diff --git a/flake.lock b/flake.lock
index 7f38aef..455a92f 100644
--- a/flake.lock
+++ b/flake.lock
@@ -873,7 +873,8 @@
         "pre-commit-hooks": "pre-commit-hooks",
         "rust-overlay": "rust-overlay_2",
         "sops": "sops",
-        "sunshine": "sunshine"
+        "sunshine": "sunshine",
+        "treefmt-nix": "treefmt-nix"
       }
     },
     "rust-overlay": {
@@ -1030,6 +1031,26 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1711963903,
+        "narHash": "sha256-N3QDhoaX+paWXHbEXZapqd1r95mdshxToGowtjtYkGI=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "49dc4a92b02b8e68798abd99184f228243b6e3ac",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index 5351e71..5b532a1 100644
--- a/flake.nix
+++ b/flake.nix
@@ -25,6 +25,11 @@
       };
     };
 
+    treefmt-nix = {
+      url = "github:numtide/treefmt-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     naersk = {
       url = "github:nix-community/naersk";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -173,7 +178,10 @@
         "aarch64-linux"
       ];
 
-      imports = [ inputs.pre-commit-hooks.flakeModule ];
+      imports = [
+        inputs.pre-commit-hooks.flakeModule
+        inputs.treefmt-nix.flakeModule
+      ];
 
       flake = {
         lib = import ./lib inputs;
@@ -251,9 +259,25 @@
             };
           };
 
+          treefmt = {
+            projectRootFile = "flake.lock";
+
+            programs = {
+              black.enable = true;
+              deadnix.enable = true;
+              nixfmt = {
+                enable = true;
+                package = pkgs.nixfmt-rfc-style;
+              };
+              shellcheck.enable = true;
+              shfmt.enable = true;
+            };
+          };
+
           packages = {
             git-repo-go = pkgs.callPackage ./pkgs/git-repo-go { };
             gitu = pkgs.callPackage ./pkgs/gitu { };
+            headscale-ui = pkgs.callPackage ./pkgs/headscale-ui { };
             incus-ui = pkgs.callPackage ./pkgs/incus-ui { };
             openfga = pkgs.callPackage ./pkgs/openfga { };
             zed = pkgs.callPackage ./pkgs/zed { };
@@ -312,8 +336,6 @@
               name = "install";
               packages = [ inputs'.disko.packages.disko ];
             };
-
-          formatter = pkgs.nixfmt-rfc-style;
         };
     };
 }
diff --git a/home-manager/modules/i3/default.nix b/home-manager/modules/i3/default.nix
index a6df14e..3cb9a0f 100644
--- a/home-manager/modules/i3/default.nix
+++ b/home-manager/modules/i3/default.nix
@@ -217,20 +217,16 @@ in
           workspaceAutoBackAndForth = true;
           workspaceOutputAssign = builtins.concatLists (
             builtins.attrValues (
-              builtins.mapAttrs
-                (
-                  name: workspaces:
-                  let
-                    output = if name == "right" then "DP-0" else "DP-4";
-                  in
-                  builtins.map
-                    (ws: {
-                      inherit output;
-                      workspace = toString ws;
-                    })
-                    workspaces
-                )
-                workspacePartition
+              builtins.mapAttrs (
+                name: workspaces:
+                let
+                  output = if name == "right" then "DP-0" else "DP-4";
+                in
+                builtins.map (ws: {
+                  inherit output;
+                  workspace = toString ws;
+                }) workspaces
+              ) workspacePartition
             )
           );
           # [
diff --git a/home-manager/modules/nnn/default.nix b/home-manager/modules/nnn/default.nix
index b2ee9f0..4b1d103 100644
--- a/home-manager/modules/nnn/default.nix
+++ b/home-manager/modules/nnn/default.nix
@@ -17,17 +17,15 @@ in
     programs.nnn = {
       enable = true;
       package =
-        (pkgs.nnn.overrideAttrs (
-          _prevAttrs: {
-            version = "unstable-2023-10-08";
-            src = pkgs.fetchFromGitHub {
-              owner = "jarun";
-              repo = "nnn";
-              rev = "7f63bef4d6c9f70b99a4c98435c9c0a68e05be44";
-              sha256 = "B9WRQW4wbs3+lJ9ACFheTaO+0+G/r67yJZJJPMDIQXI=";
-            };
-          }
-        )).override
+        (pkgs.nnn.overrideAttrs (_prevAttrs: {
+          version = "unstable-2023-10-08";
+          src = pkgs.fetchFromGitHub {
+            owner = "jarun";
+            repo = "nnn";
+            rev = "7f63bef4d6c9f70b99a4c98435c9c0a68e05be44";
+            sha256 = "B9WRQW4wbs3+lJ9ACFheTaO+0+G/r67yJZJJPMDIQXI=";
+          };
+        })).override
           {
             withNerdIcons = true;
             extraMakeFlags = [
diff --git a/home-manager/modules/rclone/default.nix b/home-manager/modules/rclone/default.nix
index ceb6087..7451548 100644
--- a/home-manager/modules/rclone/default.nix
+++ b/home-manager/modules/rclone/default.nix
@@ -19,13 +19,11 @@ let
 
   rcloneRemote =
     with types;
-    attrsOf (
-      oneOf [
-        str
-        int
-        bool
-      ]
-    );
+    attrsOf (oneOf [
+      str
+      int
+      bool
+    ]);
 
   rcloneMount =
     with types;
@@ -61,39 +59,37 @@ in
     home.packages = [ pkgs.rclone ];
 
     systemd.user.services = builtins.listToAttrs (
-      builtins.map
-        (
-          mount:
-          let
-            localPath = toString mount.local;
-            unitName = builtins.replaceStrings [ "/" ] [ "-" ] (
-              builtins.substring 1 (builtins.stringLength localPath) localPath
-            );
-          in
-          {
-            name = "rclone-${unitName}";
-            value = {
-              Unit = {
-                Description = "rclone mount ${unitName}";
-                After = [ "network.target" ];
-                AssertPathIsDirectory = toString mount.local;
-              };
-
-              Service = {
-                Environment = [ "PATH=/run/wrappers/bin:$PATH" ];
-                ExecStart = "${pkgs.rclone}/bin/rclone mount --vfs-cache-mode full --vfs-cache-poll-interval 5s --poll-interval 5s --dir-cache-time 10s --umask 022 --allow-other ${rcloneConnectionString mount} ${mount.local}";
-                ExecStop = "/run/wrappers/bin/fusermount -zu ${mount.local}";
-                Restart = "on-failure";
-                RestartSec = 10;
-              };
-
-              Install = {
-                WantedBy = [ "default.target" ];
-              };
+      builtins.map (
+        mount:
+        let
+          localPath = toString mount.local;
+          unitName = builtins.replaceStrings [ "/" ] [ "-" ] (
+            builtins.substring 1 (builtins.stringLength localPath) localPath
+          );
+        in
+        {
+          name = "rclone-${unitName}";
+          value = {
+            Unit = {
+              Description = "rclone mount ${unitName}";
+              After = [ "network.target" ];
+              AssertPathIsDirectory = toString mount.local;
             };
-          }
-        )
-        cfg.mounts
+
+            Service = {
+              Environment = [ "PATH=/run/wrappers/bin:$PATH" ];
+              ExecStart = "${pkgs.rclone}/bin/rclone mount --vfs-cache-mode full --vfs-cache-poll-interval 5s --poll-interval 5s --dir-cache-time 10s --umask 022 --allow-other ${rcloneConnectionString mount} ${mount.local}";
+              ExecStop = "/run/wrappers/bin/fusermount -zu ${mount.local}";
+              Restart = "on-failure";
+              RestartSec = 10;
+            };
+
+            Install = {
+              WantedBy = [ "default.target" ];
+            };
+          };
+        }
+      ) cfg.mounts
     );
   };
 }
diff --git a/home-manager/modules/wallpapers/default.nix b/home-manager/modules/wallpapers/default.nix
index cc2a823..dd348ac 100644
--- a/home-manager/modules/wallpapers/default.nix
+++ b/home-manager/modules/wallpapers/default.nix
@@ -13,16 +13,14 @@ let
       "${pkgs.nitrogen}/bin/nitrogen --set-color=${cfg.backgroundColor} --set-tiled ${cfg.images}"
     else
       builtins.concatStringsSep "\n" (
-        map
-          (
-            { fst, snd }:
-            let
-              image = fst;
-              monitor = toString snd;
-            in
-            "${pkgs.nitrogen}/bin/nitrogen --head=${monitor} --set-color=${cfg.backgroundColor} --set-tiled ${image}"
-          )
-          (zipLists cfg.images (builtins.genList (x: x) (builtins.length cfg.images)))
+        map (
+          { fst, snd }:
+          let
+            image = fst;
+            monitor = toString snd;
+          in
+          "${pkgs.nitrogen}/bin/nitrogen --head=${monitor} --set-color=${cfg.backgroundColor} --set-tiled ${image}"
+        ) (zipLists cfg.images (builtins.genList (x: x) (builtins.length cfg.images)))
       )
   );
 
diff --git a/modules/nix-common/default.nix b/modules/nix-common/default.nix
index 9b33499..ed051f2 100644
--- a/modules/nix-common/default.nix
+++ b/modules/nix-common/default.nix
@@ -20,14 +20,11 @@ in
   };
 
   imports = [
-    (mkRemovedOptionModule
-      [
-        "eboskma"
-        "nix-common"
-        "disable-cache"
-      ]
-      "The option `disable-cache` is no longer used"
-    )
+    (mkRemovedOptionModule [
+      "eboskma"
+      "nix-common"
+      "disable-cache"
+    ] "The option `disable-cache` is no longer used")
   ];
 
   config = mkIf cfg.enable {
diff --git a/modules/wireguard/default.nix b/modules/wireguard/default.nix
index 7b74502..4aded05 100644
--- a/modules/wireguard/default.nix
+++ b/modules/wireguard/default.nix
@@ -87,19 +87,13 @@ in
         listenPort = cfg.port;
         privateKeyFile = cfg.privateKeyFile;
 
-        postSetup =
-          concatMapStringsSep "\n"
-            (range: ''
-              ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s ${range} -o ${cfg.externalInterface} -j MASQUERADE
-            '')
-            cfg.internalIPs;
+        postSetup = concatMapStringsSep "\n" (range: ''
+          ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s ${range} -o ${cfg.externalInterface} -j MASQUERADE
+        '') cfg.internalIPs;
 
-        postShutdown =
-          concatMapStringsSep "\n"
-            (range: ''
-              ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s ${range} -o ${cfg.externalInterface} -j MASQUERADE
-            '')
-            cfg.internalIPs;
+        postShutdown = concatMapStringsSep "\n" (range: ''
+          ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s ${range} -o ${cfg.externalInterface} -j MASQUERADE
+        '') cfg.internalIPs;
 
         peers = cfg.peers;
       };
diff --git a/pkgs/incus-ui/default.nix b/pkgs/incus-ui/default.nix
index 6111e1b..334b1fc 100644
--- a/pkgs/incus-ui/default.nix
+++ b/pkgs/incus-ui/default.nix
@@ -10,81 +10,79 @@
   rsync,
 }:
 
-stdenv.mkDerivation (
-  finalAttrs: {
-    pname = "incus-ui";
-    version = "0.6";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "incus-ui";
+  version = "0.6";
 
-    src = fetchFromGitHub {
-      owner = "canonical";
-      repo = "lxd-ui";
-      rev = finalAttrs.version;
-      # hash = "sha256-52MRf7bk8Un9wqz00+JjDmuJgPKYhgAhIbMbcAuf8W8=";
-      hash = "sha256-3Ts6lKyzpMDVATCKD1fFIGTskWzWpQUT9S8cPFnlEOs=";
-    };
+  src = fetchFromGitHub {
+    owner = "canonical";
+    repo = "lxd-ui";
+    rev = finalAttrs.version;
+    # hash = "sha256-52MRf7bk8Un9wqz00+JjDmuJgPKYhgAhIbMbcAuf8W8=";
+    hash = "sha256-3Ts6lKyzpMDVATCKD1fFIGTskWzWpQUT9S8cPFnlEOs=";
+  };
 
-    offlineCache = fetchYarnDeps {
-      yarnLock = "${finalAttrs.src}/yarn.lock";
-      hash = "sha256-0pyxwMGGqogEe1w3sail8NUDHtxLQZU9Wg8E6rQNy4o=";
-    };
+  offlineCache = fetchYarnDeps {
+    yarnLock = "${finalAttrs.src}/yarn.lock";
+    hash = "sha256-0pyxwMGGqogEe1w3sail8NUDHtxLQZU9Wg8E6rQNy4o=";
+  };
 
-    patches = [
-      ./ui-canonical-0001-Branding.patch
-      ./ui-canonical-0002-Update-navigation.patch
-      ./ui-canonical-0003-Update-certificate-generation.patch
-      ./ui-canonical-0004-Remove-external-links.patch
-      ./ui-canonical-0005-Remove-Canonical-image-servers.patch
-      ./ui-canonical-0006-Remove-version-check.patch
-    ];
+  patches = [
+    ./ui-canonical-0001-Branding.patch
+    ./ui-canonical-0002-Update-navigation.patch
+    ./ui-canonical-0003-Update-certificate-generation.patch
+    ./ui-canonical-0004-Remove-external-links.patch
+    ./ui-canonical-0005-Remove-Canonical-image-servers.patch
+    ./ui-canonical-0006-Remove-version-check.patch
+  ];
 
-    nativeBuildInputs = [
-      nodejs
-      prefetch-yarn-deps
-      yarn
-    ];
+  nativeBuildInputs = [
+    nodejs
+    prefetch-yarn-deps
+    yarn
+  ];
 
-    configurePhase = ''
-      runHook preConfigure
+  configurePhase = ''
+    runHook preConfigure
 
-      ${gnused}/bin/sed -i "s/LXD/Incus/g" src/*/*.ts* src/*/*/*.ts* src/*/*/*/*.ts*
-      ${gnused}/bin/sed -i "s/devlxd/guestapi/g" src/*/*.ts* src/*/*/*.ts* src/*/*/*/*.ts*
-      ${gnused}/bin/sed -i "s/dev\/lxd/dev\/incus/g" src/*/*.ts* src/*/*/*.ts* src/*/*/*/*.ts*
-      ${gnused}/bin/sed -i "s/lxd_/incus_/g" src/*/*.ts* src/*/*/*.ts* src/*/*/*/*.ts*
-      ${gnused}/bin/sed -i "s/\"lxd\"/\"incus\"/g" src/*/*.ts* src/*/*/*.ts* src/*/*/*/*.ts*
+    ${gnused}/bin/sed -i "s/LXD/Incus/g" src/*/*.ts* src/*/*/*.ts* src/*/*/*/*.ts*
+    ${gnused}/bin/sed -i "s/devlxd/guestapi/g" src/*/*.ts* src/*/*/*.ts* src/*/*/*/*.ts*
+    ${gnused}/bin/sed -i "s/dev\/lxd/dev\/incus/g" src/*/*.ts* src/*/*/*.ts* src/*/*/*/*.ts*
+    ${gnused}/bin/sed -i "s/lxd_/incus_/g" src/*/*.ts* src/*/*/*.ts* src/*/*/*/*.ts*
+    ${gnused}/bin/sed -i "s/\"lxd\"/\"incus\"/g" src/*/*.ts* src/*/*/*.ts* src/*/*/*/*.ts*
 
-      export HOME=$(mktemp -d)
-      yarn config --offline set yarn-offline-mirror "$offlineCache"
-      fixup-yarn-lock yarn.lock
-      yarn --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive install
-      patchShebangs node_modules
-      cp ${./favicon-32x32.png} public/assets/img/favicon-32x32.png
+    export HOME=$(mktemp -d)
+    yarn config --offline set yarn-offline-mirror "$offlineCache"
+    fixup-yarn-lock yarn.lock
+    yarn --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive install
+    patchShebangs node_modules
+    cp ${./favicon-32x32.png} public/assets/img/favicon-32x32.png
 
-      runHook postConfigure
-    '';
+    runHook postConfigure
+  '';
 
-    buildPhase = ''
-      runHook preBuild
+  buildPhase = ''
+    runHook preBuild
 
-      yarn --offline build
+    yarn --offline build
 
-      runHook postBuild
-    '';
+    runHook postBuild
+  '';
 
-    installPhase = ''
-      runHook preInstall
+  installPhase = ''
+    runHook preInstall
 
-      mkdir -p $out
-      ${rsync}/bin/rsync -a build/ui/ $out/
+    mkdir -p $out
+    ${rsync}/bin/rsync -a build/ui/ $out/
 
-      runHook postInstall
-    '';
+    runHook postInstall
+  '';
 
-    meta = with lib; {
-      description = "Easy and accessible container and virtual machine management. A browser interface for LXD";
-      homepage = "https://github.com/canonical/lxd-ui";
-      license = licenses.gpl3;
-      maintainers = with maintainers; [ ];
-      platforms = platforms.linux;
-    };
-  }
-)
+  meta = with lib; {
+    description = "Easy and accessible container and virtual machine management. A browser interface for LXD";
+    homepage = "https://github.com/canonical/lxd-ui";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ ];
+    platforms = platforms.linux;
+  };
+})