diff --git a/nixos/tests/step-ca.nix b/nixos/tests/step-ca.nix
index 4f2ff71c85e8..d87601ad1cb3 100644
--- a/nixos/tests/step-ca.nix
+++ b/nixos/tests/step-ca.nix
@@ -1,4 +1,5 @@
-import ./make-test-python.nix ({ pkgs, ... }:
+import ./make-test-python.nix (
+  { pkgs, ... }:
   let
     test-certificates = pkgs.runCommandLocal "test-certificates" { } ''
       mkdir -p $out
@@ -10,83 +11,93 @@ import ./make-test-python.nix ({ pkgs, ... }:
   in
   {
     name = "step-ca";
-    nodes =
-      {
-        caserver =
-          { config, pkgs, ... }: {
-            environment.etc.password-file.source = "${test-certificates}/intermediate-password-file";
-            services.step-ca = {
-              enable = true;
-              address = "[::]";
-              port = 8443;
-              openFirewall = true;
-              intermediatePasswordFile = "/etc/${config.environment.etc.password-file.target}";
-              settings = {
-                dnsNames = [ "caserver" ];
-                root = "${test-certificates}/root_ca.crt";
-                crt = "${test-certificates}/intermediate_ca.crt";
-                key = "${test-certificates}/intermediate_ca.key";
-                db = {
-                  type = "badger";
-                  dataSource = "/var/lib/step-ca/db";
-                };
-                authority = {
-                  provisioners = [
-                    {
-                      type = "ACME";
-                      name = "acme";
-                    }
-                  ];
-                };
+    nodes = {
+      caserver =
+        { config, pkgs, ... }:
+        {
+          environment.etc.password-file.source = "${test-certificates}/intermediate-password-file";
+          services.step-ca = {
+            enable = true;
+            address = "[::]";
+            port = 8443;
+            openFirewall = true;
+            intermediatePasswordFile = "/etc/${config.environment.etc.password-file.target}";
+            settings = {
+              dnsNames = [ "caserver" ];
+              root = "${test-certificates}/root_ca.crt";
+              crt = "${test-certificates}/intermediate_ca.crt";
+              key = "${test-certificates}/intermediate_ca.key";
+              db = {
+                type = "badger";
+                dataSource = "/var/lib/step-ca/db";
+              };
+              authority = {
+                provisioners = [
+                  {
+                    type = "ACME";
+                    name = "acme";
+                  }
+                ];
               };
             };
           };
+        };
 
-        caclient =
-          { config, pkgs, ... }: {
-            security.acme.defaults.server = "https://caserver:8443/acme/acme/directory";
-            security.acme.defaults.email = "root@example.org";
-            security.acme.acceptTerms = true;
+      caclient =
+        { config, pkgs, ... }:
+        {
+          security.acme.defaults.server = "https://caserver:8443/acme/acme/directory";
+          security.acme.defaults.email = "root@example.org";
+          security.acme.acceptTerms = true;
 
-            security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];
+          security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];
 
-            networking.firewall.allowedTCPPorts = [ 80 443 ];
+          networking.firewall.allowedTCPPorts = [
+            80
+            443
+          ];
 
-            services.nginx = {
-              enable = true;
-              virtualHosts = {
-                "caclient" = {
-                  forceSSL = true;
-                  enableACME = true;
-                };
+          services.nginx = {
+            enable = true;
+            virtualHosts = {
+              "caclient" = {
+                forceSSL = true;
+                enableACME = true;
               };
             };
           };
+        };
 
-        caclientcaddy =
-          { config, pkgs, ... }: {
-            security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];
+      caclientcaddy =
+        { config, pkgs, ... }:
+        {
+          security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];
 
-            networking.firewall.allowedTCPPorts = [ 80 443 ];
+          networking.firewall.allowedTCPPorts = [
+            80
+            443
+          ];
 
-            services.caddy = {
-              enable = true;
-              virtualHosts."caclientcaddy".extraConfig = ''
-                respond "Welcome to Caddy!"
+          services.caddy = {
+            enable = true;
+            virtualHosts."caclientcaddy".extraConfig = ''
+              respond "Welcome to Caddy!"
 
-                tls caddy@example.org {
-                  ca https://caserver:8443/acme/acme/directory
-                }
-              '';
-            };
+              tls caddy@example.org {
+                ca https://caserver:8443/acme/acme/directory
+              }
+            '';
           };
+        };
 
-        catester = { config, pkgs, ... }: {
+      catester =
+        { config, pkgs, ... }:
+        {
           security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];
         };
-      };
+    };
 
-    testScript =
+    testScript = # python
       ''
         catester.start()
         caserver.wait_for_unit("step-ca.service")
@@ -96,10 +107,10 @@ import ./make-test-python.nix ({ pkgs, ... }:
         catester.succeed("curl https://caclient/ | grep \"Welcome to nginx!\"")
 
         caclientcaddy.wait_for_unit("caddy.service")
-
         # It's hard to know when caddy has finished the ACME
         # dance with step-ca, so we keep trying to curl
         # until succeess.
         catester.wait_until_succeeds("curl https://caclientcaddy/ | grep \"Welcome to Caddy!\"")
       '';
-  })
+  }
+)