Squash merge main into testing

hosts/server/default.nix

@@ -1,5 +1,11 @@
-{ inputs, outputs, lib, config, pkgs, ... }:
-let
+{
+  inputs,
+  outputs,
+  lib,
+  config,
+  pkgs,
+  ...
+}: let
   my-python-packages = python-packages:
     with python-packages; [
       pip
@@ -12,10 +18,10 @@ let
 in {
   nix = {
     settings = {
-      experimental-features = [ "nix-command" "flakes" ];
+      experimental-features = ["nix-command" "flakes"];
       warn-dirty = false;
       auto-optimise-store = true;
-      trusted-users = [ "root" "don" ];
+      trusted-users = ["root" "don"];
     };
     gc = {
       automatic = true;
@@ -49,14 +55,15 @@ in {
     inputMethod = {
       enable = true;
       type = "fcitx5";
-      fcitx5.addons = with pkgs; [ fcitx5-mozc fcitx5-gtk ];
+      fcitx5.addons = with pkgs; [fcitx5-mozc fcitx5-gtk];
     };
   };
 
   # Bootloader.
   boot = {
+    binfmt.emulatedSystems = ["aarch64-linux"];
     kernelPackages = pkgs.linuxPackages_latest;
-    kernelParams = [ "consoleblank=60" ];
+    kernelParams = ["consoleblank=60"];
     #loader = {
     #systemd-boot = {
     #enable = true;
@@ -66,34 +73,36 @@ in {
     #efiSysMountPoint = "/boot";
     #};
     #};
-    plymouth = { enable = true; };
-    kernel = { sysctl = { "vm.swappiness" = 10; }; };
+    plymouth = {enable = true;};
+    kernel = {sysctl = {"vm.swappiness" = 10;};};
   };
 
   security = {
-    polkit = { enable = true; };
+    polkit = {enable = true;};
     sudo.enable = false;
     doas = {
       enable = true;
-      extraRules = [{
-        users = [ "don" ];
-        keepEnv = true;
-        noPass = true;
-      }];
+      extraRules = [
+        {
+          users = ["don"];
+          keepEnv = true;
+          noPass = true;
+        }
+      ];
     };
   };
 
   services = {
-    pcscd = { enable = true; };
-    beszel-agent = { enable = true; };
+    pcscd = {enable = true;};
+    beszel-agent = {enable = true;};
     avahi = {
       enable = true;
       nssmdns4 = true;
     };
-    printing = { enable = true; };
-    udisks2 = { enable = true; };
-    nscd = { enableNsncd = true; };
-    tailscale = { enable = true; };
+    printing = {enable = true;};
+    udisks2 = {enable = true;};
+    nscd = {enableNsncd = true;};
+    tailscale = {enable = true;};
     locate = {
       enable = true;
       package = pkgs.mlocate;
@@ -172,15 +181,15 @@ in {
     nixfmt-classic
     pkg-config
     podman
-    poppler_utils
+    poppler-utils
     ruby
     sops
     udiskie
   ];
 
   programs = {
-    dconf = { enable = true; };
-    mtr = { enable = true; };
+    dconf = {enable = true;};
+    mtr = {enable = true;};
     gnupg = {
       agent = {
         enable = true;
@@ -192,25 +201,29 @@ in {
 
   nixpkgs.overlays = [
     (final: super: {
-      khal = super.khal.overridePythonAttrs (_: { doCheck = false; });
+      khal = super.khal.overridePythonAttrs (_: {doCheck = false;});
     })
   ];
 
   # Open ports in the firewall.
   networking.firewall = {
     enable = true;
-    trustedInterfaces = [ "tailscale0" ];
+    trustedInterfaces = ["tailscale0"];
     checkReversePath = "loose";
-    allowedUDPPorts = [ config.services.tailscale.port ];
-    allowedTCPPortRanges = [{
-      from = 1714;
-      to = 1764;
-    }];
-    allowedUDPPortRanges = [{
-      from = 1714;
-      to = 1764;
-    }];
-    allowedTCPPorts = [ 22 ];
+    allowedUDPPorts = [config.services.tailscale.port];
+    allowedTCPPortRanges = [
+      {
+        from = 1714;
+        to = 1764;
+      }
+    ];
+    allowedUDPPortRanges = [
+      {
+        from = 1714;
+        to = 1764;
+      }
+    ];
+    allowedTCPPorts = [22];
   };
 
   # This value determines the NixOS release from which the default