chore(nix): add style tooling

flake.lock

@@ -465,7 +465,8 @@
         "nixpkgs-unstable": "nixpkgs-unstable",
         "nixvim": "nixvim",
         "sops-nix": "sops-nix",
-        "stylix": "stylix"
+        "stylix": "stylix",
+        "treefmt-nix": "treefmt-nix"
       }
     },
     "sops-nix": {
@@ -617,6 +618,26 @@
         "repo": "base16-zed",
         "type": "github"
       }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1786901030,
+        "narHash": "sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "27b3b12a8e6375f28ebe122f07d230ca5459bbfa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -62,6 +62,12 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    # Repository formatter and Nix lint wiring.
+    treefmt-nix = {
+      url = "github:numtide/treefmt-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     # CachyOS kernel and binary cache.
     # This must not follow this flake's nixpkgs because Chaotic builds against its own pinned package set.
     # Its cache serves the kernel only when the overlay stays on the cache-friendly path.
@@ -69,8 +75,48 @@
   };
 
   outputs =
-    { self, nixpkgs, ... }@inputs:
     {
+      self,
+      nixpkgs,
+      treefmt-nix,
+      ...
+    }@inputs:
+    let
+      supportedSystems = [ "x86_64-linux" ];
+      forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
+      pkgsFor = system: nixpkgs.legacyPackages.${system};
+      treefmtEvalFor = system: treefmt-nix.lib.evalModule (pkgsFor system) ./treefmt.nix;
+    in
+    {
+      formatter = forAllSystems (system: (treefmtEvalFor system).config.build.wrapper);
+
+      apps = forAllSystems (
+        system:
+        let
+          pkgs = pkgsFor system;
+          treefmtEval = treefmtEvalFor system;
+          nixStyleCheck = pkgs.writeShellApplication {
+            name = "nix-style-check";
+            runtimeInputs = [
+              treefmtEval.config.build.wrapper
+              pkgs.statix
+              pkgs.deadnix
+            ];
+            text = ''
+              treefmt --fail-on-change
+              statix check .
+              deadnix --fail --no-lambda-pattern-names --no-underscore .
+            '';
+          };
+        in
+        {
+          nix-style-check = {
+            type = "app";
+            program = "${nixStyleCheck}/bin/nix-style-check";
+          };
+        }
+      );
+
       nixosConfigurations = (import ./src/dotfiles {
         inherit inputs self;
         lib = nixpkgs.lib;

statix.toml

@@ -0,0 +1,3 @@
+disabled = [
+  "repeated_keys",
+]

treefmt.nix

@@ -0,0 +1,9 @@
+{
+  projectRootFile = "flake.nix";
+
+  programs.nixfmt.enable = true;
+
+  settings.formatter.nixfmt.excludes = [
+    "configs/nixos/hosts/*/hardware-configuration.nix"
+  ];
+}