode = "u=rwx,g=rx,o="; }
+      {
+        directory = "/var/dom";
+        user = "root";
+        group = "qemu-libvirtd";
+        mode = "u=rwx,g=rx,o=";
+      }
     ];
 
     virtualisation = {
       libvirt = {
         enable = any (dom: dom.enable) (attrValues cfg.dom);
 
-        connections."qemu:///system".domains =
-          let
-            makeDomain = def: {
-              active = true;
-              restart = false;
-              definition = flakes.nixvirt.lib.domain.writeXML def;
-            };
-          in
+        connections."qemu:///system".domains = let
+          makeDomain = def: {
+            active = true;
+            restart = false;
+            definition = flakes.nixvirt.lib.domain.writeXML def;
+          };
+        in
           map makeDomain (attrValues (filterAttrs (name: _: cfg.dom.${name}.enable) doms));
 
         swtpm.enable = true;
diff --git a/sys/web/nginx.nix b/sys/web/nginx.nix
index b6e7414..a054289 100644
--- a/sys/web/nginx.nix
+++ b/sys/web/nginx.nix
@@ -1,9 +1,12 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   cfg = config.local.web;
   inherit (config.local) domains;
-in
-{
+in {
   options.local.web = {
     enable = mkEnableOption "web server";
 
@@ -13,7 +16,7 @@ in
 
     ownedCerts = mkOption {
       type = with lib.types; listOf str;
-      default = [ ];
+      default = [];
     };
   };
 
@@ -72,7 +75,7 @@ in
       })
       cfg.ownedCerts);
 
-    networking.firewall.allowedTCPPorts = [ 80 443 ];
+    networking.firewall.allowedTCPPorts = [80 443];
 
     security = {
       acme.certs = listToAttrs (map
@@ -80,12 +83,12 @@ in
           name = domains.${name}.main;
           value = {
             group = mkDefault config.services.nginx.group;
-            reloadServices = [ "nginx.service" ];
+            reloadServices = ["nginx.service"];
           };
         })
         cfg.ownedCerts);
 
-      dhparams.params.nginx = { };
+      dhparams.params.nginx = {};
     };
   };
 }
diff --git a/sys/web/php-fpm.nix b/sys/web/php-fpm.nix
index 65276ba..33efe1a 100644
--- a/sys/web/php-fpm.nix
+++ b/sys/web/php-fpm.nix
@@ -2,151 +2,153 @@
 # See also:
 # - <https://albert.cx/20181125-use-separate-systemd-units-for-php-fpm-pools>
 # - <https://freedesktop.org/wiki/Software/systemd/DaemonSocketActivation/>
-
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 with lib; let
   cfg = config.services.php-fpm-isolated;
 
-  configFile = { pool, poolOpts, runtimeDir, sockFile, pidFile }:
-    let
-      config = {
-        global = {
-          daemonize = false;
-          error_log = "syslog";
-          pid = pidFile;
-        };
+  configFile = {
+    pool,
+    poolOpts,
+    runtimeDir,
+    sockFile,
+    pidFile,
+  }: let
+    config = {
+      global = {
+        daemonize = false;
+        error_log = "syslog";
+        pid = pidFile;
+      };
 
-        "${pool}" =
-          let
-            enforced = {
-              inherit (poolOpts) user group;
-              listen = sockFile;
-            };
+      "${pool}" = let
+        enforced = {
+          inherit (poolOpts) user group;
+          listen = sockFile;
+        };
 
-            defaults = {
-              "pm" = "dynamic";
-              "pm.max_children" = 16;
-              "pm.min_spare_servers" = 1;
-              "pm.max_spare_servers" = 4;
-              "pm.start_servers" = 1;
-              "catch_workers_output" = true;
-              "php_admin_flag[log_errors]" = true;
-              "env[PATH]" = makeBinPath [ pkgs.php ];
-            };
+        defaults = {
+          "pm" = "dynamic";
+          "pm.max_children" = 16;
+          "pm.min_spare_servers" = 1;
+          "pm.max_spare_servers" = 4;
+          "pm.start_servers" = 1;
+          "catch_workers_output" = true;
+          "php_admin_flag[log_errors]" = true;
+          "env[PATH]" = makeBinPath [pkgs.php];
+        };
 
-            env = mapAttrs'
-              (name: value: {
-                name = "env[${name}]";
-                value = "\"${escape [ "\"" ] value}\"";
-              })
-              poolOpts.env;
-          in
-          defaults // poolOpts.config // env // enforced;
-      };
-    in
-    (pkgs.formats.ini { }).generate "php-fpm-pool-${pool}.conf" config;
-in
-{
+        env =
+          mapAttrs'
+          (name: value: {
+            name = "env[${name}]";
+            value = "\"${escape ["\""] value}\"";
+          })
+          poolOpts.env;
+      in
+        defaults // poolOpts.config // env // enforced;
+    };
+  in
+    (pkgs.formats.ini {}).generate "php-fpm-pool-${pool}.conf" config;
+in {
   options.services.php-fpm-isolated.pools = mkOption {
-    default = { };
+    default = {};
 
-    type = with types; attrsOf (submodule {
-      options = {
-        enable = mkEnableOption "PHP-FPM pool";
+    type = with types;
+      attrsOf (submodule {
+        options = {
+          enable = mkEnableOption "PHP-FPM pool";
 
-        user = mkOption {
-          type = str;
-        };
+          user = mkOption {
+            type = str;
+          };
 
-        group = mkOption {
-          type = str;
-        };
+          group = mkOption {
+            type = str;
+          };
 
-        unveil = mkOption {
-          type = listOf (either package str);
-        };
+          unveil = mkOption {
+            type = listOf (either package str);
+          };
 
-        env = mkOption {
-          type = attrsOf str;
-          default = { };
-        };
+          env = mkOption {
+            type = attrsOf str;
+            default = {};
+          };
 
-        config = mkOption {
-          type = attrsOf (oneOf [ int str bool ]);
-          default = { };
+          config = mkOption {
+            type = attrsOf (oneOf [int str bool]);
+            default = {};
+          };
         };
-      };
-    });
+      });
   };
 
-  config.systemd =
-    let
-      php-fpm = "${pkgs.php}/bin/php-fpm";
-
-      unitsFor = pool: poolOpts:
-        let
-          runtimeBase = "php-fpm-isolated/${pool}";
-          runtimeDir = "/run/${runtimeBase}";
-          pidFile = "${runtimeDir}/${pool}.pid";
-          sockFile = "${runtimeDir}/${pool}.sock";
-        in
-        {
-          name = "php-fpm-pool-${pool}";
-
-          value.service = {
-            description = "PHP-FPM process manager for pool '${pool}'";
-            after = [ "network.target" ];
-
-            confinement.enable = true;
-
-            serviceConfig = {
-              Type = "notify";
-              ExecReload = "${pkgs.coreutils}/bin/kill -USR2 $MAINPID";
-              PIDFile = pidFile;
-
-              Environment = "FPM_SOCKETS=${sockFile}=3";
-
-              ExecStart =
-                let
-                  fpmConfig = configFile {
-                    inherit pool poolOpts runtimeDir sockFile pidFile;
-                  };
-                in
-                "${php-fpm} --nodaemonize --fpm-config ${fpmConfig} --pid ${pidFile}";
-
-              PrivateTmp = true;
-              PrivateNetwork = true;
-              PrivateDevices = true;
-              # XXX: We need AF_NETLINK to make the sendmail SUID binary from postfix work
-              RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
-
-              User = poolOpts.user;
-              Group = poolOpts.group;
-              RuntimeDirectory = runtimeBase;
-
-              BindReadOnlyPaths =
-                let
-                  unveiled = map builtins.toString poolOpts.unveil;
-                in
-                [ "/run/systemd/journal/socket" ] ++ unveiled;
-            };
-          };
+  config.systemd = let
+    php-fpm = "${pkgs.php}/bin/php-fpm";
+
+    unitsFor = pool: poolOpts: let
+      runtimeBase = "php-fpm-isolated/${pool}";
+      runtimeDir = "/run/${runtimeBase}";
+      pidFile = "${runtimeDir}/${pool}.pid";
+      sockFile = "${runtimeDir}/${pool}.sock";
+    in {
+      name = "php-fpm-pool-${pool}";
 
-          value.socket = {
-            description = "PHP-FPM socket for pool '${pool}'";
-            listenStreams = [ sockFile ];
+      value.service = {
+        description = "PHP-FPM process manager for pool '${pool}'";
+        after = ["network.target"];
 
-            socketConfig = {
-              User = poolOpts.user;
-              Group = poolOpts.group;
+        confinement.enable = true;
+
+        serviceConfig = {
+          Type = "notify";
+          ExecReload = "${pkgs.coreutils}/bin/kill -USR2 $MAINPID";
+          PIDFile = pidFile;
+
+          Environment = "FPM_SOCKETS=${sockFile}=3";
+
+          ExecStart = let
+            fpmConfig = configFile {
+              inherit pool poolOpts runtimeDir sockFile pidFile;
             };
-          };
+          in "${php-fpm} --nodaemonize --fpm-config ${fpmConfig} --pid ${pidFile}";
+
+          PrivateTmp = true;
+          PrivateNetwork = true;
+          PrivateDevices = true;
+          # XXX: We need AF_NETLINK to make the sendmail SUID binary from postfix work
+          RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
+
+          User = poolOpts.user;
+          Group = poolOpts.group;
+          RuntimeDirectory = runtimeBase;
+
+          BindReadOnlyPaths = let
+            unveiled = map builtins.toString poolOpts.unveil;
+          in
+            ["/run/systemd/journal/socket"] ++ unveiled;
         };
+      };
+
+      value.socket = {
+        description = "PHP-FPM socket for pool '${pool}'";
+        listenStreams = [sockFile];
 
-      units = mapAttrs' unitsFor (filterAttrs (_: pool: pool.enable) cfg.pools);
-    in
-    {
-      sockets = mapAttrs (_: unit: unit.socket) units;
-      services = mapAttrs (_: unit: unit.service) units;
+        socketConfig = {
+          User = poolOpts.user;
+          Group = poolOpts.group;
+        };
+      };
     };
+
+    units = mapAttrs' unitsFor (filterAttrs (_: pool: pool.enable) cfg.pools);
+  in {
+    sockets = mapAttrs (_: unit: unit.socket) units;
+    services = mapAttrs (_: unit: unit.service) units;
+  };
 }
diff --git a/sys/web/sites/home.nix b/sys/web/sites/home.nix
index 616bf94..fed9b84 100644
--- a/sys/web/sites/home.nix
+++ b/sys/web/sites/home.nix
@@ -1,9 +1,12 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   cfg = config.local.web.sites.home;
   inherit (config.local) domains;
-in
-{
+in {
   options.local.web.sites.home = {
     enable = mkEnableOption "home site";
 
@@ -15,7 +18,7 @@ in
   config = mkIf cfg.enable {
     local.web = {
       enable = mkDefault true;
-      ownedCerts = [ "home" ];
+      ownedCerts = ["home"];
     };
 
     services.nginx.virtualHosts.${domains.home.main} = {
diff --git a/sys/web/sites/host.nix b/sys/web/sites/host.nix
index 32ef1a6..ea6cc23 100644
--- a/sys/web/sites/host.nix
+++ b/sys/web/sites/host.nix
@@ -1,4 +1,8 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   cfg = config.local.web.sites.host;
 
@@ -10,15 +14,15 @@ with lib; let
   hostDomainName = "host-${hostname}";
 
   userCerts = flatten (flatten (mapAttrsToList
-    (name: user: map
+    (name: user:
+      map
       (cert: {
         fprint = config.local.pki.byPath.${cert}.fingerprint.sha1-lower;
         inherit name;
       })
       user.mail.certs)
     users));
-in
-{
+in {
   options.local.web.sites.host = {
     enable = mkEnableOption "host site, restricted to per-user client certs";
   };
@@ -26,7 +30,7 @@ in
   config = mkIf cfg.enable {
     local.web = {
       enable = mkDefault true;
-      ownedCerts = [ hostDomainName ];
+      ownedCerts = [hostDomainName];
     };
 
     services = {
@@ -53,31 +57,36 @@ in
               #}
             '';
 
-            locations = {
-              "/".return = 403;
-            } // concatMapAttrs
-              (name: user:
-                let
-                  userLocation = config: {
-                    extraConfig = ''
+            locations =
+              {
+                "/".return = 403;
+              }
+              // concatMapAttrs
+              (name: user: let
+                userLocation = config: {
+                  extraConfig =
+                    ''
                       if ($host_user_from_fprint != "${name}") {
                         return 403;
                       }
-                    '' + config;
-                  };
+                    ''
+                    + config;
+                };
 
-                  userLocations = {
+                userLocations =
+                  {
                     "/${name}" = ''
                       return 404;
                     '';
-                  } // optionalAttrs user.mail.dav {
+                  }
+                  // optionalAttrs user.mail.dav {
                     "/${name}/dav" = ''
                       proxy_pass http://unix:/run/host-www/${name}/dav.sock;
                     '';
                   };
-                in
+              in
                 mapAttrs (_: userLocation) userLocations)
-              (filterAttrs (_: user: user.mail.certs != [ ]) users);
+              (filterAttrs (_: user: user.mail.certs != []) users);
           };
         };
       };
@@ -85,13 +94,13 @@ in
 
     systemd.tmpfiles.settings."10-run-host-www" =
       concatMapAttrs
-        (name: _: {
-          "/run/host-www/${name}".d = {
-            mode = "0750";
-            user = name;
-            group = "nginx";
-          };
-        })
-        users;
+      (name: _: {
+        "/run/host-www/${name}".d = {
+          mode = "0750";
+          user = name;
+          group = "nginx";
+        };
+      })
+      users;
   };
 }
diff --git a/sys/web/sites/portal.nix b/sys/web/sites/portal.nix
index 2365ba1..fe96cfb 100644
--- a/sys/web/sites/portal.nix
+++ b/sys/web/sites/portal.nix
@@ -1,9 +1,12 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 with lib; let
   cfg = config.local.web.sites.portal;
   inherit (config.local) domains;
-in
-{
+in {
   options.local.web.sites.portal = {
     enable = mkEnableOption "public non-fqdn portal";
   };
@@ -11,7 +14,7 @@ in
   config = mkIf cfg.enable {
     local.web = {
       enable = mkDefault true;
-      ownedCerts = [ "host" "exdev" ];
+      ownedCerts = ["host" "exdev"];
       defaultACMEHost = domains.host.main;
     };
 
@@ -19,13 +22,13 @@ in
       ${domains.host.www} = {
         forceSSL = true;
         useACMEHost = domains.host.main;
-        serverAliases = [ domains.host.main ];
+        serverAliases = [domains.host.main];
       };
 
       ${domains.exdev.main} = {
         forceSSL = true;
         useACMEHost = domains.exdev.main;
-        serverAliases = [ domains.exdev.www ];
+        serverAliases = [domains.exdev.www];
 
         locations."/fsociety".return = "301 https://meet.posixlycorrect.com/%C6%92%C6%A8%C5%8F%C4%8B%D3%80%C9%99%CF%AE%D0%A3";
       };
author	Alejandro Soto <alejandro@34project.org>	2025-08-24 18:55:06 -0600
committer	Alejandro Soto <alejandro@34project.org>	2025-08-24 18:55:06 -0600
commit	d7ac88762db111a7962c4e14b5f4e37ab85ccac7 (patch)
tree	0c2c8c4383bef74215e3b7c48a2f6b0117f084bc
parent	504589d1035f27b766bd33040b415b2725ece4ca (diff)