Merge commit ffd125e2 into haskell-updates

maintainers/maintainer-list.nix

@@ -1632,6 +1632,12 @@
     matrix = "@anthonyrsl:matrix.org";
     keys = [ { fingerprint = "472D 368A F107 F443 F3A5  C712 9DC4 987B 1A55 E75E"; } ];
   };
+  antipatico = {
+    email = "code@bootkit.dev";
+    github = "antipatico";
+    githubId = 14838767;
+    name = "Jacopo Scannella";
+  };
   antoinerg = {
     email = "roygobeil.antoine@gmail.com";
     github = "antoinerg";
@@ -2510,6 +2516,12 @@
     githubId = 66330398;
     name = "Victor Hang";
   };
+  baongoc124 = {
+    email = "baongoc124@gmail.com";
+    github = "baongoc124";
+    githubId = 766221;
+    name = "Ngoc Nguyen";
+  };
   barab-i = {
     email = "barab_i@outlook.com";
     github = "barab-i";
@@ -4931,6 +4943,12 @@
     github = "damhiya";
     githubId = 13533446;
   };
+  damidoug = {
+    email = "contact@damidoug.dev";
+    github = "damidoug";
+    githubId = 75175586;
+    name = "Douglas Damiano";
+  };
   DamienCassou = {
     email = "damien@cassou.me";
     github = "DamienCassou";
@@ -20454,6 +20472,13 @@
     githubId = 71049646;
     keys = [ { fingerprint = "8BDF DFB5 6842 2393 82A0  441B 9238 BC70 9E05 516A"; } ];
   };
+  sehqlr = {
+    name = "Sam Hatfield";
+    email = "hey@samhatfield.me";
+    matrix = "@sehqlr:matrix.org";
+    github = "sehqlr";
+    githubId = 2746852;
+  };
   sei40kr = {
     name = "Seong Yong-ju";
     email = "sei40kr@gmail.com";
@@ -24371,6 +24396,13 @@
     githubId = 20464732;
     name = "Willi Butz";
   };
+  willow_ch = {
+    email = "nix@w.wolo.dev";
+    github = "spaghetus";
+    githubId = 28763739;
+    name = "Willow Carlson-Huber";
+    keys = [ { fingerprint = "FE21E0981CDFD50ADD086423C21A693BA4693A60"; } ];
+  };
   willswats = {
     email = "williamstuwatson@gmail.com";
     github = "willswats";

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -151,8 +151,12 @@
 
 - `ente-auth` now uses the name `enteauth` for its binary. The previous name was `ente_auth`.
 
+- `foundationdb` was upgraded to 7.3.
+
 - `fluxus` has been removed, as it depends on `racket_7_9` and had no updates in 9 years.
 
+- `sm64ex-coop` has been removed as it was archived upstream. Consider migrating to `sm64coopdx`.
+
 - `renovate` was updated to v39. See the [upstream release notes](https://docs.renovatebot.com/release-notes-for-major-versions/#version-39) for breaking changes.
   Like upstream's docker images, renovate now runs on NodeJS 22.
 

nixos/modules/config/fonts/fontdir.nix

@@ -8,19 +8,35 @@ let
 
   cfg = config.fonts.fontDir;
 
-  x11Fonts = pkgs.runCommand "X11-fonts" { preferLocalBuild = true; } ''
-    mkdir -p "$out/share/X11/fonts"
-    font_regexp='.*\.\(ttf\|ttc\|otb\|otf\|pcf\|pfa\|pfb\|bdf\)\(\.gz\)?'
-    find ${toString config.fonts.packages} -regex "$font_regexp" \
-      -exec ln -sf -t "$out/share/X11/fonts" '{}' \;
-    cd "$out/share/X11/fonts"
-    ${lib.optionalString cfg.decompressFonts ''
-      ${pkgs.gzip}/bin/gunzip -f *.gz
-    ''}
-    ${pkgs.xorg.mkfontscale}/bin/mkfontscale
-    ${pkgs.xorg.mkfontdir}/bin/mkfontdir
-    cat $(find ${pkgs.xorg.fontalias}/ -name fonts.alias) >fonts.alias
-  '';
+  x11Fonts = pkgs.callPackage (
+    {
+      runCommand,
+      gzip,
+      xorg,
+    }:
+    runCommand "X11-fonts"
+      {
+        preferLocalBuild = true;
+        nativeBuildInputs = [
+          gzip
+          xorg.mkfontscale
+          xorg.mkfontdir
+        ];
+      }
+      ''
+        mkdir -p "$out/share/X11/fonts"
+        font_regexp='.*\.\(ttf\|ttc\|otb\|otf\|pcf\|pfa\|pfb\|bdf\)\(\.gz\)?'
+        find ${toString config.fonts.packages} -regex "$font_regexp" \
+          -exec ln -sf -t "$out/share/X11/fonts" '{}' \;
+        cd "$out/share/X11/fonts"
+        ${lib.optionalString cfg.decompressFonts ''
+          gunzip -f *.gz
+        ''}
+        mkfontscale
+        mkfontdir
+        cat $(find ${pkgs.xorg.fontalias}/ -name fonts.alias) >fonts.alias
+      ''
+  ) { };
 
 in
 

nixos/modules/services/databases/foundationdb.md

@@ -18,7 +18,7 @@ To enable FoundationDB, add the following to your
 ```nix
 {
   services.foundationdb.enable = true;
-  services.foundationdb.package = pkgs.foundationdb71; # FoundationDB 7.1.x
+  services.foundationdb.package = pkgs.foundationdb73; # FoundationDB 7.r3.x
 }
 ```
 
@@ -68,7 +68,7 @@ necessary Python modules).
 ```ShellSession
 a@link> cat fdb-status.py
 #! /usr/bin/env nix-shell
-#! nix-shell -i python -p python pythonPackages.foundationdb71
+#! nix-shell -i python -p python pythonPackages.foundationdb73
 
 import fdb
 import json

nixos/modules/services/misc/dwm-status.nix

@@ -49,7 +49,7 @@ in
 
   config = lib.mkIf cfg.enable {
 
-    services.upower.enable = lib.elem "battery" cfg.order;
+    services.upower.enable = lib.mkIf (lib.elem "battery" cfg.order) true;
 
     systemd.user.services.dwm-status = {
       description = "Highly performant and configurable DWM status service";

nixos/modules/services/misc/tandoor-recipes.nix

@@ -31,7 +31,7 @@ let
   '';
 in
 {
-  meta.maintainers = with lib.maintainers; [ ];
+  meta.maintainers = with lib.maintainers; [ jvanbruegge ];
 
   options.services.tandoor-recipes = {
     enable = lib.mkOption {

nixos/modules/services/misc/taskserver/default.nix

@@ -498,16 +498,16 @@ in
         ca.cert = if needToCreateCA then "${cfg.dataDir}/keys/ca.cert" else "${cfg.pki.manual.ca.cert}";
       };
 
+      systemd.tmpfiles.rules = [
+        "d ${cfg.dataDir} 0770 ${cfg.user} ${cfg.group}"
+        "z ${cfg.dataDir} 0770 ${cfg.user} ${cfg.group}"
+      ];
+
       systemd.services.taskserver-init = {
         wantedBy = [ "taskserver.service" ];
         before = [ "taskserver.service" ];
         description = "Initialize Taskserver Data Directory";
 
-        preStart = ''
-          mkdir -m 0770 -p "${cfg.dataDir}"
-          chown "${cfg.user}:${cfg.group}" "${cfg.dataDir}"
-        '';
-
         script = ''
           ${taskd} init
           touch "${cfg.dataDir}/.is_initialized"

nixos/modules/services/networking/biboumi.nix

@@ -22,9 +22,12 @@ in
     services.biboumi = {
       enable = lib.mkEnableOption "the Biboumi XMPP gateway to IRC";
 
+      package = lib.mkPackageOption pkgs "biboumi" { };
+
       settings = lib.mkOption {
         description = ''
-          See [biboumi 8.5](https://lab.louiz.org/louiz/biboumi/blob/8.5/doc/biboumi.1.rst)
+          See [biboumi 9.0](https://doc.biboumi.louiz.org/9.0/admin.html#configuration)
+
           for documentation.
         '';
         default = { };
@@ -61,10 +64,13 @@ in
             '';
           };
           options.db_name = lib.mkOption {
-            type = with lib.types; either path str;
+            type = with lib.types; nullOr (either path str);
             default = "${stateDir}/biboumi.sqlite";
             description = ''
               The name of the database to use.
+
+              Set it to null and use [credentialsFile](#opt-services.biboumi.credentialsFile)
+              if you do not want this connection string to go into the Nix store.
             '';
             example = "postgresql://user:secret@localhost";
           };
@@ -118,7 +124,7 @@ in
           };
           options.policy_directory = lib.mkOption {
             type = lib.types.path;
-            default = "${pkgs.biboumi}/etc/biboumi";
+            default = "${cfg.package}/etc/biboumi";
             defaultText = lib.literalExpression ''"''${pkgs.biboumi}/etc/biboumi"'';
             description = ''
               A directory that should contain the policy files,
@@ -208,7 +214,7 @@ in
             ''
           )
         ];
-        ExecStart = "${pkgs.biboumi}/bin/biboumi /run/biboumi/biboumi.cfg";
+        ExecStart = "${lib.getExe cfg.package} /run/biboumi/biboumi.cfg";
         ExecReload = "${pkgs.coreutils}/bin/kill -USR1 $MAINPID";
         # Firewalls needing opening for output connections can still do that
         # selectively for biboumi with:

nixos/modules/services/networking/keepalived/default.nix

@@ -153,6 +153,8 @@ in
         '';
       };
 
+      package = lib.mkPackageOption pkgs "keepalived" { };
+
       openFirewall = mkOption {
         type = types.bool;
         default = false;
@@ -334,7 +336,7 @@ in
           umask 077
           ${pkgs.envsubst}/bin/envsubst -i "${keepalivedConf}" > ${finalConfigFile}
         '');
-        ExecStart = "${pkgs.keepalived}/sbin/keepalived"
+        ExecStart = "${lib.getExe cfg.package}"
           + " -f ${finalConfigFile}"
           + " -p ${pidFile}"
           + optionalString cfg.snmp.enable " --snmp";

nixos/modules/services/search/manticore.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
 
   cfg = config.services.manticore;
@@ -14,7 +11,7 @@ let
 
   toSphinx =
     {
-      mkKeyValue ? generators.mkKeyValueDefault { } "=",
+      mkKeyValue ? lib.generators.mkKeyValueDefault { } "=",
       listsAsDuplicateKeys ? true,
     }:
     attrsOfAttrs:
@@ -22,7 +19,7 @@ let
       # map function to string for each key val
       mapAttrsToStringsSep =
         sep: mapFn: attrs:
-        concatStringsSep sep (mapAttrsToList mapFn attrs);
+        lib.concatStringsSep sep (lib.mapAttrsToList mapFn attrs);
       mkSection =
         sectName: sectValues:
         ''
@@ -46,9 +43,9 @@ in
   options = {
     services.manticore = {
 
-      enable = mkEnableOption "Manticoresearch";
+      enable = lib.mkEnableOption "Manticoresearch";
 
-      settings = mkOption {
+      settings = lib.mkOption {
         default = {
           searchd = {
             listen = [
@@ -67,10 +64,10 @@ in
           <https://manual.manticoresearch.com/Server%20settings>
           for more information.
         '';
-        type = types.submodule {
+        type = lib.types.submodule {
           freeformType = format.type;
         };
-        example = literalExpression ''
+        example = lib.literalExpression ''
           {
             searchd = {
                 listen = [
@@ -90,7 +87,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     systemd = {
       packages = [ pkgs.manticoresearch ];

nixos/modules/services/search/meilisearch.nix

@@ -4,16 +4,13 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.meilisearch;
 
 in
 {
 
-  meta.maintainers = with maintainers; [
+  meta.maintainers = with lib.maintainers; [
     Br1ght0ne
     happysalada
   ];
@@ -22,37 +19,37 @@ in
   ###### interface
 
   options.services.meilisearch = {
-    enable = mkEnableOption "MeiliSearch - a RESTful search API";
+    enable = lib.mkEnableOption "MeiliSearch - a RESTful search API";
 
-    package = mkPackageOption pkgs "meilisearch" {
+    package = lib.mkPackageOption pkgs "meilisearch" {
       extraDescription = ''
         Use this if you require specific features to be enabled. The default package has no features.
       '';
     };
 
-    listenAddress = mkOption {
+    listenAddress = lib.mkOption {
       description = "MeiliSearch listen address.";
       default = "127.0.0.1";
-      type = types.str;
+      type = lib.types.str;
     };
 
-    listenPort = mkOption {
+    listenPort = lib.mkOption {
       description = "MeiliSearch port to listen on.";
       default = 7700;
-      type = types.port;
+      type = lib.types.port;
     };
 
-    environment = mkOption {
+    environment = lib.mkOption {
       description = "Defines the running environment of MeiliSearch.";
       default = "development";
-      type = types.enum [
+      type = lib.types.enum [
         "development"
         "production"
       ];
     };
 
     # TODO change this to LoadCredentials once possible
-    masterKeyEnvironmentFile = mkOption {
+    masterKeyEnvironmentFile = lib.mkOption {
       description = ''
         Path to file which contains the master key.
         By doing so, all routes will be protected and will require a key to be accessed.
@@ -61,10 +58,10 @@ in
         MEILI_MASTER_KEY=my_secret_key
       '';
       default = null;
-      type = with types; nullOr path;
+      type = with lib.types; nullOr path;
     };
 
-    noAnalytics = mkOption {
+    noAnalytics = lib.mkOption {
       description = ''
         Deactivates analytics.
         Analytics allow MeiliSearch to know how many users are using MeiliSearch,
@@ -72,10 +69,10 @@ in
         This process is entirely anonymous.
       '';
       default = true;
-      type = types.bool;
+      type = lib.types.bool;
     };
 
-    logLevel = mkOption {
+    logLevel = lib.mkOption {
       description = ''
         Defines how much detail should be present in MeiliSearch's logs.
         MeiliSearch currently supports four log levels, listed in order of increasing verbosity:
@@ -86,10 +83,10 @@ in
           Useful when diagnosing issues and debugging
       '';
       default = "INFO";
-      type = types.str;
+      type = lib.types.str;
     };
 
-    maxIndexSize = mkOption {
+    maxIndexSize = lib.mkOption {
       description = ''
         Sets the maximum size of the index.
         Value must be given in bytes or explicitly stating a base unit.
@@ -97,10 +94,10 @@ in
         Default is 100 GiB
       '';
       default = "107374182400";
-      type = types.str;
+      type = lib.types.str;
     };
 
-    payloadSizeLimit = mkOption {
+    payloadSizeLimit = lib.mkOption {
       description = ''
         Sets the maximum size of accepted JSON payloads.
         Value must be given in bytes or explicitly stating a base unit.
@@ -108,14 +105,14 @@ in
         Default is ~ 100 MB
       '';
       default = "104857600";
-      type = types.str;
+      type = lib.types.str;
     };
 
   };
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     # used to restore dumps
     environment.systemPackages = [ cfg.package ];
@@ -127,7 +124,7 @@ in
       environment = {
         MEILI_DB_PATH = "/var/lib/meilisearch";
         MEILI_HTTP_ADDR = "${cfg.listenAddress}:${toString cfg.listenPort}";
-        MEILI_NO_ANALYTICS = boolToString cfg.noAnalytics;
+        MEILI_NO_ANALYTICS = lib.boolToString cfg.noAnalytics;
         MEILI_ENV = cfg.environment;
         MEILI_DUMP_DIR = "/var/lib/meilisearch/dumps";
         MEILI_LOG_LEVEL = cfg.logLevel;
@@ -137,7 +134,7 @@ in
         ExecStart = "${cfg.package}/bin/meilisearch";
         DynamicUser = true;
         StateDirectory = "meilisearch";
-        EnvironmentFile = mkIf (cfg.masterKeyEnvironmentFile != null) cfg.masterKeyEnvironmentFile;
+        EnvironmentFile = lib.mkIf (cfg.masterKeyEnvironmentFile != null) cfg.masterKeyEnvironmentFile;
       };
     };
   };

nixos/modules/services/search/opensearch.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.opensearch;
 
@@ -28,7 +25,7 @@ in
 {
 
   options.services.opensearch = {
-    enable = mkEnableOption "OpenSearch";
+    enable = lib.mkEnableOption "OpenSearch";
 
     package = lib.mkPackageOption pkgs "OpenSearch" {
       default = [ "opensearch" ];
@@ -113,13 +110,13 @@ in
         rootLogger.level = info
         rootLogger.appenderRef.console.ref = console
       '';
-      type = types.str;
+      type = lib.types.str;
     };
 
     dataDir = lib.mkOption {
       type = lib.types.path;
       default = "/var/lib/opensearch";
-      apply = converge (removeSuffix "/");
+      apply = lib.converge (lib.removeSuffix "/");
       description = ''
         Data directory for OpenSearch. If you change this, you need to
         manually create the directory. You also need to create the
@@ -173,7 +170,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.opensearch = {
       description = "OpenSearch Daemon";
       wantedBy = [ "multi-user.target" ];
@@ -194,7 +191,7 @@ in
                   set -o errexit -o pipefail -o nounset -o errtrace
                   shopt -s inherit_errexit
                 ''
-                + (optionalString (!config.boot.isContainer) ''
+                + (lib.optionalString (!config.boot.isContainer) ''
                   # Only set vm.max_map_count if lower than ES required minimum
                   # This avoids conflict if configured via boot.kernel.sysctl
                   if [ $(${pkgs.procps}/bin/sysctl -n vm.max_map_count) -lt 262144 ]; then
@@ -268,7 +265,7 @@ in
           TimeoutStartSec = "infinity";
           DynamicUser = usingDefaultUserAndGroup && usingDefaultDataDir;
         }
-        // (optionalAttrs (usingDefaultDataDir) {
+        // (lib.optionalAttrs (usingDefaultDataDir) {
           StateDirectory = "opensearch";
           StateDirectoryMode = "0700";
         });

nixos/modules/services/search/qdrant.nix

@@ -4,8 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
 let
 
   cfg = config.services.qdrant;
@@ -17,9 +15,9 @@ in
 
   options = {
     services.qdrant = {
-      enable = mkEnableOption "Vector Search Engine for the next generation of AI applications";
+      enable = lib.mkEnableOption "Vector Search Engine for the next generation of AI applications";
 
-      settings = mkOption {
+      settings = lib.mkOption {
         description = ''
           Configuration for Qdrant
           Refer to <https://github.com/qdrant/qdrant/blob/master/config/config.yaml> for details on supported values.
@@ -43,7 +41,7 @@ in
           telemetry_disabled = true;
         };
 
-        defaultText = literalExpression ''
+        defaultText = lib.literalExpression ''
           {
             storage = {
               storage_path = "/var/lib/qdrant/storage";
@@ -64,41 +62,41 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     services.qdrant.settings = {
-      service.static_content_dir = mkDefault pkgs.qdrant-web-ui;
-      storage.storage_path = mkDefault "/var/lib/qdrant/storage";
-      storage.snapshots_path = mkDefault "/var/lib/qdrant/snapshots";
+      service.static_content_dir = lib.mkDefault pkgs.qdrant-web-ui;
+      storage.storage_path = lib.mkDefault "/var/lib/qdrant/storage";
+      storage.snapshots_path = lib.mkDefault "/var/lib/qdrant/snapshots";
       # The following default values are the same as in the default config,
       # they are just written here for convenience.
-      storage.on_disk_payload = mkDefault true;
-      storage.wal.wal_capacity_mb = mkDefault 32;
-      storage.wal.wal_segments_ahead = mkDefault 0;
-      storage.performance.max_search_threads = mkDefault 0;
-      storage.performance.max_optimization_threads = mkDefault 1;
-      storage.optimizers.deleted_threshold = mkDefault 0.2;
-      storage.optimizers.vacuum_min_vector_number = mkDefault 1000;
-      storage.optimizers.default_segment_number = mkDefault 0;
-      storage.optimizers.max_segment_size_kb = mkDefault null;
-      storage.optimizers.memmap_threshold_kb = mkDefault null;
-      storage.optimizers.indexing_threshold_kb = mkDefault 20000;
-      storage.optimizers.flush_interval_sec = mkDefault 5;
-      storage.optimizers.max_optimization_threads = mkDefault 1;
-      storage.hnsw_index.m = mkDefault 16;
-      storage.hnsw_index.ef_construct = mkDefault 100;
-      storage.hnsw_index.full_scan_threshold_kb = mkDefault 10000;
-      storage.hnsw_index.max_indexing_threads = mkDefault 0;
-      storage.hnsw_index.on_disk = mkDefault false;
-      storage.hnsw_index.payload_m = mkDefault null;
-      service.max_request_size_mb = mkDefault 32;
-      service.max_workers = mkDefault 0;
-      service.http_port = mkDefault 6333;
-      service.grpc_port = mkDefault 6334;
-      service.enable_cors = mkDefault true;
-      cluster.enabled = mkDefault false;
+      storage.on_disk_payload = lib.mkDefault true;
+      storage.wal.wal_capacity_mb = lib.mkDefault 32;
+      storage.wal.wal_segments_ahead = lib.mkDefault 0;
+      storage.performance.max_search_threads = lib.mkDefault 0;
+      storage.performance.max_optimization_threads = lib.mkDefault 1;
+      storage.optimizers.deleted_threshold = lib.mkDefault 0.2;
+      storage.optimizers.vacuum_min_vector_number = lib.mkDefault 1000;
+      storage.optimizers.default_segment_number = lib.mkDefault 0;
+      storage.optimizers.max_segment_size_kb = lib.mkDefault null;
+      storage.optimizers.memmap_threshold_kb = lib.mkDefault null;
+      storage.optimizers.indexing_threshold_kb = lib.mkDefault 20000;
+      storage.optimizers.flush_interval_sec = lib.mkDefault 5;
+      storage.optimizers.max_optimization_threads = lib.mkDefault 1;
+      storage.hnsw_index.m = lib.mkDefault 16;
+      storage.hnsw_index.ef_construct = lib.mkDefault 100;
+      storage.hnsw_index.full_scan_threshold_kb = lib.mkDefault 10000;
+      storage.hnsw_index.max_indexing_threads = lib.mkDefault 0;
+      storage.hnsw_index.on_disk = lib.mkDefault false;
+      storage.hnsw_index.payload_m = lib.mkDefault null;
+      service.max_request_size_mb = lib.mkDefault 32;
+      service.max_workers = lib.mkDefault 0;
+      service.http_port = lib.mkDefault 6333;
+      service.grpc_port = lib.mkDefault 6334;
+      service.enable_cors = lib.mkDefault true;
+      cluster.enabled = lib.mkDefault false;
       # the following have been altered for security
-      service.host = mkDefault "127.0.0.1";
-      telemetry_disabled = mkDefault true;
+      service.host = lib.mkDefault "127.0.0.1";
+      telemetry_disabled = lib.mkDefault true;
     };
 
     systemd.services.qdrant = {

nixos/modules/services/search/quickwit.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.quickwit;
 
@@ -19,7 +16,7 @@ in
 {
 
   options.services.quickwit = {
-    enable = mkEnableOption "Quickwit";
+    enable = lib.mkEnableOption "Quickwit";
 
     package = lib.mkPackageOption pkgs "Quickwit" {
       default = [ "quickwit" ];
@@ -83,7 +80,7 @@ in
     dataDir = lib.mkOption {
       type = lib.types.path;
       default = "/var/lib/quickwit";
-      apply = converge (removeSuffix "/");
+      apply = lib.converge (lib.removeSuffix "/");
       description = ''
         Data directory for Quickwit. If you change this, you need to
         manually create the directory. You also need to create the
@@ -130,7 +127,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.quickwit = {
       description = "Quickwit";
       wantedBy = [ "multi-user.target" ];
@@ -143,7 +140,7 @@ in
         {
           ExecStart = ''
             ${cfg.package}/bin/quickwit run --config ${quickwitYml} \
-            ${escapeShellArgs cfg.extraFlags}
+            ${lib.escapeShellArgs cfg.extraFlags}
           '';
           User = cfg.user;
           Group = cfg.group;
@@ -186,7 +183,7 @@ in
             "@chown"
           ];
         }
-        // (optionalAttrs (usingDefaultDataDir) {
+        // (lib.optionalAttrs (usingDefaultDataDir) {
           StateDirectory = "quickwit";
           StateDirectoryMode = "0700";
         });

nixos/modules/services/security/certmgr.nix

@@ -4,15 +4,12 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.certmgr;
 
-  specs = mapAttrsToList (n: v: rec {
+  specs = lib.mapAttrsToList (n: v: rec {
     name = n + ".json";
-    path = if isAttrs v then pkgs.writeText name (builtins.toJSON v) else v;
+    path = if lib.isAttrs v then pkgs.writeText name (builtins.toJSON v) else v;
   }) cfg.specs;
 
   allSpecs = pkgs.linkFarm "certmgr.d" specs;
@@ -29,59 +26,59 @@ let
   );
 
   specPaths = map dirOf (
-    concatMap (
+    lib.concatMap (
       spec:
-      if isAttrs spec then
-        collect isString (filterAttrsRecursive (n: v: isAttrs v || n == "path") spec)
+      if lib.isAttrs spec then
+        lib.collect lib.isString (lib.filterAttrsRecursive (n: v: lib.isAttrs v || n == "path") spec)
       else
         [ spec ]
-    ) (attrValues cfg.specs)
+    ) (lib.attrValues cfg.specs)
   );
 
   preStart = ''
-    ${concatStringsSep " \\\n" ([ "mkdir -p" ] ++ map escapeShellArg specPaths)}
+    ${lib.concatStringsSep " \\\n" ([ "mkdir -p" ] ++ map lib.escapeShellArg specPaths)}
     ${cfg.package}/bin/certmgr -f ${certmgrYaml} check
   '';
 in
 {
   options.services.certmgr = {
-    enable = mkEnableOption "certmgr";
+    enable = lib.mkEnableOption "certmgr";
 
-    package = mkPackageOption pkgs "certmgr" { };
+    package = lib.mkPackageOption pkgs "certmgr" { };
 
-    defaultRemote = mkOption {
-      type = types.str;
+    defaultRemote = lib.mkOption {
+      type = lib.types.str;
       default = "127.0.0.1:8888";
       description = "The default CA host:port to use.";
     };
 
-    validMin = mkOption {
+    validMin = lib.mkOption {
       default = "72h";
-      type = types.str;
+      type = lib.types.str;
       description = "The interval before a certificate expires to start attempting to renew it.";
     };
 
-    renewInterval = mkOption {
+    renewInterval = lib.mkOption {
       default = "30m";
-      type = types.str;
+      type = lib.types.str;
       description = "How often to check certificate expirations and how often to update the cert_next_expires metric.";
     };
 
-    metricsAddress = mkOption {
+    metricsAddress = lib.mkOption {
       default = "127.0.0.1";
-      type = types.str;
+      type = lib.types.str;
       description = "The address for the Prometheus HTTP endpoint.";
     };
 
-    metricsPort = mkOption {
+    metricsPort = lib.mkOption {
       default = 9488;
-      type = types.ints.u16;
+      type = lib.types.ints.u16;
       description = "The port for the Prometheus HTTP endpoint.";
     };
 
-    specs = mkOption {
+    specs = lib.mkOption {
       default = { };
-      example = literalExpression ''
+      example = lib.literalExpression ''
         {
           exampleCert =
           let
@@ -119,17 +116,17 @@ in
         }
       '';
       type =
-        with types;
+        with lib.types;
         attrsOf (
           either path (submodule {
             options = {
-              service = mkOption {
+              service = lib.mkOption {
                 type = nullOr str;
                 default = null;
                 description = "The service on which to perform \<action\> after fetching.";
               };
 
-              action = mkOption {
+              action = lib.mkOption {
                 type = addCheck str (
                   x:
                   cfg.svcManager == "command"
@@ -144,22 +141,22 @@ in
               };
 
               # These ought all to be specified according to certmgr spec def.
-              authority = mkOption {
+              authority = lib.mkOption {
                 type = attrs;
                 description = "certmgr spec authority object.";
               };
 
-              certificate = mkOption {
+              certificate = lib.mkOption {
                 type = nullOr attrs;
                 description = "certmgr spec certificate object.";
               };
 
-              private_key = mkOption {
+              private_key = lib.mkOption {
                 type = nullOr attrs;
                 description = "certmgr spec private_key object.";
               };
 
-              request = mkOption {
+              request = lib.mkOption {
                 type = nullOr attrs;
                 description = "certmgr spec request object.";
               };
@@ -173,9 +170,9 @@ in
       '';
     };
 
-    svcManager = mkOption {
+    svcManager = lib.mkOption {
       default = "systemd";
-      type = types.enum [
+      type = lib.types.enum [
         "circus"
         "command"
         "dummy"
@@ -193,7 +190,7 @@ in
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     assertions = [
       {
         assertion = cfg.specs != { };
@@ -201,10 +198,10 @@ in
       }
       {
         assertion =
-          !any (hasAttrByPath [
+          !lib.any (lib.hasAttrByPath [
             "authority"
             "auth_key"
-          ]) (attrValues cfg.specs);
+          ]) (lib.attrValues cfg.specs);
         message = ''
           Inline services.certmgr.specs are added to the Nix store rendering them world readable.
           Specify paths as specs, if you want to use include auth_key - or use the auth_key_file option."
@@ -214,7 +211,7 @@ in
 
     systemd.services.certmgr = {
       description = "certmgr";
-      path = mkIf (cfg.svcManager == "command") [ pkgs.bash ];
+      path = lib.mkIf (cfg.svcManager == "command") [ pkgs.bash ];
       wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];

nixos/modules/services/security/cfssl.nix

@@ -5,19 +5,16 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.cfssl;
 in
 {
   options.services.cfssl = {
-    enable = mkEnableOption "the CFSSL CA api-server";
+    enable = lib.mkEnableOption "the CFSSL CA api-server";
 
-    dataDir = mkOption {
+    dataDir = lib.mkOption {
       default = "/var/lib/cfssl";
-      type = types.path;
+      type = lib.types.path;
       description = ''
         The work directory for CFSSL.
 
@@ -30,51 +27,51 @@ in
       '';
     };
 
-    address = mkOption {
+    address = lib.mkOption {
       default = "127.0.0.1";
-      type = types.str;
+      type = lib.types.str;
       description = "Address to bind.";
     };
 
-    port = mkOption {
+    port = lib.mkOption {
       default = 8888;
-      type = types.port;
+      type = lib.types.port;
       description = "Port to bind.";
     };
 
-    ca = mkOption {
-      defaultText = literalExpression ''"''${cfg.dataDir}/ca.pem"'';
-      type = types.str;
+    ca = lib.mkOption {
+      defaultText = lib.literalExpression ''"''${cfg.dataDir}/ca.pem"'';
+      type = lib.types.str;
       description = "CA used to sign the new certificate -- accepts '[file:]fname' or 'env:varname'.";
     };
 
-    caKey = mkOption {
-      defaultText = literalExpression ''"file:''${cfg.dataDir}/ca-key.pem"'';
-      type = types.str;
+    caKey = lib.mkOption {
+      defaultText = lib.literalExpression ''"file:''${cfg.dataDir}/ca-key.pem"'';
+      type = lib.types.str;
       description = "CA private key -- accepts '[file:]fname' or 'env:varname'.";
     };
 
-    caBundle = mkOption {
+    caBundle = lib.mkOption {
       default = null;
-      type = types.nullOr types.path;
+      type = lib.types.nullOr lib.types.path;
       description = "Path to root certificate store.";
     };
 
-    intBundle = mkOption {
+    intBundle = lib.mkOption {
       default = null;
-      type = types.nullOr types.path;
+      type = lib.types.nullOr lib.types.path;
       description = "Path to intermediate certificate store.";
     };
 
-    intDir = mkOption {
+    intDir = lib.mkOption {
       default = null;
-      type = types.nullOr types.path;
+      type = lib.types.nullOr lib.types.path;
       description = "Intermediates directory.";
     };
 
-    metadata = mkOption {
+    metadata = lib.mkOption {
       default = null;
-      type = types.nullOr types.path;
+      type = lib.types.nullOr lib.types.path;
       description = ''
         Metadata file for root certificate presence.
         The content of the file is a json dictionary (k,v): each key k is
@@ -83,81 +80,81 @@ in
       '';
     };
 
-    remote = mkOption {
+    remote = lib.mkOption {
       default = null;
-      type = types.nullOr types.str;
+      type = lib.types.nullOr lib.types.str;
       description = "Remote CFSSL server.";
     };
 
-    configFile = mkOption {
+    configFile = lib.mkOption {
       default = null;
-      type = types.nullOr types.str;
+      type = lib.types.nullOr lib.types.str;
       description = "Path to configuration file. Do not put this in nix-store as it might contain secrets.";
     };
 
-    responder = mkOption {
+    responder = lib.mkOption {
       default = null;
-      type = types.nullOr types.path;
+      type = lib.types.nullOr lib.types.path;
       description = "Certificate for OCSP responder.";
     };
 
-    responderKey = mkOption {
+    responderKey = lib.mkOption {
       default = null;
-      type = types.nullOr types.str;
+      type = lib.types.nullOr lib.types.str;
       description = "Private key for OCSP responder certificate. Do not put this in nix-store.";
     };
 
-    tlsKey = mkOption {
+    tlsKey = lib.mkOption {
       default = null;
-      type = types.nullOr types.str;
+      type = lib.types.nullOr lib.types.str;
       description = "Other endpoint's CA private key. Do not put this in nix-store.";
     };
 
-    tlsCert = mkOption {
+    tlsCert = lib.mkOption {
       default = null;
-      type = types.nullOr types.path;
+      type = lib.types.nullOr lib.types.path;
       description = "Other endpoint's CA to set up TLS protocol.";
     };
 
-    mutualTlsCa = mkOption {
+    mutualTlsCa = lib.mkOption {
       default = null;
-      type = types.nullOr types.path;
+      type = lib.types.nullOr lib.types.path;
       description = "Mutual TLS - require clients be signed by this CA.";
     };
 
-    mutualTlsCn = mkOption {
+    mutualTlsCn = lib.mkOption {
       default = null;
-      type = types.nullOr types.str;
+      type = lib.types.nullOr lib.types.str;
       description = "Mutual TLS - regex for whitelist of allowed client CNs.";
     };
 
-    tlsRemoteCa = mkOption {
+    tlsRemoteCa = lib.mkOption {
       default = null;
-      type = types.nullOr types.path;
+      type = lib.types.nullOr lib.types.path;
       description = "CAs to trust for remote TLS requests.";
     };
 
-    mutualTlsClientCert = mkOption {
+    mutualTlsClientCert = lib.mkOption {
       default = null;
-      type = types.nullOr types.path;
+      type = lib.types.nullOr lib.types.path;
       description = "Mutual TLS - client certificate to call remote instance requiring client certs.";
     };
 
-    mutualTlsClientKey = mkOption {
+    mutualTlsClientKey = lib.mkOption {
       default = null;
-      type = types.nullOr types.path;
+      type = lib.types.nullOr lib.types.path;
       description = "Mutual TLS - client key to call remote instance requiring client certs. Do not put this in nix-store.";
     };
 
-    dbConfig = mkOption {
+    dbConfig = lib.mkOption {
       default = null;
-      type = types.nullOr types.path;
+      type = lib.types.nullOr lib.types.path;
       description = "Certificate db configuration file. Path must be writeable.";
     };
 
-    logLevel = mkOption {
+    logLevel = lib.mkOption {
       default = 1;
-      type = types.enum [
+      type = lib.types.enum [
         0
         1
         2
@@ -169,7 +166,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     users.groups.cfssl = {
       gid = config.ids.gids.cfssl;
     };
@@ -223,7 +220,7 @@ in
               (opt "loglevel" (toString logLevel))
             ];
         }
-        (mkIf (cfg.dataDir == options.services.cfssl.dataDir.default) {
+        (lib.mkIf (cfg.dataDir == options.services.cfssl.dataDir.default) {
           StateDirectory = baseNameOf cfg.dataDir;
           StateDirectoryMode = 700;
         })
@@ -231,8 +228,8 @@ in
     };
 
     services.cfssl = {
-      ca = mkDefault "${cfg.dataDir}/ca.pem";
-      caKey = mkDefault "${cfg.dataDir}/ca-key.pem";
+      ca = lib.mkDefault "${cfg.dataDir}/ca.pem";
+      caKey = lib.mkDefault "${cfg.dataDir}/ca-key.pem";
     };
   };
 }

nixos/modules/services/security/clamav.nix

@@ -1,13 +1,12 @@
 { config, lib, pkgs, ... }:
-with lib;
 let
   clamavUser = "clamav";
   stateDir = "/var/lib/clamav";
   clamavGroup = clamavUser;
   cfg = config.services.clamav;
 
-  toKeyValue = generators.toKeyValue {
-    mkKeyValue = generators.mkKeyValueDefault { } " ";
+  toKeyValue = lib.generators.toKeyValue {
+    mkKeyValue = lib.generators.mkKeyValueDefault { } " ";
     listsAsDuplicateKeys = true;
   };
 
@@ -19,19 +18,19 @@ let
 in
 {
   imports = [
-    (mkRemovedOptionModule [ "services" "clamav" "updater" "config" ] "Use services.clamav.updater.settings instead.")
-    (mkRemovedOptionModule [ "services" "clamav" "updater" "extraConfig" ] "Use services.clamav.updater.settings instead.")
-    (mkRemovedOptionModule [ "services" "clamav" "daemon" "extraConfig" ] "Use services.clamav.daemon.settings instead.")
+    (lib.mkRemovedOptionModule [ "services" "clamav" "updater" "config" ] "Use services.clamav.updater.settings instead.")
+    (lib.mkRemovedOptionModule [ "services" "clamav" "updater" "extraConfig" ] "Use services.clamav.updater.settings instead.")
+    (lib.mkRemovedOptionModule [ "services" "clamav" "daemon" "extraConfig" ] "Use services.clamav.daemon.settings instead.")
   ];
 
   options = {
     services.clamav = {
-      package = mkPackageOption pkgs "clamav" { };
+      package = lib.mkPackageOption pkgs "clamav" { };
       daemon = {
-        enable = mkEnableOption "ClamAV clamd daemon";
+        enable = lib.mkEnableOption "ClamAV clamd daemon";
 
-        settings = mkOption {
-          type = with types; attrsOf (oneOf [ bool int str (listOf str) ]);
+        settings = lib.mkOption {
+          type = with lib.types; attrsOf (oneOf [ bool int str (listOf str) ]);
           default = { };
           description = ''
             ClamAV configuration. Refer to <https://linux.die.net/man/5/clamd.conf>,
@@ -40,18 +39,18 @@ in
         };
       };
       updater = {
-        enable = mkEnableOption "ClamAV freshclam updater";
+        enable = lib.mkEnableOption "ClamAV freshclam updater";
 
-        frequency = mkOption {
-          type = types.int;
+        frequency = lib.mkOption {
+          type = lib.types.int;
           default = 12;
           description = ''
             Number of database checks per day.
           '';
         };
 
-        interval = mkOption {
-          type = types.str;
+        interval = lib.mkOption {
+          type = lib.types.str;
           default = "hourly";
           description = ''
             How often freshclam is invoked. See systemd.time(7) for more
@@ -59,8 +58,8 @@ in
           '';
         };
 
-        settings = mkOption {
-          type = with types; attrsOf (oneOf [ bool int str (listOf str) ]);
+        settings = lib.mkOption {
+          type = with lib.types; attrsOf (oneOf [ bool int str (listOf str) ]);
           default = { };
           description = ''
             freshclam configuration. Refer to <https://linux.die.net/man/5/freshclam.conf>,
@@ -69,10 +68,10 @@ in
         };
       };
       fangfrisch = {
-        enable = mkEnableOption "ClamAV fangfrisch updater";
+        enable = lib.mkEnableOption "ClamAV fangfrisch updater";
 
-        interval = mkOption {
-          type = types.str;
+        interval = lib.mkOption {
+          type = lib.types.str;
           default = "hourly";
           description = ''
             How often freshclam is invoked. See systemd.time(7) for more
@@ -80,9 +79,9 @@ in
           '';
         };
 
-        settings = mkOption {
+        settings = lib.mkOption {
           type = lib.types.submodule {
-            freeformType = with types; attrsOf (attrsOf (oneOf [ str int bool ]));
+            freeformType = with lib.types; attrsOf (attrsOf (oneOf [ str int bool ]));
           };
           default = { };
           example = {
@@ -100,10 +99,10 @@ in
       };
 
       scanner = {
-        enable = mkEnableOption "ClamAV scanner";
+        enable = lib.mkEnableOption "ClamAV scanner";
 
-        interval = mkOption {
-          type = types.str;
+        interval = lib.mkOption {
+          type = lib.types.str;
           default = "*-*-* 04:00:00";
           description = ''
             How often clamdscan is invoked. See systemd.time(7) for more
@@ -112,8 +111,8 @@ in
           '';
         };
 
-        scanDirectories = mkOption {
-          type = with types; listOf str;
+        scanDirectories = lib.mkOption {
+          type = with lib.types; listOf str;
           default = [ "/home" "/var/lib" "/tmp" "/etc" "/var/tmp" ];
           description = ''
             List of directories to scan.
@@ -124,7 +123,7 @@ in
     };
   };
 
-  config = mkIf (cfg.updater.enable || cfg.daemon.enable) {
+  config = lib.mkIf (cfg.updater.enable || cfg.daemon.enable) {
     environment.systemPackages = [ cfg.package ];
 
     users.users.${clamavUser} = {
@@ -153,12 +152,12 @@ in
     };
 
     services.clamav.fangfrisch.settings = {
-      DEFAULT.db_url = mkDefault "sqlite:////var/lib/clamav/fangfrisch_db.sqlite";
-      DEFAULT.local_directory = mkDefault stateDir;
-      DEFAULT.log_level = mkDefault "INFO";
-      urlhaus.enabled = mkDefault "yes";
-      urlhaus.max_size = mkDefault "2MB";
-      sanesecurity.enabled = mkDefault "yes";
+      DEFAULT.db_url = lib.mkDefault "sqlite:////var/lib/clamav/fangfrisch_db.sqlite";
+      DEFAULT.local_directory = lib.mkDefault stateDir;
+      DEFAULT.log_level = lib.mkDefault "INFO";
+      urlhaus.enabled = lib.mkDefault "yes";
+      urlhaus.max_size = lib.mkDefault "2MB";
+      sanesecurity.enabled = lib.mkDefault "yes";
     };
 
     environment.etc."clamav/freshclam.conf".source = freshclamConfigFile;
@@ -168,10 +167,10 @@ in
       description = "ClamAV Antivirus Slice";
     };
 
-    systemd.services.clamav-daemon = mkIf cfg.daemon.enable {
+    systemd.services.clamav-daemon = lib.mkIf cfg.daemon.enable {
       description = "ClamAV daemon (clamd)";
-      after = optionals cfg.updater.enable [ "clamav-freshclam.service" ];
-      wants = optionals cfg.updater.enable [ "clamav-freshclam.service" ];
+      after = lib.optionals cfg.updater.enable [ "clamav-freshclam.service" ];
+      wants = lib.optionals cfg.updater.enable [ "clamav-freshclam.service" ];
       wantedBy = [ "multi-user.target" ];
       restartTriggers = [ clamdConfigFile ];
 
@@ -189,7 +188,7 @@ in
       };
     };
 
-    systemd.timers.clamav-freshclam = mkIf cfg.updater.enable {
+    systemd.timers.clamav-freshclam = lib.mkIf cfg.updater.enable {
       description = "Timer for ClamAV virus database updater (freshclam)";
       wantedBy = [ "timers.target" ];
       timerConfig = {
@@ -198,7 +197,7 @@ in
       };
     };
 
-    systemd.services.clamav-freshclam = mkIf cfg.updater.enable {
+    systemd.services.clamav-freshclam = lib.mkIf cfg.updater.enable {
       description = "ClamAV virus database updater (freshclam)";
       restartTriggers = [ freshclamConfigFile ];
       requires = [ "network-online.target" ];
@@ -217,7 +216,7 @@ in
       };
     };
 
-    systemd.services.clamav-fangfrisch-init = mkIf cfg.fangfrisch.enable {
+    systemd.services.clamav-fangfrisch-init = lib.mkIf cfg.fangfrisch.enable {
       wantedBy = [ "multi-user.target" ];
       # if the sqlite file can be found assume the database has already been initialised
       script = ''
@@ -239,7 +238,7 @@ in
       };
     };
 
-    systemd.timers.clamav-fangfrisch = mkIf cfg.fangfrisch.enable {
+    systemd.timers.clamav-fangfrisch = lib.mkIf cfg.fangfrisch.enable {
       description = "Timer for ClamAV virus database updater (fangfrisch)";
       wantedBy = [ "timers.target" ];
       timerConfig = {
@@ -248,7 +247,7 @@ in
       };
     };
 
-    systemd.services.clamav-fangfrisch = mkIf cfg.fangfrisch.enable {
+    systemd.services.clamav-fangfrisch = lib.mkIf cfg.fangfrisch.enable {
       description = "ClamAV virus database updater (fangfrisch)";
       restartTriggers = [ fangfrischConfigFile ];
       requires = [ "network-online.target" ];
@@ -266,7 +265,7 @@ in
       };
     };
 
-    systemd.timers.clamdscan = mkIf cfg.scanner.enable {
+    systemd.timers.clamdscan = lib.mkIf cfg.scanner.enable {
       description = "Timer for ClamAV virus scanner";
       wantedBy = [ "timers.target" ];
       timerConfig = {
@@ -275,10 +274,10 @@ in
       };
     };
 
-    systemd.services.clamdscan = mkIf cfg.scanner.enable {
+    systemd.services.clamdscan = lib.mkIf cfg.scanner.enable {
       description = "ClamAV virus scanner";
-      after = optionals cfg.updater.enable [ "clamav-freshclam.service" ];
-      wants = optionals cfg.updater.enable [ "clamav-freshclam.service" ];
+      after = lib.optionals cfg.updater.enable [ "clamav-freshclam.service" ];
+      wants = lib.optionals cfg.updater.enable [ "clamav-freshclam.service" ];
 
       serviceConfig = {
         Type = "oneshot";

nixos/modules/services/security/endlessh-go.nix

@@ -4,20 +4,17 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.endlessh-go;
 in
 {
   options.services.endlessh-go = {
-    enable = mkEnableOption "endlessh-go service";
+    enable = lib.mkEnableOption "endlessh-go service";
 
-    package = mkPackageOption pkgs "endlessh-go" { };
+    package = lib.mkPackageOption pkgs "endlessh-go" { };
 
-    listenAddress = mkOption {
-      type = types.str;
+    listenAddress = lib.mkOption {
+      type = lib.types.str;
       default = "0.0.0.0";
       example = "[::]";
       description = ''
@@ -25,8 +22,8 @@ in
       '';
     };
 
-    port = mkOption {
-      type = types.port;
+    port = lib.mkOption {
+      type = lib.types.port;
       default = 2222;
       example = 22;
       description = ''
@@ -38,10 +35,10 @@ in
     };
 
     prometheus = {
-      enable = mkEnableOption "Prometheus integration";
+      enable = lib.mkEnableOption "Prometheus integration";
 
-      listenAddress = mkOption {
-        type = types.str;
+      listenAddress = lib.mkOption {
+        type = lib.types.str;
         default = "0.0.0.0";
         example = "[::]";
         description = ''
@@ -50,8 +47,8 @@ in
         '';
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 2112;
         example = 9119;
         description = ''
@@ -61,8 +58,8 @@ in
       };
     };
 
-    extraOptions = mkOption {
-      type = with types; listOf str;
+    extraOptions = lib.mkOption {
+      type = with lib.types; listOf str;
       default = [ ];
       example = [
         "-conn_type=tcp4"
@@ -73,8 +70,8 @@ in
       '';
     };
 
-    openFirewall = mkOption {
-      type = types.bool;
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Whether to open a firewall port for the SSH listener.
@@ -82,7 +79,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.endlessh-go = {
       description = "SSH tarpit";
       requires = [ "network.target" ];
@@ -90,7 +87,7 @@ in
       serviceConfig =
         let
           needsPrivileges = cfg.port < 1024 || cfg.prometheus.port < 1024;
-          capabilities = [ "" ] ++ optionals needsPrivileges [ "CAP_NET_BIND_SERVICE" ];
+          capabilities = [ "" ] ++ lib.optionals needsPrivileges [ "CAP_NET_BIND_SERVICE" ];
           rootDirectory = "/run/endlessh-go";
         in
         {
@@ -155,5 +152,5 @@ in
     networking.firewall.allowedTCPPorts = with cfg; optionals openFirewall [ port ];
   };
 
-  meta.maintainers = with maintainers; [ azahi ];
+  meta.maintainers = with lib.maintainers; [ azahi ];
 }

nixos/modules/services/security/endlessh.nix

@@ -4,18 +4,15 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.endlessh;
 in
 {
   options.services.endlessh = {
-    enable = mkEnableOption "endlessh service";
+    enable = lib.mkEnableOption "endlessh service";
 
-    port = mkOption {
-      type = types.port;
+    port = lib.mkOption {
+      type = lib.types.port;
       default = 2222;
       example = 22;
       description = ''
@@ -26,8 +23,8 @@ in
       '';
     };
 
-    extraOptions = mkOption {
-      type = with types; listOf str;
+    extraOptions = lib.mkOption {
+      type = with lib.types; listOf str;
       default = [ ];
       example = [
         "-6"
@@ -39,8 +36,8 @@ in
       '';
     };
 
-    openFirewall = mkOption {
-      type = types.bool;
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Whether to open a firewall port for the SSH listener.
@@ -48,7 +45,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.endlessh = {
       description = "SSH tarpit";
       requires = [ "network.target" ];
@@ -56,7 +53,7 @@ in
       serviceConfig =
         let
           needsPrivileges = cfg.port < 1024;
-          capabilities = [ "" ] ++ optionals needsPrivileges [ "CAP_NET_BIND_SERVICE" ];
+          capabilities = [ "" ] ++ lib.optionals needsPrivileges [ "CAP_NET_BIND_SERVICE" ];
           rootDirectory = "/run/endlessh";
         in
         {
@@ -115,5 +112,5 @@ in
     networking.firewall.allowedTCPPorts = with cfg; optionals openFirewall [ port ];
   };
 
-  meta.maintainers = with maintainers; [ azahi ];
+  meta.maintainers = with lib.maintainers; [ azahi ];
 }

nixos/modules/services/security/fail2ban.nix

@@ -4,47 +4,44 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.fail2ban;
 
   settingsFormat = pkgs.formats.keyValue { };
 
   configFormat = pkgs.formats.ini {
-    mkKeyValue = generators.mkKeyValueDefault { } " = ";
+    mkKeyValue = lib.generators.mkKeyValueDefault { } " = ";
   };
 
   mkJailConfig =
     name: attrs:
-    optionalAttrs (name != "DEFAULT") { inherit (attrs) enabled; }
-    // optionalAttrs (attrs.filter != null) {
-      filter = if (builtins.isString filter) then filter else name;
+    lib.optionalAttrs (name != "DEFAULT") { inherit (attrs) enabled; }
+    // lib.optionalAttrs (attrs.filter != null) {
+      filter = if (builtins.isString lib.filter) then lib.filter else name;
     }
     // attrs.settings;
 
   mkFilter =
     name: attrs:
-    nameValuePair "fail2ban/filter.d/${name}.conf" {
+    lib.nameValuePair "fail2ban/filter.d/${name}.conf" {
       source = configFormat.generate "filter.d/${name}.conf" attrs.filter;
     };
 
   fail2banConf = configFormat.generate "fail2ban.local" cfg.daemonSettings;
 
-  strJails = filterAttrs (_: builtins.isString) cfg.jails;
-  attrsJails = filterAttrs (_: builtins.isAttrs) cfg.jails;
+  strJails = lib.filterAttrs (_: builtins.isString) cfg.jails;
+  attrsJails = lib.filterAttrs (_: builtins.isAttrs) cfg.jails;
 
   jailConf =
     let
       configFile = configFormat.generate "jail.local" (
-        { INCLUDES.before = "paths-nixos.conf"; } // (mapAttrs mkJailConfig attrsJails)
+        { INCLUDES.before = "paths-nixos.conf"; } // (lib.mapAttrs mkJailConfig attrsJails)
       );
-      extraConfig = concatStringsSep "\n" (
-        attrValues (
-          mapAttrs (
+      extraConfig = lib.concatStringsSep "\n" (
+        lib.attrValues (
+          lib.mapAttrs (
             name: def:
-            optionalString (def != "") ''
+            lib.optionalString (def != "") ''
               [${name}]
               ${def}
             ''
@@ -74,12 +71,12 @@ in
 {
 
   imports = [
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "fail2ban"
       "daemonConfig"
     ] "The daemon is now configured through the attribute set `services.fail2ban.daemonSettings`.")
-    (mkRemovedOptionModule [ "services" "fail2ban" "extraSettings" ]
+    (lib.mkRemovedOptionModule [ "services" "fail2ban" "extraSettings" ]
       "The extra default configuration can now be set using `services.fail2ban.jails.DEFAULT.settings`."
     )
   ];
@@ -88,9 +85,9 @@ in
 
   options = {
     services.fail2ban = {
-      enable = mkOption {
+      enable = lib.mkOption {
         default = false;
-        type = types.bool;
+        type = lib.types.bool;
         description = ''
           Whether to enable the fail2ban service.
 
@@ -99,20 +96,20 @@ in
         '';
       };
 
-      package = mkPackageOption pkgs "fail2ban" {
+      package = lib.mkPackageOption pkgs "fail2ban" {
         example = "fail2ban_0_11";
       };
 
-      packageFirewall = mkOption {
+      packageFirewall = lib.mkOption {
         default = config.networking.firewall.package;
-        defaultText = literalExpression "config.networking.firewall.package";
-        type = types.package;
+        defaultText = lib.literalExpression "config.networking.firewall.package";
+        type = lib.types.package;
         description = "The firewall package used by fail2ban service. Defaults to the package for your firewall (iptables or nftables).";
       };
 
-      extraPackages = mkOption {
+      extraPackages = lib.mkOption {
         default = [ ];
-        type = types.listOf types.package;
+        type = lib.types.listOf lib.types.package;
         example = lib.literalExpression "[ pkgs.ipset ]";
         description = ''
           Extra packages to be made available to the fail2ban service. The example contains
@@ -120,23 +117,23 @@ in
         '';
       };
 
-      bantime = mkOption {
+      bantime = lib.mkOption {
         default = "10m";
-        type = types.str;
+        type = lib.types.str;
         example = "1h";
         description = "Number of seconds that a host is banned.";
       };
 
-      maxretry = mkOption {
+      maxretry = lib.mkOption {
         default = 3;
-        type = types.ints.unsigned;
+        type = lib.types.ints.unsigned;
         description = "Number of failures before a host gets banned.";
       };
 
-      banaction = mkOption {
+      banaction = lib.mkOption {
         default = if config.networking.nftables.enable then "nftables-multiport" else "iptables-multiport";
-        defaultText = literalExpression ''if config.networking.nftables.enable then "nftables-multiport" else "iptables-multiport"'';
-        type = types.str;
+        defaultText = lib.literalExpression ''if config.networking.nftables.enable then "nftables-multiport" else "iptables-multiport"'';
+        type = lib.types.str;
         description = ''
           Default banning action (e.g. iptables, iptables-new, iptables-multiport,
           iptables-ipset-proto6-allports, shorewall, etc). It is used to
@@ -145,10 +142,10 @@ in
         '';
       };
 
-      banaction-allports = mkOption {
+      banaction-allports = lib.mkOption {
         default = if config.networking.nftables.enable then "nftables-allports" else "iptables-allports";
-        defaultText = literalExpression ''if config.networking.nftables.enable then "nftables-allports" else "iptables-allports"'';
-        type = types.str;
+        defaultText = lib.literalExpression ''if config.networking.nftables.enable then "nftables-allports" else "iptables-allports"'';
+        type = lib.types.str;
         description = ''
           Default banning action (e.g. iptables, iptables-new, iptables-multiport,
           shorewall, etc) for "allports" jails. It is used to define action_* variables. Can be overridden
@@ -156,18 +153,18 @@ in
         '';
       };
 
-      bantime-increment.enable = mkOption {
+      bantime-increment.enable = lib.mkOption {
         default = false;
-        type = types.bool;
+        type = lib.types.bool;
         description = ''
           "bantime.increment" allows to use database for searching of previously banned ip's to increase
           a default ban time using special formula, default it is banTime * 1, 2, 4, 8, 16, 32 ...
         '';
       };
 
-      bantime-increment.rndtime = mkOption {
+      bantime-increment.rndtime = lib.mkOption {
         default = null;
-        type = types.nullOr types.str;
+        type = lib.types.nullOr lib.types.str;
         example = "8m";
         description = ''
           "bantime.rndtime" is the max number of seconds using for mixing with random time
@@ -175,18 +172,18 @@ in
         '';
       };
 
-      bantime-increment.maxtime = mkOption {
+      bantime-increment.maxtime = lib.mkOption {
         default = null;
-        type = types.nullOr types.str;
+        type = lib.types.nullOr lib.types.str;
         example = "48h";
         description = ''
           "bantime.maxtime" is the max number of seconds using the ban time can reach (don't grows further)
         '';
       };
 
-      bantime-increment.factor = mkOption {
+      bantime-increment.factor = lib.mkOption {
         default = null;
-        type = types.nullOr types.str;
+        type = lib.types.nullOr lib.types.str;
         example = "4";
         description = ''
           "bantime.factor" is a coefficient to calculate exponent growing of the formula or common multiplier,
@@ -194,9 +191,9 @@ in
         '';
       };
 
-      bantime-increment.formula = mkOption {
+      bantime-increment.formula = lib.mkOption {
         default = null;
-        type = types.nullOr types.str;
+        type = lib.types.nullOr lib.types.str;
         example = "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)";
         description = ''
           "bantime.formula" used by default to calculate next value of ban time, default value below,
@@ -204,9 +201,9 @@ in
         '';
       };
 
-      bantime-increment.multipliers = mkOption {
+      bantime-increment.multipliers = lib.mkOption {
         default = null;
-        type = types.nullOr types.str;
+        type = lib.types.nullOr lib.types.str;
         example = "1 2 4 8 16 32 64";
         description = ''
           "bantime.multipliers" used to calculate next value of ban time instead of formula, corresponding
@@ -216,9 +213,9 @@ in
         '';
       };
 
-      bantime-increment.overalljails = mkOption {
+      bantime-increment.overalljails = lib.mkOption {
         default = null;
-        type = types.nullOr types.bool;
+        type = lib.types.nullOr lib.types.bool;
         example = true;
         description = ''
           "bantime.overalljails" (if true) specifies the search of IP in the database will be executed
@@ -226,9 +223,9 @@ in
         '';
       };
 
-      ignoreIP = mkOption {
+      ignoreIP = lib.mkOption {
         default = [ ];
-        type = types.listOf types.str;
+        type = lib.types.listOf lib.types.str;
         example = [
           "192.168.0.0/16"
           "2001:DB8::42"
@@ -239,10 +236,10 @@ in
         '';
       };
 
-      daemonSettings = mkOption {
+      daemonSettings = lib.mkOption {
         inherit (configFormat) type;
 
-        defaultText = literalExpression ''
+        defaultText = lib.literalExpression ''
           {
             Definition = {
               logtarget = "SYSLOG";
@@ -258,9 +255,9 @@ in
         '';
       };
 
-      jails = mkOption {
+      jails = lib.mkOption {
         default = { };
-        example = literalExpression ''
+        example = lib.literalExpression ''
           {
             apache-nohome-iptables = {
               settings = {
@@ -287,26 +284,26 @@ in
           };
         '';
         type =
-          with types;
+          with lib.types;
           attrsOf (
             either lines (
               submodule (
                 { name, ... }:
                 {
                   options = {
-                    enabled = mkEnableOption "this jail" // {
+                    enabled = lib.mkEnableOption "this jail" // {
                       default = true;
                       readOnly = name == "DEFAULT";
                     };
 
-                    filter = mkOption {
+                    filter = lib.mkOption {
                       type = nullOr (either str configFormat.type);
 
                       default = null;
                       description = "Content of the filter used for this jail.";
                     };
 
-                    settings = mkOption {
+                    settings = lib.mkOption {
                       inherit (settingsFormat) type;
 
                       default = { };
@@ -344,7 +341,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     assertions = [
       {
         assertion = cfg.bantime-increment.formula == null || cfg.bantime-increment.multipliers == null;
@@ -354,7 +351,7 @@ in
       }
     ];
 
-    warnings = mkIf (!config.networking.firewall.enable && !config.networking.nftables.enable) [
+    warnings = lib.mkIf (!config.networking.firewall.enable && !config.networking.nftables.enable) [
       "fail2ban can not be used without a firewall"
     ];
 
@@ -371,14 +368,14 @@ in
         "fail2ban/action.d".source = "${cfg.package}/etc/fail2ban/action.d/*.conf";
         "fail2ban/filter.d".source = "${cfg.package}/etc/fail2ban/filter.d/*.conf";
       }
-      // (mapAttrs' mkFilter (
-        filterAttrs (_: v: v.filter != null && !builtins.isString v.filter) attrsJails
+      // (lib.mapAttrs' mkFilter (
+        lib.filterAttrs (_: v: v.filter != null && !builtins.isString v.filter) attrsJails
       ));
 
     systemd.packages = [ cfg.package ];
     systemd.services.fail2ban = {
       wantedBy = [ "multi-user.target" ];
-      partOf = optional config.networking.firewall.enable "firewall.service";
+      partOf = lib.optional config.networking.firewall.enable "firewall.service";
 
       restartTriggers = [
         fail2banConf
@@ -423,29 +420,29 @@ in
 
     # Defaults for the daemon settings
     services.fail2ban.daemonSettings.Definition = {
-      logtarget = mkDefault "SYSLOG";
-      socket = mkDefault "/run/fail2ban/fail2ban.sock";
-      pidfile = mkDefault "/run/fail2ban/fail2ban.pid";
-      dbfile = mkDefault "/var/lib/fail2ban/fail2ban.sqlite3";
+      logtarget = lib.mkDefault "SYSLOG";
+      socket = lib.mkDefault "/run/fail2ban/fail2ban.sock";
+      pidfile = lib.mkDefault "/run/fail2ban/fail2ban.pid";
+      dbfile = lib.mkDefault "/var/lib/fail2ban/fail2ban.sqlite3";
     };
 
     # Add some reasonable default jails.  The special "DEFAULT" jail
     # sets default values for all other jails.
-    services.fail2ban.jails = mkMerge [
+    services.fail2ban.jails = lib.mkMerge [
       {
         DEFAULT.settings =
-          (optionalAttrs cfg.bantime-increment.enable (
+          (lib.optionalAttrs cfg.bantime-increment.enable (
             {
               "bantime.increment" = cfg.bantime-increment.enable;
             }
-            // (mapAttrs' (name: nameValuePair "bantime.${name}") (
-              filterAttrs (n: v: v != null && n != "enable") cfg.bantime-increment
+            // (lib.mapAttrs' (name: lib.nameValuePair "bantime.${name}") (
+              lib.filterAttrs (n: v: v != null && n != "enable") cfg.bantime-increment
             ))
           ))
           // {
             # Miscellaneous options
             inherit (cfg) banaction maxretry bantime;
-            ignoreip = ''127.0.0.1/8 ${optionalString config.networking.enableIPv6 "::1"} ${concatStringsSep " " cfg.ignoreIP}'';
+            ignoreip = ''127.0.0.1/8 ${lib.optionalString config.networking.enableIPv6 "::1"} ${lib.concatStringsSep " " cfg.ignoreIP}'';
             backend = "systemd";
             # Actions
             banaction_allports = cfg.banaction-allports;
@@ -453,15 +450,15 @@ in
       }
 
       # Block SSH if there are too many failing connection attempts.
-      (mkIf config.services.openssh.enable {
-        sshd.settings.port = mkDefault (
-          concatMapStringsSep "," builtins.toString config.services.openssh.ports
+      (lib.mkIf config.services.openssh.enable {
+        sshd.settings.port = lib.mkDefault (
+          lib.concatMapStringsSep "," builtins.toString config.services.openssh.ports
         );
       })
     ];
 
     # Benefits from verbose sshd logging to observe failed login attempts,
     # so we set that here unless the user overrode it.
-    services.openssh.settings.LogLevel = mkDefault "VERBOSE";
+    services.openssh.settings.LogLevel = lib.mkDefault "VERBOSE";
   };
 }

nixos/modules/services/security/fprintd.nix

@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.fprintd;
@@ -18,12 +15,12 @@ in
 
     services.fprintd = {
 
-      enable = mkEnableOption "fprintd daemon and PAM module for fingerprint readers handling";
+      enable = lib.mkEnableOption "fprintd daemon and PAM module for fingerprint readers handling";
 
-      package = mkOption {
-        type = types.package;
+      package = lib.mkOption {
+        type = lib.types.package;
         default = fprintdPkg;
-        defaultText = literalExpression "if config.services.fprintd.tod.enable then pkgs.fprintd-tod else pkgs.fprintd";
+        defaultText = lib.literalExpression "if config.services.fprintd.tod.enable then pkgs.fprintd-tod else pkgs.fprintd";
         description = ''
           fprintd package to use.
         '';
@@ -31,11 +28,11 @@ in
 
       tod = {
 
-        enable = mkEnableOption "Touch OEM Drivers library support";
+        enable = lib.mkEnableOption "Touch OEM Drivers library support";
 
-        driver = mkOption {
-          type = types.package;
-          example = literalExpression "pkgs.libfprint-2-tod1-goodix";
+        driver = lib.mkOption {
+          type = lib.types.package;
+          example = lib.literalExpression "pkgs.libfprint-2-tod1-goodix";
           description = ''
             Touch OEM Drivers (TOD) package to use.
           '';
@@ -47,7 +44,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     services.dbus.packages = [ cfg.package ];
 
@@ -55,7 +52,7 @@ in
 
     systemd.packages = [ cfg.package ];
 
-    systemd.services.fprintd.environment = mkIf cfg.tod.enable {
+    systemd.services.fprintd.environment = lib.mkIf cfg.tod.enable {
       FP_TOD_DRIVERS_DIR = "${cfg.tod.driver}${cfg.tod.driver.driverPath}";
     };
 

nixos/modules/services/security/haka.nix

@@ -1,14 +1,10 @@
 # This module defines global configuration for Haka.
-
 {
   config,
   lib,
   pkgs,
   ...
 }:
-
-with lib;
-
 let
 
   cfg = config.services.haka;
@@ -23,14 +19,14 @@ let
       else
         "${haka}/share/haka/sample/${cfg.configFile}"
     }
-    ${optionalString (builtins.lessThan 0 cfg.threads) "thread = ${cfg.threads}"}
+    ${lib.optionalString (builtins.lessThan 0 cfg.threads) "thread = ${cfg.threads}"}
 
     [packet]
-    ${optionalString cfg.pcap ''module = "packet/pcap"''}
-    ${optionalString cfg.nfqueue ''module = "packet/nqueue"''}
-    ${optionalString cfg.dump.enable ''dump = "yes"''}
-    ${optionalString cfg.dump.enable ''dump_input = "${cfg.dump.input}"''}
-    ${optionalString cfg.dump.enable ''dump_output = "${cfg.dump.output}"''}
+    ${lib.optionalString cfg.pcap ''module = "packet/pcap"''}
+    ${lib.optionalString cfg.nfqueue ''module = "packet/nqueue"''}
+    ${lib.optionalString cfg.dump.enable ''dump = "yes"''}
+    ${lib.optionalString cfg.dump.enable ''dump_input = "${cfg.dump.input}"''}
+    ${lib.optionalString cfg.dump.enable ''dump_output = "${cfg.dump.output}"''}
 
     interfaces = "${lib.strings.concatStringsSep "," cfg.interfaces}"
 
@@ -62,14 +58,14 @@ in
 
     services.haka = {
 
-      enable = mkEnableOption "Haka";
+      enable = lib.mkEnableOption "Haka";
 
-      package = mkPackageOption pkgs "haka" { };
+      package = lib.mkPackageOption pkgs "haka" { };
 
-      configFile = mkOption {
+      configFile = lib.mkOption {
         default = "empty.lua";
         example = "/srv/haka/myfilter.lua";
-        type = types.str;
+        type = lib.types.str;
         description = ''
           Specify which configuration file Haka uses.
           It can be absolute path or a path relative to the sample directory of
@@ -77,46 +73,46 @@ in
         '';
       };
 
-      interfaces = mkOption {
+      interfaces = lib.mkOption {
         default = [ "eth0" ];
         example = [ "any" ];
-        type = with types; listOf str;
+        type = with lib.types; listOf str;
         description = ''
           Specify which interface(s) Haka listens to.
           Use 'any' to listen to all interfaces.
         '';
       };
 
-      threads = mkOption {
+      threads = lib.mkOption {
         default = 0;
         example = 4;
-        type = types.int;
+        type = lib.types.int;
         description = ''
           The number of threads that will be used.
           All system threads are used by default.
         '';
       };
 
-      pcap = mkOption {
+      pcap = lib.mkOption {
         default = true;
-        type = types.bool;
+        type = lib.types.bool;
         description = "Whether to enable pcap";
       };
 
-      nfqueue = mkEnableOption "nfqueue";
+      nfqueue = lib.mkEnableOption "nfqueue";
 
-      dump.enable = mkEnableOption "dump";
-      dump.input = mkOption {
+      dump.enable = lib.mkEnableOption "dump";
+      dump.input = lib.mkOption {
         default = "/tmp/input.pcap";
         example = "/path/to/file.pcap";
-        type = types.path;
+        type = lib.types.path;
         description = "Path to file where incoming packets are dumped";
       };
 
-      dump.output = mkOption {
+      dump.output = lib.mkOption {
         default = "/tmp/output.pcap";
         example = "/path/to/file.pcap";
-        type = types.path;
+        type = lib.types.path;
         description = "Path to file where outgoing packets are dumped";
       };
     };
@@ -124,7 +120,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     assertions = [
       {

nixos/modules/services/security/haveged.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.haveged;
 
@@ -20,14 +17,14 @@ in
 
     services.haveged = {
 
-      enable = mkEnableOption ''
+      enable = lib.mkEnableOption ''
         haveged entropy daemon, which refills /dev/random when low.
         NOTE: does nothing on kernels newer than 5.6
       '';
       # source for the note https://github.com/jirka-h/haveged/issues/57
 
-      refill_threshold = mkOption {
-        type = types.int;
+      refill_threshold = lib.mkOption {
+        type = lib.types.int;
         default = 1024;
         description = ''
           The number of bits of available entropy beneath which
@@ -39,7 +36,7 @@ in
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     # https://github.com/jirka-h/haveged/blob/a4b69d65a8dfc5a9f52ff8505c7f58dcf8b9234f/contrib/Fedora/haveged.service
     systemd.services.haveged = {

nixos/modules/services/security/hologram-agent.nix

@@ -4,9 +4,6 @@
   lib,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.hologram-agent;
 
@@ -19,20 +16,20 @@ in
 {
   options = {
     services.hologram-agent = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable the Hologram agent for AWS instance credentials";
       };
 
-      dialAddress = mkOption {
-        type = types.str;
+      dialAddress = lib.mkOption {
+        type = lib.types.str;
         default = "localhost:3100";
         description = "Hologram server and port.";
       };
 
-      httpPort = mkOption {
-        type = types.str;
+      httpPort = lib.mkOption {
+        type = lib.types.str;
         default = "80";
         description = "Port for metadata service to listen on.";
       };
@@ -40,7 +37,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     boot.kernelModules = [ "dummy" ];
 
     networking.interfaces.dummy0.ipv4.addresses = [

nixos/modules/services/security/hologram-server.nix

@@ -4,9 +4,6 @@
   lib,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.hologram-server;
 
@@ -38,93 +35,93 @@ in
 {
   options = {
     services.hologram-server = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable the Hologram server for AWS instance credentials";
       };
 
-      listenAddress = mkOption {
-        type = types.str;
+      listenAddress = lib.mkOption {
+        type = lib.types.str;
         default = "0.0.0.0:3100";
         description = "Address and port to listen on";
       };
 
-      ldapHost = mkOption {
-        type = types.str;
+      ldapHost = lib.mkOption {
+        type = lib.types.str;
         description = "Address of the LDAP server to use";
       };
 
-      ldapInsecure = mkOption {
-        type = types.bool;
+      ldapInsecure = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to connect to LDAP over SSL or not";
       };
 
-      ldapUserAttr = mkOption {
-        type = types.str;
+      ldapUserAttr = lib.mkOption {
+        type = lib.types.str;
         default = "cn";
         description = "The LDAP attribute for usernames";
       };
 
-      ldapBaseDN = mkOption {
-        type = types.str;
+      ldapBaseDN = lib.mkOption {
+        type = lib.types.str;
         description = "The base DN for your Hologram users";
       };
 
-      ldapBindDN = mkOption {
-        type = types.str;
+      ldapBindDN = lib.mkOption {
+        type = lib.types.str;
         description = "DN of account to use to query the LDAP server";
       };
 
-      ldapBindPassword = mkOption {
-        type = types.str;
+      ldapBindPassword = lib.mkOption {
+        type = lib.types.str;
         description = "Password of account to use to query the LDAP server";
       };
 
-      enableLdapRoles = mkOption {
-        type = types.bool;
+      enableLdapRoles = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to assign user roles based on the user's LDAP group memberships";
       };
 
-      groupClassAttr = mkOption {
-        type = types.str;
+      groupClassAttr = lib.mkOption {
+        type = lib.types.str;
         default = "groupOfNames";
         description = "The objectclass attribute to search for groups when enableLdapRoles is true";
       };
 
-      roleAttr = mkOption {
-        type = types.str;
+      roleAttr = lib.mkOption {
+        type = lib.types.str;
         default = "businessCategory";
         description = "Which LDAP group attribute to search for authorized role ARNs";
       };
 
-      awsAccount = mkOption {
-        type = types.str;
+      awsAccount = lib.mkOption {
+        type = lib.types.str;
         description = "AWS account number";
       };
 
-      awsDefaultRole = mkOption {
-        type = types.str;
+      awsDefaultRole = lib.mkOption {
+        type = lib.types.str;
         description = "AWS default role";
       };
 
-      statsAddress = mkOption {
-        type = types.str;
+      statsAddress = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "Address of statsd server";
       };
 
-      cacheTimeoutSeconds = mkOption {
-        type = types.int;
+      cacheTimeoutSeconds = lib.mkOption {
+        type = lib.types.int;
         default = 3600;
         description = "How often (in seconds) to refresh the LDAP cache";
       };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.hologram-server = {
       description = "Provide EC2 instance credentials to machines outside of EC2";
       after = [ "network.target" ];

nixos/modules/services/security/infnoise.nix

@@ -4,38 +4,35 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.infnoise;
 in
 {
   options = {
     services.infnoise = {
-      enable = mkEnableOption "the Infinite Noise TRNG driver";
+      enable = lib.mkEnableOption "the Infinite Noise TRNG driver";
 
-      fillDevRandom = mkOption {
+      fillDevRandom = lib.mkOption {
         description = ''
           Whether to run the infnoise driver as a daemon to refill /dev/random.
 
           If disabled, you can use the `infnoise` command-line tool to
           manually obtain randomness.
         '';
-        type = types.bool;
+        type = lib.types.bool;
         default = true;
       };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [ pkgs.infnoise ];
 
     services.udev.extraRules = ''
       SUBSYSTEM=="usb", ATTRS{idVendor}=="0403", ATTRS{idProduct}=="6015", SYMLINK+="infnoise", TAG+="systemd", GROUP="dialout", MODE="0664", ENV{SYSTEMD_WANTS}="infnoise.service"
     '';
 
-    systemd.services.infnoise = mkIf cfg.fillDevRandom {
+    systemd.services.infnoise = lib.mkIf cfg.fillDevRandom {
       description = "Infinite Noise TRNG driver";
 
       bindsTo = [ "dev-infnoise.device" ];

nixos/modules/services/security/munge.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
 
   cfg = config.services.munge;
@@ -20,11 +17,11 @@ in
   options = {
 
     services.munge = {
-      enable = mkEnableOption "munge service";
+      enable = lib.mkEnableOption "munge service";
 
-      password = mkOption {
+      password = lib.mkOption {
         default = "/etc/munge/munge.key";
-        type = types.path;
+        type = lib.types.path;
         description = ''
           The path to a daemon's secret key.
         '';
@@ -36,7 +33,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     environment.systemPackages = [ pkgs.munge ];
 

nixos/modules/services/security/nginx-sso.nix

@@ -1,21 +1,18 @@
 { config, lib, pkgs, utils, ... }:
-
-with lib;
-
 let
   cfg = config.services.nginx.sso;
   format = pkgs.formats.yaml { };
   configPath = "/var/lib/nginx-sso/config.yaml";
 in {
   options.services.nginx.sso = {
-    enable = mkEnableOption "nginx-sso service";
+    enable = lib.mkEnableOption "nginx-sso service";
 
-    package = mkPackageOption pkgs "nginx-sso" { };
+    package = lib.mkPackageOption pkgs "nginx-sso" { };
 
-    configuration = mkOption {
+    configuration = lib.mkOption {
       type = format.type;
       default = {};
-      example = literalExpression ''
+      example = lib.literalExpression ''
         {
           listen = { addr = "127.0.0.1"; port = 8080; };
 
@@ -48,7 +45,7 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.nginx-sso = {
       description = "Nginx SSO Backend";
       after = [ "network.target" ];

nixos/modules/services/security/opensnitch.nix

@@ -4,14 +4,11 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.opensnitch;
   format = pkgs.formats.json { };
 
-  predefinedRules = flip mapAttrs cfg.rules (
+  predefinedRules = lib.flip lib.mapAttrs cfg.rules (
     name: cfg: {
       file = pkgs.writeText "rule" (builtins.toJSON cfg);
     }
@@ -21,11 +18,11 @@ in
 {
   options = {
     services.opensnitch = {
-      enable = mkEnableOption "Opensnitch application firewall";
+      enable = lib.mkEnableOption "Opensnitch application firewall";
 
-      rules = mkOption {
+      rules = lib.mkOption {
         default = { };
-        example = literalExpression ''
+        example = lib.literalExpression ''
           {
             "tor" = {
               "name" = "tor";
@@ -50,28 +47,28 @@ in
           for available options.
         '';
 
-        type = types.submodule {
+        type = lib.types.submodule {
           freeformType = format.type;
         };
       };
 
-      settings = mkOption {
-        type = types.submodule {
+      settings = lib.mkOption {
+        type = lib.types.submodule {
           freeformType = format.type;
 
           options = {
             Server = {
 
-              Address = mkOption {
-                type = types.str;
+              Address = lib.mkOption {
+                type = lib.types.str;
                 description = ''
                   Unix socket path (unix:///tmp/osui.sock, the "unix:///" part is
                   mandatory) or TCP socket (192.168.1.100:50051).
                 '';
               };
 
-              LogFile = mkOption {
-                type = types.path;
+              LogFile = lib.mkOption {
+                type = lib.types.path;
                 description = ''
                   File to write logs to (use /dev/stdout to write logs to standard
                   output).
@@ -80,8 +77,8 @@ in
 
             };
 
-            DefaultAction = mkOption {
-              type = types.enum [
+            DefaultAction = lib.mkOption {
+              type = lib.types.enum [
                 "allow"
                 "deny"
               ];
@@ -91,15 +88,15 @@ in
               '';
             };
 
-            InterceptUnknown = mkOption {
-              type = types.bool;
+            InterceptUnknown = lib.mkOption {
+              type = lib.types.bool;
               description = ''
                 Whether to intercept spare connections.
               '';
             };
 
-            ProcMonitorMethod = mkOption {
-              type = types.enum [
+            ProcMonitorMethod = lib.mkOption {
+              type = lib.types.enum [
                 "ebpf"
                 "proc"
                 "ftrace"
@@ -110,8 +107,8 @@ in
               '';
             };
 
-            LogLevel = mkOption {
-              type = types.enum [
+            LogLevel = lib.mkOption {
+              type = lib.types.enum [
                 0
                 1
                 2
@@ -124,8 +121,8 @@ in
               '';
             };
 
-            Firewall = mkOption {
-              type = types.enum [
+            Firewall = lib.mkOption {
+              type = lib.types.enum [
                 "iptables"
                 "nftables"
               ];
@@ -136,15 +133,15 @@ in
 
             Stats = {
 
-              MaxEvents = mkOption {
-                type = types.int;
+              MaxEvents = lib.mkOption {
+                type = lib.types.int;
                 description = ''
                   Max events to send to the GUI.
                 '';
               };
 
-              MaxStats = mkOption {
-                type = types.int;
+              MaxStats = lib.mkOption {
+                type = lib.types.int;
                 description = ''
                   Max stats per item to keep in backlog.
                 '';
@@ -152,14 +149,14 @@ in
 
             };
 
-            Ebpf.ModulesPath = mkOption {
-              type = types.path;
+            Ebpf.ModulesPath = lib.mkOption {
+              type = lib.types.path;
               default =
                 if cfg.settings.ProcMonitorMethod == "ebpf" then
                   "${config.boot.kernelPackages.opensnitch-ebpf}/etc/opensnitchd"
                 else
                   null;
-              defaultText = literalExpression ''
+              defaultText = lib.literalExpression ''
                 if cfg.settings.ProcMonitorMethod == "ebpf" then
                   "\\$\\{config.boot.kernelPackages.opensnitch-ebpf\\}/etc/opensnitchd"
                 else null;
@@ -170,8 +167,8 @@ in
               '';
             };
 
-            Rules.Path = mkOption {
-              type = types.path;
+            Rules.Path = lib.mkOption {
+              type = lib.types.path;
               default = "/var/lib/opensnitch/rules";
               description = ''
                 Path to the directory where firewall rules can be found and will
@@ -189,10 +186,10 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     # pkg.opensnitch is referred to elsewhere in the module so we don't need to worry about it being garbage collected
-    services.opensnitch.settings = mapAttrs (_: v: mkDefault v) (
+    services.opensnitch.settings = lib.mapAttrs (_: v: lib.mkDefault v) (
       builtins.fromJSON (
         builtins.unsafeDiscardStringContext (
           builtins.readFile "${pkgs.opensnitch}/etc/opensnitchd/default-config.json"
@@ -210,9 +207,9 @@ in
             "${pkgs.opensnitch}/bin/opensnitchd --config-file ${format.generate "default-config.json" cfg.settings}"
           ];
         };
-        preStart = mkIf (cfg.rules != { }) (
+        preStart = lib.mkIf (cfg.rules != { }) (
           let
-            rules = flip mapAttrsToList predefinedRules (
+            rules = lib.flip lib.mapAttrsToList predefinedRules (
               file: content: {
                 inherit (content) file;
                 local = "${cfg.settings.Rules.Path}/${file}.json";
@@ -225,11 +222,13 @@ in
             # declared in `cfg.rules` (i.e. all networks that were "removed" from
             # `cfg.rules`).
             find ${cfg.settings.Rules.Path} -type l -lname '${builtins.storeDir}/*' ${
-              optionalString (rules != { }) ''
-                -not \( ${concatMapStringsSep " -o " ({ local, ... }: "-name '${baseNameOf local}*'") rules} \) \
+              lib.optionalString (rules != { }) ''
+                -not \( ${
+                  lib.concatMapStringsSep " -o " ({ local, ... }: "-name '${baseNameOf local}*'") rules
+                } \) \
               ''
             } -delete
-            ${concatMapStrings (
+            ${lib.concatMapStrings (
               { file, local }:
               ''
                 ln -sf '${file}' "${local}"

nixos/modules/services/security/pass-secret-service.nix

@@ -4,25 +4,22 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.passSecretService;
 in
 {
   options.services.passSecretService = {
-    enable = mkEnableOption "pass secret service";
+    enable = lib.mkEnableOption "pass secret service";
 
-    package = mkPackageOption pkgs "pass-secret-service" {
+    package = lib.mkPackageOption pkgs "pass-secret-service" {
       example = "pass-secret-service.override { python3 = pkgs.python310 }";
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.packages = [ cfg.package ];
     services.dbus.packages = [ cfg.package ];
   };
 
-  meta.maintainers = with maintainers; [ aidalgol ];
+  meta.maintainers = with lib.maintainers; [ aidalgol ];
 }

nixos/modules/services/security/physlock.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.physlock;
 in
@@ -19,8 +16,8 @@ in
 
     services.physlock = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable the {command}`physlock` screen locking mechanism.
@@ -35,8 +32,8 @@ in
         '';
       };
 
-      allowAnyUser = mkOption {
-        type = types.bool;
+      allowAnyUser = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to allow any user to lock the screen. This will install a
@@ -46,24 +43,24 @@ in
         '';
       };
 
-      disableSysRq = mkOption {
-        type = types.bool;
+      disableSysRq = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Whether to disable SysRq when locked with physlock.
         '';
       };
 
-      lockMessage = mkOption {
-        type = types.str;
+      lockMessage = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = ''
           Message to show on physlock login terminal.
         '';
       };
 
-      muteKernelMessages = mkOption {
-        type = types.bool;
+      muteKernelMessages = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Disable kernel messages on console while physlock is running.
@@ -72,24 +69,24 @@ in
 
       lockOn = {
 
-        suspend = mkOption {
-          type = types.bool;
+        suspend = lib.mkOption {
+          type = lib.types.bool;
           default = true;
           description = ''
             Whether to lock screen with physlock just before suspend.
           '';
         };
 
-        hibernate = mkOption {
-          type = types.bool;
+        hibernate = lib.mkOption {
+          type = lib.types.bool;
           default = true;
           description = ''
             Whether to lock screen with physlock just before hibernate.
           '';
         };
 
-        extraTargets = mkOption {
-          type = types.listOf types.str;
+        extraTargets = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
           default = [ ];
           example = [ "display-manager.service" ];
           description = ''
@@ -110,46 +107,50 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable (mkMerge [
-    {
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
 
-      # for physlock -l and physlock -L
-      environment.systemPackages = [ pkgs.physlock ];
+        # for physlock -l and physlock -L
+        environment.systemPackages = [ pkgs.physlock ];
 
-      systemd.services.physlock = {
-        enable = true;
-        description = "Physlock";
-        wantedBy =
-          optional cfg.lockOn.suspend "suspend.target"
-          ++ optional cfg.lockOn.hibernate "hibernate.target"
-          ++ cfg.lockOn.extraTargets;
-        before =
-          optional cfg.lockOn.suspend "systemd-suspend.service"
-          ++ optional cfg.lockOn.hibernate "systemd-hibernate.service"
-          ++ optional (cfg.lockOn.hibernate || cfg.lockOn.suspend) "systemd-suspend-then-hibernate.service"
-          ++ cfg.lockOn.extraTargets;
-        serviceConfig = {
-          Type = "forking";
-          ExecStart = "${pkgs.physlock}/bin/physlock -d${optionalString cfg.muteKernelMessages "m"}${optionalString cfg.disableSysRq "s"}${
-            optionalString (cfg.lockMessage != "") " -p \"${cfg.lockMessage}\""
-          }";
+        systemd.services.physlock = {
+          enable = true;
+          description = "Physlock";
+          wantedBy =
+            lib.optional cfg.lockOn.suspend "suspend.target"
+            ++ lib.optional cfg.lockOn.hibernate "hibernate.target"
+            ++ cfg.lockOn.extraTargets;
+          before =
+            lib.optional cfg.lockOn.suspend "systemd-suspend.service"
+            ++ lib.optional cfg.lockOn.hibernate "systemd-hibernate.service"
+            ++ lib.optional (
+              cfg.lockOn.hibernate || cfg.lockOn.suspend
+            ) "systemd-suspend-then-hibernate.service"
+            ++ cfg.lockOn.extraTargets;
+          serviceConfig = {
+            Type = "forking";
+            ExecStart = "${pkgs.physlock}/bin/physlock -d${lib.optionalString cfg.muteKernelMessages "m"}${lib.optionalString cfg.disableSysRq "s"}${
+              lib.optionalString (cfg.lockMessage != "") " -p \"${cfg.lockMessage}\""
+            }";
+          };
         };
-      };
 
-      security.pam.services.physlock = { };
+        security.pam.services.physlock = { };
 
-    }
+      }
 
-    (mkIf cfg.allowAnyUser {
+      (lib.mkIf cfg.allowAnyUser {
 
-      security.wrappers.physlock = {
-        setuid = true;
-        owner = "root";
-        group = "root";
-        source = "${pkgs.physlock}/bin/physlock";
-      };
+        security.wrappers.physlock = {
+          setuid = true;
+          owner = "root";
+          group = "root";
+          source = "${pkgs.physlock}/bin/physlock";
+        };
 
-    })
-  ]);
+      })
+    ]
+  );
 
 }

nixos/modules/services/security/sks.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.sks;
   sksPkg = cfg.package;
@@ -16,7 +13,7 @@ let
 
 in
 {
-  meta.maintainers = with maintainers; [
+  meta.maintainers = with lib.maintainers; [
     calbrecht
     jcumming
   ];
@@ -25,15 +22,15 @@ in
 
     services.sks = {
 
-      enable = mkEnableOption ''
+      enable = lib.mkEnableOption ''
         SKS (synchronizing key server for OpenPGP) and start the database
         server. You need to create "''${dataDir}/dump/*.gpg" for the initial
         import'';
 
-      package = mkPackageOption pkgs "sks" { };
+      package = lib.mkPackageOption pkgs "sks" { };
 
-      dataDir = mkOption {
-        type = types.path;
+      dataDir = lib.mkOption {
+        type = lib.types.path;
         default = "/var/db/sks";
         example = "/var/lib/sks";
         # TODO: The default might change to "/var/lib/sks" as this is more
@@ -46,8 +43,8 @@ in
         '';
       };
 
-      extraDbConfig = mkOption {
-        type = types.str;
+      extraDbConfig = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = ''
           Set contents of the files "KDB/DB_CONFIG" and "PTree/DB_CONFIG" within
@@ -60,28 +57,28 @@ in
         '';
       };
 
-      hkpAddress = mkOption {
+      hkpAddress = lib.mkOption {
         default = [
           "127.0.0.1"
           "::1"
         ];
-        type = types.listOf types.str;
+        type = lib.types.listOf lib.types.str;
         description = ''
           Domain names, IPv4 and/or IPv6 addresses to listen on for HKP
           requests.
         '';
       };
 
-      hkpPort = mkOption {
+      hkpPort = lib.mkOption {
         default = 11371;
-        type = types.ints.u16;
+        type = lib.types.ints.u16;
         description = "HKP port to listen on.";
       };
 
-      webroot = mkOption {
-        type = types.nullOr types.path;
+      webroot = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = "${sksPkg.webSamples}/OpenPKG";
-        defaultText = literalExpression ''"''${package.webSamples}/OpenPKG"'';
+        defaultText = lib.literalExpression ''"''${package.webSamples}/OpenPKG"'';
         description = ''
           Source directory (will be symlinked, if not null) for the files the
           built-in webserver should serve. SKS (''${pkgs.sks.webSamples})
@@ -96,7 +93,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     users = {
       users.sks = {

nixos/modules/services/security/sshguard.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.sshguard;
 
@@ -19,7 +16,7 @@ let
           "-o cat"
           "-n1"
         ]
-        ++ (map (name: "-t ${escapeShellArg name}") cfg.services)
+        ++ (map (name: "-t ${lib.escapeShellArg name}") cfg.services)
       );
       backend = if config.networking.nftables.enable then "sshg-fw-nft-sets" else "sshg-fw-ipset";
     in
@@ -36,40 +33,40 @@ in
   options = {
 
     services.sshguard = {
-      enable = mkOption {
+      enable = lib.mkOption {
         default = false;
-        type = types.bool;
+        type = lib.types.bool;
         description = "Whether to enable the sshguard service.";
       };
 
-      attack_threshold = mkOption {
+      attack_threshold = lib.mkOption {
         default = 30;
-        type = types.int;
+        type = lib.types.int;
         description = ''
           Block attackers when their cumulative attack score exceeds threshold. Most attacks have a score of 10.
         '';
       };
 
-      blacklist_threshold = mkOption {
+      blacklist_threshold = lib.mkOption {
         default = null;
         example = 120;
-        type = types.nullOr types.int;
+        type = lib.types.nullOr lib.types.int;
         description = ''
           Blacklist an attacker when its score exceeds threshold. Blacklisted addresses are loaded from and added to blacklist-file.
         '';
       };
 
-      blacklist_file = mkOption {
+      blacklist_file = lib.mkOption {
         default = "/var/lib/sshguard/blacklist.db";
-        type = types.path;
+        type = lib.types.path;
         description = ''
           Blacklist an attacker when its score exceeds threshold. Blacklisted addresses are loaded from and added to blacklist-file.
         '';
       };
 
-      blocktime = mkOption {
+      blocktime = lib.mkOption {
         default = 120;
-        type = types.int;
+        type = lib.types.int;
         description = ''
           Block attackers for initially blocktime seconds after exceeding threshold. Subsequent blocks increase by a factor of 1.5.
 
@@ -77,33 +74,33 @@ in
         '';
       };
 
-      detection_time = mkOption {
+      detection_time = lib.mkOption {
         default = 1800;
-        type = types.int;
+        type = lib.types.int;
         description = ''
           Remember potential attackers for up to detection_time seconds before resetting their score.
         '';
       };
 
-      whitelist = mkOption {
+      whitelist = lib.mkOption {
         default = [ ];
         example = [
           "198.51.100.56"
           "198.51.100.2"
         ];
-        type = types.listOf types.str;
+        type = lib.types.listOf lib.types.str;
         description = ''
           Whitelist a list of addresses, hostnames, or address blocks.
         '';
       };
 
-      services = mkOption {
+      services = lib.mkOption {
         default = [ "sshd" ];
         example = [
           "sshd"
           "exim"
         ];
-        type = types.listOf types.str;
+        type = lib.types.listOf lib.types.str;
         description = ''
           Systemd services sshguard should receive logs of.
         '';
@@ -113,7 +110,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     environment.etc."sshguard.conf".source = configFile;
 
@@ -122,7 +119,7 @@ in
 
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
-      partOf = optional config.networking.firewall.enable "firewall.service";
+      partOf = lib.optional config.networking.firewall.enable "firewall.service";
 
       restartTriggers = [ configFile ];
 
@@ -149,21 +146,21 @@ in
       # of the ipsets. So instead, we create both the ipsets and
       # firewall rules before sshguard starts.
       preStart =
-        optionalString config.networking.firewall.enable ''
+        lib.optionalString config.networking.firewall.enable ''
           ${pkgs.ipset}/bin/ipset -quiet create -exist sshguard4 hash:net family inet
           ${pkgs.iptables}/bin/iptables  -I INPUT -m set --match-set sshguard4 src -j DROP
         ''
-        + optionalString (config.networking.firewall.enable && config.networking.enableIPv6) ''
+        + lib.optionalString (config.networking.firewall.enable && config.networking.enableIPv6) ''
           ${pkgs.ipset}/bin/ipset -quiet create -exist sshguard6 hash:net family inet6
           ${pkgs.iptables}/bin/ip6tables -I INPUT -m set --match-set sshguard6 src -j DROP
         '';
 
       postStop =
-        optionalString config.networking.firewall.enable ''
+        lib.optionalString config.networking.firewall.enable ''
           ${pkgs.iptables}/bin/iptables  -D INPUT -m set --match-set sshguard4 src -j DROP
           ${pkgs.ipset}/bin/ipset -quiet destroy sshguard4
         ''
-        + optionalString (config.networking.firewall.enable && config.networking.enableIPv6) ''
+        + lib.optionalString (config.networking.firewall.enable && config.networking.enableIPv6) ''
           ${pkgs.iptables}/bin/ip6tables -D INPUT -m set --match-set sshguard6 src -j DROP
           ${pkgs.ipset}/bin/ipset -quiet destroy sshguard6
         '';
@@ -179,11 +176,11 @@ in
                 "-a ${toString cfg.attack_threshold}"
                 "-p ${toString cfg.blocktime}"
                 "-s ${toString cfg.detection_time}"
-                (optionalString (
+                (lib.optionalString (
                   cfg.blacklist_threshold != null
                 ) "-b ${toString cfg.blacklist_threshold}:${cfg.blacklist_file}")
               ]
-              ++ (map (name: "-w ${escapeShellArg name}") cfg.whitelist)
+              ++ (map (name: "-w ${lib.escapeShellArg name}") cfg.whitelist)
             );
           in
           "${pkgs.sshguard}/bin/sshguard ${args}";

nixos/modules/services/security/sslmate-agent.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.sslmate-agent;
 
@@ -16,11 +13,11 @@ in
 
   options = {
     services.sslmate-agent = {
-      enable = mkEnableOption "sslmate-agent, a daemon for managing SSL/TLS certificates on a server";
+      enable = lib.mkEnableOption "sslmate-agent, a daemon for managing SSL/TLS certificates on a server";
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = with pkgs; [ sslmate-agent ];
 
     systemd = {

nixos/modules/services/security/tang.nix

@@ -4,23 +4,22 @@
   pkgs,
   ...
 }:
-with lib;
 let
   cfg = config.services.tang;
 in
 {
   options.services.tang = {
-    enable = mkEnableOption "tang";
+    enable = lib.mkEnableOption "tang";
 
-    package = mkOption {
-      type = types.package;
+    package = lib.mkOption {
+      type = lib.types.package;
       default = pkgs.tang;
-      defaultText = literalExpression "pkgs.tang";
+      defaultText = lib.literalExpression "pkgs.tang";
       description = "The tang package to use.";
     };
 
-    listenStream = mkOption {
-      type = with types; listOf str;
+    listenStream = lib.mkOption {
+      type = with lib.types; listOf str;
       default = [ "7654" ];
       example = [
         "198.168.100.1:7654"
@@ -33,9 +32,9 @@ in
       '';
     };
 
-    ipAddressAllow = mkOption {
+    ipAddressAllow = lib.mkOption {
       example = [ "192.168.1.0/24" ];
-      type = types.listOf types.str;
+      type = lib.types.listOf lib.types.str;
       description = ''
         Whitelist a list of address prefixes.
         Preferably, internal addresses should be used.
@@ -43,7 +42,7 @@ in
     };
 
   };
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [ cfg.package ];
 
     systemd.services."tangd@" = {

nixos/modules/services/security/tor.nix

@@ -5,10 +5,7 @@
   pkgs,
   ...
 }:
-
 with builtins;
-with lib;
-
 let
   cfg = config.services.tor;
   opt = options.services.tor;
@@ -44,33 +41,33 @@ let
       ]);
   optionBool =
     optionName:
-    mkOption {
-      type = with types; nullOr bool;
+    lib.mkOption {
+      type = with lib.types; nullOr bool;
       default = null;
       description = (descriptionGeneric optionName);
     };
   optionInt =
     optionName:
-    mkOption {
-      type = with types; nullOr int;
+    lib.mkOption {
+      type = with lib.types; nullOr int;
       default = null;
       description = (descriptionGeneric optionName);
     };
   optionString =
     optionName:
-    mkOption {
-      type = with types; nullOr str;
+    lib.mkOption {
+      type = with lib.types; nullOr str;
       default = null;
       description = (descriptionGeneric optionName);
     };
   optionStrings =
     optionName:
-    mkOption {
-      type = with types; listOf str;
+    lib.mkOption {
+      type = with lib.types; listOf str;
       default = [ ];
       description = (descriptionGeneric optionName);
     };
-  optionAddress = mkOption {
+  optionAddress = lib.mkOption {
     type = with types; nullOr str;
     default = null;
     example = "0.0.0.0";
@@ -78,14 +75,14 @@ let
       IPv4 or IPv6 (if between brackets) address.
     '';
   };
-  optionUnix = mkOption {
+  optionUnix = lib.mkOption {
     type = with types; nullOr path;
     default = null;
     description = ''
       Unix domain socket path to use.
     '';
   };
-  optionPort = mkOption {
+  optionPort = lib.mkOption {
     type =
       with types;
       nullOr (oneOf [
@@ -96,13 +93,13 @@ let
   };
   optionPorts =
     optionName:
-    mkOption {
-      type = with types; listOf port;
+    lib.mkOption {
+      type = with lib.types; listOf port;
       default = [ ];
       description = (descriptionGeneric optionName);
     };
   optionIsolablePort =
-    with types;
+    with lib.types;
     oneOf [
       port
       (enum [ "auto" ])
@@ -114,14 +111,14 @@ let
               addr = optionAddress;
               port = optionPort;
               flags = optionFlags;
-              SessionGroup = mkOption {
+              SessionGroup = lib.mkOption {
                 type = nullOr int;
                 default = null;
               };
             }
-            // genAttrs isolateFlags (
+            // lib.genAttrs isolateFlags (
               name:
-              mkOption {
+              lib.mkOption {
                 type = types.bool;
                 default = false;
               }
@@ -136,9 +133,9 @@ let
     ];
   optionIsolablePorts =
     optionName:
-    mkOption {
+    lib.mkOption {
       default = [ ];
-      type = with types; either optionIsolablePort (listOf optionIsolablePort);
+      type = with lib.types; either optionIsolablePort (listOf optionIsolablePort);
       description = (descriptionGeneric optionName);
     };
   isolateFlags = [
@@ -171,7 +168,7 @@ let
         "WorldWritable"
       ] ++ isolateFlags;
     in
-    with types;
+    with lib.types;
     oneOf [
       port
       (submodule (
@@ -183,19 +180,19 @@ let
               addr = optionAddress;
               port = optionPort;
               flags = optionFlags;
-              SessionGroup = mkOption {
+              SessionGroup = lib.mkOption {
                 type = nullOr int;
                 default = null;
               };
             }
-            // genAttrs flags (
+            // lib.genAttrs flags (
               name:
-              mkOption {
+              lib.mkOption {
                 type = types.bool;
                 default = false;
               }
             );
-          config = mkIf doConfig {
+          config = lib.mkIf doConfig {
             # Only add flags in SOCKSPort to avoid duplicates
             flags =
               filter (name: config.${name} == true) flags
@@ -204,17 +201,17 @@ let
         }
       ))
     ];
-  optionFlags = mkOption {
+  optionFlags = lib.mkOption {
     type = with types; listOf str;
     default = [ ];
   };
   optionORPort =
     optionName:
-    mkOption {
+    lib.mkOption {
       default = [ ];
       example = 443;
       type =
-        with types;
+        with lib.types;
         oneOf [
           port
           (enum [ "auto" ])
@@ -238,9 +235,9 @@ let
                     port = optionPort;
                     flags = optionFlags;
                   }
-                  // genAttrs flags (
+                  // lib.genAttrs flags (
                     name:
-                    mkOption {
+                    lib.mkOption {
                       type = types.bool;
                       default = false;
                     }
@@ -256,15 +253,15 @@ let
     };
   optionBandwidth =
     optionName:
-    mkOption {
-      type = with types; nullOr (either int str);
+    lib.mkOption {
+      type = with lib.types; nullOr (either int str);
       default = null;
       description = (descriptionGeneric optionName);
     };
   optionPath =
     optionName:
-    mkOption {
-      type = with types; nullOr path;
+    lib.mkOption {
+      type = with lib.types; nullOr path;
       default = null;
       description = (descriptionGeneric optionName);
     };
@@ -323,119 +320,127 @@ let
 in
 {
   imports = [
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "tor" "client" "dns" "automapHostsSuffixes" ]
       [ "services" "tor" "settings" "AutomapHostsSuffixes" ]
     )
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "tor"
       "client"
       "dns"
       "isolationOptions"
     ] "Use services.tor.settings.DNSPort instead.")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "tor"
       "client"
       "dns"
       "listenAddress"
     ] "Use services.tor.settings.DNSPort instead.")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "tor"
       "client"
       "privoxy"
       "enable"
     ] "Use services.privoxy.enable and services.privoxy.enableTor instead.")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "tor"
       "client"
       "socksIsolationOptions"
     ] "Use services.tor.settings.SOCKSPort instead.")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "tor"
       "client"
       "socksListenAddressFaster"
     ] "Use services.tor.settings.SOCKSPort instead.")
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "tor" "client" "socksPolicy" ]
       [ "services" "tor" "settings" "SocksPolicy" ]
     )
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "tor"
       "client"
       "transparentProxy"
       "isolationOptions"
     ] "Use services.tor.settings.TransPort instead.")
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "tor"
       "client"
       "transparentProxy"
       "listenAddress"
     ] "Use services.tor.settings.TransPort instead.")
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "tor" "controlPort" ]
       [ "services" "tor" "settings" "ControlPort" ]
     )
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "tor"
       "extraConfig"
     ] "Please use services.tor.settings instead.")
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "tor" "hiddenServices" ]
       [ "services" "tor" "relay" "onionServices" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "tor" "relay" "accountingMax" ]
       [ "services" "tor" "settings" "AccountingMax" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "tor" "relay" "accountingStart" ]
       [ "services" "tor" "settings" "AccountingStart" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "tor" "relay" "address" ]
       [ "services" "tor" "settings" "Address" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "tor" "relay" "bandwidthBurst" ]
       [ "services" "tor" "settings" "BandwidthBurst" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "tor" "relay" "bandwidthRate" ]
       [ "services" "tor" "settings" "BandwidthRate" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "tor" "relay" "bridgeTransports" ]
       [ "services" "tor" "settings" "ServerTransportPlugin" "transports" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "tor" "relay" "contactInfo" ]
       [ "services" "tor" "settings" "ContactInfo" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "tor" "relay" "exitPolicy" ]
       [ "services" "tor" "settings" "ExitPolicy" ]
     )
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "tor"
       "relay"
       "isBridge"
     ] "Use services.tor.relay.role instead.")
-    (mkRemovedOptionModule [ "services" "tor" "relay" "isExit" ] "Use services.tor.relay.role instead.")
-    (mkRenamedOptionModule
+    (lib.mkRemovedOptionModule [
+      "services"
+      "tor"
+      "relay"
+      "isExit"
+    ] "Use services.tor.relay.role instead.")
+    (lib.mkRenamedOptionModule
       [ "services" "tor" "relay" "nickname" ]
       [ "services" "tor" "settings" "Nickname" ]
     )
-    (mkRenamedOptionModule [ "services" "tor" "relay" "port" ] [ "services" "tor" "settings" "ORPort" ])
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
+      [ "services" "tor" "relay" "port" ]
+      [ "services" "tor" "settings" "ORPort" ]
+    )
+    (lib.mkRenamedOptionModule
       [ "services" "tor" "relay" "portSpec" ]
       [ "services" "tor" "settings" "ORPort" ]
     )
@@ -443,17 +448,17 @@ in
 
   options = {
     services.tor = {
-      enable = mkEnableOption ''
+      enable = lib.mkEnableOption ''
         Tor daemon.
                 By default, the daemon is run without
                 relay, exit, bridge or client connectivity'';
 
-      openFirewall = mkEnableOption "opening of the relay port(s) in the firewall";
+      openFirewall = lib.mkEnableOption "opening of the relay port(s) in the firewall";
 
-      package = mkPackageOption pkgs "tor" { };
+      package = lib.mkPackageOption pkgs "tor" { };
 
       enableGeoIP =
-        mkEnableOption ''
+        lib.mkEnableOption ''
           use of GeoIP databases.
                   Disabling this will disable by-country statistics for bridges and relays
                   and some client and third-party software functionality''
@@ -461,19 +466,19 @@ in
           default = true;
         };
 
-      controlSocket.enable = mkEnableOption ''
+      controlSocket.enable = lib.mkEnableOption ''
         control socket,
                 created in `${runDir}/control`'';
 
       client = {
-        enable = mkEnableOption ''
+        enable = lib.mkEnableOption ''
           the routing of application connections.
                     You might want to disable this if you plan running a dedicated Tor relay'';
 
-        transparentProxy.enable = mkEnableOption "transparent proxy";
-        dns.enable = mkEnableOption "DNS resolver";
+        transparentProxy.enable = lib.mkEnableOption "transparent proxy";
+        dns.enable = lib.mkEnableOption "DNS resolver";
 
-        socksListenAddress = mkOption {
+        socksListenAddress = lib.mkOption {
           type = optionSOCKSPort false;
           default = {
             addr = "127.0.0.1";
@@ -491,7 +496,7 @@ in
           '';
         };
 
-        onionServices = mkOption {
+        onionServices = lib.mkOption {
           description = (descriptionGeneric "HiddenServiceDir");
           default = { };
           example = {
@@ -499,11 +504,11 @@ in
               clientAuthorizations = [ "/run/keys/tor/alice.prv.x25519" ];
             };
           };
-          type = types.attrsOf (
-            types.submodule (
+          type = lib.types.attrsOf (
+            lib.types.submodule (
               { name, config, ... }:
               {
-                options.clientAuthorizations = mkOption {
+                options.clientAuthorizations = lib.mkOption {
                   description = ''
                     Clients' authorizations for a v3 onion service,
                     as a list of files containing each one private key, in the format:
@@ -512,7 +517,7 @@ in
                     ```
                     ${descriptionGeneric "_client_authorization"}
                   '';
-                  type = with types; listOf path;
+                  type = with lib.types; listOf path;
                   default = [ ];
                   example = [ "/run/keys/tor/alice.prv.x25519" ];
                 };
@@ -523,7 +528,7 @@ in
       };
 
       relay = {
-        enable = mkEnableOption "tor relaying" // {
+        enable = lib.mkEnableOption "tor relaying" // {
           description = ''
             Whether to enable relaying of Tor traffic for others.
 
@@ -538,8 +543,8 @@ in
           '';
         };
 
-        role = mkOption {
-          type = types.enum [
+        role = lib.mkOption {
+          type = lib.types.enum [
             "exit"
             "relay"
             "bridge"
@@ -629,7 +634,7 @@ in
           '';
         };
 
-        onionServices = mkOption {
+        onionServices = lib.mkOption {
           description = (descriptionGeneric "HiddenServiceDir");
           default = { };
           example = {
@@ -640,12 +645,12 @@ in
               ];
             };
           };
-          type = types.attrsOf (
-            types.submodule (
+          type = lib.types.attrsOf (
+            lib.types.submodule (
               { name, config, ... }:
               {
-                options.path = mkOption {
-                  type = types.path;
+                options.path = lib.mkOption {
+                  type = lib.types.path;
                   description = ''
                     Path where to store the data files of the hidden service.
                     If the {option}`secretKey` is null
@@ -653,8 +658,8 @@ in
                     otherwise to `${runDir}/onion/$onion`.
                   '';
                 };
-                options.secretKey = mkOption {
-                  type = with types; nullOr path;
+                options.secretKey = lib.mkOption {
+                  type = with lib.types; nullOr path;
                   default = null;
                   example = "/run/keys/tor/onion/expyuzz4wqqyqhjn/hs_ed25519_secret_key";
                   description = ''
@@ -665,16 +670,16 @@ in
                     from this file if they do not exist.
                   '';
                 };
-                options.authorizeClient = mkOption {
+                options.authorizeClient = lib.mkOption {
                   description = (descriptionGeneric "HiddenServiceAuthorizeClient");
                   default = null;
-                  type = types.nullOr (
-                    types.submodule (
+                  type = lib.types.nullOr (
+                    lib.types.submodule (
                       { ... }:
                       {
                         options = {
-                          authType = mkOption {
-                            type = types.enum [
+                          authType = lib.mkOption {
+                            type = lib.types.enum [
                               "basic"
                               "stealth"
                             ];
@@ -684,8 +689,8 @@ in
                               that also hides service activity from unauthorized clients.
                             '';
                           };
-                          clientNames = mkOption {
-                            type = with types; nonEmptyListOf (strMatching "[A-Za-z0-9+-_]+");
+                          clientNames = lib.mkOption {
+                            type = with lib.types; nonEmptyListOf (strMatching "[A-Za-z0-9+-_]+");
                             description = ''
                               Only clients that are listed here are authorized to access the hidden service.
                               Generated authorization data can be found in {file}`${stateDir}/onion/$name/hostname`.
@@ -698,7 +703,7 @@ in
                     )
                   );
                 };
-                options.authorizedClients = mkOption {
+                options.authorizedClients = lib.mkOption {
                   description = ''
                     Authorized clients for a v3 onion service,
                     as a list of public key, in the format:
@@ -707,14 +712,14 @@ in
                     ```
                     ${descriptionGeneric "_client_authorization"}
                   '';
-                  type = with types; listOf str;
+                  type = with lib.types; listOf str;
                   default = [ ];
                   example = [ "descriptor:x25519:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" ];
                 };
-                options.map = mkOption {
+                options.map = lib.mkOption {
                   description = (descriptionGeneric "HiddenServicePort");
                   type =
-                    with types;
+                    with lib.types;
                     listOf (oneOf [
                       port
                       (submodule (
@@ -722,7 +727,7 @@ in
                         {
                           options = {
                             port = optionPort;
-                            target = mkOption {
+                            target = lib.mkOption {
                               default = null;
                               type = nullOr (
                                 submodule (
@@ -752,25 +757,25 @@ in
                       v
                   );
                 };
-                options.version = mkOption {
+                options.version = lib.mkOption {
                   description = (descriptionGeneric "HiddenServiceVersion");
                   type =
-                    with types;
+                    with lib.types;
                     nullOr (enum [
                       2
                       3
                     ]);
                   default = null;
                 };
-                options.settings = mkOption {
+                options.settings = lib.mkOption {
                   description = ''
                     Settings of the onion service.
                     ${descriptionGeneric "_hidden_service_options"}
                   '';
                   default = { };
-                  type = types.submodule {
+                  type = lib.types.submodule {
                     freeformType =
-                      with types;
+                      with lib.types;
                       (attrsOf (
                         nullOr (oneOf [
                           str
@@ -784,20 +789,20 @@ in
                       };
                     options.HiddenServiceAllowUnknownPorts = optionBool "HiddenServiceAllowUnknownPorts";
                     options.HiddenServiceDirGroupReadable = optionBool "HiddenServiceDirGroupReadable";
-                    options.HiddenServiceExportCircuitID = mkOption {
+                    options.HiddenServiceExportCircuitID = lib.mkOption {
                       description = (descriptionGeneric "HiddenServiceExportCircuitID");
-                      type = with types; nullOr (enum [ "haproxy" ]);
+                      type = with lib.types; nullOr (enum [ "haproxy" ]);
                       default = null;
                     };
-                    options.HiddenServiceMaxStreams = mkOption {
+                    options.HiddenServiceMaxStreams = lib.mkOption {
                       description = (descriptionGeneric "HiddenServiceMaxStreams");
-                      type = with types; nullOr (ints.between 0 65535);
+                      type = with lib.types; nullOr (ints.between 0 65535);
                       default = null;
                     };
                     options.HiddenServiceMaxStreamsCloseCircuit = optionBool "HiddenServiceMaxStreamsCloseCircuit";
-                    options.HiddenServiceNumIntroductionPoints = mkOption {
+                    options.HiddenServiceNumIntroductionPoints = lib.mkOption {
                       description = (descriptionGeneric "HiddenServiceNumIntroductionPoints");
-                      type = with types; nullOr (ints.between 0 20);
+                      type = with lib.types; nullOr (ints.between 0 20);
                       default = null;
                     };
                     options.HiddenServiceSingleHopMode = optionBool "HiddenServiceSingleHopMode";
@@ -822,15 +827,15 @@ in
         };
       };
 
-      settings = mkOption {
+      settings = lib.mkOption {
         description = ''
           See [torrc manual](https://2019.www.torproject.org/docs/tor-manual.html.en)
           for documentation.
         '';
         default = { };
-        type = types.submodule {
+        type = lib.types.submodule {
           freeformType =
-            with types;
+            with lib.types;
             (attrsOf (
               nullOr (oneOf [
                 str
@@ -872,10 +877,10 @@ in
           options.CellStatistics = optionBool "CellStatistics";
           options.ClientAutoIPv6ORPort = optionBool "ClientAutoIPv6ORPort";
           options.ClientDNSRejectInternalAddresses = optionBool "ClientDNSRejectInternalAddresses";
-          options.ClientOnionAuthDir = mkOption {
+          options.ClientOnionAuthDir = lib.mkOption {
             description = (descriptionGeneric "ClientOnionAuthDir");
             default = null;
-            type = with types; nullOr path;
+            type = with lib.types; nullOr path;
           };
           options.ClientPreferIPv6DirPort = optionBool "ClientPreferIPv6DirPort"; # default is null and like "auto"
           options.ClientPreferIPv6ORPort = optionBool "ClientPreferIPv6ORPort"; # default is null and like "auto"
@@ -885,12 +890,12 @@ in
           options.ConnDirectionStatistics = optionBool "ConnDirectionStatistics";
           options.ConstrainedSockets = optionBool "ConstrainedSockets";
           options.ContactInfo = optionString "ContactInfo";
-          options.ControlPort = mkOption rec {
+          options.ControlPort = lib.mkOption rec {
             description = (descriptionGeneric "ControlPort");
             default = [ ];
             example = [ { port = 9051; } ];
             type =
-              with types;
+              with lib.types;
               oneOf [
                 port
                 (enum [ "auto" ])
@@ -914,9 +919,9 @@ in
                           addr = optionAddress;
                           port = optionPort;
                         }
-                        // genAttrs flags (
+                        // lib.genAttrs flags (
                           name:
-                          mkOption {
+                          lib.mkOption {
                             type = types.bool;
                             default = false;
                           }
@@ -946,9 +951,9 @@ in
           options.DormantOnFirstStartup = optionBool "DormantOnFirstStartup";
           options.DormantTimeoutDisabledByIdleStreams = optionBool "DormantTimeoutDisabledByIdleStreams";
           options.DirCache = optionBool "DirCache";
-          options.DirPolicy = mkOption {
+          options.DirPolicy = lib.mkOption {
             description = (descriptionGeneric "DirPolicy");
-            type = with types; listOf str;
+            type = with lib.types; listOf str;
             default = [ ];
             example = [ "accept *:*" ];
           };
@@ -973,11 +978,11 @@ in
           options.ExitPolicyRejectPrivate = optionBool "ExitPolicyRejectPrivate";
           options.ExitPortStatistics = optionBool "ExitPortStatistics";
           options.ExitRelay = optionBool "ExitRelay"; # default is null and like "auto"
-          options.ExtORPort = mkOption {
+          options.ExtORPort = lib.mkOption {
             description = (descriptionGeneric "ExtORPort");
             default = null;
             type =
-              with types;
+              with lib.types;
               nullOr (oneOf [
                 port
                 (enum [ "auto" ])
@@ -1009,20 +1014,20 @@ in
           options.GeoIPFile = optionPath "GeoIPFile";
           options.GeoIPv6File = optionPath "GeoIPv6File";
           options.GuardfractionFile = optionPath "GuardfractionFile";
-          options.HidServAuth = mkOption {
+          options.HidServAuth = lib.mkOption {
             description = (descriptionGeneric "HidServAuth");
             default = [ ];
             type =
-              with types;
+              with lib.types;
               listOf (oneOf [
                 (submodule {
                   options = {
-                    onion = mkOption {
+                    onion = lib.mkOption {
                       type = strMatching "[a-z2-7]{16}\\.onion";
                       description = "Onion address.";
                       example = "xxxxxxxxxxxxxxxx.onion";
                     };
-                    auth = mkOption {
+                    auth = lib.mkOption {
                       type = strMatching "[A-Za-z0-9+/]{22}";
                       description = "Authentication cookie.";
                     };
@@ -1062,10 +1067,10 @@ in
           options.PidFile = optionPath "PidFile";
           options.ProtocolWarnings = optionBool "ProtocolWarnings";
           options.PublishHidServDescriptors = optionBool "PublishHidServDescriptors";
-          options.PublishServerDescriptor = mkOption {
+          options.PublishServerDescriptor = lib.mkOption {
             description = (descriptionGeneric "PublishServerDescriptor");
             type =
-              with types;
+              with lib.types;
               nullOr (enum [
                 false
                 true
@@ -1091,17 +1096,17 @@ in
           options.ServerDNSRandomizeCase = optionBool "ServerDNSRandomizeCase";
           options.ServerDNSResolvConfFile = optionPath "ServerDNSResolvConfFile";
           options.ServerDNSSearchDomains = optionBool "ServerDNSSearchDomains";
-          options.ServerTransportPlugin = mkOption {
+          options.ServerTransportPlugin = lib.mkOption {
             description = (descriptionGeneric "ServerTransportPlugin");
             default = null;
             type =
-              with types;
+              with lib.types;
               nullOr (
                 submodule (
                   { ... }:
                   {
                     options = {
-                      transports = mkOption {
+                      transports = lib.mkOption {
                         description = "List of pluggable transports.";
                         type = listOf str;
                         example = [
@@ -1111,7 +1116,7 @@ in
                           "scramblesuit"
                         ];
                       };
-                      exec = mkOption {
+                      exec = lib.mkOption {
                         type = types.str;
                         description = "Command of pluggable transport.";
                       };
@@ -1120,31 +1125,31 @@ in
                 )
               );
           };
-          options.ShutdownWaitLength = mkOption {
-            type = types.int;
+          options.ShutdownWaitLength = lib.mkOption {
+            type = lib.types.int;
             default = 30;
             description = (descriptionGeneric "ShutdownWaitLength");
           };
           options.SocksPolicy = optionStrings "SocksPolicy" // {
             example = [ "accept *:*" ];
           };
-          options.SOCKSPort = mkOption {
+          options.SOCKSPort = lib.mkOption {
             description = (descriptionGeneric "SOCKSPort");
             default = lib.optionals cfg.settings.HiddenServiceNonAnonymousMode [ { port = 0; } ];
-            defaultText = literalExpression ''
+            defaultText = lib.literalExpression ''
               if config.${opt.settings}.HiddenServiceNonAnonymousMode == true
               then [ { port = 0; } ]
               else [ ]
             '';
             example = [ { port = 9090; } ];
-            type = types.listOf (optionSOCKSPort true);
+            type = lib.types.listOf (optionSOCKSPort true);
           };
           options.TestingTorNetwork = optionBool "TestingTorNetwork";
           options.TransPort = optionIsolablePorts "TransPort";
-          options.TransProxyType = mkOption {
+          options.TransProxyType = lib.mkOption {
             description = (descriptionGeneric "TransProxyType");
             type =
-              with types;
+              with lib.types;
               nullOr (enum [
                 "default"
                 "TPROXY"
@@ -1168,7 +1173,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     # Not sure if `cfg.relay.role == "private-bridge"` helps as tor
     # sends a lot of stats
     warnings =
@@ -1295,7 +1300,7 @@ in
       ))
     ];
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts =
         concatMap
           (

nixos/modules/services/security/torify.nix

@@ -4,7 +4,6 @@
   pkgs,
   ...
 }:
-with lib;
 let
 
   cfg = config.services.tor;
@@ -29,8 +28,8 @@ in
 
     services.tor.tsocks = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to build tsocks wrapper script to relay application traffic via Tor.
@@ -45,8 +44,8 @@ in
         '';
       };
 
-      server = mkOption {
-        type = types.str;
+      server = lib.mkOption {
+        type = lib.types.str;
         default = "localhost:9050";
         example = "192.168.0.20";
         description = ''
@@ -54,8 +53,8 @@ in
         '';
       };
 
-      config = mkOption {
-        type = types.lines;
+      config = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         description = ''
           Extra configuration. Contents will be added verbatim to TSocks
@@ -69,13 +68,13 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.tsocks.enable {
+  config = lib.mkIf cfg.tsocks.enable {
 
     environment.systemPackages = [ torify ]; # expose it to the users
 
     services.tor.tsocks.config = ''
-      server = ${toString (head (splitString ":" cfg.tsocks.server))}
-      server_port = ${toString (tail (splitString ":" cfg.tsocks.server))}
+      server = ${toString (lib.head (lib.splitString ":" cfg.tsocks.server))}
+      server_port = ${toString (lib.tail (lib.splitString ":" cfg.tsocks.server))}
 
       local = 127.0.0.0/255.128.0.0
       local = 127.128.0.0/255.192.0.0

nixos/modules/services/security/torsocks.nix

@@ -1,14 +1,11 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.tor.torsocks;
-  optionalNullStr = b: v: optionalString (b != null) v;
+  optionalNullStr = b: v: lib.optionalString (b != null) v;
 
   configFile = server: ''
-    TorAddress ${toString (head (splitString ":" server))}
-    TorPort    ${toString (tail (splitString ":" server))}
+    TorAddress ${toString (lib.head (lib.splitString ":" server))}
+    TorPort    ${toString (lib.tail (lib.splitString ":" server))}
 
     OnionAddrRange ${cfg.onionAddrRange}
 
@@ -34,18 +31,18 @@ in
 {
   options = {
     services.tor.torsocks = {
-      enable = mkOption {
-        type        = types.bool;
+      enable = lib.mkOption {
+        type        = lib.types.bool;
         default     = config.services.tor.enable && config.services.tor.client.enable;
-        defaultText = literalExpression "config.services.tor.enable && config.services.tor.client.enable";
+        defaultText = lib.literalExpression "config.services.tor.enable && config.services.tor.client.enable";
         description = ''
           Whether to build `/etc/tor/torsocks.conf`
           containing the specified global torsocks configuration.
         '';
       };
 
-      server = mkOption {
-        type    = types.str;
+      server = lib.mkOption {
+        type    = lib.types.str;
         default = "127.0.0.1:9050";
         example = "192.168.0.20:1234";
         description = ''
@@ -54,8 +51,8 @@ in
         '';
       };
 
-      fasterServer = mkOption {
-        type    = types.str;
+      fasterServer = lib.mkOption {
+        type    = lib.types.str;
         default = "127.0.0.1:9063";
         example = "192.168.0.20:1234";
         description = ''
@@ -64,8 +61,8 @@ in
         '';
       };
 
-      onionAddrRange = mkOption {
-        type    = types.str;
+      onionAddrRange = lib.mkOption {
+        type    = lib.types.str;
         default = "127.42.42.0/24";
         description = ''
           Tor hidden sites do not have real IP addresses. This
@@ -77,8 +74,8 @@ in
         '';
       };
 
-      socks5Username = mkOption {
-        type    = types.nullOr types.str;
+      socks5Username = lib.mkOption {
+        type    = lib.types.nullOr lib.types.str;
         default = null;
         example = "bob";
         description = ''
@@ -87,8 +84,8 @@ in
         '';
       };
 
-      socks5Password = mkOption {
-        type    = types.nullOr types.str;
+      socks5Password = lib.mkOption {
+        type    = lib.types.nullOr lib.types.str;
         default = null;
         example = "sekret";
         description = ''
@@ -97,8 +94,8 @@ in
         '';
       };
 
-      allowInbound = mkOption {
-        type    = types.bool;
+      allowInbound = lib.mkOption {
+        type    = lib.types.bool;
         default = false;
         description = ''
           Set Torsocks to accept inbound connections. If set to
@@ -110,7 +107,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [ pkgs.torsocks (wrapTorsocks "torsocks-faster" cfg.fasterServer) ];
 
     environment.etc."tor/torsocks.conf" =

nixos/modules/services/security/usbguard.nix

@@ -4,14 +4,12 @@
   pkgs,
   ...
 }:
-
-with lib;
 let
   cfg = config.services.usbguard;
 
   # valid policy options
   policy = (
-    types.enum [
+    lib.types.enum [
       "allow"
       "block"
       "reject"
@@ -30,13 +28,13 @@ let
     PresentDevicePolicy=${cfg.presentDevicePolicy}
     PresentControllerPolicy=${cfg.presentControllerPolicy}
     InsertedDevicePolicy=${cfg.insertedDevicePolicy}
-    RestoreControllerDeviceState=${boolToString cfg.restoreControllerDeviceState}
+    RestoreControllerDeviceState=${lib.boolToString cfg.restoreControllerDeviceState}
     # this does not seem useful for endusers to change
     DeviceManagerBackend=uevent
-    IPCAllowedUsers=${concatStringsSep " " cfg.IPCAllowedUsers}
-    IPCAllowedGroups=${concatStringsSep " " cfg.IPCAllowedGroups}
+    IPCAllowedUsers=${lib.concatStringsSep " " cfg.IPCAllowedUsers}
+    IPCAllowedGroups=${lib.concatStringsSep " " cfg.IPCAllowedGroups}
     IPCAccessControlFiles=/var/lib/usbguard/IPCAccessControl.d/
-    DeviceRulesWithPort=${boolToString cfg.deviceRulesWithPort}
+    DeviceRulesWithPort=${lib.boolToString cfg.deviceRulesWithPort}
     # HACK: that way audit logs still land in the journal
     AuditFilePath=/dev/null
   '';
@@ -50,16 +48,16 @@ in
 
   options = {
     services.usbguard = {
-      enable = mkEnableOption "USBGuard daemon";
+      enable = lib.mkEnableOption "USBGuard daemon";
 
-      package = mkPackageOption pkgs "usbguard" {
+      package = lib.mkPackageOption pkgs "usbguard" {
         extraDescription = ''
           If you do not need the Qt GUI, use `pkgs.usbguard-nox` to save disk space.
         '';
       };
 
-      ruleFile = mkOption {
-        type = types.nullOr types.path;
+      ruleFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = "/var/lib/usbguard/rules.conf";
         example = "/run/secrets/usbguard-rules";
         description = ''
@@ -71,8 +69,8 @@ in
         '';
 
       };
-      rules = mkOption {
-        type = types.nullOr types.lines;
+      rules = lib.mkOption {
+        type = lib.types.nullOr lib.types.lines;
         default = null;
         example = ''
           allow with-interface equals { 08:*:* }
@@ -92,8 +90,8 @@ in
         '';
       };
 
-      implicitPolicyTarget = mkOption {
-        type = types.enum [
+      implicitPolicyTarget = lib.mkOption {
+        type = lib.types.enum [
           "allow"
           "block"
           "reject"
@@ -106,7 +104,7 @@ in
         '';
       };
 
-      presentDevicePolicy = mkOption {
+      presentDevicePolicy = lib.mkOption {
         type = policy;
         default = "apply-policy";
         description = ''
@@ -117,7 +115,7 @@ in
         '';
       };
 
-      presentControllerPolicy = mkOption {
+      presentControllerPolicy = lib.mkOption {
         type = policy;
         default = "keep";
         description = ''
@@ -126,8 +124,8 @@ in
         '';
       };
 
-      insertedDevicePolicy = mkOption {
-        type = types.enum [
+      insertedDevicePolicy = lib.mkOption {
+        type = lib.types.enum [
           "block"
           "reject"
           "apply-policy"
@@ -139,8 +137,8 @@ in
         '';
       };
 
-      restoreControllerDeviceState = mkOption {
-        type = types.bool;
+      restoreControllerDeviceState = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           The  USBGuard  daemon  modifies  some attributes of controller
@@ -151,8 +149,8 @@ in
         '';
       };
 
-      IPCAllowedUsers = mkOption {
-        type = types.listOf types.str;
+      IPCAllowedUsers = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ "root" ];
         example = [
           "root"
@@ -163,8 +161,8 @@ in
         '';
       };
 
-      IPCAllowedGroups = mkOption {
-        type = types.listOf types.str;
+      IPCAllowedGroups = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ ];
         example = [ "wheel" ];
         description = ''
@@ -173,21 +171,21 @@ in
         '';
       };
 
-      deviceRulesWithPort = mkOption {
-        type = types.bool;
+      deviceRulesWithPort = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Generate device specific rules including the "via-port" attribute.
         '';
       };
 
-      dbus.enable = mkEnableOption "USBGuard dbus daemon";
+      dbus.enable = lib.mkEnableOption "USBGuard dbus daemon";
     };
   };
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     environment.systemPackages = [ cfg.package ];
 
@@ -239,7 +237,7 @@ in
         };
       };
 
-      usbguard-dbus = mkIf cfg.dbus.enable {
+      usbguard-dbus = lib.mkIf cfg.dbus.enable {
         description = "USBGuard D-Bus Service";
 
         wantedBy = [ "multi-user.target" ];
@@ -261,7 +259,7 @@ in
         groupCheck =
           (lib.concatStrings (map (g: "subject.isInGroup(\"${g}\") || ") cfg.IPCAllowedGroups)) + "false";
       in
-      optionalString cfg.dbus.enable ''
+      lib.optionalString cfg.dbus.enable ''
         polkit.addRule(function(action, subject) {
             if ((action.id == "org.usbguard.Policy1.listRules" ||
                  action.id == "org.usbguard.Policy1.appendRule" ||
@@ -278,15 +276,15 @@ in
       '';
   };
   imports = [
-    (mkRemovedOptionModule [ "services" "usbguard" "IPCAccessControlFiles" ]
+    (lib.mkRemovedOptionModule [ "services" "usbguard" "IPCAccessControlFiles" ]
       "The usbguard module now hardcodes IPCAccessControlFiles to /var/lib/usbguard/IPCAccessControl.d."
     )
-    (mkRemovedOptionModule [
+    (lib.mkRemovedOptionModule [
       "services"
       "usbguard"
       "auditFilePath"
     ] "Removed usbguard module audit log files. Audit logs can be found in the systemd journal.")
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "usbguard" "implictPolicyTarget" ]
       [ "services" "usbguard" "implicitPolicyTarget" ]
     )

nixos/modules/services/security/vault-agent.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   format = pkgs.formats.json { };
   commonOptions =
@@ -14,26 +11,26 @@ let
       pkgName,
       flavour ? pkgName,
     }:
-    mkOption {
+    lib.mkOption {
       default = { };
       description = ''
         Attribute set of ${flavour} instances.
         Creates independent `${flavour}-''${name}.service` systemd units for each instance defined here.
       '';
       type =
-        with types;
+        with lib.types;
         attrsOf (
           submodule (
             { name, ... }:
             {
               options = {
-                enable = mkEnableOption "this ${flavour} instance" // {
+                enable = lib.mkEnableOption "this ${flavour} instance" // {
                   default = true;
                 };
 
-                package = mkPackageOption pkgs pkgName { };
+                package = lib.mkPackageOption pkgs pkgName { };
 
-                user = mkOption {
+                user = lib.mkOption {
                   type = types.str;
                   default = "root";
                   description = ''
@@ -41,7 +38,7 @@ let
                   '';
                 };
 
-                group = mkOption {
+                group = lib.mkOption {
                   type = types.str;
                   default = "root";
                   description = ''
@@ -49,12 +46,12 @@ let
                   '';
                 };
 
-                settings = mkOption {
+                settings = lib.mkOption {
                   type = types.submodule {
                     freeformType = format.type;
 
                     options = {
-                      pid_file = mkOption {
+                      pid_file = lib.mkOption {
                         default = "/run/${flavour}/${name}.pid";
                         type = types.str;
                         description = ''
@@ -62,7 +59,7 @@ let
                         '';
                       };
 
-                      template = mkOption {
+                      template = lib.mkOption {
                         default = null;
                         type = with types; nullOr (listOf (attrsOf anything));
                         description =
@@ -116,7 +113,7 @@ let
     let
       configFile = format.generate "${name}.json" instance.settings;
     in
-    mkIf (instance.enable) {
+    lib.mkIf (instance.enable) {
       description = "${flavour} daemon - ${name}";
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
@@ -127,8 +124,8 @@ let
         User = instance.user;
         Group = instance.group;
         RuntimeDirectory = flavour;
-        ExecStart = "${getExe instance.package} ${
-          optionalString ((getName instance.package) == "vault") "agent"
+        ExecStart = "${lib.getExe instance.package} ${
+          lib.optionalString ((lib.getName instance.package) == "vault") "agent"
         } -config ${configFile}";
         ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID";
         KillSignal = "SIGINT";
@@ -146,17 +143,17 @@ in
     };
   };
 
-  config = mkMerge (
+  config = lib.mkMerge (
     map
       (
         flavour:
         let
           cfg = config.services.${flavour};
         in
-        mkIf (cfg.instances != { }) {
-          systemd.services = mapAttrs' (
+        lib.mkIf (cfg.instances != { }) {
+          systemd.services = lib.mapAttrs' (
             name: instance:
-            nameValuePair "${flavour}-${name}" (createAgentInstance {
+            lib.nameValuePair "${flavour}-${name}" (createAgentInstance {
               inherit name instance flavour;
             })
           ) cfg.instances;
@@ -168,7 +165,7 @@ in
       ]
   );
 
-  meta.maintainers = with maintainers; [
+  meta.maintainers = with lib.maintainers; [
     emilylange
     tcheronneau
   ];

nixos/modules/services/security/vault.nix

@@ -5,9 +5,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.vault;
   opt = options.services.vault;
@@ -32,10 +29,10 @@ let
       }
     ''}
     storage "${cfg.storageBackend}" {
-      ${optionalString (cfg.storagePath != null) ''path = "${cfg.storagePath}"''}
-      ${optionalString (cfg.storageConfig != null) cfg.storageConfig}
+      ${lib.optionalString (cfg.storagePath != null) ''path = "${cfg.storagePath}"''}
+      ${lib.optionalString (cfg.storageConfig != null) cfg.storageConfig}
     }
-    ${optionalString (cfg.telemetryConfig != "") ''
+    ${lib.optionalString (cfg.telemetryConfig != "") ''
       telemetry {
         ${cfg.telemetryConfig}
       }
@@ -44,10 +41,10 @@ let
   '';
 
   allConfigPaths = [ configFile ] ++ cfg.extraSettingsPaths;
-  configOptions = escapeShellArgs (
+  configOptions = lib.escapeShellArgs (
     lib.optional cfg.dev "-dev"
     ++ lib.optional (cfg.dev && cfg.devRootTokenID != null) "-dev-root-token-id=${cfg.devRootTokenID}"
-    ++ (concatMap (p: [
+    ++ (lib.concatMap (p: [
       "-config"
       p
     ]) allConfigPaths)
@@ -58,56 +55,56 @@ in
 {
   options = {
     services.vault = {
-      enable = mkEnableOption "Vault daemon";
+      enable = lib.mkEnableOption "Vault daemon";
 
-      package = mkPackageOption pkgs "vault" { };
+      package = lib.mkPackageOption pkgs "vault" { };
 
-      dev = mkOption {
-        type = types.bool;
+      dev = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           In this mode, Vault runs in-memory and starts unsealed. This option is not meant production but for development and testing i.e. for nixos tests.
         '';
       };
 
-      devRootTokenID = mkOption {
-        type = types.nullOr types.str;
+      devRootTokenID = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           Initial root token. This only applies when {option}`services.vault.dev` is true
         '';
       };
 
-      address = mkOption {
-        type = types.str;
+      address = lib.mkOption {
+        type = lib.types.str;
         default = "127.0.0.1:8200";
         description = "The name of the ip interface to listen to";
       };
 
-      tlsCertFile = mkOption {
-        type = types.nullOr types.str;
+      tlsCertFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         example = "/path/to/your/cert.pem";
         description = "TLS certificate file. TLS will be disabled unless this option is set";
       };
 
-      tlsKeyFile = mkOption {
-        type = types.nullOr types.str;
+      tlsKeyFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         example = "/path/to/your/key.pem";
         description = "TLS private key file. TLS will be disabled unless this option is set";
       };
 
-      listenerExtraConfig = mkOption {
-        type = types.lines;
+      listenerExtraConfig = lib.mkOption {
+        type = lib.types.lines;
         default = ''
           tls_min_version = "tls12"
         '';
         description = "Extra text appended to the listener section.";
       };
 
-      storageBackend = mkOption {
-        type = types.enum [
+      storageBackend = lib.mkOption {
+        type = lib.types.enum [
           "inmem"
           "file"
           "consul"
@@ -127,11 +124,11 @@ in
         description = "The name of the type of storage backend";
       };
 
-      storagePath = mkOption {
-        type = types.nullOr types.path;
+      storagePath = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default =
           if cfg.storageBackend == "file" || cfg.storageBackend == "raft" then "/var/lib/vault" else null;
-        defaultText = literalExpression ''
+        defaultText = lib.literalExpression ''
           if config.${opt.storageBackend} == "file" || cfg.storageBackend == "raft"
           then "/var/lib/vault"
           else null
@@ -139,8 +136,8 @@ in
         description = "Data directory for file backend";
       };
 
-      storageConfig = mkOption {
-        type = types.nullOr types.lines;
+      storageConfig = lib.mkOption {
+        type = lib.types.nullOr lib.types.lines;
         default = null;
         description = ''
           HCL configuration to insert in the storageBackend section.
@@ -152,20 +149,20 @@ in
         '';
       };
 
-      telemetryConfig = mkOption {
-        type = types.lines;
+      telemetryConfig = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         description = "Telemetry configuration";
       };
 
-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         description = "Extra text appended to {file}`vault.hcl`.";
       };
 
-      extraSettingsPaths = mkOption {
-        type = types.listOf types.path;
+      extraSettingsPaths = lib.mkOption {
+        type = lib.types.listOf lib.types.path;
         default = [ ];
         description = ''
           Configuration files to load besides the immutable one defined by the NixOS module.
@@ -196,7 +193,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     assertions = [
       {
         assertion = cfg.storageBackend == "inmem" -> (cfg.storagePath == null && cfg.storageConfig == null);
@@ -219,7 +216,7 @@ in
     };
     users.groups.vault.gid = config.ids.gids.vault;
 
-    systemd.tmpfiles.rules = optional (
+    systemd.tmpfiles.rules = lib.optional (
       cfg.storagePath != null
     ) "d '${cfg.storagePath}' 0700 vault vault - -";
 
@@ -227,9 +224,11 @@ in
       description = "Vault server daemon";
 
       wantedBy = [ "multi-user.target" ];
-      after = [
-        "network.target"
-      ] ++ optional (config.services.consul.enable && cfg.storageBackend == "consul") "consul.service";
+      after =
+        [
+          "network.target"
+        ]
+        ++ lib.optional (config.services.consul.enable && cfg.storageBackend == "consul") "consul.service";
 
       restartIfChanged = false; # do not restart on "nixos-rebuild switch". It would seal the storage and disrupt the clients.
 
@@ -255,7 +254,7 @@ in
         Restart = "on-failure";
       };
 
-      unitConfig.RequiresMountsFor = optional (cfg.storagePath != null) cfg.storagePath;
+      unitConfig.RequiresMountsFor = lib.optional (cfg.storagePath != null) cfg.storagePath;
     };
   };
 

nixos/modules/services/security/yubikey-agent.nix

@@ -1,21 +1,17 @@
 # Global configuration for yubikey-agent.
-
 {
   config,
   lib,
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.yubikey-agent;
 in
 {
   ###### interface
 
-  meta.maintainers = with maintainers; [
+  meta.maintainers = with lib.maintainers; [
     philandstuff
     rawkode
   ];
@@ -23,8 +19,8 @@ in
   options = {
 
     services.yubikey-agent = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to start yubikey-agent when you log in.  Also sets
@@ -35,20 +31,22 @@ in
         '';
       };
 
-      package = mkPackageOption pkgs "yubikey-agent" { };
+      package = lib.mkPackageOption pkgs "yubikey-agent" { };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [ cfg.package ];
     systemd.packages = [ cfg.package ];
 
     # This overrides the systemd user unit shipped with the
     # yubikey-agent package
-    systemd.user.services.yubikey-agent = mkIf (config.programs.gnupg.agent.pinentryPackage != null) {
-      path = [ config.programs.gnupg.agent.pinentryPackage ];
-      wantedBy = [ "default.target" ];
-    };
+    systemd.user.services.yubikey-agent =
+      lib.mkIf (config.programs.gnupg.agent.pinentryPackage != null)
+        {
+          path = [ config.programs.gnupg.agent.pinentryPackage ];
+          wantedBy = [ "default.target" ];
+        };
 
     # Yubikey-agent expects pcsd to be running in order to function.
     services.pcscd.enable = true;

nixos/modules/services/system/automatic-timezoned.nix

@@ -4,17 +4,14 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.automatic-timezoned;
 in
 {
   options = {
     services.automatic-timezoned = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Enable `automatic-timezoned`, simple daemon for keeping the system
@@ -28,11 +25,11 @@ in
           to make the choice deliberate. An error will be presented otherwise.
         '';
       };
-      package = mkPackageOption pkgs "automatic-timezoned" { };
+      package = lib.mkPackageOption pkgs "automatic-timezoned" { };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     # This will give users an error if they have set an explicit time
     # zone, rather than having the service silently override it.
     time.timeZone = null;

nixos/modules/services/system/cachix-agent/default.nix

@@ -4,9 +4,6 @@
   lib,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.cachix-agent;
 in
@@ -14,37 +11,37 @@ in
   meta.maintainers = [ lib.maintainers.domenkozar ];
 
   options.services.cachix-agent = {
-    enable = mkEnableOption "Cachix Deploy Agent: https://docs.cachix.org/deploy/";
+    enable = lib.mkEnableOption "Cachix Deploy Agent: https://docs.cachix.org/deploy/";
 
-    name = mkOption {
-      type = types.str;
+    name = lib.mkOption {
+      type = lib.types.str;
       description = "Agent name, usually same as the hostname";
       default = config.networking.hostName;
       defaultText = "config.networking.hostName";
     };
 
-    verbose = mkOption {
-      type = types.bool;
+    verbose = lib.mkOption {
+      type = lib.types.bool;
       description = "Enable verbose output";
       default = false;
     };
 
-    profile = mkOption {
-      type = types.nullOr types.str;
+    profile = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       default = null;
       description = "Profile name, defaults to 'system' (NixOS).";
     };
 
-    host = mkOption {
-      type = types.nullOr types.str;
+    host = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       default = null;
       description = "Cachix uri to use.";
     };
 
-    package = mkPackageOption pkgs "cachix" { };
+    package = lib.mkPackageOption pkgs "cachix" { };
 
-    credentialsFile = mkOption {
-      type = types.path;
+    credentialsFile = lib.mkOption {
+      type = lib.types.path;
       default = "/etc/cachix-agent.token";
       description = ''
         Required file that needs to contain CACHIX_AGENT_TOKEN=...
@@ -52,7 +49,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.cachix-agent = {
       description = "Cachix Deploy Agent";
       wants = [ "network-online.target" ];
@@ -76,7 +73,7 @@ in
           ${cfg.package}/bin/cachix ${lib.optionalString cfg.verbose "--verbose"} ${
             lib.optionalString (cfg.host != null) "--host ${cfg.host}"
           } \
-            deploy agent ${cfg.name} ${optionalString (cfg.profile != null) cfg.profile}
+            deploy agent ${cfg.name} ${lib.optionalString (cfg.profile != null) cfg.profile}
         '';
       };
     };

nixos/modules/services/system/cachix-watch-store.nix

@@ -4,9 +4,6 @@
   lib,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.cachix-watch-store;
 in
@@ -17,56 +14,56 @@ in
   ];
 
   options.services.cachix-watch-store = {
-    enable = mkEnableOption "Cachix Watch Store: https://docs.cachix.org";
+    enable = lib.mkEnableOption "Cachix Watch Store: https://docs.cachix.org";
 
-    cacheName = mkOption {
-      type = types.str;
+    cacheName = lib.mkOption {
+      type = lib.types.str;
       description = "Cachix binary cache name";
     };
 
-    cachixTokenFile = mkOption {
-      type = types.path;
+    cachixTokenFile = lib.mkOption {
+      type = lib.types.path;
       description = ''
         Required file that needs to contain the cachix auth token.
       '';
     };
 
-    signingKeyFile = mkOption {
-      type = types.nullOr types.path;
+    signingKeyFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
       description = ''
         Optional file containing a self-managed signing key to sign uploaded store paths.
       '';
       default = null;
     };
 
-    compressionLevel = mkOption {
-      type = types.nullOr types.int;
+    compressionLevel = lib.mkOption {
+      type = lib.types.nullOr lib.types.int;
       description = "The compression level for ZSTD compression (between 0 and 16)";
       default = null;
     };
 
-    jobs = mkOption {
-      type = types.nullOr types.int;
+    jobs = lib.mkOption {
+      type = lib.types.nullOr lib.types.int;
       description = "Number of threads used for pushing store paths";
       default = null;
     };
 
-    host = mkOption {
-      type = types.nullOr types.str;
+    host = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       default = null;
       description = "Cachix host to connect to";
     };
 
-    verbose = mkOption {
-      type = types.bool;
+    verbose = lib.mkOption {
+      type = lib.types.bool;
       description = "Enable verbose output";
       default = false;
     };
 
-    package = mkPackageOption pkgs "cachix" { };
+    package = lib.mkPackageOption pkgs "cachix" { };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.cachix-watch-store-agent = {
       description = "Cachix watch store Agent";
       wants = [ "network-online.target" ];

nixos/modules/services/system/cloud-init.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.cloud-init;
   path =
@@ -31,8 +28,8 @@ in
 {
   options = {
     services.cloud-init = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Enable the cloud-init service. This services reads
@@ -50,35 +47,35 @@ in
         '';
       };
 
-      btrfs.enable = mkOption {
-        type = types.bool;
+      btrfs.enable = lib.mkOption {
+        type = lib.types.bool;
         default = hasFs "btrfs";
-        defaultText = literalExpression ''hasFs "btrfs"'';
+        defaultText = lib.literalExpression ''hasFs "btrfs"'';
         description = ''
           Allow the cloud-init service to operate `btrfs` filesystem.
         '';
       };
 
-      ext4.enable = mkOption {
-        type = types.bool;
+      ext4.enable = lib.mkOption {
+        type = lib.types.bool;
         default = hasFs "ext4";
-        defaultText = literalExpression ''hasFs "ext4"'';
+        defaultText = lib.literalExpression ''hasFs "ext4"'';
         description = ''
           Allow the cloud-init service to operate `ext4` filesystem.
         '';
       };
 
-      xfs.enable = mkOption {
-        type = types.bool;
+      xfs.enable = lib.mkOption {
+        type = lib.types.bool;
         default = hasFs "xfs";
-        defaultText = literalExpression ''hasFs "xfs"'';
+        defaultText = lib.literalExpression ''hasFs "xfs"'';
         description = ''
           Allow the cloud-init service to operate `xfs` filesystem.
         '';
       };
 
-      network.enable = mkOption {
-        type = types.bool;
+      network.enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Allow the cloud-init service to configure network interfaces
@@ -86,26 +83,26 @@ in
         '';
       };
 
-      extraPackages = mkOption {
-        type = types.listOf types.package;
+      extraPackages = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
         default = [ ];
         description = ''
           List of additional packages to be available within cloud-init jobs.
         '';
       };
 
-      settings = mkOption {
+      settings = lib.mkOption {
         description = ''
           Structured cloud-init configuration.
         '';
-        type = types.submodule {
+        type = lib.types.submodule {
           freeformType = settingsFormat.type;
         };
         default = { };
       };
 
-      config = mkOption {
-        type = types.str;
+      config = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = ''
           raw cloud-init configuration.
@@ -118,20 +115,20 @@ in
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     services.cloud-init.settings = {
-      system_info = mkDefault {
+      system_info = lib.mkDefault {
         distro = "nixos";
         network = {
           renderers = [ "networkd" ];
         };
       };
 
-      users = mkDefault [ "root" ];
-      disable_root = mkDefault false;
-      preserve_hostname = mkDefault false;
+      users = lib.mkDefault [ "root" ];
+      disable_root = lib.mkDefault false;
+      preserve_hostname = lib.mkDefault false;
 
-      cloud_init_modules = mkDefault [
+      cloud_init_modules = lib.mkDefault [
         "migrator"
         "seed_random"
         "bootcmd"
@@ -145,7 +142,7 @@ in
         "users-groups"
       ];
 
-      cloud_config_modules = mkDefault [
+      cloud_config_modules = lib.mkDefault [
         "disk_setup"
         "mounts"
         "ssh-import-id"
@@ -156,7 +153,7 @@ in
         "ssh"
       ];
 
-      cloud_final_modules = mkDefault [
+      cloud_final_modules = lib.mkDefault [
         "rightscale_userdata"
         "scripts-vendor"
         "scripts-per-once"
@@ -174,7 +171,7 @@ in
     environment.etc."cloud/cloud.cfg" =
       if cfg.config == "" then { source = cfgfile; } else { text = cfg.config; };
 
-    systemd.network.enable = mkIf cfg.network.enable true;
+    systemd.network.enable = lib.mkIf cfg.network.enable true;
 
     systemd.services.cloud-init-local = {
       description = "Initial cloud-init job (pre-networking)";
@@ -272,5 +269,5 @@ in
     };
   };
 
-  meta.maintainers = [ maintainers.zimbatm ];
+  meta.maintainers = [ lib.maintainers.zimbatm ];
 }

nixos/modules/services/system/localtimed.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.localtimed;
 in
@@ -15,8 +12,8 @@ in
 
   options = {
     services.localtimed = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Enable `localtimed`, a simple daemon for keeping the
@@ -29,12 +26,12 @@ in
           to make the choice deliberate. An error will be presented otherwise.
         '';
       };
-      package = mkPackageOption pkgs "localtime" { };
-      geoclue2Package = mkPackageOption pkgs "Geoclue2" { default = "geoclue2-with-demo-agent"; };
+      package = lib.mkPackageOption pkgs "localtime" { };
+      geoclue2Package = lib.mkPackageOption pkgs "Geoclue2" { default = "geoclue2-with-demo-agent"; };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     # This will give users an error if they have set an explicit time
     # zone, rather than having the service silently override it.
     time.timeZone = null;

nixos/modules/services/system/nix-daemon.nix

@@ -1,6 +1,5 @@
 /*
   Declares what makes the nix-daemon work on systemd.
-
   See also
    - nixos/modules/config/nix.nix: the nix.conf
    - nixos/modules/config/nix-remote-build.nix: the nix.conf
@@ -11,16 +10,13 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
 
   cfg = config.nix;
 
   nixPackage = cfg.package.out;
 
-  isNixAtLeast = versionAtLeast (getVersion nixPackage);
+  isNixAtLeast = lib.versionAtLeast (lib.getVersion nixPackage);
 
   makeNixBuildUser = nr: {
     name = "nixbld${toString nr}";
@@ -39,13 +35,13 @@ let
     };
   };
 
-  nixbldUsers = listToAttrs (map makeNixBuildUser (range 1 cfg.nrBuildUsers));
+  nixbldUsers = lib.listToAttrs (map makeNixBuildUser (lib.range 1 cfg.nrBuildUsers));
 
 in
 
 {
   imports = [
-    (mkRenamedOptionModuleWith {
+    (lib.mkRenamedOptionModuleWith {
       sinceRelease = 2205;
       from = [
         "nix"
@@ -56,7 +52,7 @@ in
         "daemonIOSchedPriority"
       ];
     })
-    (mkRenamedOptionModuleWith {
+    (lib.mkRenamedOptionModuleWith {
       sinceRelease = 2211;
       from = [
         "nix"
@@ -67,7 +63,7 @@ in
         "readOnlyNixStore"
       ];
     })
-    (mkRemovedOptionModule [ "nix" "daemonNiceLevel" ] "Consider nix.daemonCPUSchedPolicy instead.")
+    (lib.mkRemovedOptionModule [ "nix" "daemonNiceLevel" ] "Consider nix.daemonCPUSchedPolicy instead.")
   ];
 
   ###### interface
@@ -76,8 +72,8 @@ in
 
     nix = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Whether to enable Nix.
@@ -85,17 +81,17 @@ in
         '';
       };
 
-      package = mkOption {
-        type = types.package;
+      package = lib.mkOption {
+        type = lib.types.package;
         default = pkgs.nix;
-        defaultText = literalExpression "pkgs.nix";
+        defaultText = lib.literalExpression "pkgs.nix";
         description = ''
           This option specifies the Nix package instance to use throughout the system.
         '';
       };
 
-      daemonCPUSchedPolicy = mkOption {
-        type = types.enum [
+      daemonCPUSchedPolicy = lib.mkOption {
+        type = lib.types.enum [
           "other"
           "batch"
           "idle"
@@ -128,8 +124,8 @@ in
         '';
       };
 
-      daemonIOSchedClass = mkOption {
-        type = types.enum [
+      daemonIOSchedClass = lib.mkOption {
+        type = lib.types.enum [
           "best-effort"
           "idle"
         ];
@@ -154,8 +150,8 @@ in
         '';
       };
 
-      daemonIOSchedPriority = mkOption {
-        type = types.int;
+      daemonIOSchedPriority = lib.mkOption {
+        type = lib.types.int;
         default = 4;
         example = 1;
         description = ''
@@ -168,15 +164,15 @@ in
       };
 
       # Environment variables for running Nix.
-      envVars = mkOption {
-        type = types.attrs;
+      envVars = lib.mkOption {
+        type = lib.types.attrs;
         internal = true;
         default = { };
         description = "Environment variables used by Nix.";
       };
 
-      nrBuildUsers = mkOption {
-        type = types.int;
+      nrBuildUsers = lib.mkOption {
+        type = lib.types.int;
         description = ''
           Number of `nixbld` user accounts created to
           perform secure concurrent builds.  If you receive an error
@@ -189,19 +185,19 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [
       nixPackage
       pkgs.nix-info
-    ] ++ optional (config.programs.bash.completion.enable) pkgs.nix-bash-completions;
+    ] ++ lib.optional (config.programs.bash.completion.enable) pkgs.nix-bash-completions;
 
     systemd.packages = [ nixPackage ];
 
-    systemd.tmpfiles = mkMerge [
-      (mkIf (isNixAtLeast "2.8") {
+    systemd.tmpfiles = lib.mkMerge [
+      (lib.mkIf (isNixAtLeast "2.8") {
         packages = [ nixPackage ];
       })
-      (mkIf (!isNixAtLeast "2.8") {
+      (lib.mkIf (!isNixAtLeast "2.8") {
         rules = [
           "d /nix/var/nix/daemon-socket 0755 root root - -"
         ];
@@ -215,7 +211,7 @@ in
         nixPackage
         pkgs.util-linux
         config.programs.ssh.package
-      ] ++ optionals cfg.distributedBuilds [ pkgs.gzip ];
+      ] ++ lib.optionals cfg.distributedBuilds [ pkgs.gzip ];
 
       environment =
         cfg.envVars
@@ -274,20 +270,20 @@ in
     # Set up the environment variables for running Nix.
     environment.sessionVariables = cfg.envVars;
 
-    nix.nrBuildUsers = mkDefault (
+    nix.nrBuildUsers = lib.mkDefault (
       if cfg.settings.auto-allocate-uids or false then
         0
       else
-        max 32 (if cfg.settings.max-jobs == "auto" then 0 else cfg.settings.max-jobs)
+        lib.max 32 (if cfg.settings.max-jobs == "auto" then 0 else cfg.settings.max-jobs)
     );
 
     users.users = nixbldUsers;
 
-    services.displayManager.hiddenUsers = attrNames nixbldUsers;
+    services.displayManager.hiddenUsers = lib.attrNames nixbldUsers;
 
     # Legacy configuration conversion.
-    nix.settings = mkMerge [
-      (mkIf (isNixAtLeast "2.3pre") { sandbox-fallback = false; })
+    nix.settings = lib.mkMerge [
+      (lib.mkIf (isNixAtLeast "2.3pre") { sandbox-fallback = false; })
     ];
 
   };

nixos/modules/services/system/nscd.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
 
   nssModulesPath = config.system.nssModules.path;
@@ -22,8 +19,8 @@ in
 
     services.nscd = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Whether to enable the Name Service Cache Daemon.
@@ -32,8 +29,8 @@ in
         '';
       };
 
-      enableNsncd = mkOption {
-        type = types.bool;
+      enableNsncd = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Whether to use nsncd instead of nscd from glibc.
@@ -42,24 +39,24 @@ in
         '';
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "nscd";
         description = ''
           User account under which nscd runs.
         '';
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "nscd";
         description = ''
           User group under which nscd runs.
         '';
       };
 
-      config = mkOption {
-        type = types.lines;
+      config = lib.mkOption {
+        type = lib.types.lines;
         default = builtins.readFile ./nscd.conf;
         description = ''
           Configuration to use for Name Service Cache Daemon.
@@ -67,8 +64,8 @@ in
         '';
       };
 
-      package = mkOption {
-        type = types.package;
+      package = lib.mkOption {
+        type = lib.types.package;
         default =
           if pkgs.stdenv.hostPlatform.libc == "glibc" then pkgs.stdenv.cc.libc.bin else pkgs.glibc.bin;
         defaultText = lib.literalExpression ''
@@ -88,7 +85,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.etc."nscd.conf".text = cfg.config;
 
     users.users.${cfg.user} = {
@@ -125,7 +122,7 @@ in
           config.environment.etc."nsswitch.conf".source
           config.environment.etc."nscd.conf".source
         ]
-        ++ optionals config.users.mysql.enable [
+        ++ lib.optionals config.users.mysql.enable [
           config.environment.etc."libnss-mysql.cfg".source
           config.environment.etc."libnss-mysql-root.cfg".source
         ]

nixos/modules/services/system/saslauthd.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
 
   cfg = config.services.saslauthd;
@@ -21,18 +18,18 @@ in
 
     services.saslauthd = {
 
-      enable = mkEnableOption "saslauthd, the Cyrus SASL authentication daemon";
+      enable = lib.mkEnableOption "saslauthd, the Cyrus SASL authentication daemon";
 
-      package = mkPackageOption pkgs [ "cyrus_sasl" "bin" ] { };
+      package = lib.mkPackageOption pkgs [ "cyrus_sasl" "bin" ] { };
 
-      mechanism = mkOption {
-        type = types.str;
+      mechanism = lib.mkOption {
+        type = lib.types.str;
         default = "pam";
         description = "Auth mechanism to use";
       };
 
-      config = mkOption {
-        type = types.lines;
+      config = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         description = "Configuration to use for Cyrus SASL authentication daemon.";
       };
@@ -43,7 +40,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     systemd.services.saslauthd = {
       description = "Cyrus SASL authentication daemon";

nixos/modules/services/system/uptimed.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.uptimed;
   stateDir = "/var/lib/uptimed";
@@ -14,8 +11,8 @@ in
 {
   options = {
     services.uptimed = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Enable `uptimed`, allowing you to track
@@ -25,7 +22,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     environment.systemPackages = [ pkgs.uptimed ];
 

nixos/modules/services/torrent/deluge.nix

@@ -1,16 +1,13 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.deluge;
   cfg_web = config.services.deluge.web;
-  isDeluge1 = versionOlder cfg.package.version "2.0.0";
+  isDeluge1 = lib.versionOlder cfg.package.version "2.0.0";
 
   openFilesLimit = 4096;
   listenPortsDefault = [ 6881 6889 ];
 
-  listToRange = x: { from = elemAt x 0; to = elemAt x 1; };
+  listToRange = x: { from = lib.elemAt x 0; to = lib.elemAt x 1; };
 
   configDir = "${cfg.dataDir}/.config/deluge";
   configFile = pkgs.writeText "core.conf" (builtins.toJSON cfg.config);
@@ -37,20 +34,20 @@ in {
   options = {
     services = {
       deluge = {
-        enable = mkEnableOption "Deluge daemon";
+        enable = lib.mkEnableOption "Deluge daemon";
 
-        openFilesLimit = mkOption {
+        openFilesLimit = lib.mkOption {
           default = openFilesLimit;
-          type = types.either types.int types.str;
+          type = lib.types.either lib.types.int lib.types.str;
           description = ''
             Number of files to allow deluged to open.
           '';
         };
 
-        config = mkOption {
-          type = types.attrs;
+        config = lib.mkOption {
+          type = lib.types.attrs;
           default = {};
-          example = literalExpression ''
+          example = lib.literalExpression ''
             {
               download_location = "/srv/torrents/";
               max_upload_speed = "1000.0";
@@ -70,8 +67,8 @@ in {
           '';
         };
 
-        declarative = mkOption {
-          type = types.bool;
+        declarative = lib.mkOption {
+          type = lib.types.bool;
           default = false;
           description = ''
             Whether to use a declarative deluge configuration.
@@ -83,9 +80,9 @@ in {
           '';
         };
 
-        openFirewall = mkOption {
+        openFirewall = lib.mkOption {
           default = false;
-          type = types.bool;
+          type = lib.types.bool;
           description = ''
             Whether to open the firewall for the ports in
             {option}`services.deluge.config.listen_ports`. It only takes effet if
@@ -99,16 +96,16 @@ in {
           '';
         };
 
-        dataDir = mkOption {
-          type = types.path;
+        dataDir = lib.mkOption {
+          type = lib.types.path;
           default = "/var/lib/deluge";
           description = ''
             The directory where deluge will create files.
           '';
         };
 
-        authFile = mkOption {
-          type = types.path;
+        authFile = lib.mkOption {
+          type = lib.types.path;
           example = "/run/keys/deluge-auth";
           description = ''
             The file managing the authentication for deluge, the format of this
@@ -121,24 +118,24 @@ in {
           '';
         };
 
-        user = mkOption {
-          type = types.str;
+        user = lib.mkOption {
+          type = lib.types.str;
           default = "deluge";
           description = ''
             User account under which deluge runs.
           '';
         };
 
-        group = mkOption {
-          type = types.str;
+        group = lib.mkOption {
+          type = lib.types.str;
           default = "deluge";
           description = ''
             Group under which deluge runs.
           '';
         };
 
-        extraPackages = mkOption {
-          type = types.listOf types.package;
+        extraPackages = lib.mkOption {
+          type = lib.types.listOf lib.types.package;
           default = [];
           description = ''
             Extra packages available at runtime to enable Deluge's plugins. For example,
@@ -147,22 +144,22 @@ in {
           '';
         };
 
-        package = mkPackageOption pkgs "deluge-2_x" { };
+        package = lib.mkPackageOption pkgs "deluge-2_x" { };
       };
 
       deluge.web = {
-        enable = mkEnableOption "Deluge Web daemon";
+        enable = lib.mkEnableOption "Deluge Web daemon";
 
-        port = mkOption {
-          type = types.port;
+        port = lib.mkOption {
+          type = lib.types.port;
           default = 8112;
           description = ''
             Deluge web UI port.
           '';
         };
 
-        openFirewall = mkOption {
-          type = types.bool;
+        openFirewall = lib.mkOption {
+          type = lib.types.bool;
           default = false;
           description = ''
             Open ports in the firewall for deluge web daemon
@@ -172,10 +169,10 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
-    services.deluge.package = mkDefault (
-      if versionAtLeast config.system.stateVersion "20.09" then
+    services.deluge.package = lib.mkDefault (
+      if lib.versionAtLeast config.system.stateVersion "20.09" then
         pkgs.deluge-2_x
       else
         # deluge-1_x is no longer packaged and this will resolve to an error
@@ -201,13 +198,13 @@ in {
       "${cfg.dataDir}/.config".d = defaultConfig;
       "${cfg.dataDir}/.config/deluge".d = defaultConfig;
     }
-    // optionalAttrs (cfg.config ? download_location) {
+    // lib.optionalAttrs (cfg.config ? download_location) {
       ${cfg.config.download_location}.d = defaultConfig;
     }
-    // optionalAttrs (cfg.config ? torrentfiles_location) {
+    // lib.optionalAttrs (cfg.config ? torrentfiles_location) {
       ${cfg.config.torrentfiles_location}.d = defaultConfig;
     }
-    // optionalAttrs (cfg.config ? move_completed_path) {
+    // lib.optionalAttrs (cfg.config ? move_completed_path) {
       ${cfg.config.move_completed_path}.d = defaultConfig;
     };
 
@@ -233,7 +230,7 @@ in {
       preStart = preStart;
     };
 
-    systemd.services.delugeweb = mkIf cfg_web.enable {
+    systemd.services.delugeweb = lib.mkIf cfg_web.enable {
       after = [ "network.target" "deluged.service"];
       requires = [ "deluged.service" ];
       description = "Deluge BitTorrent WebUI";
@@ -242,7 +239,7 @@ in {
       serviceConfig = {
         ExecStart = ''
           ${cfg.package}/bin/deluge-web \
-            ${optionalString (!isDeluge1) "--do-not-daemonize"} \
+            ${lib.optionalString (!isDeluge1) "--do-not-daemonize"} \
             --config ${configDir} \
             --port ${toString cfg.web.port}
         '';
@@ -251,19 +248,19 @@ in {
       };
     };
 
-    networking.firewall = mkMerge [
-      (mkIf (cfg.declarative && cfg.openFirewall && !(cfg.config.random_port or true)) {
-        allowedTCPPortRanges = singleton (listToRange (cfg.config.listen_ports or listenPortsDefault));
-        allowedUDPPortRanges = singleton (listToRange (cfg.config.listen_ports or listenPortsDefault));
+    networking.firewall = lib.mkMerge [
+      (lib.mkIf (cfg.declarative && cfg.openFirewall && !(cfg.config.random_port or true)) {
+        allowedTCPPortRanges = lib.singleton (listToRange (cfg.config.listen_ports or listenPortsDefault));
+        allowedUDPPortRanges = lib.singleton (listToRange (cfg.config.listen_ports or listenPortsDefault));
       })
-      (mkIf (cfg.web.openFirewall) {
+      (lib.mkIf (cfg.web.openFirewall) {
         allowedTCPPorts = [ cfg.web.port ];
       })
     ];
 
     environment.systemPackages = [ cfg.package ];
 
-    users.users = mkIf (cfg.user == "deluge") {
+    users.users = lib.mkIf (cfg.user == "deluge") {
       deluge = {
         group = cfg.group;
         uid = config.ids.uids.deluge;
@@ -272,7 +269,7 @@ in {
       };
     };
 
-    users.groups = mkIf (cfg.group == "deluge") {
+    users.groups = lib.mkIf (cfg.group == "deluge") {
       deluge = {
         gid = config.ids.gids.deluge;
       };

nixos/modules/services/torrent/flexget.nix

@@ -4,63 +4,60 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.flexget;
   pkg = cfg.package;
   ymlFile = pkgs.writeText "flexget.yml" ''
     ${cfg.config}
 
-    ${optionalString cfg.systemScheduler "schedules: no"}
+    ${lib.optionalString cfg.systemScheduler "schedules: no"}
   '';
   configFile = "${toString cfg.homeDir}/flexget.yml";
 in
 {
   options = {
     services.flexget = {
-      enable = mkEnableOption "FlexGet daemon";
+      enable = lib.mkEnableOption "FlexGet daemon";
 
-      package = mkPackageOption pkgs "flexget" { };
+      package = lib.mkPackageOption pkgs "flexget" { };
 
-      user = mkOption {
+      user = lib.mkOption {
         default = "deluge";
         example = "some_user";
-        type = types.str;
+        type = lib.types.str;
         description = "The user under which to run flexget.";
       };
 
-      homeDir = mkOption {
+      homeDir = lib.mkOption {
         default = "/var/lib/deluge";
         example = "/home/flexget";
-        type = types.path;
+        type = lib.types.path;
         description = "Where files live.";
       };
 
-      interval = mkOption {
+      interval = lib.mkOption {
         default = "10m";
         example = "1h";
-        type = types.str;
+        type = lib.types.str;
         description = "When to perform a {command}`flexget` run. See {command}`man 7 systemd.time` for the format.";
       };
 
-      systemScheduler = mkOption {
+      systemScheduler = lib.mkOption {
         default = true;
         example = false;
-        type = types.bool;
+        type = lib.types.bool;
         description = "When true, execute the runs via the flexget-runner.timer. If false, you have to specify the settings yourself in the YML file.";
       };
 
-      config = mkOption {
+      config = lib.mkOption {
         default = "";
-        type = types.lines;
+        type = lib.types.lines;
         description = "The YAML configuration for FlexGet.";
       };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     environment.systemPackages = [ pkg ];
 
@@ -81,7 +78,7 @@ in
         wantedBy = [ "multi-user.target" ];
       };
 
-      flexget-runner = mkIf cfg.systemScheduler {
+      flexget-runner = lib.mkIf cfg.systemScheduler {
         description = "FlexGet Runner";
         after = [ "flexget.service" ];
         wants = [ "flexget.service" ];
@@ -94,7 +91,7 @@ in
       };
     };
 
-    systemd.timers.flexget-runner = mkIf cfg.systemScheduler {
+    systemd.timers.flexget-runner = lib.mkIf cfg.systemScheduler {
       description = "Run FlexGet every ${cfg.interval}";
       wantedBy = [ "timers.target" ];
       timerConfig = {

nixos/modules/services/torrent/magnetico.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.magnetico;
 
@@ -22,7 +19,7 @@ let
       );
 
   # default options in magneticod/main.go
-  dbURI = concatStrings [
+  dbURI = lib.concatStrings [
     "sqlite3://${dataDir}/database.sqlite3"
     "?_journal_mode=WAL"
     "&_busy_timeout=3000"
@@ -63,10 +60,10 @@ in
   ###### interface
 
   options.services.magnetico = {
-    enable = mkEnableOption "Magnetico, Bittorrent DHT crawler";
+    enable = lib.mkEnableOption "Magnetico, Bittorrent DHT crawler";
 
-    crawler.address = mkOption {
-      type = types.str;
+    crawler.address = lib.mkOption {
+      type = lib.types.str;
       default = "0.0.0.0";
       example = "1.2.3.4";
       description = ''
@@ -74,8 +71,8 @@ in
       '';
     };
 
-    crawler.port = mkOption {
-      type = types.port;
+    crawler.port = lib.mkOption {
+      type = lib.types.port;
       default = 0;
       description = ''
         Port to be used for indexing DHT nodes.
@@ -84,8 +81,8 @@ in
       '';
     };
 
-    crawler.maxNeighbors = mkOption {
-      type = types.ints.positive;
+    crawler.maxNeighbors = lib.mkOption {
+      type = lib.types.ints.positive;
       default = 1000;
       description = ''
         Maximum number of simultaneous neighbors of an indexer.
@@ -95,24 +92,24 @@ in
       '';
     };
 
-    crawler.maxLeeches = mkOption {
-      type = types.ints.positive;
+    crawler.maxLeeches = lib.mkOption {
+      type = lib.types.ints.positive;
       default = 200;
       description = ''
         Maximum number of simultaneous leeches.
       '';
     };
 
-    crawler.extraOptions = mkOption {
-      type = types.listOf types.str;
+    crawler.extraOptions = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [ ];
       description = ''
         Extra command line arguments to pass to magneticod.
       '';
     };
 
-    web.address = mkOption {
-      type = types.str;
+    web.address = lib.mkOption {
+      type = lib.types.str;
       default = "localhost";
       example = "1.2.3.4";
       description = ''
@@ -120,16 +117,16 @@ in
       '';
     };
 
-    web.port = mkOption {
-      type = types.port;
+    web.port = lib.mkOption {
+      type = lib.types.port;
       default = 8080;
       description = ''
         Port the web interface will listen to.
       '';
     };
 
-    web.credentials = mkOption {
-      type = types.attrsOf types.str;
+    web.credentials = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
       default = { };
       example = lib.literalExpression ''
         {
@@ -156,8 +153,8 @@ in
       '';
     };
 
-    web.credentialsFile = mkOption {
-      type = types.nullOr types.path;
+    web.credentialsFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
       default = null;
       description = ''
         The path to the file holding the credentials to access the web
@@ -174,8 +171,8 @@ in
       '';
     };
 
-    web.extraOptions = mkOption {
-      type = types.listOf types.str;
+    web.extraOptions = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [ ];
       description = ''
         Extra command line arguments to pass to magneticow.
@@ -186,7 +183,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     users.users.magnetico = {
       description = "Magnetico daemons user";

nixos/modules/services/torrent/opentracker.nix

@@ -4,19 +4,17 @@
   pkgs,
   ...
 }:
-
-with lib;
 let
   cfg = config.services.opentracker;
 in
 {
   options.services.opentracker = {
-    enable = mkEnableOption "opentracker";
+    enable = lib.mkEnableOption "opentracker";
 
-    package = mkPackageOption pkgs "opentracker" { };
+    package = lib.mkPackageOption pkgs "opentracker" { };
 
-    extraOptions = mkOption {
-      type = types.separatedString " ";
+    extraOptions = lib.mkOption {
+      type = lib.types.separatedString " ";
       description = ''
         Configuration Arguments for opentracker
         See https://erdgeist.org/arts/software/opentracker/ for all params

nixos/modules/services/torrent/peerflix.nix

@@ -5,9 +5,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.peerflix;
   opt = options.services.peerflix;
@@ -25,29 +22,29 @@ in
   ###### interface
 
   options.services.peerflix = {
-    enable = mkOption {
+    enable = lib.mkOption {
       description = "Whether to enable peerflix service.";
       default = false;
-      type = types.bool;
+      type = lib.types.bool;
     };
 
-    stateDir = mkOption {
+    stateDir = lib.mkOption {
       description = "Peerflix state directory.";
       default = "/var/lib/peerflix";
-      type = types.path;
+      type = lib.types.path;
     };
 
-    downloadDir = mkOption {
+    downloadDir = lib.mkOption {
       description = "Peerflix temporary download directory.";
       default = "${cfg.stateDir}/torrents";
-      defaultText = literalExpression ''"''${config.${opt.stateDir}}/torrents"'';
-      type = types.path;
+      defaultText = lib.literalExpression ''"''${config.${opt.stateDir}}/torrents"'';
+      type = lib.types.path;
     };
   };
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.tmpfiles.rules = [
       "d '${cfg.stateDir}' - peerflix - - -"
     ];

nixos/modules/services/web-apps/monica.nix

@@ -296,7 +296,7 @@ in {
       DB_USERNAME = db.user;
       MAIL_DRIVER = mail.driver;
       MAIL_FROM_NAME = mail.fromName;
-      MAIL_FROM = mail.from;
+      MAIL_FROM_ADDRESS = mail.from;
       MAIL_HOST = mail.host;
       MAIL_PORT = mail.port;
       MAIL_USERNAME = mail.user;

nixos/modules/services/x11/colord.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
 
   cfg = config.services.colord;
@@ -17,12 +14,12 @@ in
   options = {
 
     services.colord = {
-      enable = mkEnableOption "colord, the color management daemon";
+      enable = lib.mkEnableOption "colord, the color management daemon";
     };
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     environment.systemPackages = [ pkgs.colord ];
 

nixos/modules/services/x11/desktop-managers/cde.nix

@@ -4,19 +4,16 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   xcfg = config.services.xserver;
   cfg = xcfg.desktopManager.cde;
 in
 {
   options.services.xserver.desktopManager.cde = {
-    enable = mkEnableOption "Common Desktop Environment";
+    enable = lib.mkEnableOption "Common Desktop Environment";
 
-    extraPackages = mkOption {
-      type = with types; listOf package;
+    extraPackages = lib.mkOption {
+      type = with lib.types; listOf package;
       default = with pkgs.xorg; [
         xclock
         bitmap
@@ -29,7 +26,7 @@ in
         xwd
         xwud
       ];
-      defaultText = literalExpression ''
+      defaultText = lib.literalExpression ''
         with pkgs.xorg; [
           xclock bitmap xlsfonts xfd xrefresh xload xwininfo xdpyinfo xwd xwud
         ]
@@ -40,7 +37,7 @@ in
     };
   };
 
-  config = mkIf (xcfg.enable && cfg.enable) {
+  config = lib.mkIf (xcfg.enable && cfg.enable) {
     environment.systemPackages = cfg.extraPackages;
 
     services.rpcbind.enable = true;

nixos/modules/services/x11/desktop-managers/cinnamon.nix

@@ -1,7 +1,4 @@
 { config, lib, pkgs, utils, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.xserver.desktopManager.cinnamon;
@@ -18,16 +15,16 @@ in
 {
   options = {
     services.cinnamon = {
-      apps.enable = mkEnableOption "Cinnamon default applications";
+      apps.enable = lib.mkEnableOption "Cinnamon default applications";
     };
 
     services.xserver.desktopManager.cinnamon = {
-      enable = mkEnableOption "the cinnamon desktop manager";
+      enable = lib.mkEnableOption "the cinnamon desktop manager";
 
-      sessionPath = mkOption {
+      sessionPath = lib.mkOption {
         default = [];
-        type = types.listOf types.package;
-        example = literalExpression "[ pkgs.gpaste ]";
+        type = lib.types.listOf lib.types.package;
+        example = lib.literalExpression "[ pkgs.gpaste ]";
         description = ''
           Additional list of packages to be added to the session search path.
           Useful for GSettings-conditional autostart.
@@ -36,53 +33,53 @@ in
         '';
       };
 
-      extraGSettingsOverrides = mkOption {
+      extraGSettingsOverrides = lib.mkOption {
         default = "";
-        type = types.lines;
+        type = lib.types.lines;
         description = "Additional gsettings overrides.";
       };
 
-      extraGSettingsOverridePackages = mkOption {
+      extraGSettingsOverridePackages = lib.mkOption {
         default = [];
-        type = types.listOf types.path;
+        type = lib.types.listOf lib.types.path;
         description = "List of packages for which gsettings are overridden.";
       };
     };
 
-    environment.cinnamon.excludePackages = mkOption {
+    environment.cinnamon.excludePackages = lib.mkOption {
       default = [];
-      example = literalExpression "[ pkgs.blueman ]";
-      type = types.listOf types.package;
+      example = lib.literalExpression "[ pkgs.blueman ]";
+      type = lib.types.listOf lib.types.package;
       description = "Which packages cinnamon should exclude from the default environment";
     };
 
   };
 
-  config = mkMerge [
-    (mkIf cfg.enable {
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
       services.displayManager.sessionPackages = [ pkgs.cinnamon-common ];
 
       services.xserver.displayManager.lightdm.greeters.slick = {
-        enable = mkDefault true;
+        enable = lib.mkDefault true;
 
         # Taken from mint-artwork.gschema.override
-        theme = mkIf (notExcluded pkgs.mint-themes) {
-          name = mkDefault "Mint-Y-Aqua";
-          package = mkDefault pkgs.mint-themes;
+        theme = lib.mkIf (notExcluded pkgs.mint-themes) {
+          name = lib.mkDefault "Mint-Y-Aqua";
+          package = lib.mkDefault pkgs.mint-themes;
         };
-        iconTheme = mkIf (notExcluded pkgs.mint-y-icons) {
-          name = mkDefault "Mint-Y-Sand";
-          package = mkDefault pkgs.mint-y-icons;
+        iconTheme = lib.mkIf (notExcluded pkgs.mint-y-icons) {
+          name = lib.mkDefault "Mint-Y-Sand";
+          package = lib.mkDefault pkgs.mint-y-icons;
         };
-        cursorTheme = mkIf (notExcluded pkgs.mint-cursor-themes) {
-          name = mkDefault "Bibata-Modern-Classic";
-          package = mkDefault pkgs.mint-cursor-themes;
+        cursorTheme = lib.mkIf (notExcluded pkgs.mint-cursor-themes) {
+          name = lib.mkDefault "Bibata-Modern-Classic";
+          package = lib.mkDefault pkgs.mint-cursor-themes;
         };
       };
 
       # Have to take care of GDM + Cinnamon on Wayland users
       environment.extraInit = ''
-        ${concatMapStrings (p: ''
+        ${lib.concatMapStrings (p: ''
           if [ -d "${p}/share/gsettings-schemas/${p.name}" ]; then
             export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}${p}/share/gsettings-schemas/${p.name}
           fi
@@ -95,30 +92,30 @@ in
       '';
 
       # Default services
-      services.blueman.enable = mkDefault (notExcluded pkgs.blueman);
-      hardware.bluetooth.enable = mkDefault true;
+      services.blueman.enable = lib.mkDefault (notExcluded pkgs.blueman);
+      hardware.bluetooth.enable = lib.mkDefault true;
       security.polkit.enable = true;
       services.accounts-daemon.enable = true;
-      services.system-config-printer.enable = (mkIf config.services.printing.enable (mkDefault true));
+      services.system-config-printer.enable = (lib.mkIf config.services.printing.enable (lib.mkDefault true));
       services.dbus.packages = with pkgs; [
         cinnamon-common
         cinnamon-screensaver
         nemo-with-extensions
         xapp
       ];
-      services.cinnamon.apps.enable = mkDefault true;
+      services.cinnamon.apps.enable = lib.mkDefault true;
       services.gnome.evolution-data-server.enable = true;
       services.gnome.glib-networking.enable = true;
       services.gnome.gnome-keyring.enable = true;
       services.gvfs.enable = true;
-      services.power-profiles-daemon.enable = mkDefault true;
-      services.switcherooControl.enable = mkDefault true; # xapp-gpu-offload-helper
-      services.touchegg.enable = mkDefault true;
+      services.power-profiles-daemon.enable = lib.mkDefault true;
+      services.switcherooControl.enable = lib.mkDefault true; # xapp-gpu-offload-helper
+      services.touchegg.enable = lib.mkDefault true;
       services.udisks2.enable = true;
-      services.upower.enable = mkDefault config.powerManagement.enable;
-      services.libinput.enable = mkDefault true;
+      services.upower.enable = lib.mkDefault config.powerManagement.enable;
+      services.libinput.enable = lib.mkDefault true;
       services.xserver.updateDbusEnvironment = true;
-      networking.networkmanager.enable = mkDefault true;
+      networking.networkmanager.enable = lib.mkDefault true;
 
       # Enable colord server
       services.colord.enable = true;
@@ -204,9 +201,9 @@ in
         pkgs.xdg-desktop-portal-gtk
       ];
 
-      services.orca.enable = mkDefault (notExcluded pkgs.orca);
+      services.orca.enable = lib.mkDefault (notExcluded pkgs.orca);
 
-      xdg.portal.configPackages = mkDefault [ pkgs.cinnamon-common ];
+      xdg.portal.configPackages = lib.mkDefault [ pkgs.cinnamon-common ];
 
       # Override GSettings schemas
       environment.sessionVariables.NIX_GSETTINGS_OVERRIDES_DIR = "${nixos-gsettings-overrides}/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas";
@@ -217,8 +214,8 @@ in
       ];
 
       # Shell integration for VTE terminals
-      programs.bash.vteIntegration = mkDefault true;
-      programs.zsh.vteIntegration = mkDefault true;
+      programs.bash.vteIntegration = lib.mkDefault true;
+      programs.zsh.vteIntegration = lib.mkDefault true;
 
       # Default Fonts
       fonts.packages = with pkgs; [
@@ -227,10 +224,10 @@ in
       ];
     })
 
-    (mkIf serviceCfg.apps.enable {
-      programs.gnome-disks.enable = mkDefault (notExcluded pkgs.gnome-disk-utility);
-      programs.gnome-terminal.enable = mkDefault (notExcluded pkgs.gnome-terminal);
-      programs.file-roller.enable = mkDefault (notExcluded pkgs.file-roller);
+    (lib.mkIf serviceCfg.apps.enable {
+      programs.gnome-disks.enable = lib.mkDefault (notExcluded pkgs.gnome-disk-utility);
+      programs.gnome-terminal.enable = lib.mkDefault (notExcluded pkgs.gnome-terminal);
+      programs.file-roller.enable = lib.mkDefault (notExcluded pkgs.file-roller);
 
       environment.systemPackages = with pkgs; utils.removePackagesByName [
         # cinnamon team apps

nixos/modules/services/x11/desktop-managers/deepin.nix

@@ -5,9 +5,6 @@
   utils,
   ...
 }:
-
-with lib;
-
 let
   xcfg = config.services.xserver;
   cfg = xcfg.desktopManager.deepin;
@@ -21,68 +18,68 @@ in
   options = {
 
     services.xserver.desktopManager.deepin = {
-      enable = mkEnableOption "Deepin desktop manager";
-      extraGSettingsOverrides = mkOption {
+      enable = lib.mkEnableOption "Deepin desktop manager";
+      extraGSettingsOverrides = lib.mkOption {
         default = "";
-        type = types.lines;
+        type = lib.types.lines;
         description = "Additional gsettings overrides.";
       };
-      extraGSettingsOverridePackages = mkOption {
+      extraGSettingsOverridePackages = lib.mkOption {
         default = [ ];
-        type = types.listOf types.path;
+        type = lib.types.listOf lib.types.path;
         description = "List of packages for which gsettings are overridden.";
       };
     };
 
-    environment.deepin.excludePackages = mkOption {
+    environment.deepin.excludePackages = lib.mkOption {
       default = [ ];
-      type = types.listOf types.package;
+      type = lib.types.listOf lib.types.package;
       description = "List of default packages to exclude from the configuration";
     };
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     services.displayManager.sessionPackages = [ pkgs.deepin.dde-session ];
-    services.displayManager.defaultSession = mkDefault "dde-x11";
+    services.displayManager.defaultSession = lib.mkDefault "dde-x11";
 
     # Update the DBus activation environment after launching the desktop manager.
     services.xserver.displayManager.sessionCommands = ''
       ${lib.getBin pkgs.dbus}/bin/dbus-update-activation-environment --systemd --all
     '';
 
-    hardware.bluetooth.enable = mkDefault true;
+    hardware.bluetooth.enable = lib.mkDefault true;
     security.polkit.enable = true;
 
-    services.deepin.dde-daemon.enable = mkForce true;
-    services.deepin.dde-api.enable = mkForce true;
-    services.deepin.app-services.enable = mkForce true;
+    services.deepin.dde-daemon.enable = lib.mkForce true;
+    services.deepin.dde-api.enable = lib.mkForce true;
+    services.deepin.app-services.enable = lib.mkForce true;
 
-    services.colord.enable = mkDefault true;
-    services.accounts-daemon.enable = mkDefault true;
-    services.gvfs.enable = mkDefault true;
-    services.gnome.glib-networking.enable = mkDefault true;
-    services.gnome.gnome-keyring.enable = mkDefault true;
-    services.bamf.enable = mkDefault true;
+    services.colord.enable = lib.mkDefault true;
+    services.accounts-daemon.enable = lib.mkDefault true;
+    services.gvfs.enable = lib.mkDefault true;
+    services.gnome.glib-networking.enable = lib.mkDefault true;
+    services.gnome.gnome-keyring.enable = lib.mkDefault true;
+    services.bamf.enable = lib.mkDefault true;
 
-    services.libinput.enable = mkDefault true;
+    services.libinput.enable = lib.mkDefault true;
     services.udisks2.enable = true;
-    services.upower.enable = mkDefault config.powerManagement.enable;
-    networking.networkmanager.enable = mkDefault true;
-    programs.dconf.enable = mkDefault true;
-    programs.gnupg.agent.pinentryPackage = mkDefault pkgs.pinentry-qt;
+    services.upower.enable = lib.mkDefault config.powerManagement.enable;
+    networking.networkmanager.enable = lib.mkDefault true;
+    programs.dconf.enable = lib.mkDefault true;
+    programs.gnupg.agent.pinentryPackage = lib.mkDefault pkgs.pinentry-qt;
 
     fonts.packages = with pkgs; [ noto-fonts ];
     xdg.mime.enable = true;
     xdg.menus.enable = true;
     xdg.icons.enable = true;
-    xdg.portal.enable = mkDefault true;
-    xdg.portal.extraPortals = mkDefault [
+    xdg.portal.enable = lib.mkDefault true;
+    xdg.portal.extraPortals = lib.mkDefault [
       pkgs.xdg-desktop-portal-gtk
     ];
 
     # https://github.com/NixOS/nixpkgs/pull/247766#issuecomment-1722839259
-    xdg.portal.config.deepin.default = mkDefault [ "gtk" ];
+    xdg.portal.config.deepin.default = lib.mkDefault [ "gtk" ];
 
     environment.sessionVariables = {
       NIX_GSETTINGS_OVERRIDES_DIR = "${nixos-gsettings-overrides}/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas";

nixos/modules/services/x11/desktop-managers/enlightenment.nix

@@ -4,9 +4,6 @@
   lib,
   ...
 }:
-
-with lib;
-
 let
 
   e = pkgs.enlightenment;
@@ -23,11 +20,11 @@ in
 
 {
   meta = {
-    maintainers = teams.enlightenment.members;
+    maintainers = lib.teams.enlightenment.members;
   };
 
   imports = [
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "xserver" "desktopManager" "e19" "enable" ]
       [ "services" "xserver" "desktopManager" "enlightenment" "enable" ]
     )
@@ -35,15 +32,15 @@ in
 
   options = {
 
-    services.xserver.desktopManager.enlightenment.enable = mkOption {
-      type = types.bool;
+    services.xserver.desktopManager.enlightenment.enable = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = "Enable the Enlightenment desktop environment.";
     };
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     environment.systemPackages = with pkgs; [
       enlightenment.econnman
@@ -105,7 +102,7 @@ in
 
     services.udisks2.enable = true;
     services.upower.enable = config.powerManagement.enable;
-    services.libinput.enable = mkDefault true;
+    services.libinput.enable = lib.mkDefault true;
 
     services.dbus.packages = [ e.efl ];
 

nixos/modules/services/x11/desktop-managers/kodi.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.xserver.desktopManager.kodi;
 in
@@ -14,19 +11,19 @@ in
 {
   options = {
     services.xserver.desktopManager.kodi = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Enable the kodi multimedia center.";
       };
 
-      package = mkPackageOption pkgs "kodi" {
+      package = lib.mkPackageOption pkgs "kodi" {
         example = "kodi.withPackages (p: with p; [ jellyfin pvr-iptvsimple vfs-sftp ])";
       };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     services.xserver.desktopManager.session = [
       {
         name = "kodi";

nixos/modules/services/x11/desktop-managers/lumina.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
 
   xcfg = config.services.xserver;
@@ -16,20 +13,20 @@ in
 
 {
   meta = {
-    maintainers = teams.lumina.members;
+    maintainers = lib.teams.lumina.members;
   };
 
   options = {
 
-    services.xserver.desktopManager.lumina.enable = mkOption {
-      type = types.bool;
+    services.xserver.desktopManager.lumina.enable = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = "Enable the Lumina desktop manager";
     };
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     services.displayManager.sessionPackages = [
       pkgs.lumina.lumina

nixos/modules/services/x11/desktop-managers/lxqt.nix

@@ -1,7 +1,4 @@
 { config, lib, pkgs, utils, ... }:
-
-with lib;
-
 let
   xcfg = config.services.xserver;
   cfg = xcfg.desktopManager.lxqt;
@@ -10,29 +7,29 @@ in
 
 {
   meta = {
-    maintainers = teams.lxqt.members;
+    maintainers = lib.teams.lxqt.members;
   };
 
   options = {
 
-    services.xserver.desktopManager.lxqt.enable = mkOption {
-      type = types.bool;
+    services.xserver.desktopManager.lxqt.enable = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = "Enable the LXQt desktop manager";
     };
 
-    environment.lxqt.excludePackages = mkOption {
+    environment.lxqt.excludePackages = lib.mkOption {
       default = [];
-      example = literalExpression "[ pkgs.lxqt.qterminal ]";
-      type = types.listOf types.package;
+      example = lib.literalExpression "[ pkgs.lxqt.qterminal ]";
+      type = lib.types.listOf lib.types.package;
       description = "Which LXQt packages to exclude from the default environment";
     };
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
-    services.xserver.desktopManager.session = singleton {
+    services.xserver.desktopManager.session = lib.singleton {
       name = "lxqt";
       bgSupport = true;
       start = ''
@@ -62,19 +59,19 @@ in
     # Link some extra directories in /run/current-system/software/share
     environment.pathsToLink = [ "/share" ];
 
-    programs.gnupg.agent.pinentryPackage = mkDefault pkgs.pinentry-qt;
+    programs.gnupg.agent.pinentryPackage = lib.mkDefault pkgs.pinentry-qt;
 
     # virtual file systems support for PCManFM-QT
     services.gvfs.enable = true;
 
     services.upower.enable = config.powerManagement.enable;
 
-    services.libinput.enable = mkDefault true;
+    services.libinput.enable = lib.mkDefault true;
 
-    xdg.portal.lxqt.enable = mkDefault true;
+    xdg.portal.lxqt.enable = lib.mkDefault true;
 
     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1050804
-    xdg.portal.config.lxqt.default = mkDefault [ "lxqt" "gtk" ];
+    xdg.portal.config.lxqt.default = lib.mkDefault [ "lxqt" "gtk" ];
   };
 
 }

nixos/modules/services/x11/desktop-managers/mate.nix

@@ -5,9 +5,6 @@
   utils,
   ...
 }:
-
-with lib;
-
 let
 
   xcfg = config.services.xserver;
@@ -19,48 +16,48 @@ in
   options = {
 
     services.xserver.desktopManager.mate = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Enable the MATE desktop environment";
       };
 
-      debug = mkEnableOption "mate-session debug messages";
+      debug = lib.mkEnableOption "mate-session debug messages";
 
-      extraPanelApplets = mkOption {
+      extraPanelApplets = lib.mkOption {
         default = [ ];
-        example = literalExpression "with pkgs.mate; [ mate-applets ]";
-        type = types.listOf types.package;
+        example = lib.literalExpression "with pkgs.mate; [ mate-applets ]";
+        type = lib.types.listOf lib.types.package;
         description = "Extra applets to add to mate-panel.";
       };
 
-      extraCajaExtensions = mkOption {
+      extraCajaExtensions = lib.mkOption {
         default = [ ];
         example = lib.literalExpression "with pkgs.mate; [ caja-extensions ]";
-        type = types.listOf types.package;
+        type = lib.types.listOf lib.types.package;
         description = "Extra extensions to add to caja.";
       };
 
-      enableWaylandSession = mkEnableOption "MATE Wayland session";
+      enableWaylandSession = lib.mkEnableOption "MATE Wayland session";
     };
 
-    environment.mate.excludePackages = mkOption {
+    environment.mate.excludePackages = lib.mkOption {
       default = [ ];
-      example = literalExpression "[ pkgs.mate.mate-terminal pkgs.mate.pluma ]";
-      type = types.listOf types.package;
+      example = lib.literalExpression "[ pkgs.mate.mate-terminal pkgs.mate.pluma ]";
+      type = lib.types.listOf lib.types.package;
       description = "Which MATE packages to exclude from the default environment";
     };
 
   };
 
-  config = mkMerge [
-    (mkIf (cfg.enable || cfg.enableWaylandSession) {
+  config = lib.mkMerge [
+    (lib.mkIf (cfg.enable || cfg.enableWaylandSession) {
       services.displayManager.sessionPackages = [
         pkgs.mate.mate-session-manager
       ];
 
       # Debugging
-      environment.sessionVariables.MATE_SESSION_DEBUG = mkIf cfg.debug "1";
+      environment.sessionVariables.MATE_SESSION_DEBUG = lib.mkIf cfg.debug "1";
 
       environment.systemPackages = utils.removePackagesByName (
         pkgs.mate.basePackages
@@ -83,11 +80,13 @@ in
 
       programs.dconf.enable = true;
       # Shell integration for VTE terminals
-      programs.bash.vteIntegration = mkDefault true;
-      programs.zsh.vteIntegration = mkDefault true;
+      programs.bash.vteIntegration = lib.mkDefault true;
+      programs.zsh.vteIntegration = lib.mkDefault true;
 
       # Mate uses this for printing
-      programs.system-config-printer.enable = (mkIf config.services.printing.enable (mkDefault true));
+      programs.system-config-printer.enable = (
+        lib.mkIf config.services.printing.enable (lib.mkDefault true)
+      );
 
       services.gnome.at-spi2-core.enable = true;
       services.gnome.glib-networking.enable = true;
@@ -95,15 +94,15 @@ in
       services.udev.packages = [ pkgs.mate.mate-settings-daemon ];
       services.gvfs.enable = true;
       services.upower.enable = config.powerManagement.enable;
-      services.libinput.enable = mkDefault true;
+      services.libinput.enable = lib.mkDefault true;
 
       security.pam.services.mate-screensaver.unixAuth = true;
 
-      xdg.portal.configPackages = mkDefault [ pkgs.mate.mate-desktop ];
+      xdg.portal.configPackages = lib.mkDefault [ pkgs.mate.mate-desktop ];
 
       environment.pathsToLink = [ "/share" ];
     })
-    (mkIf cfg.enableWaylandSession {
+    (lib.mkIf cfg.enableWaylandSession {
       programs.wayfire.enable = true;
       programs.wayfire.plugins = [ pkgs.wayfirePlugins.firedecor ];
 

nixos/modules/services/x11/desktop-managers/none.nix

@@ -4,14 +4,13 @@
   pkgs,
   ...
 }:
-with lib;
 let
   runXdgAutostart = config.services.xserver.desktopManager.runXdgAutostartIfNone;
 in
 {
   options = {
-    services.xserver.desktopManager.runXdgAutostartIfNone = mkOption {
-      type = types.bool;
+    services.xserver.desktopManager.runXdgAutostartIfNone = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Whether to run XDG autostart files for sessions without a desktop manager
@@ -27,18 +26,18 @@ in
     };
   };
 
-  config = mkMerge [
+  config = lib.mkMerge [
     {
       services.xserver.desktopManager.session = [
         {
           name = "none";
-          start = optionalString runXdgAutostart ''
+          start = lib.optionalString runXdgAutostart ''
             /run/current-system/systemd/bin/systemctl --user start xdg-autostart-if-no-desktop-manager.target
           '';
         }
       ];
     }
-    (mkIf runXdgAutostart {
+    (lib.mkIf runXdgAutostart {
       systemd.user.targets.xdg-autostart-if-no-desktop-manager = {
         description = "Run XDG autostart files";
         # From `plasma-workspace`, `share/systemd/user/plasma-workspace@.target`.

nixos/modules/services/x11/desktop-managers/pantheon.nix

@@ -1,7 +1,4 @@
 { config, lib, utils, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.xserver.desktopManager.pantheon;
@@ -19,7 +16,7 @@ in
 
   meta = {
     doc = ./pantheon.md;
-    maintainers = teams.pantheon.members;
+    maintainers = lib.teams.pantheon.members;
   };
 
   options = {
@@ -27,24 +24,24 @@ in
     services.pantheon = {
 
       contractor = {
-         enable = mkEnableOption "contractor, a desktop-wide extension service used by Pantheon";
+         enable = lib.mkEnableOption "contractor, a desktop-wide extension service used by Pantheon";
       };
 
-      apps.enable = mkEnableOption "Pantheon default applications";
+      apps.enable = lib.mkEnableOption "Pantheon default applications";
 
     };
 
     services.xserver.desktopManager.pantheon = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Enable the pantheon desktop manager";
       };
 
-      sessionPath = mkOption {
+      sessionPath = lib.mkOption {
         default = [];
-        type = types.listOf types.package;
-        example = literalExpression "[ pkgs.gpaste ]";
+        type = lib.types.listOf lib.types.package;
+        example = lib.literalExpression "[ pkgs.gpaste ]";
         description = ''
           Additional list of packages to be added to the session search path.
           Useful for GSettings-conditional autostart.
@@ -53,46 +50,46 @@ in
         '';
       };
 
-      extraWingpanelIndicators = mkOption {
+      extraWingpanelIndicators = lib.mkOption {
         default = null;
-        type = with types; nullOr (listOf package);
+        type = with lib.types; nullOr (listOf package);
         description = "Indicators to add to Wingpanel.";
       };
 
-      extraSwitchboardPlugs = mkOption {
+      extraSwitchboardPlugs = lib.mkOption {
         default = null;
-        type = with types; nullOr (listOf package);
+        type = with lib.types; nullOr (listOf package);
         description = "Plugs to add to Switchboard.";
       };
 
-      extraGSettingsOverrides = mkOption {
+      extraGSettingsOverrides = lib.mkOption {
         default = "";
-        type = types.lines;
+        type = lib.types.lines;
         description = "Additional gsettings overrides.";
       };
 
-      extraGSettingsOverridePackages = mkOption {
+      extraGSettingsOverridePackages = lib.mkOption {
         default = [];
-        type = types.listOf types.path;
+        type = lib.types.listOf lib.types.path;
         description = "List of packages for which gsettings are overridden.";
       };
 
-      debug = mkEnableOption "gnome-session debug messages";
+      debug = lib.mkEnableOption "gnome-session debug messages";
 
     };
 
-    environment.pantheon.excludePackages = mkOption {
+    environment.pantheon.excludePackages = lib.mkOption {
       default = [];
-      example = literalExpression "[ pkgs.pantheon.elementary-camera ]";
-      type = types.listOf types.package;
+      example = lib.literalExpression "[ pkgs.pantheon.elementary-camera ]";
+      type = lib.types.listOf lib.types.package;
       description = "Which packages pantheon should exclude from the default environment";
     };
 
   };
 
 
-  config = mkMerge [
-    (mkIf cfg.enable {
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
       services.xserver.desktopManager.pantheon.sessionPath = utils.removePackagesByName [
         pkgs.pantheon.pantheon-agent-geoclue2
       ] config.environment.pantheon.excludePackages;
@@ -101,21 +98,21 @@ in
 
       # Ensure lightdm is used when Pantheon is enabled
       # Without it screen locking will be nonfunctional because of the use of lightlocker
-      warnings = optional (config.services.xserver.displayManager.lightdm.enable != true)
+      warnings = lib.optional (config.services.xserver.displayManager.lightdm.enable != true)
         ''
           Using Pantheon without LightDM as a displayManager will break screenlocking from the UI.
         '';
 
-      services.xserver.displayManager.lightdm.greeters.pantheon.enable = mkDefault true;
+      services.xserver.displayManager.lightdm.greeters.pantheon.enable = lib.mkDefault true;
 
       # Without this, elementary LightDM greeter will pre-select non-existent `default` session
       # https://github.com/elementary/greeter/issues/368
-      services.displayManager.defaultSession = mkDefault "pantheon";
+      services.displayManager.defaultSession = lib.mkDefault "pantheon";
 
       services.xserver.displayManager.sessionCommands = ''
         if test "$XDG_CURRENT_DESKTOP" = "Pantheon"; then
             true
-            ${concatMapStrings (p: ''
+            ${lib.concatMapStrings (p: ''
               if [ -d "${p}/share/gsettings-schemas/${p.name}" ]; then
                 export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}${p}/share/gsettings-schemas/${p.name}
               fi
@@ -129,38 +126,38 @@ in
       '';
 
       # Default services
-      hardware.bluetooth.enable = mkDefault true;
+      hardware.bluetooth.enable = lib.mkDefault true;
       security.polkit.enable = true;
       services.accounts-daemon.enable = true;
       services.bamf.enable = true;
-      services.colord.enable = mkDefault true;
-      services.fwupd.enable = mkDefault true;
+      services.colord.enable = lib.mkDefault true;
+      services.fwupd.enable = lib.mkDefault true;
       # TODO: Enable once #177946 is resolved
       # services.packagekit.enable = mkDefault true;
-      services.power-profiles-daemon.enable = mkDefault true;
-      services.touchegg.enable = mkDefault true;
+      services.power-profiles-daemon.enable = lib.mkDefault true;
+      services.touchegg.enable = lib.mkDefault true;
       services.touchegg.package = pkgs.pantheon.touchegg;
-      services.tumbler.enable = mkDefault true;
-      services.system-config-printer.enable = (mkIf config.services.printing.enable (mkDefault true));
+      services.tumbler.enable = lib.mkDefault true;
+      services.system-config-printer.enable = (lib.mkIf config.services.printing.enable (lib.mkDefault true));
       services.dbus.packages = with pkgs.pantheon; [
         switchboard-plug-power
         elementary-default-settings # accountsservice extensions
       ];
-      services.pantheon.apps.enable = mkDefault true;
-      services.pantheon.contractor.enable = mkDefault true;
+      services.pantheon.apps.enable = lib.mkDefault true;
+      services.pantheon.contractor.enable = lib.mkDefault true;
       services.gnome.at-spi2-core.enable = true;
       services.gnome.evolution-data-server.enable = true;
       services.gnome.glib-networking.enable = true;
       services.gnome.gnome-keyring.enable = true;
       services.gvfs.enable = true;
-      services.gnome.rygel.enable = mkDefault true;
+      services.gnome.rygel.enable = lib.mkDefault true;
       services.udisks2.enable = true;
       services.upower.enable = config.powerManagement.enable;
-      services.libinput.enable = mkDefault true;
-      services.switcherooControl.enable = mkDefault true;
+      services.libinput.enable = lib.mkDefault true;
+      services.switcherooControl.enable = lib.mkDefault true;
       services.xserver.updateDbusEnvironment = true;
-      services.zeitgeist.enable = mkDefault true;
-      services.geoclue2.enable = mkDefault true;
+      services.zeitgeist.enable = lib.mkDefault true;
+      services.geoclue2.enable = lib.mkDefault true;
       # pantheon has pantheon-agent-geoclue2
       services.geoclue2.enableDemoAgent = false;
       services.geoclue2.appConfig."io.elementary.desktop.agent-geoclue2" = {
@@ -173,7 +170,7 @@ in
         # https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/1443
         pkgs.pantheon.mutter
       ];
-      services.orca.enable = mkDefault (notExcluded pkgs.orca);
+      services.orca.enable = lib.mkDefault (notExcluded pkgs.orca);
       systemd.packages = with pkgs; [
         gnome-session
         pantheon.gala
@@ -181,7 +178,7 @@ in
         pantheon.elementary-session-settings
       ];
       programs.dconf.enable = true;
-      networking.networkmanager.enable = mkDefault true;
+      networking.networkmanager.enable = lib.mkDefault true;
 
       systemd.user.targets."gnome-session-x11-services".wants = [
         "org.gnome.SettingsDaemon.XSettings.service"
@@ -246,12 +243,12 @@ in
         xdg-desktop-portal-pantheon
       ]);
 
-      xdg.portal.configPackages = mkDefault [ pkgs.pantheon.elementary-default-settings ];
+      xdg.portal.configPackages = lib.mkDefault [ pkgs.pantheon.elementary-default-settings ];
 
       # Override GSettings schemas
       environment.sessionVariables.NIX_GSETTINGS_OVERRIDES_DIR = "${nixos-gsettings-desktop-schemas}/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas";
 
-      environment.sessionVariables.GNOME_SESSION_DEBUG = mkIf cfg.debug "1";
+      environment.sessionVariables.GNOME_SESSION_DEBUG = lib.mkIf cfg.debug "1";
 
       environment.pathsToLink = [
         # FIXME: modules should link subdirs of `/share` rather than relying on this
@@ -265,8 +262,8 @@ in
       programs.nm-applet.indicator = false;
 
       # Shell integration for VTE terminals
-      programs.bash.vteIntegration = mkDefault true;
-      programs.zsh.vteIntegration = mkDefault true;
+      programs.bash.vteIntegration = lib.mkDefault true;
+      programs.zsh.vteIntegration = lib.mkDefault true;
 
       # Default Fonts
       fonts.packages = with pkgs; [
@@ -282,9 +279,9 @@ in
       };
     })
 
-    (mkIf serviceCfg.apps.enable {
-      programs.evince.enable = mkDefault (notExcluded pkgs.evince);
-      programs.file-roller.enable = mkDefault (notExcluded pkgs.file-roller);
+    (lib.mkIf serviceCfg.apps.enable {
+      programs.evince.enable = lib.mkDefault (notExcluded pkgs.evince);
+      programs.file-roller.enable = lib.mkDefault (notExcluded pkgs.file-roller);
 
       environment.systemPackages = utils.removePackagesByName ([
         pkgs.gnome-font-viewer
@@ -315,7 +312,7 @@ in
       ];
     })
 
-    (mkIf serviceCfg.contractor.enable {
+    (lib.mkIf serviceCfg.contractor.enable {
       environment.systemPackages = with pkgs.pantheon; [
         contractor
         file-roller-contract

nixos/modules/services/x11/desktop-managers/retroarch.nix

@@ -4,23 +4,20 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.xserver.desktopManager.retroarch;
 
 in
 {
   options.services.xserver.desktopManager.retroarch = {
-    enable = mkEnableOption "RetroArch";
+    enable = lib.mkEnableOption "RetroArch";
 
-    package = mkPackageOption pkgs "retroarch" {
+    package = lib.mkPackageOption pkgs "retroarch" {
       example = "retroarch-full";
     };
 
-    extraArgs = mkOption {
-      type = types.listOf types.str;
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [ ];
       example = [
         "--verbose"
@@ -30,12 +27,12 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     services.xserver.desktopManager.session = [
       {
         name = "RetroArch";
         start = ''
-          ${cfg.package}/bin/retroarch -f ${escapeShellArgs cfg.extraArgs} &
+          ${cfg.package}/bin/retroarch -f ${lib.escapeShellArgs cfg.extraArgs} &
           waitPID=$!
         '';
       }
@@ -44,5 +41,5 @@ in
     environment.systemPackages = [ cfg.package ];
   };
 
-  meta.maintainers = with maintainers; [ j0hax ];
+  meta.maintainers = with lib.maintainers; [ j0hax ];
 }

nixos/modules/services/x11/desktop-managers/surf-display.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.xserver.desktopManager.surf-display;
 
@@ -51,18 +48,18 @@ in
 {
   options = {
     services.xserver.desktopManager.surf-display = {
-      enable = mkEnableOption "surf-display as a kiosk browser session";
+      enable = lib.mkEnableOption "surf-display as a kiosk browser session";
 
-      defaultWwwUri = mkOption {
-        type = types.str;
+      defaultWwwUri = lib.mkOption {
+        type = lib.types.str;
         default = "${pkgs.surf-display}/share/surf-display/empty-page.html";
-        defaultText = literalExpression ''"''${pkgs.surf-display}/share/surf-display/empty-page.html"'';
+        defaultText = lib.literalExpression ''"''${pkgs.surf-display}/share/surf-display/empty-page.html"'';
         example = "https://www.example.com/";
         description = "Default URI to display.";
       };
 
-      inactivityInterval = mkOption {
-        type = types.int;
+      inactivityInterval = lib.mkOption {
+        type = lib.types.int;
         default = 300;
         example = 0;
         description = ''
@@ -75,16 +72,16 @@ in
         '';
       };
 
-      screensaverSettings = mkOption {
-        type = types.separatedString " ";
+      screensaverSettings = lib.mkOption {
+        type = lib.types.separatedString " ";
         default = "";
         description = ''
           Screensaver settings, see `man 1 xset` for possible options.
         '';
       };
 
-      pointerButtonMap = mkOption {
-        type = types.str;
+      pointerButtonMap = lib.mkOption {
+        type = lib.types.str;
         default = "1 0 0 4 5 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0";
         description = ''
           Disable right and middle pointer device click in browser sessions
@@ -93,15 +90,15 @@ in
         '';
       };
 
-      hideIdlePointer = mkOption {
-        type = types.str;
+      hideIdlePointer = lib.mkOption {
+        type = lib.types.str;
         default = "yes";
         example = "no";
         description = "Hide idle mouse pointer.";
       };
 
-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         example = ''
           # Enforce fixed resolution for all displays (default: not set):
@@ -124,7 +121,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     services.displayManager.sessionPackages = [
       pkgs.surf-display
     ];

nixos/modules/services/x11/desktop-managers/xfce.nix

@@ -1,7 +1,4 @@
 { config, lib, pkgs, utils, ... }:
-
-with lib;
-
 let
   cfg = config.services.xserver.desktopManager.xfce;
   excludePackages = config.environment.xfce.excludePackages;
@@ -9,70 +6,70 @@ let
 in
 {
   meta = {
-    maintainers = teams.xfce.members;
+    maintainers = lib.teams.xfce.members;
   };
 
   imports = [
     # added 2019-08-18
     # needed to preserve some semblance of UI familarity
     # with original XFCE module
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "xserver" "desktopManager" "xfce4-14" "extraSessionCommands" ]
       [ "services" "xserver" "displayManager" "sessionCommands" ])
 
     # added 2019-11-04
     # xfce4-14 module removed and promoted to xfce.
     # Needed for configs that used xfce4-14 module to migrate to this one.
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "xserver" "desktopManager" "xfce4-14" "enable" ]
       [ "services" "xserver" "desktopManager" "xfce" "enable" ])
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "xserver" "desktopManager" "xfce4-14" "noDesktop" ]
       [ "services" "xserver" "desktopManager" "xfce" "noDesktop" ])
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "xserver" "desktopManager" "xfce4-14" "enableXfwm" ]
       [ "services" "xserver" "desktopManager" "xfce" "enableXfwm" ])
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "xserver" "desktopManager" "xfce" "extraSessionCommands" ]
       [ "services" "xserver" "displayManager" "sessionCommands" ])
-    (mkRemovedOptionModule [ "services" "xserver" "desktopManager" "xfce" "screenLock" ] "")
+    (lib.mkRemovedOptionModule [ "services" "xserver" "desktopManager" "xfce" "screenLock" ] "")
 
     # added 2022-06-26
     # thunar has its own module
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "xserver" "desktopManager" "xfce" "thunarPlugins" ]
       [ "programs" "thunar" "plugins" ])
   ];
 
   options = {
     services.xserver.desktopManager.xfce = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Enable the Xfce desktop environment.";
       };
 
-      noDesktop = mkOption {
-        type = types.bool;
+      noDesktop = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Don't install XFCE desktop components (xfdesktop and panel).";
       };
 
-      enableXfwm = mkOption {
-        type = types.bool;
+      enableXfwm = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = "Enable the XFWM (default) window manager.";
       };
 
-      enableScreensaver = mkOption {
-        type = types.bool;
+      enableScreensaver = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = "Enable the XFCE screensaver.";
       };
 
-      enableWaylandSession = mkEnableOption "the experimental Xfce Wayland session";
+      enableWaylandSession = lib.mkEnableOption "the experimental Xfce Wayland session";
 
-      waylandSessionCompositor = mkOption {
+      waylandSessionCompositor = lib.mkOption {
         type = lib.types.str;
         default = "";
         example = "wayfire";
@@ -87,15 +84,15 @@ in
       };
     };
 
-    environment.xfce.excludePackages = mkOption {
+    environment.xfce.excludePackages = lib.mkOption {
       default = [];
-      example = literalExpression "[ pkgs.xfce.xfce4-volumed-pulse ]";
-      type = types.listOf types.package;
+      example = lib.literalExpression "[ pkgs.xfce.xfce4-volumed-pulse ]";
+      type = lib.types.listOf lib.types.package;
       description = "Which packages XFCE should exclude from the default environment";
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = utils.removePackagesByName (with pkgs; [
       glib # for gsettings
       gtk3.out # gtk-update-icon-cache
@@ -147,10 +144,10 @@ in
         xfce.xfdesktop
       ] ++ optional cfg.enableScreensaver xfce.xfce4-screensaver) excludePackages;
 
-    programs.gnupg.agent.pinentryPackage = mkDefault pkgs.pinentry-gtk2;
+    programs.gnupg.agent.pinentryPackage = lib.mkDefault pkgs.pinentry-gtk2;
     programs.xfconf.enable = true;
     programs.thunar.enable = true;
-    programs.labwc.enable = mkDefault (cfg.enableWaylandSession && (
+    programs.labwc.enable = lib.mkDefault (cfg.enableWaylandSession && (
       cfg.waylandSessionCompositor == "" || lib.substring 0 5 cfg.waylandSessionCompositor == "labwc"));
 
     environment.pathsToLink = [
@@ -173,7 +170,7 @@ in
 
     # Copied from https://gitlab.xfce.org/xfce/xfce4-session/-/blob/xfce4-session-4.19.2/xfce-wayland.desktop.in
     # to maintain consistent l10n state with X11 session file and to support the waylandSessionCompositor option.
-    services.displayManager.sessionPackages = optionals cfg.enableWaylandSession [
+    services.displayManager.sessionPackages = lib.optionals cfg.enableWaylandSession [
       ((pkgs.writeTextDir "share/wayland-sessions/xfce-wayland.desktop" ''
         [Desktop Entry]
         Version=1.0
@@ -198,16 +195,16 @@ in
     services.gnome.glib-networking.enable = true;
     services.gvfs.enable = true;
     services.tumbler.enable = true;
-    services.system-config-printer.enable = (mkIf config.services.printing.enable (mkDefault true));
-    services.libinput.enable = mkDefault true; # used in xfce4-settings-manager
-    services.colord.enable = mkDefault true;
+    services.system-config-printer.enable = (lib.mkIf config.services.printing.enable (lib.mkDefault true));
+    services.libinput.enable = lib.mkDefault true; # used in xfce4-settings-manager
+    services.colord.enable = lib.mkDefault true;
 
     # Enable default programs
     programs.dconf.enable = true;
 
     # Shell integration for VTE terminals
-    programs.bash.vteIntegration = mkDefault true;
-    programs.zsh.vteIntegration = mkDefault true;
+    programs.bash.vteIntegration = lib.mkDefault true;
+    programs.zsh.vteIntegration = lib.mkDefault true;
 
     # Systemd services
     systemd.packages = utils.removePackagesByName (with pkgs.xfce; [
@@ -216,6 +213,6 @@ in
 
     security.pam.services.xfce4-screensaver.unixAuth = cfg.enableScreensaver;
 
-    xdg.portal.configPackages = mkDefault [ pkgs.xfce.xfce4-session ];
+    xdg.portal.configPackages = lib.mkDefault [ pkgs.xfce.xfce4-session ];
   };
 }

nixos/modules/services/x11/desktop-managers/xterm.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
 
   cfg = config.services.xserver.desktopManager.xterm;
@@ -17,18 +14,18 @@ in
 {
   options = {
 
-    services.xserver.desktopManager.xterm.enable = mkOption {
-      type = types.bool;
-      default = versionOlder config.system.stateVersion "19.09" && xSessionEnabled;
-      defaultText = literalExpression ''versionOlder config.system.stateVersion "19.09" && config.services.xserver.enable;'';
+    services.xserver.desktopManager.xterm.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = lib.versionOlder config.system.stateVersion "19.09" && xSessionEnabled;
+      defaultText = lib.literalExpression ''versionOlder config.system.stateVersion "19.09" && config.services.xserver.enable;'';
       description = "Enable a xterm terminal as a desktop manager.";
     };
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
-    services.xserver.desktopManager.session = singleton {
+    services.xserver.desktopManager.session = lib.singleton {
       name = "xterm";
       start = ''
         ${pkgs.xterm}/bin/xterm -ls &

nixos/modules/services/x11/display-managers/lightdm-greeters/enso-os.nix

@@ -4,8 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
 let
   dmcfg = config.services.xserver.displayManager;
   ldmcfg = dmcfg.lightdm;
@@ -29,8 +27,8 @@ in
 {
   options = {
     services.xserver.displayManager.lightdm.greeters.enso = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable enso-os-greeter as the lightdm greeter
@@ -38,17 +36,17 @@ in
       };
 
       theme = {
-        package = mkOption {
-          type = types.package;
+        package = lib.mkOption {
+          type = lib.types.package;
           default = pkgs.gnome-themes-extra;
-          defaultText = literalExpression "pkgs.gnome-themes-extra";
+          defaultText = lib.literalExpression "pkgs.gnome-themes-extra";
           description = ''
             The package path that contains the theme given in the name option.
           '';
         };
 
-        name = mkOption {
-          type = types.str;
+        name = lib.mkOption {
+          type = lib.types.str;
           default = "Adwaita";
           description = ''
             Name of the theme to use for the lightdm-enso-os-greeter
@@ -57,17 +55,17 @@ in
       };
 
       iconTheme = {
-        package = mkOption {
-          type = types.package;
+        package = lib.mkOption {
+          type = lib.types.package;
           default = pkgs.papirus-icon-theme;
-          defaultText = literalExpression "pkgs.papirus-icon-theme";
+          defaultText = lib.literalExpression "pkgs.papirus-icon-theme";
           description = ''
             The package path that contains the icon theme given in the name option.
           '';
         };
 
-        name = mkOption {
-          type = types.str;
+        name = lib.mkOption {
+          type = lib.types.str;
           default = "ePapirus";
           description = ''
             Name of the icon theme to use for the lightdm-enso-os-greeter
@@ -76,17 +74,17 @@ in
       };
 
       cursorTheme = {
-        package = mkOption {
-          type = types.package;
+        package = lib.mkOption {
+          type = lib.types.package;
           default = pkgs.capitaine-cursors;
-          defaultText = literalExpression "pkgs.capitaine-cursors";
+          defaultText = lib.literalExpression "pkgs.capitaine-cursors";
           description = ''
             The package path that contains the cursor theme given in the name option.
           '';
         };
 
-        name = mkOption {
-          type = types.str;
+        name = lib.mkOption {
+          type = lib.types.str;
           default = "capitane-cursors";
           description = ''
             Name of the cursor theme to use for the lightdm-enso-os-greeter
@@ -94,24 +92,24 @@ in
         };
       };
 
-      blur = mkOption {
-        type = types.bool;
+      blur = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether or not to enable blur
         '';
       };
 
-      brightness = mkOption {
-        type = types.int;
+      brightness = lib.mkOption {
+        type = lib.types.int;
         default = 7;
         description = ''
           Brightness
         '';
       };
 
-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         description = ''
           Extra configuration that should be put in the greeter.conf
@@ -121,7 +119,7 @@ in
     };
   };
 
-  config = mkIf (ldmcfg.enable && cfg.enable) {
+  config = lib.mkIf (ldmcfg.enable && cfg.enable) {
     environment.etc."lightdm/greeter.conf".source = ensoGreeterConf;
 
     environment.systemPackages = [
@@ -131,14 +129,14 @@ in
     ];
 
     services.xserver.displayManager.lightdm = {
-      greeter = mkDefault {
+      greeter = lib.mkDefault {
         package = pkgs.lightdm-enso-os-greeter.xgreeters;
         name = "pantheon-greeter";
       };
 
       greeters = {
         gtk = {
-          enable = mkDefault false;
+          enable = lib.mkDefault false;
         };
       };
     };

nixos/modules/services/x11/display-managers/lightdm-greeters/gtk.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
 
   dmcfg = config.services.xserver.displayManager;
@@ -27,9 +24,11 @@ let
     cursor-theme-name = ${cfg.cursorTheme.name}
     cursor-theme-size = ${toString cfg.cursorTheme.size}
     background = ${ldmcfg.background}
-    ${optionalString (cfg.clock-format != null) "clock-format = ${cfg.clock-format}"}
-    ${optionalString (cfg.indicators != null) "indicators = ${concatStringsSep ";" cfg.indicators}"}
-    ${optionalString (xcfg.dpi != null) "xft-dpi=${toString xcfg.dpi}"}
+    ${lib.optionalString (cfg.clock-format != null) "clock-format = ${cfg.clock-format}"}
+    ${lib.optionalString (
+      cfg.indicators != null
+    ) "indicators = ${lib.concatStringsSep ";" cfg.indicators}"}
+    ${lib.optionalString (xcfg.dpi != null) "xft-dpi=${toString xcfg.dpi}"}
     ${cfg.extraConfig}
   '';
 
@@ -39,8 +38,8 @@ in
 
     services.xserver.displayManager.lightdm.greeters.gtk = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Whether to enable lightdm-gtk-greeter as the lightdm greeter.
@@ -49,17 +48,17 @@ in
 
       theme = {
 
-        package = mkOption {
-          type = types.package;
+        package = lib.mkOption {
+          type = lib.types.package;
           default = pkgs.gnome-themes-extra;
-          defaultText = literalExpression "pkgs.gnome-themes-extra";
+          defaultText = lib.literalExpression "pkgs.gnome-themes-extra";
           description = ''
             The package path that contains the theme given in the name option.
           '';
         };
 
-        name = mkOption {
-          type = types.str;
+        name = lib.mkOption {
+          type = lib.types.str;
           default = "Adwaita";
           description = ''
             Name of the theme to use for the lightdm-gtk-greeter.
@@ -70,17 +69,17 @@ in
 
       iconTheme = {
 
-        package = mkOption {
-          type = types.package;
+        package = lib.mkOption {
+          type = lib.types.package;
           default = pkgs.adwaita-icon-theme;
-          defaultText = literalExpression "pkgs.adwaita-icon-theme";
+          defaultText = lib.literalExpression "pkgs.adwaita-icon-theme";
           description = ''
             The package path that contains the icon theme given in the name option.
           '';
         };
 
-        name = mkOption {
-          type = types.str;
+        name = lib.mkOption {
+          type = lib.types.str;
           default = "Adwaita";
           description = ''
             Name of the icon theme to use for the lightdm-gtk-greeter.
@@ -91,25 +90,25 @@ in
 
       cursorTheme = {
 
-        package = mkOption {
-          type = types.package;
+        package = lib.mkOption {
+          type = lib.types.package;
           default = pkgs.adwaita-icon-theme;
-          defaultText = literalExpression "pkgs.adwaita-icon-theme";
+          defaultText = lib.literalExpression "pkgs.adwaita-icon-theme";
           description = ''
             The package path that contains the cursor theme given in the name option.
           '';
         };
 
-        name = mkOption {
-          type = types.str;
+        name = lib.mkOption {
+          type = lib.types.str;
           default = "Adwaita";
           description = ''
             Name of the cursor theme to use for the lightdm-gtk-greeter.
           '';
         };
 
-        size = mkOption {
-          type = types.int;
+        size = lib.mkOption {
+          type = lib.types.int;
           default = 16;
           description = ''
             Size of the cursor theme to use for the lightdm-gtk-greeter.
@@ -117,8 +116,8 @@ in
         };
       };
 
-      clock-format = mkOption {
-        type = types.nullOr types.str;
+      clock-format = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         example = "%F";
         description = ''
@@ -129,8 +128,8 @@ in
         '';
       };
 
-      indicators = mkOption {
-        type = types.nullOr (types.listOf types.str);
+      indicators = lib.mkOption {
+        type = lib.types.nullOr (lib.types.listOf lib.types.str);
         default = null;
         example = [
           "~host"
@@ -155,8 +154,8 @@ in
         '';
       };
 
-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         description = ''
           Extra configuration that should be put in the lightdm-gtk-greeter.conf
@@ -168,9 +167,9 @@ in
 
   };
 
-  config = mkIf (ldmcfg.enable && cfg.enable) {
+  config = lib.mkIf (ldmcfg.enable && cfg.enable) {
 
-    services.xserver.displayManager.lightdm.greeter = mkDefault {
+    services.xserver.displayManager.lightdm.greeter = lib.mkDefault {
       package = pkgs.lightdm-gtk-greeter.xgreeters;
       name = "lightdm-gtk-greeter";
     };

nixos/modules/services/x11/display-managers/lightdm-greeters/mini.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
 
   dmcfg = config.services.xserver.displayManager;
@@ -56,8 +53,8 @@ in
 
     services.xserver.displayManager.lightdm.greeters.mini = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable lightdm-mini-greeter as the lightdm greeter.
@@ -68,16 +65,16 @@ in
         '';
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "root";
         description = ''
           The user to login as.
         '';
       };
 
-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         description = ''
           Extra configuration that should be put in the lightdm-mini-greeter.conf
@@ -89,11 +86,11 @@ in
 
   };
 
-  config = mkIf (ldmcfg.enable && cfg.enable) {
+  config = lib.mkIf (ldmcfg.enable && cfg.enable) {
 
     services.xserver.displayManager.lightdm.greeters.gtk.enable = false;
 
-    services.xserver.displayManager.lightdm.greeter = mkDefault {
+    services.xserver.displayManager.lightdm.greeter = lib.mkDefault {
       package = pkgs.lightdm-mini-greeter.xgreeters;
       name = "lightdm-mini-greeter";
     };

nixos/modules/services/x11/display-managers/lightdm-greeters/mobile.nix

@@ -4,8 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
 let
   dmcfg = config.services.xserver.displayManager;
   ldmcfg = dmcfg.lightdm;
@@ -14,14 +12,14 @@ in
 {
   options = {
     services.xserver.displayManager.lightdm.greeters.mobile = {
-      enable = mkEnableOption "lightdm-mobile-greeter as the lightdm greeter";
+      enable = lib.mkEnableOption "lightdm-mobile-greeter as the lightdm greeter";
     };
   };
 
-  config = mkIf (ldmcfg.enable && cfg.enable) {
+  config = lib.mkIf (ldmcfg.enable && cfg.enable) {
     services.xserver.displayManager.lightdm.greeters.gtk.enable = false;
 
-    services.xserver.displayManager.lightdm.greeter = mkDefault {
+    services.xserver.displayManager.lightdm.greeter = lib.mkDefault {
       package = pkgs.lightdm-mobile-greeter.xgreeters;
       name = "lightdm-mobile-greeter";
     };

nixos/modules/services/x11/display-managers/lightdm-greeters/pantheon.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
 
   dmcfg = config.services.xserver.displayManager;
@@ -23,8 +20,8 @@ in
 
     services.xserver.displayManager.lightdm.greeters.pantheon = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable elementary-greeter as the lightdm greeter.
@@ -35,11 +32,11 @@ in
 
   };
 
-  config = mkIf (ldmcfg.enable && cfg.enable) {
+  config = lib.mkIf (ldmcfg.enable && cfg.enable) {
 
     services.xserver.displayManager.lightdm.greeters.gtk.enable = false;
 
-    services.xserver.displayManager.lightdm.greeter = mkDefault {
+    services.xserver.displayManager.lightdm.greeter = lib.mkDefault {
       package = pkgs.pantheon.elementary-greeter.xgreeters;
       name = "io.elementary.greeter";
     };

nixos/modules/services/x11/display-managers/lightdm-greeters/slick.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   ldmcfg = config.services.xserver.displayManager.lightdm;
   cfg = ldmcfg.greeters.slick;
@@ -26,27 +23,27 @@ let
     font-name=${cfg.font.name}
     cursor-theme-name=${cfg.cursorTheme.name}
     cursor-theme-size=${toString cfg.cursorTheme.size}
-    draw-user-backgrounds=${boolToString cfg.draw-user-backgrounds}
+    draw-user-backgrounds=${lib.boolToString cfg.draw-user-backgrounds}
     ${cfg.extraConfig}
   '';
 in
 {
   options = {
     services.xserver.displayManager.lightdm.greeters.slick = {
-      enable = mkEnableOption "lightdm-slick-greeter as the lightdm greeter";
+      enable = lib.mkEnableOption "lightdm-slick-greeter as the lightdm greeter";
 
       theme = {
-        package = mkOption {
-          type = types.package;
+        package = lib.mkOption {
+          type = lib.types.package;
           default = pkgs.gnome-themes-extra;
-          defaultText = literalExpression "pkgs.gnome-themes-extra";
+          defaultText = lib.literalExpression "pkgs.gnome-themes-extra";
           description = ''
             The package path that contains the theme given in the name option.
           '';
         };
 
-        name = mkOption {
-          type = types.str;
+        name = lib.mkOption {
+          type = lib.types.str;
           default = "Adwaita";
           description = ''
             Name of the theme to use for the lightdm-slick-greeter.
@@ -55,17 +52,17 @@ in
       };
 
       iconTheme = {
-        package = mkOption {
-          type = types.package;
+        package = lib.mkOption {
+          type = lib.types.package;
           default = pkgs.adwaita-icon-theme;
-          defaultText = literalExpression "pkgs.adwaita-icon-theme";
+          defaultText = lib.literalExpression "pkgs.adwaita-icon-theme";
           description = ''
             The package path that contains the icon theme given in the name option.
           '';
         };
 
-        name = mkOption {
-          type = types.str;
+        name = lib.mkOption {
+          type = lib.types.str;
           default = "Adwaita";
           description = ''
             Name of the icon theme to use for the lightdm-slick-greeter.
@@ -74,17 +71,17 @@ in
       };
 
       font = {
-        package = mkOption {
-          type = types.package;
+        package = lib.mkOption {
+          type = lib.types.package;
           default = pkgs.ubuntu-classic;
-          defaultText = literalExpression "pkgs.ubuntu-classic";
+          defaultText = lib.literalExpression "pkgs.ubuntu-classic";
           description = ''
             The package path that contains the font given in the name option.
           '';
         };
 
-        name = mkOption {
-          type = types.str;
+        name = lib.mkOption {
+          type = lib.types.str;
           default = "Ubuntu 11";
           description = ''
             Name of the font to use.
@@ -93,25 +90,25 @@ in
       };
 
       cursorTheme = {
-        package = mkOption {
-          type = types.package;
+        package = lib.mkOption {
+          type = lib.types.package;
           default = pkgs.adwaita-icon-theme;
-          defaultText = literalExpression "pkgs.adwaita-icon-theme";
+          defaultText = lib.literalExpression "pkgs.adwaita-icon-theme";
           description = ''
             The package path that contains the cursor theme given in the name option.
           '';
         };
 
-        name = mkOption {
-          type = types.str;
+        name = lib.mkOption {
+          type = lib.types.str;
           default = "Adwaita";
           description = ''
             Name of the cursor theme to use for the lightdm-slick-greeter.
           '';
         };
 
-        size = mkOption {
-          type = types.int;
+        size = lib.mkOption {
+          type = lib.types.int;
           default = 24;
           description = ''
             Size of the cursor theme to use for the lightdm-slick-greeter.
@@ -119,10 +116,10 @@ in
         };
       };
 
-      draw-user-backgrounds = mkEnableOption "draw user backgrounds";
+      draw-user-backgrounds = lib.mkEnableOption "draw user backgrounds";
 
-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         description = ''
           Extra configuration that should be put in the lightdm-slick-greeter.conf
@@ -132,10 +129,10 @@ in
     };
   };
 
-  config = mkIf (ldmcfg.enable && cfg.enable) {
+  config = lib.mkIf (ldmcfg.enable && cfg.enable) {
     services.xserver.displayManager.lightdm = {
       greeters.gtk.enable = false;
-      greeter = mkDefault {
+      greeter = lib.mkDefault {
         package = pkgs.lightdm-slick-greeter.xgreeters;
         name = "lightdm-slick-greeter";
       };

nixos/modules/services/x11/display-managers/lightdm-greeters/tiny.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
 
   dmcfg = config.services.xserver.displayManager;
@@ -19,8 +16,8 @@ in
 
     services.xserver.displayManager.lightdm.greeters.tiny = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable lightdm-tiny-greeter as the lightdm greeter.
@@ -32,16 +29,16 @@ in
       };
 
       label = {
-        user = mkOption {
-          type = types.str;
+        user = lib.mkOption {
+          type = lib.types.str;
           default = "Username";
           description = ''
             The string to represent the user_text label.
           '';
         };
 
-        pass = mkOption {
-          type = types.str;
+        pass = lib.mkOption {
+          type = lib.types.str;
           default = "Password";
           description = ''
             The string to represent the pass_text label.
@@ -49,8 +46,8 @@ in
         };
       };
 
-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         description = ''
           Section to describe style and ui.
@@ -61,7 +58,7 @@ in
 
   };
 
-  config = mkIf (ldmcfg.enable && cfg.enable) {
+  config = lib.mkIf (ldmcfg.enable && cfg.enable) {
 
     services.xserver.displayManager.lightdm.greeters.gtk.enable = false;
 
@@ -73,10 +70,10 @@ in
           static const char *pass_text = "${cfg.label.pass}";
           static const char *session = "${dmcfg.defaultSession}";
         '';
-        config = optionalString (cfg.extraConfig != "") (configHeader + cfg.extraConfig);
+        config = lib.optionalString (cfg.extraConfig != "") (configHeader + cfg.extraConfig);
         package = pkgs.lightdm-tiny-greeter.override { conf = config; };
       in
-      mkDefault {
+      lib.mkDefault {
         package = package.xgreeters;
         name = "lightdm-tiny-greeter";
       };

nixos/modules/services/x11/display-managers/lightdm.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
 
   xcfg = config.services.xserver;
@@ -22,7 +19,7 @@ let
   # lightdm runs with clearenv(), but we need a few things in the environment for X to startup
   xserverWrapper = writeScript "xserver-wrapper" ''
     #! ${pkgs.bash}/bin/bash
-    ${concatMapStrings (n: "export ${n}=\"${getAttr n xEnv}\"\n") (attrNames xEnv)}
+    ${lib.concatMapStrings (n: "export ${n}=\"${lib.getAttr n xEnv}\"\n") (lib.attrNames xEnv)}
 
     display=$(echo "$@" | xargs -n 1 | grep -P ^:\\d\$ | head -n 1 | sed s/^://)
     if [ -z "$display" ]
@@ -36,13 +33,13 @@ let
   usersConf = writeText "users.conf" ''
     [UserList]
     minimum-uid=1000
-    hidden-users=${concatStringsSep " " dmcfg.hiddenUsers}
+    hidden-users=${lib.concatStringsSep " " dmcfg.hiddenUsers}
     hidden-shells=/run/current-system/sw/bin/nologin
   '';
 
   lightdmConf = writeText "lightdm.conf" ''
     [LightDM]
-    ${optionalString cfg.greeter.enable ''
+    ${lib.optionalString cfg.greeter.enable ''
       greeter-user = ${config.users.users.lightdm.name}
       greeters-directory = ${cfg.greeter.package}
     ''}
@@ -52,15 +49,15 @@ let
     [Seat:*]
     xserver-command = ${xserverWrapper}
     session-wrapper = ${dmcfg.sessionData.wrapper}
-    ${optionalString cfg.greeter.enable ''
+    ${lib.optionalString cfg.greeter.enable ''
       greeter-session = ${cfg.greeter.name}
     ''}
-    ${optionalString dmcfg.autoLogin.enable ''
+    ${lib.optionalString dmcfg.autoLogin.enable ''
       autologin-user = ${dmcfg.autoLogin.user}
       autologin-user-timeout = ${toString cfg.autoLogin.timeout}
       autologin-session = ${sessionData.autologinSession}
     ''}
-    ${optionalString (xcfg.displayManager.setupCommands != "") ''
+    ${lib.optionalString (xcfg.displayManager.setupCommands != "") ''
       display-setup-script=${pkgs.writeScript "lightdm-display-setup" ''
         #!${pkgs.bash}/bin/bash
         ${xcfg.displayManager.setupCommands}
@@ -87,7 +84,7 @@ in
     ./lightdm-greeters/tiny.nix
     ./lightdm-greeters/slick.nix
     ./lightdm-greeters/mobile.nix
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "xserver" "displayManager" "lightdm" "autoLogin" "enable" ]
       [
         "services"
@@ -96,7 +93,7 @@ in
         "enable"
       ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "xserver" "displayManager" "lightdm" "autoLogin" "user" ]
       [
         "services"
@@ -111,8 +108,8 @@ in
 
     services.xserver.displayManager.lightdm = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable lightdm as the display manager.
@@ -120,24 +117,24 @@ in
       };
 
       greeter = {
-        enable = mkOption {
-          type = types.bool;
+        enable = lib.mkOption {
+          type = lib.types.bool;
           default = true;
           description = ''
             If set to false, run lightdm in greeterless mode. This only works if autologin
             is enabled and autoLogin.timeout is zero.
           '';
         };
-        package = mkOption {
-          type = types.package;
+        package = lib.mkOption {
+          type = lib.types.package;
           description = ''
             The LightDM greeter to login via. The package should be a directory
             containing a .desktop file matching the name in the 'name' option.
           '';
 
         };
-        name = mkOption {
-          type = types.str;
+        name = lib.mkOption {
+          type = lib.types.str;
           description = ''
             The name of a .desktop file in the directory specified
             in the 'package' option.
@@ -145,8 +142,8 @@ in
         };
       };
 
-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         example = ''
           user-authority-in-system-dir = true
@@ -154,17 +151,17 @@ in
         description = "Extra lines to append to LightDM section.";
       };
 
-      background = mkOption {
-        type = types.either types.path (types.strMatching "^#[0-9]\{6\}$");
+      background = lib.mkOption {
+        type = lib.types.either lib.types.path (lib.types.strMatching "^#[0-9]\{6\}$");
         # Manual cannot depend on packages, we are actually setting the default in config below.
-        defaultText = literalExpression "pkgs.nixos-artwork.wallpapers.simple-dark-gray-bottom.gnomeFilePath";
+        defaultText = lib.literalExpression "pkgs.nixos-artwork.wallpapers.simple-dark-gray-bottom.gnomeFilePath";
         description = ''
           The background image or color to use.
         '';
       };
 
-      extraSeatDefaults = mkOption {
-        type = types.lines;
+      extraSeatDefaults = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         example = ''
           greeter-show-manual-login=true
@@ -173,8 +170,8 @@ in
       };
 
       # Configuration for automatic login specific to LightDM
-      autoLogin.timeout = mkOption {
-        type = types.int;
+      autoLogin.timeout = lib.mkOption {
+        type = lib.types.int;
         default = 0;
         description = ''
           Show the greeter for this many seconds before automatic login occurs.
@@ -184,7 +181,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     assertions = [
       {
@@ -210,12 +207,12 @@ in
 
     # Keep in sync with the defaultText value from the option definition.
     services.xserver.displayManager.lightdm.background =
-      mkDefault pkgs.nixos-artwork.wallpapers.simple-dark-gray-bottom.gnomeFilePath;
+      lib.mkDefault pkgs.nixos-artwork.wallpapers.simple-dark-gray-bottom.gnomeFilePath;
 
     # Set default session in session chooser to a specified values – basically ignore session history.
     # Auto-login is already covered by a config value.
     services.displayManager.preStart =
-      optionalString (!dmcfg.autoLogin.enable && dmcfg.defaultSession != null)
+      lib.optionalString (!dmcfg.autoLogin.enable && dmcfg.defaultSession != null)
         ''
           ${setSessionScript}/bin/set-session ${dmcfg.defaultSession}
         '';

nixos/modules/services/x11/display-managers/slim.nix

@@ -4,13 +4,10 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 {
   # added 2019-11-11
   imports = [
-    (mkRemovedOptionModule [ "services" "xserver" "displayManager" "slim" ] ''
+    (lib.mkRemovedOptionModule [ "services" "xserver" "displayManager" "slim" ] ''
       The SLIM project is abandoned and their last release was in 2013.
       Because of this it poses a security risk to your system.
       Other issues include it not fully supporting systemd and logind sessions.

nixos/modules/services/x11/display-managers/startx.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
 
   cfg = config.services.xserver.displayManager.startx;
@@ -19,8 +16,8 @@ in
 
   options = {
     services.xserver.displayManager.startx = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable the dummy "startx" pseudo-display manager,
@@ -36,7 +33,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     services.xserver = {
       exportConfiguration = true;
     };
@@ -46,7 +43,7 @@ in
     #
     # To send log to Xorg's default log location ($XDG_DATA_HOME/xorg/), we do
     # not specify a log file when running X
-    services.xserver.logFile = mkDefault null;
+    services.xserver.logFile = lib.mkDefault null;
 
     # Implement xserverArgs via xinit's system-wide xserverrc
     environment.etc."X11/xinit/xserverrc".source = pkgs.writeShellScript "xserverrc" ''

nixos/modules/services/x11/display-managers/xpra.nix

@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.xserver.displayManager.xpra;
   dmcfg = config.services.xserver.displayManager;
@@ -13,46 +10,46 @@ in
 
   options = {
     services.xserver.displayManager.xpra = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable xpra as display manager.";
       };
 
-      bindTcp = mkOption {
+      bindTcp = lib.mkOption {
         default = "127.0.0.1:10000";
         example = "0.0.0.0:10000";
-        type = types.nullOr types.str;
+        type = lib.types.nullOr lib.types.str;
         description = "Bind xpra to TCP";
       };
 
-      desktop = mkOption {
-        type = types.nullOr types.str;
+      desktop = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         example = "gnome-shell";
         description = "Start a desktop environment instead of seamless mode";
       };
 
-      auth = mkOption {
-        type = types.str;
+      auth = lib.mkOption {
+        type = lib.types.str;
         default = "pam";
         example = "password:value=mysecret";
         description = "Authentication to use when connecting to xpra";
       };
 
-      pulseaudio = mkEnableOption "pulseaudio audio streaming";
+      pulseaudio = lib.mkEnableOption "pulseaudio audio streaming";
 
-      extraOptions = mkOption {
+      extraOptions = lib.mkOption {
         description = "Extra xpra options";
         default = [];
-        type = types.listOf types.str;
+        type = lib.types.listOf lib.types.str;
       };
     };
   };
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     services.xserver.videoDrivers = ["dummy"];
 
     services.xserver.monitorSection = ''
@@ -227,7 +224,7 @@ in
     '';
 
     services.displayManager.execCmd = ''
-      ${optionalString (cfg.pulseaudio)
+      ${lib.optionalString (cfg.pulseaudio)
         "export PULSE_COOKIE=/run/pulse/.config/pulse/cookie"}
       exec ${pkgs.xpra}/bin/xpra ${if cfg.desktop == null then "start" else "start-desktop --start=${cfg.desktop}"} \
         --daemon=off \
@@ -239,20 +236,20 @@ in
         --speaker=yes \
         --mdns=no \
         --pulseaudio=no \
-        ${optionalString (cfg.pulseaudio) "--sound-source=pulse"} \
+        ${lib.optionalString (cfg.pulseaudio) "--sound-source=pulse"} \
         --socket-dirs=/run/xpra \
-        --xvfb="xpra_Xdummy ${concatStringsSep " " dmcfg.xserverArgs}" \
-        ${optionalString (cfg.bindTcp != null) "--bind-tcp=${cfg.bindTcp}"} \
+        --xvfb="xpra_Xdummy ${lib.concatStringsSep " " dmcfg.xserverArgs}" \
+        ${lib.optionalString (cfg.bindTcp != null) "--bind-tcp=${cfg.bindTcp}"} \
         --auth=${cfg.auth} \
-        ${concatStringsSep " " cfg.extraOptions}
+        ${lib.concatStringsSep " " cfg.extraOptions}
     '';
 
     services.xserver.terminateOnReset = false;
 
     environment.systemPackages = [pkgs.xpra];
 
-    services.pulseaudio.enable = mkDefault cfg.pulseaudio;
-    services.pulseaudio.systemWide = mkDefault cfg.pulseaudio;
+    services.pulseaudio.enable = lib.mkDefault cfg.pulseaudio;
+    services.pulseaudio.systemWide = lib.mkDefault cfg.pulseaudio;
   };
 
 }

nixos/modules/services/x11/extra-layouts.nix

@@ -4,29 +4,26 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   layouts = config.services.xserver.xkb.extraLayouts;
 
   layoutOpts = {
     options = {
-      description = mkOption {
-        type = types.str;
+      description = lib.mkOption {
+        type = lib.types.str;
         description = "A short description of the layout.";
       };
 
-      languages = mkOption {
-        type = types.listOf types.str;
+      languages = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         description = ''
           A list of languages provided by the layout.
           (Use ISO 639-2 codes, for example: "eng" for english)
         '';
       };
 
-      compatFile = mkOption {
-        type = types.nullOr types.path;
+      compatFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         description = ''
           The path to the xkb compat file.
@@ -36,8 +33,8 @@ let
         '';
       };
 
-      geometryFile = mkOption {
-        type = types.nullOr types.path;
+      geometryFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         description = ''
           The path to the xkb geometry file.
@@ -47,8 +44,8 @@ let
         '';
       };
 
-      keycodesFile = mkOption {
-        type = types.nullOr types.path;
+      keycodesFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         description = ''
           The path to the xkb keycodes file.
@@ -58,8 +55,8 @@ let
         '';
       };
 
-      symbolsFile = mkOption {
-        type = types.nullOr types.path;
+      symbolsFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         description = ''
           The path to the xkb symbols file.
@@ -69,8 +66,8 @@ let
         '';
       };
 
-      typesFile = mkOption {
-        type = types.nullOr types.path;
+      typesFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         description = ''
           The path to the xkb types file.
@@ -111,10 +108,10 @@ in
   ###### interface
 
   options.services.xserver.xkb = {
-    extraLayouts = mkOption {
-      type = types.attrsOf (types.submodule layoutOpts);
+    extraLayouts = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule layoutOpts);
       default = { };
-      example = literalExpression ''
+      example = lib.literalExpression ''
         {
           mine = {
             description = "My custom xkb layout.";
@@ -136,7 +133,7 @@ in
 
   ###### implementation
 
-  config = mkIf (layouts != { }) {
+  config = lib.mkIf (layouts != { }) {
 
     environment.sessionVariables = {
       # runtime override supported by multiple libraries e. g. libxkbcommon

nixos/modules/services/x11/fractalart.nix

@@ -4,39 +4,38 @@
   pkgs,
   ...
 }:
-with lib;
 let
   cfg = config.services.fractalart;
 in
 {
   options.services.fractalart = {
-    enable = mkOption {
-      type = types.bool;
+    enable = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       example = true;
       description = "Enable FractalArt for generating colorful wallpapers on login";
     };
 
-    width = mkOption {
-      type = types.nullOr types.int;
+    width = lib.mkOption {
+      type = lib.types.nullOr lib.types.int;
       default = null;
       example = 1920;
       description = "Screen width";
     };
 
-    height = mkOption {
-      type = types.nullOr types.int;
+    height = lib.mkOption {
+      type = lib.types.nullOr lib.types.int;
       default = null;
       example = 1080;
       description = "Screen height";
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [ pkgs.haskellPackages.FractalArt ];
     services.xserver.displayManager.sessionCommands =
       "${pkgs.haskellPackages.FractalArt}/bin/FractalArt --no-bg -f .background-image"
-      + optionalString (cfg.width != null) " -w ${toString cfg.width}"
-      + optionalString (cfg.height != null) " -h ${toString cfg.height}";
+      + lib.optionalString (cfg.width != null) " -w ${toString cfg.width}"
+      + lib.optionalString (cfg.height != null) " -h ${toString cfg.height}";
   };
 }

nixos/modules/services/x11/hardware/cmt.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
 
   cfg = config.services.xserver.cmt;
@@ -18,13 +15,13 @@ in
   options = {
 
     services.xserver.cmt = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Enable chrome multitouch input (cmt). Touchpad drivers that are configured for chromebooks.";
       };
-      models = mkOption {
-        type = types.enum [
+      models = lib.mkOption {
+        type = lib.types.enum [
           "atlas"
           "banjo"
           "candy"
@@ -83,7 +80,7 @@ in
     }; # closes services
   }; # closes options
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     services.xserver.modules = [ pkgs.xf86_input_cmt ];
 

nixos/modules/services/x11/hardware/digimend.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
 
   cfg = config.services.xserver.digimend;
@@ -21,13 +18,13 @@ in
 
     services.xserver.digimend = {
 
-      enable = mkEnableOption "the digimend drivers for Huion/XP-Pen/etc. tablets";
+      enable = lib.mkEnableOption "the digimend drivers for Huion/XP-Pen/etc. tablets";
 
     };
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     # digimend drivers use xsetwacom and wacom X11 drivers
     services.xserver.wacom.enable = true;

nixos/modules/services/x11/hardware/synaptics.nix

@@ -5,9 +5,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.xserver.synaptics;
   opt = options.services.xserver.synaptics;
@@ -35,14 +32,14 @@ in
 
     services.xserver.synaptics = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable touchpad support. Deprecated: Consider services.libinput.enable.";
       };
 
-      dev = mkOption {
-        type = types.nullOr types.str;
+      dev = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         example = "/dev/input/event0";
         description = ''
@@ -51,73 +48,73 @@ in
         '';
       };
 
-      accelFactor = mkOption {
-        type = types.nullOr types.str;
+      accelFactor = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = "0.001";
         description = "Cursor acceleration (how fast speed increases from minSpeed to maxSpeed).";
       };
 
-      minSpeed = mkOption {
-        type = types.nullOr types.str;
+      minSpeed = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = "0.6";
         description = "Cursor speed factor for precision finger motion.";
       };
 
-      maxSpeed = mkOption {
-        type = types.nullOr types.str;
+      maxSpeed = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = "1.0";
         description = "Cursor speed factor for highest-speed finger motion.";
       };
 
-      scrollDelta = mkOption {
-        type = types.nullOr types.int;
+      scrollDelta = lib.mkOption {
+        type = lib.types.nullOr lib.types.int;
         default = null;
         example = 75;
         description = "Move distance of the finger for a scroll event.";
       };
 
-      twoFingerScroll = mkOption {
-        type = types.bool;
+      twoFingerScroll = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable two-finger drag-scrolling. Overridden by horizTwoFingerScroll and vertTwoFingerScroll.";
       };
 
-      horizTwoFingerScroll = mkOption {
-        type = types.bool;
+      horizTwoFingerScroll = lib.mkOption {
+        type = lib.types.bool;
         default = cfg.twoFingerScroll;
-        defaultText = literalExpression "config.${opt.twoFingerScroll}";
+        defaultText = lib.literalExpression "config.${opt.twoFingerScroll}";
         description = "Whether to enable horizontal two-finger drag-scrolling.";
       };
 
-      vertTwoFingerScroll = mkOption {
-        type = types.bool;
+      vertTwoFingerScroll = lib.mkOption {
+        type = lib.types.bool;
         default = cfg.twoFingerScroll;
-        defaultText = literalExpression "config.${opt.twoFingerScroll}";
+        defaultText = lib.literalExpression "config.${opt.twoFingerScroll}";
         description = "Whether to enable vertical two-finger drag-scrolling.";
       };
 
-      horizEdgeScroll = mkOption {
-        type = types.bool;
+      horizEdgeScroll = lib.mkOption {
+        type = lib.types.bool;
         default = !cfg.horizTwoFingerScroll;
-        defaultText = literalExpression "! config.${opt.horizTwoFingerScroll}";
+        defaultText = lib.literalExpression "! config.${opt.horizTwoFingerScroll}";
         description = "Whether to enable horizontal edge drag-scrolling.";
       };
 
-      vertEdgeScroll = mkOption {
-        type = types.bool;
+      vertEdgeScroll = lib.mkOption {
+        type = lib.types.bool;
         default = !cfg.vertTwoFingerScroll;
-        defaultText = literalExpression "! config.${opt.vertTwoFingerScroll}";
+        defaultText = lib.literalExpression "! config.${opt.vertTwoFingerScroll}";
         description = "Whether to enable vertical edge drag-scrolling.";
       };
 
-      tapButtons = mkOption {
-        type = types.bool;
+      tapButtons = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = "Whether to enable tap buttons.";
       };
 
-      buttonsMap = mkOption {
-        type = types.listOf types.int;
+      buttonsMap = lib.mkOption {
+        type = lib.types.listOf lib.types.int;
         default = [
           1
           2
@@ -132,8 +129,8 @@ in
         apply = map toString;
       };
 
-      fingersMap = mkOption {
-        type = types.listOf types.int;
+      fingersMap = lib.mkOption {
+        type = lib.types.listOf lib.types.int;
         default = [
           1
           2
@@ -148,34 +145,34 @@ in
         apply = map toString;
       };
 
-      palmDetect = mkOption {
-        type = types.bool;
+      palmDetect = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable palm detection (hardware support required)";
       };
 
-      palmMinWidth = mkOption {
-        type = types.nullOr types.int;
+      palmMinWidth = lib.mkOption {
+        type = lib.types.nullOr lib.types.int;
         default = null;
         example = 5;
         description = "Minimum finger width at which touch is considered a palm";
       };
 
-      palmMinZ = mkOption {
-        type = types.nullOr types.int;
+      palmMinZ = lib.mkOption {
+        type = lib.types.nullOr lib.types.int;
         default = null;
         example = 20;
         description = "Minimum finger pressure at which touch is considered a palm";
       };
 
-      horizontalScroll = mkOption {
-        type = types.bool;
+      horizontalScroll = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = "Whether to enable horizontal scrolling (on touchpad)";
       };
 
-      additionalOptions = mkOption {
-        type = types.str;
+      additionalOptions = lib.mkOption {
+        type = lib.types.str;
         default = "";
         example = ''
           Option "RTCornerButton" "2"
@@ -190,7 +187,7 @@ in
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     services.xserver.modules = [ pkg.out ];
 
@@ -203,12 +200,12 @@ in
       Section "InputClass"
         Identifier "synaptics touchpad catchall"
         MatchIsTouchpad "on"
-        ${optionalString (cfg.dev != null) ''MatchDevicePath "${cfg.dev}"''}
+        ${lib.optionalString (cfg.dev != null) ''MatchDevicePath "${cfg.dev}"''}
         Driver "synaptics"
-        ${optionalString (cfg.minSpeed != null) ''Option "MinSpeed" "${cfg.minSpeed}"''}
-        ${optionalString (cfg.maxSpeed != null) ''Option "MaxSpeed" "${cfg.maxSpeed}"''}
-        ${optionalString (cfg.accelFactor != null) ''Option "AccelFactor" "${cfg.accelFactor}"''}
-        ${optionalString cfg.tapButtons tapConfig}
+        ${lib.optionalString (cfg.minSpeed != null) ''Option "MinSpeed" "${cfg.minSpeed}"''}
+        ${lib.optionalString (cfg.maxSpeed != null) ''Option "MaxSpeed" "${cfg.maxSpeed}"''}
+        ${lib.optionalString (cfg.accelFactor != null) ''Option "AccelFactor" "${cfg.accelFactor}"''}
+        ${lib.optionalString cfg.tapButtons tapConfig}
         Option "ClickFinger1" "${builtins.elemAt cfg.buttonsMap 0}"
         Option "ClickFinger2" "${builtins.elemAt cfg.buttonsMap 1}"
         Option "ClickFinger3" "${builtins.elemAt cfg.buttonsMap 2}"
@@ -216,19 +213,19 @@ in
         Option "HorizTwoFingerScroll" "${if cfg.horizTwoFingerScroll then "1" else "0"}"
         Option "VertEdgeScroll" "${if cfg.vertEdgeScroll then "1" else "0"}"
         Option "HorizEdgeScroll" "${if cfg.horizEdgeScroll then "1" else "0"}"
-        ${optionalString cfg.palmDetect ''Option "PalmDetect" "1"''}
-        ${optionalString (
+        ${lib.optionalString cfg.palmDetect ''Option "PalmDetect" "1"''}
+        ${lib.optionalString (
           cfg.palmMinWidth != null
         ) ''Option "PalmMinWidth" "${toString cfg.palmMinWidth}"''}
-        ${optionalString (cfg.palmMinZ != null) ''Option "PalmMinZ" "${toString cfg.palmMinZ}"''}
-        ${optionalString (
+        ${lib.optionalString (cfg.palmMinZ != null) ''Option "PalmMinZ" "${toString cfg.palmMinZ}"''}
+        ${lib.optionalString (
           cfg.scrollDelta != null
         ) ''Option "VertScrollDelta" "${toString cfg.scrollDelta}"''}
         ${
           if !cfg.horizontalScroll then
             ''Option "HorizScrollDelta" "0"''
           else
-            (optionalString (
+            (lib.optionalString (
               cfg.scrollDelta != null
             ) ''Option "HorizScrollDelta" "${toString cfg.scrollDelta}"'')
         }

nixos/modules/services/x11/hardware/wacom.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
 
   cfg = config.services.xserver.wacom;
@@ -19,8 +16,8 @@ in
 
     services.xserver.wacom = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable the Wacom touchscreen/digitizer/tablet.
@@ -37,7 +34,7 @@ in
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     environment.systemPackages = [ pkgs.xf86_input_wacom ]; # provides xsetwacom
 

nixos/modules/services/x11/imwheel.nix

@@ -4,17 +4,16 @@
   pkgs,
   ...
 }:
-with lib;
 let
   cfg = config.services.xserver.imwheel;
 in
 {
   options = {
     services.xserver.imwheel = {
-      enable = mkEnableOption "IMWheel service";
+      enable = lib.mkEnableOption "IMWheel service";
 
-      extraOptions = mkOption {
-        type = types.listOf types.str;
+      extraOptions = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ "--buttons=45" ];
         example = [ "--debug" ];
         description = ''
@@ -23,10 +22,10 @@ in
         '';
       };
 
-      rules = mkOption {
-        type = types.attrsOf types.str;
+      rules = lib.mkOption {
+        type = lib.types.attrsOf lib.types.str;
         default = { };
-        example = literalExpression ''
+        example = lib.literalExpression ''
           {
             ".*" = '''
               None,      Up,   Button4, 8
@@ -49,11 +48,11 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [ pkgs.imwheel ];
 
     environment.etc."X11/imwheel/imwheelrc".source = pkgs.writeText "imwheelrc" (
-      concatStringsSep "\n\n" (mapAttrsToList (rule: conf: "\"${rule}\"\n${conf}") cfg.rules)
+      lib.concatStringsSep "\n\n" (lib.mapAttrsToList (rule: conf: "\"${rule}\"\n${conf}") cfg.rules)
     );
 
     systemd.user.services.imwheel = {
@@ -63,7 +62,7 @@ in
       serviceConfig = {
         ExecStart =
           "${pkgs.imwheel}/bin/imwheel "
-          + escapeShellArgs (
+          + lib.escapeShellArgs (
             [
               "--detach"
               "--kill"

nixos/modules/services/x11/picom.nix

@@ -5,9 +5,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
 
   cfg = config.services.picom;
@@ -15,46 +12,46 @@ let
 
   pairOf =
     x:
-    with types;
+    with lib.types;
     addCheck (listOf x) (y: length y == 2) // { description = "pair of ${x.description}"; };
 
-  mkDefaultAttrs = mapAttrs (n: v: mkDefault v);
+  mkDefaultAttrs = lib.mapAttrs (n: v: lib.mkDefault v);
 
   # Basically a tinkered lib.generators.mkKeyValueDefault
   # It either serializes a top-level definition "key: { values };"
   # or an expression "key = { values };"
   mkAttrsString =
     top:
-    mapAttrsToList (
+    lib.mapAttrsToList (
       k: v:
       let
-        sep = if (top && isAttrs v) then ":" else "=";
+        sep = if (top && lib.isAttrs v) then ":" else "=";
       in
-      "${escape [ sep ] k}${sep}${mkValueString v};"
+      "${lib.escape [ sep ] k}${sep}${mkValueString v};"
     );
 
   # This serializes a Nix expression to the libconfig format.
   mkValueString =
     v:
-    if types.bool.check v then
-      boolToString v
-    else if types.int.check v then
+    if lib.types.bool.check v then
+      lib.boolToString v
+    else if lib.types.int.check v then
       toString v
-    else if types.float.check v then
+    else if lib.types.float.check v then
       toString v
-    else if types.str.check v then
-      "\"${escape [ "\"" ] v}\""
+    else if lib.types.str.check v then
+      "\"${lib.escape [ "\"" ] v}\""
     else if builtins.isList v then
-      "[ ${concatMapStringsSep " , " mkValueString v} ]"
-    else if types.attrs.check v then
-      "{ ${concatStringsSep " " (mkAttrsString false v)} }"
+      "[ ${lib.concatMapStringsSep " , " mkValueString v} ]"
+    else if lib.types.attrs.check v then
+      "{ ${lib.concatStringsSep " " (mkAttrsString false v)} }"
     else
       throw ''
         invalid expression used in option services.picom.settings:
         ${v}
       '';
 
-  toConf = attrs: concatStringsSep "\n" (mkAttrsString true cfg.settings);
+  toConf = attrs: lib.concatStringsSep "\n" (mkAttrsString true cfg.settings);
 
   configFile = pkgs.writeText "picom.conf" (toConf cfg.settings);
 
@@ -62,38 +59,38 @@ in
 {
 
   imports = [
-    (mkAliasOptionModuleMD [ "services" "compton" ] [ "services" "picom" ])
-    (mkRemovedOptionModule [ "services" "picom" "refreshRate" ] ''
+    (lib.mkAliasOptionModuleMD [ "services" "compton" ] [ "services" "picom" ])
+    (lib.mkRemovedOptionModule [ "services" "picom" "refreshRate" ] ''
       This option corresponds to `refresh-rate`, which has been unused
       since picom v6 and was subsequently removed by upstream.
       See https://github.com/yshui/picom/commit/bcbc410
     '')
-    (mkRemovedOptionModule [ "services" "picom" "experimentalBackends" ] ''
+    (lib.mkRemovedOptionModule [ "services" "picom" "experimentalBackends" ] ''
       This option was removed by upstream since picom v10.
     '')
   ];
 
   options.services.picom = {
-    enable = mkOption {
-      type = types.bool;
+    enable = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Whether or not to enable Picom as the X.org composite manager.
       '';
     };
 
-    package = mkPackageOption pkgs "picom" { };
+    package = lib.mkPackageOption pkgs "picom" { };
 
-    fade = mkOption {
-      type = types.bool;
+    fade = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Fade windows in and out.
       '';
     };
 
-    fadeDelta = mkOption {
-      type = types.ints.positive;
+    fadeDelta = lib.mkOption {
+      type = lib.types.ints.positive;
       default = 10;
       example = 5;
       description = ''
@@ -101,8 +98,8 @@ in
       '';
     };
 
-    fadeSteps = mkOption {
-      type = pairOf (types.numbers.between 0.01 1);
+    fadeSteps = lib.mkOption {
+      type = pairOf (lib.types.numbers.between 0.01 1);
       default = [
         0.028
         0.03
@@ -116,8 +113,8 @@ in
       '';
     };
 
-    fadeExclude = mkOption {
-      type = types.listOf types.str;
+    fadeExclude = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [ ];
       example = [
         "window_type *= 'menu'"
@@ -130,16 +127,16 @@ in
       '';
     };
 
-    shadow = mkOption {
-      type = types.bool;
+    shadow = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Draw window shadows.
       '';
     };
 
-    shadowOffsets = mkOption {
-      type = pairOf types.int;
+    shadowOffsets = lib.mkOption {
+      type = pairOf lib.types.int;
       default = [
         (-15)
         (-15)
@@ -153,8 +150,8 @@ in
       '';
     };
 
-    shadowOpacity = mkOption {
-      type = types.numbers.between 0 1;
+    shadowOpacity = lib.mkOption {
+      type = lib.types.numbers.between 0 1;
       default = 0.75;
       example = 0.8;
       description = ''
@@ -162,8 +159,8 @@ in
       '';
     };
 
-    shadowExclude = mkOption {
-      type = types.listOf types.str;
+    shadowExclude = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [ ];
       example = [
         "window_type *= 'menu'"
@@ -176,8 +173,8 @@ in
       '';
     };
 
-    activeOpacity = mkOption {
-      type = types.numbers.between 0 1;
+    activeOpacity = lib.mkOption {
+      type = lib.types.numbers.between 0 1;
       default = 1.0;
       example = 0.8;
       description = ''
@@ -185,8 +182,8 @@ in
       '';
     };
 
-    inactiveOpacity = mkOption {
-      type = types.numbers.between 0.1 1;
+    inactiveOpacity = lib.mkOption {
+      type = lib.types.numbers.between 0.1 1;
       default = 1.0;
       example = 0.8;
       description = ''
@@ -194,8 +191,8 @@ in
       '';
     };
 
-    menuOpacity = mkOption {
-      type = types.numbers.between 0 1;
+    menuOpacity = lib.mkOption {
+      type = lib.types.numbers.between 0 1;
       default = 1.0;
       example = 0.8;
       description = ''
@@ -203,8 +200,8 @@ in
       '';
     };
 
-    wintypes = mkOption {
-      type = types.attrs;
+    wintypes = lib.mkOption {
+      type = lib.types.attrs;
       default = {
         popup_menu = {
           opacity = cfg.menuOpacity;
@@ -213,7 +210,7 @@ in
           opacity = cfg.menuOpacity;
         };
       };
-      defaultText = literalExpression ''
+      defaultText = lib.literalExpression ''
         {
           popup_menu = { opacity = config.${opt.menuOpacity}; };
           dropdown_menu = { opacity = config.${opt.menuOpacity}; };
@@ -225,8 +222,8 @@ in
       '';
     };
 
-    opacityRules = mkOption {
-      type = types.listOf types.str;
+    opacityRules = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [ ];
       example = [
         "95:class_g = 'URxvt' && !_NET_WM_STATE@:32a"
@@ -237,8 +234,8 @@ in
       '';
     };
 
-    backend = mkOption {
-      type = types.enum [
+    backend = lib.mkOption {
+      type = lib.types.enum [
         "egl"
         "glx"
         "xrender"
@@ -250,9 +247,9 @@ in
       '';
     };
 
-    vSync = mkOption {
+    vSync = lib.mkOption {
       type =
-        with types;
+        with lib.types;
         either bool (enum [
           "none"
           "drm"
@@ -268,9 +265,9 @@ in
           res = x != "none";
           msg =
             "The type of services.picom.vSync has changed to bool:"
-            + " interpreting ${x} as ${boolToString res}";
+            + " interpreting ${x} as ${lib.boolToString res}";
         in
-        if isBool x then x else warn msg res;
+        if lib.isBool x then x else lib.warn msg res;
 
       description = ''
         Enable vertical synchronization. Chooses the best method
@@ -280,7 +277,7 @@ in
     };
 
     settings =
-      with types;
+      with lib.types;
       let
         scalar =
           oneOf [
@@ -313,10 +310,10 @@ in
         };
 
       in
-      mkOption {
+      lib.mkOption {
         type = topLevel;
         default = { };
-        example = literalExpression ''
+        example = lib.literalExpression ''
           blur =
             { method = "gaussian";
               size = 10;
@@ -331,19 +328,19 @@ in
       };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     services.picom.settings = mkDefaultAttrs {
       # fading
       fading = cfg.fade;
       fade-delta = cfg.fadeDelta;
-      fade-in-step = elemAt cfg.fadeSteps 0;
-      fade-out-step = elemAt cfg.fadeSteps 1;
+      fade-in-step = lib.elemAt cfg.fadeSteps 0;
+      fade-out-step = lib.elemAt cfg.fadeSteps 1;
       fade-exclude = cfg.fadeExclude;
 
       # shadows
       shadow = cfg.shadow;
-      shadow-offset-x = elemAt cfg.shadowOffsets 0;
-      shadow-offset-y = elemAt cfg.shadowOffsets 1;
+      shadow-offset-x = lib.elemAt cfg.shadowOffsets 0;
+      shadow-offset-y = lib.elemAt cfg.shadowOffsets 1;
       shadow-opacity = cfg.shadowOpacity;
       shadow-exclude = cfg.shadowExclude;
 
@@ -366,12 +363,12 @@ in
       partOf = [ "graphical-session.target" ];
 
       # Temporarily fixes corrupt colours with Mesa 18
-      environment = mkIf (cfg.backend == "glx") {
+      environment = lib.mkIf (cfg.backend == "glx") {
         allow_rgb10_configs = "false";
       };
 
       serviceConfig = {
-        ExecStart = "${getExe cfg.package} --config ${configFile}";
+        ExecStart = "${lib.getExe cfg.package} --config ${configFile}";
         RestartSec = 3;
         Restart = "always";
       };

nixos/modules/services/x11/redshift.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
 
   cfg = config.services.redshift;
@@ -16,32 +13,32 @@ in
 {
 
   imports = [
-    (mkChangedOptionModule [ "services" "redshift" "latitude" ] [ "location" "latitude" ] (
+    (lib.mkChangedOptionModule [ "services" "redshift" "latitude" ] [ "location" "latitude" ] (
       config:
       let
-        value = getAttrFromPath [ "services" "redshift" "latitude" ] config;
+        value = lib.getAttrFromPath [ "services" "redshift" "latitude" ] config;
       in
       if value == null then
         throw "services.redshift.latitude is set to null, you can remove this"
       else
         builtins.fromJSON value
     ))
-    (mkChangedOptionModule [ "services" "redshift" "longitude" ] [ "location" "longitude" ] (
+    (lib.mkChangedOptionModule [ "services" "redshift" "longitude" ] [ "location" "longitude" ] (
       config:
       let
-        value = getAttrFromPath [ "services" "redshift" "longitude" ] config;
+        value = lib.getAttrFromPath [ "services" "redshift" "longitude" ] config;
       in
       if value == null then
         throw "services.redshift.longitude is set to null, you can remove this"
       else
         builtins.fromJSON value
     ))
-    (mkRenamedOptionModule [ "services" "redshift" "provider" ] [ "location" "provider" ])
+    (lib.mkRenamedOptionModule [ "services" "redshift" "provider" ] [ "location" "provider" ])
   ];
 
   options.services.redshift = {
-    enable = mkOption {
-      type = types.bool;
+    enable = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Enable Redshift to change your screen's colour temperature depending on
@@ -50,16 +47,16 @@ in
     };
 
     temperature = {
-      day = mkOption {
-        type = types.int;
+      day = lib.mkOption {
+        type = lib.types.int;
         default = 5500;
         description = ''
           Colour temperature to use during the day, between
           `1000` and `25000` K.
         '';
       };
-      night = mkOption {
-        type = types.int;
+      night = lib.mkOption {
+        type = lib.types.int;
         default = 3700;
         description = ''
           Colour temperature to use at night, between
@@ -69,16 +66,16 @@ in
     };
 
     brightness = {
-      day = mkOption {
-        type = types.str;
+      day = lib.mkOption {
+        type = lib.types.str;
         default = "1";
         description = ''
           Screen brightness to apply during the day,
           between `0.1` and `1.0`.
         '';
       };
-      night = mkOption {
-        type = types.str;
+      night = lib.mkOption {
+        type = lib.types.str;
         default = "1";
         description = ''
           Screen brightness to apply during the night,
@@ -87,10 +84,10 @@ in
       };
     };
 
-    package = mkPackageOption pkgs "redshift" { };
+    package = lib.mkPackageOption pkgs "redshift" { };
 
-    executable = mkOption {
-      type = types.str;
+    executable = lib.mkOption {
+      type = lib.types.str;
       default = "/bin/redshift";
       example = "/bin/redshift-gtk";
       description = ''
@@ -98,8 +95,8 @@ in
       '';
     };
 
-    extraOptions = mkOption {
-      type = types.listOf types.str;
+    extraOptions = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [ ];
       example = [
         "-v"
@@ -112,7 +109,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     # needed so that .desktop files are installed, which geoclue cares about
     environment.systemPackages = [ cfg.package ];
 

nixos/modules/services/x11/touchegg.nix

@@ -4,27 +4,24 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.touchegg;
 
 in
 {
   meta = {
-    maintainers = teams.pantheon.members;
+    maintainers = lib.teams.pantheon.members;
   };
 
   ###### interface
   options.services.touchegg = {
-    enable = mkEnableOption "touchegg, a multi-touch gesture recognizer";
+    enable = lib.mkEnableOption "touchegg, a multi-touch gesture recognizer";
 
-    package = mkPackageOption pkgs "touchegg" { };
+    package = lib.mkPackageOption pkgs "touchegg" { };
   };
 
   ###### implementation
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.touchegg = {
       description = "Touchegg Daemon";
       serviceConfig = {

nixos/modules/services/x11/unclutter-xfixes.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.unclutter-xfixes;
 
@@ -14,29 +11,29 @@ in
 {
   options.services.unclutter-xfixes = {
 
-    enable = mkOption {
+    enable = lib.mkOption {
       description = "Enable unclutter-xfixes to hide your mouse cursor when inactive.";
-      type = types.bool;
+      type = lib.types.bool;
       default = false;
     };
 
-    package = mkPackageOption pkgs "unclutter-xfixes" { };
+    package = lib.mkPackageOption pkgs "unclutter-xfixes" { };
 
-    timeout = mkOption {
+    timeout = lib.mkOption {
       description = "Number of seconds before the cursor is marked inactive.";
-      type = types.int;
+      type = lib.types.int;
       default = 1;
     };
 
-    threshold = mkOption {
+    threshold = lib.mkOption {
       description = "Minimum number of pixels considered cursor movement.";
-      type = types.int;
+      type = lib.types.int;
       default = 1;
     };
 
-    extraOptions = mkOption {
+    extraOptions = lib.mkOption {
       description = "More arguments to pass to the unclutter-xfixes command.";
-      type = types.listOf types.str;
+      type = lib.types.listOf lib.types.str;
       default = [ ];
       example = [
         "exclude-root"
@@ -46,7 +43,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.user.services.unclutter-xfixes = {
       description = "unclutter-xfixes";
       wantedBy = [ "graphical-session.target" ];
@@ -55,7 +52,7 @@ in
         ${cfg.package}/bin/unclutter \
           --timeout ${toString cfg.timeout} \
           --jitter ${toString (cfg.threshold - 1)} \
-          ${concatMapStrings (x: " --" + x) cfg.extraOptions} \
+          ${lib.concatMapStrings (x: " --" + x) cfg.extraOptions} \
       '';
       serviceConfig.RestartSec = 3;
       serviceConfig.Restart = "always";

nixos/modules/services/x11/unclutter.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.unclutter;
 
@@ -14,42 +11,42 @@ in
 {
   options.services.unclutter = {
 
-    enable = mkOption {
+    enable = lib.mkOption {
       description = "Enable unclutter to hide your mouse cursor when inactive";
-      type = types.bool;
+      type = lib.types.bool;
       default = false;
     };
 
-    package = mkPackageOption pkgs "unclutter" { };
+    package = lib.mkPackageOption pkgs "unclutter" { };
 
-    keystroke = mkOption {
+    keystroke = lib.mkOption {
       description = "Wait for a keystroke before hiding the cursor";
-      type = types.bool;
+      type = lib.types.bool;
       default = false;
     };
 
-    timeout = mkOption {
+    timeout = lib.mkOption {
       description = "Number of seconds before the cursor is marked inactive";
-      type = types.int;
+      type = lib.types.int;
       default = 1;
     };
 
-    threshold = mkOption {
+    threshold = lib.mkOption {
       description = "Minimum number of pixels considered cursor movement";
-      type = types.int;
+      type = lib.types.int;
       default = 1;
     };
 
-    excluded = mkOption {
+    excluded = lib.mkOption {
       description = "Names of windows where unclutter should not apply";
-      type = types.listOf types.str;
+      type = lib.types.listOf lib.types.str;
       default = [ ];
       example = [ "" ];
     };
 
-    extraOptions = mkOption {
+    extraOptions = lib.mkOption {
       description = "More arguments to pass to the unclutter command";
-      type = types.listOf types.str;
+      type = lib.types.listOf lib.types.str;
       default = [ ];
       example = [
         "noevent"
@@ -58,7 +55,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.user.services.unclutter = {
       description = "unclutter";
       wantedBy = [ "graphical-session.target" ];
@@ -67,9 +64,9 @@ in
         ${cfg.package}/bin/unclutter \
           -idle ${toString cfg.timeout} \
           -jitter ${toString (cfg.threshold - 1)} \
-          ${optionalString cfg.keystroke "-keystroke"} \
-          ${concatMapStrings (x: " -" + x) cfg.extraOptions} \
-          -not ${concatStringsSep " " cfg.excluded} \
+          ${lib.optionalString cfg.keystroke "-keystroke"} \
+          ${lib.concatMapStrings (x: " -" + x) cfg.extraOptions} \
+          -not ${lib.concatStringsSep " " cfg.excluded} \
       '';
       serviceConfig.PassEnvironment = "DISPLAY";
       serviceConfig.RestartSec = 3;
@@ -78,7 +75,7 @@ in
   };
 
   imports = [
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "unclutter" "threeshold" ]
       [ "services" "unclutter" "threshold" ]
     )

nixos/modules/services/x11/urxvtd.nix

@@ -4,18 +4,14 @@
   pkgs,
   ...
 }:
-
 # maintainer: siddharthist
-
-with lib;
-
 let
   cfg = config.services.urxvtd;
 in
 {
   options.services.urxvtd = {
-    enable = mkOption {
-      type = types.bool;
+    enable = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Enable urxvtd, the urxvt terminal daemon. To use urxvtd, run
@@ -23,10 +19,10 @@ in
       '';
     };
 
-    package = mkPackageOption pkgs "rxvt-unicode" { };
+    package = lib.mkPackageOption pkgs "rxvt-unicode" { };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.user.services.urxvtd = {
       description = "urxvt terminal daemon";
       wantedBy = [ "graphical-session.target" ];

nixos/modules/services/x11/window-managers/2bwm.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
 
   cfg = config.services.xserver.windowManager."2bwm";
@@ -18,14 +15,14 @@ in
   ###### interface
 
   options = {
-    services.xserver.windowManager."2bwm".enable = mkEnableOption "2bwm";
+    services.xserver.windowManager."2bwm".enable = lib.mkEnableOption "2bwm";
   };
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
-    services.xserver.windowManager.session = singleton {
+    services.xserver.windowManager.session = lib.singleton {
       name = "2bwm";
       start = ''
         ${pkgs._2bwm}/bin/2bwm &

nixos/modules/services/x11/window-managers/afterstep.nix

@@ -4,21 +4,18 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.xserver.windowManager.afterstep;
 in
 {
   ###### interface
   options = {
-    services.xserver.windowManager.afterstep.enable = mkEnableOption "afterstep";
+    services.xserver.windowManager.afterstep.enable = lib.mkEnableOption "afterstep";
   };
 
   ###### implementation
-  config = mkIf cfg.enable {
-    services.xserver.windowManager.session = singleton {
+  config = lib.mkIf cfg.enable {
+    services.xserver.windowManager.session = lib.singleton {
       name = "afterstep";
       start = ''
         ${pkgs.afterstep}/bin/afterstep &

nixos/modules/services/x11/window-managers/awesome.nix

@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
 
   cfg = config.services.xserver.windowManager.awesome;
@@ -25,20 +22,20 @@ in
 
     services.xserver.windowManager.awesome = {
 
-      enable = mkEnableOption "Awesome window manager";
+      enable = lib.mkEnableOption "Awesome window manager";
 
-      luaModules = mkOption {
+      luaModules = lib.mkOption {
         default = [ ];
-        type = types.listOf types.package;
+        type = lib.types.listOf lib.types.package;
         description = "List of lua packages available for being used in the Awesome configuration.";
-        example = literalExpression "[ pkgs.luaPackages.vicious ]";
+        example = lib.literalExpression "[ pkgs.luaPackages.vicious ]";
       };
 
-      package = mkPackageOption pkgs "awesome" { };
+      package = lib.mkPackageOption pkgs "awesome" { };
 
-      noArgb = mkOption {
+      noArgb = lib.mkOption {
         default = false;
-        type = types.bool;
+        type = lib.types.bool;
         description = "Disable client transparency support, which can be greatly detrimental to performance in some setups";
       };
     };
@@ -47,9 +44,9 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
-    services.xserver.windowManager.session = singleton {
+    services.xserver.windowManager.session = lib.singleton {
       name = "awesome";
       start = ''
         ${awesome}/bin/awesome ${lib.optionalString cfg.noArgb "--no-argb"} ${makeSearchPath cfg.luaModules} &

nixos/modules/services/x11/window-managers/berry.nix

@@ -4,21 +4,18 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.xserver.windowManager.berry;
 in
 {
   ###### interface
   options = {
-    services.xserver.windowManager.berry.enable = mkEnableOption "berry";
+    services.xserver.windowManager.berry.enable = lib.mkEnableOption "berry";
   };
 
   ###### implementation
-  config = mkIf cfg.enable {
-    services.xserver.windowManager.session = singleton {
+  config = lib.mkIf cfg.enable {
+    services.xserver.windowManager.session = lib.singleton {
       name = "berry";
       start = ''
         ${pkgs.berry}/bin/berry &