hosts/velarion/machine.nix

@@ -1,13 +1,11 @@
-{ dns, ... }:
+{dns, ...}: let
-let
   domain = "ruject.fun";
   database = {
     host = "127.0.0.1";
     port = 5432;
   };
   ipv4 = "94.156.112.0";
-in
+in {
-{
   services.nginx.enable = true;
   machine = {
     gateway = "10.0.0.1";
@@ -31,7 +29,7 @@ in
             "ns2"
           ];
 
-          A = [ ipv4 ];
+          A = [ipv4];
 
           subdomains = rec {
             ns1 = host ipv4 null;
@@ -54,10 +52,10 @@ in
           };
 
           TXT = [
-            (with spf; strict [ "a:mail.ruject.fun" ])
+            (with spf; strict ["a:mail.ruject.fun"])
           ];
 
-          MX = with mx; [ (mx 10 "mail.ruject.fun.") ];
+          MX = with mx; [(mx 10 "mail.ruject.fun.")];
 
           DMARC = [
             {

services/bind/firewall.nix

@@ -6,8 +6,7 @@
 let
   cfg = config.machine.bind;
 in
-with lib;
+with lib; mkIf cfg.enable {
-mkIf cfg.enable {
   networking.firewall = {
     allowedTCPPorts = [ cfg.port ];
     allowedUDPPorts = [ cfg.port ];

services/bind/service.nix

@@ -7,8 +7,7 @@
 let
   cfg = config.machine.bind;
 in
-with lib;
+with lib; mkIf cfg.enable {
-mkIf cfg.enable {
   services.bind = {
     enable = cfg.enable;
     listenOnPort = cfg.port;

services/code-server/nginx.nix

@@ -6,8 +6,7 @@
 let
   cfg = config.machine.code-server;
 in
-with lib;
+with lib; mkIf cfg.enable {
-mkIf cfg.enable {
   services.nginx.virtualHosts = mkIf (cfg.domain != null) {
     ${cfg.domain} = {
       enableACME = true;

services/code-server/options.nix

@@ -6,8 +6,7 @@
 let
   cfg = config.machine.code-server;
 in
-with lib;
+with lib; {
-{
   options.machine.code-server = {
     enable = mkEnableOption "code-server";
     port = mkOption {

services/code-server/service.nix

@@ -7,8 +7,7 @@
 let
   cfg = config.machine.code-server;
 in
-with lib;
+with lib; mkIf cfg.enable {
-mkIf cfg.enable {
   services.code-server = {
     enable = cfg.enable;
     port = cfg.port;

services/coturn/firewall.nix

@@ -6,8 +6,7 @@
 let
   cfg = config.machine.coturn;
 in
-with lib;
+with lib; mkIf cfg.enable {
-mkIf cfg.enable {
   networking.firewall = {
     interfaces.enp2s0 =
       let

services/coturn/service.nix

@@ -12,8 +12,7 @@ let
     realm
     ;
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
   services.coturn = rec {
     inherit realm enable;
     no-cli = true;

services/forgejo/mail.nix

@@ -9,8 +9,7 @@ let
   inherit (config.machine.forgejo) domain;
   address = "noreply@${domain}";
 in
-with lib;
+with lib; mkIf config.machine.mail.enable {
-mkIf config.machine.mail.enable {
   services.forgejo = {
     secrets = {
       mailer.PASSWD = sec."mail/servicePassword".path;

services/forgejo/network.nix

@@ -10,15 +10,12 @@ let
     port
     ;
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
   networking.firewall = {
     allowedTCPPorts = [ port ];
   };
 
-  services.nginx.virtualHosts =
+  services.nginx.virtualHosts = with lib; mkIf (domain != null) {
-    with lib;
-    mkIf (domain != null) {
     "${domain}" = {
       forceSSL = true;
       enableACME = true;

services/forgejo/runners.nix

@@ -9,8 +9,7 @@ let
   url = config.services.forgejo.settings.server.ROOT_URL;
   cfg = config.machine.forgejo;
 in
-with lib;
+with lib; mkIf cfg.enableRunner {
-mkIf cfg.enableRunner {
   sops.secrets = {
     "forgejo/runnerToken" = {
       sopsFile = ./../../secrets/common.yaml;

services/forgejo/tmpfiles.nix

@@ -7,8 +7,7 @@ let
   cfg = config.machine.forgejo;
   customDir = config.services.forgejo.customDir;
 in
-with lib;
+with lib; mkIf cfg.enable {
-mkIf cfg.enable {
   systemd.tmpfiles.rules = [
     "d '${customDir}/templates' - forgejo forgejo - -"
     "d '${customDir}/public' - forgejo forgejo - -"

services/mail/rspamd.nix

@@ -6,8 +6,7 @@
 let
   inherit (config.machine.mail) enable;
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
   services.rspamd = {
     enable = true;
     overrides = {

services/mail/tmpfiles.nix

@@ -7,8 +7,7 @@
 let
   inherit (config.machine.mail) enable;
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
   systemd.tmpfiles.rules = [
     "C /var/dkim/default.private 0600 root root - - ${sec.dkim_default_private.path}"
   ];

services/minecraft-server/firewall.nix

@@ -9,8 +9,7 @@ let
     port
     ;
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
   networking.firewall.allowedTCPPorts = [
     port
   ];

services/minecraft-server/service.nix

@@ -10,8 +10,7 @@ let
     port
     ;
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
   services.minecraft-server = {
     inherit enable;
     dataDir = "/var/lib/minecraft";

services/mysql/firewall.nix

@@ -6,8 +6,7 @@
 let
   cfg = config.machine.mysql;
 in
-with lib;
+with lib; mkIf cfg.enable {
-mkIf cfg.enable {
   networking.firewall = {
     allowedTCPPorts = [ cfg.port ];
   };

services/mysql/service.nix

@@ -10,8 +10,7 @@ let
     enable
     ;
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
   services.mysql = {
     inherit enable;
     package = pkgs.mysql84;

services/navidrome/service.nix

@@ -11,11 +11,8 @@ let
     folder
     ;
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
+  services.nginx.virtualHosts = with lib; mkIf (domain != null) {
-  services.nginx.virtualHosts =
-    with lib;
-    mkIf (domain != null) {
     "${domain}" = {
       forceSSL = true;
       enableACME = true;

services/networking/service.nix

@@ -1,14 +1,8 @@
-{
+{ config, lib, hostname, ... }:
-  config,
-  lib,
-  hostname,
-  ...
-}:
 let
   inherit (config.machine) ipv4 gateway;
 in
-with lib;
+with lib; {
-{
   networking = {
     hostName = hostname;
     networkmanager.enable = mkDefault true;

services/nextcloud/database.nix

@@ -7,8 +7,7 @@ let
   pgsqlEnable = config.machine.postgresql.enable;
   cfg = config.machine.nextcloud;
 in
-with lib;
+with lib; mkIf cfg.enable {
-mkIf cfg.enable {
   services.nextcloud.config =
     if pgsqlEnable then
       {
@@ -21,9 +20,7 @@ mkIf cfg.enable {
         dbhost = "localhost";
       };
 
-  services.postgresql =
+  services.postgresql = with lib; mkIf pgsqlEnable {
-    with lib;
-    mkIf pgsqlEnable {
     ensureDatabases = [ "nextcloud" ];
     ensureUsers = [
       {

services/nextcloud/mail.nix

@@ -11,8 +11,7 @@ let
     ;
   address = "noreply@${host}";
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
   services.nextcloud = {
     settings = {
       mail_smtpmode = "smtp";

services/nextcloud/service.nix

@@ -8,8 +8,7 @@
 let
   cfg = config.machine.nextcloud;
 in
-with lib;
+with lib; mkIf cfg.enable {
-mkIf cfg.enable {
   services.nextcloud = {
     enable = cfg.enable;
     appstoreEnable = false;

services/nginx/acme.nix

@@ -1,6 +1,5 @@
 { lib, config, ... }:
-with lib;
+with lib; mkIf (config.services.nginx.enable) {
-mkIf (config.services.nginx.enable) {
   security.acme = {
     acceptTerms = true;
     defaults = {

services/nginx/firewall.nix

@@ -6,8 +6,7 @@
 let
   inherit (config.services.nginx) enable;
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
   networking.firewall.allowedTCPPorts = [
     80
     443

services/postgresql/service.nix

@@ -10,8 +10,7 @@ let
     enable
     ;
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
   services.postgresql = {
     inherit enable;
     settings = {

services/prometheus/service.nix

@@ -9,8 +9,7 @@ let
     port
     ;
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
   services.prometheus = {
     inherit enable port;
   };

services/prosody/firewall.nix

@@ -8,8 +8,7 @@ let
     enable
     ;
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
   networking.firewall = {
     allowedTCPPorts = [
       # HTTP filer

services/prosody/nginx.nix

@@ -11,8 +11,7 @@ let
 
   localhost = "http://localhost:5280";
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
   security.acme.certs."${domain}".extraDomainNames = [
     "conference.${domain}"
     "upload.${domain}"
@@ -20,9 +19,7 @@ mkIf enable {
   users.groups.acme.members = [
     "prosody"
   ];
-  services.nginx.virtualHosts =
+  services.nginx.virtualHosts = with lib; mkIf (domain != null) {
-    with lib;
-    mkIf (domain != null) {
     "${domain}".locations = {
       "= /xmpp-websocket" = {
         proxyPass = localhost;

services/prosody/service.nix

@@ -12,8 +12,7 @@ let
 
   sslCertDir = config.security.acme.certs."${domain}".directory;
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
   services.prosody = {
     inherit enable;
 

services/redis/service.nix

@@ -10,8 +10,7 @@ let
     enable
     ;
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
   sops.secrets = {
     "redis/password" = { };
   };

services/roundcube/service.nix

@@ -10,8 +10,7 @@ let
     domain
     ;
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
   services.roundcube = {
     inherit enable;
     dicts = with pkgs.aspellDicts; [

services/synapse/database.nix

@@ -7,11 +7,8 @@ let
   pgsqlEnable = config.machine.postgresql.enable;
   inherit (config.machine.synapse) enable;
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
+  services.postgresql = with lib; mkIf pgsqlEnable {
-  services.postgresql =
-    with lib;
-    mkIf pgsqlEnable {
     ensureUsers = [
       {
         name = "matrix-synapse";
@@ -22,9 +19,7 @@ mkIf enable {
   };
   services.matrix-synapse.settings.database = {
     name = if pgsqlEnable then "psycopg2" else "sqlite3";
-    args =
+    args = with lib; mkIf pgsqlEnable {
-      with lib;
-      mkIf pgsqlEnable {
       host = "/run/postgresql";
     };
   };

services/synapse/element.nix

@@ -52,8 +52,7 @@ let
     };
   };
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
   services.nginx.virtualHosts.${domain} = {
     enableACME = true;
     forceSSL = true;

services/synapse/mail.nix

@@ -11,8 +11,7 @@ let
     ;
   address = "noreply@${domain}";
 in
-with lib;
+with lib; mkIf (enable && config.machine.mail.enable) {
-mkIf (enable && config.machine.mail.enable) {
   services.matrix-synapse = {
     settings = {
       admin_contact = address;

services/synapse/redis.nix

@@ -7,8 +7,7 @@ let
   redisEnable = config.machine.redis.enable;
   inherit (config.machine.synapse) enable;
 in
-with lib;
+with lib; mkIf (redisEnable && enable) {
-mkIf (redisEnable && enable) {
   services.redis.servers.matrix-synapse = {
     enable = true;
   };

services/synapse/secrets.nix

@@ -8,8 +8,7 @@ let
     enable
     ;
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
   sops.secrets = {
     "matrix/registrationSharedSecret" = {
       sopsFile = ./../../secrets/common.yaml;
@@ -41,9 +40,7 @@ mkIf enable {
         smtp_pass: ${config.sops.placeholder."mail/servicePassword"}
     '';
   };
-  services.matrix-synapse.extraConfigFiles =
+  services.matrix-synapse.extraConfigFiles = with lib; mkIf config.machine.synapse.enable [
-    with lib;
-    mkIf config.machine.synapse.enable [
     config.sops.templates.matrix-synapse-config.path
   ];
 }

services/synapse/synapse.nix

@@ -12,8 +12,7 @@ let
     metrics
     ;
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
   services.matrix-synapse = {
     inherit enable;
     enableRegistrationScript = true;

services/synapse/turn.nix

@@ -6,8 +6,7 @@
 let
   inherit (config.machine.coturn) enable;
 in
-with lib;
+with lib; mkIf (enable && config.machine.coturn.enable) {
-mkIf (enable && config.machine.coturn.enable) {
   services.matrix-synapse.settings = with config.services.coturn; {
     turn_uris = [
       "turn:${realm}:3478?transport=udp"

services/uptime-kuma/service.nix

@@ -10,8 +10,7 @@ let
     port
     ;
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
   services.uptime-kuma = {
     inherit enable;
     settings = {
@@ -19,9 +18,7 @@ mkIf enable {
     };
   };
 
-  services.nginx.virtualHosts =
+  services.nginx.virtualHosts = with lib; mkIf (domain != null) {
-    with lib;
-    mkIf (domain != null) {
     "${domain}" = {
       forceSSL = true;
       enableACME = true;

services/vaultwarden/service.nix

@@ -10,15 +10,12 @@ let
     port
     ;
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
   networking.firewall = {
     allowedTCPPorts = [ port ];
   };
 
-  services.nginx.virtualHosts =
+  services.nginx.virtualHosts = with lib; mkIf (domain != null) {
-    with lib;
-    mkIf (domain != null) {
     "${domain}" = {
       forceSSL = true;
       enableACME = true;

services/xray-3x-ui/firewall.nix

@@ -9,8 +9,7 @@ let
     port
     ;
 in
-with lib;
+with lib; mkIf enable {
-mkIf enable {
   networking.firewall.allowedTCPPorts = [
     # Web panel
     port

services/xray-3x-ui/nginx.nix

@@ -2,22 +2,17 @@
   lib,
   config,
   ...
-}:
+}: let
-let
+  inherit
-  inherit (config.machine.xray-3x-ui)
+    (config.machine.xray-3x-ui)
     enable
     port
     domain
     subscriptions
     ;
-in
+in {
-{
+  services.nginx.virtualHosts = with lib; mkIf enable {
-  services.nginx.virtualHosts =
+    ${domain} = with lib; mkIf (domain != null) {
-    with lib;
-    mkIf enable {
-      ${domain} =
-        with lib;
-        mkIf (domain != null) {
       enableACME = true;
       forceSSL = true;
       locations."/" = {
@@ -31,9 +26,7 @@ in
         '';
       };
     };
-      ${subscriptions.domain} =
+    ${subscriptions.domain} = with lib; mkIf (subscriptions.domain != null) {
-        with lib;
-        mkIf (subscriptions.domain != null) {
       enableACME = true;
       forceSSL = true;
       locations."/" = {

services/xray-3x-ui/service.nix

@@ -1,11 +1,6 @@
 # See https://github.com/sunmeplz/xray-3x-ui
 
-{
+{ config, lib, pkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  ...
-}:
 
 with lib;
 
@@ -16,7 +11,8 @@ let
   minGoVersion = "1.26.0";
 
   xray-3x-ui =
-    assert assertMsg (versionAtLeast pkgs.go.version minGoVersion)
+    assert assertMsg
+      (versionAtLeast pkgs.go.version minGoVersion)
       "3x-ui requires Go >= ${minGoVersion}, but ${pkgs.go.version} is available";
 
     pkgs.buildGoModule rec {
@@ -32,10 +28,7 @@ let
 
       vendorHash = "sha256-M8YQTMfF/xZut4hxUcAfF2xGK625vwJNp4JS/zoXUCQ=";
 
-      ldflags = [
+      ldflags = [ "-s" "-w" ];
-        "-s"
-        "-w"
-      ];
 
       meta = with lib; {
         description = "Xray panel supporting multi-protocol multi-user";
@@ -46,8 +39,7 @@ let
       };
     };
 
-in
+in {
-{
   # Service implementation
   config = mkIf cfg.enable {
     # User and group configuration
@@ -93,14 +85,8 @@ in
         Group = "xray-3x-ui";
         StateDirectory = "3x-ui 3x-ui/bin 3x-ui/logs";
         StateDirectoryMode = "0755";
-        AmbientCapabilities = [
+        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" "CAP_NET_ADMIN" ];
-          "CAP_NET_BIND_SERVICE"
+        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_NET_ADMIN" ];
-          "CAP_NET_ADMIN"
-        ];
-        CapabilityBoundingSet = [
-          "CAP_NET_BIND_SERVICE"
-          "CAP_NET_ADMIN"
-        ];
       };
     };
 

users/rus07tam/modules/openclaw/service.nix

@@ -7,7 +7,6 @@
   programs.openclaw = {
     enable = true;
     installApp = false;
-    systemd.enable = true;
 
     bundledPlugins = {
       summarize.enable = true;