diff --git a/modules/caddy.nix b/modules/caddy.nix
index e3309fe..eddcf80 100644
--- a/modules/caddy.nix
+++ b/modules/caddy.nix
@@ -1,4 +1,5 @@
-{ base, config, pkgs, lib, ... }: lib.recursiveUpdate {
+{ base, config, pkgs, lib, ... }: lib.recursiveUpdate
+{
   services.caddy.enable = true;
   services.caddy.configFile = lib.pipe ./caddy/caddyfile.nix [
     import
@@ -17,28 +18,29 @@
     sopsFile = ../secrets/caddy.json;
     format = "json";
   };
-} (
-  let
-    isDerived = base != null;
-  in
-  if isDerived
-  then
+}
+  (
     let
-      caddy_json = base.config.services.caddy.configFile;
+      isDerived = base != null;
     in
-    {
-      scalpel.trafos."caddy.json" = {
-        source = toString caddy_json;
-        matchers."cloudflare_token".secret =
-          config.sops.secrets.cloudflare_token.path;
-        owner = config.users.users.root.name;
-        group = config.users.users.nobody.group;
-        mode = "0400";
-      };
+    if isDerived
+    then
+      let
+        caddy_json = base.config.services.caddy.configFile;
+      in
+      {
+        scalpel.trafos."caddy.json" = {
+          source = toString caddy_json;
+          matchers."cloudflare_token".secret =
+            config.sops.secrets.cloudflare_token.path;
+          owner = config.users.users.root.name;
+          group = config.users.users.nobody.group;
+          mode = "0400";
+        };
 
-      services.caddy.configFile = lib.mkForce config.scalpel.trafos."caddy.json".destination;
+        services.caddy.configFile = lib.mkForce config.scalpel.trafos."caddy.json".destination;
 
-      systemd.services.caddy.reloadTriggers = [ caddy_json ];
-    }
-  else { }
-)
+        systemd.services.caddy.reloadTriggers = [ caddy_json ];
+      }
+    else { }
+  )