format all

home/c/default.nix

@@ -1,5 +1,9 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
-  imports = [./programs ./services];
+{
+  imports = [
+    ./programs
+    ./services
+  ];
 
   programs.home-manager.enable = true;
   services.trayscale.enable = true;

home/c/programs/alacritty/default.nix

@@ -1,8 +1,11 @@
-{...}: {
+{ ... }:
+{
   programs.alacritty = {
     enable = true;
     settings = {
-      env = {TERM = "xterm-256color";};
+      env = {
+        TERM = "xterm-256color";
+      };
     };
   };
 }

home/c/programs/default.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   imports = [
     ./hypr
     ./waybar

home/c/programs/direnv/default.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   programs.direnv = {
     enable = true;
     nix-direnv.enable = true;

home/c/programs/firefox/default.nix

@@ -1,4 +1,5 @@
-{inputs, ...}: {
+{ inputs, ... }:
+{
   programs.firefox = {
     enable = true;
     policies = {
@@ -37,9 +38,9 @@
         ];
       };
 
-      containers = {};
+      containers = { };
 
-      settings = {};
+      settings = { };
 
       userChrome = "";
 

home/c/programs/git/default.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   programs = {
     git = {
       enable = true;
@@ -8,7 +9,7 @@
       signing.key = "03B01F427831BCFD!";
       signing.signByDefault = true;
 
-      ignores = [".direnv/"];
+      ignores = [ ".direnv/" ];
 
       includes = [
         {
@@ -18,7 +19,9 @@
               email = "psycl6@nottingham.ac.uk";
               signingKey = "14861F1282EFB5C8!";
             };
-            credential = {helper = "store";};
+            credential = {
+              helper = "store";
+            };
           };
         }
       ];
@@ -29,10 +32,16 @@
           autocrlf = false;
         };
 
-        init = {defaultBranch = "main";};
+        init = {
+          defaultBranch = "main";
+        };
 
-        push = {autoSetupRemote = true;};
+        push = {
-        ghq = {root = "~/repos";};
+          autoSetupRemote = true;
+        };
+        ghq = {
+          root = "~/repos";
+        };
       };
     };
     delta.enable = true;

home/c/programs/jj/default.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   programs.jujutsu = {
     enable = true;
     settings = {
@@ -21,13 +22,13 @@
 
       "--scope" = [
         {
-          "--when".repositories = ["~/repos/projects.cs.nott.ac.uk"];
+          "--when".repositories = [ "~/repos/projects.cs.nott.ac.uk" ];
           user = {
             email = "psycl6@nottingham.ac.uk";
           };
         }
         {
-          "--when".commands = ["status"];
+          "--when".commands = [ "status" ];
           ui.paginate = "never";
         }
       ];

home/c/programs/rbw/default.nix

@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   programs.rbw = {
     enable = true;
     settings = {

home/c/programs/rofi/default.nix

@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   programs.rofi = {
     enable = true;
     package = pkgs.rofi;

home/c/services/default.nix

@@ -1,5 +1,9 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
-  imports = [./mako ./kanshi];
+{
+  imports = [
+    ./mako
+    ./kanshi
+  ];
   services = {
     network-manager-applet.enable = true;
     mpris-proxy.enable = true;

home/c/services/kanshi/default.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   services.kanshi = {
     enable = true;
     settings = [

home/c/services/mako/default.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   services.mako = {
     enable = true;
     settings.defaultTimeout = 7000;

hosts/artemis/containers.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   virtualisation = {
     waydroid.enable = true;
     libvirtd.enable = true;

hosts/artemis/default.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   imports = [
     ./hardware-configuration.nix
     ./configuration.nix

hosts/artemis/hardware-configuration.nix

@@ -4,14 +4,21 @@
   pkgs,
   modulesPath,
   ...
-}: {
+}:
-  imports = [(modulesPath + "/installer/scan/not-detected.nix")];
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
   zramSwap.enable = true;
   boot = {
-    initrd.availableKernelModules = ["xhci_pci" "thunderbolt" "nvme" "usb_storage" "rtsx_pci_sdmmc"];
+    initrd.availableKernelModules = [
-    initrd.kernelModules = [];
+      "xhci_pci"
-    kernelModules = ["kvm-intel"];
+      "thunderbolt"
-    extraModulePackages = [];
+      "nvme"
+      "usb_storage"
+      "rtsx_pci_sdmmc"
+    ];
+    initrd.kernelModules = [ ];
+    kernelModules = [ "kvm-intel" ];
+    extraModulePackages = [ ];
     kernelParams = [
       "i915.enable_psr=0"
       "i915.enable_fbc=0"
@@ -25,7 +32,11 @@
     bluetooth = {
       enable = true;
       powerOnBoot = true;
-      settings = {General = {Enable = "Source,Sink,Media,Socket";};};
+      settings = {
+        General = {
+          Enable = "Source,Sink,Media,Socket";
+        };
+      };
     };
 
     graphics = {
@@ -44,7 +55,9 @@
 
     cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
   };
-  environment.sessionVariables = {LIBVA_DRIVER_NAME = "iHD";}; # Force intel-media-driver
+  environment.sessionVariables = {
+    LIBVA_DRIVER_NAME = "iHD";
+  }; # Force intel-media-driver
 
   services = {
     blueman.enable = true;
@@ -68,7 +81,7 @@
     fsType = "ext4";
   };
 
-  swapDevices = [];
+  swapDevices = [ ];
 
   networking.useDHCP = lib.mkDefault true;
 }

hosts/artemis/networking.nix

@@ -1,10 +1,14 @@
-{...}: {
+{ ... }:
+{
   networking = {
     hostName = "artemis";
     networkmanager.enable = true;
     firewall.enable = true;
     firewall.allowPing = true;
     enableIPv6 = false;
-    nameservers = ["9.9.9.9" "149.112.112.112"];
+    nameservers = [
+      "9.9.9.9"
+      "149.112.112.112"
+    ];
   };
 }

hosts/artemis/programs.nix

@@ -2,7 +2,8 @@
   pkgs,
   lib,
   ...
-}: {
+}:
+{
   programs = {
     wireshark.enable = true;
     fish.enable = true;
@@ -30,7 +31,11 @@
         #   theme_name = "Adwaita";
         # };
       };
-      cageArgs = ["-s" "-m" "last"];
+      cageArgs = [
+        "-s"
+        "-m"
+        "last"
+      ];
     };
   };
   services = {

hosts/artemis/ssh.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   services.openssh = {
     enable = true;
     settings = {

hosts/artemis/styling.nix

@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   stylix = {
     enable = true;
 

hosts/default.nix

@@ -2,10 +2,20 @@
   inputs,
   mods,
   ...
-}: let
+}:
-  sharedModules = [inputs.home-manager.nixosModules.home-manager inputs.stylix.nixosModules.stylix inputs.agenix.nixosModules.default] ++ mods.sharedModules;
+let
-  artemis = import ./artemis {inherit inputs sharedModules;};
+  sharedModules = [
-  hermes = import ./hermes {inherit inputs sharedModules;};
+    inputs.home-manager.nixosModules.home-manager
-in {
+    inputs.stylix.nixosModules.stylix
-  hosts = [artemis hermes];
+    inputs.agenix.nixosModules.default
+  ]
+  ++ mods.sharedModules;
+  artemis = import ./artemis { inherit inputs sharedModules; };
+  hermes = import ./hermes { inherit inputs sharedModules; };
+in
+{
+  hosts = [
+    artemis
+    hermes
+  ];
 }

hosts/hermes/configuration.nix

@@ -2,7 +2,8 @@
   config,
   pkgs,
   ...
-}: {
+}:
+{
   nixpkgs.hostPlatform = "x86_64-linux";
   c.services.mesh = {
     enable = true;
@@ -22,7 +23,10 @@
 
   users.users.media = {
     isNormalUser = true;
-    extraGroups = ["wheel" "multimedia"];
+    extraGroups = [
+      "wheel"
+      "multimedia"
+    ];
     openssh.authorizedKeys.keys = config.keys.c;
     packages = with pkgs; [
       tree
@@ -30,7 +34,7 @@
     ];
   };
 
-  nix.settings.trusted-users = ["media"];
+  nix.settings.trusted-users = [ "media" ];
 
   environment.systemPackages = with pkgs; [
     wget

hosts/hermes/containers.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   virtualisation = {
     podman.enable = true;
     podman.dockerCompat = true;
@@ -9,7 +10,7 @@
         #image = "ghcr.io/flaresolverr/flaresolverr:pr-1282";
         image = "docker.io/alexfozor/flaresolverr:pr-1300-experimental";
         autoStart = true;
-        ports = ["127.0.0.1:8191:8191"];
+        ports = [ "127.0.0.1:8191:8191" ];
         environment = {
           LOG_LEVEL = "debug";
         };
@@ -17,7 +18,10 @@
       tdarr = {
         image = "ghcr.io/haveagitgat/tdarr";
         autoStart = true;
-        ports = ["0.0.0.0:8265:8265" "127.0.0.1:8266:8266"];
+        ports = [
+          "0.0.0.0:8265:8265"
+          "127.0.0.1:8266:8266"
+        ];
         volumes = [
           "/var/lib/tdarr/server:/app/server"
           "/var/lib/tdarr/configs:/app/configs"
@@ -37,7 +41,10 @@
           PUID = "1000";
           PGID = "994";
         };
-        extraOptions = ["--device=/dev/dri:/dev/dri" "--network=bridge"];
+        extraOptions = [
+          "--device=/dev/dri:/dev/dri"
+          "--network=bridge"
+        ];
       };
     };
   };

hosts/hermes/copyparty.nix

@@ -1,13 +1,15 @@
-{config, ...}: let
+{ config, ... }:
+let
   domain = "files.cleslie.uk";
-in {
+in
+{
   services = {
-    cloudflare-dyndns.domains = [domain];
+    cloudflare-dyndns.domains = [ domain ];
     copyparty = {
       enable = true;
       settings = {
         i = "127.0.0.1";
-        p = [3210];
+        p = [ 3210 ];
       };
       accounts = {
         c.passwordFile = config.age.secrets.copyparty-c.path;
@@ -16,13 +18,13 @@ in {
         "/media" = {
           path = "/var/lib/media/library";
           access = {
-            rw = ["c"];
+            rw = [ "c" ];
           };
         };
         "/paperless" = {
           path = "/var/lib/paperless";
           access = {
-            rw = ["c"];
+            rw = [ "c" ];
           };
         };
       };

hosts/hermes/ddns.nix

@@ -1,11 +1,12 @@
-{config, ...}: {
+{ config, ... }:
+{
   services.cloudflare-dyndns = {
     enable = true;
     ipv4 = true;
     ipv6 = false;
     proxied = false;
     deleteMissing = false;
-    domains = [];
+    domains = [ ];
     apiTokenFile = config.age.secrets.cloudflare-api.path;
   };
   # services.cloudflare-dyndns.domains = [];

hosts/hermes/default.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   imports = [
     ./hardware-configuration.nix
     ./configuration.nix

hosts/hermes/fail2ban.nix

@@ -1,8 +1,11 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   services.fail2ban = {
     enable = true;
     jails = {
-      sshd.settings = {enabled = false;};
+      sshd.settings = {
+        enabled = false;
+      };
       radarr.settings = {
         enabled = true;
         filter = "arr";
@@ -74,33 +77,39 @@
     };
   };
   environment.etc = {
-    "fail2ban/filter.d/arr.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
+    "fail2ban/filter.d/arr.local".text = pkgs.lib.mkDefault (
-      [INCLUDES]
+      pkgs.lib.mkAfter ''
-      before = common.conf
+        [INCLUDES]
+        before = common.conf
 
-      [Definition]
+        [Definition]
-      datepattern = ^%%Y-%%m-%%d %%H:%%M:%%S\.%%f\|
+        datepattern = ^%%Y-%%m-%%d %%H:%%M:%%S\.%%f\|
-      failregex = ^\s*Warn\|Auth\|Auth-Failure ip <ADDR> username '<F-USER>[^']+</F-USER>'
+        failregex = ^\s*Warn\|Auth\|Auth-Failure ip <ADDR> username '<F-USER>[^']+</F-USER>'
-      ignoreregex =
+        ignoreregex =
-    '');
+      ''
+    );
 
-    "fail2ban/filter.d/jellyseerr.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
+    "fail2ban/filter.d/jellyseerr.local".text = pkgs.lib.mkDefault (
-      [INCLUDES]
+      pkgs.lib.mkAfter ''
-      before = common.conf
+        [INCLUDES]
+        before = common.conf
 
-      [Definition]
+        [Definition]
-      failregex = ^.*\[warn\]\[API\]: Failed sign-in attempt using invalid Overseerr password {"ip":"<HOST>","email":
+        failregex = ^.*\[warn\]\[API\]: Failed sign-in attempt using invalid Overseerr password {"ip":"<HOST>","email":
-                  ^.*\[warn\]\[Auth\]: Failed login attempt from user with incorrect Jellyfin credentials {"account":{"ip":"<HOST>","email":
+                    ^.*\[warn\]\[Auth\]: Failed login attempt from user with incorrect Jellyfin credentials {"account":{"ip":"<HOST>","email":
-      ignoreregex =
+        ignoreregex =
-    '');
+      ''
+    );
 
-    "fail2ban/filter.d/jellyfin.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
+    "fail2ban/filter.d/jellyfin.local".text = pkgs.lib.mkDefault (
-      [INCLUDES]
+      pkgs.lib.mkAfter ''
-      before = common.conf
+        [INCLUDES]
+        before = common.conf
 
-      [Definition]
+        [Definition]
-      failregex = ^.*Authentication request for .* has been denied \(IP: "<ADDR>"\)\.
+        failregex = ^.*Authentication request for .* has been denied \(IP: "<ADDR>"\)\.
-      ignoreregex =
+        ignoreregex =
-    '');
+      ''
+    );
   };
 }

hosts/hermes/forgejo.nix

@@ -2,11 +2,13 @@
   lib,
   config,
   ...
-}: let
+}:
+let
   domain = "git.cleslie.uk";
-in {
+in
+{
   services = {
-    cloudflare-dyndns.domains = [domain];
+    cloudflare-dyndns.domains = [ domain ];
     forgejo = {
       enable = true;
       database.type = "postgres";

hosts/hermes/hardware-configuration.nix

@@ -3,18 +3,25 @@
   lib,
   modulesPath,
   ...
-}: {
+}:
+{
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
   boot = {
-    initrd.availableKernelModules = ["xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod"];
+    initrd.availableKernelModules = [
-    initrd.kernelModules = [];
+      "xhci_pci"
-    kernelModules = ["kvm-intel"];
+      "ahci"
+      "usbhid"
+      "usb_storage"
+      "sd_mod"
+    ];
+    initrd.kernelModules = [ ];
+    kernelModules = [ "kvm-intel" ];
     kernelParams = [
       "i915.enable_guc=2"
     ];
-    extraModulePackages = [];
+    extraModulePackages = [ ];
   };
 
   #boot.kernelPackages = pkgs.linuxPackages_latest;
@@ -27,10 +34,13 @@
   fileSystems."/boot" = {
     device = "/dev/disk/by-uuid/57CE-8609";
     fsType = "vfat";
-    options = ["fmask=0077" "dmask=0077"];
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
   };
 
-  swapDevices = [];
+  swapDevices = [ ];
 
   networking.useDHCP = lib.mkDefault true;
 

hosts/hermes/headscale.nix

@@ -1,6 +1,8 @@
-{config, ...}: let
+{ config, ... }:
+let
   domain = "mesh.cleslie.uk";
-in {
+in
+{
   services = {
     headscale = {
       enable = true;
@@ -16,7 +18,7 @@ in {
         ip_prefixes = "100.64.0.0/10";
       };
     };
-    cloudflare-dyndns.domains = [domain];
+    cloudflare-dyndns.domains = [ domain ];
     caddy.virtualHosts.${domain}.extraConfig = ''
       reverse_proxy localhost:${toString config.services.headscale.port}
     '';

hosts/hermes/media.nix

@@ -1,10 +1,14 @@
-{pkgs, ...}: let
+{ pkgs, ... }:
+let
   mediaDir = "/var/lib/media";
-in {
+in
+{
   users = {
-    groups.multimedia = {gid = 994;};
+    groups.multimedia = {
-    users."root".extraGroups = ["multimedia"];
+      gid = 994;
-    users."media".extraGroups = ["multimedia"];
+    };
+    users."root".extraGroups = [ "multimedia" ];
+    users."media".extraGroups = [ "multimedia" ];
   };
 
   systemd.tmpfiles.rules = [
@@ -87,7 +91,11 @@ in {
       };
     };
 
-    cloudflare-dyndns.domains = ["media.cleslie.uk" "watch.cleslie.uk" "request.cleslie.uk"];
+    cloudflare-dyndns.domains = [
+      "media.cleslie.uk"
+      "watch.cleslie.uk"
+      "request.cleslie.uk"
+    ];
 
     jellyfin = {
       enable = true;
@@ -126,7 +134,7 @@ in {
       dataDir = "${mediaDir}/torrents";
       declarative = true;
       config = {
-        enabled_plugins = ["Label"];
+        enabled_plugins = [ "Label" ];
         outgoing_interface = "wg1";
         allow_remote = true;
         openFirewall = false;

hosts/hermes/n8n.nix

@@ -1,8 +1,10 @@
-{pkgs, ...}: let
+{ pkgs, ... }:
+let
   domain = "automation.cleslie.uk";
-in {
+in
+{
   services = {
-    cloudflare-dyndns.domains = [domain];
+    cloudflare-dyndns.domains = [ domain ];
     n8n = {
       enable = true;
       environment = {
@@ -14,5 +16,5 @@ in {
       reverse_proxy http://127.0.0.1:5678
     '';
   };
-  environment.systemPackages = with pkgs; [mupdf-headless];
+  environment.systemPackages = with pkgs; [ mupdf-headless ];
 }

hosts/hermes/networking.nix

@@ -1,8 +1,13 @@
-{config, ...}: {
+{ config, ... }:
+{
   networking = {
     hostName = "hermes";
     enableIPv6 = false;
-    firewall.allowedTCPPorts = [80 443 8265];
+    firewall.allowedTCPPorts = [
+      80
+      443
+      8265
+    ];
     firewall.checkReversePath = false;
     iproute2.enable = true;
     iproute2.rttablesExtraConfig = ''

hosts/hermes/nocodb.nix

@@ -1,8 +1,10 @@
-_: let
+_:
+let
   domain = "hub.cleslie.uk";
-in {
+in
+{
   services = {
-    cloudflare-dyndns.domains = [domain];
+    cloudflare-dyndns.domains = [ domain ];
     nocodb = {
       enable = true;
       environment = {

hosts/hermes/quassel.nix

@@ -1,6 +1,7 @@
-{...}: {
+{ ... }:
+{
   services.quassel = {
     enable = true;
-    interfaces = ["0.0.0.0"];
+    interfaces = [ "0.0.0.0" ];
   };
 }

hosts/hermes/ssh.nix

@@ -1,8 +1,9 @@
-{...}: {
+{ ... }:
+{
   services = {
     openssh = {
       enable = true;
-      ports = [62480];
+      ports = [ 62480 ];
       settings.PasswordAuthentication = false;
       settings.PermitRootLogin = "no";
     };

hosts/hermes/vaultwarden.nix

@@ -1,8 +1,10 @@
-{config, ...}: let
+{ config, ... }:
+let
   domain = "vaultwarden.cleslie.uk";
-in {
+in
+{
   services = {
-    cloudflare-dyndns.domains = [domain];
+    cloudflare-dyndns.domains = [ domain ];
     vaultwarden = {
       enable = true;
       dbBackend = "sqlite";

overlays/default.nix

@@ -1,5 +1,6 @@
-{inputs, ...}: _final: prev: {
+{ inputs, ... }:
+_final: prev: {
   nvf = inputs.nvf.packages.${prev.system}.default;
-  devour-flake = prev.callPackage inputs.devour-flake {};
+  devour-flake = prev.callPackage inputs.devour-flake { };
   agenix = inputs.agenix.packages.${prev.system}.default;
 }

packages/default.nix

@@ -2,13 +2,14 @@
   pkgs,
   inputs,
   inputs',
-}: {
+}:
-  tmux-sessionizer-cl = pkgs.callPackage ./tmux-sessionizer {};
+{
+  tmux-sessionizer-cl = pkgs.callPackage ./tmux-sessionizer { };
   om = inputs'.omnix.packages.default;
   nvf = inputs'.nvf.packages.default;
   agenix = inputs'.agenix.packages.default;
-  vaapiIntel = pkgs.intel-vaapi-driver.override {enableHybridCodec = true;};
+  vaapiIntel = pkgs.intel-vaapi-driver.override { enableHybridCodec = true; };
-  devour-flake = pkgs.callPackage inputs.devour-flake {};
+  devour-flake = pkgs.callPackage inputs.devour-flake { };
   nish = inputs'.nish.packages.default;
   nsbm = inputs'.nsbm.packages.default;
   jellyfin-ffmpeg = pkgs.jellyfin-ffmpeg.override {

packages/tmux-sessionizer/default.nix

@@ -1,8 +1,13 @@
-{pkgs}: let
+{ pkgs }:
+let
   name = "tmux-sessionizer";
-  runtimeInputs = [pkgs.tmux pkgs.ghq pkgs.fzf];
+  runtimeInputs = [
+    pkgs.tmux
+    pkgs.ghq
+    pkgs.fzf
+  ];
   text = builtins.readFile ./tmux-sessionizer.sh;
 in
-  pkgs.writeShellApplication {
+pkgs.writeShellApplication {
-    inherit name runtimeInputs text;
+  inherit name runtimeInputs text;
-  }
+}

secrets/secrets.nix

@@ -5,12 +5,13 @@ let
     artemis = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILERlCL5ZwP/mmtBNAMtLrUwEDy+tOprUWUmsGBRlTCF";
   };
   allSystems = builtins.attrValues systems;
-in {
+in
+{
   "wg-conf.age".publicKeys = keys.c ++ allSystems;
   "mesh-conf-infra.age".publicKeys = keys.c ++ allSystems;
   "mesh-conf-cleslie.age".publicKeys = keys.c ++ allSystems;
-  "forgejo-password.age".publicKeys = keys.c ++ [systems.hermes];
+  "forgejo-password.age".publicKeys = keys.c ++ [ systems.hermes ];
-  "copyparty-c.age".publicKeys = keys.c ++ [systems.hermes];
+  "copyparty-c.age".publicKeys = keys.c ++ [ systems.hermes ];
-  "cloudflare-api.age".publicKeys = keys.c ++ [systems.hermes];
+  "cloudflare-api.age".publicKeys = keys.c ++ [ systems.hermes ];
-  "vaultwarden-env.age".publicKeys = keys.c ++ [systems.hermes];
+  "vaultwarden-env.age".publicKeys = keys.c ++ [ systems.hermes ];
 }