diff --git a/modules/grafana.nix b/modules/grafana.nix
index 9a97342..6c63f75 100644
--- a/modules/grafana.nix
+++ b/modules/grafana.nix
@@ -1,6 +1,5 @@
 { lib, config, base, pkgs, helpers, ... }:
-lib.recursiveUpdate
-{
+lib.recursiveUpdate {
   services.grafana = {
     enable = true;
 
@@ -29,7 +28,7 @@
         api_url =
           "https://login.clicks.codes/realms/clicks/protocol/openid-connect/userinfo";
         role_attribute_path =
-        "contains(resource_access.grafana.roles[*], 'server_admin') && 'GrafanaAdmin' || contains(resource_access.grafana.roles[*], 'admin') && 'Admin' || contains(resource_access.grafana.roles[*], 'editor') && 'Editor' || 'Viewer'";
+          "contains(resource_access.grafana.roles[*], 'server_admin') && 'GrafanaAdmin' || contains(resource_access.grafana.roles[*], 'admin') && 'Admin' || contains(resource_access.grafana.roles[*], 'editor') && 'Editor' || 'Viewer'";
         allow_assign_grafana_admin = true;
         auto_login = true;
       };
@@ -57,42 +56,40 @@
     sopsFile = ../secrets/grafana.json;
     format = "json";
   };
-}
-  (
-    let isDerived = base != null;
-    in if isDerived then
-      let
-        generators = lib.generators;
-        cfg = config.services.grafana;
-        settingsFormatIni = pkgs.formats.ini {
-          listToValue =
-            lib.concatMapStringsSep " " (generators.mkValueStringDefault { });
-          mkKeyValue = generators.mkKeyValueDefault
-            {
-              mkValueString = v:
-                if v == null then "" else generators.mkValueStringDefault { } v;
-            } "=";
-        };
-        grafana_cfgfile = settingsFormatIni.generate "config.ini" cfg.settings;
-      in
-      {
-        scalpel.trafos."grafana.ini" = {
-          source = toString grafana_cfgfile;
-          matchers."client_secret".secret =
-            config.sops.secrets.clicks_grafana_client_secret.path;
-          owner = config.users.users.grafana.name;
-          group = "nobody";
-          mode = "0400";
-        };
+} (let isDerived = base != null;
+in if isDerived then
+  let
+    generators = lib.generators;
+    cfg = config.services.grafana;
+    settingsFormatIni = pkgs.formats.ini {
+      listToValue =
+        lib.concatMapStringsSep " " (generators.mkValueStringDefault { });
+      mkKeyValue = generators.mkKeyValueDefault {
+        mkValueString = v:
+          if v == null then "" else generators.mkValueStringDefault { } v;
+      } "=";
+    };
+    grafana_cfgfile = settingsFormatIni.generate "config.ini" cfg.settings;
+  in {
+    scalpel.trafos."grafana.ini" = {
+      source = toString grafana_cfgfile;
+      matchers."client_secret".secret =
+        config.sops.secrets.clicks_grafana_client_secret.path;
+      owner = config.users.users.grafana.name;
+      group = "nobody";
+      mode = "0400";
+    };
 
-        systemd.services.grafana.serviceConfig.ExecStart = lib.mkForce (pkgs.writeShellScript "grafana-start" ''
-          set -o errexit -o pipefail -o nounset -o errtrace
-          shopt -s inherit_errexit
+    systemd.services.grafana.serviceConfig.ExecStart = lib.mkForce
+      (pkgs.writeShellScript "grafana-start" ''
+        set -o errexit -o pipefail -o nounset -o errtrace
+        shopt -s inherit_errexit
 
-          exec ${cfg.package}/bin/grafana-server -homepath ${cfg.dataDir} -config ${config.scalpel.trafos."grafana.ini".destination}
-        '');
-        systemd.services.grafana.restartTriggers = [ grafana_cfgfile ];
-      }
-    else
-      { }
-  )
+        exec ${cfg.package}/bin/grafana-server -homepath ${cfg.dataDir} -config ${
+          config.scalpel.trafos."grafana.ini".destination
+        }
+      '');
+    systemd.services.grafana.restartTriggers = [ grafana_cfgfile ];
+  }
+else
+  { })