flake.nix

@@ -79,14 +79,25 @@
             master = import inputs.master { inherit system; };
           };
 
-          packages = let
+          packages =
+            let
               nixos-lib = import (inputs.nixpkgs + "/nixos/lib") { };
               testDir = builtins.attrNames (builtins.readDir ./tests);
               testFiles = builtins.filter (n: builtins.match "^.*.nix$" n != null) testDir;
-          in builtins.listToAttrs (map (x: {
+            in
+            builtins.listToAttrs (
+              map (x: {
                 name = "test-${lib.strings.removeSuffix ".nix" x}";
-            value = nixos-lib.runTest (import (./tests + "/${x}") { inherit self; inherit pkgs; inherit lib; inherit config; });
+                value = nixos-lib.runTest (
-          }) testFiles);
+                  import (./tests + "/${x}") {
+                    inherit self;
+                    inherit pkgs;
+                    inherit lib;
+                    inherit config;
+                  }
+                );
+              }) testFiles
+            );
 
           devShells.default = pkgs.mkShell {
             buildInputs = with pkgs; [

modules/backups/default.nix

@@ -7,11 +7,16 @@
 }:
 {
   options.pub-solar-os.backups = {
-    stores = with lib; mkOption {
+    stores =
+      with lib;
+      mkOption {
         description = ''
           Periodic backups to create with Restic.
         '';
-      type = types.attrsOf (types.submodule ({ name, ... }: {
+        type = types.attrsOf (
+          types.submodule (
+            { name, ... }:
+            {
               options = {
                 passwordFile = mkOption {
                   type = types.str;
@@ -30,7 +35,9 @@
                   example = "sftp:backup@192.168.1.100:/backups/${name}";
                 };
               };
-      }));
+            }
+          )
+        );
 
         default = { };
         example = {
@@ -41,11 +48,16 @@
         };
       };
 
-    backups = with lib; mkOption {
+    backups =
+      with lib;
+      mkOption {
         description = ''
           Periodic backups to create with Restic.
         '';
-      type = types.attrsOf (types.submodule ({ name, ... }: {
+        type = types.attrsOf (
+          types.submodule (
+            { name, ... }:
+            {
               options = {
                 paths = mkOption {
                   # This is nullable for legacy reasons only. We should consider making it a pure listOf
@@ -112,9 +124,7 @@
                   description = ''
                     Extra arguments passed to restic backup.
                   '';
-            example = [
+                  example = [ "--exclude-file=/etc/nixos/restic-ignore" ];
-              "--exclude-file=/etc/nixos/restic-ignore"
-            ];
                 };
 
                 extraOptions = mkOption {
@@ -123,9 +133,7 @@
                   description = ''
                     Extra extended options to be passed to the restic --option flag.
                   '';
-            example = [
+                  example = [ "sftp.command='ssh backup@192.168.1.100 -i /home/user/.ssh/id_rsa -s sftp'" ];
-              "sftp.command='ssh backup@192.168.1.100 -i /home/user/.ssh/id_rsa -s sftp'"
-            ];
                 };
 
                 initialize = mkOption {
@@ -167,9 +175,7 @@
                   description = ''
                     A list of options for 'restic check'.
                   '';
-            example = [
+                  example = [ "--with-cache" ];
-              "--with-cache"
-            ];
                 };
 
                 dynamicFilesFrom = mkOption {
@@ -211,7 +217,9 @@
                   '';
                 };
               };
-      }));
+            }
+          )
+        );
         default = { };
         example = {
           localbackup = {
@@ -234,20 +242,22 @@
   };
 
   config = {
-    services.restic.backups = let 
+    services.restic.backups =
+      let
         stores = config.pub-solar-os.backups.stores;
         backups = config.pub-solar-os.backups.backups;
 
         storeNames = builtins.attrNames stores;
         backupNames = builtins.attrNames backups;
 
-      createBackups = backupName: map
+        createBackups =
-        (storeName: {
+          backupName:
+          map (storeName: {
             name = "${backupName}-${storeName}";
             value = stores."${storeName}" // backups."${backupName}";
-        })
+          }) storeNames;
-        storeNames;
 
-    in builtins.listToAttrs (lib.lists.flatten (map createBackups backupNames));
+      in
+      builtins.listToAttrs (lib.lists.flatten (map createBackups backupNames));
   };
 }

modules/core/nix.nix

@@ -6,9 +6,7 @@
   ...
 }:
 {
-  nixpkgs.config = lib.mkDefault {
+  nixpkgs.config = lib.mkDefault { allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ ]; };
-    allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ ];
-  };
 
   nix = {
     # Use default version alias for nix package

modules/keycloak/default.nix

@@ -42,9 +42,7 @@
       };
     };
 
-    nixpkgs.config = lib.mkDefault {
+    nixpkgs.config = lib.mkDefault { permittedInsecurePackages = [ "keycloak-23.0.6" ]; };
-      permittedInsecurePackages = [ "keycloak-23.0.6" ];
-    };
 
     # keycloak
     services.keycloak = {

tests/keycloak.nix

@@ -4,8 +4,10 @@
   lib,
   config,
   ...
-}: let
+}:
-in {
+let
+in
+{
   name = "keycloak";
 
   hostPkgs = pkgs;
@@ -42,9 +44,7 @@ in {
         ./support/global.nix
       ];
 
-      systemd.tmpfiles.rules = [
+      systemd.tmpfiles.rules = [ "f /tmp/dbf 1777 root root 10d password" ];
-        "f /tmp/dbf 1777 root root 10d password"
-      ];
 
       virtualisation.memorySize = 4096;
 
@@ -65,7 +65,9 @@ in {
 
   enableOCR = true;
 
-  testScript = {nodes, ...}: let
+  testScript =
+    { nodes, ... }:
+    let
       user = nodes.client.users.users.${nodes.client.pub-solar-os.authentication.username};
       #uid = toString user.uid;
       bus = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$(id -u ${user.name})/bus";
@@ -73,7 +75,8 @@ in {
       su = command: "su - ${user.name} -c '${command}'";
       gseval = "call --session -d org.gnome.Shell -o /org/gnome/Shell -m org.gnome.Shell.Eval";
       wmClass = su "${gdbus} ${gseval} global.display.focus_window.wm_class";
-  in ''
+    in
+    ''
       start_all()
 
       nachtigall.wait_for_unit("system.slice")

tests/support/ca.nix

@@ -3,14 +3,11 @@
   lib,
   config,
   ...
-}: {
+}:
-  imports = [
+{
-    ./global.nix
+  imports = [ ./global.nix ];
-  ];
 
-  systemd.tmpfiles.rules = [
+  systemd.tmpfiles.rules = [ "f /tmp/step-ca-intermediate-pw 1777 root root 10d password" ];
-    "f /tmp/step-ca-intermediate-pw 1777 root root 10d password"
-  ];
 
   networking.interfaces.eth0.ipv4.addresses = [
     {
@@ -19,7 +16,8 @@
     }
   ];
 
-  services.step-ca = let
+  services.step-ca =
+    let
       certificates = pkgs.stdenv.mkDerivation {
         name = "certificates";
         src = ./step;
@@ -29,7 +27,8 @@
           cp -r secrets $out/
         '';
       };
-  in {
+    in
+    {
       enable = true;
       openFirewall = true;
       intermediatePasswordFile = "/tmp/step-ca-intermediate-pw";

tests/support/client.nix

@@ -5,9 +5,7 @@
   ...
 }:
 {
-  imports = [
+  imports = [ ./global.nix ];
-    ./global.nix
-  ];
 
   services.xserver.enable = true;
   services.xserver.displayManager.gdm.enable = true;

tests/support/global.nix

@@ -3,14 +3,13 @@
   lib,
   config,
   ...
-}: {
+}:
+{
   pub-solar-os.networking.domain = "test.pub.solar";
 
   security.acme.defaults.server = "https://ca.${config.pub-solar-os.networking.domain}/acme/acme/directory";
 
-  security.pki.certificates = [
+  security.pki.certificates = [ (builtins.readFile ./step/certs/root_ca.crt) ];
-    (builtins.readFile ./step/certs/root_ca.crt)
-  ];
 
   services.openssh = {
     enable = true;
@@ -24,10 +23,12 @@
 
   security.pam.services.sshd.allowNullPassword = true;
 
-  virtualisation.forwardPorts = let
+  virtualisation.forwardPorts =
+    let
       address = (builtins.elemAt config.networking.interfaces.eth0.ipv4.addresses 0).address;
       lastAddressPart = builtins.elemAt (lib.strings.splitString "." address) 3;
-  in [
+    in
+    [
       {
         from = "host";
         host.port = 2000 + (lib.strings.toInt lastAddressPart);

tests/support/step/config/ca.json

@@ -2,9 +2,7 @@
   "federatedRoots": null,
   "address": ":443",
   "insecureAddress": "",
-	"dnsNames": [
+  "dnsNames": ["ca.test.pub.solar"],
-		"ca.test.pub.solar"
-	],
   "logger": {
     "format": "text"
   },