From bd84297c70a1ff34661d2bde895f2bb1e5fe9478 Mon Sep 17 00:00:00 2001
From: kuflierl <41301536+kuflierl@users.noreply.github.com>
Date: Sat, 27 Sep 2025 15:35:19 +0200
Subject: [PATCH 1/4] nixos/modules/profiles: remove with lib

---
 nixos/modules/profiles/clone-config.nix       | 19 ++++++++-----------
 .../modules/profiles/installation-device.nix  | 19 ++++++++-----------
 2 files changed, 16 insertions(+), 22 deletions(-)

diff --git a/nixos/modules/profiles/clone-config.nix b/nixos/modules/profiles/clone-config.nix
index 2c6377e65c883..f727a09929d8e 100644
--- a/nixos/modules/profiles/clone-config.nix
+++ b/nixos/modules/profiles/clone-config.nix
@@ -5,9 +5,6 @@
   modules,
   ...
 }:
-
-with lib;
-
 let
 
   # Location of the repository on the harddrive
@@ -19,20 +16,20 @@ let
     let
       s = toString path;
     in
-    removePrefix nixosPath s != s;
+    lib.removePrefix nixosPath s != s;
 
   # Copy modules given as extra configuration files.  Unfortunately, we
   # cannot serialized attribute set given in the list of modules (that's why
   # you should use files).
   moduleFiles =
     # FIXME: use typeOf (Nix 1.6.1).
-    filter (x: !isAttrs x && !lib.isFunction x) modules;
+    lib.filter (x: !lib.isAttrs x && !lib.isFunction x) modules;
 
   # Partition module files because between NixOS and non-NixOS files.  NixOS
   # files may change if the repository is updated.
   partitionedModuleFiles =
     let
-      p = partition isNixOSFile moduleFiles;
+      p = lib.partition isNixOSFile moduleFiles;
     in
     {
       nixos = p.right;
@@ -43,7 +40,7 @@ let
   # device configuration could be rebuild.
   relocatedModuleFiles =
     let
-      relocateNixOS = path: "<nixpkgs/nixos" + removePrefix nixosPath (toString path) + ">";
+      relocateNixOS = path: "<nixpkgs/nixos" + lib.removePrefix nixosPath (toString path) + ">";
     in
     {
       nixos = map relocateNixOS partitionedModuleFiles.nixos;
@@ -72,7 +69,7 @@ in
 
   options = {
 
-    installer.cloneConfig = mkOption {
+    installer.cloneConfig = lib.mkOption {
       default = true;
       description = ''
         Try to clone the installation-device configuration by re-using it's
@@ -80,7 +77,7 @@ in
       '';
     };
 
-    installer.cloneConfigIncludes = mkOption {
+    installer.cloneConfigIncludes = lib.mkOption {
       default = [ ];
       example = [ "./nixos/modules/hardware/network/rt73.nix" ];
       description = ''
@@ -88,7 +85,7 @@ in
       '';
     };
 
-    installer.cloneConfigExtra = mkOption {
+    installer.cloneConfigExtra = lib.mkOption {
       default = "";
       description = ''
         Extra text to include in the cloned configuration.nix included in this
@@ -105,7 +102,7 @@ in
       # Provide a mount point for nixos-install.
       mkdir -p /mnt
 
-      ${optionalString config.installer.cloneConfig ''
+      ${lib.optionalString config.installer.cloneConfig ''
         # Provide a configuration for the CD/DVD itself, to allow users
         # to run nixos-rebuild to change the configuration of the
         # running system on the CD/DVD.
diff --git a/nixos/modules/profiles/installation-device.nix b/nixos/modules/profiles/installation-device.nix
index 3865613da23c9..cd141b5a4e8bd 100644
--- a/nixos/modules/profiles/installation-device.nix
+++ b/nixos/modules/profiles/installation-device.nix
@@ -5,9 +5,6 @@
   lib,
   ...
 }:
-
-with lib;
-
 {
   imports = [
     # Enable devices which are usually scanned, because we don't know the
@@ -28,10 +25,10 @@ with lib;
     system.nixos.variant_id = lib.mkDefault "installer";
 
     # Enable in installer, even if the minimal profile disables it.
-    documentation.enable = mkImageMediaOverride true;
+    documentation.enable = lib.mkImageMediaOverride true;
 
     # Show the manual.
-    documentation.nixos.enable = mkImageMediaOverride true;
+    documentation.nixos.enable = lib.mkImageMediaOverride true;
 
     # Use less privileged nixos user
     users.users.nixos = {
@@ -53,8 +50,8 @@ with lib;
 
     # Allow passwordless sudo from nixos user
     security.sudo = {
-      enable = mkDefault true;
-      wheelNeedsPassword = mkImageMediaOverride false;
+      enable = lib.mkDefault true;
+      wheelNeedsPassword = lib.mkImageMediaOverride false;
     };
 
     # Automatically log in at the virtual consoles.
@@ -70,7 +67,7 @@ with lib;
 
       To set up a wireless connection, run `nmtui`.
     ''
-    + optionalString config.services.xserver.enable ''
+    + lib.optionalString config.services.xserver.enable ''
 
       Type `sudo systemctl start display-manager' to
       start the graphical user interface.
@@ -82,8 +79,8 @@ with lib;
     # installation device for head-less systems i.e. arm boards by manually
     # mounting the storage in a different system.
     services.openssh = {
-      enable = mkDefault true;
-      settings.PermitRootLogin = mkDefault "yes";
+      enable = lib.mkDefault true;
+      settings.PermitRootLogin = lib.mkDefault "yes";
     };
 
     # Provide networkmanager for easy network configuration.
@@ -120,7 +117,7 @@ with lib;
     # Show all debug messages from the kernel but don't log refused packets
     # because we have the firewall enabled. This makes installs from the
     # console less cumbersome if the machine has a public IP.
-    networking.firewall.logRefusedConnections = mkDefault false;
+    networking.firewall.logRefusedConnections = lib.mkDefault false;
 
     # Prevent installation media from evacuating persistent storage, as their
     # var directory is not persistent and it would thus result in deletion of

From 527cb9779ba94e4bee2a3f7eea64d125187c2b41 Mon Sep 17 00:00:00 2001
From: kuflierl <41301536+kuflierl@users.noreply.github.com>
Date: Sat, 27 Sep 2025 17:38:43 +0200
Subject: [PATCH 2/4] nixos/modules: remove with lib pt1

---
 nixos/modules/hardware/cpu/amd-sev.nix        |   1 -
 nixos/modules/hardware/uni-sync.nix           |  43 ++--
 .../installer/netboot/netboot-base.nix        |   2 -
 nixos/modules/installer/netboot/netboot.nix   |  19 +-
 nixos/modules/installer/sd-card/sd-image.nix  |  81 ++++---
 nixos/modules/profiles/nix-builder-vm.nix     |  26 +--
 nixos/modules/programs/nix-index.nix          |  12 +-
 .../modules/programs/nix-required-mounts.nix  |  20 +-
 nixos/modules/programs/wayland/lib.nix        |   6 +-
 nixos/modules/security/pam.nix                |  37 ++-
 nixos/modules/security/rtkit.nix              |  14 +-
 nixos/modules/services/admin/meshcentral.nix  |  15 +-
 nixos/modules/services/audio/mympd.nix        |  12 +-
 .../services/cluster/kubernetes/kubelet.nix   | 174 +++++++-------
 .../services/cluster/kubernetes/pki.nix       | 217 +++++++++---------
 .../services/cluster/kubernetes/proxy.nix     |  49 ++--
 .../gocd-server/default.nix                   |  71 +++---
 17 files changed, 387 insertions(+), 412 deletions(-)

diff --git a/nixos/modules/hardware/cpu/amd-sev.nix b/nixos/modules/hardware/cpu/amd-sev.nix
index 4bf43f70c70c1..526be9a9807cf 100644
--- a/nixos/modules/hardware/cpu/amd-sev.nix
+++ b/nixos/modules/hardware/cpu/amd-sev.nix
@@ -27,7 +27,6 @@ let
     };
   };
 in
-with lib;
 {
   options.hardware.cpu.amd.sev = optionsFor "SEV" "sev";
 
diff --git a/nixos/modules/hardware/uni-sync.nix b/nixos/modules/hardware/uni-sync.nix
index 2fc93772562d6..5f0bd91f854ec 100644
--- a/nixos/modules/hardware/uni-sync.nix
+++ b/nixos/modules/hardware/uni-sync.nix
@@ -4,20 +4,19 @@
   pkgs,
   ...
 }:
-with lib;
 let
   cfg = config.hardware.uni-sync;
 in
 {
-  meta.maintainers = with maintainers; [ yunfachi ];
+  meta.maintainers = with lib.maintainers; [ yunfachi ];
 
   options.hardware.uni-sync = {
-    enable = mkEnableOption "udev rules and software for Lian Li Uni Controllers";
-    package = mkPackageOption pkgs "uni-sync" { };
+    enable = lib.mkEnableOption "udev rules and software for Lian Li Uni Controllers";
+    package = lib.mkPackageOption pkgs "uni-sync" { };
 
-    devices = mkOption {
+    devices = lib.mkOption {
       default = [ ];
-      example = literalExpression ''
+      example = lib.literalExpression ''
         [
           {
             device_id = "VID:1111/PID:11111/SN:1111111111";
@@ -53,23 +52,23 @@ in
         ]
       '';
       description = "List of controllers with their configurations.";
-      type = types.listOf (
-        types.submodule {
+      type = lib.types.listOf (
+        lib.types.submodule {
           options = {
-            device_id = mkOption {
-              type = types.str;
+            device_id = lib.mkOption {
+              type = lib.types.str;
               example = "VID:1111/PID:11111/SN:1111111111";
               description = "Unique device ID displayed at each startup.";
             };
-            sync_rgb = mkOption {
-              type = types.bool;
+            sync_rgb = lib.mkOption {
+              type = lib.types.bool;
               default = false;
               example = true;
               description = "Enable ARGB header sync.";
             };
-            channels = mkOption {
+            channels = lib.mkOption {
               default = [ ];
-              example = literalExpression ''
+              example = lib.literalExpression ''
                 [
                   {
                     mode = "PWM";
@@ -89,11 +88,11 @@ in
                 ]
               '';
               description = "List of channels connected to the controller.";
-              type = types.listOf (
-                types.submodule {
+              type = lib.types.listOf (
+                lib.types.submodule {
                   options = {
-                    mode = mkOption {
-                      type = types.enum [
+                    mode = lib.mkOption {
+                      type = lib.types.enum [
                         "Manual"
                         "PWM"
                       ];
@@ -101,8 +100,8 @@ in
                       example = "PWM";
                       description = "\"PWM\" to enable PWM sync. \"Manual\" to set speed.";
                     };
-                    speed = mkOption {
-                      type = types.int;
+                    speed = lib.mkOption {
+                      type = lib.types.int;
                       default = "50";
                       example = "100";
                       description = "Fan speed as percentage (clamped between 0 and 100).";
@@ -117,8 +116,8 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
-    environment.etc."uni-sync/uni-sync.json".text = mkIf (cfg.devices != [ ]) (
+  config = lib.mkIf cfg.enable {
+    environment.etc."uni-sync/uni-sync.json".text = lib.mkIf (cfg.devices != [ ]) (
       builtins.toJSON { configs = cfg.devices; }
     );
 
diff --git a/nixos/modules/installer/netboot/netboot-base.nix b/nixos/modules/installer/netboot/netboot-base.nix
index 25578b06fea1f..ebb7645dd3a3d 100644
--- a/nixos/modules/installer/netboot/netboot-base.nix
+++ b/nixos/modules/installer/netboot/netboot-base.nix
@@ -1,8 +1,6 @@
 # This module contains the basic configuration for building netboot
 # images
 
-{ lib, ... }:
-
 {
   imports = [
     ./netboot.nix
diff --git a/nixos/modules/installer/netboot/netboot.nix b/nixos/modules/installer/netboot/netboot.nix
index a4d9664a55312..2beccdfabdecd 100644
--- a/nixos/modules/installer/netboot/netboot.nix
+++ b/nixos/modules/installer/netboot/netboot.nix
@@ -8,9 +8,6 @@
   modulesPath,
   ...
 }:
-
-with lib;
-
 {
   imports = [
     ../../image/file-options.nix
@@ -18,17 +15,17 @@ with lib;
 
   options = {
 
-    netboot.squashfsCompression = mkOption {
+    netboot.squashfsCompression = lib.mkOption {
       default = "zstd -Xcompression-level 19";
       description = ''
         Compression settings to use for the squashfs nix store.
       '';
       example = "zstd -Xcompression-level 6";
-      type = types.str;
+      type = lib.types.str;
     };
 
-    netboot.storeContents = mkOption {
-      example = literalExpression "[ pkgs.stdenv ]";
+    netboot.storeContents = lib.mkOption {
+      example = lib.literalExpression "[ pkgs.stdenv ]";
       description = ''
         This option lists additional derivations to be included in the
         Nix store in the generated netboot image.
@@ -42,14 +39,14 @@ with lib;
     # here and it causes a cyclic dependency.
     boot.loader.grub.enable = false;
 
-    fileSystems."/" = mkImageMediaOverride {
+    fileSystems."/" = lib.mkImageMediaOverride {
       fsType = "tmpfs";
       options = [ "mode=0755" ];
     };
 
     # In stage 1, mount a tmpfs on top of /nix/store (the squashfs
     # image) to make this a live CD.
-    fileSystems."/nix/.ro-store" = mkImageMediaOverride {
+    fileSystems."/nix/.ro-store" = lib.mkImageMediaOverride {
       fsType = "squashfs";
       device = "../nix-store.squashfs";
       options = [
@@ -59,13 +56,13 @@ with lib;
       neededForBoot = true;
     };
 
-    fileSystems."/nix/.rw-store" = mkImageMediaOverride {
+    fileSystems."/nix/.rw-store" = lib.mkImageMediaOverride {
       fsType = "tmpfs";
       options = [ "mode=0755" ];
       neededForBoot = true;
     };
 
-    fileSystems."/nix/store" = mkImageMediaOverride {
+    fileSystems."/nix/store" = lib.mkImageMediaOverride {
       overlay = {
         lowerdir = [ "/nix/.ro-store" ];
         upperdir = "/nix/.rw-store/store";
diff --git a/nixos/modules/installer/sd-card/sd-image.nix b/nixos/modules/installer/sd-card/sd-image.nix
index b3251f9c6e1d3..4cead16bef792 100644
--- a/nixos/modules/installer/sd-card/sd-image.nix
+++ b/nixos/modules/installer/sd-card/sd-image.nix
@@ -17,9 +17,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   rootfsImage = pkgs.callPackage config.sdImage.rootFilesystemCreator (
     {
@@ -28,17 +25,17 @@ let
       populateImageCommands = config.sdImage.populateRootCommands;
       volumeLabel = config.sdImage.rootVolumeLabel;
     }
-    // optionalAttrs (config.sdImage.rootPartitionUUID != null) {
+    // lib.optionalAttrs (config.sdImage.rootPartitionUUID != null) {
       uuid = config.sdImage.rootPartitionUUID;
     }
   );
 in
 {
   imports = [
-    (mkRemovedOptionModule [ "sdImage" "bootPartitionID" ]
+    (lib.mkRemovedOptionModule [ "sdImage" "bootPartitionID" ]
       "The FAT partition for SD image now only holds the Raspberry Pi firmware files. Use firmwarePartitionID to configure that partition's ID."
     )
-    (mkRemovedOptionModule [ "sdImage" "bootSize" ]
+    (lib.mkRemovedOptionModule [ "sdImage" "bootSize" ]
       "The boot files for SD image have been moved to the main ext4 partition. The FAT partition now only holds the Raspberry Pi firmware files. Changing its size may not be required."
     )
     (lib.mkRenamedOptionModuleWith {
@@ -68,16 +65,16 @@ in
   ];
 
   options.sdImage = {
-    storePaths = mkOption {
-      type = with types; listOf package;
-      example = literalExpression "[ pkgs.stdenv ]";
+    storePaths = lib.mkOption {
+      type = lib.types.listOf lib.types.package;
+      example = lib.literalExpression "[ pkgs.stdenv ]";
       description = ''
         Derivations to be included in the Nix store in the generated SD image.
       '';
     };
 
-    firmwarePartitionOffset = mkOption {
-      type = types.int;
+    firmwarePartitionOffset = lib.mkOption {
+      type = lib.types.int;
       default = 8;
       description = ''
         Gap in front of the /boot/firmware partition, in MiB (1024×1024 bytes).
@@ -91,8 +88,8 @@ in
       '';
     };
 
-    firmwarePartitionID = mkOption {
-      type = types.str;
+    firmwarePartitionID = lib.mkOption {
+      type = lib.types.str;
       default = "0x2178694e";
       description = ''
         Volume ID for the /boot/firmware partition on the SD card. This value
@@ -100,16 +97,16 @@ in
       '';
     };
 
-    firmwarePartitionName = mkOption {
-      type = types.str;
+    firmwarePartitionName = lib.mkOption {
+      type = lib.types.str;
       default = "FIRMWARE";
       description = ''
         Name of the filesystem which holds the boot firmware.
       '';
     };
 
-    rootPartitionUUID = mkOption {
-      type = types.nullOr types.str;
+    rootPartitionUUID = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       default = null;
       example = "14e19a7b-0ae0-484d-9d54-43bd6fdc20c7";
       description = ''
@@ -117,8 +114,8 @@ in
       '';
     };
 
-    rootVolumeLabel = mkOption {
-      type = types.str;
+    rootVolumeLabel = lib.mkOption {
+      type = lib.types.str;
       default = "NIXOS_SD";
       example = "NIXOS_PENDRIVE";
       description = ''
@@ -128,10 +125,10 @@ in
       '';
     };
 
-    rootFilesystemCreator = mkOption {
-      type = types.oneOf [
-        types.package
-        types.path
+    rootFilesystemCreator = lib.mkOption {
+      type = lib.types.oneOf [
+        lib.types.package
+        lib.types.path
       ];
       default = ../../../lib/make-ext4-fs.nix;
       example = ''
@@ -142,8 +139,8 @@ in
       '';
     };
 
-    rootFilesystemImage = mkOption {
-      type = types.package;
+    rootFilesystemImage = lib.mkOption {
+      type = lib.types.package;
       default = rootfsImage;
       description = ''
         The finished root partition image with all custom fileystem modifications.
@@ -151,8 +148,8 @@ in
       '';
     };
 
-    firmwareSize = mkOption {
-      type = types.int;
+    firmwareSize = lib.mkOption {
+      type = lib.types.int;
       # As of 2019-08-18 the Raspberry pi firmware + u-boot takes ~18MiB
       default = 30;
       description = ''
@@ -160,8 +157,8 @@ in
       '';
     };
 
-    populateFirmwareCommands = mkOption {
-      example = literalExpression "'' cp \${pkgs.myBootLoader}/u-boot.bin firmware/ ''";
+    populateFirmwareCommands = lib.mkOption {
+      example = lib.literalExpression "'' cp \${pkgs.myBootLoader}/u-boot.bin firmware/ ''";
       description = ''
         Shell commands to populate the ./firmware directory.
         All files in that directory are copied to the
@@ -169,8 +166,8 @@ in
       '';
     };
 
-    populateRootCommands = mkOption {
-      example = literalExpression "''\${config.boot.loader.generic-extlinux-compatible.populateCmd} -c \${config.system.build.toplevel} -d ./files/boot''";
+    populateRootCommands = lib.mkOption {
+      example = lib.literalExpression "''\${config.boot.loader.generic-extlinux-compatible.populateCmd} -c \${config.system.build.toplevel} -d ./files/boot''";
       description = ''
         Shell commands to populate the ./files directory.
         All files in that directory are copied to the
@@ -179,8 +176,8 @@ in
       '';
     };
 
-    postBuildCommands = mkOption {
-      example = literalExpression "'' dd if=\${pkgs.myBootLoader}/SPL of=$img bs=1024 seek=1 conv=notrunc ''";
+    postBuildCommands = lib.mkOption {
+      example = lib.literalExpression "'' dd if=\${pkgs.myBootLoader}/SPL of=$img bs=1024 seek=1 conv=notrunc ''";
       default = "";
       description = ''
         Shell commands to run after the image is built.
@@ -188,8 +185,8 @@ in
       '';
     };
 
-    compressImage = mkOption {
-      type = types.bool;
+    compressImage = lib.mkOption {
+      type = lib.types.bool;
       default = true;
       description = ''
         Whether the SD image should be compressed using
@@ -197,16 +194,16 @@ in
       '';
     };
 
-    expandOnBoot = mkOption {
-      type = types.bool;
+    expandOnBoot = lib.mkOption {
+      type = lib.types.bool;
       default = true;
       description = ''
         Whether to configure the sd image to expand it's partition on boot.
       '';
     };
 
-    nixPathRegistrationFile = mkOption {
-      type = types.str;
+    nixPathRegistrationFile = lib.mkOption {
+      type = lib.types.str;
       default = "/nix-path-registration";
       description = ''
         Location of the file containing the input for nix-store --load-db once the machine has booted.
@@ -285,11 +282,11 @@ in
           ''}
 
           # Gap in front of the first partition, in MiB
-          gap=${toString config.sdImage.firmwarePartitionOffset}
+          gap=${lib.toString config.sdImage.firmwarePartitionOffset}
 
           # Create the image file sized to fit /boot/firmware and /, plus slack for the gap.
           rootSizeBlocks=$(du -B 512 --apparent-size $root_fs | awk '{ print $1 }')
-          firmwareSizeBlocks=$((${toString config.sdImage.firmwareSize} * 1024 * 1024 / 512))
+          firmwareSizeBlocks=$((${lib.toString config.sdImage.firmwareSize} * 1024 * 1024 / 512))
           imageSize=$((rootSizeBlocks * 512 + firmwareSizeBlocks * 512 + gap * 1024 * 1024))
           truncate -s $imageSize $img
 
@@ -301,7 +298,7 @@ in
               label-id: ${config.sdImage.firmwarePartitionID}
 
               start=''${gap}M, size=$firmwareSizeBlocks, type=b
-              start=$((gap + ${toString config.sdImage.firmwareSize}))M, type=83, bootable
+              start=$((gap + ${lib.toString config.sdImage.firmwareSize}))M, type=83, bootable
           EOF
 
           # Copy the rootfs into the SD image
diff --git a/nixos/modules/profiles/nix-builder-vm.nix b/nixos/modules/profiles/nix-builder-vm.nix
index 3bb9953cf28cd..1d480117821be 100644
--- a/nixos/modules/profiles/nix-builder-vm.nix
+++ b/nixos/modules/profiles/nix-builder-vm.nix
@@ -47,49 +47,49 @@ in
     }
   ];
 
-  options.virtualisation.darwin-builder = with lib; {
-    diskSize = mkOption {
+  options.virtualisation.darwin-builder = {
+    diskSize = lib.mkOption {
       default = 20 * 1024;
-      type = types.int;
+      type = lib.types.int;
       example = 30720;
       description = "The maximum disk space allocated to the runner in MiB (1024×1024 bytes).";
     };
-    memorySize = mkOption {
+    memorySize = lib.mkOption {
       default = 3 * 1024;
-      type = types.int;
+      type = lib.types.int;
       example = 8192;
       description = "The runner's memory in MiB (1024×1024 bytes).";
     };
-    min-free = mkOption {
+    min-free = lib.mkOption {
       default = 1024 * 1024 * 1024;
-      type = types.int;
+      type = lib.types.int;
       example = 1073741824;
       description = ''
         The threshold (in bytes) of free disk space left at which to
         start garbage collection on the runner
       '';
     };
-    max-free = mkOption {
+    max-free = lib.mkOption {
       default = 3 * 1024 * 1024 * 1024;
-      type = types.int;
+      type = lib.types.int;
       example = 3221225472;
       description = ''
         The threshold (in bytes) of free disk space left at which to
         stop garbage collection on the runner
       '';
     };
-    workingDirectory = mkOption {
+    workingDirectory = lib.mkOption {
       default = ".";
-      type = types.str;
+      type = lib.types.str;
       example = "/var/lib/darwin-builder";
       description = ''
         The working directory to use to run the script. When running
         as part of a flake will need to be set to a non read-only filesystem.
       '';
     };
-    hostPort = mkOption {
+    hostPort = lib.mkOption {
       default = 31022;
-      type = types.port;
+      type = lib.types.port;
       example = 22;
       description = ''
         The localhost host port to forward TCP to the guest port.
diff --git a/nixos/modules/programs/nix-index.nix b/nixos/modules/programs/nix-index.nix
index 21e9eb9e17656..161fbe234e196 100644
--- a/nixos/modules/programs/nix-index.nix
+++ b/nixos/modules/programs/nix-index.nix
@@ -8,20 +8,20 @@ let
   cfg = config.programs.nix-index;
 in
 {
-  options.programs.nix-index = with lib; {
-    enable = mkEnableOption "nix-index, a file database for nixpkgs";
+  options.programs.nix-index = {
+    enable = lib.mkEnableOption "nix-index, a file database for nixpkgs";
 
-    package = mkPackageOption pkgs "nix-index" { };
+    package = lib.mkPackageOption pkgs "nix-index" { };
 
-    enableBashIntegration = mkEnableOption "Bash integration" // {
+    enableBashIntegration = lib.mkEnableOption "Bash integration" // {
       default = true;
     };
 
-    enableZshIntegration = mkEnableOption "Zsh integration" // {
+    enableZshIntegration = lib.mkEnableOption "Zsh integration" // {
       default = true;
     };
 
-    enableFishIntegration = mkEnableOption "Fish integration" // {
+    enableFishIntegration = lib.mkEnableOption "Fish integration" // {
       default = true;
     };
   };
diff --git a/nixos/modules/programs/nix-required-mounts.nix b/nixos/modules/programs/nix-required-mounts.nix
index a7ec09fe5f9a4..0ffcd673808b4 100644
--- a/nixos/modules/programs/nix-required-mounts.nix
+++ b/nixos/modules/programs/nix-required-mounts.nix
@@ -9,18 +9,16 @@ let
   cfg = config.programs.nix-required-mounts;
   package = pkgs.nix-required-mounts;
 
-  Mount =
-    with lib;
-    types.submodule {
-      options.host = mkOption {
-        type = types.str;
-        description = "Host path to mount";
-      };
-      options.guest = mkOption {
-        type = types.str;
-        description = "Location in the sandbox to mount the host path at";
-      };
+  Mount = lib.types.submodule {
+    options.host = lib.mkOption {
+      type = lib.types.str;
+      description = "Host path to mount";
     };
+    options.guest = lib.mkOption {
+      type = lib.types.str;
+      description = "Location in the sandbox to mount the host path at";
+    };
+  };
   Pattern =
     with lib.types;
     types.submodule (
diff --git a/nixos/modules/programs/wayland/lib.nix b/nixos/modules/programs/wayland/lib.nix
index bc130b7c0e58c..d7b18b48f56bc 100644
--- a/nixos/modules/programs/wayland/lib.nix
+++ b/nixos/modules/programs/wayland/lib.nix
@@ -5,9 +5,9 @@
     pkg: args:
     let
       expectedArgs = lib.naturalSort (lib.attrNames args);
-      existingArgs =
-        with lib;
-        naturalSort (intersectLists expectedArgs (attrNames (functionArgs pkg.override)));
+      existingArgs = lib.naturalSort (
+        lib.intersectLists expectedArgs (lib.attrNames (lib.functionArgs pkg.override))
+      );
     in
     if existingArgs != expectedArgs then pkg else pkg.override args;
 }
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index 21859a64d74b4..d15d31aff2118 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -2388,26 +2388,23 @@ in
       lib.concatMapStrings (name: "r ${config.environment.etc."pam.d/${name}".source},\n") (
         lib.attrNames enabledServices
       )
-      + (
-        with lib;
-        pipe enabledServices [
-          lib.attrValues
-          (catAttrs "rules")
-          (lib.concatMap lib.attrValues)
-          (lib.concatMap lib.attrValues)
-          (lib.filter (rule: rule.enable))
-          (lib.catAttrs "modulePath")
-          (map (
-            modulePath:
-            lib.throwIfNot (lib.hasPrefix "/" modulePath)
-              ''non-absolute PAM modulePath "${modulePath}" is unsupported by apparmor''
-              modulePath
-          ))
-          lib.unique
-          (map (module: "mr ${module},"))
-          concatLines
-        ]
-      );
+      + (lib.pipe enabledServices [
+        lib.attrValues
+        (lib.catAttrs "rules")
+        (lib.concatMap lib.attrValues)
+        (lib.concatMap lib.attrValues)
+        (lib.filter (rule: rule.enable))
+        (lib.catAttrs "modulePath")
+        (lib.map (
+          modulePath:
+          lib.throwIfNot (lib.hasPrefix "/" modulePath)
+            ''non-absolute PAM modulePath "${modulePath}" is unsupported by apparmor''
+            modulePath
+        ))
+        lib.unique
+        (lib.map (module: "mr ${module},"))
+        lib.concatLines
+      ]);
 
     security.sudo.extraConfig = optionalSudoConfigForSSHAgentAuth;
     security.sudo-rs.extraConfig = optionalSudoConfigForSSHAgentAuth;
diff --git a/nixos/modules/security/rtkit.nix b/nixos/modules/security/rtkit.nix
index f2cd256468da9..0587e61b22772 100644
--- a/nixos/modules/security/rtkit.nix
+++ b/nixos/modules/security/rtkit.nix
@@ -8,20 +8,16 @@
   utils,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.security.rtkit;
   package = pkgs.rtkit;
-
 in
 {
 
   options = {
 
-    security.rtkit.enable = mkOption {
-      type = types.bool;
+    security.rtkit.enable = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Whether to enable the RealtimeKit system service, which hands
@@ -31,8 +27,8 @@ in
       '';
     };
 
-    security.rtkit.args = mkOption {
-      type = types.listOf types.str;
+    security.rtkit.args = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [ ];
       description = ''
         Command-line options for `rtkit-daemon`.
@@ -45,7 +41,7 @@ in
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     security.polkit.enable = true;
 
diff --git a/nixos/modules/services/admin/meshcentral.nix b/nixos/modules/services/admin/meshcentral.nix
index f736429fd234d..69e487c1940ab 100644
--- a/nixos/modules/services/admin/meshcentral.nix
+++ b/nixos/modules/services/admin/meshcentral.nix
@@ -9,12 +9,11 @@ let
   configFormat = pkgs.formats.json { };
   configFile = configFormat.generate "meshcentral-config.json" cfg.settings;
 in
-with lib;
 {
-  options.services.meshcentral = with types; {
-    enable = mkEnableOption "MeshCentral computer management server";
-    package = mkPackageOption pkgs "meshcentral" { };
-    settings = mkOption {
+  options.services.meshcentral = {
+    enable = lib.mkEnableOption "MeshCentral computer management server";
+    package = lib.mkPackageOption pkgs "meshcentral" { };
+    settings = lib.mkOption {
       description = ''
         Settings for MeshCentral. Refer to upstream documentation for details:
 
@@ -23,8 +22,8 @@ with lib;
         - [complex sample configuration](https://github.com/Ylianst/MeshCentral/blob/master/sample-config-advanced.json)
         - [Old homepage with documentation link](https://www.meshcommander.com/meshcentral2)
       '';
-      type = types.submodule {
-        freeformType = attrsOf configFormat.type;
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf configFormat.type;
       };
       example = {
         settings = {
@@ -37,7 +36,7 @@ with lib;
       };
     };
   };
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     services.meshcentral.settings.settings.autoBackup.backupPath =
       lib.mkDefault "/var/lib/meshcentral/backups";
     systemd.services.meshcentral = {
diff --git a/nixos/modules/services/audio/mympd.nix b/nixos/modules/services/audio/mympd.nix
index 3e728abaa4dec..c8bb5c4453608 100644
--- a/nixos/modules/services/audio/mympd.nix
+++ b/nixos/modules/services/audio/mympd.nix
@@ -85,17 +85,19 @@ in
       # upstream service config: https://github.com/jcorporation/myMPD/blob/master/contrib/initscripts/mympd.service.in
       after = [ "mpd.service" ];
       wantedBy = [ "multi-user.target" ];
-      preStart = with lib; ''
+      preStart = ''
         config_dir="/var/lib/mympd/config"
         mkdir -p "$config_dir"
 
-        ${pipe cfg.settings [
-          (mapAttrsToList (
+        ${lib.pipe cfg.settings [
+          (lib.mapAttrsToList (
             name: value: ''
-              echo -n "${if isBool value then boolToString value else toString value}" > "$config_dir/${name}"
+              echo -n "${
+                if lib.isBool value then lib.boolToString value else toString value
+              }" > "$config_dir/${name}"
             ''
           ))
-          (concatStringsSep "\n")
+          (lib.concatStringsSep "\n")
         ]}
       '';
       unitConfig = {
diff --git a/nixos/modules/services/cluster/kubernetes/kubelet.nix b/nixos/modules/services/cluster/kubernetes/kubelet.nix
index 46e7c7c2550a1..3627bbe8ac680 100644
--- a/nixos/modules/services/cluster/kubernetes/kubelet.nix
+++ b/nixos/modules/services/cluster/kubernetes/kubelet.nix
@@ -5,9 +5,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   top = config.services.kubernetes;
   otop = options.services.kubernetes;
@@ -21,7 +18,7 @@ let
     else
       (pkgs.buildEnv {
         name = "kubernetes-cni-config";
-        paths = imap (
+        paths = lib.imap (
           i: entry: pkgs.writeTextDir "${toString (10 + i)}-${entry.type}.conf" (builtins.toJSON entry)
         ) cfg.cni.config;
       });
@@ -82,24 +79,23 @@ let
   manifestPath = "kubernetes/manifests";
 
   taintOptions =
-    with lib.types;
     { name, ... }:
     {
       options = {
-        key = mkOption {
+        key = lib.mkOption {
           description = "Key of taint.";
           default = name;
-          defaultText = literalMD "Name of this submodule.";
-          type = str;
+          defaultText = lib.literalMD "Name of this submodule.";
+          type = lib.types.str;
         };
-        value = mkOption {
+        value = lib.mkOption {
           description = "Value of taint.";
-          type = str;
+          type = lib.types.str;
         };
-        effect = mkOption {
+        effect = lib.mkOption {
           description = "Effect of taint.";
           example = "NoSchedule";
-          type = enum [
+          type = lib.types.enum [
             "NoSchedule"
             "PreferNoSchedule"
             "NoExecute"
@@ -108,58 +104,60 @@ let
       };
     };
 
-  taints = concatMapStringsSep "," (v: "${v.key}=${v.value}:${v.effect}") (attrValues cfg.taints);
+  taints = lib.concatMapStringsSep "," (v: "${v.key}=${v.value}:${v.effect}") (
+    lib.attrValues cfg.taints
+  );
 in
 {
   imports = [
-    (mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "applyManifests" ] "")
-    (mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "cadvisorPort" ] "")
-    (mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "allowPrivileged" ] "")
-    (mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "networkPlugin" ] "")
-    (mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "containerRuntime" ] "")
+    (lib.mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "applyManifests" ] "")
+    (lib.mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "cadvisorPort" ] "")
+    (lib.mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "allowPrivileged" ] "")
+    (lib.mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "networkPlugin" ] "")
+    (lib.mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "containerRuntime" ] "")
   ];
 
   ###### interface
-  options.services.kubernetes.kubelet = with lib.types; {
+  options.services.kubernetes.kubelet = {
 
-    address = mkOption {
+    address = lib.mkOption {
       description = "Kubernetes kubelet info server listening address.";
       default = "0.0.0.0";
-      type = str;
+      type = lib.types.str;
     };
 
-    clusterDns = mkOption {
+    clusterDns = lib.mkOption {
       description = "Use alternative DNS.";
       default = [ "10.1.0.1" ];
-      type = listOf str;
+      type = lib.types.listOf lib.types.str;
     };
 
-    clusterDomain = mkOption {
+    clusterDomain = lib.mkOption {
       description = "Use alternative domain.";
       default = config.services.kubernetes.addons.dns.clusterDomain;
-      defaultText = literalExpression "config.${options.services.kubernetes.addons.dns.clusterDomain}";
-      type = str;
+      defaultText = lib.literalExpression "config.${options.services.kubernetes.addons.dns.clusterDomain}";
+      type = lib.types.str;
     };
 
-    clientCaFile = mkOption {
+    clientCaFile = lib.mkOption {
       description = "Kubernetes apiserver CA file for client authentication.";
       default = top.caFile;
-      defaultText = literalExpression "config.${otop.caFile}";
-      type = nullOr path;
+      defaultText = lib.literalExpression "config.${otop.caFile}";
+      type = lib.types.nullOr lib.types.path;
     };
 
     cni = {
-      packages = mkOption {
+      packages = lib.mkOption {
         description = "List of network plugin packages to install.";
-        type = listOf package;
+        type = lib.types.listOf lib.types.package;
         default = [ ];
       };
 
-      config = mkOption {
+      config = lib.mkOption {
         description = "Kubernetes CNI configuration.";
-        type = listOf attrs;
+        type = lib.types.listOf lib.types.attrs;
         default = [ ];
-        example = literalExpression ''
+        example = lib.literalExpression ''
           [{
             "cniVersion": "0.3.1",
             "name": "mynet",
@@ -181,28 +179,28 @@ in
         '';
       };
 
-      configDir = mkOption {
+      configDir = lib.mkOption {
         description = "Path to Kubernetes CNI configuration directory.";
-        type = nullOr path;
+        type = lib.types.nullOr lib.types.path;
         default = null;
       };
     };
 
-    containerRuntimeEndpoint = mkOption {
+    containerRuntimeEndpoint = lib.mkOption {
       description = "Endpoint at which to find the container runtime api interface/socket";
-      type = str;
+      type = lib.types.str;
       default = "unix:///run/containerd/containerd.sock";
     };
 
-    enable = mkEnableOption "Kubernetes kubelet";
+    enable = lib.mkEnableOption "Kubernetes kubelet";
 
-    extraOpts = mkOption {
+    extraOpts = lib.mkOption {
       description = "Kubernetes kubelet extra command line options.";
       default = "";
-      type = separatedString " ";
+      type = lib.types.separatedString " ";
     };
 
-    extraConfig = mkOption {
+    extraConfig = lib.mkOption {
       description = ''
         Kubernetes kubelet extra configuration file entries.
 
@@ -210,106 +208,106 @@ in
         and [Kubelet Configuration](https://kubernetes.io/docs/reference/config-api/kubelet-config.v1beta1/).
       '';
       default = { };
-      type = attrsOf ((pkgs.formats.json { }).type);
+      type = lib.types.attrsOf ((pkgs.formats.json { }).type);
     };
 
-    featureGates = mkOption {
+    featureGates = lib.mkOption {
       description = "Attribute set of feature gate";
       default = top.featureGates;
-      defaultText = literalExpression "config.${otop.featureGates}";
-      type = attrsOf bool;
+      defaultText = lib.literalExpression "config.${otop.featureGates}";
+      type = lib.types.attrsOf lib.types.bool;
     };
 
     healthz = {
-      bind = mkOption {
+      bind = lib.mkOption {
         description = "Kubernetes kubelet healthz listening address.";
         default = "127.0.0.1";
-        type = str;
+        type = lib.types.str;
       };
 
-      port = mkOption {
+      port = lib.mkOption {
         description = "Kubernetes kubelet healthz port.";
         default = 10248;
-        type = port;
+        type = lib.types.port;
       };
     };
 
-    hostname = mkOption {
+    hostname = lib.mkOption {
       description = "Kubernetes kubelet hostname override.";
-      defaultText = literalExpression "config.networking.fqdnOrHostName";
-      type = str;
+      defaultText = lib.literalExpression "config.networking.fqdnOrHostName";
+      type = lib.types.str;
     };
 
     kubeconfig = top.lib.mkKubeConfigOptions "Kubelet";
 
-    manifests = mkOption {
+    manifests = lib.mkOption {
       description = "List of manifests to bootstrap with kubelet (only pods can be created as manifest entry)";
-      type = attrsOf attrs;
+      type = lib.types.attrsOf lib.types.attrs;
       default = { };
     };
 
-    nodeIp = mkOption {
+    nodeIp = lib.mkOption {
       description = "IP address of the node. If set, kubelet will use this IP address for the node.";
       default = null;
-      type = nullOr str;
+      type = lib.types.nullOr lib.types.str;
     };
 
-    registerNode = mkOption {
+    registerNode = lib.mkOption {
       description = "Whether to auto register kubelet with API server.";
       default = true;
-      type = bool;
+      type = lib.types.bool;
     };
 
-    port = mkOption {
+    port = lib.mkOption {
       description = "Kubernetes kubelet info server listening port.";
       default = 10250;
-      type = port;
+      type = lib.types.port;
     };
 
-    seedDockerImages = mkOption {
+    seedDockerImages = lib.mkOption {
       description = "List of docker images to preload on system";
       default = [ ];
-      type = listOf package;
+      type = lib.types.listOf lib.types.package;
     };
 
-    taints = mkOption {
+    taints = lib.mkOption {
       description = "Node taints (https://kubernetes.io/docs/concepts/configuration/assign-pod-node/).";
       default = { };
-      type = attrsOf (submodule [ taintOptions ]);
+      type = lib.types.attrsOf (lib.types.submodule [ taintOptions ]);
     };
 
-    tlsCertFile = mkOption {
+    tlsCertFile = lib.mkOption {
       description = "File containing x509 Certificate for HTTPS.";
       default = null;
-      type = nullOr path;
+      type = lib.types.nullOr lib.types.path;
     };
 
-    tlsKeyFile = mkOption {
+    tlsKeyFile = lib.mkOption {
       description = "File containing x509 private key matching tlsCertFile.";
       default = null;
-      type = nullOr path;
+      type = lib.types.nullOr lib.types.path;
     };
 
-    unschedulable = mkOption {
+    unschedulable = lib.mkOption {
       description = "Whether to set node taint to unschedulable=true as it is the case of node that has only master role.";
       default = false;
-      type = bool;
+      type = lib.types.bool;
     };
 
-    verbosity = mkOption {
+    verbosity = lib.mkOption {
       description = ''
         Optional glog verbosity level for logging statements. See
         <https://github.com/kubernetes/community/blob/master/contributors/devel/logging.md>
       '';
       default = null;
-      type = nullOr int;
+      type = lib.types.nullOr lib.types.int;
     };
 
   };
 
   ###### implementation
-  config = mkMerge [
-    (mkIf cfg.enable {
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
 
       environment.etc."cni/net.d".source = cniConfig;
 
@@ -344,7 +342,7 @@ in
           ++ lib.optional config.boot.zfs.enabled config.boot.zfs.package
           ++ top.path;
         preStart = ''
-          ${concatMapStrings (img: ''
+          ${lib.concatMapStrings (img: ''
             echo "Seeding container image: ${img}"
             ${
               if (lib.hasSuffix "gz" img) then
@@ -355,7 +353,7 @@ in
           '') cfg.seedDockerImages}
 
           rm /opt/cni/bin/* || true
-          ${concatMapStrings (package: ''
+          ${lib.concatMapStrings (package: ''
             echo "Linking cni package: ${package}"
             ln -fs ${package}/bin/* /opt/cni/bin
           '') cfg.cni.packages}
@@ -370,12 +368,14 @@ in
                         --config=${kubeletConfig} \
                         --hostname-override=${cfg.hostname} \
                         --kubeconfig=${kubeconfig} \
-                        ${optionalString (cfg.nodeIp != null) "--node-ip=${cfg.nodeIp}"} \
+                        ${lib.optionalString (cfg.nodeIp != null) "--node-ip=${cfg.nodeIp}"} \
                         --pod-infra-container-image=pause \
-                        ${optionalString (cfg.manifests != { }) "--pod-manifest-path=/etc/${manifestPath}"} \
-                        ${optionalString (taints != "") "--register-with-taints=${taints}"} \
+                        ${
+                          lib.optionalString (cfg.manifests != { }) "--pod-manifest-path=/etc/${manifestPath}"
+                        } \
+                        ${lib.optionalString (taints != "") "--register-with-taints=${taints}"} \
                         --root-dir=${top.dataDir} \
-                        ${optionalString (cfg.verbosity != null) "--v=${toString cfg.verbosity}"} \
+                        ${lib.optionalString (cfg.verbosity != null) "--v=${toString cfg.verbosity}"} \
                         ${cfg.extraOpts}
           '';
           WorkingDirectory = top.dataDir;
@@ -396,7 +396,7 @@ in
         "overlay"
       ];
 
-      services.kubernetes.kubelet.hostname = mkDefault (lib.toLower config.networking.fqdnOrHostName);
+      services.kubernetes.kubelet.hostname = lib.mkDefault (lib.toLower config.networking.fqdnOrHostName);
 
       services.kubernetes.pki.certs = with top.lib; {
         kubelet = mkCert {
@@ -415,20 +415,20 @@ in
         };
       };
 
-      services.kubernetes.kubelet.kubeconfig.server = mkDefault top.apiserverAddress;
+      services.kubernetes.kubelet.kubeconfig.server = lib.mkDefault top.apiserverAddress;
     })
 
-    (mkIf (cfg.enable && cfg.manifests != { }) {
-      environment.etc = mapAttrs' (
+    (lib.mkIf (cfg.enable && cfg.manifests != { }) {
+      environment.etc = lib.mapAttrs' (
         name: manifest:
-        nameValuePair "${manifestPath}/${name}.json" {
+        lib.nameValuePair "${manifestPath}/${name}.json" {
           text = builtins.toJSON manifest;
           mode = "0755";
         }
       ) cfg.manifests;
     })
 
-    (mkIf (cfg.unschedulable && cfg.enable) {
+    (lib.mkIf (cfg.unschedulable && cfg.enable) {
       services.kubernetes.kubelet.taints.unschedulable = {
         value = "true";
         effect = "NoSchedule";
diff --git a/nixos/modules/services/cluster/kubernetes/pki.nix b/nixos/modules/services/cluster/kubernetes/pki.nix
index e4f8cf44e7033..03df146e55cc0 100644
--- a/nixos/modules/services/cluster/kubernetes/pki.nix
+++ b/nixos/modules/services/cluster/kubernetes/pki.nix
@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   top = config.services.kubernetes;
   cfg = top.pki;
@@ -17,7 +14,7 @@ let
         algo = "rsa";
         size = 2048;
       };
-      names = singleton cfg.caSpec;
+      names = lib.singleton cfg.caSpec;
     }
   );
 
@@ -45,74 +42,74 @@ let
       keyFile = key;
     };
 
-  remote = with config.services; "https://${kubernetes.masterAddress}:${toString cfssl.port}";
+  remote = "https://${config.services.kubernetes.masterAddress}:${toString config.services.cfssl.port}";
 in
 {
   ###### interface
-  options.services.kubernetes.pki = with lib.types; {
+  options.services.kubernetes.pki = {
 
-    enable = mkEnableOption "easyCert issuer service";
+    enable = lib.mkEnableOption "easyCert issuer service";
 
-    certs = mkOption {
+    certs = lib.mkOption {
       description = "List of certificate specs to feed to cert generator.";
       default = { };
-      type = attrs;
+      type = lib.types.attrs;
     };
 
-    genCfsslCACert = mkOption {
+    genCfsslCACert = lib.mkOption {
       description = ''
         Whether to automatically generate cfssl CA certificate and key,
         if they don't exist.
       '';
       default = true;
-      type = bool;
+      type = lib.types.bool;
     };
 
-    genCfsslAPICerts = mkOption {
+    genCfsslAPICerts = lib.mkOption {
       description = ''
         Whether to automatically generate cfssl API webserver TLS cert and key,
         if they don't exist.
       '';
       default = true;
-      type = bool;
+      type = lib.types.bool;
     };
 
-    cfsslAPIExtraSANs = mkOption {
+    cfsslAPIExtraSANs = lib.mkOption {
       description = ''
         Extra x509 Subject Alternative Names to be added to the cfssl API webserver TLS cert.
       '';
       default = [ ];
       example = [ "subdomain.example.com" ];
-      type = listOf str;
+      type = lib.types.listOf lib.types.str;
     };
 
-    genCfsslAPIToken = mkOption {
+    genCfsslAPIToken = lib.mkOption {
       description = ''
         Whether to automatically generate cfssl API-token secret,
         if they doesn't exist.
       '';
       default = true;
-      type = bool;
+      type = lib.types.bool;
     };
 
-    pkiTrustOnBootstrap = mkOption {
+    pkiTrustOnBootstrap = lib.mkOption {
       description = "Whether to always trust remote cfssl server upon initial PKI bootstrap.";
       default = true;
-      type = bool;
+      type = lib.types.bool;
     };
 
-    caCertPathPrefix = mkOption {
+    caCertPathPrefix = lib.mkOption {
       description = ''
         Path-prefrix for the CA-certificate to be used for cfssl signing.
         Suffixes ".pem" and "-key.pem" will be automatically appended for
         the public and private keys respectively.
       '';
       default = "${config.services.cfssl.dataDir}/ca";
-      defaultText = literalExpression ''"''${config.services.cfssl.dataDir}/ca"'';
-      type = str;
+      defaultText = lib.literalExpression ''"''${config.services.cfssl.dataDir}/ca"'';
+      type = lib.types.str;
     };
 
-    caSpec = mkOption {
+    caSpec = lib.mkOption {
       description = "Certificate specification for the auto-generated CAcert.";
       default = {
         CN = "kubernetes-cluster-ca";
@@ -120,22 +117,22 @@ in
         OU = "services.kubernetes.pki.caSpec";
         L = "auto-generated";
       };
-      type = attrs;
+      type = lib.types.attrs;
     };
 
-    etcClusterAdminKubeconfig = mkOption {
+    etcClusterAdminKubeconfig = lib.mkOption {
       description = ''
         Symlink a kubeconfig with cluster-admin privileges to environment path
         (/etc/\<path\>).
       '';
       default = null;
-      type = nullOr str;
+      type = lib.types.nullOr lib.types.str;
     };
 
   };
 
   ###### implementation
-  config = mkIf cfg.enable (
+  config = lib.mkIf cfg.enable (
     let
       cfsslCertPathPrefix = "${config.services.cfssl.dataDir}/cfssl";
       cfsslCert = "${cfsslCertPathPrefix}.pem";
@@ -143,7 +140,7 @@ in
     in
     {
 
-      services.cfssl = mkIf (top.apiserver.enable) {
+      services.cfssl = lib.mkIf (top.apiserver.enable) {
         enable = true;
         address = "0.0.0.0";
         tlsCert = cfsslCert;
@@ -172,24 +169,25 @@ in
       };
 
       systemd.services.cfssl.preStart =
-        with pkgs;
-        with config.services.cfssl;
-        mkIf (top.apiserver.enable) (
-          concatStringsSep "\n" [
+        let
+          cfsslDataDir = config.services.cfssl.dataDir;
+        in
+        lib.mkIf (top.apiserver.enable) (
+          lib.concatStringsSep "\n" [
             "set -e"
-            (optionalString cfg.genCfsslCACert ''
+            (lib.optionalString cfg.genCfsslCACert ''
               if [ ! -f "${cfg.caCertPathPrefix}.pem" ]; then
-                ${cfssl}/bin/cfssl genkey -initca ${csrCA} | \
-                  ${cfssl}/bin/cfssljson -bare ${cfg.caCertPathPrefix}
+                ${pkgs.cfssl}/bin/cfssl genkey -initca ${csrCA} | \
+                  ${pkgs.cfssl}/bin/cfssljson -bare ${cfg.caCertPathPrefix}
               fi
             '')
-            (optionalString cfg.genCfsslAPICerts ''
-              if [ ! -f "${dataDir}/cfssl.pem" ]; then
-                ${cfssl}/bin/cfssl gencert -ca "${cfg.caCertPathPrefix}.pem" -ca-key "${cfg.caCertPathPrefix}-key.pem" ${csrCfssl} | \
-                  ${cfssl}/bin/cfssljson -bare ${cfsslCertPathPrefix}
+            (lib.optionalString cfg.genCfsslAPICerts ''
+              if [ ! -f "${cfsslDataDir}/cfssl.pem" ]; then
+                ${pkgs.cfssl}/bin/cfssl gencert -ca "${cfg.caCertPathPrefix}.pem" -ca-key "${cfg.caCertPathPrefix}-key.pem" ${csrCfssl} | \
+                  ${pkgs.cfssl}/bin/cfssljson -bare ${cfsslCertPathPrefix}
               fi
             '')
-            (optionalString cfg.genCfsslAPIToken ''
+            (lib.optionalString cfg.genCfsslAPIToken ''
               if [ ! -f "${cfsslAPITokenPath}" ]; then
                 install -o cfssl -m 400 <(head -c ${
                   toString (cfsslAPITokenLength / 2)
@@ -203,7 +201,7 @@ in
         description = "Kubernetes certmgr bootstrapper";
         wantedBy = [ "certmgr.service" ];
         after = [ "cfssl.target" ];
-        script = concatStringsSep "\n" [
+        script = lib.concatStringsSep "\n" [
           ''
             set -e
 
@@ -219,7 +217,7 @@ in
               install -m 600 /dev/null "${certmgrAPITokenPath}"
             fi
           ''
-          (optionalString (cfg.pkiTrustOnBootstrap) ''
+          (lib.optionalString (cfg.pkiTrustOnBootstrap) ''
             if [ ! -f "${top.caFile}" ] || [ $(cat "${top.caFile}" | wc -c) -lt 1 ]; then
               ${pkgs.curl}/bin/curl --fail-early -f -kd '{}' ${remote}/api/v1/cfssl/info | \
                 ${pkgs.cfssl}/bin/cfssljson -stdout >${top.caFile}
@@ -261,7 +259,7 @@ in
               };
             };
           in
-          mapAttrs mkSpec cfg.certs;
+          lib.mapAttrs mkSpec cfg.certs;
       };
 
       #TODO: Get rid of kube-addon-manager in the future for the following reasons
@@ -269,38 +267,39 @@ in
       # - it assumes that it is clusterAdmin or can gain clusterAdmin rights through serviceAccount
       # - it is designed to be used with k8s system components only
       # - it would be better with a more Nix-oriented way of managing addons
-      systemd.services.kube-addon-manager = mkIf top.addonManager.enable (mkMerge [
-        {
-          environment.KUBECONFIG =
-            with cfg.certs.addonManager;
-            top.lib.mkKubeConfig "addon-manager" {
-              server = top.apiserverAddress;
-              certFile = cert;
-              keyFile = key;
-            };
-        }
-
-        (optionalAttrs (top.addonManager.bootstrapAddons != { }) {
-          serviceConfig.PermissionsStartOnly = true;
-          preStart =
-            with pkgs;
-            let
-              files = mapAttrsToList (
-                n: v: writeText "${n}.json" (builtins.toJSON v)
-              ) top.addonManager.bootstrapAddons;
-            in
-            ''
-              export KUBECONFIG=${clusterAdminKubeconfig}
-              ${top.package}/bin/kubectl apply -f ${concatStringsSep " \\\n -f " files}
-            '';
-        })
-      ]);
-
-      environment.etc.${cfg.etcClusterAdminKubeconfig}.source = mkIf (
+      systemd.services.kube-addon-manager = lib.mkIf top.addonManager.enable (
+        lib.mkMerge [
+          {
+            environment.KUBECONFIG =
+              with cfg.certs.addonManager;
+              top.lib.mkKubeConfig "addon-manager" {
+                server = top.apiserverAddress;
+                certFile = cert;
+                keyFile = key;
+              };
+          }
+
+          (lib.optionalAttrs (top.addonManager.bootstrapAddons != { }) {
+            serviceConfig.PermissionsStartOnly = true;
+            preStart =
+              let
+                files = lib.mapAttrsToList (
+                  n: v: pkgs.writeText "${n}.json" (builtins.toJSON v)
+                ) top.addonManager.bootstrapAddons;
+              in
+              ''
+                export KUBECONFIG=${clusterAdminKubeconfig}
+                ${top.package}/bin/kubectl apply -f ${lib.concatStringsSep " \\\n -f " files}
+              '';
+          })
+        ]
+      );
+
+      environment.etc.${cfg.etcClusterAdminKubeconfig}.source = lib.mkIf (
         cfg.etcClusterAdminKubeconfig != null
       ) clusterAdminKubeconfig;
 
-      environment.systemPackages = mkIf (top.kubelet.enable || top.proxy.enable) [
+      environment.systemPackages = lib.mkIf (top.kubelet.enable || top.proxy.enable) [
         (pkgs.writeScriptBin "nixos-kubernetes-node-join" ''
           set -e
           exec 1>&2
@@ -331,19 +330,19 @@ in
 
           echo "Waiting for certs to appear..." >&1
 
-          ${optionalString top.kubelet.enable ''
+          ${lib.optionalString top.kubelet.enable ''
             while [ ! -f ${cfg.certs.kubelet.cert} ]; do sleep 1; done
             echo "Restarting kubelet..." >&1
             systemctl restart kubelet
           ''}
 
-          ${optionalString top.proxy.enable ''
+          ${lib.optionalString top.proxy.enable ''
             while [ ! -f ${cfg.certs.kubeProxyClient.cert} ]; do sleep 1; done
             echo "Restarting kube-proxy..." >&1
             systemctl restart kube-proxy
           ''}
 
-          ${optionalString top.flannel.enable ''
+          ${lib.optionalString top.flannel.enable ''
             while [ ! -f ${cfg.certs.flannelClient.cert} ]; do sleep 1; done
             echo "Restarting flannel..." >&1
             systemctl restart flannel
@@ -361,11 +360,11 @@ in
         advertiseClientUrls = [ "https://etcd.local:2379" ];
         initialCluster = [ "${top.masterAddress}=https://etcd.local:2380" ];
         initialAdvertisePeerUrls = [ "https://etcd.local:2380" ];
-        certFile = mkDefault cert;
-        keyFile = mkDefault key;
-        trustedCaFile = mkDefault caCert;
+        certFile = lib.mkDefault cert;
+        keyFile = lib.mkDefault key;
+        trustedCaFile = lib.mkDefault caCert;
       };
-      networking.extraHosts = mkIf (config.services.etcd.enable) ''
+      networking.extraHosts = lib.mkIf (config.services.etcd.enable) ''
         127.0.0.1 etcd.${top.addons.dns.clusterDomain} etcd.local
       '';
 
@@ -379,54 +378,54 @@ in
 
       services.kubernetes = {
 
-        apiserver = mkIf top.apiserver.enable (
+        apiserver = lib.mkIf top.apiserver.enable (
           with cfg.certs.apiServer;
           {
             etcd = with cfg.certs.apiserverEtcdClient; {
               servers = [ "https://etcd.local:2379" ];
-              certFile = mkDefault cert;
-              keyFile = mkDefault key;
-              caFile = mkDefault caCert;
+              certFile = lib.mkDefault cert;
+              keyFile = lib.mkDefault key;
+              caFile = lib.mkDefault caCert;
             };
-            clientCaFile = mkDefault caCert;
-            tlsCertFile = mkDefault cert;
-            tlsKeyFile = mkDefault key;
-            serviceAccountKeyFile = mkDefault cfg.certs.serviceAccount.cert;
-            serviceAccountSigningKeyFile = mkDefault cfg.certs.serviceAccount.key;
-            kubeletClientCaFile = mkDefault caCert;
-            kubeletClientCertFile = mkDefault cfg.certs.apiserverKubeletClient.cert;
-            kubeletClientKeyFile = mkDefault cfg.certs.apiserverKubeletClient.key;
-            proxyClientCertFile = mkDefault cfg.certs.apiserverProxyClient.cert;
-            proxyClientKeyFile = mkDefault cfg.certs.apiserverProxyClient.key;
+            clientCaFile = lib.mkDefault caCert;
+            tlsCertFile = lib.mkDefault cert;
+            tlsKeyFile = lib.mkDefault key;
+            serviceAccountKeyFile = lib.mkDefault cfg.certs.serviceAccount.cert;
+            serviceAccountSigningKeyFile = lib.mkDefault cfg.certs.serviceAccount.key;
+            kubeletClientCaFile = lib.mkDefault caCert;
+            kubeletClientCertFile = lib.mkDefault cfg.certs.apiserverKubeletClient.cert;
+            kubeletClientKeyFile = lib.mkDefault cfg.certs.apiserverKubeletClient.key;
+            proxyClientCertFile = lib.mkDefault cfg.certs.apiserverProxyClient.cert;
+            proxyClientKeyFile = lib.mkDefault cfg.certs.apiserverProxyClient.key;
           }
         );
-        controllerManager = mkIf top.controllerManager.enable {
-          serviceAccountKeyFile = mkDefault cfg.certs.serviceAccount.key;
+        controllerManager = lib.mkIf top.controllerManager.enable {
+          serviceAccountKeyFile = lib.mkDefault cfg.certs.serviceAccount.key;
           rootCaFile = cfg.certs.controllerManagerClient.caCert;
           kubeconfig = with cfg.certs.controllerManagerClient; {
-            certFile = mkDefault cert;
-            keyFile = mkDefault key;
+            certFile = lib.mkDefault cert;
+            keyFile = lib.mkDefault key;
           };
         };
-        scheduler = mkIf top.scheduler.enable {
+        scheduler = lib.mkIf top.scheduler.enable {
           kubeconfig = with cfg.certs.schedulerClient; {
-            certFile = mkDefault cert;
-            keyFile = mkDefault key;
+            certFile = lib.mkDefault cert;
+            keyFile = lib.mkDefault key;
           };
         };
-        kubelet = mkIf top.kubelet.enable {
-          clientCaFile = mkDefault cfg.certs.kubelet.caCert;
-          tlsCertFile = mkDefault cfg.certs.kubelet.cert;
-          tlsKeyFile = mkDefault cfg.certs.kubelet.key;
+        kubelet = lib.mkIf top.kubelet.enable {
+          clientCaFile = lib.mkDefault cfg.certs.kubelet.caCert;
+          tlsCertFile = lib.mkDefault cfg.certs.kubelet.cert;
+          tlsKeyFile = lib.mkDefault cfg.certs.kubelet.key;
           kubeconfig = with cfg.certs.kubeletClient; {
-            certFile = mkDefault cert;
-            keyFile = mkDefault key;
+            certFile = lib.mkDefault cert;
+            keyFile = lib.mkDefault key;
           };
         };
-        proxy = mkIf top.proxy.enable {
+        proxy = lib.mkIf top.proxy.enable {
           kubeconfig = with cfg.certs.kubeProxyClient; {
-            certFile = mkDefault cert;
-            keyFile = mkDefault key;
+            certFile = lib.mkDefault cert;
+            keyFile = lib.mkDefault key;
           };
         };
       };
diff --git a/nixos/modules/services/cluster/kubernetes/proxy.nix b/nixos/modules/services/cluster/kubernetes/proxy.nix
index 32d2b072f587f..bd6b1a514b253 100644
--- a/nixos/modules/services/cluster/kubernetes/proxy.nix
+++ b/nixos/modules/services/cluster/kubernetes/proxy.nix
@@ -5,9 +5,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   top = config.services.kubernetes;
   otop = options.services.kubernetes;
@@ -15,58 +12,58 @@ let
 in
 {
   imports = [
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "kubernetes" "proxy" "address" ]
       [ "services" "kubernetes" "proxy" "bindAddress" ]
     )
   ];
 
   ###### interface
-  options.services.kubernetes.proxy = with lib.types; {
+  options.services.kubernetes.proxy = {
 
-    bindAddress = mkOption {
+    bindAddress = lib.mkOption {
       description = "Kubernetes proxy listening address.";
       default = "0.0.0.0";
-      type = str;
+      type = lib.types.str;
     };
 
-    enable = mkEnableOption "Kubernetes proxy";
+    enable = lib.mkEnableOption "Kubernetes proxy";
 
-    extraOpts = mkOption {
+    extraOpts = lib.mkOption {
       description = "Kubernetes proxy extra command line options.";
       default = "";
-      type = separatedString " ";
+      type = lib.types.separatedString " ";
     };
 
-    featureGates = mkOption {
+    featureGates = lib.mkOption {
       description = "Attribute set of feature gates.";
       default = top.featureGates;
-      defaultText = literalExpression "config.${otop.featureGates}";
-      type = attrsOf bool;
+      defaultText = lib.literalExpression "config.${otop.featureGates}";
+      type = lib.types.attrsOf lib.types.bool;
     };
 
-    hostname = mkOption {
+    hostname = lib.mkOption {
       description = "Kubernetes proxy hostname override.";
       default = config.networking.hostName;
-      defaultText = literalExpression "config.networking.hostName";
-      type = str;
+      defaultText = lib.literalExpression "config.networking.hostName";
+      type = lib.types.str;
     };
 
     kubeconfig = top.lib.mkKubeConfigOptions "Kubernetes proxy";
 
-    verbosity = mkOption {
+    verbosity = lib.mkOption {
       description = ''
         Optional glog verbosity level for logging statements. See
         <https://github.com/kubernetes/community/blob/master/contributors/devel/logging.md>
       '';
       default = null;
-      type = nullOr int;
+      type = lib.types.nullOr lib.types.int;
     };
 
   };
 
   ###### implementation
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.kube-proxy = {
       description = "Kubernetes Proxy Service";
       wantedBy = [ "kubernetes.target" ];
@@ -80,18 +77,18 @@ in
         ExecStart = ''
           ${top.package}/bin/kube-proxy \
           --bind-address=${cfg.bindAddress} \
-          ${optionalString (top.clusterCidr != null) "--cluster-cidr=${top.clusterCidr}"} \
+          ${lib.optionalString (top.clusterCidr != null) "--cluster-cidr=${top.clusterCidr}"} \
           ${
-            optionalString (cfg.featureGates != { })
+            lib.optionalString (cfg.featureGates != { })
               "--feature-gates=${
-                concatStringsSep "," (
-                  builtins.attrValues (mapAttrs (n: v: "${n}=${trivial.boolToString v}") cfg.featureGates)
+                lib.concatStringsSep "," (
+                  builtins.attrValues (lib.mapAttrs (n: v: "${n}=${lib.trivial.boolToString v}") cfg.featureGates)
                 )
               }"
           } \
           --hostname-override=${cfg.hostname} \
           --kubeconfig=${top.lib.mkKubeConfig "kube-proxy" cfg.kubeconfig} \
-          ${optionalString (cfg.verbosity != null) "--v=${toString cfg.verbosity}"} \
+          ${lib.optionalString (cfg.verbosity != null) "--v=${toString cfg.verbosity}"} \
           ${cfg.extraOpts}
         '';
         WorkingDirectory = top.dataDir;
@@ -103,7 +100,7 @@ in
       };
     };
 
-    services.kubernetes.proxy.hostname = with config.networking; mkDefault hostName;
+    services.kubernetes.proxy.hostname = lib.mkDefault config.networking.hostName;
 
     services.kubernetes.pki.certs = {
       kubeProxyClient = top.lib.mkCert {
@@ -113,7 +110,7 @@ in
       };
     };
 
-    services.kubernetes.proxy.kubeconfig.server = mkDefault top.apiserverAddress;
+    services.kubernetes.proxy.kubeconfig.server = lib.mkDefault top.apiserverAddress;
   };
 
   meta.buildDocsInSandbox = false;
diff --git a/nixos/modules/services/continuous-integration/gocd-server/default.nix b/nixos/modules/services/continuous-integration/gocd-server/default.nix
index de4403b30208f..a412f902c3305 100644
--- a/nixos/modules/services/continuous-integration/gocd-server/default.nix
+++ b/nixos/modules/services/continuous-integration/gocd-server/default.nix
@@ -5,9 +5,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.gocd-server;
   opt = options.services.gocd-server;
@@ -15,27 +12,27 @@ in
 {
   options = {
     services.gocd-server = {
-      enable = mkEnableOption "gocd-server";
+      enable = lib.mkEnableOption "gocd-server";
 
-      user = mkOption {
+      user = lib.mkOption {
         default = "gocd-server";
-        type = types.str;
+        type = lib.types.str;
         description = ''
           User the Go.CD server should execute under.
         '';
       };
 
-      group = mkOption {
+      group = lib.mkOption {
         default = "gocd-server";
-        type = types.str;
+        type = lib.types.str;
         description = ''
           If the default user "gocd-server" is configured then this is the primary group of that user.
         '';
       };
 
-      extraGroups = mkOption {
+      extraGroups = lib.mkOption {
         default = [ ];
-        type = types.listOf types.str;
+        type = lib.types.listOf lib.types.str;
         example = [
           "wheel"
           "docker"
@@ -45,40 +42,40 @@ in
         '';
       };
 
-      listenAddress = mkOption {
+      listenAddress = lib.mkOption {
         default = "0.0.0.0";
         example = "localhost";
-        type = types.str;
+        type = lib.types.str;
         description = ''
           Specifies the bind address on which the Go.CD server HTTP interface listens.
         '';
       };
 
-      port = mkOption {
+      port = lib.mkOption {
         default = 8153;
-        type = types.port;
+        type = lib.types.port;
         description = ''
           Specifies port number on which the Go.CD server HTTP interface listens.
         '';
       };
 
-      sslPort = mkOption {
+      sslPort = lib.mkOption {
         default = 8154;
-        type = types.port;
+        type = lib.types.port;
         description = ''
           Specifies port number on which the Go.CD server HTTPS interface listens.
         '';
       };
 
-      workDir = mkOption {
+      workDir = lib.mkOption {
         default = "/var/lib/go-server";
-        type = types.str;
+        type = lib.types.str;
         description = ''
           Specifies the working directory in which the Go.CD server java archive resides.
         '';
       };
 
-      packages = mkOption {
+      packages = lib.mkOption {
         default = [
           pkgs.stdenv
           pkgs.jre
@@ -86,31 +83,31 @@ in
           config.programs.ssh.package
           pkgs.nix
         ];
-        defaultText = literalExpression "[ pkgs.stdenv pkgs.jre pkgs.git config.programs.ssh.package pkgs.nix ]";
-        type = types.listOf types.package;
+        defaultText = lib.literalExpression "[ pkgs.stdenv pkgs.jre pkgs.git config.programs.ssh.package pkgs.nix ]";
+        type = lib.types.listOf lib.types.package;
         description = ''
           Packages to add to PATH for the Go.CD server's process.
         '';
       };
 
-      initialJavaHeapSize = mkOption {
+      initialJavaHeapSize = lib.mkOption {
         default = "512m";
-        type = types.str;
+        type = lib.types.str;
         description = ''
           Specifies the initial java heap memory size for the Go.CD server's java process.
         '';
       };
 
-      maxJavaHeapMemory = mkOption {
+      maxJavaHeapMemory = lib.mkOption {
         default = "1024m";
-        type = types.str;
+        type = lib.types.str;
         description = ''
           Specifies the java maximum heap memory size for the Go.CD server's java process.
         '';
       };
 
-      startupOptions = mkOption {
-        type = types.listOf types.str;
+      startupOptions = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [
           "-Xms${cfg.initialJavaHeapSize}"
           "-Xmx${cfg.maxJavaHeapMemory}"
@@ -125,7 +122,7 @@ in
           "--add-opens=java.base/java.lang=ALL-UNNAMED"
           "--add-opens=java.base/java.util=ALL-UNNAMED"
         ];
-        defaultText = literalExpression ''
+        defaultText = lib.literalExpression ''
           [
             "-Xms''${config.${opt.initialJavaHeapSize}}"
             "-Xmx''${config.${opt.maxJavaHeapMemory}}"
@@ -148,9 +145,9 @@ in
         '';
       };
 
-      extraOptions = mkOption {
+      extraOptions = lib.mkOption {
         default = [ ];
-        type = types.listOf types.str;
+        type = lib.types.listOf lib.types.str;
         example = [
           "-X debug"
           "-Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5005"
@@ -167,9 +164,9 @@ in
         '';
       };
 
-      environment = mkOption {
+      environment = lib.mkOption {
         default = { };
-        type = with types; attrsOf str;
+        type = lib.types.attrsOf lib.types.str;
         description = ''
           Additional environment variables to be passed to the gocd-server process.
           As a base environment, gocd-server receives NIX_PATH from
@@ -180,12 +177,12 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
-    users.groups = optionalAttrs (cfg.group == "gocd-server") {
+  config = lib.mkIf cfg.enable {
+    users.groups = lib.optionalAttrs (cfg.group == "gocd-server") {
       gocd-server.gid = config.ids.gids.gocd-server;
     };
 
-    users.users = optionalAttrs (cfg.user == "gocd-server") {
+    users.users = lib.optionalAttrs (cfg.user == "gocd-server") {
       gocd-server = {
         description = "gocd-server user";
         createHome = true;
@@ -218,8 +215,8 @@ in
 
       script = ''
         ${pkgs.git}/bin/git config --global --add http.sslCAinfo ${config.security.pki.caBundle}
-        ${pkgs.jre}/bin/java -server ${concatStringsSep " " cfg.startupOptions} \
-                               ${concatStringsSep " " cfg.extraOptions}  \
+        ${pkgs.jre}/bin/java -server ${lib.concatStringsSep " " cfg.startupOptions} \
+                               ${lib.concatStringsSep " " cfg.extraOptions}  \
                               -jar ${pkgs.gocd-server}/go-server/lib/go.jar
       '';
 

From f7aa76cf8cf3e31a03da66a56ecbe5cc3474bebf Mon Sep 17 00:00:00 2001
From: kuflierl <41301536+kuflierl@users.noreply.github.com>
Date: Sat, 27 Sep 2025 20:51:36 +0200
Subject: [PATCH 3/4] nixos/modules: remove with lib pt2

---
 nixos/modules/services/databases/lldap.nix    |  44 +--
 .../services/databases/tigerbeetle.nix        |  17 +-
 .../services/databases/victoriametrics.nix    |  23 +-
 .../services/desktop-managers/pantheon.nix    |  99 +++---
 nixos/modules/services/games/armagetronad.nix |   7 +-
 .../modules/services/games/quake3-server.nix  |   4 +-
 .../modules/services/hardware/buffyboard.nix  |  38 +--
 .../services/hardware/handheld-daemon.nix     |  37 +--
 nixos/modules/services/hardware/lcd.nix       |  63 ++--
 .../services/logging/journaldriver.nix        |  28 +-
 nixos/modules/services/logging/promtail.nix   |  29 +-
 nixos/modules/services/mail/postgrey.nix      | 104 +++---
 nixos/modules/services/mail/public-inbox.nix  | 273 ++++++++-------
 nixos/modules/services/mail/rspamd.nix        | 141 ++++----
 nixos/modules/services/matrix/maubot.nix      | 101 +++---
 nixos/modules/services/matrix/synapse.nix     | 310 +++++++++---------
 .../services/misc/anki-sync-server.nix        |  61 ++--
 nixos/modules/services/misc/zoneminder.nix    |  28 +-
 nixos/modules/services/monitoring/vmalert.nix |  33 +-
 .../modules/services/networking/bitcoind.nix  |  91 ++---
 20 files changed, 765 insertions(+), 766 deletions(-)

diff --git a/nixos/modules/services/databases/lldap.nix b/nixos/modules/services/databases/lldap.nix
index 1680965573c90..9121fa530068a 100644
--- a/nixos/modules/services/databases/lldap.nix
+++ b/nixos/modules/services/databases/lldap.nix
@@ -6,17 +6,19 @@
 }:
 
 let
+  inherit (lib) types;
+
   cfg = config.services.lldap;
   format = pkgs.formats.toml { };
 in
 {
-  options.services.lldap = with lib; {
-    enable = mkEnableOption "lldap, a lightweight authentication server that provides an opinionated, simplified LDAP interface for authentication";
+  options.services.lldap = {
+    enable = lib.mkEnableOption "lldap, a lightweight authentication server that provides an opinionated, simplified LDAP interface for authentication";
 
-    package = mkPackageOption pkgs "lldap" { };
+    package = lib.mkPackageOption pkgs "lldap" { };
 
-    environment = mkOption {
-      type = with types; attrsOf str;
+    environment = lib.mkOption {
+      type = types.attrsOf types.str;
       default = { };
       example = {
         LLDAP_JWT_SECRET_FILE = "/run/lldap/jwt_secret";
@@ -28,7 +30,7 @@ in
       '';
     };
 
-    environmentFile = mkOption {
+    environmentFile = lib.mkOption {
       type = types.nullOr types.path;
       default = null;
       description = ''
@@ -36,7 +38,7 @@ in
       '';
     };
 
-    settings = mkOption {
+    settings = lib.mkOption {
       description = ''
         Free-form settings written directly to the `lldap_config.toml` file.
         Refer to <https://github.com/lldap/lldap/blob/main/lldap_config.docker_template.toml> for supported values.
@@ -47,62 +49,62 @@ in
       type = types.submodule {
         freeformType = format.type;
         options = {
-          ldap_host = mkOption {
+          ldap_host = lib.mkOption {
             type = types.str;
             description = "The host address that the LDAP server will be bound to.";
             default = "::";
           };
 
-          ldap_port = mkOption {
+          ldap_port = lib.mkOption {
             type = types.port;
             description = "The port on which to have the LDAP server.";
             default = 3890;
           };
 
-          http_host = mkOption {
+          http_host = lib.mkOption {
             type = types.str;
             description = "The host address that the HTTP server will be bound to.";
             default = "::";
           };
 
-          http_port = mkOption {
+          http_port = lib.mkOption {
             type = types.port;
             description = "The port on which to have the HTTP server, for user login and administration.";
             default = 17170;
           };
 
-          http_url = mkOption {
+          http_url = lib.mkOption {
             type = types.str;
             description = "The public URL of the server, for password reset links.";
             default = "http://localhost";
           };
 
-          ldap_base_dn = mkOption {
+          ldap_base_dn = lib.mkOption {
             type = types.str;
             description = "Base DN for LDAP.";
             example = "dc=example,dc=com";
           };
 
-          ldap_user_dn = mkOption {
+          ldap_user_dn = lib.mkOption {
             type = types.str;
             description = "Admin username";
             default = "admin";
           };
 
-          ldap_user_email = mkOption {
+          ldap_user_email = lib.mkOption {
             type = types.str;
             description = "Admin email.";
             default = "admin@example.com";
           };
 
-          database_url = mkOption {
+          database_url = lib.mkOption {
             type = types.str;
             description = "Database URL.";
             default = "sqlite://./users.db?mode=rwc";
             example = "postgres://postgres-user:password@postgres-server/my-database";
           };
 
-          ldap_user_pass = mkOption {
+          ldap_user_pass = lib.mkOption {
             type = types.nullOr types.str;
             default = null;
             description = ''
@@ -112,7 +114,7 @@ in
             '';
           };
 
-          ldap_user_pass_file = mkOption {
+          ldap_user_pass_file = lib.mkOption {
             type = types.nullOr types.str;
             default = null;
             description = ''
@@ -125,7 +127,7 @@ in
             '';
           };
 
-          force_ldap_user_pass_reset = mkOption {
+          force_ldap_user_pass_reset = lib.mkOption {
             type = types.oneOf [
               types.bool
               (types.enum [ "always" ])
@@ -144,7 +146,7 @@ in
             '';
           };
 
-          jwt_secret_file = mkOption {
+          jwt_secret_file = lib.mkOption {
             type = types.nullOr types.str;
             default = null;
             description = ''
@@ -158,7 +160,7 @@ in
       apply = lib.filterAttrsRecursive (_: v: v != null);
     };
 
-    silenceForceUserPassResetWarning = mkOption {
+    silenceForceUserPassResetWarning = lib.mkOption {
       type = types.bool;
       default = false;
       description = ''
diff --git a/nixos/modules/services/databases/tigerbeetle.nix b/nixos/modules/services/databases/tigerbeetle.nix
index 514652a6c8d14..eb3e260007404 100644
--- a/nixos/modules/services/databases/tigerbeetle.nix
+++ b/nixos/modules/services/databases/tigerbeetle.nix
@@ -5,6 +5,7 @@
   ...
 }:
 let
+  inherit (lib) types;
   cfg = config.services.tigerbeetle;
 in
 {
@@ -15,12 +16,12 @@ in
   };
 
   options = {
-    services.tigerbeetle = with lib; {
-      enable = mkEnableOption "TigerBeetle server";
+    services.tigerbeetle = {
+      enable = lib.mkEnableOption "TigerBeetle server";
 
-      package = mkPackageOption pkgs "tigerbeetle" { };
+      package = lib.mkPackageOption pkgs "tigerbeetle" { };
 
-      clusterId = mkOption {
+      clusterId = lib.mkOption {
         type = types.either types.ints.unsigned (types.strMatching "[0-9]+");
         default = 0;
         description = ''
@@ -30,7 +31,7 @@ in
         '';
       };
 
-      replicaIndex = mkOption {
+      replicaIndex = lib.mkOption {
         type = types.ints.unsigned;
         default = 0;
         description = ''
@@ -38,7 +39,7 @@ in
         '';
       };
 
-      replicaCount = mkOption {
+      replicaCount = lib.mkOption {
         type = types.ints.unsigned;
         default = 1;
         description = ''
@@ -46,7 +47,7 @@ in
         '';
       };
 
-      cacheGridSize = mkOption {
+      cacheGridSize = lib.mkOption {
         type = types.strMatching "[0-9]+(K|M|G)iB";
         default = "1GiB";
         description = ''
@@ -56,7 +57,7 @@ in
         '';
       };
 
-      addresses = mkOption {
+      addresses = lib.mkOption {
         type = types.listOf types.nonEmptyStr;
         default = [ "3001" ];
         description = ''
diff --git a/nixos/modules/services/databases/victoriametrics.nix b/nixos/modules/services/databases/victoriametrics.nix
index 3ff94c3d4b96e..a88c61ed5db35 100644
--- a/nixos/modules/services/databases/victoriametrics.nix
+++ b/nixos/modules/services/databases/victoriametrics.nix
@@ -4,7 +4,6 @@
   lib,
   ...
 }:
-with lib;
 let
   cfg = config.services.victoriametrics;
   settingsFormat = pkgs.formats.yaml { };
@@ -42,18 +41,18 @@ in
         VictoriaMetrics is a fast, cost-effective and scalable monitoring solution and time series database.
       '';
     };
-    package = mkPackageOption pkgs "victoriametrics" { };
+    package = lib.mkPackageOption pkgs "victoriametrics" { };
 
-    listenAddress = mkOption {
+    listenAddress = lib.mkOption {
       default = ":8428";
-      type = types.str;
+      type = lib.types.str;
       description = ''
         TCP address to listen for incoming http requests.
       '';
     };
 
-    stateDir = mkOption {
-      type = types.str;
+    stateDir = lib.mkOption {
+      type = lib.types.str;
       default = "victoriametrics";
       description = ''
         Directory below `/var/lib` to store VictoriaMetrics metrics data.
@@ -61,8 +60,8 @@ in
       '';
     };
 
-    retentionPeriod = mkOption {
-      type = types.nullOr types.str;
+    retentionPeriod = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       default = null;
       example = "15d";
       description = ''
@@ -92,7 +91,7 @@ in
     prometheusConfig = lib.mkOption {
       type = lib.types.submodule { freeformType = settingsFormat.type; };
       default = { };
-      example = literalExpression ''
+      example = lib.literalExpression ''
         {
           scrape_configs = [
             {
@@ -129,10 +128,10 @@ in
       '';
     };
 
-    extraOptions = mkOption {
-      type = types.listOf types.str;
+    extraOptions = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [ ];
-      example = literalExpression ''
+      example = lib.literalExpression ''
         [
           "-loggerLevel=WARN"
         ]
diff --git a/nixos/modules/services/desktop-managers/pantheon.nix b/nixos/modules/services/desktop-managers/pantheon.nix
index ef2d8ff30fdca..9dac3875f2480 100644
--- a/nixos/modules/services/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/desktop-managers/pantheon.nix
@@ -5,11 +5,8 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
-
+  inherit (lib) types;
   cfg = config.services.desktopManager.pantheon;
   serviceCfg = config.services.pantheon;
 
@@ -25,7 +22,7 @@ in
 
   meta = {
     doc = ./pantheon.md;
-    maintainers = teams.pantheon.members;
+    maintainers = lib.teams.pantheon.members;
   };
 
   imports = [
@@ -40,24 +37,24 @@ in
     services.pantheon = {
 
       contractor = {
-        enable = mkEnableOption "contractor, a desktop-wide extension service used by Pantheon";
+        enable = lib.mkEnableOption "contractor, a desktop-wide extension service used by Pantheon";
       };
 
-      apps.enable = mkEnableOption "Pantheon default applications";
+      apps.enable = lib.mkEnableOption "Pantheon default applications";
 
     };
 
     services.desktopManager.pantheon = {
-      enable = mkOption {
+      enable = lib.mkOption {
         type = types.bool;
         default = false;
         description = "Enable the pantheon desktop manager";
       };
 
-      sessionPath = mkOption {
+      sessionPath = lib.mkOption {
         default = [ ];
         type = types.listOf types.package;
-        example = literalExpression "[ pkgs.gpaste ]";
+        example = lib.literalExpression "[ pkgs.gpaste ]";
         description = ''
           Additional list of packages to be added to the session search path.
           Useful for GSettings-conditional autostart.
@@ -66,45 +63,45 @@ in
         '';
       };
 
-      extraWingpanelIndicators = mkOption {
+      extraWingpanelIndicators = lib.mkOption {
         default = null;
-        type = with types; nullOr (listOf package);
+        type = types.nullOr (types.listOf types.package);
         description = "Indicators to add to Wingpanel.";
       };
 
-      extraSwitchboardPlugs = mkOption {
+      extraSwitchboardPlugs = lib.mkOption {
         default = null;
-        type = with types; nullOr (listOf package);
+        type = types.nullOr (types.listOf types.package);
         description = "Plugs to add to Switchboard.";
       };
 
-      extraGSettingsOverrides = mkOption {
+      extraGSettingsOverrides = lib.mkOption {
         default = "";
         type = types.lines;
         description = "Additional gsettings overrides.";
       };
 
-      extraGSettingsOverridePackages = mkOption {
+      extraGSettingsOverridePackages = lib.mkOption {
         default = [ ];
         type = types.listOf types.path;
         description = "List of packages for which gsettings are overridden.";
       };
 
-      debug = mkEnableOption "gnome-session debug messages";
+      debug = lib.mkEnableOption "gnome-session debug messages";
 
     };
 
-    environment.pantheon.excludePackages = mkOption {
+    environment.pantheon.excludePackages = lib.mkOption {
       default = [ ];
-      example = literalExpression "[ pkgs.pantheon.elementary-camera ]";
+      example = lib.literalExpression "[ pkgs.pantheon.elementary-camera ]";
       type = types.listOf types.package;
       description = "Which packages pantheon should exclude from the default environment";
     };
 
   };
 
-  config = mkMerge [
-    (mkIf cfg.enable {
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
       services.desktopManager.pantheon.sessionPath = utils.removePackagesByName [
         pkgs.pantheon.pantheon-agent-geoclue2
       ] config.environment.pantheon.excludePackages;
@@ -113,15 +110,15 @@ in
 
       # Ensure lightdm is used when Pantheon is enabled
       # Without it screen locking will be nonfunctional because of the use of lightlocker
-      warnings = optional (config.services.xserver.displayManager.lightdm.enable != true) ''
+      warnings = lib.optional (config.services.xserver.displayManager.lightdm.enable != true) ''
         Using Pantheon without LightDM as a displayManager will break screenlocking from the UI.
       '';
 
-      services.xserver.displayManager.lightdm.greeters.pantheon.enable = mkDefault true;
+      services.xserver.displayManager.lightdm.greeters.pantheon.enable = lib.mkDefault true;
 
       # Without this, elementary LightDM greeter will pre-select non-existent `default` session
       # https://github.com/elementary/greeter/issues/368
-      services.displayManager.defaultSession = mkDefault "pantheon-wayland";
+      services.displayManager.defaultSession = lib.mkDefault "pantheon-wayland";
       programs.dconf.profiles.user.databases = [
         {
           settings."io/elementary/greeter" = {
@@ -131,7 +128,7 @@ in
       ];
 
       environment.extraInit = ''
-        ${concatMapStrings (p: ''
+        ${lib.concatMapStrings (p: ''
           if [ -d "${p}/share/gsettings-schemas/${p.name}" ]; then
             export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}${p}/share/gsettings-schemas/${p.name}
           fi
@@ -144,37 +141,39 @@ in
       '';
 
       # Default services
-      hardware.bluetooth.enable = mkDefault true;
+      hardware.bluetooth.enable = lib.mkDefault true;
       security.polkit.enable = true;
       services.accounts-daemon.enable = true;
-      services.colord.enable = mkDefault true;
-      services.fwupd.enable = mkDefault true;
+      services.colord.enable = lib.mkDefault true;
+      services.fwupd.enable = lib.mkDefault true;
       # TODO: Enable once #177946 is resolved
-      # services.packagekit.enable = mkDefault true;
-      services.power-profiles-daemon.enable = mkDefault true;
-      services.touchegg.enable = mkDefault true;
+      # services.packagekit.enable = lib.mkDefault true;
+      services.power-profiles-daemon.enable = lib.mkDefault true;
+      services.touchegg.enable = lib.mkDefault true;
       services.touchegg.package = pkgs.pantheon.touchegg;
-      services.tumbler.enable = mkDefault true;
-      services.system-config-printer.enable = (mkIf config.services.printing.enable (mkDefault true));
+      services.tumbler.enable = lib.mkDefault true;
+      services.system-config-printer.enable = (
+        lib.mkIf config.services.printing.enable (lib.mkDefault true)
+      );
       services.dbus.packages = with pkgs.pantheon; [
         switchboard-plug-power
         elementary-default-settings # accountsservice extensions
       ];
-      services.pantheon.apps.enable = mkDefault true;
-      services.pantheon.contractor.enable = mkDefault true;
+      services.pantheon.apps.enable = lib.mkDefault true;
+      services.pantheon.contractor.enable = lib.mkDefault true;
       services.gnome.at-spi2-core.enable = true;
       services.gnome.evolution-data-server.enable = true;
       services.gnome.glib-networking.enable = true;
       services.gnome.gnome-keyring.enable = true;
-      services.gnome.gcr-ssh-agent.enable = mkDefault true;
+      services.gnome.gcr-ssh-agent.enable = lib.mkDefault true;
       services.gvfs.enable = true;
-      services.gnome.rygel.enable = mkDefault true;
+      services.gnome.rygel.enable = lib.mkDefault true;
       services.udisks2.enable = true;
       services.upower.enable = config.powerManagement.enable;
-      services.libinput.enable = mkDefault true;
-      services.switcherooControl.enable = mkDefault true;
-      services.zeitgeist.enable = mkDefault true;
-      services.geoclue2.enable = mkDefault true;
+      services.libinput.enable = lib.mkDefault true;
+      services.switcherooControl.enable = lib.mkDefault true;
+      services.zeitgeist.enable = lib.mkDefault true;
+      services.geoclue2.enable = lib.mkDefault true;
       # pantheon has pantheon-agent-geoclue2
       services.geoclue2.enableDemoAgent = false;
       services.geoclue2.appConfig."io.elementary.desktop.agent-geoclue2" = {
@@ -187,7 +186,7 @@ in
         # https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/1443
         pkgs.pantheon.mutter
       ];
-      services.orca.enable = mkDefault (notExcluded pkgs.orca);
+      services.orca.enable = lib.mkDefault (notExcluded pkgs.orca);
       systemd.packages = with pkgs; [
         gnome-session
         pantheon.gala
@@ -196,7 +195,7 @@ in
         pantheon.elementary-settings-daemon
       ];
       programs.dconf.enable = true;
-      networking.networkmanager.enable = mkDefault true;
+      networking.networkmanager.enable = lib.mkDefault true;
 
       systemd.user.targets."gnome-session-x11-services".wants = [
         "org.gnome.SettingsDaemon.XSettings.service"
@@ -271,12 +270,12 @@ in
         ])
       ) config.environment.pantheon.excludePackages;
 
-      xdg.portal.configPackages = mkDefault [ pkgs.pantheon.elementary-default-settings ];
+      xdg.portal.configPackages = lib.mkDefault [ pkgs.pantheon.elementary-default-settings ];
 
       # Override GSettings schemas
       environment.sessionVariables.NIX_GSETTINGS_OVERRIDES_DIR = "${nixos-gsettings-desktop-schemas}/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas";
 
-      environment.sessionVariables.GNOME_SESSION_DEBUG = mkIf cfg.debug "1";
+      environment.sessionVariables.GNOME_SESSION_DEBUG = lib.mkIf cfg.debug "1";
 
       environment.pathsToLink = [
         # FIXME: modules should link subdirs of `/share` rather than relying on this
@@ -290,8 +289,8 @@ in
       programs.nm-applet.indicator = false;
 
       # Shell integration for VTE terminals
-      programs.bash.vteIntegration = mkDefault true;
-      programs.zsh.vteIntegration = mkDefault true;
+      programs.bash.vteIntegration = lib.mkDefault true;
+      programs.zsh.vteIntegration = lib.mkDefault true;
 
       # Default Fonts
       fonts.packages = with pkgs; [
@@ -307,8 +306,8 @@ in
       };
     })
 
-    (mkIf serviceCfg.apps.enable {
-      programs.evince.enable = mkDefault (notExcluded pkgs.evince);
+    (lib.mkIf serviceCfg.apps.enable {
+      programs.evince.enable = lib.mkDefault (notExcluded pkgs.evince);
 
       environment.systemPackages = utils.removePackagesByName (
         [
@@ -349,7 +348,7 @@ in
       ];
     })
 
-    (mkIf serviceCfg.contractor.enable {
+    (lib.mkIf serviceCfg.contractor.enable {
       environment.systemPackages = with pkgs.pantheon; [
         contractor
         file-roller-contract
diff --git a/nixos/modules/services/games/armagetronad.nix b/nixos/modules/services/games/armagetronad.nix
index 17e449beb5477..bfdc2d7c82770 100644
--- a/nixos/modules/services/games/armagetronad.nix
+++ b/nixos/modules/services/games/armagetronad.nix
@@ -21,13 +21,12 @@ let
     ;
 
   mkValueStringArmagetron =
-    with lib;
     v:
-    if isInt v then
+    if lib.isInt v then
       toString v
-    else if isFloat v then
+    else if lib.isFloat v then
       toString v
-    else if isString v then
+    else if lib.isString v then
       v
     else if true == v then
       "1"
diff --git a/nixos/modules/services/games/quake3-server.nix b/nixos/modules/services/games/quake3-server.nix
index 98e74eb71f69d..3d1c667c1cd61 100644
--- a/nixos/modules/services/games/quake3-server.nix
+++ b/nixos/modules/services/games/quake3-server.nix
@@ -112,14 +112,14 @@ in
 
         environment.HOME = if baseq3InStore then home else cfg.baseq3;
 
-        serviceConfig = with lib; {
+        serviceConfig = {
           Restart = "always";
           DynamicUser = true;
           WorkingDirectory = home;
 
           # It is possible to alter configuration files via RCON. To ensure reproducibility we have to prevent this
           ReadOnlyPaths = if baseq3InStore then home else cfg.baseq3;
-          ExecStartPre = optionalString (
+          ExecStartPre = lib.optionalString (
             !baseq3InStore
           ) "+${pkgs.coreutils}/bin/cp ${configFile} ${cfg.baseq3}/.q3a/baseq3/nix.cfg";
 
diff --git a/nixos/modules/services/hardware/buffyboard.nix b/nixos/modules/services/hardware/buffyboard.nix
index 26b83882c12b1..09a223fb05ae7 100644
--- a/nixos/modules/services/hardware/buffyboard.nix
+++ b/nixos/modules/services/hardware/buffyboard.nix
@@ -28,12 +28,12 @@ in
   meta.maintainers = with lib.maintainers; [ colinsane ];
 
   options = {
-    services.buffyboard = with lib; {
-      enable = mkEnableOption "buffyboard framebuffer keyboard (on-screen keyboard)";
-      package = mkPackageOption pkgs "buffybox" { };
+    services.buffyboard = {
+      enable = lib.mkEnableOption "buffyboard framebuffer keyboard (on-screen keyboard)";
+      package = lib.mkPackageOption pkgs "buffybox" { };
 
-      extraFlags = mkOption {
-        type = types.listOf types.str;
+      extraFlags = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ ];
         description = ''
           Extra CLI arguments to pass to buffyboard.
@@ -46,7 +46,7 @@ in
         ];
       };
 
-      configFile = mkOption {
+      configFile = lib.mkOption {
         type = lib.types.path;
         default = ini.generate "buffyboard.conf" (lib.filterAttrsRecursive (_: v: v != null) cfg.settings);
         defaultText = lib.literalExpression ''ini.generate "buffyboard.conf" cfg.settings'';
@@ -59,33 +59,33 @@ in
         '';
       };
 
-      settings = mkOption {
+      settings = lib.mkOption {
         description = ''
           Settings to include in /etc/buffyboard.conf.
           Every option here is strictly optional:
           Buffyboard will use its own baked-in defaults for those options left unset.
         '';
-        type = types.submodule {
+        type = lib.types.submodule {
           freeformType = ini.type;
 
-          options.input.pointer = mkOption {
-            type = types.nullOr types.bool;
+          options.input.pointer = lib.mkOption {
+            type = lib.types.nullOr lib.types.bool;
             default = null;
             description = ''
               Enable or disable the use of a hardware mouse or other pointing device.
             '';
           };
-          options.input.touchscreen = mkOption {
-            type = types.nullOr types.bool;
+          options.input.touchscreen = lib.mkOption {
+            type = lib.types.nullOr lib.types.bool;
             default = null;
             description = ''
               Enable or disable the use of the touchscreen.
             '';
           };
 
-          options.theme.default = mkOption {
-            type = types.either types.str (
-              types.enum [
+          options.theme.default = lib.mkOption {
+            type = lib.types.either lib.types.str (
+              lib.types.enum [
                 null
                 "adwaita-dark"
                 "breezy-dark"
@@ -101,16 +101,16 @@ in
               Selects the default theme on boot. Can be changed at runtime to the alternative theme.
             '';
           };
-          options.quirks.fbdev_force_refresh = mkOption {
-            type = types.nullOr types.bool;
+          options.quirks.fbdev_force_refresh = lib.mkOption {
+            type = lib.types.nullOr lib.types.bool;
             default = null;
             description = ''
               If true and using the framebuffer backend, this triggers a display refresh after every draw operation.
               This has a negative performance impact.
             '';
           };
-          options.quirks.ignore_unused_terminals = mkOption {
-            type = types.nullOr types.bool;
+          options.quirks.ignore_unused_terminals = lib.mkOption {
+            type = lib.types.nullOr lib.types.bool;
             default = null;
             description = ''
               If true, buffyboard won't automatically update the layout of a new terminal and
diff --git a/nixos/modules/services/hardware/handheld-daemon.nix b/nixos/modules/services/hardware/handheld-daemon.nix
index 35c5840ca300a..5f47796e4d3de 100644
--- a/nixos/modules/services/hardware/handheld-daemon.nix
+++ b/nixos/modules/services/hardware/handheld-daemon.nix
@@ -4,13 +4,12 @@
   pkgs,
   ...
 }:
-with lib;
 let
   cfg = config.services.handheld-daemon;
 in
 {
   imports = [
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "handheld-daemon"
       "adjustor"
@@ -18,18 +17,18 @@ in
     ] "Adjustor is now part of handheld-daemon package, so it can't be overriden")
   ];
   options.services.handheld-daemon = {
-    enable = mkEnableOption "Handheld Daemon";
-    package = mkPackageOption pkgs "handheld-daemon" { };
+    enable = lib.mkEnableOption "Handheld Daemon";
+    package = lib.mkPackageOption pkgs "handheld-daemon" { };
 
     ui = {
-      enable = mkEnableOption "Handheld Daemon UI";
-      package = mkPackageOption pkgs "handheld-daemon-ui" { };
+      enable = lib.mkEnableOption "Handheld Daemon UI";
+      package = lib.mkPackageOption pkgs "handheld-daemon-ui" { };
     };
 
     adjustor = {
-      enable = mkEnableOption "Handheld Daemon TDP control plugin";
-      loadAcpiCallModule = mkOption {
-        type = types.bool;
+      enable = lib.mkEnableOption "Handheld Daemon TDP control plugin";
+      loadAcpiCallModule = lib.mkOption {
+        type = lib.types.bool;
         description = ''
           Whether to load the acpi_call kernel module.
           Required for TDP control by adjustor on most devices.
@@ -37,17 +36,17 @@ in
       };
     };
 
-    user = mkOption {
-      type = types.str;
+    user = lib.mkOption {
+      type = lib.types.str;
       description = ''
         The user to run Handheld Daemon with.
       '';
     };
   };
 
-  config = mkIf cfg.enable {
-    services.handheld-daemon.ui.enable = mkDefault true;
-    services.handheld-daemon.adjustor.loadAcpiCallModule = mkDefault cfg.adjustor.enable;
+  config = lib.mkIf cfg.enable {
+    services.handheld-daemon.ui.enable = lib.mkDefault true;
+    services.handheld-daemon.adjustor.loadAcpiCallModule = lib.mkDefault cfg.adjustor.enable;
     environment.systemPackages = [
       cfg.package
     ]
@@ -55,8 +54,8 @@ in
     services.udev.packages = [ cfg.package ];
     systemd.packages = [ cfg.package ];
 
-    boot.kernelModules = mkIf cfg.adjustor.loadAcpiCallModule [ "acpi_call" ];
-    boot.extraModulePackages = mkIf cfg.adjustor.loadAcpiCallModule [
+    boot.kernelModules = lib.mkIf cfg.adjustor.loadAcpiCallModule [ "acpi_call" ];
+    boot.extraModulePackages = lib.mkIf cfg.adjustor.loadAcpiCallModule [
       config.boot.kernelPackages.acpi_call
     ];
 
@@ -68,10 +67,10 @@ in
       restartIfChanged = true;
 
       environment = {
-        HHD_ADJ_DISABLE = mkIf (!cfg.adjustor.enable) "1";
+        HHD_ADJ_DISABLE = lib.mkIf (!cfg.adjustor.enable) "1";
       };
 
-      path = mkIf cfg.ui.enable [
+      path = lib.mkIf cfg.ui.enable [
         cfg.ui.package
         pkgs.lsof
       ];
@@ -85,5 +84,5 @@ in
     };
   };
 
-  meta.maintainers = [ maintainers.toast ];
+  meta.maintainers = [ lib.maintainers.toast ];
 }
diff --git a/nixos/modules/services/hardware/lcd.nix b/nixos/modules/services/hardware/lcd.nix
index 0b39281667cc7..9f9b4fd986ec2 100644
--- a/nixos/modules/services/hardware/lcd.nix
+++ b/nixos/modules/services/hardware/lcd.nix
@@ -33,40 +33,39 @@ let
   };
 
 in
-with lib;
 {
 
-  meta.maintainers = with maintainers; [ peterhoeg ];
+  meta.maintainers = with lib.maintainers; [ peterhoeg ];
 
-  options = with types; {
+  options = {
     services.hardware.lcd = {
-      serverHost = mkOption {
-        type = str;
+      serverHost = lib.mkOption {
+        type = lib.types.str;
         default = "localhost";
         description = "Host on which LCDd is listening.";
       };
 
-      serverPort = mkOption {
-        type = int;
+      serverPort = lib.mkOption {
+        type = lib.types.int;
         default = 13666;
         description = "Port on which LCDd is listening.";
       };
 
       server = {
-        enable = mkOption {
-          type = bool;
+        enable = lib.mkOption {
+          type = lib.types.bool;
           default = false;
           description = "Enable the LCD panel server (LCDd)";
         };
 
-        openPorts = mkOption {
-          type = bool;
+        openPorts = lib.mkOption {
+          type = lib.types.bool;
           default = false;
           description = "Open the ports in the firewall";
         };
 
-        usbPermissions = mkOption {
-          type = bool;
+        usbPermissions = lib.mkOption {
+          type = lib.types.bool;
           default = false;
           description = ''
             Set group-write permissions on a USB device.
@@ -87,46 +86,46 @@ with lib;
           '';
         };
 
-        usbVid = mkOption {
-          type = str;
+        usbVid = lib.mkOption {
+          type = lib.types.str;
           default = "";
           description = "The vendor ID of the USB device to claim.";
         };
 
-        usbPid = mkOption {
-          type = str;
+        usbPid = lib.mkOption {
+          type = lib.types.str;
           default = "";
           description = "The product ID of the USB device to claim.";
         };
 
-        usbGroup = mkOption {
-          type = str;
+        usbGroup = lib.mkOption {
+          type = lib.types.str;
           default = "dialout";
           description = "The group to use for settings permissions. This group must exist or you will have to create it.";
         };
 
-        extraConfig = mkOption {
-          type = lines;
+        extraConfig = lib.mkOption {
+          type = lib.types.lines;
           default = "";
           description = "Additional configuration added verbatim to the server config.";
         };
       };
 
       client = {
-        enable = mkOption {
-          type = bool;
+        enable = lib.mkOption {
+          type = lib.types.bool;
           default = false;
           description = "Enable the LCD panel client (LCDproc)";
         };
 
-        extraConfig = mkOption {
-          type = lines;
+        extraConfig = lib.mkOption {
+          type = lib.types.lines;
           default = "";
           description = "Additional configuration added verbatim to the client config.";
         };
 
-        restartForever = mkOption {
-          type = bool;
+        restartForever = lib.mkOption {
+          type = lib.types.bool;
           default = true;
           description = "Try restarting the client forever.";
         };
@@ -134,17 +133,17 @@ with lib;
     };
   };
 
-  config = mkIf (cfg.server.enable || cfg.client.enable) {
-    networking.firewall.allowedTCPPorts = mkIf (cfg.server.enable && cfg.server.openPorts) [
+  config = lib.mkIf (cfg.server.enable || cfg.client.enable) {
+    networking.firewall.allowedTCPPorts = lib.mkIf (cfg.server.enable && cfg.server.openPorts) [
       cfg.serverPort
     ];
 
-    services.udev.extraRules = mkIf (cfg.server.enable && cfg.server.usbPermissions) ''
+    services.udev.extraRules = lib.mkIf (cfg.server.enable && cfg.server.usbPermissions) ''
       ACTION=="add", SUBSYSTEMS=="usb", ATTRS{idVendor}=="${cfg.server.usbVid}", ATTRS{idProduct}=="${cfg.server.usbPid}", MODE="660", GROUP="${cfg.server.usbGroup}"
     '';
 
     systemd.services = {
-      lcdd = mkIf cfg.server.enable {
+      lcdd = lib.mkIf cfg.server.enable {
         description = "LCDproc - server";
         wantedBy = [ "lcd.target" ];
         serviceConfig = serviceCfg // {
@@ -153,7 +152,7 @@ with lib;
         };
       };
 
-      lcdproc = mkIf cfg.client.enable {
+      lcdproc = lib.mkIf cfg.client.enable {
         description = "LCDproc - client";
         after = [ "lcdd.service" ];
         wantedBy = [ "lcd.target" ];
diff --git a/nixos/modules/services/logging/journaldriver.nix b/nixos/modules/services/logging/journaldriver.nix
index efb53de0b4842..826df056d4b66 100644
--- a/nixos/modules/services/logging/journaldriver.nix
+++ b/nixos/modules/services/logging/journaldriver.nix
@@ -15,15 +15,13 @@
   pkgs,
   ...
 }:
-
-with lib;
 let
   cfg = config.services.journaldriver;
 in
 {
   options.services.journaldriver = {
-    enable = mkOption {
-      type = types.bool;
+    enable = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Whether to enable journaldriver to forward journald logs to
@@ -31,16 +29,16 @@ in
       '';
     };
 
-    logLevel = mkOption {
-      type = types.str;
+    logLevel = lib.mkOption {
+      type = lib.types.str;
       default = "info";
       description = ''
         Log level at which journaldriver logs its own output.
       '';
     };
 
-    logName = mkOption {
-      type = with types; nullOr str;
+    logName = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       default = null;
       description = ''
         Configures the name of the target log in Stackdriver Logging.
@@ -50,8 +48,8 @@ in
       '';
     };
 
-    googleCloudProject = mkOption {
-      type = with types; nullOr str;
+    googleCloudProject = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       default = null;
       description = ''
         Configures the name of the Google Cloud project to which to
@@ -62,8 +60,8 @@ in
       '';
     };
 
-    logStream = mkOption {
-      type = with types; nullOr str;
+    logStream = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       default = null;
       description = ''
         Configures the name of the Stackdriver Logging log stream into
@@ -74,8 +72,8 @@ in
       '';
     };
 
-    applicationCredentials = mkOption {
-      type = with types; nullOr path;
+    applicationCredentials = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
       default = null;
       description = ''
         Path to the service account private key (in JSON-format) used
@@ -88,7 +86,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.journaldriver = {
       description = "Stackdriver Logging journal forwarder";
       script = "${pkgs.journaldriver}/bin/journaldriver";
diff --git a/nixos/modules/services/logging/promtail.nix b/nixos/modules/services/logging/promtail.nix
index f346070441b3d..50ef11bb9c1b5 100644
--- a/nixos/modules/services/logging/promtail.nix
+++ b/nixos/modules/services/logging/promtail.nix
@@ -4,16 +4,14 @@
   pkgs,
   ...
 }:
-with lib;
 let
   cfg = config.services.promtail;
 
   format = pkgs.formats.json { };
   prettyJSON =
     conf:
-    with lib;
-    pipe conf [
-      (flip removeAttrs [ "_module" ])
+    lib.pipe conf [
+      (lib.flip lib.removeAttrs [ "_module" ])
       (format.generate "promtail-config.json")
     ];
 
@@ -27,10 +25,10 @@ let
 
 in
 {
-  options.services.promtail = with types; {
-    enable = mkEnableOption "the Promtail ingresser";
+  options.services.promtail = {
+    enable = lib.mkEnableOption "the Promtail ingresser";
 
-    configuration = mkOption {
+    configuration = lib.mkOption {
       type = format.type;
       description = ''
         Specify the configuration for Promtail in Nix.
@@ -38,8 +36,8 @@ in
       '';
     };
 
-    configFile = mkOption {
-      type = nullOr path;
+    configFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
       default = null;
       description = ''
         Config file path for Promtail.
@@ -47,8 +45,8 @@ in
       '';
     };
 
-    extraFlags = mkOption {
-      type = listOf str;
+    extraFlags = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [ ];
       example = [ "--server.http-listen-port=3101" ];
       description = ''
@@ -58,8 +56,9 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
-    services.promtail.configuration.positions.filename = mkDefault "/var/cache/promtail/positions.yaml";
+  config = lib.mkIf cfg.enable {
+    services.promtail.configuration.positions.filename =
+      lib.mkDefault "/var/cache/promtail/positions.yaml";
 
     systemd.services.promtail = {
       description = "Promtail log ingress";
@@ -74,7 +73,7 @@ in
         Restart = "on-failure";
         TimeoutStopSec = 10;
 
-        ExecStart = "${pkgs.promtail}/bin/promtail -config.file=${configFile} ${escapeShellArgs cfg.extraFlags}";
+        ExecStart = "${pkgs.promtail}/bin/promtail -config.file=${configFile} ${lib.escapeShellArgs cfg.extraFlags}";
 
         ProtectSystem = "strict";
         ProtectHome = true;
@@ -106,7 +105,7 @@ in
 
         SupplementaryGroups = lib.optional allowSystemdJournal "systemd-journal";
       }
-      // (optionalAttrs (!pkgs.stdenv.hostPlatform.isAarch64) {
+      // (lib.optionalAttrs (!pkgs.stdenv.hostPlatform.isAarch64) {
         # FIXME: figure out why this breaks on aarch64
         SystemCallFilter = "@system-service";
       });
diff --git a/nixos/modules/services/mail/postgrey.nix b/nixos/modules/services/mail/postgrey.nix
index 463757fa8440f..152517dac250a 100644
--- a/nixos/modules/services/mail/postgrey.nix
+++ b/nixos/modules/services/mail/postgrey.nix
@@ -4,42 +4,42 @@
   pkgs,
   ...
 }:
-
-with lib;
 let
 
   cfg = config.services.postgrey;
 
-  socket =
-    with types;
-    addCheck (either (submodule unixSocket) (submodule inetSocket)) (x: x ? path || x ? port);
+  inherit (lib) types;
+
+  socket = types.addCheck (types.either (types.submodule unixSocket) (types.submodule inetSocket)) (
+    x: x ? path || x ? port
+  );
 
-  inetSocket = with types; {
+  inetSocket = {
     options = {
-      addr = mkOption {
-        type = nullOr str;
+      addr = lib.mkOption {
+        type = types.nullOr types.str;
         default = null;
         example = "127.0.0.1";
         description = "The address to bind to. Localhost if null";
       };
-      port = mkOption {
-        type = port;
+      port = lib.mkOption {
+        type = types.port;
         default = 10030;
         description = "Tcp port to bind to";
       };
     };
   };
 
-  unixSocket = with types; {
+  unixSocket = {
     options = {
-      path = mkOption {
-        type = path;
+      path = lib.mkOption {
+        type = types.path;
         default = "/run/postgrey.sock";
         description = "Path of the unix socket";
       };
 
-      mode = mkOption {
-        type = str;
+      mode = lib.mkOption {
+        type = types.str;
         default = "0777";
         description = "Mode of the unix socket";
       };
@@ -49,7 +49,7 @@ let
 in
 {
   imports = [
-    (mkMergedOptionModule
+    (lib.mkMergedOptionModule
       [
         [
           "services"
@@ -66,7 +66,7 @@ in
       (
         config:
         let
-          value = p: getAttrFromPath p config;
+          value = p: lib.getAttrFromPath p config;
           inetAddr = [
             "services"
             "postgrey"
@@ -90,13 +90,13 @@ in
   ];
 
   options = {
-    services.postgrey = with types; {
-      enable = mkOption {
-        type = bool;
+    services.postgrey = {
+      enable = lib.mkOption {
+        type = types.bool;
         default = false;
         description = "Whether to run the Postgrey daemon";
       };
-      socket = mkOption {
+      socket = lib.mkOption {
         type = socket;
         default = {
           path = "/run/postgrey.sock";
@@ -108,76 +108,76 @@ in
         };
         description = "Socket to bind to";
       };
-      greylistText = mkOption {
-        type = str;
+      greylistText = lib.mkOption {
+        type = types.str;
         default = "Greylisted for %%s seconds";
         description = "Response status text for greylisted messages; use %%s for seconds left until greylisting is over and %%r for mail domain of recipient";
       };
-      greylistAction = mkOption {
-        type = str;
+      greylistAction = lib.mkOption {
+        type = types.str;
         default = "DEFER_IF_PERMIT";
         description = "Response status for greylisted messages (see {manpage}`access(5)`)";
       };
-      greylistHeader = mkOption {
-        type = str;
+      greylistHeader = lib.mkOption {
+        type = types.str;
         default = "X-Greylist: delayed %%t seconds by postgrey-%%v at %%h; %%d";
         description = "Prepend header to greylisted mails; use %%t for seconds delayed due to greylisting, %%v for the version of postgrey, %%d for the date, and %%h for the host";
       };
-      delay = mkOption {
-        type = ints.unsigned;
+      delay = lib.mkOption {
+        type = types.ints.unsigned;
         default = 300;
         description = "Greylist for N seconds";
       };
-      maxAge = mkOption {
-        type = ints.unsigned;
+      maxAge = lib.mkOption {
+        type = types.ints.unsigned;
         default = 35;
         description = "Delete entries from whitelist if they haven't been seen for N days";
       };
-      retryWindow = mkOption {
-        type = either str ints.unsigned;
+      retryWindow = lib.mkOption {
+        type = types.either types.str types.ints.unsigned;
         default = 2;
         example = "12h";
         description = "Allow N days for the first retry. Use string with appended 'h' to specify time in hours";
       };
-      lookupBySubnet = mkOption {
-        type = bool;
+      lookupBySubnet = lib.mkOption {
+        type = types.bool;
         default = true;
         description = "Strip the last N bits from IP addresses, determined by IPv4CIDR and IPv6CIDR";
       };
-      IPv4CIDR = mkOption {
-        type = ints.unsigned;
+      IPv4CIDR = lib.mkOption {
+        type = types.ints.unsigned;
         default = 24;
         description = "Strip N bits from IPv4 addresses if lookupBySubnet is true";
       };
-      IPv6CIDR = mkOption {
-        type = ints.unsigned;
+      IPv6CIDR = lib.mkOption {
+        type = types.ints.unsigned;
         default = 64;
         description = "Strip N bits from IPv6 addresses if lookupBySubnet is true";
       };
-      privacy = mkOption {
-        type = bool;
+      privacy = lib.mkOption {
+        type = types.bool;
         default = true;
         description = "Store data using one-way hash functions (SHA1)";
       };
-      autoWhitelist = mkOption {
-        type = nullOr ints.positive;
+      autoWhitelist = lib.mkOption {
+        type = types.nullOr types.ints.positive;
         default = 5;
         description = "Whitelist clients after successful delivery of N messages";
       };
-      whitelistClients = mkOption {
-        type = listOf path;
+      whitelistClients = lib.mkOption {
+        type = types.listOf types.path;
         default = [ ];
         description = "Client address whitelist files (see {manpage}`postgrey(8)`)";
       };
-      whitelistRecipients = mkOption {
-        type = listOf path;
+      whitelistRecipients = lib.mkOption {
+        type = types.listOf types.path;
         default = [ ];
         description = "Recipient address whitelist files (see {manpage}`postgrey(8)`)";
       };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     environment.systemPackages = [ pkgs.postgrey ];
 
@@ -203,7 +203,7 @@ in
             "--unix=${cfg.socket.path} --socketmode=${cfg.socket.mode}"
           else
             ''--inet=${
-              optionalString (cfg.socket.addr != null) (cfg.socket.addr + ":")
+              lib.optionalString (cfg.socket.addr != null) (cfg.socket.addr + ":")
             }${toString cfg.socket.port}'';
       in
       {
@@ -227,15 +227,15 @@ in
                       --retry-window=${toString cfg.retryWindow} \
                       ${if cfg.lookupBySubnet then "--lookup-by-subnet" else "--lookup-by-host"} \
                       --ipv4cidr=${toString cfg.IPv4CIDR} --ipv6cidr=${toString cfg.IPv6CIDR} \
-                      ${optionalString cfg.privacy "--privacy"} \
+                      ${lib.optionalString cfg.privacy "--privacy"} \
                       --auto-whitelist-clients=${
                         toString (if cfg.autoWhitelist == null then 0 else cfg.autoWhitelist)
                       } \
                       --greylist-action=${cfg.greylistAction} \
                       --greylist-text="${cfg.greylistText}" \
                       --x-greylist-header="${cfg.greylistHeader}" \
-                      ${concatMapStringsSep " " (x: "--whitelist-clients=" + x) cfg.whitelistClients} \
-                      ${concatMapStringsSep " " (x: "--whitelist-recipients=" + x) cfg.whitelistRecipients}
+                      ${lib.concatMapStringsSep " " (x: "--whitelist-clients=" + x) cfg.whitelistClients} \
+                      ${lib.concatMapStringsSep " " (x: "--whitelist-recipients=" + x) cfg.whitelistRecipients}
           '';
           Restart = "always";
           RestartSec = 5;
diff --git a/nixos/modules/services/mail/public-inbox.nix b/nixos/modules/services/mail/public-inbox.nix
index 353db2e2207ca..c9d491c195e3e 100644
--- a/nixos/modules/services/mail/public-inbox.nix
+++ b/nixos/modules/services/mail/public-inbox.nix
@@ -4,10 +4,9 @@
   config,
   ...
 }:
-
-with lib;
-
 let
+  inherit (lib) types;
+
   cfg = config.services.public-inbox;
   stateDir = "/var/lib/public-inbox";
 
@@ -19,13 +18,13 @@ let
     || cfg.settings.publicinboxwatch.spamcheck == "spamc";
 
   publicInboxDaemonOptions = proto: defaultPort: {
-    args = mkOption {
-      type = with types; listOf str;
+    args = lib.mkOption {
+      type = types.listOf types.str;
       default = [ ];
       description = "Command-line arguments to pass to {manpage}`public-inbox-${proto}d(1)`.";
     };
-    port = mkOption {
-      type = with types; nullOr (either str port);
+    port = lib.mkOption {
+      type = types.nullOr (types.either types.str types.port);
       default = defaultPort;
       description = ''
         Listening port.
@@ -34,14 +33,14 @@ let
         if you need a more advanced listening.
       '';
     };
-    cert = mkOption {
-      type = with types; nullOr str;
+    cert = lib.mkOption {
+      type = types.nullOr types.str;
       default = null;
       example = "/path/to/fullchain.pem";
       description = "Path to TLS certificate to use for connections to {manpage}`public-inbox-${proto}d(1)`.";
     };
-    key = mkOption {
-      type = with types; nullOr str;
+    key = lib.mkOption {
+      type = types.nullOr types.str;
       default = null;
       example = "/path/to/key.pem";
       description = "Path to TLS key to use for connections to {manpage}`public-inbox-${proto}d(1)`.";
@@ -51,7 +50,7 @@ let
   serviceConfig =
     srv:
     let
-      proto = removeSuffix "d" srv;
+      proto = lib.removeSuffix "d" srv;
       needNetwork = builtins.hasAttr proto cfg && cfg.${proto}.port == null;
     in
     {
@@ -79,8 +78,8 @@ let
           "/run/systemd"
           "${config.i18n.glibcLocales}"
         ]
-        ++ mapAttrsToList (name: inbox: inbox.description) cfg.inboxes
-        ++ filter (x: x != null) [
+        ++ lib.mapAttrsToList (name: inbox: inbox.description) cfg.inboxes
+        ++ lib.filter (x: x != null) [
           cfg.${proto}.cert or null
           cfg.${proto}.key or null
         ];
@@ -93,7 +92,7 @@ let
         LockPersonality = true;
         MemoryDenyWriteExecute = true;
         NoNewPrivileges = true;
-        PrivateNetwork = mkDefault (!needNetwork);
+        PrivateNetwork = lib.mkDefault (!needNetwork);
         ProcSubset = "pid";
         ProtectClock = true;
         ProtectHome = "tmpfs";
@@ -105,7 +104,7 @@ let
         RestrictAddressFamilies = [
           "AF_UNIX"
         ]
-        ++ optionals needNetwork [
+        ++ lib.optionals needNetwork [
           "AF_INET"
           "AF_INET6"
         ];
@@ -131,7 +130,7 @@ let
         binSh = "${pkgs.dash}/bin/dash";
         packages = [
           pkgs.iana-etc
-          (getLib pkgs.nss)
+          (lib.getLib pkgs.nss)
           pkgs.tzdata
         ];
       };
@@ -140,18 +139,18 @@ in
 
 {
   options.services.public-inbox = {
-    enable = mkEnableOption "the public-inbox mail archiver";
-    package = mkPackageOption pkgs "public-inbox" { };
-    path = mkOption {
-      type = with types; listOf package;
+    enable = lib.mkEnableOption "the public-inbox mail archiver";
+    package = lib.mkPackageOption pkgs "public-inbox" { };
+    path = lib.mkOption {
+      type = types.listOf types.package;
       default = [ ];
-      example = literalExpression "with pkgs; [ spamassassin ]";
+      example = lib.literalExpression "with pkgs; [ spamassassin ]";
       description = ''
         Additional packages to place in the path of public-inbox-mda,
         public-inbox-watch, etc.
       '';
     };
-    inboxes = mkOption {
+    inboxes = lib.mkOption {
       description = ''
         Inboxes to configure, where attribute names are inbox names.
       '';
@@ -161,40 +160,40 @@ in
           { name, ... }:
           {
             freeformType = types.attrsOf iniAtom;
-            options.inboxdir = mkOption {
+            options.inboxdir = lib.mkOption {
               type = types.str;
               default = "${stateDir}/inboxes/${name}";
               description = "The absolute path to the directory which hosts the public-inbox.";
             };
-            options.address = mkOption {
-              type = with types; listOf str;
+            options.address = lib.mkOption {
+              type = types.listOf types.str;
               example = "example-discuss@example.org";
               description = "The email addresses of the public-inbox.";
             };
-            options.url = mkOption {
+            options.url = lib.mkOption {
               type = types.nonEmptyStr;
               example = "https://example.org/lists/example-discuss";
               description = "URL where this inbox can be accessed over HTTP.";
             };
-            options.description = mkOption {
+            options.description = lib.mkOption {
               type = types.str;
               example = "user/dev discussion of public-inbox itself";
               description = "User-visible description for the repository.";
               apply = pkgs.writeText "public-inbox-description-${name}";
             };
-            options.newsgroup = mkOption {
-              type = with types; nullOr str;
+            options.newsgroup = lib.mkOption {
+              type = types.nullOr types.str;
               default = null;
               description = "NNTP group name for the inbox.";
             };
-            options.watch = mkOption {
-              type = with types; listOf str;
+            options.watch = lib.mkOption {
+              type = types.listOf types.str;
               default = [ ];
               description = "Paths for {manpage}`public-inbox-watch(1)` to monitor for new mail.";
               example = [ "maildir:/path/to/test.example.com.git" ];
             };
-            options.watchheader = mkOption {
-              type = with types; nullOr str;
+            options.watchheader = lib.mkOption {
+              type = types.nullOr types.str;
               default = null;
               example = "List-Id:<test@example.com>";
               description = ''
@@ -202,8 +201,8 @@ in
                 mail containing a matching header.
               '';
             };
-            options.coderepo = mkOption {
-              type = (types.listOf (types.enum (attrNames cfg.settings.coderepo))) // {
+            options.coderepo = lib.mkOption {
+              type = (types.listOf (types.enum (lib.attrNames cfg.settings.coderepo))) // {
                 description = "list of coderepo names";
               };
               default = [ ];
@@ -214,13 +213,13 @@ in
       );
     };
     imap = {
-      enable = mkEnableOption "the public-inbox IMAP server";
+      enable = lib.mkEnableOption "the public-inbox IMAP server";
     }
     // publicInboxDaemonOptions "imap" 993;
     http = {
-      enable = mkEnableOption "the public-inbox HTTP server";
-      mounts = mkOption {
-        type = with types; listOf str;
+      enable = lib.mkEnableOption "the public-inbox HTTP server";
+      mounts = lib.mkOption {
+        type = types.listOf types.str;
         default = [ "/" ];
         example = [ "/lists/archives" ];
         description = ''
@@ -230,8 +229,8 @@ in
         '';
       };
       args = (publicInboxDaemonOptions "http" 80).args;
-      port = mkOption {
-        type = with types; nullOr (either str port);
+      port = lib.mkOption {
+        type = types.nullOr (types.either types.str types.port);
         default = 80;
         example = "/run/public-inbox-httpd.sock";
         description = ''
@@ -244,57 +243,57 @@ in
       };
     };
     mda = {
-      enable = mkEnableOption "the public-inbox Mail Delivery Agent";
-      args = mkOption {
-        type = with types; listOf str;
+      enable = lib.mkEnableOption "the public-inbox Mail Delivery Agent";
+      args = lib.mkOption {
+        type = types.listOf types.str;
         default = [ ];
         description = "Command-line arguments to pass to {manpage}`public-inbox-mda(1)`.";
       };
     };
-    postfix.enable = mkEnableOption "the integration into Postfix";
+    postfix.enable = lib.mkEnableOption "the integration into Postfix";
     nntp = {
-      enable = mkEnableOption "the public-inbox NNTP server";
+      enable = lib.mkEnableOption "the public-inbox NNTP server";
     }
     // publicInboxDaemonOptions "nntp" 563;
-    spamAssassinRules = mkOption {
-      type = with types; nullOr path;
+    spamAssassinRules = lib.mkOption {
+      type = types.nullOr types.path;
       default = "${cfg.package.sa_config}/user/.spamassassin/user_prefs";
-      defaultText = literalExpression "\${cfg.package.sa_config}/user/.spamassassin/user_prefs";
+      defaultText = lib.literalExpression "\${cfg.package.sa_config}/user/.spamassassin/user_prefs";
       description = "SpamAssassin configuration specific to public-inbox.";
     };
-    settings = mkOption {
+    settings = lib.mkOption {
       description = ''
         Settings for the [public-inbox config file](https://public-inbox.org/public-inbox-config.html).
       '';
       default = { };
       type = types.submodule {
         freeformType = gitIni.type;
-        options.publicinbox = mkOption {
+        options.publicinbox = lib.mkOption {
           default = { };
           description = "public inboxes";
           type = types.submodule {
             # Support both global options like `services.public-inbox.settings.publicinbox.imapserver`
             # and inbox specific options like `services.public-inbox.settings.publicinbox.foo.address`.
-            freeformType =
-              with types;
-              attrsOf (oneOf [
+            freeformType = types.attrsOf (
+              types.oneOf [
                 iniAtom
-                (attrsOf iniAtom)
-              ]);
+                (types.attrsOf iniAtom)
+              ]
+            );
 
-            options.css = mkOption {
-              type = with types; listOf str;
+            options.css = lib.mkOption {
+              type = types.listOf types.str;
               default = [ ];
               description = "The local path name of a CSS file for the PSGI web interface.";
             };
-            options.imapserver = mkOption {
-              type = with types; listOf str;
+            options.imapserver = lib.mkOption {
+              type = types.listOf types.str;
               default = [ ];
               example = [ "imap.public-inbox.org" ];
               description = "IMAP URLs to this public-inbox instance";
             };
-            options.nntpserver = mkOption {
-              type = with types; listOf str;
+            options.nntpserver = lib.mkOption {
+              type = types.listOf types.str;
               default = [ ];
               example = [
                 "nntp://news.public-inbox.org"
@@ -302,20 +301,18 @@ in
               ];
               description = "NNTP URLs to this public-inbox instance";
             };
-            options.pop3server = mkOption {
-              type = with types; listOf str;
+            options.pop3server = lib.mkOption {
+              type = types.listOf types.str;
               default = [ ];
               example = [ "pop.public-inbox.org" ];
               description = "POP3 URLs to this public-inbox instance";
             };
-            options.wwwlisting = mkOption {
-              type =
-                with types;
-                enum [
-                  "all"
-                  "404"
-                  "match=domain"
-                ];
+            options.wwwlisting = lib.mkOption {
+              type = types.enum [
+                "all"
+                "404"
+                "match=domain"
+              ];
               default = "404";
               description = ''
                 Controls which lists (if any) are listed for when the root
@@ -324,34 +321,30 @@ in
             };
           };
         };
-        options.publicinboxmda.spamcheck = mkOption {
-          type =
-            with types;
-            enum [
-              "spamc"
-              "none"
-            ];
+        options.publicinboxmda.spamcheck = lib.mkOption {
+          type = types.enum [
+            "spamc"
+            "none"
+          ];
           default = "none";
           description = ''
             If set to spamc, {manpage}`public-inbox-watch(1)` will filter spam
             using SpamAssassin.
           '';
         };
-        options.publicinboxwatch.spamcheck = mkOption {
-          type =
-            with types;
-            enum [
-              "spamc"
-              "none"
-            ];
+        options.publicinboxwatch.spamcheck = lib.mkOption {
+          type = types.enum [
+            "spamc"
+            "none"
+          ];
           default = "none";
           description = ''
             If set to spamc, {manpage}`public-inbox-watch(1)` will filter spam
             using SpamAssassin.
           '';
         };
-        options.publicinboxwatch.watchspam = mkOption {
-          type = with types; nullOr str;
+        options.publicinboxwatch.watchspam = lib.mkOption {
+          type = types.nullOr types.str;
           default = null;
           example = "maildir:/path/to/spam";
           description = ''
@@ -359,17 +352,17 @@ in
             deleted from all watched inboxes
           '';
         };
-        options.coderepo = mkOption {
+        options.coderepo = lib.mkOption {
           default = { };
           description = "code repositories";
           type = types.attrsOf (
             types.submodule {
               freeformType = types.attrsOf iniAtom;
-              options.cgitUrl = mkOption {
+              options.cgitUrl = lib.mkOption {
                 type = types.str;
                 description = "URL of a cgit instance";
               };
-              options.dir = mkOption {
+              options.dir = lib.mkOption {
                 type = types.str;
                 description = "Path to a git repository";
               };
@@ -378,9 +371,9 @@ in
         };
       };
     };
-    openFirewall = mkEnableOption "opening the firewall when using a port option";
+    openFirewall = lib.mkEnableOption "opening the firewall when using a port option";
   };
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     assertions = [
       {
         assertion = config.services.spamassassin.enable || !useSpamAssassin;
@@ -402,8 +395,8 @@ in
         '';
       }
     ];
-    services.public-inbox.settings = filterAttrsRecursive (n: v: v != null) {
-      publicinbox = mapAttrs (n: v: removeAttrs v [ "description" ]) cfg.inboxes;
+    services.public-inbox.settings = lib.filterAttrsRecursive (n: v: v != null) {
+      publicinbox = lib.mapAttrs (n: v: lib.removeAttrs v [ "description" ]) cfg.inboxes;
     };
     users = {
       users.public-inbox = {
@@ -413,10 +406,12 @@ in
       };
       groups.public-inbox = { };
     };
-    networking.firewall = mkIf cfg.openFirewall {
-      allowedTCPPorts = mkMerge (
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = lib.mkMerge (
         map
-          (proto: (mkIf (cfg.${proto}.enable && types.port.check cfg.${proto}.port) [ cfg.${proto}.port ]))
+          (
+            proto: (lib.mkIf (cfg.${proto}.enable && types.port.check cfg.${proto}.port) [ cfg.${proto}.port ])
+          )
           [
             "imap"
             "http"
@@ -424,21 +419,21 @@ in
           ]
       );
     };
-    services.postfix = mkIf (cfg.postfix.enable && cfg.mda.enable) {
+    services.postfix = lib.mkIf (cfg.postfix.enable && cfg.mda.enable) {
       # Not sure limiting to 1 is necessary, but better safe than sorry.
       settings.main.public-inbox_destination_recipient_limit = "1";
 
       # Register the addresses as existing
-      virtual = concatStringsSep "\n" (
-        mapAttrsToList (
-          _: inbox: concatMapStringsSep "\n" (address: "${address} ${address}") inbox.address
+      virtual = lib.concatStringsSep "\n" (
+        lib.mapAttrsToList (
+          _: inbox: lib.concatMapStringsSep "\n" (address: "${address} ${address}") inbox.address
         ) cfg.inboxes
       );
 
       # Deliver the addresses with the public-inbox transport
-      transport = concatStringsSep "\n" (
-        mapAttrsToList (
-          _: inbox: concatMapStringsSep "\n" (address: "${address} public-inbox:${address}") inbox.address
+      transport = lib.concatStringsSep "\n" (
+        lib.mapAttrsToList (
+          _: inbox: lib.concatMapStringsSep "\n" (address: "${address} public-inbox:${address}") inbox.address
         ) cfg.inboxes
       );
 
@@ -456,17 +451,17 @@ in
           "argv=${pkgs.writeShellScript "public-inbox-transport" ''
             export HOME="${stateDir}"
             export ORIGINAL_RECIPIENT="''${2:-1}"
-            export PATH="${makeBinPath cfg.path}:$PATH"
-            exec ${cfg.package}/bin/public-inbox-mda ${escapeShellArgs cfg.mda.args}
+            export PATH="${lib.makeBinPath cfg.path}:$PATH"
+            exec ${cfg.package}/bin/public-inbox-mda ${lib.escapeShellArgs cfg.mda.args}
           ''} \${original_recipient} \${nexthop}"
         ];
       };
     };
-    systemd.sockets = mkMerge (
+    systemd.sockets = lib.mkMerge (
       map
         (
           proto:
-          mkIf (cfg.${proto}.enable && cfg.${proto}.port != null) {
+          lib.mkIf (cfg.${proto}.enable && cfg.${proto}.port != null) {
             "public-inbox-${proto}d" = {
               listenStreams = [ (toString cfg.${proto}.port) ];
               wantedBy = [ "sockets.target" ];
@@ -479,9 +474,9 @@ in
           "nntp"
         ]
     );
-    systemd.services = mkMerge [
-      (mkIf cfg.imap.enable {
-        public-inbox-imapd = mkMerge [
+    systemd.services = lib.mkMerge [
+      (lib.mkIf cfg.imap.enable {
+        public-inbox-imapd = lib.mkMerge [
           (serviceConfig "imapd")
           {
             after = [
@@ -490,14 +485,14 @@ in
             ];
             requires = [ "public-inbox-init.service" ];
             serviceConfig = {
-              ExecStart = escapeShellArgs (
+              ExecStart = lib.escapeShellArgs (
                 [ "${cfg.package}/bin/public-inbox-imapd" ]
                 ++ cfg.imap.args
-                ++ optionals (cfg.imap.cert != null) [
+                ++ lib.optionals (cfg.imap.cert != null) [
                   "--cert"
                   cfg.imap.cert
                 ]
-                ++ optionals (cfg.imap.key != null) [
+                ++ lib.optionals (cfg.imap.key != null) [
                   "--key"
                   cfg.imap.key
                 ]
@@ -506,8 +501,8 @@ in
           }
         ];
       })
-      (mkIf cfg.http.enable {
-        public-inbox-httpd = mkMerge [
+      (lib.mkIf cfg.http.enable {
+        public-inbox-httpd = lib.mkMerge [
           (serviceConfig "httpd")
           {
             after = [
@@ -517,7 +512,7 @@ in
             requires = [ "public-inbox-init.service" ];
             serviceConfig = {
               BindReadOnlyPaths = map (c: c.dir) (lib.attrValues cfg.settings.coderepo);
-              ExecStart = escapeShellArgs (
+              ExecStart = lib.escapeShellArgs (
                 [ "${cfg.package}/bin/public-inbox-httpd" ]
                 ++ cfg.http.args
                 ++
@@ -544,7 +539,7 @@ in
                         enable 'Head';
 
                         # Route according to configured domains and root paths.
-                        ${concatMapStrings (path: ''
+                        ${lib.concatMapStrings (path: ''
                           mount q(${path}) => sub { $www->call(@_); };
                         '') cfg.http.mounts}
                       }
@@ -555,8 +550,8 @@ in
           }
         ];
       })
-      (mkIf cfg.nntp.enable {
-        public-inbox-nntpd = mkMerge [
+      (lib.mkIf cfg.nntp.enable {
+        public-inbox-nntpd = lib.mkMerge [
           (serviceConfig "nntpd")
           {
             after = [
@@ -565,14 +560,14 @@ in
             ];
             requires = [ "public-inbox-init.service" ];
             serviceConfig = {
-              ExecStart = escapeShellArgs (
+              ExecStart = lib.escapeShellArgs (
                 [ "${cfg.package}/bin/public-inbox-nntpd" ]
                 ++ cfg.nntp.args
-                ++ optionals (cfg.nntp.cert != null) [
+                ++ lib.optionals (cfg.nntp.cert != null) [
                   "--cert"
                   cfg.nntp.cert
                 ]
-                ++ optionals (cfg.nntp.key != null) [
+                ++ lib.optionals (cfg.nntp.key != null) [
                   "--key"
                   cfg.nntp.key
                 ]
@@ -581,13 +576,13 @@ in
           }
         ];
       })
-      (mkIf
+      (lib.mkIf
         (
-          any (inbox: inbox.watch != [ ]) (attrValues cfg.inboxes)
+          lib.any (inbox: inbox.watch != [ ]) (lib.attrValues cfg.inboxes)
           || cfg.settings.publicinboxwatch.watchspam != null
         )
         {
-          public-inbox-watch = mkMerge [
+          public-inbox-watch = lib.mkMerge [
             (serviceConfig "watch")
             {
               inherit (cfg) path;
@@ -595,7 +590,7 @@ in
               requires = [
                 "public-inbox-init.service"
               ]
-              ++ optional (cfg.settings.publicinboxwatch.spamcheck == "spamc") "spamassassin.service";
+              ++ lib.optional (cfg.settings.publicinboxwatch.spamcheck == "spamc") "spamassassin.service";
               wantedBy = [ "multi-user.target" ];
               serviceConfig = {
                 ExecStart = "${cfg.package}/bin/public-inbox-watch";
@@ -609,10 +604,10 @@ in
         public-inbox-init =
           let
             PI_CONFIG = gitIni.generate "public-inbox.ini" (
-              filterAttrsRecursive (n: v: v != null) cfg.settings
+              lib.filterAttrsRecursive (n: v: v != null) cfg.settings
             );
           in
-          mkMerge [
+          lib.mkMerge [
             (serviceConfig "init")
             {
               wantedBy = [ "multi-user.target" ];
@@ -622,15 +617,15 @@ in
                 set -ux
                 install -D -p ${PI_CONFIG} ${stateDir}/.public-inbox/config
               ''
-              + optionalString useSpamAssassin ''
+              + lib.optionalString useSpamAssassin ''
                 install -m 0700 -o spamd -d ${stateDir}/.spamassassin
-                ${optionalString (cfg.spamAssassinRules != null) ''
+                ${lib.optionalString (cfg.spamAssassinRules != null) ''
                   ln -sf ${cfg.spamAssassinRules} ${stateDir}/.spamassassin/user_prefs
                 ''}
               ''
-              + concatStrings (
-                mapAttrsToList (name: inbox: ''
-                  if [ ! -e ${escapeShellArg inbox.inboxdir} ]; then
+              + lib.concatStrings (
+                lib.mapAttrsToList (name: inbox: ''
+                  if [ ! -e ${lib.escapeShellArg inbox.inboxdir} ]; then
                     # public-inbox-init creates an inbox and adds it to a config file.
                     # It tries to atomically write the config file by creating
                     # another file in the same directory, and renaming it.
@@ -640,7 +635,7 @@ in
 
                     PI_CONFIG=$conf_dir/conf \
                     ${cfg.package}/bin/public-inbox-init -V2 \
-                      ${escapeShellArgs (
+                      ${lib.escapeShellArgs (
                         [
                           name
                           inbox.inboxdir
@@ -653,9 +648,9 @@ in
                   fi
 
                   ln -sf ${inbox.description} \
-                    ${escapeShellArg inbox.inboxdir}/description
+                    ${lib.escapeShellArg inbox.inboxdir}/description
 
-                  export GIT_DIR=${escapeShellArg inbox.inboxdir}/all.git
+                  export GIT_DIR=${lib.escapeShellArg inbox.inboxdir}/all.git
                   if test -d "$GIT_DIR"; then
                     # Config is inherited by each epoch repository,
                     # so just needs to be set for all.git.
diff --git a/nixos/modules/services/mail/rspamd.nix b/nixos/modules/services/mail/rspamd.nix
index 715376e24f883..58b97dd79a88e 100644
--- a/nixos/modules/services/mail/rspamd.nix
+++ b/nixos/modules/services/mail/rspamd.nix
@@ -5,10 +5,8 @@
   lib,
   ...
 }:
-
-with lib;
-
 let
+  inherit (lib) types;
 
   cfg = config.services.rspamd;
   opt = options.services.rspamd;
@@ -18,38 +16,39 @@ let
     { options, config, ... }:
     {
       options = {
-        socket = mkOption {
+        socket = lib.mkOption {
           type = types.str;
           example = "localhost:11333";
           description = ''
             Socket for this worker to listen on in a format acceptable by rspamd.
           '';
         };
-        mode = mkOption {
+        mode = lib.mkOption {
           type = types.str;
           default = "0644";
           description = "Mode to set on unix socket";
         };
-        owner = mkOption {
+        owner = lib.mkOption {
           type = types.str;
           default = "${cfg.user}";
           description = "Owner to set on unix socket";
         };
-        group = mkOption {
+        group = lib.mkOption {
           type = types.str;
           default = "${cfg.group}";
           description = "Group to set on unix socket";
         };
-        rawEntry = mkOption {
+        rawEntry = lib.mkOption {
           type = types.str;
           internal = true;
         };
       };
       config.rawEntry =
         let
-          maybeOption = option: optionalString options.${option}.isDefined " ${option}=${config.${option}}";
+          maybeOption =
+            option: lib.optionalString options.${option}.isDefined " ${option}=${config.${option}}";
         in
-        if (!(hasPrefix "/" config.socket)) then
+        if (!(lib.hasPrefix "/" config.socket)) then
           "${config.socket}"
         else
           "${config.socket}${maybeOption "mode"}${maybeOption "owner"}${maybeOption "group"}";
@@ -61,17 +60,17 @@ let
     { name, options, ... }:
     {
       options = {
-        enable = mkOption {
+        enable = lib.mkOption {
           type = types.nullOr types.bool;
           default = null;
           description = "Whether to run the rspamd worker.";
         };
-        name = mkOption {
+        name = lib.mkOption {
           type = types.nullOr types.str;
           default = name;
           description = "Name of the worker";
         };
-        type = mkOption {
+        type = lib.mkOption {
           type = types.nullOr (
             types.enum [
               "normal"
@@ -91,11 +90,11 @@ let
             let
               from = "services.rspamd.workers.\"${name}\".type";
               files = options.type.files;
-              warning = "The option `${from}` defined in ${showFiles files} has enum value `proxy` which has been renamed to `rspamd_proxy`";
+              warning = "The option `${from}` defined in ${lib.showFiles files} has enum value `proxy` which has been renamed to `rspamd_proxy`";
             in
             x: if x == "proxy" then traceWarning warning "rspamd_proxy" else x;
         };
-        bindSockets = mkOption {
+        bindSockets = lib.mkOption {
           type = types.listOf (types.either types.str (types.submodule bindSocketOpts));
           default = [ ];
           description = ''
@@ -113,7 +112,7 @@ let
             value:
             map (
               each:
-              if (isString each) then
+              if (lib.isString each) then
                 if (isUnixSocket each) then
                   {
                     socket = each;
@@ -131,31 +130,33 @@ let
                 each
             ) value;
         };
-        count = mkOption {
+        count = lib.mkOption {
           type = types.nullOr types.int;
           default = null;
           description = ''
             Number of worker instances to run
           '';
         };
-        includes = mkOption {
+        includes = lib.mkOption {
           type = types.listOf types.str;
           default = [ ];
           description = ''
             List of files to include in configuration
           '';
         };
-        extraConfig = mkOption {
+        extraConfig = lib.mkOption {
           type = types.lines;
           default = "";
           description = "Additional entries to put verbatim into worker section of rspamd config file.";
         };
       };
       config =
-        mkIf (name == "normal" || name == "controller" || name == "fuzzy" || name == "rspamd_proxy")
+        lib.mkIf (name == "normal" || name == "controller" || name == "fuzzy" || name == "rspamd_proxy")
           {
-            type = mkDefault name;
-            includes = mkDefault [ "$CONFDIR/worker-${if name == "rspamd_proxy" then "proxy" else name}.inc" ];
+            type = lib.mkDefault name;
+            includes = lib.mkDefault [
+              "$CONFDIR/worker-${if name == "rspamd_proxy" then "proxy" else name}.inc"
+            ];
             bindSockets =
               let
                 unixSocket = name: {
@@ -165,7 +166,7 @@ let
                   group = cfg.group;
                 };
               in
-              mkDefault (
+              lib.mkDefault (
                 if name == "normal" then
                   [ (unixSocket "rspamd") ]
                 else if name == "controller" then
@@ -178,11 +179,11 @@ let
           };
     };
 
-  isUnixSocket = socket: hasPrefix "/" (if (isString socket) then socket else socket.socket);
+  isUnixSocket = socket: lib.hasPrefix "/" (if (lib.isString socket) then socket else socket.socket);
 
   mkBindSockets =
     enabled: socks:
-    concatStringsSep "\n  " (flatten (map (each: "bind_socket = \"${each.rawEntry}\";") socks));
+    lib.concatStringsSep "\n  " (lib.flatten (map (each: "bind_socket = \"${each.rawEntry}\";") socks));
 
   rspamdConfFile = pkgs.writeText "rspamd.conf" ''
     .include "$CONFDIR/common.conf"
@@ -201,20 +202,22 @@ let
       .include(try=true; priority=10) "$LOCAL_CONFDIR/override.d/logging.inc"
     }
 
-    ${concatStringsSep "\n" (
-      mapAttrsToList (
+    ${lib.concatStringsSep "\n" (
+      lib.mapAttrsToList (
         name: value:
         let
           includeName = if name == "rspamd_proxy" then "proxy" else name;
-          tryOverride = boolToString (value.extraConfig == "");
+          tryOverride = lib.boolToString (value.extraConfig == "");
         in
         ''
           worker "${value.type}" {
             type = "${value.type}";
-            ${optionalString (value.enable != null) "enabled = ${lib.boolToYesNo (value.enable != false)};"}
+            ${lib.optionalString (value.enable != null)
+              "enabled = ${lib.boolToYesNo (value.enable != false)};"
+            }
             ${mkBindSockets value.enable value.bindSockets}
-            ${optionalString (value.count != null) "count = ${toString value.count};"}
-            ${concatStringsSep "\n  " (map (each: ".include \"${each}\"") value.includes)}
+            ${lib.optionalString (value.count != null) "count = ${toString value.count};"}
+            ${lib.concatStringsSep "\n  " (map (each: ".include \"${each}\"") value.includes)}
             .include(try=true; priority=1,duplicate=merge) "$LOCAL_CONFDIR/local.d/worker-${includeName}.inc"
             .include(try=${tryOverride}; priority=10) "$LOCAL_CONFDIR/override.d/worker-${includeName}.inc"
           }
@@ -222,22 +225,22 @@ let
       ) cfg.workers
     )}
 
-    ${optionalString (cfg.extraConfig != "") ''
+    ${lib.optionalString (cfg.extraConfig != "") ''
       .include(priority=10) "$LOCAL_CONFDIR/override.d/extra-config.inc"
     ''}
   '';
 
-  filterFiles = files: filterAttrs (n: v: v.enable) files;
+  filterFiles = files: lib.filterAttrs (n: v: v.enable) files;
   rspamdDir = pkgs.linkFarm "etc-rspamd-dir" (
-    (mapAttrsToList (name: file: {
+    (lib.mapAttrsToList (name: file: {
       name = "local.d/${name}";
       path = file.source;
     }) (filterFiles cfg.locals))
-    ++ (mapAttrsToList (name: file: {
+    ++ (lib.mapAttrsToList (name: file: {
       name = "override.d/${name}";
       path = file.source;
     }) (filterFiles cfg.overrides))
-    ++ (optional (cfg.localLuaRules != null) {
+    ++ (lib.optional (cfg.localLuaRules != null) {
       name = "rspamd.local.lua";
       path = cfg.localLuaRules;
     })
@@ -254,7 +257,7 @@ let
     { name, config, ... }:
     {
       options = {
-        enable = mkOption {
+        enable = lib.mkOption {
           type = types.bool;
           default = true;
           description = ''
@@ -263,34 +266,34 @@ let
           '';
         };
 
-        text = mkOption {
+        text = lib.mkOption {
           default = null;
           type = types.nullOr types.lines;
           description = "Text of the file.";
         };
 
-        source = mkOption {
+        source = lib.mkOption {
           type = types.path;
           description = "Path of the source file.";
         };
       };
       config = {
-        source = mkIf (config.text != null) (
+        source = lib.mkIf (config.text != null) (
           let
             name' = "rspamd-${prefix}-" + baseNameOf name;
           in
-          mkDefault (pkgs.writeText name' config.text)
+          lib.mkDefault (pkgs.writeText name' config.text)
         );
       };
     };
 
   configOverrides =
-    (mapAttrs' (
+    (lib.mapAttrs' (
       n: v:
-      nameValuePair "worker-${if n == "rspamd_proxy" then "proxy" else n}.inc" {
+      lib.nameValuePair "worker-${if n == "rspamd_proxy" then "proxy" else n}.inc" {
         text = v.extraConfig;
       }
-    ) (filterAttrs (n: v: v.extraConfig != "") cfg.workers))
+    ) (lib.filterAttrs (n: v: v.extraConfig != "") cfg.workers))
     // (lib.optionalAttrs (cfg.extraConfig != "") {
       "extra-config.inc".text = cfg.extraConfig;
     });
@@ -302,42 +305,42 @@ in
   options = {
 
     services.rspamd = {
-      enable = mkEnableOption "rspamd, the Rapid spam filtering system";
+      enable = lib.mkEnableOption "rspamd, the Rapid spam filtering system";
       package = lib.mkPackageOption pkgs "rspamd" { };
 
-      debug = mkOption {
+      debug = lib.mkOption {
         type = types.bool;
         default = false;
         description = "Whether to run the rspamd daemon in debug mode.";
       };
 
-      locals = mkOption {
-        type = with types; attrsOf (submodule (configFileModule "locals"));
+      locals = lib.mkOption {
+        type = types.attrsOf (types.submodule (configFileModule "locals"));
         default = { };
         description = ''
           Local configuration files, written into {file}`/etc/rspamd/local.d/{name}`.
         '';
-        example = literalExpression ''
+        example = lib.literalExpression ''
           { "redis.conf".source = "/nix/store/.../etc/dir/redis.conf";
             "arc.conf".text = "allow_envfrom_empty = true;";
           }
         '';
       };
 
-      overrides = mkOption {
+      overrides = lib.mkOption {
         type = with types; attrsOf (submodule (configFileModule "overrides"));
         default = { };
         description = ''
           Overridden configuration files, written into {file}`/etc/rspamd/override.d/{name}`.
         '';
-        example = literalExpression ''
+        example = lib.literalExpression ''
           { "redis.conf".source = "/nix/store/.../etc/dir/redis.conf";
             "arc.conf".text = "allow_envfrom_empty = true;";
           }
         '';
       };
 
-      localLuaRules = mkOption {
+      localLuaRules = lib.mkOption {
         default = null;
         type = types.nullOr types.path;
         description = ''
@@ -346,7 +349,7 @@ in
         '';
       };
 
-      workers = mkOption {
+      workers = lib.mkOption {
         type = with types; attrsOf (submodule workerOpts);
         description = ''
           Attribute set of workers to start.
@@ -355,7 +358,7 @@ in
           normal = { };
           controller = { };
         };
-        example = literalExpression ''
+        example = lib.literalExpression ''
           {
             normal = {
               includes = [ "$CONFDIR/worker-normal.inc" ];
@@ -374,7 +377,7 @@ in
         '';
       };
 
-      extraConfig = mkOption {
+      extraConfig = lib.mkOption {
         type = types.lines;
         default = "";
         description = ''
@@ -383,7 +386,7 @@ in
         '';
       };
 
-      user = mkOption {
+      user = lib.mkOption {
         type = types.str;
         default = "rspamd";
         description = ''
@@ -391,7 +394,7 @@ in
         '';
       };
 
-      group = mkOption {
+      group = lib.mkOption {
         type = types.str;
         default = "rspamd";
         description = ''
@@ -400,13 +403,13 @@ in
       };
 
       postfix = {
-        enable = mkOption {
+        enable = lib.mkOption {
           type = types.bool;
           default = false;
           description = "Add rspamd milter to postfix main.conf";
         };
 
-        config = mkOption {
+        config = lib.mkOption {
           type =
             with types;
             attrsOf (oneOf [
@@ -428,9 +431,9 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     services.rspamd.overrides = configOverrides;
-    services.rspamd.workers = mkIf cfg.postfix.enable {
+    services.rspamd.workers = lib.mkIf cfg.postfix.enable {
       controller = { };
       rspamd_proxy = {
         bindSockets = [
@@ -449,9 +452,9 @@ in
         '';
       };
     };
-    services.postfix.settings.main = mkIf cfg.postfix.enable cfg.postfix.config;
+    services.postfix.settings.main = lib.mkIf cfg.postfix.enable cfg.postfix.config;
 
-    systemd.services.postfix = mkIf cfg.postfix.enable {
+    systemd.services.postfix = lib.mkIf cfg.postfix.enable {
       serviceConfig.SupplementaryGroups = [ postfixCfg.group ];
     };
 
@@ -478,12 +481,12 @@ in
       restartTriggers = [ rspamdDir ];
 
       serviceConfig = {
-        ExecStart = "${cfg.package}/bin/rspamd ${optionalString cfg.debug "-d"} -c /etc/rspamd/rspamd.conf -f";
+        ExecStart = "${cfg.package}/bin/rspamd ${lib.optionalString cfg.debug "-d"} -c /etc/rspamd/rspamd.conf -f";
         Restart = "always";
 
         User = "${cfg.user}";
         Group = "${cfg.group}";
-        SupplementaryGroups = mkIf cfg.postfix.enable [ postfixCfg.group ];
+        SupplementaryGroups = lib.mkIf cfg.postfix.enable [ postfixCfg.group ];
 
         RuntimeDirectory = "rspamd";
         RuntimeDirectoryMode = "0755";
@@ -524,20 +527,20 @@ in
     };
   };
   imports = [
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "rspamd"
       "socketActivation"
     ] "Socket activation never worked correctly and could at this time not be fixed and so was removed")
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "rspamd" "bindSocket" ]
       [ "services" "rspamd" "workers" "normal" "bindSockets" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "rspamd" "bindUISocket" ]
       [ "services" "rspamd" "workers" "controller" "bindSockets" ]
     )
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "rmilter"
     ] "Use services.rspamd.* instead to set up milter service")
diff --git a/nixos/modules/services/matrix/maubot.nix b/nixos/modules/services/matrix/maubot.nix
index 382c5436e07b5..0b8ee3af80ee7 100644
--- a/nixos/modules/services/matrix/maubot.nix
+++ b/nixos/modules/services/matrix/maubot.nix
@@ -6,6 +6,8 @@
 }:
 
 let
+  inherit (lib) types;
+
   cfg = config.services.maubot;
 
   wrapper1 = if cfg.plugins == [ ] then cfg.package else cfg.package.withPlugins (_: cfg.plugins);
@@ -58,15 +60,15 @@ let
   hasLocalPostgresDB = localPostgresDBs != [ ];
 in
 {
-  options.services.maubot = with lib; {
-    enable = mkEnableOption "maubot";
+  options.services.maubot = {
+    enable = lib.mkEnableOption "maubot";
 
     package = lib.mkPackageOption pkgs "maubot" { };
 
-    plugins = mkOption {
+    plugins = lib.mkOption {
       type = types.listOf types.package;
       default = [ ];
-      example = literalExpression ''
+      example = lib.literalExpression ''
         with config.services.maubot.package.plugins; [
           xyz.maubot.reactbot
           xyz.maubot.rss
@@ -77,10 +79,10 @@ in
       '';
     };
 
-    pythonPackages = mkOption {
+    pythonPackages = lib.mkOption {
       type = types.listOf types.package;
       default = [ ];
-      example = literalExpression ''
+      example = lib.literalExpression ''
         with pkgs.python3Packages; [
           aiohttp
         ];
@@ -90,7 +92,7 @@ in
       '';
     };
 
-    dataDir = mkOption {
+    dataDir = lib.mkOption {
       type = types.str;
       default = "/var/lib/maubot";
       description = ''
@@ -98,10 +100,10 @@ in
       '';
     };
 
-    extraConfigFile = mkOption {
+    extraConfigFile = lib.mkOption {
       type = types.str;
       default = "./config.yaml";
-      defaultText = literalExpression ''"''${config.services.maubot.dataDir}/config.yaml"'';
+      defaultText = lib.literalExpression ''"''${config.services.maubot.dataDir}/config.yaml"'';
       description = ''
         A file for storing secrets. You can pass homeserver registration keys here.
         If it already exists, **it must contain `server.unshared_secret`** which is used for signing API keys.
@@ -109,7 +111,7 @@ in
       '';
     };
 
-    configMutable = mkOption {
+    configMutable = lib.mkOption {
       type = types.bool;
       default = false;
       description = ''
@@ -117,7 +119,7 @@ in
       '';
     };
 
-    settings = mkOption {
+    settings = lib.mkOption {
       default = { };
       description = ''
         YAML settings for maubot. See the
@@ -127,11 +129,10 @@ in
         Secrets should be passed in by using `extraConfigFile`.
       '';
       type =
-        with types;
-        submodule {
+        types.submodule {
           options = {
-            database = mkOption {
-              type = str;
+            database = lib.mkOption {
+              type = types.str;
               default = "sqlite:maubot.db";
               example = "postgresql://username:password@hostname/dbname";
               description = ''
@@ -140,8 +141,8 @@ in
               '';
             };
 
-            crypto_database = mkOption {
-              type = str;
+            crypto_database = lib.mkOption {
+              type = types.str;
               default = "default";
               example = "postgresql://username:password@hostname/dbname";
               description = ''
@@ -149,7 +150,7 @@ in
               '';
             };
 
-            database_opts = mkOption {
+            database_opts = lib.mkOption {
               type = types.attrs;
               default = { };
               description = ''
@@ -157,31 +158,31 @@ in
               '';
             };
 
-            plugin_directories = mkOption {
+            plugin_directories = lib.mkOption {
               default = { };
               description = "Plugin directory paths";
-              type = submodule {
+              type = types.submodule {
                 options = {
-                  upload = mkOption {
+                  upload = lib.mkOption {
                     type = types.str;
                     default = "./plugins";
-                    defaultText = literalExpression ''"''${config.services.maubot.dataDir}/plugins"'';
+                    defaultText = lib.literalExpression ''"''${config.services.maubot.dataDir}/plugins"'';
                     description = ''
                       The directory where uploaded new plugins should be stored.
                     '';
                   };
-                  load = mkOption {
+                  load = lib.mkOption {
                     type = types.listOf types.str;
                     default = [ "./plugins" ];
-                    defaultText = literalExpression ''[ "''${config.services.maubot.dataDir}/plugins" ]'';
+                    defaultText = lib.literalExpression ''[ "''${config.services.maubot.dataDir}/plugins" ]'';
                     description = ''
                       The directories from which plugins should be loaded. Duplicate plugin IDs will be moved to the trash.
                     '';
                   };
-                  trash = mkOption {
+                  trash = lib.mkOption {
                     type = with types; nullOr str;
                     default = "./trash";
-                    defaultText = literalExpression ''"''${config.services.maubot.dataDir}/trash"'';
+                    defaultText = lib.literalExpression ''"''${config.services.maubot.dataDir}/trash"'';
                     description = ''
                       The directory where old plugin versions and conflicting plugins should be moved. Set to null to delete files immediately.
                     '';
@@ -190,30 +191,30 @@ in
               };
             };
 
-            plugin_databases = mkOption {
+            plugin_databases = lib.mkOption {
               description = "Plugin database settings";
               default = { };
-              type = submodule {
+              type = types.submodule {
                 options = {
-                  sqlite = mkOption {
+                  sqlite = lib.mkOption {
                     type = types.str;
                     default = "./plugins";
-                    defaultText = literalExpression ''"''${config.services.maubot.dataDir}/plugins"'';
+                    defaultText = lib.literalExpression ''"''${config.services.maubot.dataDir}/plugins"'';
                     description = ''
                       The directory where SQLite plugin databases should be stored.
                     '';
                   };
 
-                  postgres = mkOption {
+                  postgres = lib.mkOption {
                     type = types.nullOr types.str;
                     default = if isPostgresql cfg.settings.database then "default" else null;
-                    defaultText = literalExpression ''if isPostgresql config.services.maubot.settings.database then "default" else null'';
+                    defaultText = lib.literalExpression ''if isPostgresql config.services.maubot.settings.database then "default" else null'';
                     description = ''
                       The connection URL for plugin database. See [example config](https://github.com/maubot/maubot/blob/master/maubot/example-config.yaml) for exact format.
                     '';
                   };
 
-                  postgres_max_conns_per_plugin = mkOption {
+                  postgres_max_conns_per_plugin = lib.mkOption {
                     type = types.nullOr types.int;
                     default = 3;
                     description = ''
@@ -221,7 +222,7 @@ in
                     '';
                   };
 
-                  postgres_opts = mkOption {
+                  postgres_opts = lib.mkOption {
                     type = types.attrs;
                     default = { };
                     description = ''
@@ -232,51 +233,51 @@ in
               };
             };
 
-            server = mkOption {
+            server = lib.mkOption {
               default = { };
               description = "Listener config";
-              type = submodule {
+              type = types.submodule {
                 options = {
-                  hostname = mkOption {
+                  hostname = lib.mkOption {
                     type = types.str;
                     default = "127.0.0.1";
                     description = ''
                       The IP to listen on
                     '';
                   };
-                  port = mkOption {
+                  port = lib.mkOption {
                     type = types.port;
                     default = 29316;
                     description = ''
                       The port to listen on
                     '';
                   };
-                  public_url = mkOption {
+                  public_url = lib.mkOption {
                     type = types.str;
                     default = "http://${cfg.settings.server.hostname}:${toString cfg.settings.server.port}";
-                    defaultText = literalExpression ''"http://''${config.services.maubot.settings.server.hostname}:''${toString config.services.maubot.settings.server.port}"'';
+                    defaultText = lib.literalExpression ''"http://''${config.services.maubot.settings.server.hostname}:''${toString config.services.maubot.settings.server.port}"'';
                     description = ''
                       Public base URL where the server is visible.
                     '';
                   };
-                  ui_base_path = mkOption {
+                  ui_base_path = lib.mkOption {
                     type = types.str;
                     default = "/_matrix/maubot";
                     description = ''
                       The base path for the UI.
                     '';
                   };
-                  plugin_base_path = mkOption {
+                  plugin_base_path = lib.mkOption {
                     type = types.str;
                     default = "${config.services.maubot.settings.server.ui_base_path}/plugin/";
-                    defaultText = literalExpression ''
+                    defaultText = lib.literalExpression ''
                       "''${config.services.maubot.settings.server.ui_base_path}/plugin/"
                     '';
                     description = ''
                       The base path for plugin endpoints. The instance ID will be appended directly.
                     '';
                   };
-                  override_resource_path = mkOption {
+                  override_resource_path = lib.mkOption {
                     type = types.nullOr types.str;
                     default = null;
                     description = ''
@@ -287,11 +288,11 @@ in
               };
             };
 
-            homeservers = mkOption {
+            homeservers = lib.mkOption {
               type = types.attrsOf (
                 types.submodule {
                   options = {
-                    url = mkOption {
+                    url = lib.mkOption {
                       type = types.str;
                       description = ''
                         Client-server API URL
@@ -311,7 +312,7 @@ in
               '';
             };
 
-            admins = mkOption {
+            admins = lib.mkOption {
               type = types.attrsOf types.str;
               default = {
                 root = "";
@@ -322,8 +323,8 @@ in
               '';
             };
 
-            api_features = mkOption {
-              type = types.attrsOf bool;
+            api_features = lib.mkOption {
+              type = types.attrsOf types.bool;
               default = {
                 login = true;
                 plugin = true;
@@ -341,7 +342,7 @@ in
               '';
             };
 
-            logging = mkOption {
+            logging = lib.mkOption {
               type = types.attrs;
               description = ''
                 Python logging configuration. See [section 16.7.2 of the Python
diff --git a/nixos/modules/services/matrix/synapse.nix b/nixos/modules/services/matrix/synapse.nix
index ec5cf8aee8dd7..69aaaa8a83d87 100644
--- a/nixos/modules/services/matrix/synapse.nix
+++ b/nixos/modules/services/matrix/synapse.nix
@@ -6,19 +6,18 @@
   utils,
   ...
 }:
-
-with lib;
-
 let
+  inherit (lib) types;
+
   cfg = config.services.matrix-synapse;
   format = pkgs.formats.yaml { };
 
   filterRecursiveNull =
     o:
-    if isAttrs o then
-      mapAttrs (_: v: filterRecursiveNull v) (filterAttrs (_: v: v != null) o)
-    else if isList o then
-      map filterRecursiveNull (filter (v: v != null) o)
+    if lib.isAttrs o then
+      lib.mapAttrs (_: v: filterRecursiveNull v) (lib.filterAttrs (_: v: v != null) o)
+    else if lib.isList o then
+      map filterRecursiveNull (lib.filter (v: v != null) o)
     else
       o;
 
@@ -34,7 +33,7 @@ let
     usePostgresql
     && (
       !(args ? host)
-      || (elem args.host [
+      || (lib.elem args.host [
         "localhost"
         "127.0.0.1"
         "::1"
@@ -46,20 +45,20 @@ let
   listenerSupportsResource =
     resource: listener: lib.any ({ names, ... }: builtins.elem resource names) listener.resources;
 
-  clientListener = findFirst (listenerSupportsResource "client") null (
+  clientListener = lib.findFirst (listenerSupportsResource "client") null (
     cfg.settings.listeners
-    ++ concatMap ({ worker_listeners, ... }: worker_listeners) (attrValues cfg.workers)
+    ++ lib.concatMap ({ worker_listeners, ... }: worker_listeners) (lib.attrValues cfg.workers)
   );
 
   registerNewMatrixUser =
     let
-      isIpv6 = hasInfix ":";
+      isIpv6 = lib.hasInfix ":";
 
       # add a tail, so that without any bind_addresses we still have a useable address
-      bindAddress = head (clientListener.bind_addresses ++ [ "127.0.0.1" ]);
+      bindAddress = lib.head (clientListener.bind_addresses ++ [ "127.0.0.1" ]);
       listenerProtocol = if clientListener.tls then "https" else "http";
     in
-    assert assertMsg (
+    assert lib.assertMsg (
       clientListener != null
     ) "No client listener found in synapse or one of its workers";
     pkgs.writeShellScriptBin "matrix-synapse-register_new_matrix_user" ''
@@ -106,7 +105,7 @@ let
     disable_existing_loggers = false;
   };
 
-  defaultCommonLogConfigText = generators.toPretty { } defaultCommonLogConfig;
+  defaultCommonLogConfigText = lib.generators.toPretty { } defaultCommonLogConfig;
 
   logConfigText =
     logName:
@@ -114,8 +113,8 @@ let
       Path to a yaml file generated from this Nix expression:
 
       ```
-      ${generators.toPretty { } (
-        recursiveUpdate defaultCommonLogConfig { handlers.journal.SYSLOG_IDENTIFIER = logName; }
+      ${lib.generators.toPretty { } (
+        lib.recursiveUpdate defaultCommonLogConfig { handlers.journal.SYSLOG_IDENTIFIER = logName; }
       )}
       ```
     '';
@@ -123,8 +122,8 @@ let
   genLogConfigFile =
     logName:
     format.generate "synapse-log-${logName}.yaml" (
-      attrsets.recursiveUpdate cfg.log (
-        optionalAttrs (cfg.log ? handlers.journal) {
+      lib.attrsets.recursiveUpdate cfg.log (
+       lib.optionalAttrs (cfg.log ? handlers.journal) {
           handlers.journal = cfg.log.handlers.journal // {
             SYSLOG_IDENTIFIER = logName;
           };
@@ -146,16 +145,16 @@ in
 
   imports = [
 
-    (mkRemovedOptionModule [ "services" "matrix-synapse" "trusted_third_party_id_servers" ] ''
+    (lib.mkRemovedOptionModule [ "services" "matrix-synapse" "trusted_third_party_id_servers" ] ''
       The `trusted_third_party_id_servers` option as been removed in `matrix-synapse` v1.4.0
       as the behavior is now obsolete.
     '')
-    (mkRemovedOptionModule [ "services" "matrix-synapse" "create_local_database" ] ''
+    (lib.mkRemovedOptionModule [ "services" "matrix-synapse" "create_local_database" ] ''
       Database configuration must be done manually. An exemplary setup is demonstrated in
       <nixpkgs/nixos/tests/matrix/synapse.nix>
     '')
-    (mkRemovedOptionModule [ "services" "matrix-synapse" "web_client" ] "")
-    (mkRemovedOptionModule [ "services" "matrix-synapse" "room_invite_state_types" ] ''
+    (lib.mkRemovedOptionModule [ "services" "matrix-synapse" "web_client" ] "")
+    (lib.mkRemovedOptionModule [ "services" "matrix-synapse" "room_invite_state_types" ] ''
       You may add additional event types via
       `services.matrix-synapse.room_prejoin_state.additional_event_types` and
       disable the default events via
@@ -163,252 +162,252 @@ in
     '')
 
     # options that don't exist in synapse anymore
-    (mkRemovedOptionModule [ "services" "matrix-synapse" "bind_host" ] "Use listener settings instead.")
-    (mkRemovedOptionModule [ "services" "matrix-synapse" "bind_port" ] "Use listener settings instead.")
-    (mkRemovedOptionModule [ "services" "matrix-synapse" "expire_access_tokens" ] "")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [ "services" "matrix-synapse" "bind_host" ] "Use listener settings instead.")
+    (lib.mkRemovedOptionModule [ "services" "matrix-synapse" "bind_port" ] "Use listener settings instead.")
+    (lib.mkRemovedOptionModule [ "services" "matrix-synapse" "expire_access_tokens" ] "")
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "no_tls"
     ] "It is no longer supported by synapse.")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "tls_dh_param_path"
     ] "It was removed from synapse.")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "unsecure_port"
     ] "Use settings.listeners instead.")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "user_creation_max_duration"
     ] "It is no longer supported by synapse.")
-    (mkRemovedOptionModule [ "services" "matrix-synapse" "verbose" ] "Use a log config instead.")
+    (lib.mkRemovedOptionModule [ "services" "matrix-synapse" "verbose" ] "Use a log config instead.")
 
     # options that were moved into rfc42 style settings
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "app_service_config_files"
     ] "Use settings.app_service_config_files instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "database_args"
     ] "Use settings.database.args instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "database_name"
     ] "Use settings.database.args.database instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "database_type"
     ] "Use settings.database.name instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "database_user"
     ] "Use settings.database.args.user instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "dynamic_thumbnails"
     ] "Use settings.dynamic_thumbnails instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "enable_metrics"
     ] "Use settings.enable_metrics instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "enable_registration"
     ] "Use settings.enable_registration instead")
-    (mkRemovedOptionModule [ "services" "matrix-synapse" "extraConfig" ] "Use settings instead.")
-    (mkRemovedOptionModule [ "services" "matrix-synapse" "listeners" ] "Use settings.listeners instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [ "services" "matrix-synapse" "extraConfig" ] "Use settings instead.")
+    (lib.mkRemovedOptionModule [ "services" "matrix-synapse" "listeners" ] "Use settings.listeners instead")
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "logConfig"
     ] "Use settings.log_config instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "max_image_pixels"
     ] "Use settings.max_image_pixels instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "max_upload_size"
     ] "Use settings.max_upload_size instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "presence"
       "enabled"
     ] "Use settings.presence.enabled instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "public_baseurl"
     ] "Use settings.public_baseurl instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "report_stats"
     ] "Use settings.report_stats instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "server_name"
     ] "Use settings.server_name instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "servers"
     ] "Use settings.trusted_key_servers instead.")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "tls_certificate_path"
     ] "Use settings.tls_certificate_path instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "tls_private_key_path"
     ] "Use settings.tls_private_key_path instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "turn_shared_secret"
     ] "Use settings.turn_shared_secret instead")
-    (mkRemovedOptionModule [ "services" "matrix-synapse" "turn_uris" ] "Use settings.turn_uris instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [ "services" "matrix-synapse" "turn_uris" ] "Use settings.turn_uris instead")
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "turn_user_lifetime"
     ] "Use settings.turn_user_lifetime instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "url_preview_enabled"
     ] "Use settings.url_preview_enabled instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "url_preview_ip_range_blacklist"
     ] "Use settings.url_preview_ip_range_blacklist instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "url_preview_ip_range_whitelist"
     ] "Use settings.url_preview_ip_range_whitelist instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "url_preview_url_blacklist"
     ] "Use settings.url_preview_url_blacklist instead")
 
     # options that are too specific to mention them explicitly in settings
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "account_threepid_delegates"
       "email"
     ] "Use settings.account_threepid_delegates.email instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "account_threepid_delegates"
       "msisdn"
     ] "Use settings.account_threepid_delegates.msisdn instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "allow_guest_access"
     ] "Use settings.allow_guest_access instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "bcrypt_rounds"
     ] "Use settings.bcrypt_rounds instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "enable_registration_captcha"
     ] "Use settings.enable_registration_captcha instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "event_cache_size"
     ] "Use settings.event_cache_size instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "federation_rc_concurrent"
     ] "Use settings.rc_federation.concurrent instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "federation_rc_reject_limit"
     ] "Use settings.rc_federation.reject_limit instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "federation_rc_sleep_delay"
     ] "Use settings.rc_federation.sleep_delay instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "federation_rc_sleep_limit"
     ] "Use settings.rc_federation.sleep_limit instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "federation_rc_window_size"
     ] "Use settings.rc_federation.window_size instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "key_refresh_interval"
     ] "Use settings.key_refresh_interval instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "rc_messages_burst_count"
     ] "Use settings.rc_messages.burst_count instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "rc_messages_per_second"
     ] "Use settings.rc_messages.per_second instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "recaptcha_private_key"
     ] "Use settings.recaptcha_private_key instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "recaptcha_public_key"
     ] "Use settings.recaptcha_public_key instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "redaction_retention_period"
     ] "Use settings.redaction_retention_period instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "room_prejoin_state"
       "additional_event_types"
     ] "Use settings.room_prejoin_state.additional_event_types instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "room_prejoin_state"
@@ -416,12 +415,12 @@ in
     ] "Use settings.room_prejoin-state.disable_default_event_types instead")
 
     # Options that should be passed via extraConfigFiles, so they are not persisted into the nix store
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "macaroon_secret_key"
     ] "Pass this value via extraConfigFiles instead")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
       "registration_shared_secret"
@@ -437,7 +436,7 @@ in
           { config, ... }:
           {
             options = {
-              port = mkOption {
+              port = lib.mkOption {
                 type = types.nullOr types.port;
                 default = null;
                 example = 8448;
@@ -446,7 +445,7 @@ in
                 '';
               };
 
-              bind_addresses = mkOption {
+              bind_addresses = lib.mkOption {
                 type = types.nullOr (types.listOf types.str);
                 default =
                   if config.path != null then
@@ -456,7 +455,7 @@ in
                       "::1"
                       "127.0.0.1"
                     ];
-                defaultText = literalExpression ''
+                defaultText = lib.literalExpression ''
                   if path != null then
                     null
                   else
@@ -465,7 +464,7 @@ in
                       "127.0.0.1"
                     ]
                 '';
-                example = literalExpression ''
+                example = lib.literalExpression ''
                   [
                     "::"
                     "0.0.0.0"
@@ -476,7 +475,7 @@ in
                 '';
               };
 
-              path = mkOption {
+              path = lib.mkOption {
                 type = types.nullOr types.path;
                 default = null;
                 description = ''
@@ -489,10 +488,10 @@ in
                 '';
               };
 
-              mode = mkOption {
+              mode = lib.mkOption {
                 type = types.nullOr (types.strMatching "^[0,2-7]{3,4}$");
                 default = if config.path != null then "660" else null;
-                defaultText = literalExpression ''
+                defaultText = lib.literalExpression ''
                   if path != null then
                     "660"
                   else
@@ -505,7 +504,7 @@ in
                 apply = toDecimalFilePermission;
               };
 
-              type = mkOption {
+              type = lib.mkOption {
                 type = types.enum [
                   "http"
                   "manhole"
@@ -519,7 +518,7 @@ in
                 '';
               };
 
-              tls = mkOption {
+              tls = lib.mkOption {
                 type = types.nullOr types.bool;
                 default = if config.path != null then null else !workerContext;
                 defaultText = ''
@@ -535,7 +534,7 @@ in
                 '';
               };
 
-              x_forwarded = mkOption {
+              x_forwarded = lib.mkOption {
                 type = types.bool;
                 default = config.path != null;
                 defaultText = ''
@@ -548,11 +547,11 @@ in
                 '';
               };
 
-              resources = mkOption {
+              resources = lib.mkOption {
                 type = types.listOf (
                   types.submodule {
                     options = {
-                      names = mkOption {
+                      names = lib.mkOption {
                         type = types.listOf (
                           types.enum [
                             "client"
@@ -574,7 +573,7 @@ in
                           "client"
                         ];
                       };
-                      compress = mkOption {
+                      compress = lib.mkOption {
                         default = false;
                         type = types.bool;
                         description = ''
@@ -596,9 +595,9 @@ in
     in
     {
       services.matrix-synapse = {
-        enable = mkEnableOption "matrix.org synapse, the reference homeserver";
+        enable = lib.mkEnableOption "matrix.org synapse, the reference homeserver";
 
-        enableRegistrationScript = mkOption {
+        enableRegistrationScript = lib.mkOption {
           type = types.bool;
           default = clientListener.bind_addresses != [ ];
           example = false;
@@ -627,7 +626,7 @@ in
           '';
         };
 
-        configFile = mkOption {
+        configFile = lib.mkOption {
           type = types.path;
           readOnly = true;
           description = ''
@@ -636,7 +635,7 @@ in
           '';
         };
 
-        package = mkOption {
+        package = lib.mkOption {
           type = types.package;
           readOnly = true;
           description = ''
@@ -657,12 +656,12 @@ in
           '';
         };
 
-        extras = mkOption {
+        extras = lib.mkOption {
           type = types.listOf (
             types.enum (lib.attrNames pkgs.matrix-synapse-unwrapped.optional-dependencies)
           );
           default = defaultExtras;
-          example = literalExpression ''
+          example = lib.literalExpression ''
             [
               "cache-memory" # Provide statistics about caching memory consumption
               "jwt"          # JSON Web Token authentication
@@ -688,10 +687,10 @@ in
           '';
         };
 
-        plugins = mkOption {
+        plugins = lib.mkOption {
           type = types.listOf types.package;
           default = [ ];
-          example = literalExpression ''
+          example = lib.literalExpression ''
             with config.services.matrix-synapse.package.plugins; [
               matrix-synapse-ldap3
               matrix-synapse-pam
@@ -702,7 +701,7 @@ in
           '';
         };
 
-        withJemalloc = mkOption {
+        withJemalloc = lib.mkOption {
           type = types.bool;
           default = true;
           description = ''
@@ -710,7 +709,7 @@ in
           '';
         };
 
-        dataDir = mkOption {
+        dataDir = lib.mkOption {
           type = types.str;
           default = "/var/lib/matrix-synapse";
           description = ''
@@ -719,9 +718,9 @@ in
           '';
         };
 
-        log = mkOption {
+        log = lib.mkOption {
           type = types.attrsOf format.type;
-          defaultText = literalExpression defaultCommonLogConfigText;
+          defaultText = lib.literalExpression defaultCommonLogConfigText;
           description = ''
             Default configuration for the loggers used by `matrix-synapse` and its workers.
             The defaults are added with the default priority which means that
@@ -762,7 +761,7 @@ in
           '';
         };
 
-        settings = mkOption {
+        settings = lib.mkOption {
           default = { };
           description = ''
             The primary synapse configuration. See the
@@ -772,21 +771,20 @@ in
             Secrets should be passed in by using the `extraConfigFiles` option.
           '';
           type =
-            with types;
-            submodule {
+            types.submodule {
               freeformType = format.type;
               options = {
                 # This is a reduced set of popular options and defaults
                 # Do not add every available option here, they can be specified
                 # by the user at their own discretion. This is a freeform type!
 
-                server_name = mkOption {
+                server_name = lib.mkOption {
                   type = types.str;
                   example = "example.com";
                   default = config.networking.hostName;
-                  defaultText = literalExpression "config.networking.hostName";
+                  defaultText = lib.literalExpression "config.networking.hostName";
                   description = ''
-                    The domain name of the server, with optional explicit port.
+                    The domain name of the server, withlib.optional explicit port.
                     This is used by remote servers to look up the server address.
                     This is also the last part of your UserID.
 
@@ -794,7 +792,7 @@ in
                   '';
                 };
 
-                enable_registration = mkOption {
+                enable_registration = lib.mkOption {
                   type = types.bool;
                   default = false;
                   description = ''
@@ -802,7 +800,7 @@ in
                   '';
                 };
 
-                registration_shared_secret = mkOption {
+                registration_shared_secret = lib.mkOption {
                   type = types.nullOr types.str;
                   default = null;
                   description = ''
@@ -813,7 +811,7 @@ in
                   '';
                 };
 
-                macaroon_secret_key = mkOption {
+                macaroon_secret_key = lib.mkOption {
                   type = types.nullOr types.str;
                   default = null;
                   description = ''
@@ -825,7 +823,7 @@ in
                   '';
                 };
 
-                enable_metrics = mkOption {
+                enable_metrics = lib.mkOption {
                   type = types.bool;
                   default = false;
                   description = ''
@@ -833,7 +831,7 @@ in
                   '';
                 };
 
-                report_stats = mkOption {
+                report_stats = lib.mkOption {
                   type = types.bool;
                   default = false;
                   description = ''
@@ -841,7 +839,7 @@ in
                   '';
                 };
 
-                signing_key_path = mkOption {
+                signing_key_path = lib.mkOption {
                   type = types.path;
                   default = "${cfg.dataDir}/homeserver.signing.key";
                   description = ''
@@ -849,7 +847,7 @@ in
                   '';
                 };
 
-                pid_file = mkOption {
+                pid_file = lib.mkOption {
                   type = types.path;
                   default = "/run/matrix-synapse.pid";
                   readOnly = true;
@@ -858,7 +856,7 @@ in
                   '';
                 };
 
-                log_config = mkOption {
+                log_config = lib.mkOption {
                   type = types.path;
                   default = genLogConfigFile "synapse";
                   defaultText = logConfigText "synapse";
@@ -867,7 +865,7 @@ in
                   '';
                 };
 
-                media_store_path = mkOption {
+                media_store_path = lib.mkOption {
                   type = types.path;
                   default =
                     if lib.versionAtLeast config.system.stateVersion "22.05" then
@@ -880,7 +878,7 @@ in
                   '';
                 };
 
-                public_baseurl = mkOption {
+                public_baseurl = lib.mkOption {
                   type = types.nullOr types.str;
                   default = null;
                   example = "https://example.com:8448/";
@@ -889,7 +887,7 @@ in
                   '';
                 };
 
-                tls_certificate_path = mkOption {
+                tls_certificate_path = lib.mkOption {
                   type = types.nullOr types.str;
                   default = null;
                   example = "/var/lib/acme/example.com/fullchain.pem";
@@ -902,7 +900,7 @@ in
                   '';
                 };
 
-                tls_private_key_path = mkOption {
+                tls_private_key_path = lib.mkOption {
                   type = types.nullOr types.str;
                   default = null;
                   example = "/var/lib/acme/example.com/key.pem";
@@ -912,7 +910,7 @@ in
                   '';
                 };
 
-                presence.enabled = mkOption {
+                presence.enabled = lib.mkOption {
                   type = types.bool;
                   default = true;
                   example = false;
@@ -924,7 +922,7 @@ in
                   '';
                 };
 
-                listeners = mkOption {
+                listeners = lib.mkOption {
                   type = types.listOf (listenerType false);
                   default = [
                     {
@@ -964,13 +962,13 @@ in
                   '';
                 };
 
-                database.name = mkOption {
+                database.name = lib.mkOption {
                   type = types.enum [
                     "sqlite3"
                     "psycopg2"
                   ];
-                  default = if versionAtLeast config.system.stateVersion "18.03" then "psycopg2" else "sqlite3";
-                  defaultText = literalExpression ''
+                  default = if lib.versionAtLeast config.system.stateVersion "18.03" then "psycopg2" else "sqlite3";
+                  defaultText = lib.literalExpression ''
                     if versionAtLeast config.system.stateVersion "18.03"
                     then "psycopg2"
                     else "sqlite3"
@@ -980,7 +978,7 @@ in
                   '';
                 };
 
-                database.args.database = mkOption {
+                database.args.database = lib.mkOption {
                   type = types.str;
                   default =
                     {
@@ -988,7 +986,7 @@ in
                       psycopg2 = "matrix-synapse";
                     }
                     .${cfg.settings.database.name};
-                  defaultText = literalExpression ''
+                  defaultText = lib.literalExpression ''
                     {
                       sqlite3 = "''${${options.services.matrix-synapse.dataDir}}/homeserver.db";
                       psycopg2 = "matrix-synapse";
@@ -1000,7 +998,7 @@ in
                   '';
                 };
 
-                database.args.user = mkOption {
+                database.args.user = lib.mkOption {
                   type = types.nullOr types.str;
                   default =
                     {
@@ -1020,7 +1018,7 @@ in
                   '';
                 };
 
-                url_preview_enabled = mkOption {
+                url_preview_enabled = lib.mkOption {
                   type = types.bool;
                   default = true;
                   example = false;
@@ -1031,7 +1029,7 @@ in
                   '';
                 };
 
-                url_preview_ip_range_blacklist = mkOption {
+                url_preview_ip_range_blacklist = lib.mkOption {
                   type = types.listOf types.str;
                   default = [
                     "10.0.0.0/8"
@@ -1060,7 +1058,7 @@ in
                   '';
                 };
 
-                url_preview_ip_range_whitelist = mkOption {
+                url_preview_ip_range_whitelist = lib.mkOption {
                   type = types.listOf types.str;
                   default = [ ];
                   description = ''
@@ -1069,10 +1067,10 @@ in
                   '';
                 };
 
-                url_preview_url_blacklist = mkOption {
+                url_preview_url_blacklist = lib.mkOption {
                   # FIXME revert to just `listOf (attrsOf str)` after some time(tm).
                   type = types.listOf (
-                    types.coercedTo types.str (const (throw ''
+                    types.coercedTo types.str (lib.const (throw ''
                       Setting `config.services.matrix-synapse.settings.url_preview_url_blacklist`
                       to a list of strings has never worked. Due to a bug, this was the type accepted
                       by the module, but in practice it broke on runtime and as a result, no URL
@@ -1083,7 +1081,7 @@ in
                     '')) (types.attrsOf types.str)
                   );
                   default = [ ];
-                  example = literalExpression ''
+                  example = lib.literalExpression ''
                     [
                       { scheme = "http"; } # no http previews
                       { netloc = "www.acme.com"; path = "/foo"; } # block http(s)://www.acme.com/foo
@@ -1095,7 +1093,7 @@ in
                   '';
                 };
 
-                max_upload_size = mkOption {
+                max_upload_size = lib.mkOption {
                   type = types.str;
                   default = "50M";
                   example = "100M";
@@ -1104,7 +1102,7 @@ in
                   '';
                 };
 
-                max_image_pixels = mkOption {
+                max_image_pixels = lib.mkOption {
                   type = types.str;
                   default = "32M";
                   example = "64M";
@@ -1113,7 +1111,7 @@ in
                   '';
                 };
 
-                dynamic_thumbnails = mkOption {
+                dynamic_thumbnails = lib.mkOption {
                   type = types.bool;
                   default = false;
                   example = true;
@@ -1126,7 +1124,7 @@ in
                   '';
                 };
 
-                turn_uris = mkOption {
+                turn_uris = lib.mkOption {
                   type = types.listOf types.str;
                   default = [ ];
                   example = [
@@ -1139,10 +1137,10 @@ in
                     The public URIs of the TURN server to give to clients
                   '';
                 };
-                turn_shared_secret = mkOption {
+                turn_shared_secret = lib.mkOption {
                   type = types.str;
                   default = "";
-                  example = literalExpression ''
+                  example = lib.literalExpression ''
                     config.services.coturn.static-auth-secret
                   '';
                   description = ''
@@ -1152,12 +1150,12 @@ in
                   '';
                 };
 
-                trusted_key_servers = mkOption {
+                trusted_key_servers = lib.mkOption {
                   type = types.listOf (
                     types.submodule {
                       freeformType = format.type;
                       options = {
-                        server_name = mkOption {
+                        server_name = lib.mkOption {
                           type = types.str;
                           example = "matrix.org";
                           description = ''
@@ -1180,7 +1178,7 @@ in
                   '';
                 };
 
-                app_service_config_files = mkOption {
+                app_service_config_files = lib.mkOption {
                   type = types.listOf types.path;
                   default = [ ];
                   description = ''
@@ -1298,7 +1296,7 @@ in
           '';
         };
 
-        extraArgs = mkOption {
+        extraArgs = lib.mkOption {
           type = types.listOf types.str;
           default = [ ];
           example = [ "--no-secrets-in-config" ];
@@ -1307,7 +1305,7 @@ in
           '';
         };
 
-        extraConfigFiles = mkOption {
+        extraConfigFiles = lib.mkOption {
           type = types.listOf types.path;
           default = [ ];
           description = ''
@@ -1330,7 +1328,7 @@ in
       };
     };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     assertions = [
       {
         assertion = clientListener != null;
@@ -1427,7 +1425,7 @@ in
     # default them, so they are additive
     services.matrix-synapse.extras = defaultExtras;
 
-    services.matrix-synapse.log = mapAttrsRecursive (const mkDefault) defaultCommonLogConfig;
+    services.matrix-synapse.log = lib.mapAttrsRecursive (lib.const lib.mkDefault) defaultCommonLogConfig;
 
     users.users.matrix-synapse = {
       group = "matrix-synapse";
@@ -1444,7 +1442,7 @@ in
     systemd.targets.matrix-synapse = lib.mkIf hasWorkers {
       description = "Synapse Matrix parent target";
       wants = [ "network-online.target" ];
-      after = [ "network-online.target" ] ++ optional hasLocalPostgresDB "postgresql.target";
+      after = [ "network-online.target" ] ++lib.optional hasLocalPostgresDB "postgresql.target";
       wantedBy = [ "multi-user.target" ];
     };
 
@@ -1456,17 +1454,17 @@ in
               partOf = [ "matrix-synapse.target" ];
               wantedBy = [ "matrix-synapse.target" ];
               unitConfig.ReloadPropagatedFrom = "matrix-synapse.target";
-              requires = optional hasLocalPostgresDB "postgresql.target";
+              requires =lib.optional hasLocalPostgresDB "postgresql.target";
             }
           else
             {
               wants = [ "network-online.target" ];
-              after = [ "network-online.target" ] ++ optional hasLocalPostgresDB "postgresql.target";
-              requires = optional hasLocalPostgresDB "postgresql.target";
+              after = [ "network-online.target" ] ++lib.optional hasLocalPostgresDB "postgresql.target";
+              requires =lib.optional hasLocalPostgresDB "postgresql.target";
               wantedBy = [ "multi-user.target" ];
             };
         baseServiceConfig = {
-          environment = optionalAttrs (cfg.withJemalloc) {
+          environment =lib.optionalAttrs (cfg.withJemalloc) {
             LD_PRELOAD = "${pkgs.jemalloc}/lib/libjemalloc.so";
             PYTHONMALLOC = "malloc";
           };
@@ -1504,7 +1502,7 @@ in
               cfg.settings.media_store_path
             ]
             ++ (map (listener: dirOf listener.path) (
-              filter (listener: listener.path != null) cfg.settings.listeners
+              lib.filter (listener: listener.path != null) cfg.settings.listeners
             ));
             RemoveIPC = true;
             RestrictAddressFamilies = [
@@ -1544,7 +1542,7 @@ in
                 serviceConfig = {
                   ExecStart = ''
                     ${cfg.package}/bin/synapse_worker \
-                      ${concatMapStringsSep "\n  " (x: "--config-path ${x} \\") (
+                      ${lib.concatMapStringsSep "\n  " (x: "--config-path ${x} \\") (
                         [
                           configFile
                           workerConfigFile
@@ -1582,7 +1580,7 @@ in
               ];
               ExecStart = ''
                 ${cfg.package}/bin/synapse_homeserver \
-                  ${concatMapStringsSep "\n  " (x: "--config-path ${x} \\") (
+                  ${lib.concatMapStringsSep "\n  " (x: "--config-path ${x} \\") (
                     [ configFile ] ++ cfg.extraConfigFiles
                   )}
                   --keys-directory ${cfg.dataDir} \
diff --git a/nixos/modules/services/misc/anki-sync-server.nix b/nixos/modules/services/misc/anki-sync-server.nix
index 908adbf74e767..2b5045e2d425a 100644
--- a/nixos/modules/services/misc/anki-sync-server.nix
+++ b/nixos/modules/services/misc/anki-sync-server.nix
@@ -4,17 +4,18 @@
   pkgs,
   ...
 }:
-with lib;
 let
+  inherit (lib) types;
+
   cfg = config.services.anki-sync-server;
   name = "anki-sync-server";
-  specEscape = replaceStrings [ "%" ] [ "%%" ];
-  usersWithIndexes = lists.imap1 (i: user: {
+  specEscape = lib.replaceStrings [ "%" ] [ "%%" ];
+  usersWithIndexes = lib.lists.imap1 (i: user: {
     i = i;
     user = user;
   }) cfg.users;
-  usersWithIndexesFile = filter (x: x.user.passwordFile != null) usersWithIndexes;
-  usersWithIndexesNoFile = filter (
+  usersWithIndexesFile = lib.filter (x: x.user.passwordFile != null) usersWithIndexes;
+  usersWithIndexesNoFile = lib.filter (
     x: x.user.passwordFile == null && x.user.password != null
   ) usersWithIndexes;
   anki-sync-server-run = pkgs.writeShellScript "anki-sync-server-run" ''
@@ -23,26 +24,26 @@ let
     # a file system exposed to the service. Here we read the passwords from
     # the credential files to pass them as environment variables to the Anki
     # sync server.
-    ${concatMapStringsSep "\n" (x: ''
-      read -r pass < "''${CREDENTIALS_DIRECTORY}/"${escapeShellArg x.user.username}
-      export SYNC_USER${toString x.i}=${escapeShellArg x.user.username}:"$pass"
+    ${lib.concatMapStringsSep "\n" (x: ''
+      read -r pass < "''${CREDENTIALS_DIRECTORY}/"${lib.escapeShellArg x.user.username}
+      export SYNC_USER${toString x.i}=${lib.escapeShellArg x.user.username}:"$pass"
     '') usersWithIndexesFile}
     # For users where services.anki-sync-server.users.password isn't set,
     # export passwords in environment variables in plaintext.
-    ${concatMapStringsSep "\n" (
+    ${lib.concatMapStringsSep "\n" (
       x:
-      ''export SYNC_USER${toString x.i}=${escapeShellArg x.user.username}:${escapeShellArg x.user.password}''
+      ''export SYNC_USER${toString x.i}=${lib.escapeShellArg x.user.username}:${lib.escapeShellArg x.user.password}''
     ) usersWithIndexesNoFile}
     exec ${lib.getExe cfg.package}
   '';
 in
 {
   options.services.anki-sync-server = {
-    enable = mkEnableOption "anki-sync-server";
+    enable = lib.mkEnableOption "anki-sync-server";
 
-    package = mkPackageOption pkgs "anki-sync-server" { };
+    package = lib.mkPackageOption pkgs "anki-sync-server" { };
 
-    address = mkOption {
+    address = lib.mkOption {
       type = types.str;
       default = "::1";
       description = ''
@@ -51,35 +52,34 @@ in
       '';
     };
 
-    port = mkOption {
+    port = lib.mkOption {
       type = types.port;
       default = 27701;
       description = "Port number anki-sync-server listens to.";
     };
 
-    baseDirectory = mkOption {
+    baseDirectory = lib.mkOption {
       type = types.str;
       default = "%S/%N";
       description = "Base directory where user(s) synchronized data will be stored.";
     };
 
-    openFirewall = mkOption {
+    openFirewall = lib.mkOption {
       default = false;
       type = types.bool;
       description = "Whether to open the firewall for the specified port.";
     };
 
-    users = mkOption {
-      type =
-        with types;
-        listOf (submodule {
+    users = lib.mkOption {
+      type = types.listOf (
+        types.submodule {
           options = {
-            username = mkOption {
-              type = str;
+            username = lib.mkOption {
+              type = types.str;
               description = "User name accepted by anki-sync-server.";
             };
-            password = mkOption {
-              type = nullOr str;
+            password = lib.mkOption {
+              type = types.nullOr types.str;
               default = null;
               description = ''
                 Password accepted by anki-sync-server for the associated username.
@@ -89,8 +89,8 @@ in
                 a more secure option.
               '';
             };
-            passwordFile = mkOption {
-              type = nullOr path;
+            passwordFile = lib.mkOption {
+              type = types.nullOr types.path;
               default = null;
               description = ''
                 File containing the password accepted by anki-sync-server for
@@ -99,19 +99,20 @@ in
               '';
             };
           };
-        });
+        }
+      );
       description = "List of user-password pairs to provide to the sync server.";
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     assertions = [
       {
         assertion = (builtins.length usersWithIndexesFile) + (builtins.length usersWithIndexesNoFile) > 0;
         message = "At least one username-password pair must be set.";
       }
     ];
-    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
 
     systemd.services.anki-sync-server = {
       description = "anki-sync-server: Anki sync server built into Anki";
@@ -138,7 +139,7 @@ in
   };
 
   meta = {
-    maintainers = with maintainers; [ telotortium ];
+    maintainers = with lib.maintainers; [ telotortium ];
     doc = ./anki-sync-server.md;
   };
 }
diff --git a/nixos/modules/services/misc/zoneminder.nix b/nixos/modules/services/misc/zoneminder.nix
index fc886a859da1f..4487d50bbfda3 100644
--- a/nixos/modules/services/misc/zoneminder.nix
+++ b/nixos/modules/services/misc/zoneminder.nix
@@ -6,6 +6,8 @@
 }:
 
 let
+  inherit (lib) types;
+
   cfg = config.services.zoneminder;
   fpm = config.services.phpfpm.pools.zoneminder;
   pkg = pkgs.zoneminder;
@@ -76,7 +78,7 @@ let
 in
 {
   options = {
-    services.zoneminder = with lib; {
+    services.zoneminder = {
       enable = lib.mkEnableOption ''
         ZoneMinder.
 
@@ -88,7 +90,7 @@ in
         upgrading to a newer version
       '';
 
-      webserver = mkOption {
+      webserver = lib.mkOption {
         type = types.enum [
           "nginx"
           "none"
@@ -102,7 +104,7 @@ in
         '';
       };
 
-      hostname = mkOption {
+      hostname = lib.mkOption {
         type = types.str;
         default = "localhost";
         description = ''
@@ -110,7 +112,7 @@ in
         '';
       };
 
-      port = mkOption {
+      port = lib.mkOption {
         type = types.port;
         default = 8095;
         description = ''
@@ -118,7 +120,7 @@ in
         '';
       };
 
-      openFirewall = mkOption {
+      openFirewall = lib.mkOption {
         type = types.bool;
         default = false;
         description = ''
@@ -127,7 +129,7 @@ in
       };
 
       database = {
-        createLocally = mkOption {
+        createLocally = lib.mkOption {
           type = types.bool;
           default = false;
           description = ''
@@ -135,7 +137,7 @@ in
           '';
         };
 
-        host = mkOption {
+        host = lib.mkOption {
           type = types.str;
           default = "localhost";
           description = ''
@@ -143,7 +145,7 @@ in
           '';
         };
 
-        name = mkOption {
+        name = lib.mkOption {
           type = types.str;
           default = "zm";
           description = ''
@@ -151,7 +153,7 @@ in
           '';
         };
 
-        username = mkOption {
+        username = lib.mkOption {
           type = types.str;
           default = "zmuser";
           description = ''
@@ -159,7 +161,7 @@ in
           '';
         };
 
-        password = mkOption {
+        password = lib.mkOption {
           type = types.str;
           default = "zmpass";
           description = ''
@@ -169,7 +171,7 @@ in
         };
       };
 
-      cameras = mkOption {
+      cameras = lib.mkOption {
         type = types.int;
         default = 1;
         description = ''
@@ -177,7 +179,7 @@ in
         '';
       };
 
-      storageDir = mkOption {
+      storageDir = lib.mkOption {
         type = types.nullOr types.str;
         default = null;
         example = "/storage/tank";
@@ -187,7 +189,7 @@ in
         '';
       };
 
-      extraConfig = mkOption {
+      extraConfig = lib.mkOption {
         type = types.lines;
         default = "";
         description = ''
diff --git a/nixos/modules/services/monitoring/vmalert.nix b/nixos/modules/services/monitoring/vmalert.nix
index 0baaa039e3952..5ba11cdb51dae 100644
--- a/nixos/modules/services/monitoring/vmalert.nix
+++ b/nixos/modules/services/monitoring/vmalert.nix
@@ -4,15 +4,18 @@
   lib,
   ...
 }:
-with lib;
 let
+  inherit (lib) types;
+
   cfg = config.services.vmalert;
 
   format = pkgs.formats.yaml { };
 
   mkConfOpts =
     settings:
-    concatStringsSep " \\\n" (mapAttrsToList mkLine (filterAttrs (_: v: v != false) settings));
+    lib.concatStringsSep " \\\n" (
+      lib.mapAttrsToList mkLine (lib.filterAttrs (_: v: v != false) settings)
+    );
   confType =
     with types;
     let
@@ -29,10 +32,10 @@ let
     key: value:
     if value == true then
       "-${key}"
-    else if isList value then
-      concatMapStringsSep " " (v: "-${key}=${escapeShellArg (toString v)}") value
+    else if lib.isList value then
+      lib.concatMapStringsSep " " (v: "-${key}=${lib.escapeShellArg (toString v)}") value
     else
-      "-${key}=${escapeShellArg (toString value)}";
+      "-${key}=${lib.escapeShellArg (toString value)}";
 
   vmalertName = name: "vmalert" + lib.optionalString (name != "") ("-" + name);
   enabledInstances = lib.filterAttrs (name: conf: conf.enable) config.services.vmalert.instances;
@@ -54,9 +57,9 @@ in
   ];
 
   # interface
-  options.services.vmalert.package = mkPackageOption pkgs "victoriametrics" { };
+  options.services.vmalert.package = lib.mkPackageOption pkgs "victoriametrics" { };
 
-  options.services.vmalert.instances = mkOption {
+  options.services.vmalert.instances = lib.mkOption {
     default = { };
 
     description = ''
@@ -78,12 +81,12 @@ in
               '';
             };
 
-            settings = mkOption {
+            settings = lib.mkOption {
               type = types.submodule {
                 freeformType = confType;
                 options = {
 
-                  "datasource.url" = mkOption {
+                  "datasource.url" = lib.mkOption {
                     type = types.nonEmptyStr;
                     example = "http://localhost:8428";
                     description = ''
@@ -91,8 +94,8 @@ in
                     '';
                   };
 
-                  "notifier.url" = mkOption {
-                    type = with types; listOf nonEmptyStr;
+                  "notifier.url" = lib.mkOption {
+                    type = types.listOf types.nonEmptyStr;
                     default = [ ];
                     example = [ "http://127.0.0.1:9093" ];
                     description = ''
@@ -100,8 +103,8 @@ in
                     '';
                   };
 
-                  "rule" = mkOption {
-                    type = with types; listOf path;
+                  "rule" = lib.mkOption {
+                    type = types.listOf types.path;
                     description = ''
                       Path to the files with alerting and/or recording rules.
 
@@ -131,7 +134,7 @@ in
               '';
             };
 
-            rules = mkOption {
+            rules = lib.mkOption {
               type = format.type;
               default = { };
               example = {
@@ -170,7 +173,7 @@ in
   };
 
   # implementation
-  config = mkIf (enabledInstances != { }) {
+  config = lib.mkIf (enabledInstances != { }) {
     environment.etc = lib.mapAttrs' (
       name:
       { rules, ... }:
diff --git a/nixos/modules/services/networking/bitcoind.nix b/nixos/modules/services/networking/bitcoind.nix
index e46a101c20435..e2b6d22387106 100644
--- a/nixos/modules/services/networking/bitcoind.nix
+++ b/nixos/modules/services/networking/bitcoind.nix
@@ -4,24 +4,23 @@
   lib,
   ...
 }:
-
-with lib;
-
 let
-  eachBitcoind = filterAttrs (bitcoindName: cfg: cfg.enable) config.services.bitcoind;
+  inherit (lib) types;
+
+  eachBitcoind = lib.filterAttrs (bitcoindName: cfg: cfg.enable) config.services.bitcoind;
 
   rpcUserOpts =
     { name, ... }:
     {
       options = {
-        name = mkOption {
+        name = lib.mkOption {
           type = types.str;
           example = "alice";
           description = ''
             Username for JSON-RPC connections.
           '';
         };
-        passwordHMAC = mkOption {
+        passwordHMAC = lib.mkOption {
           type = types.uniq (types.strMatching "[0-9a-f]+\\$[0-9a-f]{64}");
           example = "f7efda5c189b999524f151318c0c86$d5b51b3beffbc02b724e5d095828e0bc8b2456e9ac8757ae3211a5d9b16a22ae";
           description = ''
@@ -34,7 +33,7 @@ let
         };
       };
       config = {
-        name = mkDefault name;
+        name = lib.mkDefault name;
       };
     };
 
@@ -48,18 +47,18 @@ let
     {
       options = {
 
-        enable = mkEnableOption "Bitcoin daemon";
+        enable = lib.mkEnableOption "Bitcoin daemon";
 
-        package = mkPackageOption pkgs "bitcoind" { };
+        package = lib.mkPackageOption pkgs "bitcoind" { };
 
-        configFile = mkOption {
+        configFile = lib.mkOption {
           type = types.nullOr types.path;
           default = null;
           example = "/var/lib/${name}/bitcoin.conf";
           description = "The configuration file path to supply bitcoind.";
         };
 
-        extraConfig = mkOption {
+        extraConfig = lib.mkOption {
           type = types.lines;
           default = "";
           example = ''
@@ -70,33 +69,33 @@ let
           description = "Additional configurations to be appended to {file}`bitcoin.conf`.";
         };
 
-        dataDir = mkOption {
+        dataDir = lib.mkOption {
           type = types.path;
           default = "/var/lib/bitcoind-${name}";
           description = "The data directory for bitcoind.";
         };
 
-        user = mkOption {
+        user = lib.mkOption {
           type = types.str;
           default = "bitcoind-${name}";
           description = "The user as which to run bitcoind.";
         };
 
-        group = mkOption {
+        group = lib.mkOption {
           type = types.str;
           default = config.user;
           description = "The group as which to run bitcoind.";
         };
 
         rpc = {
-          port = mkOption {
+          port = lib.mkOption {
             type = types.nullOr types.port;
             default = null;
             description = "Override the default port on which to listen for JSON-RPC connections.";
           };
-          users = mkOption {
+          users = lib.mkOption {
             default = { };
-            example = literalExpression ''
+            example = lib.literalExpression ''
               {
                 alice.passwordHMAC = "f7efda5c189b999524f151318c0c86$d5b51b3beffbc02b724e5d095828e0bc8b2456e9ac8757ae3211a5d9b16a22ae";
                 bob.passwordHMAC = "b2dd077cb54591a2f3139e69a897ac$4e71f08d48b4347cf8eff3815c0e25ae2e9a4340474079f55705f40574f4ec99";
@@ -107,32 +106,32 @@ let
           };
         };
 
-        pidFile = mkOption {
+        pidFile = lib.mkOption {
           type = types.path;
           default = "${config.dataDir}/bitcoind.pid";
           description = "Location of bitcoind pid file.";
         };
 
-        testnet = mkOption {
+        testnet = lib.mkOption {
           type = types.bool;
           default = false;
           description = "Whether to use the testnet instead of mainnet.";
         };
 
-        port = mkOption {
+        port = lib.mkOption {
           type = types.nullOr types.port;
           default = null;
           description = "Override the default port on which to listen for connections.";
         };
 
-        dbCache = mkOption {
+        dbCache = lib.mkOption {
           type = types.nullOr (types.ints.between 4 16384);
           default = null;
           example = 4000;
           description = "Override the default database cache size in MiB.";
         };
 
-        prune = mkOption {
+        prune = lib.mkOption {
           type = types.nullOr (
             types.coercedTo (types.enum [
               "disable"
@@ -153,7 +152,7 @@ let
           '';
         };
 
-        extraCmdlineOptions = mkOption {
+        extraCmdlineOptions = lib.mkOption {
           type = types.listOf types.str;
           default = [ ];
           description = ''
@@ -167,17 +166,17 @@ in
 {
 
   options = {
-    services.bitcoind = mkOption {
+    services.bitcoind = lib.mkOption {
       type = types.attrsOf (types.submodule bitcoindOpts);
       default = { };
       description = "Specification of one or more bitcoind instances.";
     };
   };
 
-  config = mkIf (eachBitcoind != { }) {
+  config = lib.mkIf (eachBitcoind != { }) {
 
-    assertions = flatten (
-      mapAttrsToList (bitcoindName: cfg: [
+    assertions = lib.flatten (
+      lib.mapAttrsToList (bitcoindName: cfg: [
         {
           assertion =
             (cfg.prune != null)
@@ -204,23 +203,23 @@ in
       ]) eachBitcoind
     );
 
-    environment.systemPackages = flatten (
-      mapAttrsToList (bitcoindName: cfg: [
+    environment.systemPackages = lib.flatten (
+      lib.mapAttrsToList (bitcoindName: cfg: [
         cfg.package
       ]) eachBitcoind
     );
 
-    systemd.services = mapAttrs' (
+    systemd.services = lib.mapAttrs' (
       bitcoindName: cfg:
-      (nameValuePair "bitcoind-${bitcoindName}" (
+      (lib.nameValuePair "bitcoind-${bitcoindName}" (
         let
           configFile = pkgs.writeText "bitcoin.conf" ''
             # If Testnet is enabled, we need to add [test] section
             # otherwise, some options (e.g.: custom RPC port) will not work
-            ${optionalString cfg.testnet "[test]"}
+            ${lib.optionalString cfg.testnet "[test]"}
             # RPC users
-            ${concatMapStringsSep "\n" (rpcUser: "rpcauth=${rpcUser.name}:${rpcUser.passwordHMAC}") (
-              attrValues cfg.rpc.users
+            ${lib.concatMapStringsSep "\n" (rpcUser: "rpcauth=${rpcUser.name}:${rpcUser.passwordHMAC}") (
+              lib.attrValues cfg.rpc.users
             )}
             # Extra config options (from bitcoind nixos service)
             ${cfg.extraConfig}
@@ -239,11 +238,11 @@ in
               ${if (cfg.configFile != null) then "-conf=${cfg.configFile}" else "-conf=${configFile}"} \
               -datadir=${cfg.dataDir} \
               -pid=${cfg.pidFile} \
-              ${optionalString cfg.testnet "-testnet"}\
-              ${optionalString (cfg.port != null) "-port=${toString cfg.port}"}\
-              ${optionalString (cfg.prune != null) "-prune=${toString cfg.prune}"}\
-              ${optionalString (cfg.dbCache != null) "-dbcache=${toString cfg.dbCache}"}\
-              ${optionalString (cfg.rpc.port != null) "-rpcport=${toString cfg.rpc.port}"}\
+              ${lib.optionalString cfg.testnet "-testnet"}\
+              ${lib.optionalString (cfg.port != null) "-port=${toString cfg.port}"}\
+              ${lib.optionalString (cfg.prune != null) "-prune=${toString cfg.prune}"}\
+              ${lib.optionalString (cfg.dbCache != null) "-dbcache=${toString cfg.dbCache}"}\
+              ${lib.optionalString (cfg.rpc.port != null) "-rpcport=${toString cfg.rpc.port}"}\
               ${toString cfg.extraCmdlineOptions}
             '';
             Restart = "on-failure";
@@ -259,15 +258,15 @@ in
       ))
     ) eachBitcoind;
 
-    systemd.tmpfiles.rules = flatten (
-      mapAttrsToList (bitcoindName: cfg: [
+    systemd.tmpfiles.rules = lib.flatten (
+      lib.mapAttrsToList (bitcoindName: cfg: [
         "d '${cfg.dataDir}' 0770 '${cfg.user}' '${cfg.group}' - -"
       ]) eachBitcoind
     );
 
-    users.users = mapAttrs' (
+    users.users = lib.mapAttrs' (
       bitcoindName: cfg:
-      (nameValuePair "bitcoind-${bitcoindName}" {
+      (lib.nameValuePair "bitcoind-${bitcoindName}" {
         name = cfg.user;
         group = cfg.group;
         description = "Bitcoin daemon user";
@@ -276,10 +275,12 @@ in
       })
     ) eachBitcoind;
 
-    users.groups = mapAttrs' (bitcoindName: cfg: (nameValuePair "${cfg.group}" { })) eachBitcoind;
+    users.groups = lib.mapAttrs' (
+      bitcoindName: cfg: (lib.nameValuePair "${cfg.group}" { })
+    ) eachBitcoind;
 
   };
 
-  meta.maintainers = with maintainers; [ _1000101 ];
+  meta.maintainers = with lib.maintainers; [ _1000101 ];
 
 }

From 963b86f05665eea1975ad3a82504d92947230482 Mon Sep 17 00:00:00 2001
From: kuflierl <41301536+kuflierl@users.noreply.github.com>
Date: Sat, 27 Sep 2025 20:55:14 +0200
Subject: [PATCH 4/4] nixos/modules/matrix/{maubot,synapse}: nixfmt

---
 nixos/modules/services/matrix/maubot.nix  | 459 ++++++------
 nixos/modules/services/matrix/synapse.nix | 817 +++++++++++-----------
 2 files changed, 645 insertions(+), 631 deletions(-)

diff --git a/nixos/modules/services/matrix/maubot.nix b/nixos/modules/services/matrix/maubot.nix
index 0b8ee3af80ee7..d3b3d6de777aa 100644
--- a/nixos/modules/services/matrix/maubot.nix
+++ b/nixos/modules/services/matrix/maubot.nix
@@ -128,273 +128,272 @@ in
 
         Secrets should be passed in by using `extraConfigFile`.
       '';
-      type =
-        types.submodule {
-          options = {
-            database = lib.mkOption {
-              type = types.str;
-              default = "sqlite:maubot.db";
-              example = "postgresql://username:password@hostname/dbname";
-              description = ''
-                The full URI to the database. SQLite and Postgres are fully supported.
-                Other DBMSes supported by SQLAlchemy may or may not work.
-              '';
-            };
+      type = types.submodule {
+        options = {
+          database = lib.mkOption {
+            type = types.str;
+            default = "sqlite:maubot.db";
+            example = "postgresql://username:password@hostname/dbname";
+            description = ''
+              The full URI to the database. SQLite and Postgres are fully supported.
+              Other DBMSes supported by SQLAlchemy may or may not work.
+            '';
+          };
 
-            crypto_database = lib.mkOption {
-              type = types.str;
-              default = "default";
-              example = "postgresql://username:password@hostname/dbname";
-              description = ''
-                Separate database URL for the crypto database. By default, the regular database is also used for crypto.
-              '';
-            };
+          crypto_database = lib.mkOption {
+            type = types.str;
+            default = "default";
+            example = "postgresql://username:password@hostname/dbname";
+            description = ''
+              Separate database URL for the crypto database. By default, the regular database is also used for crypto.
+            '';
+          };
 
-            database_opts = lib.mkOption {
-              type = types.attrs;
-              default = { };
-              description = ''
-                Additional arguments for asyncpg.create_pool() or sqlite3.connect()
-              '';
-            };
+          database_opts = lib.mkOption {
+            type = types.attrs;
+            default = { };
+            description = ''
+              Additional arguments for asyncpg.create_pool() or sqlite3.connect()
+            '';
+          };
 
-            plugin_directories = lib.mkOption {
-              default = { };
-              description = "Plugin directory paths";
-              type = types.submodule {
-                options = {
-                  upload = lib.mkOption {
-                    type = types.str;
-                    default = "./plugins";
-                    defaultText = lib.literalExpression ''"''${config.services.maubot.dataDir}/plugins"'';
-                    description = ''
-                      The directory where uploaded new plugins should be stored.
-                    '';
-                  };
-                  load = lib.mkOption {
-                    type = types.listOf types.str;
-                    default = [ "./plugins" ];
-                    defaultText = lib.literalExpression ''[ "''${config.services.maubot.dataDir}/plugins" ]'';
-                    description = ''
-                      The directories from which plugins should be loaded. Duplicate plugin IDs will be moved to the trash.
-                    '';
-                  };
-                  trash = lib.mkOption {
-                    type = with types; nullOr str;
-                    default = "./trash";
-                    defaultText = lib.literalExpression ''"''${config.services.maubot.dataDir}/trash"'';
-                    description = ''
-                      The directory where old plugin versions and conflicting plugins should be moved. Set to null to delete files immediately.
-                    '';
-                  };
+          plugin_directories = lib.mkOption {
+            default = { };
+            description = "Plugin directory paths";
+            type = types.submodule {
+              options = {
+                upload = lib.mkOption {
+                  type = types.str;
+                  default = "./plugins";
+                  defaultText = lib.literalExpression ''"''${config.services.maubot.dataDir}/plugins"'';
+                  description = ''
+                    The directory where uploaded new plugins should be stored.
+                  '';
+                };
+                load = lib.mkOption {
+                  type = types.listOf types.str;
+                  default = [ "./plugins" ];
+                  defaultText = lib.literalExpression ''[ "''${config.services.maubot.dataDir}/plugins" ]'';
+                  description = ''
+                    The directories from which plugins should be loaded. Duplicate plugin IDs will be moved to the trash.
+                  '';
+                };
+                trash = lib.mkOption {
+                  type = with types; nullOr str;
+                  default = "./trash";
+                  defaultText = lib.literalExpression ''"''${config.services.maubot.dataDir}/trash"'';
+                  description = ''
+                    The directory where old plugin versions and conflicting plugins should be moved. Set to null to delete files immediately.
+                  '';
                 };
               };
             };
+          };
 
-            plugin_databases = lib.mkOption {
-              description = "Plugin database settings";
-              default = { };
-              type = types.submodule {
-                options = {
-                  sqlite = lib.mkOption {
-                    type = types.str;
-                    default = "./plugins";
-                    defaultText = lib.literalExpression ''"''${config.services.maubot.dataDir}/plugins"'';
-                    description = ''
-                      The directory where SQLite plugin databases should be stored.
-                    '';
-                  };
+          plugin_databases = lib.mkOption {
+            description = "Plugin database settings";
+            default = { };
+            type = types.submodule {
+              options = {
+                sqlite = lib.mkOption {
+                  type = types.str;
+                  default = "./plugins";
+                  defaultText = lib.literalExpression ''"''${config.services.maubot.dataDir}/plugins"'';
+                  description = ''
+                    The directory where SQLite plugin databases should be stored.
+                  '';
+                };
 
-                  postgres = lib.mkOption {
-                    type = types.nullOr types.str;
-                    default = if isPostgresql cfg.settings.database then "default" else null;
-                    defaultText = lib.literalExpression ''if isPostgresql config.services.maubot.settings.database then "default" else null'';
-                    description = ''
-                      The connection URL for plugin database. See [example config](https://github.com/maubot/maubot/blob/master/maubot/example-config.yaml) for exact format.
-                    '';
-                  };
+                postgres = lib.mkOption {
+                  type = types.nullOr types.str;
+                  default = if isPostgresql cfg.settings.database then "default" else null;
+                  defaultText = lib.literalExpression ''if isPostgresql config.services.maubot.settings.database then "default" else null'';
+                  description = ''
+                    The connection URL for plugin database. See [example config](https://github.com/maubot/maubot/blob/master/maubot/example-config.yaml) for exact format.
+                  '';
+                };
 
-                  postgres_max_conns_per_plugin = lib.mkOption {
-                    type = types.nullOr types.int;
-                    default = 3;
-                    description = ''
-                      Maximum number of connections per plugin instance.
-                    '';
-                  };
+                postgres_max_conns_per_plugin = lib.mkOption {
+                  type = types.nullOr types.int;
+                  default = 3;
+                  description = ''
+                    Maximum number of connections per plugin instance.
+                  '';
+                };
 
-                  postgres_opts = lib.mkOption {
-                    type = types.attrs;
-                    default = { };
-                    description = ''
-                      Overrides for the default database_opts when using a non-default postgres connection URL.
-                    '';
-                  };
+                postgres_opts = lib.mkOption {
+                  type = types.attrs;
+                  default = { };
+                  description = ''
+                    Overrides for the default database_opts when using a non-default postgres connection URL.
+                  '';
+                };
+              };
+            };
+          };
+
+          server = lib.mkOption {
+            default = { };
+            description = "Listener config";
+            type = types.submodule {
+              options = {
+                hostname = lib.mkOption {
+                  type = types.str;
+                  default = "127.0.0.1";
+                  description = ''
+                    The IP to listen on
+                  '';
+                };
+                port = lib.mkOption {
+                  type = types.port;
+                  default = 29316;
+                  description = ''
+                    The port to listen on
+                  '';
+                };
+                public_url = lib.mkOption {
+                  type = types.str;
+                  default = "http://${cfg.settings.server.hostname}:${toString cfg.settings.server.port}";
+                  defaultText = lib.literalExpression ''"http://''${config.services.maubot.settings.server.hostname}:''${toString config.services.maubot.settings.server.port}"'';
+                  description = ''
+                    Public base URL where the server is visible.
+                  '';
+                };
+                ui_base_path = lib.mkOption {
+                  type = types.str;
+                  default = "/_matrix/maubot";
+                  description = ''
+                    The base path for the UI.
+                  '';
+                };
+                plugin_base_path = lib.mkOption {
+                  type = types.str;
+                  default = "${config.services.maubot.settings.server.ui_base_path}/plugin/";
+                  defaultText = lib.literalExpression ''
+                    "''${config.services.maubot.settings.server.ui_base_path}/plugin/"
+                  '';
+                  description = ''
+                    The base path for plugin endpoints. The instance ID will be appended directly.
+                  '';
+                };
+                override_resource_path = lib.mkOption {
+                  type = types.nullOr types.str;
+                  default = null;
+                  description = ''
+                    Override path from where to load UI resources.
+                  '';
                 };
               };
             };
+          };
 
-            server = lib.mkOption {
-              default = { };
-              description = "Listener config";
-              type = types.submodule {
+          homeservers = lib.mkOption {
+            type = types.attrsOf (
+              types.submodule {
                 options = {
-                  hostname = lib.mkOption {
-                    type = types.str;
-                    default = "127.0.0.1";
-                    description = ''
-                      The IP to listen on
-                    '';
-                  };
-                  port = lib.mkOption {
-                    type = types.port;
-                    default = 29316;
-                    description = ''
-                      The port to listen on
-                    '';
-                  };
-                  public_url = lib.mkOption {
+                  url = lib.mkOption {
                     type = types.str;
-                    default = "http://${cfg.settings.server.hostname}:${toString cfg.settings.server.port}";
-                    defaultText = lib.literalExpression ''"http://''${config.services.maubot.settings.server.hostname}:''${toString config.services.maubot.settings.server.port}"'';
                     description = ''
-                      Public base URL where the server is visible.
-                    '';
-                  };
-                  ui_base_path = lib.mkOption {
-                    type = types.str;
-                    default = "/_matrix/maubot";
-                    description = ''
-                      The base path for the UI.
-                    '';
-                  };
-                  plugin_base_path = lib.mkOption {
-                    type = types.str;
-                    default = "${config.services.maubot.settings.server.ui_base_path}/plugin/";
-                    defaultText = lib.literalExpression ''
-                      "''${config.services.maubot.settings.server.ui_base_path}/plugin/"
-                    '';
-                    description = ''
-                      The base path for plugin endpoints. The instance ID will be appended directly.
-                    '';
-                  };
-                  override_resource_path = lib.mkOption {
-                    type = types.nullOr types.str;
-                    default = null;
-                    description = ''
-                      Override path from where to load UI resources.
+                      Client-server API URL
                     '';
                   };
                 };
+              }
+            );
+            default = {
+              "matrix.org" = {
+                url = "https://matrix-client.matrix.org";
               };
             };
+            description = ''
+              Known homeservers. This is required for the `mbc auth` command and also allows more convenient access from the management UI.
+              If you want to specify registration secrets, pass this via extraConfigFile instead.
+            '';
+          };
 
-            homeservers = lib.mkOption {
-              type = types.attrsOf (
-                types.submodule {
-                  options = {
-                    url = lib.mkOption {
-                      type = types.str;
-                      description = ''
-                        Client-server API URL
-                      '';
-                    };
-                  };
-                }
-              );
-              default = {
-                "matrix.org" = {
-                  url = "https://matrix-client.matrix.org";
-                };
-              };
-              description = ''
-                Known homeservers. This is required for the `mbc auth` command and also allows more convenient access from the management UI.
-                If you want to specify registration secrets, pass this via extraConfigFile instead.
-              '';
+          admins = lib.mkOption {
+            type = types.attrsOf types.str;
+            default = {
+              root = "";
             };
+            description = ''
+              List of administrator users. Plaintext passwords will be bcrypted on startup. Set empty password
+              to prevent normal login. Root is a special user that can't have a password and will always exist.
+            '';
+          };
 
-            admins = lib.mkOption {
-              type = types.attrsOf types.str;
-              default = {
-                root = "";
-              };
-              description = ''
-                List of administrator users. Plaintext passwords will be bcrypted on startup. Set empty password
-                to prevent normal login. Root is a special user that can't have a password and will always exist.
-              '';
+          api_features = lib.mkOption {
+            type = types.attrsOf types.bool;
+            default = {
+              login = true;
+              plugin = true;
+              plugin_upload = true;
+              instance = true;
+              instance_database = true;
+              client = true;
+              client_proxy = true;
+              client_auth = true;
+              dev_open = true;
+              log = true;
             };
+            description = ''
+              API feature switches.
+            '';
+          };
 
-            api_features = lib.mkOption {
-              type = types.attrsOf types.bool;
-              default = {
-                login = true;
-                plugin = true;
-                plugin_upload = true;
-                instance = true;
-                instance_database = true;
-                client = true;
-                client_proxy = true;
-                client_auth = true;
-                dev_open = true;
-                log = true;
+          logging = lib.mkOption {
+            type = types.attrs;
+            description = ''
+              Python logging configuration. See [section 16.7.2 of the Python
+              documentation](https://docs.python.org/3.6/library/logging.config.html#configuration-dictionary-schema)
+              for more info.
+            '';
+            default = {
+              version = 1;
+              formatters = {
+                colored = {
+                  "()" = "maubot.lib.color_log.ColorFormatter";
+                  format = "[%(asctime)s] [%(levelname)s@%(name)s] %(message)s";
+                };
+                normal = {
+                  format = "[%(asctime)s] [%(levelname)s@%(name)s] %(message)s";
+                };
               };
-              description = ''
-                API feature switches.
-              '';
-            };
-
-            logging = lib.mkOption {
-              type = types.attrs;
-              description = ''
-                Python logging configuration. See [section 16.7.2 of the Python
-                documentation](https://docs.python.org/3.6/library/logging.config.html#configuration-dictionary-schema)
-                for more info.
-              '';
-              default = {
-                version = 1;
-                formatters = {
-                  colored = {
-                    "()" = "maubot.lib.color_log.ColorFormatter";
-                    format = "[%(asctime)s] [%(levelname)s@%(name)s] %(message)s";
-                  };
-                  normal = {
-                    format = "[%(asctime)s] [%(levelname)s@%(name)s] %(message)s";
-                  };
+              handlers = {
+                file = {
+                  class = "logging.handlers.RotatingFileHandler";
+                  formatter = "normal";
+                  filename = "./maubot.log";
+                  maxBytes = 10485760;
+                  backupCount = 10;
                 };
-                handlers = {
-                  file = {
-                    class = "logging.handlers.RotatingFileHandler";
-                    formatter = "normal";
-                    filename = "./maubot.log";
-                    maxBytes = 10485760;
-                    backupCount = 10;
-                  };
-                  console = {
-                    class = "logging.StreamHandler";
-                    formatter = "colored";
-                  };
+                console = {
+                  class = "logging.StreamHandler";
+                  formatter = "colored";
                 };
-                loggers = {
-                  maubot = {
-                    level = "DEBUG";
-                  };
-                  mau = {
-                    level = "DEBUG";
-                  };
-                  aiohttp = {
-                    level = "INFO";
-                  };
+              };
+              loggers = {
+                maubot = {
+                  level = "DEBUG";
                 };
-                root = {
+                mau = {
                   level = "DEBUG";
-                  handlers = [
-                    "file"
-                    "console"
-                  ];
+                };
+                aiohttp = {
+                  level = "INFO";
                 };
               };
+              root = {
+                level = "DEBUG";
+                handlers = [
+                  "file"
+                  "console"
+                ];
+              };
             };
           };
         };
+      };
     };
   };
 
diff --git a/nixos/modules/services/matrix/synapse.nix b/nixos/modules/services/matrix/synapse.nix
index 69aaaa8a83d87..afa1d5305e38e 100644
--- a/nixos/modules/services/matrix/synapse.nix
+++ b/nixos/modules/services/matrix/synapse.nix
@@ -123,7 +123,7 @@ let
     logName:
     format.generate "synapse-log-${logName}.yaml" (
       lib.attrsets.recursiveUpdate cfg.log (
-       lib.optionalAttrs (cfg.log ? handlers.journal) {
+        lib.optionalAttrs (cfg.log ? handlers.journal) {
           handlers.journal = cfg.log.handlers.journal // {
             SYSLOG_IDENTIFIER = logName;
           };
@@ -162,8 +162,16 @@ in
     '')
 
     # options that don't exist in synapse anymore
-    (lib.mkRemovedOptionModule [ "services" "matrix-synapse" "bind_host" ] "Use listener settings instead.")
-    (lib.mkRemovedOptionModule [ "services" "matrix-synapse" "bind_port" ] "Use listener settings instead.")
+    (lib.mkRemovedOptionModule [
+      "services"
+      "matrix-synapse"
+      "bind_host"
+    ] "Use listener settings instead.")
+    (lib.mkRemovedOptionModule [
+      "services"
+      "matrix-synapse"
+      "bind_port"
+    ] "Use listener settings instead.")
     (lib.mkRemovedOptionModule [ "services" "matrix-synapse" "expire_access_tokens" ] "")
     (lib.mkRemovedOptionModule [
       "services"
@@ -229,7 +237,11 @@ in
       "enable_registration"
     ] "Use settings.enable_registration instead")
     (lib.mkRemovedOptionModule [ "services" "matrix-synapse" "extraConfig" ] "Use settings instead.")
-    (lib.mkRemovedOptionModule [ "services" "matrix-synapse" "listeners" ] "Use settings.listeners instead")
+    (lib.mkRemovedOptionModule [
+      "services"
+      "matrix-synapse"
+      "listeners"
+    ] "Use settings.listeners instead")
     (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
@@ -286,7 +298,11 @@ in
       "matrix-synapse"
       "turn_shared_secret"
     ] "Use settings.turn_shared_secret instead")
-    (lib.mkRemovedOptionModule [ "services" "matrix-synapse" "turn_uris" ] "Use settings.turn_uris instead")
+    (lib.mkRemovedOptionModule [
+      "services"
+      "matrix-synapse"
+      "turn_uris"
+    ] "Use settings.turn_uris instead")
     (lib.mkRemovedOptionModule [
       "services"
       "matrix-synapse"
@@ -770,446 +786,445 @@ in
 
             Secrets should be passed in by using the `extraConfigFiles` option.
           '';
-          type =
-            types.submodule {
-              freeformType = format.type;
-              options = {
-                # This is a reduced set of popular options and defaults
-                # Do not add every available option here, they can be specified
-                # by the user at their own discretion. This is a freeform type!
-
-                server_name = lib.mkOption {
-                  type = types.str;
-                  example = "example.com";
-                  default = config.networking.hostName;
-                  defaultText = lib.literalExpression "config.networking.hostName";
-                  description = ''
-                    The domain name of the server, withlib.optional explicit port.
-                    This is used by remote servers to look up the server address.
-                    This is also the last part of your UserID.
-
-                    The server_name cannot be changed later so it is important to configure this correctly before you start Synapse.
-                  '';
-                };
+          type = types.submodule {
+            freeformType = format.type;
+            options = {
+              # This is a reduced set of popular options and defaults
+              # Do not add every available option here, they can be specified
+              # by the user at their own discretion. This is a freeform type!
+
+              server_name = lib.mkOption {
+                type = types.str;
+                example = "example.com";
+                default = config.networking.hostName;
+                defaultText = lib.literalExpression "config.networking.hostName";
+                description = ''
+                  The domain name of the server, withlib.optional explicit port.
+                  This is used by remote servers to look up the server address.
+                  This is also the last part of your UserID.
 
-                enable_registration = lib.mkOption {
-                  type = types.bool;
-                  default = false;
-                  description = ''
-                    Enable registration for new users.
-                  '';
-                };
+                  The server_name cannot be changed later so it is important to configure this correctly before you start Synapse.
+                '';
+              };
 
-                registration_shared_secret = lib.mkOption {
-                  type = types.nullOr types.str;
-                  default = null;
-                  description = ''
-                    If set, allows registration by anyone who also has the shared
-                    secret, even if registration is otherwise disabled.
+              enable_registration = lib.mkOption {
+                type = types.bool;
+                default = false;
+                description = ''
+                  Enable registration for new users.
+                '';
+              };
 
-                    Secrets should be passed in via `extraConfigFiles`!
-                  '';
-                };
+              registration_shared_secret = lib.mkOption {
+                type = types.nullOr types.str;
+                default = null;
+                description = ''
+                  If set, allows registration by anyone who also has the shared
+                  secret, even if registration is otherwise disabled.
 
-                macaroon_secret_key = lib.mkOption {
-                  type = types.nullOr types.str;
-                  default = null;
-                  description = ''
-                    Secret key for authentication tokens. If none is specified,
-                    the registration_shared_secret is used, if one is given; otherwise,
-                    a secret key is derived from the signing key.
+                  Secrets should be passed in via `extraConfigFiles`!
+                '';
+              };
 
-                    Secrets should be passed in via `extraConfigFiles`!
-                  '';
-                };
+              macaroon_secret_key = lib.mkOption {
+                type = types.nullOr types.str;
+                default = null;
+                description = ''
+                  Secret key for authentication tokens. If none is specified,
+                  the registration_shared_secret is used, if one is given; otherwise,
+                  a secret key is derived from the signing key.
 
-                enable_metrics = lib.mkOption {
-                  type = types.bool;
-                  default = false;
-                  description = ''
-                    Enable collection and rendering of performance metrics
-                  '';
-                };
+                  Secrets should be passed in via `extraConfigFiles`!
+                '';
+              };
 
-                report_stats = lib.mkOption {
-                  type = types.bool;
-                  default = false;
-                  description = ''
-                    Whether or not to report anonymized homeserver usage statistics.
-                  '';
-                };
+              enable_metrics = lib.mkOption {
+                type = types.bool;
+                default = false;
+                description = ''
+                  Enable collection and rendering of performance metrics
+                '';
+              };
 
-                signing_key_path = lib.mkOption {
-                  type = types.path;
-                  default = "${cfg.dataDir}/homeserver.signing.key";
-                  description = ''
-                    Path to the signing key to sign messages with.
-                  '';
-                };
+              report_stats = lib.mkOption {
+                type = types.bool;
+                default = false;
+                description = ''
+                  Whether or not to report anonymized homeserver usage statistics.
+                '';
+              };
 
-                pid_file = lib.mkOption {
-                  type = types.path;
-                  default = "/run/matrix-synapse.pid";
-                  readOnly = true;
-                  description = ''
-                    The file to store the PID in.
-                  '';
-                };
+              signing_key_path = lib.mkOption {
+                type = types.path;
+                default = "${cfg.dataDir}/homeserver.signing.key";
+                description = ''
+                  Path to the signing key to sign messages with.
+                '';
+              };
 
-                log_config = lib.mkOption {
-                  type = types.path;
-                  default = genLogConfigFile "synapse";
-                  defaultText = logConfigText "synapse";
-                  description = ''
-                    The file that holds the logging configuration.
-                  '';
-                };
+              pid_file = lib.mkOption {
+                type = types.path;
+                default = "/run/matrix-synapse.pid";
+                readOnly = true;
+                description = ''
+                  The file to store the PID in.
+                '';
+              };
 
-                media_store_path = lib.mkOption {
-                  type = types.path;
-                  default =
-                    if lib.versionAtLeast config.system.stateVersion "22.05" then
-                      "${cfg.dataDir}/media_store"
-                    else
-                      "${cfg.dataDir}/media";
-                  defaultText = "${cfg.dataDir}/media_store for when system.stateVersion is at least 22.05, ${cfg.dataDir}/media when lower than 22.05";
-                  description = ''
-                    Directory where uploaded images and attachments are stored.
-                  '';
-                };
+              log_config = lib.mkOption {
+                type = types.path;
+                default = genLogConfigFile "synapse";
+                defaultText = logConfigText "synapse";
+                description = ''
+                  The file that holds the logging configuration.
+                '';
+              };
 
-                public_baseurl = lib.mkOption {
-                  type = types.nullOr types.str;
-                  default = null;
-                  example = "https://example.com:8448/";
-                  description = ''
-                    The public-facing base URL for the client API (not including _matrix/...)
-                  '';
-                };
+              media_store_path = lib.mkOption {
+                type = types.path;
+                default =
+                  if lib.versionAtLeast config.system.stateVersion "22.05" then
+                    "${cfg.dataDir}/media_store"
+                  else
+                    "${cfg.dataDir}/media";
+                defaultText = "${cfg.dataDir}/media_store for when system.stateVersion is at least 22.05, ${cfg.dataDir}/media when lower than 22.05";
+                description = ''
+                  Directory where uploaded images and attachments are stored.
+                '';
+              };
 
-                tls_certificate_path = lib.mkOption {
-                  type = types.nullOr types.str;
-                  default = null;
-                  example = "/var/lib/acme/example.com/fullchain.pem";
-                  description = ''
-                    PEM encoded X509 certificate for TLS.
-                    You can replace the self-signed certificate that synapse
-                    autogenerates on launch with your own SSL certificate + key pair
-                    if you like.  Any required intermediary certificates can be
-                    appended after the primary certificate in hierarchical order.
-                  '';
-                };
+              public_baseurl = lib.mkOption {
+                type = types.nullOr types.str;
+                default = null;
+                example = "https://example.com:8448/";
+                description = ''
+                  The public-facing base URL for the client API (not including _matrix/...)
+                '';
+              };
 
-                tls_private_key_path = lib.mkOption {
-                  type = types.nullOr types.str;
-                  default = null;
-                  example = "/var/lib/acme/example.com/key.pem";
-                  description = ''
-                    PEM encoded private key for TLS. Specify null if synapse is not
-                    speaking TLS directly.
-                  '';
-                };
+              tls_certificate_path = lib.mkOption {
+                type = types.nullOr types.str;
+                default = null;
+                example = "/var/lib/acme/example.com/fullchain.pem";
+                description = ''
+                  PEM encoded X509 certificate for TLS.
+                  You can replace the self-signed certificate that synapse
+                  autogenerates on launch with your own SSL certificate + key pair
+                  if you like.  Any required intermediary certificates can be
+                  appended after the primary certificate in hierarchical order.
+                '';
+              };
 
-                presence.enabled = lib.mkOption {
-                  type = types.bool;
-                  default = true;
-                  example = false;
-                  description = ''
-                    Whether to enable presence tracking.
+              tls_private_key_path = lib.mkOption {
+                type = types.nullOr types.str;
+                default = null;
+                example = "/var/lib/acme/example.com/key.pem";
+                description = ''
+                  PEM encoded private key for TLS. Specify null if synapse is not
+                  speaking TLS directly.
+                '';
+              };
 
-                    Presence tracking allows users to see the state (e.g online/offline)
-                    of other local and remote users.
-                  '';
-                };
+              presence.enabled = lib.mkOption {
+                type = types.bool;
+                default = true;
+                example = false;
+                description = ''
+                  Whether to enable presence tracking.
 
-                listeners = lib.mkOption {
-                  type = types.listOf (listenerType false);
-                  default = [
-                    {
-                      port = 8008;
-                      bind_addresses = [ "127.0.0.1" ];
-                      type = "http";
-                      tls = false;
-                      x_forwarded = true;
-                      resources = [
-                        {
-                          names = [ "client" ];
-                          compress = true;
-                        }
-                        {
-                          names = [ "federation" ];
-                          compress = false;
-                        }
-                      ];
-                    }
-                  ]
-                  ++ lib.optional hasWorkers {
-                    path = "/run/matrix-synapse/main_replication.sock";
+                  Presence tracking allows users to see the state (e.g online/offline)
+                  of other local and remote users.
+                '';
+              };
+
+              listeners = lib.mkOption {
+                type = types.listOf (listenerType false);
+                default = [
+                  {
+                    port = 8008;
+                    bind_addresses = [ "127.0.0.1" ];
                     type = "http";
+                    tls = false;
+                    x_forwarded = true;
                     resources = [
                       {
-                        names = [ "replication" ];
+                        names = [ "client" ];
+                        compress = true;
+                      }
+                      {
+                        names = [ "federation" ];
                         compress = false;
                       }
                     ];
-                  };
-                  description = ''
-                    List of ports that Synapse should listen on, their purpose and their configuration.
-
-                    By default, synapse will be configured for client and federation traffic on port 8008, and
-                    use a UNIX domain socket for worker replication. See [`services.matrix-synapse.workers`](#opt-services.matrix-synapse.workers)
-                    for more details.
-                  '';
-                };
-
-                database.name = lib.mkOption {
-                  type = types.enum [
-                    "sqlite3"
-                    "psycopg2"
-                  ];
-                  default = if lib.versionAtLeast config.system.stateVersion "18.03" then "psycopg2" else "sqlite3";
-                  defaultText = lib.literalExpression ''
-                    if versionAtLeast config.system.stateVersion "18.03"
-                    then "psycopg2"
-                    else "sqlite3"
-                  '';
-                  description = ''
-                    The database engine name. Can be sqlite3 or psycopg2.
-                  '';
-                };
-
-                database.args.database = lib.mkOption {
-                  type = types.str;
-                  default =
+                  }
+                ]
+                ++ lib.optional hasWorkers {
+                  path = "/run/matrix-synapse/main_replication.sock";
+                  type = "http";
+                  resources = [
                     {
-                      sqlite3 = "${cfg.dataDir}/homeserver.db";
-                      psycopg2 = "matrix-synapse";
+                      names = [ "replication" ];
+                      compress = false;
                     }
-                    .${cfg.settings.database.name};
-                  defaultText = lib.literalExpression ''
-                    {
-                      sqlite3 = "''${${options.services.matrix-synapse.dataDir}}/homeserver.db";
-                      psycopg2 = "matrix-synapse";
-                    }.''${${options.services.matrix-synapse.settings}.database.name};
-                  '';
-                  description = ''
-                    Name of the database when using the psycopg2 backend,
-                    path to the database location when using sqlite3.
-                  '';
+                  ];
                 };
+                description = ''
+                  List of ports that Synapse should listen on, their purpose and their configuration.
 
-                database.args.user = lib.mkOption {
-                  type = types.nullOr types.str;
-                  default =
-                    {
-                      sqlite3 = null;
-                      psycopg2 = "matrix-synapse";
-                    }
-                    .${cfg.settings.database.name};
-                  defaultText = lib.literalExpression ''
-                    {
-                      sqlite3 = null;
-                      psycopg2 = "matrix-synapse";
-                    }.''${cfg.settings.database.name};
-                  '';
-                  description = ''
-                    Username to connect with psycopg2, set to null
-                    when using sqlite3.
-                  '';
-                };
+                  By default, synapse will be configured for client and federation traffic on port 8008, and
+                  use a UNIX domain socket for worker replication. See [`services.matrix-synapse.workers`](#opt-services.matrix-synapse.workers)
+                  for more details.
+                '';
+              };
 
-                url_preview_enabled = lib.mkOption {
-                  type = types.bool;
-                  default = true;
-                  example = false;
-                  description = ''
-                    Is the preview URL API enabled?  If enabled, you *must* specify an
-                    explicit url_preview_ip_range_blacklist of IPs that the spider is
-                    denied from accessing.
-                  '';
-                };
+              database.name = lib.mkOption {
+                type = types.enum [
+                  "sqlite3"
+                  "psycopg2"
+                ];
+                default = if lib.versionAtLeast config.system.stateVersion "18.03" then "psycopg2" else "sqlite3";
+                defaultText = lib.literalExpression ''
+                  if versionAtLeast config.system.stateVersion "18.03"
+                  then "psycopg2"
+                  else "sqlite3"
+                '';
+                description = ''
+                  The database engine name. Can be sqlite3 or psycopg2.
+                '';
+              };
 
-                url_preview_ip_range_blacklist = lib.mkOption {
-                  type = types.listOf types.str;
-                  default = [
-                    "10.0.0.0/8"
-                    "100.64.0.0/10"
-                    "127.0.0.0/8"
-                    "169.254.0.0/16"
-                    "172.16.0.0/12"
-                    "192.0.0.0/24"
-                    "192.0.2.0/24"
-                    "192.168.0.0/16"
-                    "192.88.99.0/24"
-                    "198.18.0.0/15"
-                    "198.51.100.0/24"
-                    "2001:db8::/32"
-                    "203.0.113.0/24"
-                    "224.0.0.0/4"
-                    "::1/128"
-                    "fc00::/7"
-                    "fe80::/10"
-                    "fec0::/10"
-                    "ff00::/8"
-                  ];
-                  description = ''
-                    List of IP address CIDR ranges that the URL preview spider is denied
-                    from accessing.
-                  '';
-                };
+              database.args.database = lib.mkOption {
+                type = types.str;
+                default =
+                  {
+                    sqlite3 = "${cfg.dataDir}/homeserver.db";
+                    psycopg2 = "matrix-synapse";
+                  }
+                  .${cfg.settings.database.name};
+                defaultText = lib.literalExpression ''
+                  {
+                    sqlite3 = "''${${options.services.matrix-synapse.dataDir}}/homeserver.db";
+                    psycopg2 = "matrix-synapse";
+                  }.''${${options.services.matrix-synapse.settings}.database.name};
+                '';
+                description = ''
+                  Name of the database when using the psycopg2 backend,
+                  path to the database location when using sqlite3.
+                '';
+              };
 
-                url_preview_ip_range_whitelist = lib.mkOption {
-                  type = types.listOf types.str;
-                  default = [ ];
-                  description = ''
-                    List of IP address CIDR ranges that the URL preview spider is allowed
-                    to access even if they are specified in url_preview_ip_range_blacklist.
-                  '';
-                };
+              database.args.user = lib.mkOption {
+                type = types.nullOr types.str;
+                default =
+                  {
+                    sqlite3 = null;
+                    psycopg2 = "matrix-synapse";
+                  }
+                  .${cfg.settings.database.name};
+                defaultText = lib.literalExpression ''
+                  {
+                    sqlite3 = null;
+                    psycopg2 = "matrix-synapse";
+                  }.''${cfg.settings.database.name};
+                '';
+                description = ''
+                  Username to connect with psycopg2, set to null
+                  when using sqlite3.
+                '';
+              };
 
-                url_preview_url_blacklist = lib.mkOption {
-                  # FIXME revert to just `listOf (attrsOf str)` after some time(tm).
-                  type = types.listOf (
-                    types.coercedTo types.str (lib.const (throw ''
-                      Setting `config.services.matrix-synapse.settings.url_preview_url_blacklist`
-                      to a list of strings has never worked. Due to a bug, this was the type accepted
-                      by the module, but in practice it broke on runtime and as a result, no URL
-                      preview worked anywhere if this was set.
-
-                      See https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#url_preview_url_blacklist
-                      on how to configure it properly.
-                    '')) (types.attrsOf types.str)
-                  );
-                  default = [ ];
-                  example = lib.literalExpression ''
-                    [
-                      { scheme = "http"; } # no http previews
-                      { netloc = "www.acme.com"; path = "/foo"; } # block http(s)://www.acme.com/foo
-                    ]
-                  '';
-                  description = ''
-                    Optional list of URL matches that the URL preview spider is
-                    denied from accessing.
-                  '';
-                };
+              url_preview_enabled = lib.mkOption {
+                type = types.bool;
+                default = true;
+                example = false;
+                description = ''
+                  Is the preview URL API enabled?  If enabled, you *must* specify an
+                  explicit url_preview_ip_range_blacklist of IPs that the spider is
+                  denied from accessing.
+                '';
+              };
 
-                max_upload_size = lib.mkOption {
-                  type = types.str;
-                  default = "50M";
-                  example = "100M";
-                  description = ''
-                    The largest allowed upload size in bytes
-                  '';
-                };
+              url_preview_ip_range_blacklist = lib.mkOption {
+                type = types.listOf types.str;
+                default = [
+                  "10.0.0.0/8"
+                  "100.64.0.0/10"
+                  "127.0.0.0/8"
+                  "169.254.0.0/16"
+                  "172.16.0.0/12"
+                  "192.0.0.0/24"
+                  "192.0.2.0/24"
+                  "192.168.0.0/16"
+                  "192.88.99.0/24"
+                  "198.18.0.0/15"
+                  "198.51.100.0/24"
+                  "2001:db8::/32"
+                  "203.0.113.0/24"
+                  "224.0.0.0/4"
+                  "::1/128"
+                  "fc00::/7"
+                  "fe80::/10"
+                  "fec0::/10"
+                  "ff00::/8"
+                ];
+                description = ''
+                  List of IP address CIDR ranges that the URL preview spider is denied
+                  from accessing.
+                '';
+              };
 
-                max_image_pixels = lib.mkOption {
-                  type = types.str;
-                  default = "32M";
-                  example = "64M";
-                  description = ''
-                    Maximum number of pixels that will be thumbnailed
-                  '';
-                };
+              url_preview_ip_range_whitelist = lib.mkOption {
+                type = types.listOf types.str;
+                default = [ ];
+                description = ''
+                  List of IP address CIDR ranges that the URL preview spider is allowed
+                  to access even if they are specified in url_preview_ip_range_blacklist.
+                '';
+              };
 
-                dynamic_thumbnails = lib.mkOption {
-                  type = types.bool;
-                  default = false;
-                  example = true;
-                  description = ''
-                    Whether to generate new thumbnails on the fly to precisely match
-                    the resolution requested by the client. If true then whenever
-                    a new resolution is requested by the client the server will
-                    generate a new thumbnail. If false the server will pick a thumbnail
-                    from a precalculated list.
-                  '';
-                };
+              url_preview_url_blacklist = lib.mkOption {
+                # FIXME revert to just `listOf (attrsOf str)` after some time(tm).
+                type = types.listOf (
+                  types.coercedTo types.str (lib.const (throw ''
+                    Setting `config.services.matrix-synapse.settings.url_preview_url_blacklist`
+                    to a list of strings has never worked. Due to a bug, this was the type accepted
+                    by the module, but in practice it broke on runtime and as a result, no URL
+                    preview worked anywhere if this was set.
+
+                    See https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#url_preview_url_blacklist
+                    on how to configure it properly.
+                  '')) (types.attrsOf types.str)
+                );
+                default = [ ];
+                example = lib.literalExpression ''
+                  [
+                    { scheme = "http"; } # no http previews
+                    { netloc = "www.acme.com"; path = "/foo"; } # block http(s)://www.acme.com/foo
+                  ]
+                '';
+                description = ''
+                  Optional list of URL matches that the URL preview spider is
+                  denied from accessing.
+                '';
+              };
 
-                turn_uris = lib.mkOption {
-                  type = types.listOf types.str;
-                  default = [ ];
-                  example = [
-                    "turn:turn.example.com:3487?transport=udp"
-                    "turn:turn.example.com:3487?transport=tcp"
-                    "turns:turn.example.com:5349?transport=udp"
-                    "turns:turn.example.com:5349?transport=tcp"
-                  ];
-                  description = ''
-                    The public URIs of the TURN server to give to clients
-                  '';
-                };
-                turn_shared_secret = lib.mkOption {
-                  type = types.str;
-                  default = "";
-                  example = lib.literalExpression ''
-                    config.services.coturn.static-auth-secret
-                  '';
-                  description = ''
-                    The shared secret used to compute passwords for the TURN server.
+              max_upload_size = lib.mkOption {
+                type = types.str;
+                default = "50M";
+                example = "100M";
+                description = ''
+                  The largest allowed upload size in bytes
+                '';
+              };
 
-                    Secrets should be passed in via `extraConfigFiles`!
-                  '';
-                };
+              max_image_pixels = lib.mkOption {
+                type = types.str;
+                default = "32M";
+                example = "64M";
+                description = ''
+                  Maximum number of pixels that will be thumbnailed
+                '';
+              };
 
-                trusted_key_servers = lib.mkOption {
-                  type = types.listOf (
-                    types.submodule {
-                      freeformType = format.type;
-                      options = {
-                        server_name = lib.mkOption {
-                          type = types.str;
-                          example = "matrix.org";
-                          description = ''
-                            Hostname of the trusted server.
-                          '';
-                        };
-                      };
-                    }
-                  );
-                  default = [
-                    {
-                      server_name = "matrix.org";
-                      verify_keys = {
-                        "ed25519:auto" = "Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw";
-                      };
-                    }
-                  ];
-                  description = ''
-                    The trusted servers to download signing keys from.
-                  '';
-                };
+              dynamic_thumbnails = lib.mkOption {
+                type = types.bool;
+                default = false;
+                example = true;
+                description = ''
+                  Whether to generate new thumbnails on the fly to precisely match
+                  the resolution requested by the client. If true then whenever
+                  a new resolution is requested by the client the server will
+                  generate a new thumbnail. If false the server will pick a thumbnail
+                  from a precalculated list.
+                '';
+              };
 
-                app_service_config_files = lib.mkOption {
-                  type = types.listOf types.path;
-                  default = [ ];
-                  description = ''
-                    A list of application service config file to use
-                  '';
-                };
+              turn_uris = lib.mkOption {
+                type = types.listOf types.str;
+                default = [ ];
+                example = [
+                  "turn:turn.example.com:3487?transport=udp"
+                  "turn:turn.example.com:3487?transport=tcp"
+                  "turns:turn.example.com:5349?transport=udp"
+                  "turns:turn.example.com:5349?transport=tcp"
+                ];
+                description = ''
+                  The public URIs of the TURN server to give to clients
+                '';
+              };
+              turn_shared_secret = lib.mkOption {
+                type = types.str;
+                default = "";
+                example = lib.literalExpression ''
+                  config.services.coturn.static-auth-secret
+                '';
+                description = ''
+                  The shared secret used to compute passwords for the TURN server.
+
+                  Secrets should be passed in via `extraConfigFiles`!
+                '';
+              };
 
-                redis = lib.mkOption {
-                  type = types.submodule {
+              trusted_key_servers = lib.mkOption {
+                type = types.listOf (
+                  types.submodule {
                     freeformType = format.type;
                     options = {
-                      enabled = lib.mkOption {
-                        type = types.bool;
-                        default = false;
+                      server_name = lib.mkOption {
+                        type = types.str;
+                        example = "matrix.org";
                         description = ''
-                          Whether to use redis support
+                          Hostname of the trusted server.
                         '';
                       };
                     };
-                  };
-                  default = { };
-                  description = ''
-                    Redis configuration for synapse.
+                  }
+                );
+                default = [
+                  {
+                    server_name = "matrix.org";
+                    verify_keys = {
+                      "ed25519:auto" = "Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw";
+                    };
+                  }
+                ];
+                description = ''
+                  The trusted servers to download signing keys from.
+                '';
+              };
 
-                    See the
-                    [upstream documentation](https://github.com/element-hq/synapse/blob/v${pkgs.matrix-synapse-unwrapped.version}/docs/usage/configuration/config_documentation.md#redis)
-                    for available options.
-                  '';
+              app_service_config_files = lib.mkOption {
+                type = types.listOf types.path;
+                default = [ ];
+                description = ''
+                  A list of application service config file to use
+                '';
+              };
+
+              redis = lib.mkOption {
+                type = types.submodule {
+                  freeformType = format.type;
+                  options = {
+                    enabled = lib.mkOption {
+                      type = types.bool;
+                      default = false;
+                      description = ''
+                        Whether to use redis support
+                      '';
+                    };
+                  };
                 };
+                default = { };
+                description = ''
+                  Redis configuration for synapse.
+
+                  See the
+                  [upstream documentation](https://github.com/element-hq/synapse/blob/v${pkgs.matrix-synapse-unwrapped.version}/docs/usage/configuration/config_documentation.md#redis)
+                  for available options.
+                '';
               };
             };
+          };
         };
 
         workers = lib.mkOption {
@@ -1442,7 +1457,7 @@ in
     systemd.targets.matrix-synapse = lib.mkIf hasWorkers {
       description = "Synapse Matrix parent target";
       wants = [ "network-online.target" ];
-      after = [ "network-online.target" ] ++lib.optional hasLocalPostgresDB "postgresql.target";
+      after = [ "network-online.target" ] ++ lib.optional hasLocalPostgresDB "postgresql.target";
       wantedBy = [ "multi-user.target" ];
     };
 
@@ -1454,17 +1469,17 @@ in
               partOf = [ "matrix-synapse.target" ];
               wantedBy = [ "matrix-synapse.target" ];
               unitConfig.ReloadPropagatedFrom = "matrix-synapse.target";
-              requires =lib.optional hasLocalPostgresDB "postgresql.target";
+              requires = lib.optional hasLocalPostgresDB "postgresql.target";
             }
           else
             {
               wants = [ "network-online.target" ];
-              after = [ "network-online.target" ] ++lib.optional hasLocalPostgresDB "postgresql.target";
-              requires =lib.optional hasLocalPostgresDB "postgresql.target";
+              after = [ "network-online.target" ] ++ lib.optional hasLocalPostgresDB "postgresql.target";
+              requires = lib.optional hasLocalPostgresDB "postgresql.target";
               wantedBy = [ "multi-user.target" ];
             };
         baseServiceConfig = {
-          environment =lib.optionalAttrs (cfg.withJemalloc) {
+          environment = lib.optionalAttrs (cfg.withJemalloc) {
             LD_PRELOAD = "${pkgs.jemalloc}/lib/libjemalloc.so";
             PYTHONMALLOC = "malloc";
           };