Code Linting and hooks to do so automatically

.gitignore

@@ -2,4 +2,4 @@
 # Ignore build outputs from performing a nix-build or `nix build` command
 result
 result-*
-
+.pre-commit-config.yaml

README.md

@@ -146,8 +146,7 @@ machine. The only technically required file in there is `configuration.nix`. So
 
 A good skeleton is probably:
 ```
-flake-inputs:
+{config, pkgs, lib, flake-inputs, ... }: {
-{config, pkgs, lib, ... }: {
 
 imports = [
   ./hardware-configuration.nix
@@ -278,3 +277,29 @@ something like this:
 {lib, pkgs, config, ...} :
 <module code >
 ```
+
+# Contributing
+
+Like with all FS projects, you are welcome to contribute. Work is done usually by the person that is most annoyed
+by the circumstances or by the person that didn't run fast enough. So we are happy if we get help. That doesn't
+mean that we don't need to have some level of quality, people after us needs to work with it. It is live infrastructure
+and downtime hurts someone (and in the wrong moment even really bad (Matheball ticket sales for example).
+
+So here are some Guidelines.
+
+## Coding style and linting.
+If you run `nix check` there are automated checks in place, please make sure to pass them.
+There is also a code autoformatter (`alejandra`) incorporated into those. You can also install
+them into your local git repository as pre-commit hooks, and setting up a shell that has
+even more tooling by running `nix develop`. That will give you a bash in which you can run
+all the checks manually `pre-commit run -a`. This will also run the autoformatter.
+
+## Process for submitting changes
+
+1. If it is something bigger, please open an issue first describing what and why you want to do something.
+   If it is just something small, skip this step.
+2. Fork the repo and implement your changes in a branch on your fork. Afterwards open a pull request (possibly mentioning the issue).
+   Against the main branch.
+   - Your branch should be based on an up to date version of main, if it is not consider rebasing.
+3. You will need to find someone with the proper rights to approve of your changes, but most of the time there will be request
+   for changes first.

flake-module.nix

@@ -1,24 +1,56 @@
-{inputs, ...}:
+{inputs, ...}: {
-{
   # debug = true;
   # We only define machines config in this flake yet, so we only include
   # the module that builds these. This file might get fuller, if we need to
   # build our own packages, that are not flakes.
-  imports = [ ./nixos/flake-module.nix
+  imports = [
+    ./nixos/flake-module.nix
+    inputs.pre-commit-hooks.flakeModule
     # To import a flake module
     # 1. Add foo to inputs
     # 2. Add foo as a parameter to the outputs function
     # 3. Add here: foo.flakeModule
-
   ];
   systems = ["x86_64-linux"];
-#  perSystem = { config, self', inputs', pkgs, system, ... }: {
+  perSystem = {
+    config,
+    inputs',
+    pkgs,
+    ...
+  }: {
+    devShells.default = config.pre-commit.devShell;
+
+    pre-commit = let
+      generatedFiles = [
+        "hardware-configuration\\.nix"
+      ];
+    in {
+      check.enable = true;
+      pkgs = inputs'.nixpkgs.legacyPackages;
+      settings = {
+        # for some reason statix takes it config differently than all the other hooks.
+        settings.statix = {
+          format = "stderr";
+          ignore = generatedFiles;
+        };
+        hooks = {
+          nil.enable = true;
+          statix.enable = true;
+          deadnix = {
+            enable = true;
+            excludes = generatedFiles;
+          };
+          alejandra.enable = true;
+        };
+      };
+    };
+
     # Per-system attributes can be defined here. The self' and inputs'
     # module parameters provide easy access to attributes of the same
     # system.
+  };
 
   # Equivalent to  inputs'.nixpkgs.legacyPackages.hello;
-#  };
   #      flake = {
   # The usual flake attributes can be defined here, including system-
   # agnostic ones like nixosModule and system-enumerating ones, although

flake.nix

@@ -17,6 +17,15 @@
     impermanence = {
       url = "github:nix-community/impermanence";
     };
+    pre-commit-hooks = {
+      url = "github:cachix/pre-commit-hooks.nix";
+      inputs = {
+        flake-compat.follows = "";
+        gitignore.follows = "";
+        nixpkgs-stable.follows = "";
+        nixpkgs.follows = "";
+      };
+    };
   };
 
   outputs = inputs @ {flake-parts, ...}:

nixos/flake-module.nix

@@ -1,20 +1,30 @@
 # copied and adopted from maralorns config
-
 # This automatically searches for nixos configs in ./machines/${name}/configuration.nix
 # and exposes them as outputs.nixosConfigurations.${name}
-{ withSystem, lib, inputs, ... }: {
+{
+  withSystem,
+  lib,
+  inputs,
+  ...
+}: {
   flake = {
-    nixosConfigurations = withSystem "x86_64-linux" ({ pkgs, ... }:
+    nixosConfigurations = withSystem "x86_64-linux" ({pkgs, ...}: let
-    let
       machines = builtins.attrNames (builtins.readDir ./machines);
-      makeSystem = name:
+      makeSystem = name: let
+        importedConfig = import (./. + "/machines/${name}/configuration.nix");
+        systemConfig =
+          if lib.isFunction importedConfig
+          then x: importedConfig (x // {flake-inputs = inputs;})
+          else importedConfig;
+      in
         pkgs.nixos {
           imports = [
-            (import (./. + "/machines/${name}/configuration.nix") inputs)
+            systemConfig
             inputs.sops-nix.nixosModules.sops
             inputs.impermanence.nixosModules.impermanence
           ];
         };
-    in lib.genAttrs machines makeSystem);
+    in
+      lib.genAttrs machines makeSystem);
   };
 }

nixos/machines/ghatanothoa/configuration.nix

@@ -1,6 +1,4 @@
-flake-inputs:
+{
-{config, pkgs, lib, ... }: {
-
   imports = [
     ./hardware-configuration.nix
     ../../modules/jitsi.nix

nixos/machines/ghatanothoa/hardware-configuration.nix

@@ -1,4 +1,4 @@
-{config, lib, pkgs, modulesPath, ...}: {
+{lib, ...}: {
   imports = [];
 
   fileSystems."/" = {
@@ -22,8 +22,7 @@
     options = ["subvol=nix"];
   };
 
-  swapDevices =
+  swapDevices = [{device = "/dev/disk/by-uuid/e6e3ba6b-c9f5-4960-b56d-f49760d76a4a";}];
-    [{ device = "/dev/disk/by-uuid/e6e3ba6b-c9f5-4960-b56d-f49760d76a4a"; }];
 
   nix.settings.max-jobs = lib.mkDefault 4;
 

nixos/machines/ghatanothoa/network.nix

@@ -4,12 +4,13 @@
 {
   imports = [];
   networking = {
-    interfaces.enX0.ipv4.addresses = [ {
+    interfaces.enX0.ipv4.addresses = [
+      {
         address = "192.168.0.25";
         prefixLength = 16;
-    } ];
+      }
+    ];
     defaultGateway = "192.168.0.152";
     nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"];
   };
 }
-

nixos/modules/impermanence.nix

@@ -1,16 +1,17 @@
-{lib, config, ...} :
+{
-
+  lib,
-let 
+  config,
-  inherit (lib)
+  ...
+}: let
+  inherit
+    (lib)
     mkEnableOption
     mkIf
     mkOption
     types
     ;
   cfg = config.impermanence;
-in
+in {
-
-{
   imports = [];
 
   options.impermanence = {
@@ -43,5 +44,4 @@ config = mkIf cfg.enable {
     };
     environment.etc.machine-id.source = "${cfg.storagePath}/machine-id";
   };
-
 }

nixos/modules/jitsi.nix

@@ -1,14 +1,19 @@
-{pkgs, config, lib, modulesPath, ...}:
+{
-let 
+  config,
-  inherit (lib)
+  lib,
+  modulesPath,
+  ...
+}: let
+  inherit
+    (lib)
     mkIf
     mkEnableOption
     mkOption
-    head;
+    head
+    ;
   inherit (lib.types) str;
   cfg = config.services.mathebau-jitsi;
-in
+in {
-{
   imports = [(modulesPath + "/services/web-apps/jitsi-meet.nix")];
 
   options.services.mathebau-jitsi = {
@@ -23,18 +28,25 @@ in
   };
 
   config = mkIf cfg.enable {
-    services.jitsi-meet = {
+    services = {
+      jitsi-meet = {
         enable = true;
-      hostName = cfg.hostName;
         config = {
           defaultLang = "de";
         };
+        inherit (cfg) hostName;
       };
-    services.jitsi-videobridge = {
+      jitsi-videobridge = {
         openFirewall = true;
         nat = {
           publicAddress = "130.83.2.184";
-        localAddress = cfg.localAddress;
+          inherit (cfg) localAddress;
+        };
+      };
+      #We are behind a reverse proxy that handles TLS
+      nginx.virtualHosts."${cfg.hostName}" = {
+        enableACME = false;
+        forceSSL = false;
       };
     };
     environment.persistence.${config.impermanence.name} = {
@@ -43,12 +55,6 @@ in
         "/var/lib/prosody"
       ];
     };
-  #We are behind a reverse proxy that handles TLS
-    services.nginx.virtualHosts."${cfg.hostName}" = {
-      enableACME = false;
-      forceSSL = false;
-    };
-
     #The network ports for HTTP(S) are not opened automatically
     networking.firewall.allowedTCPPorts = [80 443];
   };

nixos/roles/admins.nix

@@ -1,26 +1,24 @@
 {lib, ...}:
-with lib;
+with lib; let
-
-let
   admins = {
     nerf = {
-      hashedPassword =
+      hashedPassword = "$y$j9T$SJcjUIcs3JYuM5oyxfEQa/$tUBQT07FK4cb9xm.A6ZKVnFIPNOYMOKC6Dt6hadCuJ7";
-        "$y$j9T$SJcjUIcs3JYuM5oyxfEQa/$tUBQT07FK4cb9xm.A6ZKVnFIPNOYMOKC6Dt6hadCuJ7";
       keys = [
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdA4LpEGUUmN8esFyrNZXFb2GiBID9/S6zzhcnofQuP nerf@nerflap2"
       ];
     };
     gonne = {
-      hashedPassword =
+      hashedPassword = "$6$EtGpHEcFkOi0yUWp$slXf0CvIUrhdqaoCrQ5YwtYu2IVuE1RGGst4fnDPRLWVm.lYx0ruvSAF2/vw/sLbW37ORJjlb0NHQ.kSG7cVY/";
-        "$6$EtGpHEcFkOi0yUWp$slXf0CvIUrhdqaoCrQ5YwtYu2IVuE1RGGst4fnDPRLWVm.lYx0ruvSAF2/vw/sLbW37ORJjlb0NHQ.kSG7cVY/";
       keys = [
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFopCUadohY3wg9AoEup9TDRDMyEPSLsQoCnN4lsKCrr gonne@mathebau.de NixOS"
       ];
     };
   };
 
-  mkAdmin = name :
+  mkAdmin = name: {
-  {hashedPassword, keys}: {
+    hashedPassword,
+    keys,
+  }: {
     "${name}" = {
       isNormalUser = true;
       createHome = true;
@@ -31,7 +29,6 @@ let
       inherit hashedPassword;
     };
   };
-
 in {
   users.users = mkMerge (mapAttrsToList mkAdmin admins);
 }

nixos/roles/default.nix

@@ -1,5 +1,9 @@
-{pkgs, config, lib, modulesPath, ...} : {
+{
-
+  pkgs,
+  lib,
+  modulesPath,
+  ...
+}: {
   imports = [
     ./admins.nix
     ./nix_keys.nix
@@ -15,7 +19,8 @@ nix = {
   };
 
   networking = {
-  firewall = { # these shoud be default, but better make sure!
+    firewall = {
+      # these shoud be default, but better make sure!
       enable = true;
       allowPing = true;
     };
@@ -35,8 +40,13 @@ sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 
   environment = {
     systemPackages = builtins.attrValues {
-    inherit (pkgs)
+      inherit
-      htop lsof tmux btop;
+        (pkgs)
+        htop
+        lsof
+        tmux
+        btop
+        ;
     };
   };
 

nixos/roles/prometheusNodeExporter.nix

@@ -1,5 +1,4 @@
-{config, ...}:
+{config, ...}: {
-{
   imports = [];
   services.prometheus.exporters.node = {
     enable = true;