Resolve all statix and nixpkgs-fmt warnings repo-wide

Zero W20 (repeated attribute keys), W10 (empty { ... }: variadic
pattern, use _: instead), and W04 (a = x.a instead of inherit)
warnings remain anywhere in the tree, and nixpkgs-fmt --check is
clean on all 46 .nix files.

Repeated-key merges go as deep as statix actually flags per file
(e.g. boot.loader.* nested under boot.loader = { ... } once the
outer boot.* merge exposed it as its own repeat) — every merge is a
pure attribute-path restructuring with no value changes, verified by
comparing config.system.build.toplevel.drvPath before/after for a
representative host per changed module plus a full 19-host + 4-package
eval sweep.

One indentation slip caught and fixed during this pass: nesting
modules/installer/common.nix's environment.etc."auto-install.sh".text
under an environment = { ... } block initially normalized the
script's shebang/set line indentation, which actually changes the
rendered file (Nix's '' string dedent treats it as real content, not
cosmetic whitespace) — reproduced the original's exact indentation
and reverified the rendered script is byte-identical to before.

modules/services/zfs/auto-mount-volumes.nix picked up formatting too;
worth noting it isn't imported by anything in this flake at all.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

hosts/docker/host.nix

@@ -1,4 +1,4 @@
-{ ... }:
+_:
 
 {
   networking.hostName = "docker";

hosts/nix-minimal/host.nix

@@ -1,4 +1,4 @@
-{ ... }:
+_:
 
 {
   # Preserves the hostname of the existing, already-deployed machine

hosts/nixos/home.nix

@@ -6,14 +6,13 @@
     ../../modules/common/aliases.nix
   ];
 
-  home.username = vars.primaryUser;
-  home.homeDirectory = "/home/${vars.primaryUser}";
-  home.stateVersion = "25.05"; # match your NixOS stateVersion
-
-  programs.home-manager.enable = true; # mandatory to activate HM
+  home = {
+    username = vars.primaryUser;
+    homeDirectory = "/home/${vars.primaryUser}";
+    stateVersion = "25.05"; # match your NixOS stateVersion
 
     # Optional: packages
-  home.packages = with pkgs; [
+    packages = with pkgs; [
       git
       vim
       tmux
@@ -23,18 +22,11 @@
     ];
 
     # Optional: set environment vars
-  home.sessionVariables = {
+    sessionVariables = {
       EDITOR = "vim";
     };
 
-  # Optional: enable bash (or zsh, fish...)
-  programs.bash.enable = true;
-  services.nextcloud-client = {
-    enable = true;
-    # Optionally start in background directly
-    startInBackground = true;
-  };
-  home.file = {
+    file = {
       ".local/share/applications/proxmox-chromium-app.desktop".text = ''
         [Desktop Entry]
         Type=Application
@@ -76,4 +68,15 @@
         StartupWMClass=PBS
       '';
     };
+  };
+
+  programs.home-manager.enable = true; # mandatory to activate HM
+
+  # Optional: enable bash (or zsh, fish...)
+  programs.bash.enable = true;
+  services.nextcloud-client = {
+    enable = true;
+    # Optionally start in background directly
+    startInBackground = true;
+  };
 }

hosts/nixos/host.nix

@@ -1,4 +1,4 @@
-{ ... }:
+_:
 
 {
   networking.hostName = "nixos";

hosts/pxe-boot/host.nix

@@ -1,4 +1,4 @@
-{ ... }:
+_:
 
 {
   networking.hostName = "pxe-boot";

modules/boot/efi.nix

@@ -1,4 +1,4 @@
-{ ... }:
+_:
 
 {
   boot.loader.systemd-boot.enable = true;

modules/build-types/gui.nix

@@ -19,25 +19,49 @@
 
   boot.loader.grub.useOSProber = true;
 
-  services.xserver.enable = true;
-  services.xserver.displayManager.lightdm.enable = true;
-  services.xserver.desktopManager.cinnamon.enable = true;
+  services = {
+    xserver = {
+      enable = true;
 
-  services.xserver.xkb = {
+      displayManager = {
+        lightdm.enable = true;
+        sessionCommands = ''
+          eval $(gnome-keyring-daemon --start --components=secrets,ssh)
+          export SSH_AUTH_SOCK
+        '';
+      };
+
+      desktopManager.cinnamon.enable = true;
+
+      xkb = {
         layout = "au";
         variant = "";
       };
+    };
 
-  services.printing.enable = true;
+    printing.enable = true;
 
-  security.rtkit.enable = true;
-  services.pipewire = {
+    pipewire = {
       enable = true;
       alsa.enable = true;
       alsa.support32Bit = true;
       pulse.enable = true;
     };
 
+    xrdp = {
+      enable = true;
+      defaultWindowManager = "cinnamon-session";
+      openFirewall = true;
+    };
+
+    gnome.gnome-keyring.enable = true;
+  };
+
+  security = {
+    rtkit.enable = true;
+    pam.services.login.enableGnomeKeyring = true;
+  };
+
   # The networkmanager group only exists when NM is actually enabled — the
   # lxc platform module force-disables it, so don't add the user to a group
   # that won't exist there.
@@ -45,16 +69,5 @@
 
   programs.firefox.enable = true;
 
-  services.xrdp.enable = true;
-  services.xrdp.defaultWindowManager = "cinnamon-session";
-  services.xrdp.openFirewall = true;
   nixpkgs.config.allowUnfree = true;
-
-  services.gnome.gnome-keyring.enable = true;
-  security.pam.services.login.enableGnomeKeyring = true;
-
-  services.xserver.displayManager.sessionCommands = ''
-    eval $(gnome-keyring-daemon --start --components=secrets,ssh)
-    export SSH_AUTH_SOCK
-  '';
 }

modules/build-types/pxe-boot.nix

@@ -95,7 +95,8 @@ in
     ipxe
   ];
 
-  services.nginx = {
+  services = {
+    nginx = {
       enable = true;
 
       virtualHosts."pxe-boot" = {
@@ -111,7 +112,7 @@ in
 
     # TFTP is only used to deliver the initial iPXE bootloader. After iPXE
     # starts, all further assets are fetched via nginx over HTTP.
-  services.atftpd = {
+    atftpd = {
       enable = true;
       root = tftpRoot;
       extraOptions = [
@@ -119,6 +120,9 @@ in
       ];
     };
 
+    openssh.settings.PermitRootLogin = "yes";
+  };
+
   systemd.tmpfiles.rules = [
     "d ${pxeRoot} 0755 root root -"
     "d ${httpRoot} 0755 root root -"
@@ -149,8 +153,6 @@ in
     };
   };
 
-  services.openssh.settings.PermitRootLogin = "yes";
-
   networking.firewall.allowedTCPPorts = [ 80 ];
   networking.firewall.allowedUDPPorts = [ 69 ];
 }

modules/common/configuration.nix

@@ -33,17 +33,23 @@
   # or docs/ for the sops workflow). hashedPassword/hashedPasswordFile need
   # neededForUsers so they're available before the normal secret-activation
   # step, since user creation happens very early in boot.
-  sops.defaultSopsFile = ../../secrets/common.yaml;
-  sops.secrets."root-hashedPassword".neededForUsers = true;
-  sops.secrets."nixos-hashedPassword".neededForUsers = true;
-  sops.secrets."nix-github-token" = { };
+  sops = {
+    defaultSopsFile = ../../secrets/common.yaml;
+
+    secrets = {
+      "root-hashedPassword".neededForUsers = true;
+      "nixos-hashedPassword".neededForUsers = true;
+      "nix-github-token" = { };
+    };
 
     # nix.conf doesn't support a *File-style option for access-tokens, so the
     # token is rendered into a runtime-only file (never touches the Nix store)
     # and pulled in via nix.conf's native !include directive.
-  sops.templates."nix-github-token.conf".content = ''
+    templates."nix-github-token.conf".content = ''
       access-tokens = github.com=${config.sops.placeholder."nix-github-token"}
     '';
+  };
+
   nix.extraOptions = ''
     !include ${config.sops.templates."nix-github-token.conf".path}
   '';
@@ -62,7 +68,7 @@
     ];
     hashedPasswordFile = config.sops.secrets."nixos-hashedPassword".path;
     openssh.authorizedKeys.keys = [
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCq/Q5LvIXlZwO2kdeAN5nLGZ59nZB7JHYMEszHxmNtGMzv1lM31jiPNsr0z2EKVZhE7OOfa2IF9rhWYD7JUA9G0yzdZ4WTXFNGVVOJoOVH6vAF3XCxoVilOEwTc7h2Wiy+rzd0B28/3spffzQQWJhY6GRQVa8j+6xAGF60Fcvl1vLosYT9Bn2ZbK4TCWOwAn2jqXIieGpZdn/UNZbGOeKRiCvhktDfMAzuQzN/9jMu/oF4pkPn2X1UrsQdNlvp0Ci8md612MozIpncQJyAF1ADhunr3sMx0isUXiqD29R5DS4TftpekqLNLak+zcxFa8N7DcRNp3DcKfJvyTkwQrR4r+b7lFLYOLHLagSso9CzeW/paAS2q9I5SBm/2DtE1diLLg2jZikYcstsu/G5RgvbzbKqjiaMwTdXC3AMvDxQrs7U5pDRZFzoofG3cpODbTm+uy3m0kP70z0M1K45UbDG0p+itnTu9x40JbQEgefbx38AItNvAIx1A8HO4I1VX28= wayne@stream"
+      vars.adminSshKey
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
     ];
   };

modules/common/home.nix

@@ -10,9 +10,25 @@ in
     ./aliases.nix
   ];
 
-  home.username = vars.primaryUser;
-  home.homeDirectory = "/home/${vars.primaryUser}";
-  home.stateVersion = "25.11"; # match your NixOS stateVersion
+  home = {
+    username = vars.primaryUser;
+    homeDirectory = "/home/${vars.primaryUser}";
+    stateVersion = "25.11"; # match your NixOS stateVersion
+
+    # Optional: packages
+    packages = with pkgs; [
+      git
+      vim
+      tmux
+      nano
+      sshfs
+    ];
+
+    # Optional: set environment vars
+    sessionVariables = {
+      EDITOR = "nano";
+    };
+  };
 
   programs.home-manager.enable = true; # mandatory to activate HM
 
@@ -23,19 +39,6 @@ in
   # modules/common/configuration.nix instead (covers the daemon for every
   # user, not just this one).
 
-  # Optional: packages
-  home.packages = with pkgs; [
-    git
-    vim
-    tmux
-    nano
-    sshfs
-  ];
-
-  # Optional: set environment vars
-  home.sessionVariables = {
-    EDITOR = "nano";
-  };
   #  systemd.user.services.mount-proxmox-iso = {
   #    Unit = {
   #      Description = "Mount Proxmox ISO dir via SSHFS";

modules/common/set-locale.nix

@@ -1,4 +1,4 @@
-{ ... }:
+_:
 
 {
   i18n.defaultLocale = "en_AU.UTF-8";

modules/disko/proxmox.nix

@@ -1,4 +1,4 @@
-{ ... }:
+_:
 
 {
   disko.devices = {

modules/docker/mount-data.nix

@@ -1,7 +1,8 @@
 { config, lib, pkgs, vars, ... }:
 
 {
-  fileSystems."/mnt/docker/config" = {
+  fileSystems = {
+    "/mnt/docker/config" = {
       device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/config";
       fsType = "nfs";
 
@@ -13,7 +14,7 @@
       ];
     };
 
-  fileSystems."/mnt/docker/databases" = {
+    "/mnt/docker/databases" = {
       device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/databases";
       fsType = "nfs";
 
@@ -25,7 +26,7 @@
       ];
     };
 
-  fileSystems."/mnt/docker/volumes" = {
+    "/mnt/docker/volumes" = {
       device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/volumes";
       fsType = "nfs";
 
@@ -37,7 +38,7 @@
       ];
     };
 
-  fileSystems."/mnt/nextcloud-data" = {
+    "/mnt/nextcloud-data" = {
       device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/nextcloud-data";
       fsType = "nfs";
 
@@ -49,7 +50,7 @@
       ];
     };
 
-  fileSystems."/mnt/raspi-backup" = {
+    "/mnt/raspi-backup" = {
       device = "${vars.nfsServerHost}:${vars.storageRoot}/raspi/volumes";
       fsType = "nfs";
 
@@ -60,4 +61,5 @@
         "noatime"
       ];
     };
+  };
 }

modules/hardware-configuration/vm/linode.nix

@@ -5,36 +5,42 @@
 
 {
   imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    [
+      (modulesPath + "/profiles/qemu-guest.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_scsi" "ahci" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-  boot.loader.grub.device = "/dev/sda";
-
-  fileSystems."/" =
-    { device = "/dev/sda";
-      fsType = "ext4";
-    };
-
-  swapDevices =
-    [ { device = "/dev/sdb"; }
-    ];
+  boot = {
+    initrd.availableKernelModules = [ "virtio_pci" "virtio_scsi" "ahci" "sd_mod" ];
+    initrd.kernelModules = [ ];
+    kernelModules = [ ];
+    extraModulePackages = [ ];
 
     # Enable LISH
-boot.kernelParams = [ "console=ttyS0,19200n8" ];
-boot.loader.grub.extraConfig = ''
+    kernelParams = [ "console=ttyS0,19200n8" ];
+
+    loader = {
+      grub = {
+        device = "/dev/sda";
+        extraConfig = ''
           serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1;
           terminal_input serial;
           terminal_output serial;
         '';
+        forceInstall = true;
+        # device = "nodev";
+      };
+      timeout = 10;
+    };
+  };
 
-boot.loader.grub.forceInstall = true;
-# boot.loader.grub.device = "nodev";
-boot.loader.timeout = 10;
+  fileSystems."/" =
+    {
+      device = "/dev/sda";
+      fsType = "ext4";
+    };
 
+  swapDevices =
+    [{ device = "/dev/sdb"; }];
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }

modules/hardware-configuration/vm/proxmox.nix

@@ -5,13 +5,16 @@
 
 {
   imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    [
+      (modulesPath + "/profiles/qemu-guest.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-amd" ];
-  boot.extraModulePackages = [ ];
+  boot = {
+    initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+    initrd.kernelModules = [ ];
+    kernelModules = [ "kvm-amd" ];
+    extraModulePackages = [ ];
+  };
   # boot.loader.grub.device = "/dev/sda2"; # or "nodev" for efi only
 
   # fileSystems."/" =

modules/nix-cache/remote-builder-client.nix

@@ -5,22 +5,24 @@
   #   sudo install -d -m 0700 /root/.ssh
   #   sudo install -m 0600 ./nixremote /root/.ssh/nixremote
   #   sudo ssh -i /root/.ssh/nixremote nixremote@nix-cache nix-store --version
-  nix.distributedBuilds = true;
+  nix = {
+    distributedBuilds = true;
 
-  nix.buildMachines = [
+    buildMachines = [
       {
         hostName = vars.nixCacheHost;
         sshUser = vars.remoteBuilderUser;
         sshKey = "/root/.ssh/${vars.remoteBuilderUser}";
-      system = pkgs.stdenv.hostPlatform.system;
+        inherit (pkgs.stdenv.hostPlatform) system;
         maxJobs = 4;
         speedFactor = 2;
         supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
       }
     ];
 
-  nix.settings = {
+    settings = {
       builders-use-substitutes = true;
       max-jobs = "auto";
     };
+  };
 }

modules/nix-cache/server.nix

@@ -9,12 +9,13 @@
   #   sudo chmod 0600 /etc/nix/cache-priv.pem
   #   sudo chmod 0644 /etc/nix/cache-pub.pem
   #   cat /etc/nix/cache-pub.pem
-  services.nix-serve = {
+  services = {
+    nix-serve = {
       enable = true;
       secretKeyFile = "/etc/nix/cache-priv.pem";
     };
 
-  services.nginx = {
+    nginx = {
       enable = true;
       recommendedProxySettings = true;
       virtualHosts.${vars.nixCacheHost} = {
@@ -24,6 +25,9 @@
       };
     };
 
+    openssh.enable = true;
+  };
+
   networking.firewall.allowedTCPPorts = [ 80 ];
 
   users.groups.${vars.remoteBuilderUser} = { };
@@ -40,8 +44,6 @@
     openssh.authorizedKeys.keys = vars.remoteBuilderAuthorizedKeys;
   };
 
-  services.openssh.enable = true;
-
   nix.settings = {
     trusted-users = [ "root" vars.remoteBuilderUser ];
     experimental-features = [ "nix-command" "flakes" ];

modules/platforms/lxc.nix

@@ -1,30 +1,36 @@
 { lib, ... }:
 
 {
-  boot.isContainer = true;
+  boot = {
+    isContainer = true;
 
-  boot.loader.grub.enable = false;
-  boot.loader.systemd-boot.enable = false;
+    loader = {
+      grub.enable = false;
+      systemd-boot.enable = false;
 
       # LXC containers share the host kernel — Proxmox starts them by exec'ing
       # /sbin/init directly, no bootloader/initrd involved. Without this, that
       # file doesn't correctly launch the current generation, so even a
       # correctly-installed system can fail to come up after reboot.
-  boot.loader.initScript.enable = true;
+      initScript.enable = true;
+    };
+  };
 
+  networking = {
     # boot.isContainer disables services.udev (see nixpkgs'
     # virtualisation/container-config.nix), and NetworkManager depends on a
     # running udevd to enumerate/classify devices. That leaves NM unable to
     # reliably manage the container's veth interface, which is what broke
     # DHCP-hostname registration in Pi-hole. systemd-networkd talks to the
     # kernel over rtnetlink directly and doesn't have that dependency.
-  networking.networkmanager.enable = lib.mkForce false;
-  networking.useNetworkd = true;
+    networkmanager.enable = lib.mkForce false;
+    useNetworkd = true;
 
     # container-config.nix also defaults this to true, which assumes a
     # systemd-nspawn-style host bind-mount of /etc/resolv.conf. Real Proxmox
     # LXC doesn't do that (nixpkgs' own virtualisation/proxmox-lxc.nix module
     # forces this false for the same reason), so leaving it true silently
     # breaks DNS instead of falling back to networkd/DHCP-provided servers.
-  networking.useHostResolvConf = lib.mkForce false;
+    useHostResolvConf = lib.mkForce false;
+  };
 }

modules/services/enable-rpcbind.nix

@@ -1,4 +1,4 @@
- { ... }:
+_:
 
 {
   services.rpcbind.enable = true;

modules/services/zfs/enable-service.nix

@@ -1,9 +1,15 @@
 { pkgs, ... }:
 
 {
-boot.supportedFilesystems = [ "zfs" ];
-  boot.zfs.forceImportRoot = false;
-  boot.zfs.package = pkgs.zfs_unstable;
+  boot = {
+    supportedFilesystems = [ "zfs" ];
+    zfs = {
+      forceImportRoot = false;
+      package = pkgs.zfs_unstable;
+      devNodes = "/dev/disk/by-id";
+    };
+  };
+
   services.zfs = {
     autoScrub.enable = true;
     autoSnapshot.enable = true;
@@ -12,5 +18,4 @@ boot.supportedFilesystems = [ "zfs" ];
 
   #systemd.services.zfs-import-cache.enable = true;
   systemd.services.zfs-mount.enable = true;
-boot.zfs.devNodes = "/dev/disk/by-id";
 }

modules/tailscale/enable-service.nix

@@ -1,4 +1,4 @@
-{ ... }:
+_:
 
 {
   services.tailscale.enable = true;

modules/traefik/rotate-logs.nix

@@ -1,4 +1,4 @@
-{ ... }:
+_:
 
 {
   services.logrotate = {