Try pre-commit and formatting with alejandra

flake.lock

@@ -105,6 +105,22 @@
         "type": "github"
       }
     },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "inputs": {
         "systems": "systems_2"
@@ -140,6 +156,27 @@
         "type": "indirect"
       }
     },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "pre-commit-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -215,12 +252,49 @@
         "type": "github"
       }
     },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1730768919,
+        "narHash": "sha256-8AKquNnnSaJRXZxc5YmF/WfmxiHX6MMZZasRP6RRQkE=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a04d33c0c3f1a59a2c1cb0c6e34cd24500e5a1dc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "pre-commit-hooks": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "gitignore": "gitignore",
+        "nixpkgs": "nixpkgs_3"
+      },
+      "locked": {
+        "lastModified": 1747372754,
+        "narHash": "sha256-2Y53NGIX2vxfie1rOW0Qb86vjRZ7ngizoo+bnXU9D9k=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "80479b6ec16fefd9c1db3ea13aeb038c60530f46",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "agenix": "agenix",
         "crowdsec": "crowdsec",
         "home-manager": "home-manager_2",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs_2",
+        "pre-commit-hooks": "pre-commit-hooks"
       }
     },
     "rust-overlay": {

flake.nix

@@ -3,6 +3,7 @@
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
+    pre-commit-hooks.url = "github:cachix/git-hooks.nix";
     home-manager = {
       url = "github:nix-community/home-manager/release-25.05";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -27,7 +28,17 @@
     proxy_host = "192.168.1.40";
     pgsql_host = "192.168.1.13";
     pkgs = import nixpkgs {inherit system;};
+    supportedSystems = ["x86_64-linux"];
+    forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
   in {
+    checks = forAllSystems (system: {
+      pre-commit-check = inputs.pre-commit-hooks.lib.${system}.run {
+        src = ./.;
+        hooks = {
+          alejandra.enable = true;
+        };
+      };
+    });
     nixosConfigurations = {
       nginx = nixpkgs.lib.nixosSystem {
         inherit system;

modules/crowdsec.nix

@@ -3,9 +3,7 @@
   pkgs,
   lib,
   ...
-}:
+}: let
-let
-
   format = pkgs.formats.yaml {};
 
   rootDir = "/var/lib/crowdsec";
@@ -22,10 +20,7 @@ let
   localParsersS01ParseDir = "${parsersDir}/s01-parse/";
   localParsersS02EnrichDir = "${parsersDir}/s02-enrich/";
   localContextsDir = "${confDir}/contexts/";
-
+in {
-in
-{
-
   options.services.crowdsec = with lib; {
     enable = mkEnableOption "CrowdSec Security Engine";
 
@@ -443,8 +438,7 @@ in
       };
     };
   };
-  config =
+  config = let
-    let
     cfg = config.services.crowdsec;
     configFile = format.generate "crowdsec.yaml" cfg.settings.general;
     simulationFile = format.generate "simulation.yaml" cfg.settings.simulation;
@@ -468,7 +462,7 @@ in
       $sudo ${lib.getExe' cfg.package "cscli"} -c=${configFile} "$@"
     '';
 
-      localScenariosMap = (map (format.generate "scenario.yaml") cfg.localConfig.scenarios);
+    localScenariosMap = map (format.generate "scenario.yaml") cfg.localConfig.scenarios;
     localParsersS00RawMap = (
       map (format.generate "parsers-s00-raw.yaml") cfg.localConfig.parsers.s00Raw
     );
@@ -481,8 +475,8 @@ in
     localPostOverflowsS01WhitelistMap = (
       map (format.generate "postoverflows-s01-whitelist.yaml") cfg.localConfig.postOverflows.s01Whitelist
     );
-      localContextsMap = (map (format.generate "context.yaml") cfg.localConfig.contexts);
+    localContextsMap = map (format.generate "context.yaml") cfg.localConfig.contexts;
-      localNotificationsMap = (map (format.generate "notification.yaml") cfg.localConfig.notifications);
+    localNotificationsMap = map (format.generate "notification.yaml") cfg.localConfig.notifications;
     localProfilesFile = pkgs.writeText "local_profiles.yaml" ''
       ---
       ${lib.strings.concatMapStringsSep "\n---\n" builtins.toJSON cfg.localConfig.profiles}
@@ -554,10 +548,8 @@ in
     setupScript = pkgs.writeShellScriptBin "crowdsec-setup" (
       lib.strings.concatStringsSep "\n" scriptArray
     );
-
   in
     lib.mkIf (cfg.enable) {
-
       warnings =
         []
         ++ lib.optionals (cfg.localConfig.profiles == []) [
@@ -824,7 +816,8 @@ in
                   argument = "${scenarioFile}";
                 };
               };
-            }) localScenariosMap
+            })
+            localScenariosMap
           )
           // builtins.listToAttrs (
             map (parser: {
@@ -836,7 +829,8 @@ in
                   argument = "${parser}";
                 };
               };
-            }) localParsersS00RawMap
+            })
+            localParsersS00RawMap
           )
           // builtins.listToAttrs (
             map (parser: {
@@ -848,7 +842,8 @@ in
                   argument = "${parser}";
                 };
               };
-            }) localParsersS01ParseMap
+            })
+            localParsersS01ParseMap
           )
           // builtins.listToAttrs (
             map (parser: {
@@ -860,7 +855,8 @@ in
                   argument = "${parser}";
                 };
               };
-            }) localParsersS02EnrichMap
+            })
+            localParsersS02EnrichMap
           )
           // builtins.listToAttrs (
             map (postoverflow: {
@@ -872,7 +868,8 @@ in
                   argument = "${postoverflow}";
                 };
               };
-            }) localPostOverflowsS01WhitelistMap
+            })
+            localPostOverflowsS01WhitelistMap
           )
           // builtins.listToAttrs (
             map (context: {
@@ -884,7 +881,8 @@ in
                   argument = "${context}";
                 };
               };
-            }) localContextsMap
+            })
+            localContextsMap
           )
           // builtins.listToAttrs (
             map (notification: {
@@ -896,7 +894,8 @@ in
                   argument = "${notification}";
                 };
               };
-            }) localNotificationsMap
+            })
+            localNotificationsMap
           );
       };
 

services/netbox/default.nix

@@ -18,7 +18,6 @@ in {
       file = ../../secrets/netbox-lapi-key.age;
       owner = "crowdsec";
     };
-    };
     services = {
       crowdsec = {
         settings.lapi.credentialsFile = "${config.age.secrets.netbox-lapi-key.path}";

systems/minimalLXCConfig.nix

@@ -1,7 +1,4 @@
-{
+{pkgs, ...}: {
-  pkgs,
-  ...
-}: {
   nix = {
     settings.experimental-features = ["nix-command" "flakes"];
     settings.trusted-users = ["root" "@wheel"];

systems/minimalVMConfig.nix

@@ -1,7 +1,4 @@
-{
+{pkgs, ...}: {
-  pkgs,
-  ...
-}: {
   nix = {
     settings.experimental-features = ["nix-command" "flakes"];
     settings.trusted-users = ["root" "@wheel"];