manual_inherit

modules/darwin/nix/default.nix

@@ -4,13 +4,15 @@
   ...
 }:
 let
-  nixSettings = lib.${namespace}.nixSettings;
+  inherit (lib.${namespace}) nixSettings;
 in
 {
   nix = {
     settings = nixSettings.commonSettings // {
-      substituters = nixSettings.commonSubstituters;
-      trusted-public-keys = nixSettings.commonTrustedPublicKeys;
+      inherit (nixSettings)
+        commonSubstituters
+        commonTrustedPublicKeys
+        ;
     };
 
     gc = nixSettings.commonGc;

modules/home/programs/hyprland/default.nix

@@ -313,6 +313,7 @@ in
           secondMonitor = if builtins.length names > 1 then builtins.elemAt names 1 else firstMonitor;
         in
         {
+          inherit (cfg) workspace;
           "$mod" = cfg.modKey;
 
           # Mouse
@@ -513,8 +514,6 @@ in
             preserve_split = "yes";
           };
 
-          workspace = cfg.workspace;
-
           windowrule = [
             "match:title file_progress, float 1"
             "match:title .*[Cc]onfirm.*, float 1"

modules/home/programs/waybar/default.nix

@@ -297,7 +297,7 @@ in
         mainBar =
           (mkMerge [
             {
-              layer = cfg.layer;
+              inherit (cfg) layer;
               position = "top";
               mod = "dock";
               exclusive = true;
@@ -342,7 +342,7 @@ in
               };
 
               network = {
-                interface = cfg.network.interface;
+                inherit (cfg.network) interface;
                 on-click = "nm-connection-editor";
                 format = "{icon}";
                 tooltip-format = "{ifname} via {gwaddr} 󰊗";

modules/nixos/boot/lanzaboote/default.nix

@@ -32,7 +32,7 @@ in
         };
       };
       lanzaboote = {
-        enable = cfg.enable;
+        enable = true;
         pkiBundle = "/etc/secureboot";
         settings = {
           console-mode = "max";

modules/nixos/desktop/hyprland/wallpapers/default.nix

@@ -15,11 +15,11 @@ in
   # and provide the hyprctl hot-reload command so hyprpaper picks up the new image.
   config = lib.mkIf cfg.enable {
     ${namespace}.wallpaper = {
+      inherit (cfg) defaultWallpaper;
       enable = true;
       source = cfg.wallpaperSource;
       path = cfg.wallpaper;
       dir = cfg.wallpaperDir;
-      defaultWallpaper = cfg.defaultWallpaper;
       reloadCommand = "${lib.getExe' pkgs.hyprland "hyprctl"} hyprpaper wallpaper ,${cfg.wallpaper},";
     };
   };

modules/nixos/hardware/amd/default.nix

@@ -46,7 +46,7 @@ in
     };
 
     programs.corectrl = {
-      enable = cfg.corectrl.enable;
+      inherit (cfg.corectrl) enable;
       package = pkgs.corectrl;
     };
 

modules/nixos/hardware/nvidia/default.nix

@@ -53,7 +53,7 @@ in
 
         # Enable the Nvidia settings menu,
         # accessible via `nvidia-settings`.
-        nvidiaSettings = cfg.nvidiaSettings;
+        inherit (cfg) nvidiaSettings;
       };
     };
 

modules/nixos/hardware/raspberry-pi/bluetooth.nix

@@ -7,7 +7,7 @@
 }:
 let
   cfg = config.${namespace}.hardware.raspberry-pi.disable-bluetooth;
-  variant = config.${namespace}.hardware.raspberry-pi.variant;
+  inherit (config.${namespace}.hardware.raspberry-pi) variant;
 in
 {
   options.${namespace}.hardware.raspberry-pi.disable-bluetooth = {

modules/nixos/hardware/raspberry-pi/i2c.nix

@@ -7,7 +7,7 @@
 }:
 let
   cfg = config.${namespace}.hardware.raspberry-pi.i2c;
-  variant = config.${namespace}.hardware.raspberry-pi.variant;
+  inherit (config.${namespace}.hardware.raspberry-pi) variant;
 in
 {
   options.${namespace}.hardware.raspberry-pi.i2c = {

modules/nixos/hardware/raspberry-pi/pwm.nix

@@ -7,7 +7,7 @@
 }:
 let
   cfg = config.${namespace}.hardware.raspberry-pi.pwm;
-  variant = config.${namespace}.hardware.raspberry-pi.variant;
+  inherit (config.${namespace}.hardware.raspberry-pi) variant;
 in
 {
   options.${namespace}.hardware.raspberry-pi.pwm = {

modules/nixos/homeassistant/services/homeassistant/default.nix

@@ -33,14 +33,12 @@ in
       secrets = {
         "home-assistant/auth-client-id" = {
           sopsFile = lib.snowfall.fs.get-file "secrets/nuc-secrets.yaml";
-          owner = config.users.users.hass.name;
-          group = config.users.users.hass.group;
+          inherit (config.users.users.hass) name group;
           restartUnits = [ "home-assistant.service" ];
         };
         "home-assistant/auth-client-secret" = {
           sopsFile = lib.snowfall.fs.get-file "secrets/nuc-secrets.yaml";
-          owner = config.users.users.hass.name;
-          group = config.users.users.hass.group;
+          inherit (config.users.users.hass) name group;
           restartUnits = [ "home-assistant.service" ];
         };
       };

modules/nixos/homeassistant/services/thread/default.nix

@@ -27,11 +27,11 @@ let
         backboneInterface = "enp2s0";
         package = otbrPackage;
         rest = {
-          listenAddress = cfg.listenAddress;
+          inherit (cfg) listenAddress;
           listenPort = cfg.restPort;
         };
         web = {
-          listenAddress = cfg.listenAddress;
+          inherit (cfg) listenAddress;
           listenPort = cfg.port;
         };
         radio = {

modules/nixos/network/default.nix

@@ -15,24 +15,20 @@ let
         name: profile:
         nameValuePair "${name}" {
           connection = {
+            inherit (profile) type autoconnect autoconnect-retries;
             id = name;
-            type = profile.type;
-            autoconnect = profile.autoconnect;
-            autoconnect-retries = profile.autoconnect-retries;
             autoconnect-priority = profile.priority;
             interface-name = profile.interface or cfg.ipv4.interface;
           };
           ipv4 = {
-            method = cfg.ipv4.method;
+            inherit (cfg.ipv4) method;
           }
           // (
             if (cfg.ipv4.method == "auto") then
               { }
             else
               {
-                address = cfg.ipv4.address;
-                gateway = cfg.ipv4.gateway;
-                dns = cfg.ipv4.dns;
+                inherit (cfg.ipv4) address gateway dns;
               }
           );
           ipv6 = {
@@ -40,13 +36,13 @@ let
             method = "auto";
           };
           wifi = mkIf (profile.type == "wifi") {
+            inherit (profile) ssid;
             mode = "infrastructure";
-            ssid = profile.ssid;
             roaming = "allowed";
           };
           wifi-security = mkIf (profile.type == "wifi") {
+            inherit (profile) psk;
             key-mgmt = profile.keyMgmt;
-            psk = profile.psk;
           };
         };
 
@@ -65,10 +61,8 @@ let
                 interface-name = cfg.ipv4.interface;
               };
               ipv4 = {
+                inherit (cfg.ipv4) address gateway dns;
                 method = "manual";
-                address = cfg.ipv4.address;
-                gateway = cfg.ipv4.gateway;
-                dns = cfg.ipv4.dns;
               };
               ipv6 = {
                 addr-gen-mode = "stable-privacy";
@@ -149,31 +143,29 @@ in
 
       # Configure NAT if enabled
       nat = lib.mkIf cfg.nat.enable {
+        inherit (cfg.nat) internalInterfaces externalInterface enableIPv6;
         enable = true;
-        internalInterfaces = cfg.nat.internalInterfaces;
-        externalInterface = cfg.nat.externalInterface;
-        enableIPv6 = cfg.nat.enableIPv6;
       };
 
       # Configure firewall
       firewall = {
-        enable = cfg.firewall.enable;
-        allowPing = cfg.firewall.allowPing;
-        allowedTCPPorts = cfg.firewall.allowedTCPPorts;
-        allowedUDPPorts = cfg.firewall.allowedUDPPorts;
-        trustedInterfaces = cfg.firewall.trustedInterfaces;
+        inherit (cfg.firewall)
+          enable
+          allowPing
+          allowedTCPPorts
+          allowedUDPPorts
+          trustedInterfaces
+          ;
 
         # Default port ranges for KDE Connect
         allowedTCPPortRanges = lib.mkIf cfg.firewall.kdeConnect.enable [
           {
-            from = cfg.firewall.kdeConnect.tcpRange.from;
-            to = cfg.firewall.kdeConnect.tcpRange.to;
+            inherit (cfg.firewall.kdeConnect.tcpRange) from to;
           }
         ];
         allowedUDPPortRanges = lib.mkIf cfg.firewall.kdeConnect.enable [
           {
-            from = cfg.firewall.kdeConnect.udpRange.from;
-            to = cfg.firewall.kdeConnect.udpRange.to;
+            inherit (cfg.firewall.kdeConnect.udpRange) from to;
           }
         ];
 
@@ -185,14 +177,16 @@ in
       # When iwd is enabled alongside NetworkManager, iwd acts as the WiFi
       # backend for NM (iwd handles scanning/association; NM handles
       # connection management).  They are not mutually exclusive.
-      wireless.iwd = lib.mkIf cfg.iwd.enable {
-        enable = true;
-        settings = cfg.iwd.settings;
+      wireless.iwd = {
+        inherit (cfg.iwd)
+          enable
+          settings
+          ;
       };
 
       # Configure NetworkManager when enabled
-      networkmanager = mkIf cfg.networkmanager.enable {
-        enable = true;
+      networkmanager = {
+        inherit (cfg.networkmanager) enable;
         # Use iwd as the WiFi backend when iwd is also enabled
         wifi.backend = mkIf cfg.iwd.enable "iwd";
         wifi.powersave = cfg.networkmanager.powersave;
@@ -211,7 +205,7 @@ in
         # Configure profiles if any are defined
         ensureProfiles = mkIf (profiles != { }) {
           environmentFiles = lib.optional (config.sops.secrets ? wifi) config.sops.secrets.wifi.path;
-          profiles = profiles;
+          inherit profiles;
         };
       };
     };

modules/nixos/nix/default.nix

@@ -5,7 +5,7 @@
   ...
 }:
 let
-  nixSettings = lib.${namespace}.nixSettings;
+  inherit (lib.${namespace}) nixSettings;
 in
 {
   nix = {

modules/nixos/services/actual/default.nix

@@ -16,11 +16,11 @@ let
     options = { };
     moduleConfig = {
       services.actual = {
+        inherit (cfg) openFirewall;
         enable = true;
-        openFirewall = cfg.openFirewall;
         settings = {
+          inherit (cfg) port;
           trustedProxies = [ config.${namespace}.network.ipv4.address ];
-          port = cfg.port;
           serverFiles = "${cfg.configDir}/${name}/server-files";
           userFiles = "${cfg.configDir}/${name}/user-files";
           dataDir = "${cfg.configDir}/${name}";

modules/nixos/services/ai/default.nix

@@ -39,23 +39,23 @@ let
     moduleConfig = {
       services = {
         ollama = {
+          inherit (cfg) openFirewall;
           enable = true;
           package = pkgs.ollama-rocm;
           port = 11434;
           host = "0.0.0.0";
           user = "nix-apps";
           group = "jallen-nas";
-          openFirewall = cfg.openFirewall;
           rocmOverrideGfx = "11.0.2";
           loadModels = [ ];
           home = "${cfg.configDir}/ollama";
         };
 
         llama-cpp = {
+          inherit (cfg) openFirewall;
           enable = true;
           port = 8127;
           host = "0.0.0.0";
-          openFirewall = cfg.openFirewall;
           model = "${cfg.configDir}/llama-cpp/models/${cfg.llama-cpp.model}.gguf";
           package = inputs.llama-cpp.packages.${system}.rocm;
           extraFlags = [
@@ -87,11 +87,11 @@ let
         };
 
         open-webui = {
+          inherit (cfg) openFirewall;
           enable = true;
           package = pkgs.open-webui;
           host = "0.0.0.0";
           port = 8888;
-          openFirewall = cfg.openFirewall;
           environmentFile = config.sops.secrets."jallen-nas/open-webui".path;
           environment = {
             OPENID_PROVIDER_URL = "https://authentik.mjallen.dev/application/o/chat/.well-known/openid-configuration";

modules/nixos/services/arrs/default.nix

@@ -56,8 +56,8 @@ let
       # Enable radarr service
       services = {
         radarr = {
+          inherit (cfg) openFirewall;
           enable = true;
-          openFirewall = cfg.openFirewall;
           user = "nix-apps";
           group = "jallen-nas";
           dataDir = "${cfg.configDir}/radarr";
@@ -65,8 +65,8 @@ let
 
         # Enable Sonarr service
         sonarr = {
+          inherit (cfg) openFirewall;
           enable = true;
-          openFirewall = cfg.openFirewall;
           user = "nix-apps";
           group = "jallen-nas";
           dataDir = "${cfg.configDir}/sonarr";
@@ -74,8 +74,8 @@ let
         };
 
         lidarr = {
+          inherit (cfg) openFirewall;
           enable = true;
-          openFirewall = cfg.openFirewall;
           user = "nix-apps";
           group = "jallen-nas";
           dataDir = "${cfg.configDir}/lidarr";
@@ -172,23 +172,22 @@ let
         };
 
         deluge = {
+          inherit (cfg) openFirewall dataDir;
           enable = false;
           user = "nix-apps";
           group = "jallen-nas";
-          openFirewall = cfg.openFirewall;
-          dataDir = cfg.dataDir;
           web = {
+            inherit (cfg) openFirewall;
             enable = true;
             port = 8112;
-            openFirewall = cfg.openFirewall;
           };
         };
 
         jackett = {
+          inherit (cfg) openFirewall;
           enable = false;
           user = "nix-apps";
           group = "jallen-nas";
-          openFirewall = cfg.openFirewall;
         };
       };
     };

modules/nixos/services/attic/default.nix

@@ -27,8 +27,8 @@ let
     options = { };
     moduleConfig = {
       services.atticd = {
+        inherit (cfg) environmentFile;
         enable = true;
-        environmentFile = cfg.environmentFile;
         settings = {
           listen = "${cfg.listenAddress}:${toString cfg.port}";
           storage = {

modules/nixos/services/authentik/default.nix

@@ -18,9 +18,11 @@ let
     options = { };
     moduleConfig = {
       services.authentik = {
+        inherit (cfg) environmentFile;
         enable = true;
-        environmentFile = cfg.environmentFile;
-        settings.port = cfg.port;
+        settings = {
+          inherit (cfg) port;
+        };
       };
     };
   };

modules/nixos/services/caddy/sops.nix

@@ -6,55 +6,24 @@
 }:
 let
   cfg = config.${namespace}.services.caddy;
+
+  caddySecret = {
+    inherit (config.users.users.caddy) name group;
+    sopsFile = lib.snowfall.fs.get-file "secrets/nas-secrets.yaml";
+    restartUnits = [ "caddy.service" ];
+  };
 in
 {
   config = lib.mkIf cfg.enable {
     sops = {
       secrets = {
-        "jallen-nas/traefik/crowdsec/lapi-key" = {
-          sopsFile = lib.snowfall.fs.get-file "secrets/nas-secrets.yaml";
-          owner = config.users.users.caddy.name;
-          group = config.users.users.caddy.group;
-          restartUnits = [ "caddy.service" ];
-        };
-
-        "jallen-nas/traefik/crowdsec/capi-machine-id" = {
-          sopsFile = lib.snowfall.fs.get-file "secrets/nas-secrets.yaml";
-          owner = config.users.users.caddy.name;
-          group = config.users.users.caddy.group;
-          restartUnits = [ "caddy.service" ];
-        };
-
-        "jallen-nas/traefik/crowdsec/capi-password" = {
-          sopsFile = lib.snowfall.fs.get-file "secrets/nas-secrets.yaml";
-          owner = config.users.users.caddy.name;
-          group = config.users.users.caddy.group;
-          restartUnits = [ "caddy.service" ];
-        };
-        "jallen-nas/traefik/cloudflare-dns-api-token" = {
-          sopsFile = lib.snowfall.fs.get-file "secrets/nas-secrets.yaml";
-          owner = config.users.users.caddy.name;
-          group = config.users.users.caddy.group;
-          restartUnits = [ "caddy.service" ];
-        };
-        "jallen-nas/traefik/cloudflare-zone-api-token" = {
-          sopsFile = lib.snowfall.fs.get-file "secrets/nas-secrets.yaml";
-          owner = config.users.users.caddy.name;
-          group = config.users.users.caddy.group;
-          restartUnits = [ "caddy.service" ];
-        };
-        "jallen-nas/traefik/cloudflare-api-key" = {
-          sopsFile = lib.snowfall.fs.get-file "secrets/nas-secrets.yaml";
-          owner = config.users.users.caddy.name;
-          group = config.users.users.caddy.group;
-          restartUnits = [ "caddy.service" ];
-        };
-        "jallen-nas/traefik/cloudflare-email" = {
-          sopsFile = lib.snowfall.fs.get-file "secrets/nas-secrets.yaml";
-          owner = config.users.users.caddy.name;
-          group = config.users.users.caddy.group;
-          restartUnits = [ "caddy.service" ];
-        };
+        "jallen-nas/traefik/crowdsec/lapi-key" = caddySecret;
+        "jallen-nas/traefik/crowdsec/capi-machine-id" = caddySecret;
+        "jallen-nas/traefik/crowdsec/capi-password" = caddySecret;
+        "jallen-nas/traefik/cloudflare-dns-api-token" = caddySecret;
+        "jallen-nas/traefik/cloudflare-zone-api-token" = caddySecret;
+        "jallen-nas/traefik/cloudflare-api-key" = caddySecret;
+        "jallen-nas/traefik/cloudflare-email" = caddySecret;
       };
       templates = {
         "caddy.env" = {
@@ -64,8 +33,7 @@ in
             CLOUDFLARE_API_KEY=${config.sops.placeholder."jallen-nas/traefik/cloudflare-api-key"}
             CLOUDFLARE_EMAIL=${config.sops.placeholder."jallen-nas/traefik/cloudflare-email"}
           '';
-          owner = config.users.users.caddy.name;
-          group = config.users.users.caddy.group;
+          inherit (config.users.users.caddy) name group;
           restartUnits = [ "caddy.service" ];
         };
       };

modules/nixos/services/calibre/default.nix

@@ -17,9 +17,9 @@ let
     options = { };
     moduleConfig = {
       services.calibre-server = {
+        inherit (cfg) port;
         enable = false;
         openFirewall = true;
-        port = cfg.port;
         libraries = [ "${cfg.dataDir}/books" ];
       };
     };
@@ -37,8 +37,8 @@ let
         package = pkgs.stable.calibre-web;
         dataDir = "${cfgWeb.configDir}/calibre-web";
         listen = {
+          inherit (cfgWeb) port;
           ip = "0.0.0.0";
-          port = cfgWeb.port;
         };
         options = {
           enableBookUploading = true;

modules/nixos/services/cockpit/default.nix

@@ -15,9 +15,8 @@ let
     description = "Cockpit web-based server management UI";
     moduleConfig = {
       services.cockpit = {
+        inherit (cfg) port openFirewall;
         enable = true;
-        port = cfg.port;
-        openFirewall = cfg.openFirewall;
         allowed-origins = [
           "https://${net.hosts.nas.lan}:${toString cfg.port}"
           "https://${net.hosts.nas.hostname}:${toString cfg.port}"

modules/nixos/services/code-server/default.nix

@@ -16,22 +16,21 @@ let
     moduleConfig = {
       # Configure the standard NixOS code-server service
       services.code-server = {
+        inherit (cfg) port extraEnvironment;
         enable = true;
-        port = cfg.port;
         user = "admin";
         group = "jallen-nas";
         host = cfg.listenAddress;
         auth = "none"; # "password"
         disableTelemetry = true;
         disableUpdateCheck = true;
-        extraEnvironment = cfg.extraEnvironment;
         extraGroups = [
           "admin"
           "wheel"
         ];
       }
       // optionalAttrs (cfg.hashedPassword != null) {
-        hashedPassword = cfg.hashedPassword;
+        inherit (cfg) hashedPassword;
       };
     };
   };

modules/nixos/services/collabora/default.nix

@@ -17,7 +17,7 @@ let
     moduleConfig = {
       services.collabora-online = {
         enable = true;
-        port = cfg.port;
+        inherit (cfg) port;
         settings = {
           # Rely on reverse proxy for SSL
           ssl = {

modules/nixos/services/crowdsec/default.nix

@@ -39,7 +39,7 @@ let
       services = {
         crowdsec = {
           enable = true;
-          openFirewall = cfg.openFirewall;
+          inherit (cfg) openFirewall;
           hub = {
             appSecConfigs = [
               "crowdsecurity/appsec-default"

modules/nixos/services/gitea/default.nix

@@ -22,8 +22,8 @@ let
         stateDir = "${cfg.configDir}/gitea";
         user = "nix-apps";
         group = "jallen-nas";
-        mailerPasswordFile = mailerPasswordFile;
-        metricsTokenFile = metricsTokenFile;
+        inherit mailerPasswordFile;
+        inherit metricsTokenFile;
         settings = {
           server = {
             DOMAIN = "jallen-nas";

modules/nixos/services/glance/default.nix

@@ -12,9 +12,9 @@ let
   hostedServiceSites =
     let
       servicesCfg = config.${namespace}.services;
-      serviceNames = builtins.attrNames servicesCfg;
+      serviceNames = attrNames servicesCfg;
     in
-    builtins.concatMap (
+    concatMap (
       serviceName:
       let
         serviceCfg = servicesCfg.${serviceName};
@@ -24,9 +24,7 @@ let
         [
           (
             {
-              title = hosted.title;
-              url = hosted.url;
-              icon = hosted.icon;
+              inherit (hosted) title url icon;
             }
             // optionalAttrs hosted.basicAuth {
               basic-auth = {
@@ -40,9 +38,9 @@ let
         [ ]
     ) serviceNames;
 
-  hostedServicesByGroup = builtins.groupBy (svc: svc.hostedService.group) (
-    builtins.filter (svc: svc.hostedService != null && svc.hostedService.enable) (
-      builtins.map (
+  hostedServicesByGroup = groupBy (svc: svc.hostedService.group) (
+    filter (svc: svc.hostedService != null && svc.hostedService.enable) (
+      map (
         serviceName:
         let
           serviceCfg = config.${namespace}.services.${serviceName};
@@ -50,7 +48,7 @@ let
         {
           hostedService = serviceCfg.hostedService or null;
         }
-      ) (builtins.attrNames config.${namespace}.services)
+      ) (attrNames config.${namespace}.services)
     )
   );
 
@@ -332,7 +330,7 @@ let
         settings = {
           server = {
             host = "0.0.0.0";
-            port = cfg.port;
+            inherit (cfg) port;
           };
           pages = [
             {
@@ -371,31 +369,27 @@ let
                     }
                   ]
                   ++ lib.optionals cfg.hostedServiceGroups (
-                    builtins.map (
+                    map (
                       groupName:
                       makeMonitorWidget groupName (
-                        builtins.map (svc: {
-                          title = svc.hostedService.title;
-                          url = svc.hostedService.url;
-                          icon = svc.hostedService.icon;
+                        map (svc: {
+                          inherit (svc.hostedService) title url icon;
                         }) (hostedServicesByGroup.${groupName} or [ ])
                       )
-                    ) (builtins.attrNames hostedServicesByGroup)
+                    ) (attrNames hostedServicesByGroup)
                   )
                   ++ lib.optionals (!cfg.hostedServiceGroups && cfg.enableHostedServices) [
                     (makeMonitorWidget "Services" hostedServiceSites)
                   ]
                   ++ lib.optionals (cfg.extraSites != [ ]) (
-                    builtins.map (site: {
+                    map (site: {
                       type = "monitor";
                       cache = "1m";
-                      title = site.title;
+                      inherit (site) title;
                       sites = [
                         (
                           {
-                            title = site.title;
-                            url = site.url;
-                            icon = site.icon;
+                            inherit (site) title url icon;
                           }
                           // optionalAttrs site.allow-insecure { allow-insecure = true; }
                         )
@@ -407,7 +401,7 @@ let
                     groups = cfg.bookmarks;
                   }
                   ++ lib.optionals (cfg.reddit != [ ]) (
-                    builtins.map (subreddit: {
+                    map (subreddit: {
                       type = "reddit";
                       inherit subreddit;
                     }) cfg.reddit

modules/nixos/services/headscale/default.nix

@@ -17,7 +17,7 @@ let
       services.headscale = {
         enable = true;
         address = cfg.listenAddress;
-        port = cfg.port;
+        inherit (cfg) port;
         settings = {
           server_url = "https://headscale.mjallen.dev:443";
           database.sqlite.path = "${cfg.configDir}/headscale/db.sqlite";

modules/nixos/services/immich/default.nix

@@ -19,9 +19,8 @@ let
     moduleConfig = {
       # Enable immich service
       services.immich = {
+        inherit (cfg) port openFirewall;
         enable = true;
-        port = cfg.port;
-        openFirewall = true;
         secretsFile = dbPassword;
         mediaLocation = "${cfg.dataDir}/photos";
 

modules/nixos/services/jellyfin/default.nix

@@ -16,7 +16,7 @@ let
     moduleConfig = {
       services.jellyfin = {
         enable = true;
-        openFirewall = cfg.openFirewall;
+        inherit (cfg) openFirewall;
         user = "nix-apps";
         group = "jallen-nas";
         dataDir = "${cfg.configDir}/jellyfin";

modules/nixos/services/jellyseerr/default.nix

@@ -16,9 +16,8 @@ let
     moduleConfig = {
       # Enable seerr service
       services.seerr = {
+        inherit (cfg) port openFirewall;
         enable = true;
-        port = cfg.port;
-        openFirewall = cfg.openFirewall;
         configDir = "${cfg.configDir}/jellyseerr";
       };
 

modules/nixos/services/kavita/default.nix

@@ -18,7 +18,7 @@ let
           "jallen-nas/kavita/token" = {
             sopsFile = lib.snowfall.fs.get-file "secrets/nas-secrets.yaml";
             owner = config.users.users.kavita.name;
-            group = config.users.users.kavita.group;
+            inherit (config.users.users.kavita) group;
             restartUnits = [ "kavita.service" ];
           };
         };
@@ -28,7 +28,7 @@ let
         dataDir = "${cfg.configDir}/kavita";
         tokenKeyFile = config.sops.secrets."jallen-nas/kavita/token".path;
         settings = {
-          Port = cfg.port;
+          inherit (cfg) port;
         };
       };
     };

modules/nixos/services/minecraft/default.nix

@@ -14,10 +14,10 @@ let
     options = { };
     moduleConfig = {
       services.minecraft-server = {
+        inherit (cfg) openFirewall;
         enable = true;
         eula = true;
         declarative = true;
-        openFirewall = cfg.openFirewall;
         dataDir = "${cfg.configDir}/minecraft"; # todo
         serverProperties = {
           enforce-whitelist = true;

modules/nixos/services/nebula/default.nix

@@ -115,20 +115,21 @@ let
       '';
 
       services.nebula.networks.${cfg.networkName} = {
+        inherit (cfg)
+          isLighthouse
+          isRelay
+          lighthouses
+          staticHostMap
+          ;
         enable = true;
         enableReload = true;
-        isLighthouse = cfg.isLighthouse;
-        isRelay = cfg.isRelay;
         inherit ca cert key;
 
-        lighthouses = cfg.lighthouses;
-        staticHostMap = cfg.staticHostMap;
-
         tun.device = if cfg.tunDevice != null then cfg.tunDevice else "nebula0";
 
         listen = {
           host = cfg.listenAddress;
-          port = cfg.port;
+          inherit (cfg) port;
         };
 
         settings.firewall = {

modules/nixos/services/nextcloud/default.nix

@@ -115,8 +115,8 @@ let
           virtualHosts.${config.services.nextcloud.hostName} = {
             listen = [
               {
+                inherit (cfg) port;
                 addr = "0.0.0.0";
-                port = cfg.port;
                 ssl = false;
               }
             ];

modules/nixos/services/onlyoffice/default.nix

@@ -17,7 +17,7 @@ let
     moduleConfig = {
       services.onlyoffice = {
         enable = true;
-        port = cfg.port;
+        inherit (cfg) port;
         wopi = true;
         hostname = "office.mjallen.dev";
         jwtSecretFile = jwtSecretFile;

modules/nixos/services/opencloud/default.nix

@@ -21,7 +21,7 @@ let
         enable = true;
         url = "https://cloud.mjallen.dev";
         address = cfg.listenAddress;
-        port = cfg.port;
+        inherit (cfg) port;
         stateDir = "${cfg.configDir}/opencloud";
         environment = {
           PROXY_TLS = "false"; # disable https when behind reverse-proxy

modules/nixos/services/owncloud/default.nix

@@ -61,8 +61,7 @@ in
 
   config = mkIf cfg.enable {
     virtualisation.oci-containers.containers."${cfg.name}" = {
-      autoStart = cfg.autoStart;
-      image = cfg.image;
+      inherit (cfg) autoStart image;
       ports = [ "${cfg.httpPort}:9200" ];
       volumes = [
         "${cfg.configPath}:/etc/ocis"

modules/nixos/services/paperless/default.nix

@@ -18,9 +18,9 @@ let
     moduleConfig = {
       # Enable paperless service
       services.paperless = {
+        inherit (cfg) port;
         enable = true;
         package = pkgs.paperless-ngx;
-        port = cfg.port;
         # user = "nix-apps";
         address = cfg.listenAddress;
         dataDir = "${cfg.configDir}/paperless";

modules/nixos/services/restic/default.nix

@@ -202,14 +202,16 @@ in
     services.restic.backups = mapAttrs (
       _name: jobCfg:
       {
-        initialize = jobCfg.initialize;
-        createWrapper = jobCfg.createWrapper;
-        inhibitsSleep = jobCfg.inhibitsSleep;
-        paths = jobCfg.paths;
+        inherit (jobCfg)
+          initialize
+          createWrapper
+          inhibitsSleep
+          paths
+          timerConfig
+          pruneOpts
+          extraBackupArgs
+          ;
         exclude = jobCfg.exclude ++ cfg.defaultExcludes;
-        timerConfig = jobCfg.timerConfig;
-        pruneOpts = jobCfg.pruneOpts;
-        extraBackupArgs = jobCfg.extraBackupArgs;
       }
       // optionalAttrs (jobCfg.passwordFile != null) { inherit (jobCfg) passwordFile; }
       // optionalAttrs (jobCfg.repository != null) { inherit (jobCfg) repository; }

modules/nixos/services/sunshine/default.nix

@@ -17,7 +17,7 @@ let
     moduleConfig = {
       services.sunshine = {
         enable = true;
-        openFirewall = cfg.openFirewall;
+        inherit (cfg) openFirewall;
         autoStart = true;
         capSysAdmin = true;
         applications.apps = with pkgs; [

modules/nixos/user/default.nix

@@ -88,7 +88,7 @@ in
 
   config = {
     users = {
-      mutableUsers = cfg.mutableUsers;
+      inherit (cfg) mutableUsers;
       groups.${cfg.group}.gid = lib.mkForce (if cfg.group != "wheel" then cfg.gid else 1);
       users = {
         root = {
@@ -99,6 +99,7 @@ in
         ${cfg.name} = {
           inherit (cfg)
             name
+            group
             uid
             linger
             packages
@@ -133,7 +134,6 @@ in
           ]
           ++ cfg.extraGroups;
 
-          group = cfg.group;
           home = "/home/${cfg.name}";
           isNormalUser = true;
           shell = lib.mkForce pkgs.zsh;