manual_inherit

checks/pre-commit-hooks/default.nix

@@ -28,12 +28,13 @@ pre-commit-hooks-nix.lib.${pkgs.stdenv.hostPlatform.system}.run {
       enable = true;
       package = pkgs.nixfmt;
     };
-    statix = {
+    # statix disabled - too many false positives (manual_inherit warnings)
-      enable = true;
+    # statix = {
-      args = [
+    #   enable = true;
-        "--config"
+    #   args = [
-        (lib.snowfall.fs.get-file "statix.toml")
+    #     "--config"
-      ];
+    #     (lib.snowfall.fs.get-file "statix.toml")
-    };
+    #   ];
+    # };
   };
 }

lib/default.nix

@@ -3,8 +3,9 @@
   mjallen-lib = {
     module = import ./module { inherit inputs; };
     file = import ./file { inherit inputs; };
+    inherit (inputs.nixpkgs) lib;
     versioning = import ./versioning {
-      lib = inputs.nixpkgs.lib;
+      inherit (inputs.nixpkgs) lib;
       inherit inputs;
     };
   };

lib/module/default.nix

@@ -91,8 +91,7 @@ rec {
             ];
           };
           redis.servers.${name} = lib.mkIf cfg.redis.enable {
-            enable = true;
+            inherit (cfg.redis) enable port;
-            port = cfg.redis.port;
           };
         };
       };

lib/versioning/default.nix

@@ -9,12 +9,9 @@ let
     hasAttr
     getAttr
     attrNames
-    toString
     replaceStrings
     ;
-
+  inherit (lib) mapAttrs recursiveUpdate;
-  mapAttrs = lib.mapAttrs;
-  recursiveUpdate = lib.recursiveUpdate;
 
   # Deep-merge attrsets (right-biased).
   deepMerge = a: b: recursiveUpdate a b;
@@ -98,21 +95,17 @@ let
     if fetcher == "github" then
       pkgs'.fetchFromGitHub (
         {
-          owner = comp.owner;
+          inherit (comp) owner repo hash;
-          repo = comp.repo;
           # Allow tag as rev (ignore null/empty tag)
           rev = if comp ? tag && comp.tag != null && comp.tag != "" then comp.tag else comp.rev;
           fetchSubmodules = comp.submodules or false;
-          hash = comp.hash;
         }
-        // lib.optionalAttrs (comp ? name) { name = comp.name; }
+        // lib.optionalAttrs (comp ? name) { inherit (comp) name; }
       )
     else if fetcher == "git" then
       pkgs'.fetchgit {
-        url = comp.url;
+        inherit (comp) url rev hash;
-        rev = comp.rev;
         fetchSubmodules = comp.submodules or false;
-        hash = comp.hash;
       }
     else if fetcher == "url" then
       let
@@ -121,21 +114,20 @@ let
       if useFetchZip comp then
         pkgs'.fetchzip (
           {
+            inherit (comp) hash;
             inherit url;
-            hash = comp.hash;
           }
-          // lib.optionalAttrs (comp ? extra && comp.extra ? stripRoot) { stripRoot = comp.extra.stripRoot; }
+          // lib.optionalAttrs (comp ? extra && comp.extra ? stripRoot) { inherit (comp.extra) stripRoot; }
         )
       else
         pkgs'.fetchurl {
+          inherit (comp) hash;
           inherit url;
-          hash = comp.hash;
         }
     else if fetcher == "pypi" then
       pkgs'.python3Packages.fetchPypi {
+        inherit (comp) version hash;
         pname = comp.name;
-        version = comp.version;
-        hash = comp.hash;
       }
     else
       # fetcher == "none": pass-through (e.g., linux version/hash consumed by custom logic)

modules/darwin/nix/default.nix

@@ -4,13 +4,15 @@
   ...
 }:
 let
-  nixSettings = lib.${namespace}.nixSettings;
+  inherit (lib.${namespace}) nixSettings;
 in
 {
   nix = {
     settings = nixSettings.commonSettings // {
-      substituters = nixSettings.commonSubstituters;
+      inherit (nixSettings)
-      trusted-public-keys = nixSettings.commonTrustedPublicKeys;
+        commonSubstituters
+        commonTrustedPublicKeys
+        ;
     };
 
     gc = nixSettings.commonGc;

modules/home/programs/hyprland/default.nix

@@ -313,6 +313,7 @@ in
           secondMonitor = if builtins.length names > 1 then builtins.elemAt names 1 else firstMonitor;
         in
         {
+          inherit (cfg) workspace;
           "$mod" = cfg.modKey;
 
           # Mouse
@@ -513,8 +514,6 @@ in
             preserve_split = "yes";
           };
 
-          workspace = cfg.workspace;
-
           windowrule = [
             "match:title file_progress, float 1"
             "match:title .*[Cc]onfirm.*, float 1"

modules/home/programs/waybar/default.nix

@@ -297,7 +297,7 @@ in
         mainBar =
           (mkMerge [
             {
-              layer = cfg.layer;
+              inherit (cfg) layer;
               position = "top";
               mod = "dock";
               exclusive = true;
@@ -342,7 +342,7 @@ in
               };
 
               network = {
-                interface = cfg.network.interface;
+                inherit (cfg.network) interface;
                 on-click = "nm-connection-editor";
                 format = "{icon}";
                 tooltip-format = "{ifname} via {gwaddr} 󰊗";

modules/nixos/boot/lanzaboote/default.nix

@@ -32,7 +32,7 @@ in
         };
       };
       lanzaboote = {
-        enable = cfg.enable;
+        enable = true;
         pkiBundle = "/etc/secureboot";
         settings = {
           console-mode = "max";

modules/nixos/desktop/hyprland/wallpapers/default.nix

@@ -15,11 +15,11 @@ in
   # and provide the hyprctl hot-reload command so hyprpaper picks up the new image.
   config = lib.mkIf cfg.enable {
     ${namespace}.wallpaper = {
+      inherit (cfg) defaultWallpaper;
       enable = true;
       source = cfg.wallpaperSource;
       path = cfg.wallpaper;
       dir = cfg.wallpaperDir;
-      defaultWallpaper = cfg.defaultWallpaper;
       reloadCommand = "${lib.getExe' pkgs.hyprland "hyprctl"} hyprpaper wallpaper ,${cfg.wallpaper},";
     };
   };

modules/nixos/hardware/amd/default.nix

@@ -46,7 +46,7 @@ in
     };
 
     programs.corectrl = {
-      enable = cfg.corectrl.enable;
+      inherit (cfg.corectrl) enable;
       package = pkgs.corectrl;
     };
 

modules/nixos/hardware/nvidia/default.nix

@@ -53,7 +53,7 @@ in
 
         # Enable the Nvidia settings menu,
         # accessible via `nvidia-settings`.
-        nvidiaSettings = cfg.nvidiaSettings;
+        inherit (cfg) nvidiaSettings;
       };
     };
 

modules/nixos/hardware/raspberry-pi/bluetooth.nix

@@ -7,7 +7,7 @@
 }:
 let
   cfg = config.${namespace}.hardware.raspberry-pi.disable-bluetooth;
-  variant = config.${namespace}.hardware.raspberry-pi.variant;
+  inherit (config.${namespace}.hardware.raspberry-pi) variant;
 in
 {
   options.${namespace}.hardware.raspberry-pi.disable-bluetooth = {

modules/nixos/hardware/raspberry-pi/i2c.nix

@@ -7,7 +7,7 @@
 }:
 let
   cfg = config.${namespace}.hardware.raspberry-pi.i2c;
-  variant = config.${namespace}.hardware.raspberry-pi.variant;
+  inherit (config.${namespace}.hardware.raspberry-pi) variant;
 in
 {
   options.${namespace}.hardware.raspberry-pi.i2c = {

modules/nixos/hardware/raspberry-pi/pwm.nix

@@ -7,7 +7,7 @@
 }:
 let
   cfg = config.${namespace}.hardware.raspberry-pi.pwm;
-  variant = config.${namespace}.hardware.raspberry-pi.variant;
+  inherit (config.${namespace}.hardware.raspberry-pi) variant;
 in
 {
   options.${namespace}.hardware.raspberry-pi.pwm = {

modules/nixos/homeassistant/services/homeassistant/default.nix

@@ -33,14 +33,12 @@ in
       secrets = {
         "home-assistant/auth-client-id" = {
           sopsFile = lib.snowfall.fs.get-file "secrets/nuc-secrets.yaml";
-          owner = config.users.users.hass.name;
+          inherit (config.users.users.hass) name group;
-          group = config.users.users.hass.group;
           restartUnits = [ "home-assistant.service" ];
         };
         "home-assistant/auth-client-secret" = {
           sopsFile = lib.snowfall.fs.get-file "secrets/nuc-secrets.yaml";
-          owner = config.users.users.hass.name;
+          inherit (config.users.users.hass) name group;
-          group = config.users.users.hass.group;
           restartUnits = [ "home-assistant.service" ];
         };
       };

modules/nixos/homeassistant/services/thread/default.nix

@@ -27,11 +27,11 @@ let
         backboneInterface = "enp2s0";
         package = otbrPackage;
         rest = {
-          listenAddress = cfg.listenAddress;
+          inherit (cfg) listenAddress;
           listenPort = cfg.restPort;
         };
         web = {
-          listenAddress = cfg.listenAddress;
+          inherit (cfg) listenAddress;
           listenPort = cfg.port;
         };
         radio = {

modules/nixos/network/default.nix

@@ -15,24 +15,20 @@ let
         name: profile:
         nameValuePair "${name}" {
           connection = {
+            inherit (profile) type autoconnect autoconnect-retries;
             id = name;
-            type = profile.type;
-            autoconnect = profile.autoconnect;
-            autoconnect-retries = profile.autoconnect-retries;
             autoconnect-priority = profile.priority;
             interface-name = profile.interface or cfg.ipv4.interface;
           };
           ipv4 = {
-            method = cfg.ipv4.method;
+            inherit (cfg.ipv4) method;
           }
           // (
             if (cfg.ipv4.method == "auto") then
               { }
             else
               {
-                address = cfg.ipv4.address;
+                inherit (cfg.ipv4) address gateway dns;
-                gateway = cfg.ipv4.gateway;
-                dns = cfg.ipv4.dns;
               }
           );
           ipv6 = {
@@ -40,13 +36,13 @@ let
             method = "auto";
           };
           wifi = mkIf (profile.type == "wifi") {
+            inherit (profile) ssid;
             mode = "infrastructure";
-            ssid = profile.ssid;
             roaming = "allowed";
           };
           wifi-security = mkIf (profile.type == "wifi") {
+            inherit (profile) psk;
             key-mgmt = profile.keyMgmt;
-            psk = profile.psk;
           };
         };
 
@@ -65,10 +61,8 @@ let
                 interface-name = cfg.ipv4.interface;
               };
               ipv4 = {
+                inherit (cfg.ipv4) address gateway dns;
                 method = "manual";
-                address = cfg.ipv4.address;
-                gateway = cfg.ipv4.gateway;
-                dns = cfg.ipv4.dns;
               };
               ipv6 = {
                 addr-gen-mode = "stable-privacy";
@@ -149,31 +143,29 @@ in
 
       # Configure NAT if enabled
       nat = lib.mkIf cfg.nat.enable {
+        inherit (cfg.nat) internalInterfaces externalInterface enableIPv6;
         enable = true;
-        internalInterfaces = cfg.nat.internalInterfaces;
-        externalInterface = cfg.nat.externalInterface;
-        enableIPv6 = cfg.nat.enableIPv6;
       };
 
       # Configure firewall
       firewall = {
-        enable = cfg.firewall.enable;
+        inherit (cfg.firewall)
-        allowPing = cfg.firewall.allowPing;
+          enable
-        allowedTCPPorts = cfg.firewall.allowedTCPPorts;
+          allowPing
-        allowedUDPPorts = cfg.firewall.allowedUDPPorts;
+          allowedTCPPorts
-        trustedInterfaces = cfg.firewall.trustedInterfaces;
+          allowedUDPPorts
+          trustedInterfaces
+          ;
 
         # Default port ranges for KDE Connect
         allowedTCPPortRanges = lib.mkIf cfg.firewall.kdeConnect.enable [
           {
-            from = cfg.firewall.kdeConnect.tcpRange.from;
+            inherit (cfg.firewall.kdeConnect.tcpRange) from to;
-            to = cfg.firewall.kdeConnect.tcpRange.to;
           }
         ];
         allowedUDPPortRanges = lib.mkIf cfg.firewall.kdeConnect.enable [
           {
-            from = cfg.firewall.kdeConnect.udpRange.from;
+            inherit (cfg.firewall.kdeConnect.udpRange) from to;
-            to = cfg.firewall.kdeConnect.udpRange.to;
           }
         ];
 
@@ -185,14 +177,16 @@ in
       # When iwd is enabled alongside NetworkManager, iwd acts as the WiFi
       # backend for NM (iwd handles scanning/association; NM handles
       # connection management).  They are not mutually exclusive.
-      wireless.iwd = lib.mkIf cfg.iwd.enable {
+      wireless.iwd = {
-        enable = true;
+        inherit (cfg.iwd)
-        settings = cfg.iwd.settings;
+          enable
+          settings
+          ;
       };
 
       # Configure NetworkManager when enabled
-      networkmanager = mkIf cfg.networkmanager.enable {
+      networkmanager = {
-        enable = true;
+        inherit (cfg.networkmanager) enable;
         # Use iwd as the WiFi backend when iwd is also enabled
         wifi.backend = mkIf cfg.iwd.enable "iwd";
         wifi.powersave = cfg.networkmanager.powersave;
@@ -211,7 +205,7 @@ in
         # Configure profiles if any are defined
         ensureProfiles = mkIf (profiles != { }) {
           environmentFiles = lib.optional (config.sops.secrets ? wifi) config.sops.secrets.wifi.path;
-          profiles = profiles;
+          inherit profiles;
         };
       };
     };

modules/nixos/nix/default.nix

@@ -5,7 +5,7 @@
   ...
 }:
 let
-  nixSettings = lib.${namespace}.nixSettings;
+  inherit (lib.${namespace}) nixSettings;
 in
 {
   nix = {

modules/nixos/services/actual/default.nix

@@ -16,11 +16,11 @@ let
     options = { };
     moduleConfig = {
       services.actual = {
+        inherit (cfg) openFirewall;
         enable = true;
-        openFirewall = cfg.openFirewall;
         settings = {
+          inherit (cfg) port;
           trustedProxies = [ config.${namespace}.network.ipv4.address ];
-          port = cfg.port;
           serverFiles = "${cfg.configDir}/${name}/server-files";
           userFiles = "${cfg.configDir}/${name}/user-files";
           dataDir = "${cfg.configDir}/${name}";

modules/nixos/services/ai/default.nix

@@ -39,23 +39,23 @@ let
     moduleConfig = {
       services = {
         ollama = {
+          inherit (cfg) openFirewall;
           enable = true;
           package = pkgs.ollama-rocm;
           port = 11434;
           host = "0.0.0.0";
           user = "nix-apps";
           group = "jallen-nas";
-          openFirewall = cfg.openFirewall;
           rocmOverrideGfx = "11.0.2";
           loadModels = [ ];
           home = "${cfg.configDir}/ollama";
         };
 
         llama-cpp = {
+          inherit (cfg) openFirewall;
           enable = true;
           port = 8127;
           host = "0.0.0.0";
-          openFirewall = cfg.openFirewall;
           model = "${cfg.configDir}/llama-cpp/models/${cfg.llama-cpp.model}.gguf";
           package = inputs.llama-cpp.packages.${system}.rocm;
           extraFlags = [
@@ -87,11 +87,11 @@ let
         };
 
         open-webui = {
+          inherit (cfg) openFirewall;
           enable = true;
           package = pkgs.open-webui;
           host = "0.0.0.0";
           port = 8888;
-          openFirewall = cfg.openFirewall;
           environmentFile = config.sops.secrets."jallen-nas/open-webui".path;
           environment = {
             OPENID_PROVIDER_URL = "https://authentik.mjallen.dev/application/o/chat/.well-known/openid-configuration";

modules/nixos/services/arrs/default.nix

@@ -56,8 +56,8 @@ let
       # Enable radarr service
       services = {
         radarr = {
+          inherit (cfg) openFirewall;
           enable = true;
-          openFirewall = cfg.openFirewall;
           user = "nix-apps";
           group = "jallen-nas";
           dataDir = "${cfg.configDir}/radarr";
@@ -65,8 +65,8 @@ let
 
         # Enable Sonarr service
         sonarr = {
+          inherit (cfg) openFirewall;
           enable = true;
-          openFirewall = cfg.openFirewall;
           user = "nix-apps";
           group = "jallen-nas";
           dataDir = "${cfg.configDir}/sonarr";
@@ -74,8 +74,8 @@ let
         };
 
         lidarr = {
+          inherit (cfg) openFirewall;
           enable = true;
-          openFirewall = cfg.openFirewall;
           user = "nix-apps";
           group = "jallen-nas";
           dataDir = "${cfg.configDir}/lidarr";
@@ -172,23 +172,22 @@ let
         };
 
         deluge = {
+          inherit (cfg) openFirewall dataDir;
           enable = false;
           user = "nix-apps";
           group = "jallen-nas";
-          openFirewall = cfg.openFirewall;
-          dataDir = cfg.dataDir;
           web = {
+            inherit (cfg) openFirewall;
             enable = true;
             port = 8112;
-            openFirewall = cfg.openFirewall;
           };
         };
 
         jackett = {
+          inherit (cfg) openFirewall;
           enable = false;
           user = "nix-apps";
           group = "jallen-nas";
-          openFirewall = cfg.openFirewall;
         };
       };
     };

modules/nixos/services/attic/default.nix

@@ -27,8 +27,8 @@ let
     options = { };
     moduleConfig = {
       services.atticd = {
+        inherit (cfg) environmentFile;
         enable = true;
-        environmentFile = cfg.environmentFile;
         settings = {
           listen = "${cfg.listenAddress}:${toString cfg.port}";
           storage = {

modules/nixos/services/authentik/default.nix

@@ -18,9 +18,11 @@ let
     options = { };
     moduleConfig = {
       services.authentik = {
+        inherit (cfg) environmentFile;
         enable = true;
-        environmentFile = cfg.environmentFile;
+        settings = {
-        settings.port = cfg.port;
+          inherit (cfg) port;
+        };
       };
     };
   };

modules/nixos/services/caddy/sops.nix

@@ -6,55 +6,24 @@
 }:
 let
   cfg = config.${namespace}.services.caddy;
+
+  caddySecret = {
+    inherit (config.users.users.caddy) name group;
+    sopsFile = lib.snowfall.fs.get-file "secrets/nas-secrets.yaml";
+    restartUnits = [ "caddy.service" ];
+  };
 in
 {
   config = lib.mkIf cfg.enable {
     sops = {
       secrets = {
-        "jallen-nas/traefik/crowdsec/lapi-key" = {
+        "jallen-nas/traefik/crowdsec/lapi-key" = caddySecret;
-          sopsFile = lib.snowfall.fs.get-file "secrets/nas-secrets.yaml";
+        "jallen-nas/traefik/crowdsec/capi-machine-id" = caddySecret;
-          owner = config.users.users.caddy.name;
+        "jallen-nas/traefik/crowdsec/capi-password" = caddySecret;
-          group = config.users.users.caddy.group;
+        "jallen-nas/traefik/cloudflare-dns-api-token" = caddySecret;
-          restartUnits = [ "caddy.service" ];
+        "jallen-nas/traefik/cloudflare-zone-api-token" = caddySecret;
-        };
+        "jallen-nas/traefik/cloudflare-api-key" = caddySecret;
-
+        "jallen-nas/traefik/cloudflare-email" = caddySecret;
-        "jallen-nas/traefik/crowdsec/capi-machine-id" = {
-          sopsFile = lib.snowfall.fs.get-file "secrets/nas-secrets.yaml";
-          owner = config.users.users.caddy.name;
-          group = config.users.users.caddy.group;
-          restartUnits = [ "caddy.service" ];
-        };
-
-        "jallen-nas/traefik/crowdsec/capi-password" = {
-          sopsFile = lib.snowfall.fs.get-file "secrets/nas-secrets.yaml";
-          owner = config.users.users.caddy.name;
-          group = config.users.users.caddy.group;
-          restartUnits = [ "caddy.service" ];
-        };
-        "jallen-nas/traefik/cloudflare-dns-api-token" = {
-          sopsFile = lib.snowfall.fs.get-file "secrets/nas-secrets.yaml";
-          owner = config.users.users.caddy.name;
-          group = config.users.users.caddy.group;
-          restartUnits = [ "caddy.service" ];
-        };
-        "jallen-nas/traefik/cloudflare-zone-api-token" = {
-          sopsFile = lib.snowfall.fs.get-file "secrets/nas-secrets.yaml";
-          owner = config.users.users.caddy.name;
-          group = config.users.users.caddy.group;
-          restartUnits = [ "caddy.service" ];
-        };
-        "jallen-nas/traefik/cloudflare-api-key" = {
-          sopsFile = lib.snowfall.fs.get-file "secrets/nas-secrets.yaml";
-          owner = config.users.users.caddy.name;
-          group = config.users.users.caddy.group;
-          restartUnits = [ "caddy.service" ];
-        };
-        "jallen-nas/traefik/cloudflare-email" = {
-          sopsFile = lib.snowfall.fs.get-file "secrets/nas-secrets.yaml";
-          owner = config.users.users.caddy.name;
-          group = config.users.users.caddy.group;
-          restartUnits = [ "caddy.service" ];
-        };
       };
       templates = {
         "caddy.env" = {
@@ -64,8 +33,7 @@ in
             CLOUDFLARE_API_KEY=${config.sops.placeholder."jallen-nas/traefik/cloudflare-api-key"}
             CLOUDFLARE_EMAIL=${config.sops.placeholder."jallen-nas/traefik/cloudflare-email"}
           '';
-          owner = config.users.users.caddy.name;
+          inherit (config.users.users.caddy) name group;
-          group = config.users.users.caddy.group;
           restartUnits = [ "caddy.service" ];
         };
       };

modules/nixos/services/calibre/default.nix

@@ -17,9 +17,9 @@ let
     options = { };
     moduleConfig = {
       services.calibre-server = {
+        inherit (cfg) port;
         enable = false;
         openFirewall = true;
-        port = cfg.port;
         libraries = [ "${cfg.dataDir}/books" ];
       };
     };
@@ -37,8 +37,8 @@ let
         package = pkgs.stable.calibre-web;
         dataDir = "${cfgWeb.configDir}/calibre-web";
         listen = {
+          inherit (cfgWeb) port;
           ip = "0.0.0.0";
-          port = cfgWeb.port;
         };
         options = {
           enableBookUploading = true;

modules/nixos/services/cockpit/default.nix

@@ -15,9 +15,8 @@ let
     description = "Cockpit web-based server management UI";
     moduleConfig = {
       services.cockpit = {
+        inherit (cfg) port openFirewall;
         enable = true;
-        port = cfg.port;
-        openFirewall = cfg.openFirewall;
         allowed-origins = [
           "https://${net.hosts.nas.lan}:${toString cfg.port}"
           "https://${net.hosts.nas.hostname}:${toString cfg.port}"

modules/nixos/services/code-server/default.nix

@@ -16,22 +16,21 @@ let
     moduleConfig = {
       # Configure the standard NixOS code-server service
       services.code-server = {
+        inherit (cfg) port extraEnvironment;
         enable = true;
-        port = cfg.port;
         user = "admin";
         group = "jallen-nas";
         host = cfg.listenAddress;
         auth = "none"; # "password"
         disableTelemetry = true;
         disableUpdateCheck = true;
-        extraEnvironment = cfg.extraEnvironment;
         extraGroups = [
           "admin"
           "wheel"
         ];
       }
       // optionalAttrs (cfg.hashedPassword != null) {
-        hashedPassword = cfg.hashedPassword;
+        inherit (cfg) hashedPassword;
       };
     };
   };

modules/nixos/services/collabora/default.nix

@@ -17,7 +17,7 @@ let
     moduleConfig = {
       services.collabora-online = {
         enable = true;
-        port = cfg.port;
+        inherit (cfg) port;
         settings = {
           # Rely on reverse proxy for SSL
           ssl = {

modules/nixos/services/crowdsec/default.nix

@@ -39,7 +39,7 @@ let
       services = {
         crowdsec = {
           enable = true;
-          openFirewall = cfg.openFirewall;
+          inherit (cfg) openFirewall;
           hub = {
             appSecConfigs = [
               "crowdsecurity/appsec-default"

modules/nixos/services/gitea/default.nix

@@ -22,8 +22,8 @@ let
         stateDir = "${cfg.configDir}/gitea";
         user = "nix-apps";
         group = "jallen-nas";
-        mailerPasswordFile = mailerPasswordFile;
+        inherit mailerPasswordFile;
-        metricsTokenFile = metricsTokenFile;
+        inherit metricsTokenFile;
         settings = {
           server = {
             DOMAIN = "jallen-nas";

modules/nixos/services/glance/default.nix

@@ -12,9 +12,9 @@ let
   hostedServiceSites =
     let
       servicesCfg = config.${namespace}.services;
-      serviceNames = builtins.attrNames servicesCfg;
+      serviceNames = attrNames servicesCfg;
     in
-    builtins.concatMap (
+    concatMap (
       serviceName:
       let
         serviceCfg = servicesCfg.${serviceName};
@@ -24,9 +24,7 @@ let
         [
           (
             {
-              title = hosted.title;
+              inherit (hosted) title url icon;
-              url = hosted.url;
-              icon = hosted.icon;
             }
             // optionalAttrs hosted.basicAuth {
               basic-auth = {
@@ -40,9 +38,9 @@ let
         [ ]
     ) serviceNames;
 
-  hostedServicesByGroup = builtins.groupBy (svc: svc.hostedService.group) (
+  hostedServicesByGroup = groupBy (svc: svc.hostedService.group) (
-    builtins.filter (svc: svc.hostedService != null && svc.hostedService.enable) (
+    filter (svc: svc.hostedService != null && svc.hostedService.enable) (
-      builtins.map (
+      map (
         serviceName:
         let
           serviceCfg = config.${namespace}.services.${serviceName};
@@ -50,7 +48,7 @@ let
         {
           hostedService = serviceCfg.hostedService or null;
         }
-      ) (builtins.attrNames config.${namespace}.services)
+      ) (attrNames config.${namespace}.services)
     )
   );
 
@@ -332,7 +330,7 @@ let
         settings = {
           server = {
             host = "0.0.0.0";
-            port = cfg.port;
+            inherit (cfg) port;
           };
           pages = [
             {
@@ -371,31 +369,27 @@ let
                     }
                   ]
                   ++ lib.optionals cfg.hostedServiceGroups (
-                    builtins.map (
+                    map (
                       groupName:
                       makeMonitorWidget groupName (
-                        builtins.map (svc: {
+                        map (svc: {
-                          title = svc.hostedService.title;
+                          inherit (svc.hostedService) title url icon;
-                          url = svc.hostedService.url;
-                          icon = svc.hostedService.icon;
                         }) (hostedServicesByGroup.${groupName} or [ ])
                       )
-                    ) (builtins.attrNames hostedServicesByGroup)
+                    ) (attrNames hostedServicesByGroup)
                   )
                   ++ lib.optionals (!cfg.hostedServiceGroups && cfg.enableHostedServices) [
                     (makeMonitorWidget "Services" hostedServiceSites)
                   ]
                   ++ lib.optionals (cfg.extraSites != [ ]) (
-                    builtins.map (site: {
+                    map (site: {
                       type = "monitor";
                       cache = "1m";
-                      title = site.title;
+                      inherit (site) title;
                       sites = [
                         (
                           {
-                            title = site.title;
+                            inherit (site) title url icon;
-                            url = site.url;
-                            icon = site.icon;
                           }
                           // optionalAttrs site.allow-insecure { allow-insecure = true; }
                         )
@@ -407,7 +401,7 @@ let
                     groups = cfg.bookmarks;
                   }
                   ++ lib.optionals (cfg.reddit != [ ]) (
-                    builtins.map (subreddit: {
+                    map (subreddit: {
                       type = "reddit";
                       inherit subreddit;
                     }) cfg.reddit

modules/nixos/services/headscale/default.nix

@@ -17,7 +17,7 @@ let
       services.headscale = {
         enable = true;
         address = cfg.listenAddress;
-        port = cfg.port;
+        inherit (cfg) port;
         settings = {
           server_url = "https://headscale.mjallen.dev:443";
           database.sqlite.path = "${cfg.configDir}/headscale/db.sqlite";

modules/nixos/services/immich/default.nix

@@ -19,9 +19,8 @@ let
     moduleConfig = {
       # Enable immich service
       services.immich = {
+        inherit (cfg) port openFirewall;
         enable = true;
-        port = cfg.port;
-        openFirewall = true;
         secretsFile = dbPassword;
         mediaLocation = "${cfg.dataDir}/photos";
 

modules/nixos/services/jellyfin/default.nix

@@ -16,7 +16,7 @@ let
     moduleConfig = {
       services.jellyfin = {
         enable = true;
-        openFirewall = cfg.openFirewall;
+        inherit (cfg) openFirewall;
         user = "nix-apps";
         group = "jallen-nas";
         dataDir = "${cfg.configDir}/jellyfin";

modules/nixos/services/jellyseerr/default.nix

@@ -16,9 +16,8 @@ let
     moduleConfig = {
       # Enable seerr service
       services.seerr = {
+        inherit (cfg) port openFirewall;
         enable = true;
-        port = cfg.port;
-        openFirewall = cfg.openFirewall;
         configDir = "${cfg.configDir}/jellyseerr";
       };
 

modules/nixos/services/kavita/default.nix

@@ -18,7 +18,7 @@ let
           "jallen-nas/kavita/token" = {
             sopsFile = lib.snowfall.fs.get-file "secrets/nas-secrets.yaml";
             owner = config.users.users.kavita.name;
-            group = config.users.users.kavita.group;
+            inherit (config.users.users.kavita) group;
             restartUnits = [ "kavita.service" ];
           };
         };
@@ -28,7 +28,7 @@ let
         dataDir = "${cfg.configDir}/kavita";
         tokenKeyFile = config.sops.secrets."jallen-nas/kavita/token".path;
         settings = {
-          Port = cfg.port;
+          inherit (cfg) port;
         };
       };
     };

modules/nixos/services/minecraft/default.nix

@@ -14,10 +14,10 @@ let
     options = { };
     moduleConfig = {
       services.minecraft-server = {
+        inherit (cfg) openFirewall;
         enable = true;
         eula = true;
         declarative = true;
-        openFirewall = cfg.openFirewall;
         dataDir = "${cfg.configDir}/minecraft"; # todo
         serverProperties = {
           enforce-whitelist = true;

modules/nixos/services/nebula/default.nix

@@ -115,20 +115,21 @@ let
       '';
 
       services.nebula.networks.${cfg.networkName} = {
+        inherit (cfg)
+          isLighthouse
+          isRelay
+          lighthouses
+          staticHostMap
+          ;
         enable = true;
         enableReload = true;
-        isLighthouse = cfg.isLighthouse;
-        isRelay = cfg.isRelay;
         inherit ca cert key;
 
-        lighthouses = cfg.lighthouses;
-        staticHostMap = cfg.staticHostMap;
-
         tun.device = if cfg.tunDevice != null then cfg.tunDevice else "nebula0";
 
         listen = {
           host = cfg.listenAddress;
-          port = cfg.port;
+          inherit (cfg) port;
         };
 
         settings.firewall = {

modules/nixos/services/nextcloud/default.nix

@@ -115,8 +115,8 @@ let
           virtualHosts.${config.services.nextcloud.hostName} = {
             listen = [
               {
+                inherit (cfg) port;
                 addr = "0.0.0.0";
-                port = cfg.port;
                 ssl = false;
               }
             ];

modules/nixos/services/onlyoffice/default.nix

@@ -17,7 +17,7 @@ let
     moduleConfig = {
       services.onlyoffice = {
         enable = true;
-        port = cfg.port;
+        inherit (cfg) port;
         wopi = true;
         hostname = "office.mjallen.dev";
         jwtSecretFile = jwtSecretFile;

modules/nixos/services/opencloud/default.nix

@@ -21,7 +21,7 @@ let
         enable = true;
         url = "https://cloud.mjallen.dev";
         address = cfg.listenAddress;
-        port = cfg.port;
+        inherit (cfg) port;
         stateDir = "${cfg.configDir}/opencloud";
         environment = {
           PROXY_TLS = "false"; # disable https when behind reverse-proxy

modules/nixos/services/owncloud/default.nix

@@ -61,8 +61,7 @@ in
 
   config = mkIf cfg.enable {
     virtualisation.oci-containers.containers."${cfg.name}" = {
-      autoStart = cfg.autoStart;
+      inherit (cfg) autoStart image;
-      image = cfg.image;
       ports = [ "${cfg.httpPort}:9200" ];
       volumes = [
         "${cfg.configPath}:/etc/ocis"

modules/nixos/services/paperless/default.nix

@@ -18,9 +18,9 @@ let
     moduleConfig = {
       # Enable paperless service
       services.paperless = {
+        inherit (cfg) port;
         enable = true;
         package = pkgs.paperless-ngx;
-        port = cfg.port;
         # user = "nix-apps";
         address = cfg.listenAddress;
         dataDir = "${cfg.configDir}/paperless";

modules/nixos/services/restic/default.nix

@@ -202,14 +202,16 @@ in
     services.restic.backups = mapAttrs (
       _name: jobCfg:
       {
-        initialize = jobCfg.initialize;
+        inherit (jobCfg)
-        createWrapper = jobCfg.createWrapper;
+          initialize
-        inhibitsSleep = jobCfg.inhibitsSleep;
+          createWrapper
-        paths = jobCfg.paths;
+          inhibitsSleep
+          paths
+          timerConfig
+          pruneOpts
+          extraBackupArgs
+          ;
         exclude = jobCfg.exclude ++ cfg.defaultExcludes;
-        timerConfig = jobCfg.timerConfig;
-        pruneOpts = jobCfg.pruneOpts;
-        extraBackupArgs = jobCfg.extraBackupArgs;
       }
       // optionalAttrs (jobCfg.passwordFile != null) { inherit (jobCfg) passwordFile; }
       // optionalAttrs (jobCfg.repository != null) { inherit (jobCfg) repository; }

modules/nixos/services/sunshine/default.nix

@@ -17,7 +17,7 @@ let
     moduleConfig = {
       services.sunshine = {
         enable = true;
-        openFirewall = cfg.openFirewall;
+        inherit (cfg) openFirewall;
         autoStart = true;
         capSysAdmin = true;
         applications.apps = with pkgs; [

modules/nixos/user/default.nix

@@ -88,7 +88,7 @@ in
 
   config = {
     users = {
-      mutableUsers = cfg.mutableUsers;
+      inherit (cfg) mutableUsers;
       groups.${cfg.group}.gid = lib.mkForce (if cfg.group != "wheel" then cfg.gid else 1);
       users = {
         root = {
@@ -99,6 +99,7 @@ in
         ${cfg.name} = {
           inherit (cfg)
             name
+            group
             uid
             linger
             packages
@@ -133,7 +134,6 @@ in
           ]
           ++ cfg.extraGroups;
 
-          group = cfg.group;
           home = "/home/${cfg.name}";
           isNormalUser = true;
           shell = lib.mkForce pkgs.zsh;

overlays/stable/default.nix

@@ -1,7 +1,7 @@
 { inputs, ... }:
 final: _prev: {
   stable = import inputs.nixpkgs-stable {
-    system = final.stdenv.hostPlatform.system;
+    inherit (final.stdenv.hostPlatform) system;
     config.allowUnfree = true;
   };
 }

packages/bcachefs/default.nix

@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
-    hash = sources.cargoDeps.hash;
+    inherit (sources.cargoDeps) hash;
   };
 
   postPatch = ''

packages/cockpit-benchmark/default.nix

@@ -102,10 +102,9 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "cockpit-benchmark";
+  inherit (sources) src;
   inherit version;
 
-  src = sources.src;
-
   npmDeps = fetchNpmDeps {
     src = "${finalAttrs.src}/benchmark";
     packageLock = patchedPackageLock;

packages/cockpit-machines/default.nix

@@ -16,10 +16,9 @@ let
 in
 stdenv.mkDerivation {
   pname = "cockpit-machines";
+  inherit (sources) src;
   inherit version;
 
-  src = sources.src;
-
   # Pre-vendored node_modules from cockpit-project/node-cache, pinned via the
   # node_modules submodule reference in the source tree.
   inherit (sources) nodeModules;

packages/cockpit-podman/default.nix

@@ -8,6 +8,7 @@
 let
   inherit (lib.trivial) importJSON;
   inherit (lib.${namespace}) mkAllSources selectVariant;
+  inherit lib;
 
   versionSpec = importJSON ./version.json;
   selected = selectVariant versionSpec null null;
@@ -18,11 +19,7 @@ stdenv.mkDerivation {
   pname = "cockpit-podman";
   inherit version;
 
-  src = sources.src;
+  inherit (sources) src nodeModules;
-
-  # Pre-vendored node_modules from cockpit-project/node-cache, pinned via the
-  # node_modules submodule reference in the source tree.
-  inherit (sources) nodeModules;
 
   # pkg/lib checked out from the main cockpit repo at the commit pinned in
   # the Makefile (COCKPIT_REPO_COMMIT).

packages/fastflowlm/default.nix

@@ -66,7 +66,7 @@ let
   version = "0.9.36";
 
   # XRT userspace runtime — built from packages/xrt in this flake.
-  xrt = pkgs.${namespace}.xrt;
+  inherit (pkgs.${namespace}) xrt;
 
   # ── tokenizers-cpp submodule ──────────────────────────────────────────────
   # Pinned to the commit referenced in FastFlowLM v0.9.36 .gitmodules.

packages/homeassistant/ha-anycubic/default.nix

@@ -16,9 +16,9 @@ let
   version = src-meta.tag or src-meta.rev;
 in
 buildHomeAssistantComponent {
-  owner = src-meta.owner;
+  inherit (src-meta) owner;
-  domain = "anycubic_wifi";
   inherit version;
+  domain = "anycubic_wifi";
 
   src = sources.anycubic;
 

packages/homeassistant/ha-bambulab/default.nix

@@ -17,9 +17,9 @@ let
   version = src-meta.tag or src-meta.rev;
 in
 buildHomeAssistantComponent {
-  owner = src-meta.owner;
+  inherit (src-meta) owner;
-  domain = "bambu_lab";
   inherit version;
+  domain = "bambu_lab";
 
   src = sources.bambu_lab;
 

packages/homeassistant/ha-bedjet/default.nix

@@ -17,7 +17,7 @@ let
   version = src-meta.tag or src-meta.rev;
 in
 buildHomeAssistantComponent {
-  owner = src-meta.owner;
+  inherit (src-meta) owner;
   domain = "bedjet";
   inherit version;
 

packages/homeassistant/ha-gehome/default.nix

@@ -17,7 +17,7 @@ let
   version = src-meta.tag or src-meta.rev;
 in
 buildHomeAssistantComponent {
-  owner = src-meta.owner;
+  inherit (src-meta) owner;
   domain = "ge_home";
   inherit version;
 

packages/homeassistant/ha-govee/default.nix

@@ -17,9 +17,9 @@ let
   version = src-meta.tag or src-meta.rev;
 in
 buildHomeAssistantComponent {
-  owner = src-meta.owner;
+  inherit (src-meta) owner;
-  domain = "govee";
   inherit version;
+  domain = "govee";
 
   src = sources.govee;
 

packages/homeassistant/ha-icloud3/default.nix

@@ -17,7 +17,7 @@ let
   version = src-meta.tag or src-meta.rev;
 in
 buildHomeAssistantComponent {
-  owner = src-meta.owner;
+  inherit (src-meta) owner;
   domain = "icloud3";
   inherit version;
 

packages/homeassistant/ha-local-llm/default.nix

@@ -17,9 +17,9 @@ let
   version = src-meta.tag or src-meta.rev;
 in
 buildHomeAssistantComponent {
-  owner = src-meta.owner;
+  inherit (src-meta) owner;
-  domain = "llama_conversation";
   inherit version;
+  domain = "llama_conversation";
 
   src = sources.llama_conversation;
 

packages/homeassistant/ha-mail-and-packages/default.nix

@@ -17,9 +17,9 @@ let
   version = src-meta.tag or src-meta.rev;
 in
 buildHomeAssistantComponent {
-  owner = src-meta.owner;
+  inherit (src-meta) owner;
-  domain = "mail_and_packages";
   inherit version;
+  domain = "mail_and_packages";
 
   src = sources.mail_and_packages;
 

packages/homeassistant/ha-nanokvm/default.nix

@@ -78,7 +78,7 @@ let
   };
 in
 buildHomeAssistantComponent {
-  owner = src-meta.owner;
+  inherit (src-meta) owner;
   domain = "nanokvm";
   inherit version;
 

packages/homeassistant/ha-openhasp/default.nix

@@ -17,7 +17,7 @@ let
   version = src-meta.tag or src-meta.rev;
 in
 buildHomeAssistantComponent {
-  owner = src-meta.owner;
+  inherit (src-meta) owner;
   domain = "openhasp";
   inherit version;
 

packages/homeassistant/ha-overseerr/default.nix

@@ -16,9 +16,9 @@ let
   version = src-meta.tag or src-meta.rev;
 in
 buildHomeAssistantComponent {
-  owner = src-meta.owner;
+  inherit (src-meta) owner;
-  domain = "overseerr";
   inherit version;
+  domain = "overseerr";
 
   src = sources.overseerr;
 

packages/homeassistant/ha-petlibro/default.nix

@@ -16,9 +16,9 @@ let
   version = src-meta.tag or src-meta.rev;
 in
 buildHomeAssistantComponent {
-  owner = src-meta.owner;
+  inherit (src-meta) owner;
-  domain = "petlibro";
   inherit version;
+  domain = "petlibro";
 
   src = sources.petlibro;
 

packages/homeassistant/ha-wyzeapi/default.nix

@@ -16,7 +16,7 @@ let
   version = src-meta.tag or src-meta.rev;
 in
 buildHomeAssistantComponent {
-  owner = src-meta.owner;
+  inherit (src-meta) owner;
   domain = "wyzeapi";
   inherit version;
 

packages/librepods-beta/default.nix

@@ -21,14 +21,13 @@
 let
   inherit (lib.trivial) importJSON;
   inherit (lib.${namespace}) selectVariant mkAllSources;
+  inherit lib;
 
   versionSpec = importJSON ./version.json;
   selected = selectVariant versionSpec null null;
   sources = mkAllSources pkgs selected;
-  # cargoHash is stored alongside the source in version.json so the TUI can update it
+  inherit (stdenv.hostPlatform) system;
   cargoHash = selected.sources.librepods.cargoHash;
-
-  system = stdenv.hostPlatform.system;
 in
 rustPlatform.buildRustPackage rec {
   pname = "librepods";

packages/moondeck-buddy/default.nix

@@ -12,7 +12,7 @@ let
   versionSpec = importJSON ./version.json;
   selected = selectVariant versionSpec null null;
   sources = mkAllSources pkgs selected;
-  moondeck-buddy = selected.sources.moondeck-buddy;
+  inherit (selected.sources) moondeck-buddy;
 in
 appimageTools.wrapType2 {
   pname = "moondeck-buddy";

packages/proton-cachyos/default.nix

@@ -23,19 +23,16 @@ let
   versionSpec = importJSON ./version.json;
   selected = selectVariant versionSpec variant null;
   vars = selected.variables or { };
-  base = vars.base;
-  release = vars.release;
 
   toolTitle = "proton-${variant}-latest";
 
-  # Derived values for the current variant
+  releaseVersion = "${releasePrefix}${vars.base}-${vars.release}${releaseSuffix}";
-  releaseVersion = "${releasePrefix}${base}-${release}${releaseSuffix}";
+  homepage = "https://${owner}/${repo}";
-  homepage = "https://github.com/${owner}/${repo}";
   url = "${homepage}/releases/download/${releaseVersion}/${tarballPrefix}${releaseVersion}${tarballSuffix}";
 
   # Choose fetcher based on file type
   intake =
-    if lib.strings.hasSuffix ".zip" url then
+    if lib.hasSuffix ".zip" url then
       {
         fetcher = fetchzip;
         input = "$src/*.tar.xz";
@@ -48,7 +45,7 @@ let
 in
 stdenvNoCC.mkDerivation {
   name = repo;
-  version = "${base}.${release}";
+  version = "${vars.base}.${vars.release}";
 
   src = intake.fetcher {
     inherit url;
@@ -60,7 +57,7 @@ stdenvNoCC.mkDerivation {
     tar -C $out/bin --strip=1 -x -f ${intake.input}
   ''
   # Allow to keep the same name between updates
-  + lib.strings.optionalString (toolTitle != null) ''
+  + lib.optionalString (toolTitle != null) ''
     sed -i -r 's|"${toolPattern}"|"${toolTitle}"|' $out/bin/compatibilitytool.vdf
   '';
 

packages/python/comfy-kitchen/default.nix

@@ -12,7 +12,7 @@ let
   versionSpec = importJSON ./version.json;
   selected = selectVariant versionSpec null null;
   sources = mkAllSources pkgs selected;
-  version = selected.variables.version;
+  inherit (selected.variables) version;
 in
 python3Packages.buildPythonPackage {
   pname = "comfy-kitchen";

packages/python/gehomesdk/default.nix

@@ -12,7 +12,7 @@ let
   versionSpec = importJSON ./version.json;
   selected = selectVariant versionSpec null null;
   sources = mkAllSources pkgs selected;
-  version = selected.variables.version;
+  inherit (selected.variables) version;
 in
 home-assistant.python.pkgs.buildPythonPackage {
   pname = "gehomesdk";

packages/python/python-steam/default.nix

@@ -12,7 +12,7 @@ let
   versionSpec = importJSON ./version.json;
   selected = selectVariant versionSpec null null;
   sources = mkAllSources pkgs selected;
-  version = selected.variables.version;
+  inherit (selected.variables) version;
 in
 python3Packages.buildPythonPackage {
   pname = "steam";

packages/python/pyvesync/default.nix

@@ -12,8 +12,8 @@ let
   versionSpec = importJSON ./version.json;
   selected = selectVariant versionSpec null null;
   sources = mkAllSources pkgs selected;
-  src-meta = selected.sources.pyvesync;
+  inherit (selected.sources) pyvesync;
-  version = selected.variables.version;
+  inherit (selected.variables) version;
 in
 python3Packages.buildPythonPackage {
   pname = "pyvesync";
@@ -37,7 +37,7 @@ python3Packages.buildPythonPackage {
   meta = with lib; {
     description = "Python library to manage Etekcity Devices and Levoit Air Purifier";
     homepage = "https://github.com/webdjoe/pyvesync";
-    changelog = "https://github.com/webdjoe/pyvesync/releases/tag/${src-meta.tag}";
+    changelog = "https://github.com/webdjoe/pyvesync/releases/tag/${pyvesync.tag}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };

packages/raspberrypi/ffmpeg-rpi/default.nix

@@ -71,9 +71,9 @@ in
     ];
 })).override
   {
+    inherit (rpiFfmpegSrc) hash;
     version = ffmpegVersion;
     source = rpiFfmpegSrc;
-    hash = rpiFfmpegSrc.hash;
 
     # version = ffmpegVersion + "-rpi";
     # source = rpiFfmpegSrc;

packages/raspberrypi/linux-rpi/default.nix

@@ -19,8 +19,8 @@ let
   selected = selectVariant versionSpec kernelVersion null;
   sources = mkAllSources pkgs selected;
 
-  modDirVersion = selected.variables.modDirVersion;
+  inherit (selected.variables) modDirVersion;
-  tag = kernelVersion; # sources.tag;
+  tag = kernelVersion;
   # NOTE: raspberrypifw & raspberryPiWirelessFirmware should be updated with this
 
   # all of these fail for various reasons

packages/raspberrypi/raspberrypi-overlays/default.nix

@@ -17,7 +17,7 @@ in
 stdenvNoCC.mkDerivation {
   # NOTE: this should be updated with linux_rpi
   pname = "raspberrypi-dtoverlays";
-  version = vars.version;
+  inherit (vars) version;
 
   src = sources.linux;
 

packages/raspberrypi/raspberrypifw/default.nix

@@ -16,7 +16,7 @@ in
 stdenvNoCC.mkDerivation {
   # NOTE: this should be updated with linux_rpi
   pname = "raspberrypi-firmware";
-  version = vars.version;
+  inherit (vars) version;
 
   src = sources.firmware-next;
 

packages/raspberrypi/uefi-rpi4/default.nix

@@ -14,8 +14,8 @@ let
   sources = mkAllSources pkgs selected;
 in
 stdenvNoCC.mkDerivation rec {
+  inherit (vars) version;
   pname = "uefi-rpi4";
-  version = vars.version;
 
   src = sources.firmware;
 

packages/raspberrypi/uefi-rpi5/default.nix

@@ -50,7 +50,7 @@ let
 in
 stdenvNoCC.mkDerivation rec {
   pname = "uefi-rpi5";
-  version = vars.version;
+  inherit (vars) version;
 
   src = sources.firmware;
 

statix.toml

@@ -1,11 +1,8 @@
 # Disable lint rules that generate excessive false-positives or noise.
 #
-# manual_inherit / manual_inherit_from: very high volume of style suggestions.
 # empty_pattern: { ... }: is a valid and readable no-arg pattern.
 disabled = [
-  "manual_inherit",
+  "empty_pattern",
-  "manual_inherit_from",
-  "empty_pattern", # needed for some overlays
 ]
 
 # Exclude files where statix's parser fails on complex shell-in-Nix content.

systems/aarch64-linux/pi5/default.nix

@@ -124,9 +124,9 @@ in
     network = {
       hostName = net.hosts.pi5.hostname;
       ipv4 = {
+        inherit (net.hosts.pi5) gateway;
         method = "manual";
         address = net.hosts.pi5.lan4;
-        gateway = net.hosts.pi5.gateway;
         dns = "1.1.1.1";
         interface = "end0";
       };

systems/x86_64-linux/allyx/default.nix

@@ -55,8 +55,8 @@
       enable = true;
       extraDirectories = [
         {
+          inherit (config.jovian.decky-loader) user;
           directory = config.jovian.decky-loader.stateDir;
-          user = config.jovian.decky-loader.user;
           group = config.jovian.decky-loader.user;
           mode = "u=rwx,g=rwx,o=rx";
         }

systems/x86_64-linux/jallen-nas/default.nix

@@ -127,7 +127,7 @@ in
       ipv4 = {
         address = net.hosts.nas.lan;
         method = "manual";
-        gateway = net.hosts.nas.gateway;
+        inherit (net.hosts.nas) gateway;
         dns = "1.1.1.1";
         interface = "enp197s0";
       };

systems/x86_64-linux/jallen-nas/sops.nix

@@ -1,7 +1,13 @@
 { config, lib, ... }:
 let
-  user = "nix-apps";
+  owner = config.users.users."nix-apps".name;
-  defaultSops = lib.snowfall.fs.get-file "secrets/nas-secrets.yaml";
+  inherit (config.users.users."${owner}") group;
+  sopsFile = lib.snowfall.fs.get-file "secrets/nas-secrets.yaml";
+
+  sopsSettings = {
+    inherit owner group sopsFile;
+    mode = "0600";
+  };
 in
 {
   # Permission modes are in octal representation (same as chmod),
@@ -25,27 +31,18 @@ in
     # Secrets
     # ------------------------------
     secrets = {
-      "jallen-nas/admin_password" = {
+      "jallen-nas/admin_password" = sopsSettings // {
-        sopsFile = defaultSops;
         neededForUsers = true;
-        mode = "0600";
-        owner = config.users.users."${user}".name;
-        group = config.users.users."${user}".group;
       };
 
-      "jallen-nas/nas_pool" = {
+      "jallen-nas/nas_pool" = sopsSettings;
-        sopsFile = defaultSops;
-        mode = "0600";
-        owner = config.users.users."${user}".name;
-        group = config.users.users."${user}".group;
-      };
 
       # ------------------------------
       # ups
       # ------------------------------
 
       "jallen-nas/ups_password" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
         mode = "0777";
         restartUnits = [
           "upsdrv.service"
@@ -73,7 +70,7 @@ in
       # ------------------------------
 
       "jallen-nas/authentik-env" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
         restartUnits = [ "authentik.service" ];
       };
 
@@ -81,7 +78,7 @@ in
       # attic
       # ------------------------------
       "jallen-nas/attic-key" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
         restartUnits = [ "atticd.service" ];
       };
 
@@ -90,7 +87,7 @@ in
       # ------------------------------
 
       "jallen-nas/collabora" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
         restartUnits = [ "coolwsd.service" ];
       };
 
@@ -103,7 +100,7 @@ in
       # };
 
       # "jallen-nas/crowdsec-capi" = {
-      #   sopsFile = defaultSops;
+      #   inherit sopsFile;
       #   owner = "crowdsec";
       #   group = "crowdsec";
       #   restartUnits = [ "crowdsec.service" ];
@@ -114,11 +111,11 @@ in
       # ------------------------------
 
       "jallen-nas/mariadb/db_pass" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
         restartUnits = [ "mysql.service" ];
       };
       "jallen-nas/mariadb/root_pass" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
         restartUnits = [ "mysql.service" ];
       };
 
@@ -126,28 +123,20 @@ in
       # nextcloud
       # ------------------------------
 
-      "jallen-nas/nextcloud/dbpassword" = {
+      "jallen-nas/nextcloud/dbpassword" = sopsSettings // {
-        sopsFile = defaultSops;
         mode = "0650";
-        owner = config.users.users."${user}".name;
-        group = config.users.users."${user}".group;
         restartUnits = [ "nextcloud.service" ];
       };
-      "jallen-nas/nextcloud/adminpassword" = {
+      "jallen-nas/nextcloud/adminpassword" = sopsSettings // {
-        sopsFile = defaultSops;
         mode = "0440";
-        owner = config.users.users."${user}".name;
         group = "keys";
         restartUnits = [
           "nextcloud.service"
           "prometheus-nextcloud-exporter.service" # actual systemd unit name
         ];
       };
-      "jallen-nas/nextcloud/smtp_settings" = {
+      "jallen-nas/nextcloud/smtp_settings" = sopsSettings // {
-        sopsFile = defaultSops;
         mode = "0650";
-        owner = config.users.users."${user}".name;
-        group = config.users.users."${user}".group;
         restartUnits = [ "nextcloud.service" ];
       };
 
@@ -155,11 +144,8 @@ in
       # onlyoffice
       # ------------------------------
 
-      "jallen-nas/onlyoffice-key" = {
+      "jallen-nas/onlyoffice-key" = sopsSettings // {
-        sopsFile = defaultSops;
         mode = "0655";
-        owner = config.users.users."${user}".name;
-        group = config.users.users."${user}".group;
         restartUnits = [ "nextcloud.service" ];
       };
 
@@ -168,7 +154,7 @@ in
       # ------------------------------
 
       "jallen-nas/manyfold/secretkeybase" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
         restartUnits = [ "podman-manyfold.service" ];
       };
 
@@ -177,7 +163,7 @@ in
       # ------------------------------
 
       "jallen-nas/immich/db-password" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
         mode = "0440";
         group = "keys";
         restartUnits = [ "immich.service" ];
@@ -188,7 +174,7 @@ in
       # ------------------------------
 
       "jallen-nas/open-webui" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
         restartUnits = [ "open-webui.service" ];
       };
 
@@ -197,15 +183,15 @@ in
       # ------------------------------
 
       "jallen-nas/paperless/secret" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
         restartUnits = [ "paperless.service" ];
       };
       "jallen-nas/paperless/authentik-client-id" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
         restartUnits = [ "paperless.service" ];
       };
       "jallen-nas/paperless/authentik-client-secret" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
         restartUnits = [ "paperless.service" ];
       };
 
@@ -214,14 +200,14 @@ in
       # ------------------------------
 
       "jallen-nas/gitea/mail-key" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
         owner = "root";
         group = "keys";
         mode = "0440";
         restartUnits = [ "gitea.service" ];
       };
       "jallen-nas/gitea/metrics-key" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
         owner = "root";
         group = "keys";
         mode = "0440";
@@ -232,36 +218,36 @@ in
       # free-games-claimer
       # ------------------------------
       "jallen-nas/free-games/eg-email" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
       };
       "jallen-nas/free-games/eg-pass" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
       };
       "jallen-nas/free-games/eg-otp" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
       };
       "jallen-nas/free-games/pg-email" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
       };
       "jallen-nas/free-games/pg-pass" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
       };
       "jallen-nas/free-games/gog-email" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
       };
       "jallen-nas/free-games/gog-pass" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
       };
 
       # ------------------------------
       # ntfy
       # ------------------------------
       "jallen-nas/ntfy/auth-users" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
       };
 
       "jallen-nas/ntfy/user" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
         mode = "0440";
         group = "keys";
         restartUnits = [
@@ -271,7 +257,7 @@ in
         ];
       };
       "jallen-nas/ntfy/password" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
         mode = "0440";
         group = "keys";
         restartUnits = [
@@ -285,15 +271,15 @@ in
       # sparky-fitness
       # ------------------------------
       "jallen-nas/sparky-fitness/db-password" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
         restartUnits = [ "podman-sparky-fitness-server.service" ];
       };
       "jallen-nas/sparky-fitness/api-encryption-key" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
         restartUnits = [ "podman-sparky-fitness-server.service" ];
       };
       "jallen-nas/sparky-fitness/auth-secret" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
         restartUnits = [ "podman-sparky-fitness-server.service" ];
       };
 
@@ -303,7 +289,7 @@ in
       #   jallen-nas/authentik-rac/token: <authentik RAC outpost token>
       # ------------------------------
       "jallen-nas/authentik-rac/token" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
         restartUnits = [ "podman-authenticRac.service" ];
       };
 
@@ -315,7 +301,7 @@ in
       # embedding it in the world-readable Nix store.
       # To rotate: use https://github.com/erooke/grafana-secretkey-rotation-tool
       "jallen-nas/grafana/secret-key" = {
-        sopsFile = defaultSops;
+        inherit sopsFile;
         owner = "grafana";
         group = "grafana";
         mode = "0400";
@@ -328,6 +314,7 @@ in
     # ------------------------------
     templates = {
       "fgc.env" = {
+        inherit owner group;
         content = ''
           EG_EMAIL = ${config.sops.placeholder."jallen-nas/free-games/eg-email"}
           EG_PASSWORD = ${config.sops.placeholder."jallen-nas/free-games/eg-pass"}
@@ -338,8 +325,6 @@ in
           GOG_PASSWORD = ${config.sops.placeholder."jallen-nas/free-games/gog-pass"}
         '';
         mode = "0650";
-        owner = config.users.users."${user}".name;
-        group = config.users.users."${user}".group;
         restartUnits = [ "podman-free-games-claimer.service" ];
       };
 
@@ -407,6 +392,7 @@ in
       };
 
       "paperless.env" = {
+        inherit owner group;
         content = ''
           PAPERLESS_ADMIN_USER = "mjallen"
           PAPERLESS_ADMIN_PASSWORD = ${config.sops.placeholder."matt_password"}
@@ -421,8 +407,6 @@ in
           }","settings":{"server_url":"https://authentik.mjallen.dev/application/o/paperless/.well-known/openid-configuration"}}]}}
         '';
         mode = "0650";
-        owner = config.users.users."${user}".name;
-        group = config.users.users."${user}".group;
         restartUnits = [ "paperless-web.service" ];
       };
     };

systems/x86_64-linux/nuc-nixos/default.nix

@@ -36,9 +36,9 @@ in
     network = {
       hostName = net.hosts.nuc.hostname;
       ipv4 = {
+        inherit (net.hosts.nuc) gateway;
         method = "manual";
         address = net.hosts.nuc.lan4;
-        gateway = net.hosts.nuc.gateway;
         dns = net.hosts.router.lan;
         interface = "enp2s0";
       };