diff --git a/deployment/default.nix b/deployment/default.nix
index 89bc89d9..ae7ff5f1 100644
--- a/deployment/default.nix
+++ b/deployment/default.nix
@@ -44,138 +44,140 @@ in
 { providers, ... }:
 
 {
-  providers = { inherit (nixops4.modules.nixops4Provider) local; };
-
-  resources =
-    let
-      ## NOTE: All of these secrets are publicly available in this source file
-      ## and will end up in the Nix store. We don't care as they are only ever
-      ## used for testing anyway.
-      ##
-      ## FIXME: Generate and store in NixOps4's state.
-      mastodonS3KeyConfig =
-        { pkgs, ... }:
-        {
-          s3AccessKeyFile = pkgs.writeText "s3AccessKey" "GK3515373e4c851ebaad366558";
-          s3SecretKeyFile = pkgs.writeText "s3SecretKey" "7d37d093435a41f2aab8f13c19ba067d9776c90215f56614adad6ece597dbb34";
-        };
-      peertubeS3KeyConfig =
-        { pkgs, ... }:
-        {
-          s3AccessKeyFile = pkgs.writeText "s3AccessKey" "GK1f9feea9960f6f95ff404c9b";
-          s3SecretKeyFile = pkgs.writeText "s3SecretKey" "7295c4201966a02c2c3d25b5cea4a5ff782966a2415e3a196f91924631191395";
-        };
-      pixelfedS3KeyConfig =
-        { pkgs, ... }:
-        {
-          s3AccessKeyFile = pkgs.writeText "s3AccessKey" "GKb5615457d44214411e673b7b";
-          s3SecretKeyFile = pkgs.writeText "s3SecretKey" "5be6799a88ca9b9d813d1a806b64f15efa49482dbe15339ddfaf7f19cf434987";
-        };
-
-      makeConfigurationResource = resourceModule: config: {
-        type = providers.local.exec;
-        imports = [
-          nixops4-nixos.modules.nixops4Resource.nixos
-          resourceModule
+  config = {
+    providers = { inherit (nixops4.modules.nixops4Provider) local; };
 
+    resources =
+      let
+        ## NOTE: All of these secrets are publicly available in this source file
+        ## and will end up in the Nix store. We don't care as they are only ever
+        ## used for testing anyway.
+        ##
+        ## FIXME: Generate and store in NixOps4's state.
+        mastodonS3KeyConfig =
+          { pkgs, ... }:
           {
-            ## NOTE: With NixOps4, there are several levels and all of them live
-            ## in the NixOS module system:
-            ##
-            ##   1. Each NixOps4 deployment is a module.
-            ##   2. Each NixOps4 resource is a module. This very comment is
-            ##      inside an attrset imported as a module in a resource.
-            ##   3. Each NixOps4 'configuration' resource contains an attribute
-            ##      'nixos.module', itself a NixOS configuration module.
-            nixos.module =
-              { ... }:
-              {
-                imports = [
-                  config
-                  fediversity
-                ];
-              };
-          }
-        ];
-      };
-
-    in
-
-    {
-      garage-configuration = makeConfigurationResource garageConfigurationResource (
-        { pkgs, ... }:
-        mkIf (panelConfig.mastodon.enable || panelConfig.peertube.enable || panelConfig.pixelfed.enable) {
-          fediversity = {
-            inherit (panelConfig) domain;
-            garage.enable = true;
-            pixelfed = pixelfedS3KeyConfig { inherit pkgs; };
-            mastodon = mastodonS3KeyConfig { inherit pkgs; };
-            peertube = peertubeS3KeyConfig { inherit pkgs; };
+            s3AccessKeyFile = pkgs.writeText "s3AccessKey" "GK3515373e4c851ebaad366558";
+            s3SecretKeyFile = pkgs.writeText "s3SecretKey" "7d37d093435a41f2aab8f13c19ba067d9776c90215f56614adad6ece597dbb34";
           };
-        }
-      );
-
-      mastodon-configuration = makeConfigurationResource mastodonConfigurationResource (
-        { pkgs, ... }:
-        mkIf panelConfig.mastodon.enable {
-          fediversity = {
-            inherit (panelConfig) domain;
-            temp.initialUser = {
-              inherit (panelConfig.initialUser) username email displayName;
-              # FIXME: disgusting, but nvm, this is going to be replaced by
-              # proper central authentication at some point
-              passwordFile = pkgs.writeText "password" panelConfig.initialUser.password;
-            };
-
-            mastodon = mastodonS3KeyConfig { inherit pkgs; } // {
-              enable = true;
-            };
-
-            temp.cores = 1; # FIXME: should come from NixOps4 eventually
+        peertubeS3KeyConfig =
+          { pkgs, ... }:
+          {
+            s3AccessKeyFile = pkgs.writeText "s3AccessKey" "GK1f9feea9960f6f95ff404c9b";
+            s3SecretKeyFile = pkgs.writeText "s3SecretKey" "7295c4201966a02c2c3d25b5cea4a5ff782966a2415e3a196f91924631191395";
+          };
+        pixelfedS3KeyConfig =
+          { pkgs, ... }:
+          {
+            s3AccessKeyFile = pkgs.writeText "s3AccessKey" "GKb5615457d44214411e673b7b";
+            s3SecretKeyFile = pkgs.writeText "s3SecretKey" "5be6799a88ca9b9d813d1a806b64f15efa49482dbe15339ddfaf7f19cf434987";
           };
-        }
-      );
 
-      peertube-configuration = makeConfigurationResource peertubeConfigurationResource (
-        { pkgs, ... }:
-        mkIf panelConfig.peertube.enable {
-          fediversity = {
-            inherit (panelConfig) domain;
-            temp.initialUser = {
-              inherit (panelConfig.initialUser) username email displayName;
-              # FIXME: disgusting, but nvm, this is going to be replaced by
-              # proper central authentication at some point
-              passwordFile = pkgs.writeText "password" panelConfig.initialUser.password;
-            };
+        makeConfigurationResource = resourceModule: config: {
+          type = providers.local.exec;
+          imports = [
+            nixops4-nixos.modules.nixops4Resource.nixos
+            resourceModule
 
-            peertube = peertubeS3KeyConfig { inherit pkgs; } // {
-              enable = true;
-              ## NOTE: Only ever used for testing anyway.
+            {
+              ## NOTE: With NixOps4, there are several levels and all of them live
+              ## in the NixOS module system:
               ##
-              ## FIXME: Generate and store in NixOps4's state.
-              secretsFile = pkgs.writeText "secret" "574e093907d1157ac0f8e760a6deb1035402003af5763135bae9cbd6abe32b24";
-            };
-          };
-        }
-      );
+              ##   1. Each NixOps4 deployment is a module.
+              ##   2. Each NixOps4 resource is a module. This very comment is
+              ##      inside an attrset imported as a module in a resource.
+              ##   3. Each NixOps4 'configuration' resource contains an attribute
+              ##      'nixos.module', itself a NixOS configuration module.
+              nixos.module =
+                { ... }:
+                {
+                  imports = [
+                    config
+                    fediversity
+                  ];
+                };
+            }
+          ];
+        };
 
-      pixelfed-configuration = makeConfigurationResource pixelfedConfigurationResource (
-        { pkgs, ... }:
-        mkIf panelConfig.pixelfed.enable {
-          fediversity = {
-            inherit (panelConfig) domain;
-            temp.initialUser = {
-              inherit (panelConfig.initialUser) username email displayName;
-              # FIXME: disgusting, but nvm, this is going to be replaced by
-              # proper central authentication at some point
-              passwordFile = pkgs.writeText "password" panelConfig.initialUser.password;
-            };
+      in
 
-            pixelfed = pixelfedS3KeyConfig { inherit pkgs; } // {
-              enable = true;
+      {
+        garage-configuration = makeConfigurationResource garageConfigurationResource (
+          { pkgs, ... }:
+          mkIf (panelConfig.mastodon.enable || panelConfig.peertube.enable || panelConfig.pixelfed.enable) {
+            fediversity = {
+              inherit (panelConfig) domain;
+              garage.enable = true;
+              pixelfed = pixelfedS3KeyConfig { inherit pkgs; };
+              mastodon = mastodonS3KeyConfig { inherit pkgs; };
+              peertube = peertubeS3KeyConfig { inherit pkgs; };
             };
-          };
-        }
-      );
-    };
+          }
+        );
+
+        mastodon-configuration = makeConfigurationResource mastodonConfigurationResource (
+          { pkgs, ... }:
+          mkIf panelConfig.mastodon.enable {
+            fediversity = {
+              inherit (panelConfig) domain;
+              temp.initialUser = {
+                inherit (panelConfig.initialUser) username email displayName;
+                # FIXME: disgusting, but nvm, this is going to be replaced by
+                # proper central authentication at some point
+                passwordFile = pkgs.writeText "password" panelConfig.initialUser.password;
+              };
+
+              mastodon = mastodonS3KeyConfig { inherit pkgs; } // {
+                enable = true;
+              };
+
+              temp.cores = 1; # FIXME: should come from NixOps4 eventually
+            };
+          }
+        );
+
+        peertube-configuration = makeConfigurationResource peertubeConfigurationResource (
+          { pkgs, ... }:
+          mkIf panelConfig.peertube.enable {
+            fediversity = {
+              inherit (panelConfig) domain;
+              temp.initialUser = {
+                inherit (panelConfig.initialUser) username email displayName;
+                # FIXME: disgusting, but nvm, this is going to be replaced by
+                # proper central authentication at some point
+                passwordFile = pkgs.writeText "password" panelConfig.initialUser.password;
+              };
+
+              peertube = peertubeS3KeyConfig { inherit pkgs; } // {
+                enable = true;
+                ## NOTE: Only ever used for testing anyway.
+                ##
+                ## FIXME: Generate and store in NixOps4's state.
+                secretsFile = pkgs.writeText "secret" "574e093907d1157ac0f8e760a6deb1035402003af5763135bae9cbd6abe32b24";
+              };
+            };
+          }
+        );
+
+        pixelfed-configuration = makeConfigurationResource pixelfedConfigurationResource (
+          { pkgs, ... }:
+          mkIf panelConfig.pixelfed.enable {
+            fediversity = {
+              inherit (panelConfig) domain;
+              temp.initialUser = {
+                inherit (panelConfig.initialUser) username email displayName;
+                # FIXME: disgusting, but nvm, this is going to be replaced by
+                # proper central authentication at some point
+                passwordFile = pkgs.writeText "password" panelConfig.initialUser.password;
+              };
+
+              pixelfed = pixelfedS3KeyConfig { inherit pkgs; } // {
+                enable = true;
+              };
+            };
+          }
+        );
+      };
+  };
 }