treewide: fix syntax errors in nix code blocks

Fixes all code blocks with "nix" language in markdown files for syntax
errors to be able to run nixfmt in the next step.

nixos/doc/manual/administration/service-mgmt.chapter.md

@@ -126,6 +126,7 @@ in turn will not make the service / timer start on login.
 You can define services by adding them to `systemd.services`:
 
 ```nix
+{
   systemd.services.myservice = {
     after = [ "network-online.target" ];
     requires = [ "network-online.target" ];
@@ -137,6 +138,7 @@ systemd.services.myservice = {
       ExecStart = "...";
     };
   };
+}
 ```
 
 If you want to specify a multi-line script for `ExecStart`,

nixos/doc/manual/configuration/adding-custom-packages.section.md

@@ -111,7 +111,7 @@ If there are shared libraries missing add them with
     extraPkgs = pkgs: [
       # missing libraries here, e.g.: `pkgs.libepoxy`
     ];
-  }
+  };
 }
 ```
 

nixos/doc/manual/configuration/mattermost.chapter.md

@@ -33,7 +33,7 @@ To enable Mattermost using Postgres, use a config like this:
 
     # For example, to disable auto-installation of prepackaged plugins.
     settings.PluginSettings.AutomaticPrepackagedPlugins = false;
-  }
+  };
 }
 ```
 

nixos/doc/manual/configuration/user-mgmt.chapter.md

@@ -137,7 +137,9 @@ the Perl script. It aims to eventually replace the Perl script by default.
 You can enable Userborn via:
 
 ```nix
+{
   services.userborn.enable = true;
+}
 ```
 
 You can configure Userborn to store the password files
@@ -145,7 +147,9 @@ You can configure Userborn to store the password files
 location to `/etc`:
 
 ```nix
+{
   services.userborn.passwordFilesLocation = "/persistent/etc";
+}
 ```
 
 This is useful when you store `/etc` on a `tmpfs` or if `/etc` is immutable

nixos/doc/manual/development/testing-hardware-features.section.md

@@ -22,6 +22,7 @@ You can run `vwifi-ctrl` on this node to control characteristics of the simulate
 physical layer.
 
 ```nix
+{
   airgap =
     { config, ... }:
     {
@@ -41,6 +42,7 @@ airgap =
         };
       };
     };
+}
 ```
 
 ### AP {#sec-nixos-test-wifi-ap}
@@ -48,6 +50,7 @@ airgap =
 A node like this will act as a wireless access point in infrastructure mode.
 
 ```nix
+{
   ap =
     { config, ... }:
     {
@@ -82,6 +85,7 @@ ap =
         };
       };
     };
+}
 ```
 
 ### Station {#sec-nixos-test-wifi-station}
@@ -89,6 +93,7 @@ ap =
 A node like this acts as a wireless client.
 
 ```nix
+{
   station =
     { config, ... }:
     {
@@ -120,6 +125,7 @@ station =
         };
       };
     };
+}
 ```
 
 ### Monitor {#sec-nixos-test-wifi-monitor}
@@ -128,6 +134,7 @@ When the monitor mode interface is enabled, this node will receive
 all packets broadcast by all other nodes through the spy interface.
 
 ```nix
+{
   monitor =
     { config, ... }:
     {
@@ -149,4 +156,6 @@ monitor =
           serverAddress = "192.168.1.2";
         };
       };
+    };
+}
 ```

nixos/doc/manual/installation/building-images-via-nixos-rebuild-build-image.chapter.md

@@ -25,7 +25,9 @@ The `image.modules` option can be used to set specific options per image variant
 E.g. images for the cloud provider Linode use `grub2` as a bootloader by default. If you are using `systemd-boot` on other platforms and want to disable it for Linode only, you could use the following options:
 
 ``` nix
+{
   image.modules.linode = {
     boot.loader.systemd-boot.enable = lib.mkForce false;
   };
+}
 ```

nixos/doc/manual/release-notes/rl-2405.section.md

@@ -243,9 +243,11 @@ The pre-existing `services.ankisyncd` has been marked deprecated and will be dro
 - `azure-cli` now has extension support. For example, to install the `aks-preview` extension, use
 
   ```nix
+  {
     environment.systemPackages = [
       (azure-cli.withExtensions [ azure-cli.extensions.aks-preview ])
     ];
+  }
   ```
   To make the `azure-cli` immutable and prevent clashes in case `azure-cli` is also installed via other package managers, some configuration files were moved into the derivation.
   This can be disabled by overriding `withImmutableConfig = false` when building `azure-cli`.

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -615,8 +615,10 @@
   Then, follow the instructions on the [upstream release notes](https://github.com/majewsky/portunus/releases/tag/v2.0.0) to upgrade all existing user accounts to strong password hashes.
   If you need to upgrade to 24.11 without having completed the migration, consider the security implications of weak password hashes on your user accounts, and add the following to your configuration:
   ```nix
+  {
     services.portunus.package      = pkgs.portunus.override { libxcrypt = pkgs.libxcrypt-legacy; };
     services.portunus.ldap.package = pkgs.openldap.override { libxcrypt = pkgs.libxcrypt-legacy; };
+  }
   ```
 
 - The default value of `services.kubernetes.kubelet.hostname` is now lowercased.
@@ -956,6 +958,7 @@ If you set `sound.mediaKeys` in your configuration:
   - If you want to maintain the exact behavior of the option, use the following snippet
 
 ```nix
+{
   services.actkbd = let
     volumeStep = "1%";
   in {
@@ -974,6 +977,7 @@ in {
       { keys = [ 190 ]; events = [ "key" ];       command = "${alsa-utils}/bin/amixer -q set Capture toggle"; }
     ];
   };
+}
 ```
 
 ### `hardware.deviceTree.overlays` compatible string matching {#sec-release-24.11-migration-dto-compatible}

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -355,10 +355,12 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 - To avoid delaying user logins unnecessarily the `multi-user.target` is no longer ordered after `network-online.target`.
   System services requiring a connection to start correctly must explicitly state so, i.e.
   ```nix
-  systemd.services.<name> = {
+  {
+    systemd.services."<name>" = {
       wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
     };
+  }
   ```
   This changed follows a deprecation period of one year started in NixOS 24.05 (see [PR #283818](https://github.com/NixOS/nixpkgs/pull/283818)).
 
@@ -457,6 +459,7 @@ Alongside many enhancements to NixOS modules and general system improvements, th
   Example:
 
   ```nix
+  {
     services.mysql = {
       enable = true;
       galeraCluster = {
@@ -466,6 +469,7 @@ Alongside many enhancements to NixOS modules and general system improvements, th
         nodeAddresses = [ "galera_01" "galera_02" "galera_03"];
       };
     };
+  }
   ```
 
 - systemd's {manpage}`systemd-ssh-generator(8)` now works out of the box on NixOS.

nixos/modules/services/databases/postgresql.md

@@ -147,6 +147,7 @@ Assume that your app creates a role `admin` and you want the `root` user to be a
 You can then use [](#opt-services.postgresql.identMap) to define the map and [](#opt-services.postgresql.authentication) to enable it:
 
 ```nix
+{
   services.postgresql = {
     identMap = ''
       admin root admin
@@ -154,6 +155,7 @@ services.postgresql = {
     authentication = ''
       local all admin peer map=admin
     '';
+  };
 }
 ```
 

nixos/modules/services/misc/paisa.md

@@ -21,7 +21,9 @@ configure this in the module, but you can e.g. use systemd to give the unit
 access to the command at runtime.
 
 ```nix
+{
   systemd.services.paisa.path = [ pkgs.hledger ];
+}
 ```
 
 ::: {.note}

nixos/modules/services/monitoring/glances.md

@@ -16,5 +16,5 @@ Use the following configuration to start a public instance of Glances locally:
     enable = true;
     openFirewall = true;
   };
-};
+}
 ```

nixos/modules/services/networking/crab-hole.md

@@ -103,7 +103,7 @@ Additionally you can set an optional timeout value.
       certificate = ./dns.example.com.crt;
       key = "/dns.example.com.key";
       # optional (default = 3000)
-      timeout_ms = 3000
+      timeout_ms = 3000;
     }
   ];
 }

nixos/modules/services/networking/jotta-cli.md

@@ -15,11 +15,13 @@ This adds `jotta-cli` to `environment.systemPackages` and starts a user service
 ## Example Configuration {#module-services-jotta-cli-example-configuration}
 
 ```nix
+{
   services.jotta-cli = {
     enable = true;
     options = [ "slow" ];
     package = pkgs.jotta-cli;
   };
+}
 ```
 
 This uses `jotta-cli` and `jottad` from the `pkgs.jotta-cli` package and starts `jottad` in low memory mode.

nixos/modules/services/networking/netbird/server.md

@@ -9,6 +9,7 @@ To fully setup Netbird as a self-hosted server, we need both a Coturn server and
 There are quite a few settings that need to be passed to Netbird for it to function, and a minimal config looks like :
 
 ```nix
+{
   services.netbird.server = {
     enable = true;
 
@@ -39,4 +40,5 @@ services.netbird.server = {
       };
     };
   };
+}
 ```

nixos/modules/services/networking/pihole-ftl.md

@@ -110,7 +110,6 @@ to configure additional interfaces with different configuration, use
       "dhcp-range=::f,::ff,constructor:enp1s0,ra-names,ra-stateless"
     ];
   };
-  };
 }
 ```
 

nixos/modules/services/system/kerberos/kerberos-server.md

@@ -24,7 +24,7 @@ To enable a Kerberos server:
         admin_server = "kerberos.example.com";
       };
     };
-  }
+  };
 
   services.kerberos-server = {
     enable = true;

nixos/modules/services/web-apps/nextcloud.md

@@ -208,7 +208,9 @@ release notes when upgrading.
     the cache size to zero:
 
     ```nix
+    {
       services.nextcloud.phpOptions."realpath_cache_size" = "0";
+    }
     ```
 
   - **Empty Files on chunked uploads**
@@ -286,9 +288,9 @@ that are managed by Nix:
 
 ```nix
 { config, pkgs, ... }: {
-  services.nextcloud.extraApps = with config.services.nextcloud.package.packages.apps; [
+  services.nextcloud.extraApps = with config.services.nextcloud.package.packages.apps; {
     inherit user_oidc calendar contacts;
-  ];
+  };
 }
 ```
 

nixos/modules/services/web-apps/szurubooru.md

@@ -40,10 +40,10 @@ The prefered method to run this service is behind a reverse proxy not to expose
 
     server = {
       port = 8080;
-      ...
+      # ...
     };
 
-    ...
+    # ...
   };
 
   services.nginx.virtualHosts."szurubooru.domain.tld" = {

pkgs/applications/networking/cluster/k3s/docs/examples/EXTERNAL_CONTAINERD.md

@@ -6,6 +6,7 @@ containerd. This can be done in a few lines of configuration.
 ## Configure Containerd
 
 ```nix
+{
   virtualisation.containerd = {
     enable = true;
     settings.plugins."io.containerd.grpc.v1.cri".cni = {
@@ -17,15 +18,18 @@ virtualisation.containerd = {
       sandbox_image = "docker.io/rancher/mirrored-pause:3.6";
     };
   };
+}
 ```
 
 ## Configure k3s
 
 ```nix
+{
   services.k3s = {
     enable = true;
     extraFlags = [ "--container-runtime-endpoint unix:///run/containerd/containerd.sock" ];
   };
+}
 ```
 
 ## Importing Container Images

pkgs/by-name/README.md

@@ -99,9 +99,14 @@ Definitions like the following however, _can_ be transitioned:
 
 ```nix
 # all-packages.nix
+{
   fooWithBaz = foo.override {
     bar = baz;
   };
+}
+```
+
+```nix
 # turned into pkgs/by-name/fo/fooWithBaz/package.nix with:
 {
   foo,

pkgs/by-name/az/azure-cli/README.md

@@ -56,6 +56,7 @@ The output should look something like this:
 Based on this, you can add an attribute to `extensions-manual.nix`:
 
 ```nix
+{
   azure-devops = mkAzExtension {
     pname = "azure-devops";
     version = "1.0.0";
@@ -67,6 +68,7 @@ Based on this, you can add an attribute to `extensions-manual.nix`:
     ];
     meta.maintainers = with lib.maintainers; [ katexochen ];
   };
+}
 ```
 
 * The attribute name should be the same as `pname`.
@@ -113,5 +115,7 @@ If extensions are removed upstream, an alias is added to the end of `extensions-
 this example:
 
 ```nix
+{
   blockchain = throw "The 'blockchain' extension for azure-cli was deprecated upstream"; # Added 2024-04-26
+}
 ```

pkgs/servers/home-assistant/custom-components/README.md

@@ -80,6 +80,7 @@ needs to be. Instead of applying brittle substitutions the version constraint
 can be ignored on a per requirement basis.
 
 ```nix
+{
   dependencies = [
     pyemvue
   ];
@@ -88,5 +89,5 @@ can be ignored on a per requirement basis.
   ignoreVersionRequirement = [
     "pyemvue"
   ];
+}
 ```
-`