nix flake

flake/formatter.nix

@@ -0,0 +1,35 @@
+{ inputs, ... }:
+{
+  imports = [
+    inputs.treefmt-nix.flakeModule
+  ];
+
+  perSystem = _: {
+    treefmt = {
+      projectRootFile = "flake.nix";
+
+      programs = {
+        nixfmt.enable = true;
+        deadnix.enable = true;
+        statix.enable = true;
+
+        shfmt.enable = true;
+        shellcheck.enable = true;
+
+        prettier.enable = true;
+        yamlfmt.enable = true;
+        taplo.enable = true;
+        oxfmt.enable = true;
+      };
+
+      settings = {
+        excludes = [
+          ".git/**"
+          "*.lock"
+          ".direnv/**"
+          "*.age"
+        ];
+      };
+    };
+  };
+}

flake/git-hooks.nix

@@ -0,0 +1,43 @@
+{ inputs, ... }:
+{
+  imports = [
+    inputs.git-hooks-nix.flakeModule
+  ];
+
+  perSystem =
+    {
+      pkgs,
+      config,
+      ...
+    }:
+    {
+      pre-commit.settings = {
+        hooks = {
+          treefmt = {
+            enable = true;
+
+            package = config.treefmt.build.wrapper;
+          };
+
+          gitleaks = {
+            enable = true;
+            name = "gitleaks";
+            description = "Detect hardcoded secrets";
+
+            entry = "${pkgs.gitleaks}/bin/gitleaks dir --no-banner --redact --verbose .";
+
+            pass_filenames = false;
+
+            stages = [
+              "pre-commit"
+              "pre-push"
+            ];
+          };
+
+          deadnix.enable = true;
+          statix.enable = true;
+          shellcheck.enable = true;
+        };
+      };
+    };
+}