Update proxy.nix

Makefile

@@ -1,4 +1,10 @@
-.PHONY: lock
+.PHONY: lock update build
+
+build:
+	sudo nixos-rebuild switch --flake .#haschel
 
 lock:
 	nix flake lock
+
+update:
+	nix flake update

configuration.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   imports = [
@@ -9,12 +9,15 @@
     ./modules/users.nix
     ./modules/hardware.nix
     ./modules/services.nix
-    ./modules/nginx.nix
+    ./modules/proxy.nix
     ./modules/matrix.nix
     ./modules/fail2ban.nix
   ];
 
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
 
   environment.systemPackages = with pkgs; [
     git

flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1771008912,
+        "lastModified": 1772773019,
-        "narHash": "sha256-gf2AmWVTs8lEq7z/3ZAsgnZDhWIckkb+ZnAo5RzSxJg=",
+        "narHash": "sha256-E1bxHxNKfDoQUuvriG71+f+s/NT0qWkImXsYZNFFfCs=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "a82ccc39b39b621151d6732718e3e250109076fa",
+        "rev": "aca4d95fce4914b3892661bcb80b8087293536c6",
         "type": "github"
       },
       "original": {

hardware-configuration.nix

@@ -1,28 +1,37 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{ lib, modulesPath, ... }:
 
 {
-  imports =
+  imports = [
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    (modulesPath + "/profiles/qemu-guest.nix")
-    ];
+  ];
 
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ "dm-snapshot" ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "/dev/disk/by-uuid/7a81e9fe-a727-4979-b63f-209ec593bd1d";
+    device = "/dev/disk/by-uuid/7a81e9fe-a727-4979-b63f-209ec593bd1d";
-      fsType = "ext4";
+    fsType = "ext4";
-    };
+  };
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    { device = "/dev/disk/by-uuid/FFAB-FF4F";
+    device = "/dev/disk/by-uuid/FFAB-FF4F";
-      fsType = "vfat";
+    fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
+    options = [
-    };
+      "fmask=0022"
+      "dmask=0022"
+    ];
+  };
 
   swapDevices = [ ];
 

modules/boot.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   boot.loader.grub = {

modules/fail2ban.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ ... }:
 
 {
   services.fail2ban = {

modules/hardware.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ ... }:
 
 {
   hardware.enableRedistributableFirmware = true;

modules/locale.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ ... }:
 
 let
   settings = import ../settings.nix;

modules/matrix.nix

@@ -1,7 +1,7 @@
-{ config, pkgs, lib, ... }:
+{ pkgs, ... }:
 
 let
-  livekitKeyFile = "/run/livekit.key";
+  livekitKeyFile = "/var/lib/livekit/livekit.key";
   serverName = "atri.dad";
   matrixDomain = "matrix.atri.dad";
   matrixRtcDomain = "matrixrtc.atri.dad";
@@ -12,13 +12,19 @@ in
     settings = {
       global = {
         server_name = serverName;
-        address = [ "127.0.0.1" "::1" ];
+        address = [
+          "127.0.0.1"
+          "::1"
+        ];
         port = [ 6167 ];
         max_request_size = 104857600;
         allow_registration = false;
         allow_encryption = true;
         allow_federation = true;
-        trusted_servers = [ "matrix.org" "chat.blahaj.zone" ];
+        trusted_servers = [
+          "matrix.org"
+          "chat.blahaj.zone"
+        ];
         ip_range_denylist = [
           "127.0.0.0/8"
           "10.0.0.0/8"
@@ -98,22 +104,41 @@ in
   systemd.services.livekit.requires = [ "acme-${matrixRtcDomain}.service" ];
 
   systemd.services.livekit-key = {
-    before = [ "lk-jwt-service.service" "livekit.service" ];
+    before = [
+      "lk-jwt-service.service"
+      "livekit.service"
+    ];
     wantedBy = [ "multi-user.target" ];
-    path = with pkgs; [ livekit coreutils gawk ];
+    path = with pkgs; [
+      livekit
+      coreutils
+      gawk
+    ];
     script = ''
       echo "Key missing, generating key"
+      install -d -m 0700 "$(dirname "${livekitKeyFile}")"
+      install -m 0600 /dev/null "${livekitKeyFile}"
       echo "lk-jwt-service: $(livekit-server generate-keys | tail -1 | awk '{print $3}')" > "${livekitKeyFile}"
     '';
-    serviceConfig.Type = "oneshot";
+    serviceConfig = {
+      Type = "oneshot";
+      UMask = "0177";
+    };
     unitConfig.ConditionPathExists = "!${livekitKeyFile}";
   };
 
   networking.firewall = {
-    allowedTCPPorts = [ 7880 7881 5349 ];
+    allowedTCPPorts = [
+      7880
+      7881
+      5349
+    ];
     allowedUDPPorts = [ 3478 ];
     allowedUDPPortRanges = [
-      { from = 50000; to = 60000; }
+      {
+        from = 50000;
+        to = 60000;
+      }
     ];
   };
 }

modules/networking.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ ... }:
 
 let
   settings = import ../settings.nix;
@@ -7,10 +7,4 @@ in
   networking.hostName = settings.hostname;
 
   networking.networkmanager.enable = true;
-
-  networking.firewall = {
-    enable = true;
-    allowedTCPPorts = [ 22 80 443 ];
-    allowedUDPPorts = [ ];
-  };
 }

modules/nginx.nix

@@ -1,264 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-
-let
-  atriDotDad = "atri.dad";
-  atashDotDev = "atash.dev";
-
-  matrixDomain = "matrix.${atriDotDad}";
-  matrixRtcDomain = "matrixrtc.${atriDotDad}";
-
-  upstream = "lloyd.tadpole-pain.ts.net";
-
-  wellKnownServer = builtins.toJSON {
-    "m.server" = "${matrixDomain}:443";
-  };
-
-  wellKnownClient = builtins.toJSON {
-    "m.homeserver" = {
-      base_url = "https://${matrixDomain}";
-    };
-    "org.matrix.msc4143.rtc_foci" = [
-      {
-        type = "livekit";
-        livekit_service_url = "https://${matrixDomain}/livekit/jwt";
-      }
-    ];
-  };
-
-  mkProxy = port: {
-    enableACME = true;
-    forceSSL = true;
-    locations."/" = {
-      proxyPass = "http://${upstream}:${toString port}";
-      proxyWebsockets = true;
-      extraConfig = "if ($fuckai) { return 444; }";
-    };
-  };
-
-  mkStream = port: ''
-    server {
-      listen ${toString port};
-      listen ${toString port} udp;
-      proxy_pass ${upstream}:${toString port};
-    }
-  '';
-in
-{
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "me@${atriDotDad}";
-  };
-
-  services.nginx = {
-    enable = true;
-
-    recommendedGzipSettings = true;
-    recommendedOptimisation = true;
-    recommendedProxySettings = true;
-    recommendedTlsSettings = true;
-
-    # Fuck AI
-    clientMaxBodySize = "3g";
-
-    commonHttpConfig = ''
-      more_clear_headers Server;
-      more_clear_headers X-Powered-By;
-
-      map $http_user_agent $fuckai {
-          default 0;
-
-          "~*GPTBot" 1;
-          "~*ChatGPT-User" 1;
-          "~*OAI-SearchBot" 1;
-          "~*ChatGPT-Browser" 1;
-          "~*ClaudeBot" 1;
-          "~*Claude-Web" 1;
-          "~*anthropic-ai" 1;
-          "~*Anthropic-Claude" 1;
-          "~*xAI-Bot" 1;
-          "~*DeepseekBot" 1;
-          "~*Google-Extended" 1;
-          "~*Gemini-Ai" 1;
-          "~*Gemini-Deep-Research" 1;
-          "~*Google-CloudVertexBot" 1;
-          "~*Google-NotebookLM" 1;
-          "~*GoogleAgent-Mariner" 1;
-          "~*Bard-Ai" 1;
-          "~*FacebookBot" 1;
-          "~*Meta-ExternalAgent" 1;
-          "~*meta-webindexer" 1;
-          "~*Applebot-Extended" 1;
-          "~*bingbot" 1;
-          "~*CCBot" 1;
-          "~*PerplexityBot" 1;
-          "~*Perplexity-User" 1;
-          "~*Bytespider" 1;
-          "~*Diffbot" 1;
-          "~*Amazonbot" 1;
-          "~*cohere-ai" 1;
-          "~*Cohere-Command" 1;
-          "~*YouBot" 1;
-          "~*Omgilibot" 1;
-          "~*ImagesiftBot" 1;
-          "~*AI2Bot" 1;
-          "~*Andibot" 1;
-          "~*bigsur.ai" 1;
-          "~*Brightbot" 1;
-          "~*TerraCotta" 1;
-          "~*Character-AI" 1;
-          "~*Devin" 1;
-          "~*Crawlspace" 1;
-          "~*DuckAssistBot" 1;
-          "~*FirecrawlAgent" 1;
-          "~*Groq-Bot" 1;
-          "~*HuggingFace-Bot" 1;
-          "~*IbouBot" 1;
-          "~*MistralAI-User" 1;
-          "~*Replicate-Bot" 1;
-          "~*RunPod-Bot" 1;
-          "~*TimpiBot" 1;
-          "~*Together-Bot" 1;
-          "~*Kangaroo Bot" 1;
-          "~*PanguBot" 1;
-          "~*Cotoyogi" 1;
-          "~*Webzio-Extended" 1;
-      }
-    '';
-
-    streamConfig = lib.concatStrings (
-      map mkStream [
-        69
-        420
-        25565
-        25566
-        25567
-      ]
-    );
-
-    virtualHosts = {
-      "${atriDotDad}" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://${upstream}:3000";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-        locations."= /.well-known/matrix/server" = {
-          extraConfig = ''
-            default_type application/json;
-            return 200 '${wellKnownServer}';
-          '';
-        };
-        locations."= /.well-known/matrix/client" = {
-          extraConfig = ''
-            default_type application/json;
-            add_header Access-Control-Allow-Origin "*";
-            return 200 '${wellKnownClient}';
-          '';
-        };
-      };
-
-      "analytics.${atriDotDad}" = mkProxy 30060;
-      "archive.${atriDotDad}" = mkProxy 30288;
-      "ascently.${atriDotDad}" = mkProxy 8838;
-      "bsky.${atriDotDad}" = mkProxy 31173;
-      "chef.${atriDotDad}" = mkProxy 30111;
-      "democlimb.${atriDotDad}" = mkProxy 8008;
-      "fedi.${atriDotDad}" = mkProxy 8181;
-      "gist.${atriDotDad}" = mkProxy 1227;
-      "git.${atriDotDad}" = mkProxy 30010;
-      "links.${atriDotDad}" = mkProxy 30243;
-      "memos.${atriDotDad}" = mkProxy 30311;
-      "mermaid.${atriDotDad}" = mkProxy 8280;
-      "msrc.${atriDotDad}" = mkProxy 3311;
-      "n8n.${atriDotDad}" = mkProxy 30109;
-      "ocr.${atriDotDad}" = mkProxy 30070;
-      "openclimb.${atriDotDad}" = mkProxy 1337;
-      "photos.${atriDotDad}" = mkProxy 30041;
-      "pods.${atriDotDad}" = mkProxy 8828;
-      "requests.${atriDotDad}" = mkProxy 30042;
-      "s3.${atriDotDad}" = mkProxy 30188;
-      "search.${atriDotDad}" = mkProxy 30053;
-      "sync.${atriDotDad}" = mkProxy 20910;
-      "travel.${atriDotDad}" = mkProxy 30251;
-      "travelapi.${atriDotDad}" = mkProxy 30250;
-      "vault.${atriDotDad}" = mkProxy 30032;
-
-      "media.${atriDotDad}" = {
-        enableACME = true;
-        forceSSL = true;
-        extraConfig = ''
-          client_max_body_size 0;
-        '';
-        locations."/" = {
-          proxyPass = "http://${upstream}:30013";
-          proxyWebsockets = true;
-          extraConfig = ''
-            if ($fuckai) { return 444; }
-            proxy_buffering off;
-            proxy_request_buffering off;
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            send_timeout 86400s;
-          '';
-        };
-      };
-
-      "${matrixDomain}" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://[::1]:6167";
-          proxyWebsockets = true;
-          extraConfig = ''
-            client_max_body_size 100M;
-          '';
-        };
-        locations."^~ /livekit/jwt/" = {
-          priority = 400;
-          proxyPass = "http://[::1]:${toString config.services.lk-jwt-service.port}/";
-        };
-      };
-
-      "${matrixRtcDomain}" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://[::1]:${toString config.services.livekit.settings.port}";
-          proxyWebsockets = true;
-          extraConfig = ''
-            proxy_send_timeout 120;
-            proxy_read_timeout 120;
-            proxy_buffering off;
-            proxy_set_header Accept-Encoding gzip;
-          '';
-        };
-      };
-
-      "ripkyle.org" = mkProxy 4321;
-      "${atashDotDev}" = mkProxy 6969;
-      "chronus.${atashDotDev}" = mkProxy 7337;
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-    69
-    420
-    25565
-    25566
-    25567
-  ];
-  networking.firewall.allowedUDPPorts = [
-    69
-    420
-    25565
-    25566
-    25567
-  ];
-}

modules/proxy.nix

@@ -0,0 +1,218 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  atriDotDad = "atri.dad";
+  atashDotDev = "atash.dev";
+
+  matrixDomain = "matrix.${atriDotDad}";
+  matrixRtcDomain = "matrixrtc.${atriDotDad}";
+
+  upstream = "lloyd.tadpole-pain.ts.net";
+  streamPorts = [
+    69
+    420
+    25565
+    25566
+    25567
+    30058
+    51820
+  ];
+
+  wellKnownServer = builtins.toJSON {
+    "m.server" = "${matrixDomain}:443";
+  };
+
+  wellKnownClient = builtins.toJSON {
+    "m.homeserver" = {
+      base_url = "https://${matrixDomain}";
+    };
+    "org.matrix.msc4143.rtc_foci" = [
+      {
+        type = "livekit";
+        livekit_service_url = "https://${matrixDomain}/livekit/jwt";
+      }
+    ];
+  };
+
+  mkProxy = port: config_preset: ''
+    import ${config_preset}
+    reverse_proxy http://${upstream}:${toString port}
+  '';
+
+  mkSocatService =
+    port: proto:
+    lib.nameValuePair "socat-${proto}-${toString port}" {
+      description = "Socat ${proto} proxy for port ${toString port}";
+      after = [
+        "network-online.target"
+        "tailscaled.service"
+      ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = "${pkgs.socat}/bin/socat ${lib.toUpper proto}-LISTEN:${toString port},fork,reuseaddr ${lib.toUpper proto}:${upstream}:${toString port}";
+        Restart = "on-failure";
+        RestartSec = "5s";
+        DynamicUser = true;
+        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+      };
+    };
+
+in
+{
+  services.caddy = {
+    enable = true;
+    email = "me@${atriDotDad}";
+
+    package = pkgs.caddy.withPlugins {
+      plugins = [ "pkg.jsn.cam/caddy-defender@v0.10.0" ];
+      hash = "sha256-DpCaOp9pXV3sdMz1hh/1SQ7ww7Fo4aAgLvFyQFgIJdI=";
+    };
+
+    extraConfig = ''
+      (strict_config) {
+        encode zstd gzip
+
+        defender garbage {
+          ranges openai deepseek aliyun azurepubliccloud aws gcloud githubcopilot mistral oci vultr digitalocean linode cloudflare
+        }
+
+        header {
+          Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+          X-Content-Type-Options "nosniff"
+          X-Frame-Options "DENY"
+          X-Robots-Tag "noimageindex, noodp, noydir, nofollow"
+          Referrer-Policy "strict-origin-when-cross-origin"
+          Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://*.atri.dad https://*.atash.dev; font-src 'self' data:; connect-src 'self' wss: https://*.atri.dad https://*.atash.dev; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
+          -Server
+          -alt-svc
+        }
+      }
+
+      (relaxed_config) {
+        encode zstd gzip
+
+        header {
+          Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+          X-Content-Type-Options "nosniff"
+          X-Frame-Options "DENY"
+          X-Robots-Tag "noimageindex, noodp, noydir, nofollow"
+          Referrer-Policy "strict-origin-when-cross-origin"
+          Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' wss: https://*.atri.dad https://*.atash.dev; media-src 'self' https://rogers-hls.leanstream.co; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
+          -Server
+          -alt-svc
+        }
+      }
+
+      ${atriDotDad} {
+        import strict_config
+
+        handle /.well-known/matrix/server {
+          header Content-Type application/json
+          header X-Content-Type-Options nosniff
+          respond `${wellKnownServer}` 200
+        }
+
+        handle /.well-known/matrix/client {
+          header Content-Type application/json
+          header Access-Control-Allow-Origin "*"
+          header Vary Origin
+          header X-Content-Type-Options nosniff
+          respond `${wellKnownClient}` 200
+        }
+
+        handle {
+          reverse_proxy http://${upstream}:3000
+        }
+      }
+
+      analytics.${atriDotDad} { ${mkProxy 30060 "strict_config"} }
+      ascently.${atriDotDad} { ${mkProxy 8838 "strict_config"} }
+      chef.${atriDotDad} { ${mkProxy 30111 "strict_config"} }
+      democlimb.${atriDotDad} { ${mkProxy 8008 "strict_config"} }
+      fedi.${atriDotDad} { ${mkProxy 8181 "strict_config"} }
+      gist.${atriDotDad} { ${mkProxy 1227 "strict_config"} }
+      git.${atriDotDad} { ${mkProxy 30010 "strict_config"} }
+      links.${atriDotDad} { ${mkProxy 30243 "strict_config"} }
+      memos.${atriDotDad} { ${mkProxy 30311 "strict_config"} }
+      mermaid.${atriDotDad} { ${mkProxy 8280 "relaxed_config"} }
+      msrc.${atriDotDad} { ${mkProxy 3311 "strict_config"} }
+      openclimb.${atriDotDad} { ${mkProxy 1337 "strict_config"} }
+      photos.${atriDotDad} { ${mkProxy 30041 "strict_config"} }
+      abs.${atriDotDad} { ${mkProxy 30067 "strict_config"} }
+      s3.${atriDotDad} { ${mkProxy 30188 "strict_config"} }
+      search.${atriDotDad} { ${mkProxy 30053 "relaxed_config"} }
+      vault.${atriDotDad} { ${mkProxy 30032 "strict_config"} }
+      vids.${atriDotDad} { ${mkProxy 31008 "strict_config"} }
+      music.${atriDotDad} { ${mkProxy 30043 "strict_config"} }
+      books.${atriDotDad} { ${mkProxy 31067 "strict_config"} }
+      tv.${atriDotDad} { ${mkProxy 30013 "strict_config"} }
+      vpn.${atriDotDad} { ${mkProxy 30058 "strict_config"} }
+
+      ripkyle.org { ${mkProxy 4321 "strict_config"} }
+      ${atashDotDev} { ${mkProxy 6969 "strict_config"} }
+      chronus.${atashDotDev} { ${mkProxy 7337 "strict_config"} }
+
+      ${matrixDomain} {
+        request_body {
+          max_size 1GB
+        }
+
+        handle_path /livekit/jwt/* {
+          @allowed path /sfu/get /get_token /healthz
+          handle @allowed {
+            reverse_proxy http://[::1]:${toString config.services.lk-jwt-service.port}
+          }
+          handle {
+            respond 404
+          }
+        }
+
+        handle {
+          reverse_proxy http://[::1]:6167
+        }
+      }
+
+      ${matrixRtcDomain} {
+        handle /.well-known/acme-challenge/* {
+          root * /var/lib/acme/acme-challenge
+          file_server
+        }
+
+        handle {
+          reverse_proxy http://[::1]:${toString config.services.livekit.settings.port} {
+            flush_interval -1
+          }
+        }
+      }
+    '';
+  };
+
+  systemd.services = lib.listToAttrs (
+    (map (port: mkSocatService port "tcp") streamPorts)
+    ++ (map (port: mkSocatService port "udp") streamPorts)
+  );
+
+  networking.firewall = {
+    allowedTCPPorts = [
+      80
+      443
+    ]
+    ++ streamPorts;
+    allowedUDPPorts = streamPorts;
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "me@${atriDotDad}";
+
+    certs."${matrixRtcDomain}" = {
+      webroot = "/var/lib/acme/acme-challenge";
+    };
+  };
+}

modules/services.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ ... }:
 
 {
   services.openssh = {

modules/users.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ ... }:
 
 let
   settings = import ../settings.nix;
@@ -8,10 +8,14 @@ in
     isNormalUser = true;
     description = settings.userDescription;
     extraGroups = settings.userGroups;
-    openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMuiXQV7+vtLxoyLojnW/Pkt6ScWQs29KPZe8aJVAvvC" ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMuiXQV7+vtLxoyLojnW/Pkt6ScWQs29KPZe8aJVAvvC"
+    ];
   };
 
-  users.users.root.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMuiXQV7+vtLxoyLojnW/Pkt6ScWQs29KPZe8aJVAvvC" ];
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMuiXQV7+vtLxoyLojnW/Pkt6ScWQs29KPZe8aJVAvvC"
+  ];
 
   security.sudo.execWheelOnly = true;
 }