diff --git a/nix/host-modules/swarm-authelia.nix b/nix/host-modules/swarm-authelia.nix
index 81a73f15..8aca2d44 100644
--- a/nix/host-modules/swarm-authelia.nix
+++ b/nix/host-modules/swarm-authelia.nix
@@ -455,32 +455,32 @@ in
               SyslogIdentifier = "${unitName}-secrets";
             };
             script = ''
-                            set -euo pipefail
+              set -euo pipefail
 
-                            # Each is generated once and never rotated here: the
-                            # session and storage keys are load-bearing for data
-                            # already written (sessions, the encrypted store), so
-                            # replacing one is an operator action, not a boot action.
-                            for f in ${lib.concatStringsSep " " randomKeys}; do
-                              p=${lib.escapeShellArg stateDir}/"$f".key
-                              if [ ! -s "$p" ]; then
-                                head -c 64 /dev/urandom | od -An -tx1 | tr -d ' \n' > "$p"
-                                echo "generated $p"
-                              fi
-                              chmod 0600 "$p"
-                            done
+              # Each is generated once and never rotated here: the
+              # session and storage keys are load-bearing for data
+              # already written (sessions, the encrypted store), so
+              # replacing one is an operator action, not a boot action.
+              for f in ${lib.concatStringsSep " " randomKeys}; do
+                p=${lib.escapeShellArg stateDir}/"$f".key
+                if [ ! -s "$p" ]; then
+                  head -c 64 /dev/urandom | od -An -tx1 | tr -d ' \n' > "$p"
+                  echo "generated $p"
+                fi
+                chmod 0600 "$p"
+              done
               ${oidcGenScript}
 
-                            # A users database that exists and parses, with nobody in
-                            # it. authelia refuses to start without one, and the
-                            # alternative to an empty file is a placeholder account —
-                            # which is a credential nobody meant to create.
-                            users=${lib.escapeShellArg cfg.usersFile}
-                            if [ ! -s "$users" ]; then
-                              echo "users: {}" > "$users"
-                              echo "seeded empty users database at $users"
-                            fi
-                            chmod 0600 "$users"
+              # A users database that exists and parses, with nobody in
+              # it. authelia refuses to start without one, and the
+              # alternative to an empty file is a placeholder account —
+              # which is a credential nobody meant to create.
+              users=${lib.escapeShellArg cfg.usersFile}
+              if [ ! -s "$users" ]; then
+                echo "users: {}" > "$users"
+                echo "seeded empty users database at $users"
+              fi
+              chmod 0600 "$users"
             '';
           };