about summary refs log tree commit diff
path: root/nixos/modules/services/networking
diff options
context:
space:
mode:
Diffstat (limited to 'nixos/modules/services/networking')
-rw-r--r--nixos/modules/services/networking/3proxy.nix44
-rw-r--r--nixos/modules/services/networking/adguardhome.nix10
-rw-r--r--nixos/modules/services/networking/amuled.nix6
-rw-r--r--nixos/modules/services/networking/antennas.nix8
-rw-r--r--nixos/modules/services/networking/aria2.nix14
-rw-r--r--nixos/modules/services/networking/asterisk.nix30
-rw-r--r--nixos/modules/services/networking/atftpd.nix6
-rw-r--r--nixos/modules/services/networking/autossh.nix10
-rw-r--r--nixos/modules/services/networking/avahi-daemon.nix46
-rw-r--r--nixos/modules/services/networking/babeld.nix12
-rw-r--r--nixos/modules/services/networking/bee-clef.nix8
-rw-r--r--nixos/modules/services/networking/bee.nix12
-rw-r--r--nixos/modules/services/networking/biboumi.nix28
-rw-r--r--nixos/modules/services/networking/bind.nix18
-rw-r--r--nixos/modules/services/networking/bird-lg.nix48
-rw-r--r--nixos/modules/services/networking/bitcoind.nix32
-rw-r--r--nixos/modules/services/networking/bitlbee.nix22
-rw-r--r--nixos/modules/services/networking/blockbook-frontend.nix58
-rw-r--r--nixos/modules/services/networking/blocky.nix4
-rw-r--r--nixos/modules/services/networking/charybdis.nix10
-rw-r--r--nixos/modules/services/networking/cjdns.nix36
-rw-r--r--nixos/modules/services/networking/cloudflare-dyndns.nix10
-rw-r--r--nixos/modules/services/networking/cntlm.nix18
-rw-r--r--nixos/modules/services/networking/connman.nix16
-rw-r--r--nixos/modules/services/networking/consul.nix32
-rw-r--r--nixos/modules/services/networking/coredns.nix2
-rw-r--r--nixos/modules/services/networking/corerad.nix8
-rw-r--r--nixos/modules/services/networking/coturn.nix58
-rw-r--r--nixos/modules/services/networking/croc.nix4
-rw-r--r--nixos/modules/services/networking/dante.nix2
-rw-r--r--nixos/modules/services/networking/ddclient.nix36
-rw-r--r--nixos/modules/services/networking/dhcpcd.nix12
-rw-r--r--nixos/modules/services/networking/dhcpd.nix20
-rw-r--r--nixos/modules/services/networking/dnscache.nix10
-rw-r--r--nixos/modules/services/networking/dnscrypt-proxy2.nix12
-rw-r--r--nixos/modules/services/networking/dnscrypt-wrapper.nix20
-rw-r--r--nixos/modules/services/networking/dnsdist.nix6
-rw-r--r--nixos/modules/services/networking/dnsmasq.nix12
-rw-r--r--nixos/modules/services/networking/doh-proxy-rust.nix4
-rw-r--r--nixos/modules/services/networking/ejabberd.nix20
-rw-r--r--nixos/modules/services/networking/envoy.nix2
-rw-r--r--nixos/modules/services/networking/epmd.nix6
-rw-r--r--nixos/modules/services/networking/ergo.nix20
-rw-r--r--nixos/modules/services/networking/ergochat.nix8
-rw-r--r--nixos/modules/services/networking/eternal-terminal.nix8
-rw-r--r--nixos/modules/services/networking/expressvpn.nix2
-rw-r--r--nixos/modules/services/networking/fakeroute.nix4
-rw-r--r--nixos/modules/services/networking/ferm.nix4
-rw-r--r--nixos/modules/services/networking/fireqos.nix2
-rw-r--r--nixos/modules/services/networking/firewall.nix44
-rw-r--r--nixos/modules/services/networking/flannel.nix30
-rw-r--r--nixos/modules/services/networking/freenet.nix4
-rw-r--r--nixos/modules/services/networking/freeradius.nix4
-rw-r--r--nixos/modules/services/networking/frr.nix12
-rw-r--r--nixos/modules/services/networking/gateone.nix4
-rw-r--r--nixos/modules/services/networking/ghostunnel.nix22
-rw-r--r--nixos/modules/services/networking/git-daemon.nix18
-rw-r--r--nixos/modules/services/networking/globalprotect-vpn.nix4
-rw-r--r--nixos/modules/services/networking/gnunet.nix16
-rw-r--r--nixos/modules/services/networking/go-neb.nix18
-rw-r--r--nixos/modules/services/networking/go-shadowsocks2.nix2
-rw-r--r--nixos/modules/services/networking/gobgpd.nix4
-rw-r--r--nixos/modules/services/networking/gvpe.nix12
-rw-r--r--nixos/modules/services/networking/hans.nix16
-rw-r--r--nixos/modules/services/networking/haproxy.nix10
-rw-r--r--nixos/modules/services/networking/headscale.nix84
-rw-r--r--nixos/modules/services/networking/hostapd.nix42
-rw-r--r--nixos/modules/services/networking/htpdate.nix8
-rw-r--r--nixos/modules/services/networking/https-dns-proxy.nix14
-rw-r--r--nixos/modules/services/networking/hylafax/options.nix72
-rw-r--r--nixos/modules/services/networking/i2pd.nix114
-rw-r--r--nixos/modules/services/networking/icecream/daemon.nix24
-rw-r--r--nixos/modules/services/networking/icecream/scheduler.nix14
-rw-r--r--nixos/modules/services/networking/inspircd.nix14
-rw-r--r--nixos/modules/services/networking/iodine.nix18
-rw-r--r--nixos/modules/services/networking/iperf3.nix20
-rw-r--r--nixos/modules/services/networking/iscsi/initiator.nix10
-rw-r--r--nixos/modules/services/networking/iscsi/root-initiator.nix14
-rw-r--r--nixos/modules/services/networking/iscsi/target.nix2
-rw-r--r--nixos/modules/services/networking/iwd.nix4
-rw-r--r--nixos/modules/services/networking/jibri/default.nix38
-rw-r--r--nixos/modules/services/networking/jicofo.nix20
-rw-r--r--nixos/modules/services/networking/jitsi-videobridge.nix32
-rw-r--r--nixos/modules/services/networking/kea.nix32
-rw-r--r--nixos/modules/services/networking/keybase.nix2
-rw-r--r--nixos/modules/services/networking/knot.nix8
-rw-r--r--nixos/modules/services/networking/kresd.nix14
-rw-r--r--nixos/modules/services/networking/lambdabot.nix6
-rw-r--r--nixos/modules/services/networking/libreswan.nix10
-rw-r--r--nixos/modules/services/networking/lldpd.nix2
-rw-r--r--nixos/modules/services/networking/logmein-hamachi.nix2
-rw-r--r--nixos/modules/services/networking/lokinet.nix12
-rw-r--r--nixos/modules/services/networking/lxd-image-server.nix8
-rw-r--r--nixos/modules/services/networking/matterbridge.nix12
-rw-r--r--nixos/modules/services/networking/minidlna.nix36
-rw-r--r--nixos/modules/services/networking/miniupnpd.nix8
-rw-r--r--nixos/modules/services/networking/miredo.nix10
-rw-r--r--nixos/modules/services/networking/mjpg-streamer.nix10
-rw-r--r--nixos/modules/services/networking/monero.nix42
-rw-r--r--nixos/modules/services/networking/morty.nix14
-rw-r--r--nixos/modules/services/networking/mosquitto.nix46
-rw-r--r--nixos/modules/services/networking/mozillavpn.nix2
-rw-r--r--nixos/modules/services/networking/mstpd.nix2
-rw-r--r--nixos/modules/services/networking/mtprotoproxy.nix10
-rw-r--r--nixos/modules/services/networking/mtr-exporter.nix10
-rw-r--r--nixos/modules/services/networking/mullvad-vpn.nix4
-rw-r--r--nixos/modules/services/networking/multipath.nix108
-rw-r--r--nixos/modules/services/networking/murmur.nix58
-rw-r--r--nixos/modules/services/networking/mxisd.nix12
-rw-r--r--nixos/modules/services/networking/namecoind.nix22
-rw-r--r--nixos/modules/services/networking/nar-serve.nix2
-rw-r--r--nixos/modules/services/networking/nat.nix32
-rw-r--r--nixos/modules/services/networking/nats.nix16
-rw-r--r--nixos/modules/services/networking/nbd.nix10
-rw-r--r--nixos/modules/services/networking/ncdns.nix18
-rw-r--r--nixos/modules/services/networking/ndppd.nix22
-rw-r--r--nixos/modules/services/networking/nebula.nix34
-rw-r--r--nixos/modules/services/networking/networkmanager.nix32
-rw-r--r--nixos/modules/services/networking/nextdns.nix4
-rw-r--r--nixos/modules/services/networking/nftables.nix4
-rw-r--r--nixos/modules/services/networking/nghttpx/backend-params-submodule.nix16
-rw-r--r--nixos/modules/services/networking/nghttpx/frontend-params-submodule.nix10
-rw-r--r--nixos/modules/services/networking/nghttpx/server-options.nix4
-rw-r--r--nixos/modules/services/networking/nghttpx/tls-submodule.nix4
-rw-r--r--nixos/modules/services/networking/ngircd.nix4
-rw-r--r--nixos/modules/services/networking/nix-serve.nix8
-rw-r--r--nixos/modules/services/networking/nix-store-gcs-proxy.nix8
-rw-r--r--nixos/modules/services/networking/nixops-dns.nix6
-rw-r--r--nixos/modules/services/networking/nntp-proxy.nix28
-rw-r--r--nixos/modules/services/networking/nomad.nix32
-rw-r--r--nixos/modules/services/networking/nsd.nix122
-rw-r--r--nixos/modules/services/networking/ntopng.nix22
-rw-r--r--nixos/modules/services/networking/ntp/chrony.nix22
-rw-r--r--nixos/modules/services/networking/ntp/ntpd.nix8
-rw-r--r--nixos/modules/services/networking/ntp/openntpd.nix6
-rw-r--r--nixos/modules/services/networking/nullidentdmod.nix2
-rw-r--r--nixos/modules/services/networking/nylon.nix20
-rw-r--r--nixos/modules/services/networking/ofono.nix2
-rw-r--r--nixos/modules/services/networking/oidentd.nix2
-rw-r--r--nixos/modules/services/networking/onedrive.nix4
-rw-r--r--nixos/modules/services/networking/openconnect.nix14
-rw-r--r--nixos/modules/services/networking/openvpn.nix20
-rw-r--r--nixos/modules/services/networking/ostinato.nix10
-rw-r--r--nixos/modules/services/networking/pdns-recursor.nix36
-rw-r--r--nixos/modules/services/networking/pdnsd.nix14
-rw-r--r--nixos/modules/services/networking/pixiecore.nix24
-rw-r--r--nixos/modules/services/networking/pleroma.nix14
-rw-r--r--nixos/modules/services/networking/polipo.nix14
-rw-r--r--nixos/modules/services/networking/powerdns.nix4
-rw-r--r--nixos/modules/services/networking/pppd.nix12
-rw-r--r--nixos/modules/services/networking/pptpd.nix10
-rw-r--r--nixos/modules/services/networking/prayer.nix4
-rw-r--r--nixos/modules/services/networking/privoxy.nix18
-rw-r--r--nixos/modules/services/networking/prosody.nix180
-rw-r--r--nixos/modules/services/networking/quassel.nix12
-rw-r--r--nixos/modules/services/networking/quicktun.nix2
-rw-r--r--nixos/modules/services/networking/quorum.nix38
-rw-r--r--nixos/modules/services/networking/r53-ddns.nix10
-rw-r--r--nixos/modules/services/networking/radicale.nix26
-rw-r--r--nixos/modules/services/networking/radvd.nix8
-rw-r--r--nixos/modules/services/networking/rdnssd.nix6
-rw-r--r--nixos/modules/services/networking/redsocks.nix28
-rw-r--r--nixos/modules/services/networking/resilio.nix36
-rw-r--r--nixos/modules/services/networking/robustirc-bridge.nix2
-rw-r--r--nixos/modules/services/networking/routedns.nix8
-rw-r--r--nixos/modules/services/networking/sabnzbd.nix8
-rw-r--r--nixos/modules/services/networking/seafile.nix22
-rw-r--r--nixos/modules/services/networking/searx.nix10
-rw-r--r--nixos/modules/services/networking/shadowsocks.nix26
-rw-r--r--nixos/modules/services/networking/shairport-sync.nix10
-rw-r--r--nixos/modules/services/networking/shellhub-agent.nix10
-rw-r--r--nixos/modules/services/networking/shorewall.nix4
-rw-r--r--nixos/modules/services/networking/shorewall6.nix4
-rw-r--r--nixos/modules/services/networking/shout.nix18
-rw-r--r--nixos/modules/services/networking/skydns.nix18
-rw-r--r--nixos/modules/services/networking/smartdns.nix8
-rw-r--r--nixos/modules/services/networking/smokeping.nix46
-rw-r--r--nixos/modules/services/networking/sniproxy.nix6
-rw-r--r--nixos/modules/services/networking/snowflake-proxy.nix8
-rw-r--r--nixos/modules/services/networking/softether.nix8
-rw-r--r--nixos/modules/services/networking/soju.nix10
-rw-r--r--nixos/modules/services/networking/solanum.nix10
-rw-r--r--nixos/modules/services/networking/spacecookie.nix28
-rw-r--r--nixos/modules/services/networking/spiped.nix58
-rw-r--r--nixos/modules/services/networking/squid.nix12
-rw-r--r--nixos/modules/services/networking/ssh/lshd.nix26
-rw-r--r--nixos/modules/services/networking/ssh/sshd.nix68
-rw-r--r--nixos/modules/services/networking/sslh.nix12
-rw-r--r--nixos/modules/services/networking/strongswan.nix24
-rw-r--r--nixos/modules/services/networking/stubby.nix10
-rw-r--r--nixos/modules/services/networking/stunnel.nix12
-rw-r--r--nixos/modules/services/networking/supplicant.nix56
-rw-r--r--nixos/modules/services/networking/supybot.nix12
-rw-r--r--nixos/modules/services/networking/syncplay.nix18
-rw-r--r--nixos/modules/services/networking/syncthing-relay.nix22
-rw-r--r--nixos/modules/services/networking/syncthing.nix36
-rw-r--r--nixos/modules/services/networking/tailscale.nix8
-rw-r--r--nixos/modules/services/networking/tcpcrypt.nix2
-rw-r--r--nixos/modules/services/networking/teamspeak3.nix22
-rw-r--r--nixos/modules/services/networking/tedicross.nix10
-rw-r--r--nixos/modules/services/networking/teleport.nix12
-rw-r--r--nixos/modules/services/networking/tftpd.nix4
-rw-r--r--nixos/modules/services/networking/thelounge.nix22
-rw-r--r--nixos/modules/services/networking/tinc.nix62
-rw-r--r--nixos/modules/services/networking/tinydns.nix6
-rw-r--r--nixos/modules/services/networking/tox-bootstrapd.nix12
-rw-r--r--nixos/modules/services/networking/tox-node.nix16
-rw-r--r--nixos/modules/services/networking/toxvpn.nix6
-rw-r--r--nixos/modules/services/networking/trickster.nix20
-rw-r--r--nixos/modules/services/networking/tvheadend.nix4
-rw-r--r--nixos/modules/services/networking/ucarp.nix34
-rw-r--r--nixos/modules/services/networking/unbound.nix24
-rw-r--r--nixos/modules/services/networking/unifi.nix14
-rw-r--r--nixos/modules/services/networking/uptermd.nix12
-rw-r--r--nixos/modules/services/networking/v2ray.nix12
-rw-r--r--nixos/modules/services/networking/vsftpd.nix26
-rw-r--r--nixos/modules/services/networking/wasabibackend.nix24
-rw-r--r--nixos/modules/services/networking/websockify.nix8
-rw-r--r--nixos/modules/services/networking/wg-quick.nix50
-rw-r--r--nixos/modules/services/networking/wireguard.nix52
-rw-r--r--nixos/modules/services/networking/wpa_supplicant.nix26
-rw-r--r--nixos/modules/services/networking/x2goserver.nix2
-rw-r--r--nixos/modules/services/networking/xandikos.nix16
-rw-r--r--nixos/modules/services/networking/xinetd.nix22
-rw-r--r--nixos/modules/services/networking/xl2tpd.nix8
-rw-r--r--nixos/modules/services/networking/xrdp.nix14
-rw-r--r--nixos/modules/services/networking/yggdrasil.nix8
-rw-r--r--nixos/modules/services/networking/zerobin.nix12
-rw-r--r--nixos/modules/services/networking/zeronet.nix16
-rw-r--r--nixos/modules/services/networking/zerotierone.nix6
-rw-r--r--nixos/modules/services/networking/znc/options.nix30
231 files changed, 2191 insertions, 2191 deletions
diff --git a/nixos/modules/services/networking/3proxy.nix b/nixos/modules/services/networking/3proxy.nix
index 326a8671fcca..9fc1dac7c280 100644
--- a/nixos/modules/services/networking/3proxy.nix
+++ b/nixos/modules/services/networking/3proxy.nix
@@ -10,7 +10,7 @@ in {
     confFile = mkOption {
       type = types.path;
       example = "/var/lib/3proxy/3proxy.conf";
-      description = ''
+      description = lib.mdDoc ''
         Ignore all other 3proxy options and load configuration from this file.
       '';
     };
@@ -90,7 +90,7 @@ in {
             type = types.str;
             default = "[::]";
             example = "127.0.0.1";
-            description = ''
+            description = lib.mdDoc ''
               Address used for service.
             '';
           };
@@ -98,7 +98,7 @@ in {
             type = types.nullOr types.int;
             default = null;
             example = 3128;
-            description = ''
+            description = lib.mdDoc ''
               Override default port used for service.
             '';
           };
@@ -106,7 +106,7 @@ in {
             type = types.int;
             default = 100;
             example = 1000;
-            description = ''
+            description = lib.mdDoc ''
               Maximum number of simulationeous connections to this service.
             '';
           };
@@ -171,7 +171,7 @@ in {
                   type = types.listOf types.str;
                   default = [ ];
                   example = [ "user1" "user2" "user3" ];
-                  description = ''
+                  description = lib.mdDoc ''
                     List of users, use empty list for any.
                   '';
                 };
@@ -179,7 +179,7 @@ in {
                   type = types.listOf types.str;
                   default = [ ];
                   example = [ "127.0.0.1" "192.168.1.0/24" ];
-                  description = ''
+                  description = lib.mdDoc ''
                     List of source IP range, use empty list for any.
                   '';
                 };
@@ -198,7 +198,7 @@ in {
                   type = types.listOf types.int;
                   default = [ ];
                   example = [ 80 443 ];
-                  description = ''
+                  description = lib.mdDoc ''
                     List of target ports, use empty list for any.
                   '';
                 };
@@ -220,7 +220,7 @@ in {
                 }
               ]
             '';
-            description = ''
+            description = lib.mdDoc ''
               Use this option to limit user access to resources.
             '';
           };
@@ -228,17 +228,17 @@ in {
             type = types.nullOr types.str;
             default = null;
             example = "-46";
-            description = ''
+            description = lib.mdDoc ''
               Extra arguments for service.
-              Consult "Options" section in <link xlink:href="https://github.com/z3APA3A/3proxy/wiki/3proxy.cfg">documentation</link> for available arguments.
+              Consult "Options" section in [documentation](https://github.com/z3APA3A/3proxy/wiki/3proxy.cfg) for available arguments.
             '';
           };
           extraConfig = mkOption {
             type = types.nullOr types.lines;
             default = null;
-            description = ''
+            description = lib.mdDoc ''
               Extra configuration for service. Use this to configure things like bandwidth limiter or ACL-based redirection.
-              Consult <link xlink:href="https://github.com/z3APA3A/3proxy/wiki/3proxy.cfg">documentation</link> for available options.
+              Consult [documentation](https://github.com/z3APA3A/3proxy/wiki/3proxy.cfg) for available options.
             '';
           };
         };
@@ -266,14 +266,14 @@ in {
           }
         ]
       '';
-      description = ''
+      description = lib.mdDoc ''
         Use this option to define 3proxy services.
       '';
     };
     denyPrivate = mkOption {
       type = types.bool;
       default = true;
-      description = ''
+      description = lib.mdDoc ''
         Whether to deny access to private IP ranges including loopback.
       '';
     };
@@ -290,7 +290,7 @@ in {
         "::1"
         "fc00::/7"
       ];
-      description = ''
+      description = lib.mdDoc ''
         What IP ranges to deny access when denyPrivate is set tu true.
       '';
     };
@@ -301,7 +301,7 @@ in {
             type = types.listOf types.str;
             default = [ ];
             example = [ "127.0.0.53" "192.168.1.3:5353/tcp" ];
-            description = ''
+            description = lib.mdDoc ''
               List of nameservers to use.
 
               Up to 5 nservers may be specified. If no nserver is configured,
@@ -311,12 +311,12 @@ in {
           nscache = mkOption {
             type = types.int;
             default = 65535;
-            description = "Set name cache size for IPv4.";
+            description = lib.mdDoc "Set name cache size for IPv4.";
           };
           nscache6 = mkOption {
             type = types.int;
             default = 65535;
-            description = "Set name cache size for IPv6.";
+            description = lib.mdDoc "Set name cache size for IPv6.";
           };
           nsrecord = mkOption {
             type = types.attrsOf types.str;
@@ -327,21 +327,21 @@ in {
                 "site.local" = "192.168.1.43";
               }
             '';
-            description = "Adds static nsrecords.";
+            description = lib.mdDoc "Adds static nsrecords.";
           };
         };
       };
       default = { };
-      description = ''
+      description = lib.mdDoc ''
         Use this option to configure name resolution and DNS caching.
       '';
     };
     extraConfig = mkOption {
       type = types.nullOr types.lines;
       default = null;
-      description = ''
+      description = lib.mdDoc ''
         Extra configuration, appended to the 3proxy configuration file.
-        Consult <link xlink:href="https://github.com/z3APA3A/3proxy/wiki/3proxy.cfg">documentation</link> for available options.
+        Consult [documentation](https://github.com/z3APA3A/3proxy/wiki/3proxy.cfg) for available options.
       '';
     };
   };
diff --git a/nixos/modules/services/networking/adguardhome.nix b/nixos/modules/services/networking/adguardhome.nix
index 98ddf0716087..13ef78c10c53 100644
--- a/nixos/modules/services/networking/adguardhome.nix
+++ b/nixos/modules/services/networking/adguardhome.nix
@@ -30,7 +30,7 @@ in {
     host = mkOption {
       default = "0.0.0.0";
       type = str;
-      description = ''
+      description = lib.mdDoc ''
         Host address to bind HTTP server to.
       '';
     };
@@ -38,7 +38,7 @@ in {
     port = mkOption {
       default = 3000;
       type = port;
-      description = ''
+      description = lib.mdDoc ''
         Port to serve HTTP pages on.
       '';
     };
@@ -46,7 +46,7 @@ in {
     openFirewall = mkOption {
       default = false;
       type = bool;
-      description = ''
+      description = lib.mdDoc ''
         Open ports in the firewall for the AdGuard Home web interface. Does not
         open the port needed to access the DNS resolver.
       '';
@@ -55,7 +55,7 @@ in {
     mutableSettings = mkOption {
       default = true;
       type = bool;
-      description = ''
+      description = lib.mdDoc ''
         Allow changes made on the AdGuard Home web interface to persist between
         service restarts.
       '';
@@ -80,7 +80,7 @@ in {
     extraArgs = mkOption {
       default = [ ];
       type = listOf str;
-      description = ''
+      description = lib.mdDoc ''
         Extra command line parameters to be passed to the adguardhome binary.
       '';
     };
diff --git a/nixos/modules/services/networking/amuled.nix b/nixos/modules/services/networking/amuled.nix
index aa72a047526b..1cd543358196 100644
--- a/nixos/modules/services/networking/amuled.nix
+++ b/nixos/modules/services/networking/amuled.nix
@@ -19,7 +19,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to run the AMule daemon. You need to manually run "amuled --ec-config" to configure the service for the first time.
         '';
       };
@@ -30,7 +30,7 @@ in
         defaultText = literalExpression ''
           "/home/''${config.${opt.user}}/"
         '';
-        description = ''
+        description = lib.mdDoc ''
           The directory holding configuration, incoming and temporary files.
         '';
       };
@@ -38,7 +38,7 @@ in
       user = mkOption {
         type = types.nullOr types.str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           The user the AMule daemon should run as.
         '';
       };
diff --git a/nixos/modules/services/networking/antennas.nix b/nixos/modules/services/networking/antennas.nix
index ef98af22f20f..e3bde2b67d26 100644
--- a/nixos/modules/services/networking/antennas.nix
+++ b/nixos/modules/services/networking/antennas.nix
@@ -13,25 +13,25 @@ in
       tvheadendUrl = mkOption {
         type        = types.str;
         default     = "http://localhost:9981";
-        description = "URL of Tvheadend.";
+        description = lib.mdDoc "URL of Tvheadend.";
       };
 
       antennasUrl = mkOption {
         type        = types.str;
         default     = "http://127.0.0.1:5004";
-        description = "URL of Antennas.";
+        description = lib.mdDoc "URL of Antennas.";
       };
 
       tunerCount = mkOption {
         type        = types.int;
         default     = 6;
-        description = "Numbers of tuners in tvheadend.";
+        description = lib.mdDoc "Numbers of tuners in tvheadend.";
       };
 
       deviceUUID = mkOption {
         type        = types.str;
         default     = "2f70c0d7-90a3-4429-8275-cbeeee9cd605";
-        description = "Device tuner UUID. Change this if you are running multiple instances.";
+        description = lib.mdDoc "Device tuner UUID. Change this if you are running multiple instances.";
       };
     };
   };
diff --git a/nixos/modules/services/networking/aria2.nix b/nixos/modules/services/networking/aria2.nix
index 156fef144791..e848869cc0ac 100644
--- a/nixos/modules/services/networking/aria2.nix
+++ b/nixos/modules/services/networking/aria2.nix
@@ -28,7 +28,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether or not to enable the headless Aria2 daemon service.
 
           Aria2 daemon can be controlled via the RPC interface using
@@ -41,7 +41,7 @@ in
       openPorts = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Open listen and RPC ports found in listenPortRange and rpcListenPort
           options in the firewall.
         '';
@@ -49,26 +49,26 @@ in
       downloadDir = mkOption {
         type = types.path;
         default = downloadDir;
-        description = ''
+        description = lib.mdDoc ''
           Directory to store downloaded files.
         '';
       };
       listenPortRange = mkOption {
         type = types.listOf types.attrs;
         default = [ { from = 6881; to = 6999; } ];
-        description = ''
+        description = lib.mdDoc ''
           Set UDP listening port range used by DHT(IPv4, IPv6) and UDP tracker.
         '';
       };
       rpcListenPort = mkOption {
         type = types.int;
         default = 6800;
-        description = "Specify a port number for JSON-RPC/XML-RPC server to listen to. Possible Values: 1024-65535";
+        description = lib.mdDoc "Specify a port number for JSON-RPC/XML-RPC server to listen to. Possible Values: 1024-65535";
       };
       rpcSecret = mkOption {
         type = types.str;
         default = "aria2rpc";
-        description = ''
+        description = lib.mdDoc ''
           Set RPC secret authorization token.
           Read https://aria2.github.io/manual/en/html/aria2c.html#rpc-auth to know how this option value is used.
         '';
@@ -77,7 +77,7 @@ in
         type = types.separatedString " ";
         example = "--rpc-listen-all --remote-time=true";
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           Additional arguments to be passed to Aria2.
         '';
       };
diff --git a/nixos/modules/services/networking/asterisk.nix b/nixos/modules/services/networking/asterisk.nix
index 297d0b3b2d02..5a1d03f07211 100644
--- a/nixos/modules/services/networking/asterisk.nix
+++ b/nixos/modules/services/networking/asterisk.nix
@@ -59,7 +59,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to enable the Asterisk PBX server.
         '';
       };
@@ -72,9 +72,9 @@ in
           verbose=3
           debug=3
         '';
-        description = ''
+        description = lib.mdDoc ''
           Extra configuration options appended to the default
-          <literal>asterisk.conf</literal> file.
+          `asterisk.conf` file.
         '';
       };
 
@@ -127,19 +127,19 @@ in
               ''';
             }
         '';
-        description = ''
+        description = lib.mdDoc ''
           Sets the content of config files (typically ending with
-          <literal>.conf</literal>) in the Asterisk configuration directory.
+          `.conf`) in the Asterisk configuration directory.
 
-          Note that if you want to change <literal>asterisk.conf</literal>, it
-          is preferable to use the <option>services.asterisk.extraConfig</option>
-          option over this option. If <literal>"asterisk.conf"</literal> is
-          specified with the <option>confFiles</option> option (not recommended),
-          you must be prepared to set your own <literal>astetcdir</literal>
+          Note that if you want to change `asterisk.conf`, it
+          is preferable to use the {option}`services.asterisk.extraConfig`
+          option over this option. If `"asterisk.conf"` is
+          specified with the {option}`confFiles` option (not recommended),
+          you must be prepared to set your own `astetcdir`
           path.
 
           See
-          <link xlink:href="http://www.asterisk.org/community/documentation"/>
+          <http://www.asterisk.org/community/documentation>
           for more examples of what is possible here.
         '';
       };
@@ -148,9 +148,9 @@ in
         default = [ "ari.conf" "acl.conf" "agents.conf" "amd.conf" "calendar.conf" "cdr.conf" "cdr_syslog.conf" "cdr_custom.conf" "cel.conf" "cel_custom.conf" "cli_aliases.conf" "confbridge.conf" "dundi.conf" "features.conf" "hep.conf" "iax.conf" "pjsip.conf" "pjsip_wizard.conf" "phone.conf" "phoneprov.conf" "queues.conf" "res_config_sqlite3.conf" "res_parking.conf" "statsd.conf" "udptl.conf" "unistim.conf" ];
         type = types.listOf types.str;
         example = [ "sip.conf" "dundi.conf" ];
-        description = ''Sets these config files to the default content. The default value for
+        description = lib.mdDoc ''Sets these config files to the default content. The default value for
           this option contains all necesscary files to avoid errors at startup.
-          This does not override settings via <option>services.asterisk.confFiles</option>.
+          This does not override settings via {option}`services.asterisk.confFiles`.
         '';
       };
 
@@ -159,7 +159,7 @@ in
         type = types.listOf types.str;
         example =
           [ "-vvvddd" "-e" "1024" ];
-        description = ''
+        description = lib.mdDoc ''
           Additional command line arguments to pass to Asterisk.
         '';
       };
@@ -167,7 +167,7 @@ in
         type = types.package;
         default = pkgs.asterisk;
         defaultText = literalExpression "pkgs.asterisk";
-        description = "The Asterisk package to use.";
+        description = lib.mdDoc "The Asterisk package to use.";
       };
     };
   };
diff --git a/nixos/modules/services/networking/atftpd.nix b/nixos/modules/services/networking/atftpd.nix
index da5e305201f8..e31b447e6c5b 100644
--- a/nixos/modules/services/networking/atftpd.nix
+++ b/nixos/modules/services/networking/atftpd.nix
@@ -19,7 +19,7 @@ in
       enable = mkOption {
         default = false;
         type = types.bool;
-        description = ''
+        description = lib.mdDoc ''
           Whether to enable the atftpd TFTP server. By default, the server
           binds to address 0.0.0.0.
         '';
@@ -33,7 +33,7 @@ in
             "--verbose=7"
           ]
         '';
-        description = ''
+        description = lib.mdDoc ''
           Extra command line arguments to pass to atftp.
         '';
       };
@@ -41,7 +41,7 @@ in
       root = mkOption {
         default = "/srv/tftp";
         type = types.path;
-        description = ''
+        description = lib.mdDoc ''
           Document root directory for the atftpd.
         '';
       };
diff --git a/nixos/modules/services/networking/autossh.nix b/nixos/modules/services/networking/autossh.nix
index 245f2bfc2cf3..ed9c07d9a147 100644
--- a/nixos/modules/services/networking/autossh.nix
+++ b/nixos/modules/services/networking/autossh.nix
@@ -22,18 +22,18 @@ in
             name = mkOption {
               type = types.str;
               example = "socks-peer";
-              description = "Name of the local AutoSSH session";
+              description = lib.mdDoc "Name of the local AutoSSH session";
             };
             user = mkOption {
               type = types.str;
               example = "bill";
-              description = "Name of the user the AutoSSH session should run as";
+              description = lib.mdDoc "Name of the user the AutoSSH session should run as";
             };
             monitoringPort = mkOption {
               type = types.int;
               default = 0;
               example = 20000;
-              description = ''
+              description = lib.mdDoc ''
                 Port to be used by AutoSSH for peer monitoring. Note, that
                 AutoSSH also uses mport+1. Value of 0 disables the keep-alive
                 style monitoring
@@ -42,7 +42,7 @@ in
             extraArguments = mkOption {
               type = types.separatedString " ";
               example = "-N -D4343 bill@socks.example.net";
-              description = ''
+              description = lib.mdDoc ''
                 Arguments to be passed to AutoSSH and retransmitted to SSH
                 process. Some meaningful options include -N (don't run remote
                 command), -D (open SOCKS proxy on local port), -R (forward
@@ -54,7 +54,7 @@ in
         });
 
         default = [];
-        description = ''
+        description = lib.mdDoc ''
           List of AutoSSH sessions to start as systemd services. Each service is
           named 'autossh-{session.name}'.
         '';
diff --git a/nixos/modules/services/networking/avahi-daemon.nix b/nixos/modules/services/networking/avahi-daemon.nix
index 50c4ffdedce8..498e5a476708 100644
--- a/nixos/modules/services/networking/avahi-daemon.nix
+++ b/nixos/modules/services/networking/avahi-daemon.nix
@@ -43,7 +43,7 @@ in
     enable = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         Whether to run the Avahi daemon, which allows Avahi clients
         to use Avahi's service discovery facilities and also allows
         the local machine to advertise its presence and services
@@ -55,16 +55,16 @@ in
       type = types.str;
       default = config.networking.hostName;
       defaultText = literalExpression "config.networking.hostName";
-      description = ''
+      description = lib.mdDoc ''
         Host name advertised on the LAN. If not set, avahi will use the value
-        of <option>config.networking.hostName</option>.
+        of {option}`config.networking.hostName`.
       '';
     };
 
     domainName = mkOption {
       type = types.str;
       default = "local";
-      description = ''
+      description = lib.mdDoc ''
         Domain name for all advertisements.
       '';
     };
@@ -73,7 +73,7 @@ in
       type = types.listOf types.str;
       default = [ ];
       example = [ "0pointer.de" "zeroconf.org" ];
-      description = ''
+      description = lib.mdDoc ''
         List of non-local DNS domains to be browsed.
       '';
     };
@@ -81,22 +81,22 @@ in
     ipv4 = mkOption {
       type = types.bool;
       default = true;
-      description = "Whether to use IPv4.";
+      description = lib.mdDoc "Whether to use IPv4.";
     };
 
     ipv6 = mkOption {
       type = types.bool;
       default = config.networking.enableIPv6;
       defaultText = literalExpression "config.networking.enableIPv6";
-      description = "Whether to use IPv6.";
+      description = lib.mdDoc "Whether to use IPv6.";
     };
 
     interfaces = mkOption {
       type = types.nullOr (types.listOf types.str);
       default = null;
-      description = ''
-        List of network interfaces that should be used by the <command>avahi-daemon</command>.
-        Other interfaces will be ignored. If <literal>null</literal>, all local interfaces
+      description = lib.mdDoc ''
+        List of network interfaces that should be used by the {command}`avahi-daemon`.
+        Other interfaces will be ignored. If `null`, all local interfaces
         except loopback and point-to-point will be used.
       '';
     };
@@ -104,7 +104,7 @@ in
     openFirewall = mkOption {
       type = types.bool;
       default = true;
-      description = ''
+      description = lib.mdDoc ''
         Whether to open the firewall for UDP port 5353.
       '';
     };
@@ -112,7 +112,7 @@ in
     allowPointToPoint = mkOption {
       type = types.bool;
       default = false;
-      description= ''
+      description= lib.mdDoc ''
         Whether to use POINTTOPOINT interfaces. Might make mDNS unreliable due to usually large
         latencies with such links and opens a potential security hole by allowing mDNS access from Internet
         connections.
@@ -122,13 +122,13 @@ in
     wideArea = mkOption {
       type = types.bool;
       default = true;
-      description = "Whether to enable wide-area service discovery.";
+      description = lib.mdDoc "Whether to enable wide-area service discovery.";
     };
 
     reflector = mkOption {
       type = types.bool;
       default = false;
-      description = "Reflect incoming mDNS requests to all allowed network interfaces.";
+      description = lib.mdDoc "Reflect incoming mDNS requests to all allowed network interfaces.";
     };
 
     extraServiceFiles = mkOption {
@@ -161,25 +161,25 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = "Whether to allow publishing in general.";
+        description = lib.mdDoc "Whether to allow publishing in general.";
       };
 
       userServices = mkOption {
         type = types.bool;
         default = false;
-        description = "Whether to publish user services. Will set <literal>addresses=true</literal>.";
+        description = lib.mdDoc "Whether to publish user services. Will set `addresses=true`.";
       };
 
       addresses = mkOption {
         type = types.bool;
         default = false;
-        description = "Whether to register mDNS address records for all local IP addresses.";
+        description = lib.mdDoc "Whether to register mDNS address records for all local IP addresses.";
       };
 
       hinfo = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to register a mDNS HINFO record which contains information about the
           local operating system and CPU.
         '';
@@ -188,7 +188,7 @@ in
       workstation = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to register a service of type "_workstation._tcp" on the local LAN.
         '';
       };
@@ -196,14 +196,14 @@ in
       domain = mkOption {
         type = types.bool;
         default = false;
-        description = "Whether to announce the locally used domain name for browsing by other hosts.";
+        description = lib.mdDoc "Whether to announce the locally used domain name for browsing by other hosts.";
       };
     };
 
     nssmdns = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         Whether to enable the mDNS NSS (Name Service Switch) plug-in.
         Enabling it allows applications to resolve names in the `.local'
         domain by transparently querying the Avahi daemon.
@@ -213,7 +213,7 @@ in
     cacheEntriesMax = mkOption {
       type = types.nullOr types.int;
       default = null;
-      description = ''
+      description = lib.mdDoc ''
         Number of resource records to be cached per interface. Use 0 to
         disable caching. Avahi daemon defaults to 4096 if not set.
       '';
@@ -222,7 +222,7 @@ in
     extraConfig = mkOption {
       type = types.lines;
       default = "";
-      description = ''
+      description = lib.mdDoc ''
         Extra config to append to avahi-daemon.conf.
       '';
     };
diff --git a/nixos/modules/services/networking/babeld.nix b/nixos/modules/services/networking/babeld.nix
index aae6f1498a42..b393b6e05920 100644
--- a/nixos/modules/services/networking/babeld.nix
+++ b/nixos/modules/services/networking/babeld.nix
@@ -44,9 +44,9 @@ in
 
       interfaceDefaults = mkOption {
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           A set describing default parameters for babeld interfaces.
-          See <citerefentry><refentrytitle>babeld</refentrytitle><manvolnum>8</manvolnum></citerefentry> for options.
+          See {manpage}`babeld(8)` for options.
         '';
         type = types.nullOr (types.attrsOf types.unspecified);
         example =
@@ -58,9 +58,9 @@ in
 
       interfaces = mkOption {
         default = {};
-        description = ''
+        description = lib.mdDoc ''
           A set describing babeld interfaces.
-          See <citerefentry><refentrytitle>babeld</refentrytitle><manvolnum>8</manvolnum></citerefentry> for options.
+          See {manpage}`babeld(8)` for options.
         '';
         type = types.attrsOf (types.attrsOf types.unspecified);
         example =
@@ -75,9 +75,9 @@ in
       extraConfig = mkOption {
         default = "";
         type = types.lines;
-        description = ''
+        description = lib.mdDoc ''
           Options that will be copied to babeld.conf.
-          See <citerefentry><refentrytitle>babeld</refentrytitle><manvolnum>8</manvolnum></citerefentry> for details.
+          See {manpage}`babeld(8)` for details.
         '';
       };
     };
diff --git a/nixos/modules/services/networking/bee-clef.nix b/nixos/modules/services/networking/bee-clef.nix
index 719714b28982..852e1396b915 100644
--- a/nixos/modules/services/networking/bee-clef.nix
+++ b/nixos/modules/services/networking/bee-clef.nix
@@ -19,7 +19,7 @@ in {
       dataDir = mkOption {
         type = types.nullOr types.str;
         default = "/var/lib/bee-clef";
-        description = ''
+        description = lib.mdDoc ''
           Data dir for bee-clef. Beware that some helper scripts may not work when changed!
           The service itself should work fine, though.
         '';
@@ -28,13 +28,13 @@ in {
       passwordFile = mkOption {
         type = types.nullOr types.str;
         default = "/var/lib/bee-clef/password";
-        description = "Password file for bee-clef.";
+        description = lib.mdDoc "Password file for bee-clef.";
       };
 
       user = mkOption {
         type = types.str;
         default = "bee-clef";
-        description = ''
+        description = lib.mdDoc ''
           User the bee-clef daemon should execute under.
         '';
       };
@@ -42,7 +42,7 @@ in {
       group = mkOption {
         type = types.str;
         default = "bee-clef";
-        description = ''
+        description = lib.mdDoc ''
           Group the bee-clef daemon should execute under.
         '';
       };
diff --git a/nixos/modules/services/networking/bee.nix b/nixos/modules/services/networking/bee.nix
index d6efade0630f..a99513cb8cc7 100644
--- a/nixos/modules/services/networking/bee.nix
+++ b/nixos/modules/services/networking/bee.nix
@@ -22,14 +22,14 @@ in {
         default = pkgs.bee;
         defaultText = literalExpression "pkgs.bee";
         example = literalExpression "pkgs.bee-unstable";
-        description = "The package providing the bee binary for the service.";
+        description = lib.mdDoc "The package providing the bee binary for the service.";
       };
 
       settings = mkOption {
         type = format.type;
-        description = ''
+        description = lib.mdDoc ''
           Ethereum Swarm Bee configuration. Refer to
-          <link xlink:href="https://gateway.ethswarm.org/bzz/docs.swarm.eth/docs/installation/configuration/"/>
+          <https://gateway.ethswarm.org/bzz/docs.swarm.eth/docs/installation/configuration/>
           for details on supported values.
         '';
       };
@@ -37,7 +37,7 @@ in {
       daemonNiceLevel = mkOption {
         type = types.int;
         default = 0;
-        description = ''
+        description = lib.mdDoc ''
           Daemon process priority for bee.
           0 is the default Unix process priority, 19 is the lowest.
         '';
@@ -46,7 +46,7 @@ in {
       user = mkOption {
         type = types.str;
         default = "bee";
-        description = ''
+        description = lib.mdDoc ''
           User the bee binary should execute under.
         '';
       };
@@ -54,7 +54,7 @@ in {
       group = mkOption {
         type = types.str;
         default = "bee";
-        description = ''
+        description = lib.mdDoc ''
           Group the bee binary should execute under.
         '';
       };
diff --git a/nixos/modules/services/networking/biboumi.nix b/nixos/modules/services/networking/biboumi.nix
index 3f46b95eaf0c..7e6033008832 100644
--- a/nixos/modules/services/networking/biboumi.nix
+++ b/nixos/modules/services/networking/biboumi.nix
@@ -19,8 +19,8 @@ in
       enable = mkEnableOption "the Biboumi XMPP gateway to IRC";
 
       settings = mkOption {
-        description = ''
-          See <link xlink:href="https://lab.louiz.org/louiz/biboumi/blob/8.5/doc/biboumi.1.rst">biboumi 8.5</link>
+        description = lib.mdDoc ''
+          See [biboumi 8.5](https://lab.louiz.org/louiz/biboumi/blob/8.5/doc/biboumi.1.rst)
           for documentation.
         '';
         default = {};
@@ -34,7 +34,7 @@ in
             default = [];
             example = ["admin@example.org"];
             apply = concatStringsSep ":";
-            description = ''
+            description = lib.mdDoc ''
               The bare JID of the gateway administrator. This JID will have more
               privileges than other standard users, for example some administration
               ad-hoc commands will only be available to that JID.
@@ -43,7 +43,7 @@ in
           options.ca_file = mkOption {
             type = types.path;
             default = "/etc/ssl/certs/ca-certificates.crt";
-            description = ''
+            description = lib.mdDoc ''
               Specifies which file should be used as the list of trusted CA
               when negociating a TLS session.
             '';
@@ -51,7 +51,7 @@ in
           options.db_name = mkOption {
             type = with types; either path str;
             default = "${stateDir}/biboumi.sqlite";
-            description = ''
+            description = lib.mdDoc ''
               The name of the database to use.
             '';
             example = "postgresql://user:secret@localhost";
@@ -59,7 +59,7 @@ in
           options.hostname = mkOption {
             type = types.str;
             example = "biboumi.example.org";
-            description = ''
+            description = lib.mdDoc ''
               The hostname served by the XMPP gateway.
               This domain must be configured in the XMPP server
               as an external component.
@@ -69,14 +69,14 @@ in
             type = types.port;
             default = 113;
             example = 0;
-            description = ''
+            description = lib.mdDoc ''
               The TCP port on which to listen for identd queries.
             '';
           };
           options.log_level = mkOption {
             type = types.ints.between 0 3;
             default = 1;
-            description = ''
+            description = lib.mdDoc ''
               Indicate what type of log messages to write in the logs.
               0 is debug, 1 is info, 2 is warning, 3 is error.
             '';
@@ -96,7 +96,7 @@ in
           options.persistent_by_default = mkOption {
             type = types.bool;
             default = false;
-            description = ''
+            description = lib.mdDoc ''
               Whether all rooms will be persistent by default:
               the value of the “persistent” option in the global configuration of each
               user will be “true”, but the value of each individual room will still
@@ -108,7 +108,7 @@ in
             type = types.path;
             default = "${pkgs.biboumi}/etc/biboumi";
             defaultText = literalExpression ''"''${pkgs.biboumi}/etc/biboumi"'';
-            description = ''
+            description = lib.mdDoc ''
               A directory that should contain the policy files,
               used to customize Botan’s behaviour
               when negociating the TLS connections with the IRC servers.
@@ -117,14 +117,14 @@ in
           options.port = mkOption {
             type = types.port;
             default = 5347;
-            description = ''
+            description = lib.mdDoc ''
               The TCP port to use to connect to the local XMPP component.
             '';
           };
           options.realname_customization = mkOption {
             type = types.bool;
             default = true;
-            description = ''
+            description = lib.mdDoc ''
               Whether the users will be able to use
               the ad-hoc commands that lets them configure
               their realname and username.
@@ -133,7 +133,7 @@ in
           options.realname_from_jid = mkOption {
             type = types.bool;
             default = false;
-            description = ''
+            description = lib.mdDoc ''
               Whether the realname and username of each biboumi
               user will be extracted from their JID.
               Otherwise they will be set to the nick
@@ -143,7 +143,7 @@ in
           options.xmpp_server_ip = mkOption {
             type = types.str;
             default = "127.0.0.1";
-            description = ''
+            description = lib.mdDoc ''
               The IP address to connect to the XMPP server on.
               The connection to the XMPP server is unencrypted,
               so the biboumi instance and the server should
diff --git a/nixos/modules/services/networking/bind.nix b/nixos/modules/services/networking/bind.nix
index 2045612ec054..0966332f7d0d 100644
--- a/nixos/modules/services/networking/bind.nix
+++ b/nixos/modules/services/networking/bind.nix
@@ -17,28 +17,28 @@ let
       name = mkOption {
         type = types.str;
         default = name;
-        description = "Name of the zone.";
+        description = lib.mdDoc "Name of the zone.";
       };
       master = mkOption {
-        description = "Master=false means slave server";
+        description = lib.mdDoc "Master=false means slave server";
         type = types.bool;
       };
       file = mkOption {
         type = types.either types.str types.path;
-        description = "Zone file resource records contain columns of data, separated by whitespace, that define the record.";
+        description = lib.mdDoc "Zone file resource records contain columns of data, separated by whitespace, that define the record.";
       };
       masters = mkOption {
         type = types.listOf types.str;
-        description = "List of servers for inclusion in stub and secondary zones.";
+        description = lib.mdDoc "List of servers for inclusion in stub and secondary zones.";
       };
       slaves = mkOption {
         type = types.listOf types.str;
-        description = "Addresses who may request zone transfers.";
+        description = lib.mdDoc "Addresses who may request zone transfers.";
         default = [ ];
       };
       extraConfig = mkOption {
         type = types.str;
-        description = "Extra zone config to be appended at the end of the zone section.";
+        description = lib.mdDoc "Extra zone config to be appended at the end of the zone section.";
         default = "";
       };
     };
@@ -111,7 +111,7 @@ in
         type = types.package;
         default = pkgs.bind;
         defaultText = literalExpression "pkgs.bind";
-        description = "The BIND package to use.";
+        description = lib.mdDoc "The BIND package to use.";
       };
 
       cacheNetworks = mkOption {
@@ -178,7 +178,7 @@ in
       directory = mkOption {
         type = types.str;
         default = "/run/named";
-        description = "Working directory of BIND.";
+        description = lib.mdDoc "Working directory of BIND.";
       };
 
       zones = mkOption {
@@ -209,7 +209,7 @@ in
       extraOptions = mkOption {
         type = types.lines;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           Extra lines to be added verbatim to the options section of the
           generated named configuration file.
         '';
diff --git a/nixos/modules/services/networking/bird-lg.nix b/nixos/modules/services/networking/bird-lg.nix
index 515ef38608b4..db4a4140dd40 100644
--- a/nixos/modules/services/networking/bird-lg.nix
+++ b/nixos/modules/services/networking/bird-lg.nix
@@ -12,19 +12,19 @@ in
         type = types.package;
         default = pkgs.bird-lg;
         defaultText = literalExpression "pkgs.bird-lg";
-        description = "The Bird Looking Glass package to use.";
+        description = lib.mdDoc "The Bird Looking Glass package to use.";
       };
 
       user = mkOption {
         type = types.str;
         default = "bird-lg";
-        description = "User to run the service.";
+        description = lib.mdDoc "User to run the service.";
       };
 
       group = mkOption {
         type = types.str;
         default = "bird-lg";
-        description = "Group to run the service.";
+        description = lib.mdDoc "Group to run the service.";
       };
 
       frontend = {
@@ -33,103 +33,103 @@ in
         listenAddress = mkOption {
           type = types.str;
           default = "127.0.0.1:5000";
-          description = "Address to listen on.";
+          description = lib.mdDoc "Address to listen on.";
         };
 
         proxyPort = mkOption {
           type = types.port;
           default = 8000;
-          description = "Port bird-lg-proxy is running on.";
+          description = lib.mdDoc "Port bird-lg-proxy is running on.";
         };
 
         domain = mkOption {
           type = types.str;
           default = "";
           example = "dn42.lantian.pub";
-          description = "Server name domain suffixes.";
+          description = lib.mdDoc "Server name domain suffixes.";
         };
 
         servers = mkOption {
           type = types.listOf types.str;
           default = [ ];
           example = [ "gigsgigscloud" "hostdare" ];
-          description = "Server name prefixes.";
+          description = lib.mdDoc "Server name prefixes.";
         };
 
         whois = mkOption {
           type = types.str;
           default = "whois.verisign-grs.com";
-          description = "Whois server for queries.";
+          description = lib.mdDoc "Whois server for queries.";
         };
 
         dnsInterface = mkOption {
           type = types.str;
           default = "asn.cymru.com";
-          description = "DNS zone to query ASN information.";
+          description = lib.mdDoc "DNS zone to query ASN information.";
         };
 
         bgpMapInfo = mkOption {
           type = types.listOf types.str;
           default = [ "asn" "as-name" "ASName" "descr" ];
-          description = "Information displayed in bgpmap.";
+          description = lib.mdDoc "Information displayed in bgpmap.";
         };
 
         titleBrand = mkOption {
           type = types.str;
           default = "Bird-lg Go";
-          description = "Prefix of page titles in browser tabs.";
+          description = lib.mdDoc "Prefix of page titles in browser tabs.";
         };
 
         netSpecificMode = mkOption {
           type = types.str;
           default = "";
           example = "dn42";
-          description = "Apply network-specific changes for some networks.";
+          description = lib.mdDoc "Apply network-specific changes for some networks.";
         };
 
         protocolFilter = mkOption {
           type = types.listOf types.str;
           default = [ ];
           example = [ "ospf" ];
-          description = "Information displayed in bgpmap.";
+          description = lib.mdDoc "Information displayed in bgpmap.";
         };
 
         nameFilter = mkOption {
           type = types.str;
           default = "";
           example = "^ospf";
-          description = "Protocol names to hide in summary tables (RE2 syntax),";
+          description = lib.mdDoc "Protocol names to hide in summary tables (RE2 syntax),";
         };
 
         timeout = mkOption {
           type = types.int;
           default = 120;
-          description = "Time before request timed out, in seconds.";
+          description = lib.mdDoc "Time before request timed out, in seconds.";
         };
 
         navbar = {
           brand = mkOption {
             type = types.str;
             default = "Bird-lg Go";
-            description = "Brand to show in the navigation bar .";
+            description = lib.mdDoc "Brand to show in the navigation bar .";
           };
 
           brandURL = mkOption {
             type = types.str;
             default = "/";
-            description = "URL of the brand to show in the navigation bar.";
+            description = lib.mdDoc "URL of the brand to show in the navigation bar.";
           };
 
           allServers = mkOption {
             type = types.str;
             default = "ALL Servers";
-            description = "Text of 'All server' button in the navigation bar.";
+            description = lib.mdDoc "Text of 'All server' button in the navigation bar.";
           };
 
           allServersURL = mkOption {
             type = types.str;
             default = "all";
-            description = "URL of 'All servers' button.";
+            description = lib.mdDoc "URL of 'All servers' button.";
           };
         };
 
@@ -148,21 +148,21 @@ in
         listenAddress = mkOption {
           type = types.str;
           default = "127.0.0.1:8000";
-          description = "Address to listen on.";
+          description = lib.mdDoc "Address to listen on.";
         };
 
         allowedIPs = mkOption {
           type = types.listOf types.str;
           default = [ ];
           example = [ "192.168.25.52" "192.168.25.53" ];
-          description = "List of IPs to allow (default all allowed).";
+          description = lib.mdDoc "List of IPs to allow (default all allowed).";
         };
 
         birdSocket = mkOption {
           type = types.str;
           default = "/run/bird.ctl";
           example = "/var/run/bird/bird.ctl";
-          description = "Bird control socket path.";
+          description = lib.mdDoc "Bird control socket path.";
         };
 
         traceroute = {
@@ -170,13 +170,13 @@ in
             type = types.str;
             default = "${pkgs.traceroute}/bin/traceroute";
             defaultText = literalExpression ''"''${pkgs.traceroute}/bin/traceroute"'';
-            description = "Traceroute's binary path.";
+            description = lib.mdDoc "Traceroute's binary path.";
           };
 
           rawOutput = mkOption {
             type = types.bool;
             default = false;
-            description = "Display traceroute output in raw format.";
+            description = lib.mdDoc "Display traceroute output in raw format.";
           };
         };
 
diff --git a/nixos/modules/services/networking/bitcoind.nix b/nixos/modules/services/networking/bitcoind.nix
index 80033d958609..1788d5fcf58d 100644
--- a/nixos/modules/services/networking/bitcoind.nix
+++ b/nixos/modules/services/networking/bitcoind.nix
@@ -11,7 +11,7 @@ let
       name = mkOption {
         type = types.str;
         example = "alice";
-        description = ''
+        description = lib.mdDoc ''
           Username for JSON-RPC connections.
         '';
       };
@@ -41,14 +41,14 @@ let
         type = types.package;
         default = pkgs.bitcoind;
         defaultText = literalExpression "pkgs.bitcoind";
-        description = "The package providing bitcoin binaries.";
+        description = lib.mdDoc "The package providing bitcoin binaries.";
       };
 
       configFile = mkOption {
         type = types.nullOr types.path;
         default = null;
         example = "/var/lib/${name}/bitcoin.conf";
-        description = "The configuration file path to supply bitcoind.";
+        description = lib.mdDoc "The configuration file path to supply bitcoind.";
       };
 
       extraConfig = mkOption {
@@ -59,32 +59,32 @@ let
           rpcthreads=16
           logips=1
         '';
-        description = "Additional configurations to be appended to <filename>bitcoin.conf</filename>.";
+        description = lib.mdDoc "Additional configurations to be appended to {file}`bitcoin.conf`.";
       };
 
       dataDir = mkOption {
         type = types.path;
         default = "/var/lib/bitcoind-${name}";
-        description = "The data directory for bitcoind.";
+        description = lib.mdDoc "The data directory for bitcoind.";
       };
 
       user = mkOption {
         type = types.str;
         default = "bitcoind-${name}";
-        description = "The user as which to run bitcoind.";
+        description = lib.mdDoc "The user as which to run bitcoind.";
       };
 
       group = mkOption {
         type = types.str;
         default = config.user;
-        description = "The group as which to run bitcoind.";
+        description = lib.mdDoc "The group as which to run bitcoind.";
       };
 
       rpc = {
         port = mkOption {
           type = types.nullOr types.port;
           default = null;
-          description = "Override the default port on which to listen for JSON-RPC connections.";
+          description = lib.mdDoc "Override the default port on which to listen for JSON-RPC connections.";
         };
         users = mkOption {
           default = {};
@@ -95,33 +95,33 @@ let
             }
           '';
           type = types.attrsOf (types.submodule rpcUserOpts);
-          description = "RPC user information for JSON-RPC connnections.";
+          description = lib.mdDoc "RPC user information for JSON-RPC connnections.";
         };
       };
 
       pidFile = mkOption {
         type = types.path;
         default = "${config.dataDir}/bitcoind.pid";
-        description = "Location of bitcoind pid file.";
+        description = lib.mdDoc "Location of bitcoind pid file.";
       };
 
       testnet = mkOption {
         type = types.bool;
         default = false;
-        description = "Whether to use the testnet instead of mainnet.";
+        description = lib.mdDoc "Whether to use the testnet instead of mainnet.";
       };
 
       port = mkOption {
         type = types.nullOr types.port;
         default = null;
-        description = "Override the default port on which to listen for connections.";
+        description = lib.mdDoc "Override the default port on which to listen for connections.";
       };
 
       dbCache = mkOption {
         type = types.nullOr (types.ints.between 4 16384);
         default = null;
         example = 4000;
-        description = "Override the default database cache size in MiB.";
+        description = lib.mdDoc "Override the default database cache size in MiB.";
       };
 
       prune = mkOption {
@@ -132,7 +132,7 @@ let
         );
         default = null;
         example = 10000;
-        description = ''
+        description = lib.mdDoc ''
           Reduce storage requirements by enabling pruning (deleting) of old
           blocks. This allows the pruneblockchain RPC to be called to delete
           specific blocks, and enables automatic pruning of old blocks if a
@@ -147,7 +147,7 @@ let
       extraCmdlineOptions = mkOption {
         type = types.listOf types.str;
         default = [];
-        description = ''
+        description = lib.mdDoc ''
           Extra command line options to pass to bitcoind.
           Run bitcoind --help to list all available options.
         '';
@@ -161,7 +161,7 @@ in
     services.bitcoind = mkOption {
       type = types.attrsOf (types.submodule bitcoindOpts);
       default = {};
-      description = "Specification of one or more bitcoind instances.";
+      description = lib.mdDoc "Specification of one or more bitcoind instances.";
     };
   };
 
diff --git a/nixos/modules/services/networking/bitlbee.nix b/nixos/modules/services/networking/bitlbee.nix
index f76cffc79bfa..e2844feda028 100644
--- a/nixos/modules/services/networking/bitlbee.nix
+++ b/nixos/modules/services/networking/bitlbee.nix
@@ -49,7 +49,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to run the BitlBee IRC to other chat network gateway.
           Running it allows you to access the MSN, Jabber, Yahoo! and ICQ chat
           networks via an IRC client.
@@ -69,7 +69,7 @@ in
       portNumber = mkOption {
         default = 6667;
         type = types.int;
-        description = ''
+        description = lib.mdDoc ''
           Number of the port BitlBee will be listening to.
         '';
       };
@@ -77,7 +77,7 @@ in
       authBackend = mkOption {
         default = "storage";
         type = types.enum [ "storage" "pam" ];
-        description = ''
+        description = lib.mdDoc ''
           How users are authenticated
             storage -- save passwords internally
             pam -- Linux PAM authentication
@@ -87,7 +87,7 @@ in
       authMode = mkOption {
         default = "Open";
         type = types.enum [ "Open" "Closed" "Registered" ];
-        description = ''
+        description = lib.mdDoc ''
           The following authentication modes are available:
             Open -- Accept connections from anyone, use NickServ for user authentication.
             Closed -- Require authorization (using the PASS command during login) before allowing the user to connect at all.
@@ -98,7 +98,7 @@ in
       hostName = mkOption {
         default = "";
         type = types.str;
-        description = ''
+        description = lib.mdDoc ''
           Normally, BitlBee gets a hostname using getsockname(). If you have a nicer
           alias for your BitlBee daemon, you can set it here and BitlBee will identify
           itself with that name instead.
@@ -109,7 +109,7 @@ in
         type = types.listOf types.package;
         default = [];
         example = literalExpression "[ pkgs.bitlbee-facebook ]";
-        description = ''
+        description = lib.mdDoc ''
           The list of bitlbee plugins to install.
         '';
       };
@@ -118,7 +118,7 @@ in
         type = types.listOf types.package;
         default = [];
         example = literalExpression "[ pkgs.purple-matrix ]";
-        description = ''
+        description = lib.mdDoc ''
           The list of libpurple plugins to install.
         '';
       };
@@ -126,7 +126,7 @@ in
       configDir = mkOption {
         default = "/var/lib/bitlbee";
         type = types.path;
-        description = ''
+        description = lib.mdDoc ''
           Specify an alternative directory to store all the per-user configuration
           files.
         '';
@@ -135,7 +135,7 @@ in
       protocols = mkOption {
         default = "";
         type = types.str;
-        description = ''
+        description = lib.mdDoc ''
           This option allows to remove the support of protocol, even if compiled
           in. If nothing is given, there are no restrictions.
         '';
@@ -144,7 +144,7 @@ in
       extraSettings = mkOption {
         default = "";
         type = types.lines;
-        description = ''
+        description = lib.mdDoc ''
           Will be inserted in the Settings section of the config file.
         '';
       };
@@ -152,7 +152,7 @@ in
       extraDefaults = mkOption {
         default = "";
         type = types.lines;
-        description = ''
+        description = lib.mdDoc ''
           Will be inserted in the Default section of the config file.
         '';
       };
diff --git a/nixos/modules/services/networking/blockbook-frontend.nix b/nixos/modules/services/networking/blockbook-frontend.nix
index eeea521c8d51..0164883c7470 100644
--- a/nixos/modules/services/networking/blockbook-frontend.nix
+++ b/nixos/modules/services/networking/blockbook-frontend.nix
@@ -16,28 +16,28 @@ let
         type = types.package;
         default = pkgs.blockbook;
         defaultText = literalExpression "pkgs.blockbook";
-        description = "Which blockbook package to use.";
+        description = lib.mdDoc "Which blockbook package to use.";
       };
 
       user = mkOption {
         type = types.str;
         default = "blockbook-frontend-${name}";
-        description = "The user as which to run blockbook-frontend-${name}.";
+        description = lib.mdDoc "The user as which to run blockbook-frontend-${name}.";
       };
 
       group = mkOption {
         type = types.str;
         default = "${config.user}";
-        description = "The group as which to run blockbook-frontend-${name}.";
+        description = lib.mdDoc "The group as which to run blockbook-frontend-${name}.";
       };
 
       certFile = mkOption {
         type = types.nullOr types.path;
         default = null;
         example = "/etc/secrets/blockbook-frontend-${name}/certFile";
-        description = ''
+        description = lib.mdDoc ''
           To enable SSL, specify path to the name of certificate files without extension.
-          Expecting <filename>certFile.crt</filename> and <filename>certFile.key</filename>.
+          Expecting {file}`certFile.crt` and {file}`certFile.key`.
         '';
       };
 
@@ -45,14 +45,14 @@ let
         type = with types; nullOr path;
         default = null;
         example = "${config.dataDir}/config.json";
-        description = "Location of the blockbook configuration file.";
+        description = lib.mdDoc "Location of the blockbook configuration file.";
       };
 
       coinName = mkOption {
         type = types.str;
         default = "Bitcoin";
-        description = ''
-          See <link xlink:href="https://github.com/trezor/blockbook/blob/master/bchain/coins/blockchain.go#L61"/>
+        description = lib.mdDoc ''
+          See <https://github.com/trezor/blockbook/blob/master/bchain/coins/blockchain.go#L61>
           for current of coins supported in master (Note: may differ from release).
         '';
       };
@@ -62,8 +62,8 @@ let
         default = "${config.package}/share/css/";
         defaultText = literalExpression ''"''${package}/share/css/"'';
         example = literalExpression ''"''${dataDir}/static/css/"'';
-        description = ''
-          Location of the dir with <filename>main.css</filename> CSS file.
+        description = lib.mdDoc ''
+          Location of the dir with {file}`main.css` CSS file.
           By default, the one shipped with the package is used.
         '';
       };
@@ -71,68 +71,68 @@ let
       dataDir = mkOption {
         type = types.path;
         default = "/var/lib/blockbook-frontend-${name}";
-        description = "Location of blockbook-frontend-${name} data directory.";
+        description = lib.mdDoc "Location of blockbook-frontend-${name} data directory.";
       };
 
       debug = mkOption {
         type = types.bool;
         default = false;
-        description = "Debug mode, return more verbose errors, reload templates on each request.";
+        description = lib.mdDoc "Debug mode, return more verbose errors, reload templates on each request.";
       };
 
       internal = mkOption {
         type = types.nullOr types.str;
         default = ":9030";
-        description = "Internal http server binding <literal>[address]:port</literal>.";
+        description = lib.mdDoc "Internal http server binding `[address]:port`.";
       };
 
       messageQueueBinding = mkOption {
         type = types.str;
         default = "tcp://127.0.0.1:38330";
-        description = "Message Queue Binding <literal>address:port</literal>.";
+        description = lib.mdDoc "Message Queue Binding `address:port`.";
       };
 
       public = mkOption {
         type = types.nullOr types.str;
         default = ":9130";
-        description = "Public http server binding <literal>[address]:port</literal>.";
+        description = lib.mdDoc "Public http server binding `[address]:port`.";
       };
 
       rpc = {
         url = mkOption {
           type = types.str;
           default = "http://127.0.0.1";
-          description = "URL for JSON-RPC connections.";
+          description = lib.mdDoc "URL for JSON-RPC connections.";
         };
 
         port = mkOption {
           type = types.port;
           default = 8030;
-          description = "Port for JSON-RPC connections.";
+          description = lib.mdDoc "Port for JSON-RPC connections.";
         };
 
         user = mkOption {
           type = types.str;
           default = "rpc";
-          description = "Username for JSON-RPC connections.";
+          description = lib.mdDoc "Username for JSON-RPC connections.";
         };
 
         password = mkOption {
           type = types.str;
           default = "rpc";
-          description = ''
+          description = lib.mdDoc ''
             RPC password for JSON-RPC connections.
             Warning: this is stored in cleartext in the Nix store!!!
-            Use <literal>configFile</literal> or <literal>passwordFile</literal> if needed.
+            Use `configFile` or `passwordFile` if needed.
           '';
         };
 
         passwordFile = mkOption {
           type = types.nullOr types.path;
           default = null;
-          description = ''
+          description = lib.mdDoc ''
             File containing password of the RPC user.
-            Note: This options is ignored when <literal>configFile</literal> is used.
+            Note: This options is ignored when `configFile` is used.
           '';
         };
       };
@@ -140,7 +140,7 @@ let
       sync = mkOption {
         type = types.bool;
         default = true;
-        description = "Synchronizes until tip, if together with zeromq, keeps index synchronized.";
+        description = lib.mdDoc "Synchronizes until tip, if together with zeromq, keeps index synchronized.";
       };
 
       templateDir = mkOption {
@@ -148,7 +148,7 @@ let
         default = "${config.package}/share/templates/";
         defaultText = literalExpression ''"''${package}/share/templates/"'';
         example = literalExpression ''"''${dataDir}/templates/static/"'';
-        description = "Location of the HTML templates. By default, ones shipped with the package are used.";
+        description = lib.mdDoc "Location of the HTML templates. By default, ones shipped with the package are used.";
       };
 
       extraConfig = mkOption {
@@ -171,10 +171,10 @@ let
           "mempool_sub_workers" = 2;
           "block_addresses_to_keep" = 300;
         }'';
-        description = ''
-          Additional configurations to be appended to <filename>coin.conf</filename>.
+        description = lib.mdDoc ''
+          Additional configurations to be appended to {file}`coin.conf`.
           Overrides any already defined configuration options.
-          See <link xlink:href="https://github.com/trezor/blockbook/tree/master/configs/coins"/>
+          See <https://github.com/trezor/blockbook/tree/master/configs/coins>
           for current configuration options supported in master (Note: may differ from release).
         '';
       };
@@ -183,7 +183,7 @@ let
         type = types.listOf types.str;
         default = [];
         example = [ "-workers=1" "-dbcache=0" "-logtosderr" ];
-        description = ''
+        description = lib.mdDoc ''
           Extra command line options to pass to Blockbook.
           Run blockbook --help to list all available options.
         '';
@@ -198,7 +198,7 @@ in
     services.blockbook-frontend = mkOption {
       type = types.attrsOf (types.submodule blockbookOpts);
       default = {};
-      description = "Specification of one or more blockbook-frontend instances.";
+      description = lib.mdDoc "Specification of one or more blockbook-frontend instances.";
     };
   };
 
diff --git a/nixos/modules/services/networking/blocky.nix b/nixos/modules/services/networking/blocky.nix
index 7488e05fc033..42eab1459667 100644
--- a/nixos/modules/services/networking/blocky.nix
+++ b/nixos/modules/services/networking/blocky.nix
@@ -15,9 +15,9 @@ in
     settings = mkOption {
       type = format.type;
       default = { };
-      description = ''
+      description = lib.mdDoc ''
         Blocky configuration. Refer to
-        <link xlink:href="https://0xerr0r.github.io/blocky/configuration/"/>
+        <https://0xerr0r.github.io/blocky/configuration/>
         for details on supported values.
       '';
     };
diff --git a/nixos/modules/services/networking/charybdis.nix b/nixos/modules/services/networking/charybdis.nix
index ff09c0160cb6..c875557a1a38 100644
--- a/nixos/modules/services/networking/charybdis.nix
+++ b/nixos/modules/services/networking/charybdis.nix
@@ -22,7 +22,7 @@ in
 
       config = mkOption {
         type = types.str;
-        description = ''
+        description = lib.mdDoc ''
           Charybdis IRC daemon configuration file.
         '';
       };
@@ -30,7 +30,7 @@ in
       statedir = mkOption {
         type = types.path;
         default = "/var/lib/charybdis";
-        description = ''
+        description = lib.mdDoc ''
           Location of the state directory of charybdis.
         '';
       };
@@ -38,7 +38,7 @@ in
       user = mkOption {
         type = types.str;
         default = "ircd";
-        description = ''
+        description = lib.mdDoc ''
           Charybdis IRC daemon user.
         '';
       };
@@ -46,7 +46,7 @@ in
       group = mkOption {
         type = types.str;
         default = "ircd";
-        description = ''
+        description = lib.mdDoc ''
           Charybdis IRC daemon group.
         '';
       };
@@ -54,7 +54,7 @@ in
       motd = mkOption {
         type = types.nullOr types.lines;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Charybdis MOTD text.
 
           Charybdis will read its MOTD from /etc/charybdis/ircd.motd .
diff --git a/nixos/modules/services/networking/cjdns.nix b/nixos/modules/services/networking/cjdns.nix
index 0d97d379e907..5a19475161fd 100644
--- a/nixos/modules/services/networking/cjdns.nix
+++ b/nixos/modules/services/networking/cjdns.nix
@@ -13,27 +13,27 @@ let
   { options =
     { password = mkOption {
         type = types.str;
-        description = "Authorized password to the opposite end of the tunnel.";
+        description = lib.mdDoc "Authorized password to the opposite end of the tunnel.";
       };
       login = mkOption {
         default = "";
         type = types.str;
-        description = "(optional) name your peer has for you";
+        description = lib.mdDoc "(optional) name your peer has for you";
       };
       peerName = mkOption {
         default = "";
         type = types.str;
-        description = "(optional) human-readable name for peer";
+        description = lib.mdDoc "(optional) human-readable name for peer";
       };
       publicKey = mkOption {
         type = types.str;
-        description = "Public key at the opposite end of the tunnel.";
+        description = lib.mdDoc "Public key at the opposite end of the tunnel.";
       };
       hostname = mkOption {
         default = "";
         example = "foobar.hype";
         type = types.str;
-        description = "Optional hostname to add to /etc/hosts; prevents reverse lookup failures.";
+        description = lib.mdDoc "Optional hostname to add to /etc/hosts; prevents reverse lookup failures.";
       };
     };
   };
@@ -87,7 +87,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to enable the cjdns network encryption
           and routing engine. A file at /etc/cjdns.keys will
           be created if it does not exist to contain a random
@@ -99,7 +99,7 @@ in
         type = types.attrs;
         default = {};
         example = { router.interface.tunDevice = "tun10"; };
-        description = ''
+        description = lib.mdDoc ''
           Extra configuration, given as attrs, that will be merged recursively
           with the rest of the JSON generated by this module, at the root node.
         '';
@@ -109,7 +109,7 @@ in
         type = types.nullOr types.path;
         default = null;
         example = "/etc/cjdroute.conf";
-        description = ''
+        description = lib.mdDoc ''
           Ignore all other cjdns options and load configuration from this file.
         '';
       };
@@ -122,7 +122,7 @@ in
           "z9md3t4p45mfrjzdjurxn4wuj0d8swv"
           "49275fut6tmzu354pq70sr5b95qq0vj"
         ];
-        description = ''
+        description = lib.mdDoc ''
           Any remote cjdns nodes that offer these passwords on
           connection will be allowed to route through this node.
         '';
@@ -132,7 +132,7 @@ in
         bind = mkOption {
           type = types.str;
           default = "127.0.0.1:11234";
-          description = ''
+          description = lib.mdDoc ''
             Bind the administration port to this address and port.
           '';
         };
@@ -143,7 +143,7 @@ in
           type = types.str;
           default = "";
           example = "192.168.1.32:43211";
-          description = ''
+          description = lib.mdDoc ''
             Address and port to bind UDP tunnels to.
           '';
          };
@@ -159,7 +159,7 @@ in
               };
             }
           '';
-          description = ''
+          description = lib.mdDoc ''
             Credentials for making UDP tunnels.
           '';
         };
@@ -171,16 +171,16 @@ in
           default = "";
           example = "eth0";
           description =
-            ''
+            lib.mdDoc ''
               Bind to this device for native ethernet operation.
-              <literal>all</literal> is a pseudo-name which will try to connect to all devices.
+              `all` is a pseudo-name which will try to connect to all devices.
             '';
         };
 
         beacon = mkOption {
           type = types.int;
           default = 2;
-          description = ''
+          description = lib.mdDoc ''
             Auto-connect to other cjdns nodes on the same network.
             Options:
               0: Disabled.
@@ -206,7 +206,7 @@ in
               };
             }
           '';
-          description = ''
+          description = lib.mdDoc ''
             Credentials for connecting look similar to UDP credientials
             except they begin with the mac address.
           '';
@@ -216,9 +216,9 @@ in
       addExtraHosts = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to add cjdns peers with an associated hostname to
-          <filename>/etc/hosts</filename>.  Beware that enabling this
+          {file}`/etc/hosts`.  Beware that enabling this
           incurs heavy eval-time costs.
         '';
       };
diff --git a/nixos/modules/services/networking/cloudflare-dyndns.nix b/nixos/modules/services/networking/cloudflare-dyndns.nix
index ab5b1a08539a..5dd90cfe35ba 100644
--- a/nixos/modules/services/networking/cloudflare-dyndns.nix
+++ b/nixos/modules/services/networking/cloudflare-dyndns.nix
@@ -23,7 +23,7 @@ in
       domains = mkOption {
         type = types.listOf types.str;
         default = [ ];
-        description = ''
+        description = lib.mdDoc ''
           List of domain names to update records for.
         '';
       };
@@ -31,7 +31,7 @@ in
       proxied = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether this is a DNS-only record, or also being proxied through CloudFlare.
         '';
       };
@@ -39,7 +39,7 @@ in
       ipv4 = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Whether to enable setting IPv4 A records.
         '';
       };
@@ -47,7 +47,7 @@ in
       ipv6 = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to enable setting IPv6 AAAA records.
         '';
       };
@@ -55,7 +55,7 @@ in
       deleteMissing = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to delete the record when no IP address is found.
         '';
       };
diff --git a/nixos/modules/services/networking/cntlm.nix b/nixos/modules/services/networking/cntlm.nix
index eea28e12ce0e..2b5d0583c653 100644
--- a/nixos/modules/services/networking/cntlm.nix
+++ b/nixos/modules/services/networking/cntlm.nix
@@ -37,33 +37,33 @@ in
 
     username = mkOption {
       type = types.str;
-      description = ''
+      description = lib.mdDoc ''
         Proxy account name, without the possibility to include domain name ('at' sign is interpreted literally).
       '';
     };
 
     domain = mkOption {
       type = types.str;
-      description = "Proxy account domain/workgroup name.";
+      description = lib.mdDoc "Proxy account domain/workgroup name.";
     };
 
     password = mkOption {
       default = "/etc/cntlm.password";
       type = types.str;
-      description = "Proxy account password. Note: use chmod 0600 on /etc/cntlm.password for security.";
+      description = lib.mdDoc "Proxy account password. Note: use chmod 0600 on /etc/cntlm.password for security.";
     };
 
     netbios_hostname = mkOption {
       type = types.str;
       default = "";
-      description = ''
+      description = lib.mdDoc ''
         The hostname of your machine.
       '';
     };
 
     proxy = mkOption {
       type = types.listOf types.str;
-      description = ''
+      description = lib.mdDoc ''
         A list of NTLM/NTLMv2 authenticating HTTP proxies.
 
         Parent proxy, which requires authentication. The same as proxy on the command-line, can be used more than  once  to  specify  unlimited
@@ -74,7 +74,7 @@ in
     };
 
     noproxy = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         A list of domains where the proxy is skipped.
       '';
       default = [];
@@ -85,19 +85,19 @@ in
     port = mkOption {
       default = [3128];
       type = types.listOf types.port;
-      description = "Specifies on which ports the cntlm daemon listens.";
+      description = lib.mdDoc "Specifies on which ports the cntlm daemon listens.";
     };
 
     extraConfig = mkOption {
       type = types.lines;
       default = "";
-      description = "Additional config appended to the end of the generated <filename>cntlm.conf</filename>.";
+      description = lib.mdDoc "Additional config appended to the end of the generated {file}`cntlm.conf`.";
     };
 
     configText = mkOption {
        type = types.lines;
        default = "";
-       description = "Verbatim contents of <filename>cntlm.conf</filename>.";
+       description = lib.mdDoc "Verbatim contents of {file}`cntlm.conf`.";
     };
 
   };
diff --git a/nixos/modules/services/networking/connman.nix b/nixos/modules/services/networking/connman.nix
index 9945dc83a279..498991419579 100644
--- a/nixos/modules/services/networking/connman.nix
+++ b/nixos/modules/services/networking/connman.nix
@@ -27,7 +27,7 @@ in {
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to use ConnMan for managing your network connections.
         '';
       };
@@ -35,7 +35,7 @@ in {
       enableVPN = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Whether to enable ConnMan VPN service.
         '';
       };
@@ -43,7 +43,7 @@ in {
       extraConfig = mkOption {
         type = types.lines;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           Configuration lines appended to the generated connman configuration file.
         '';
       };
@@ -51,7 +51,7 @@ in {
       networkInterfaceBlacklist = mkOption {
         type = with types; listOf str;
         default = [ "vmnet" "vboxnet" "virbr" "ifb" "ve" ];
-        description = ''
+        description = lib.mdDoc ''
           Default blacklisted interfaces, this includes NixOS containers interfaces (ve).
         '';
       };
@@ -60,9 +60,9 @@ in {
         backend = mkOption {
           type = types.enum [ "wpa_supplicant" "iwd" ];
           default = "wpa_supplicant";
-          description = ''
+          description = lib.mdDoc ''
             Specify the Wi-Fi backend used.
-            Currently supported are <option>wpa_supplicant</option> or <option>iwd</option>.
+            Currently supported are {option}`wpa_supplicant` or {option}`iwd`.
           '';
         };
       };
@@ -71,14 +71,14 @@ in {
         type = with types; listOf str;
         default = [ ];
         example = [ "--nodnsproxy" ];
-        description = ''
+        description = lib.mdDoc ''
           Extra flags to pass to connmand
         '';
       };
 
       package = mkOption {
         type = types.package;
-        description = "The connman package / build flavor";
+        description = lib.mdDoc "The connman package / build flavor";
         default = connman;
         defaultText = literalExpression "pkgs.connman";
         example = literalExpression "pkgs.connmanFull";
diff --git a/nixos/modules/services/networking/consul.nix b/nixos/modules/services/networking/consul.nix
index cb53cc01f52d..16f1b5eec879 100644
--- a/nixos/modules/services/networking/consul.nix
+++ b/nixos/modules/services/networking/consul.nix
@@ -28,7 +28,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Enables the consul daemon.
         '';
       };
@@ -37,7 +37,7 @@ in
         type = types.package;
         default = pkgs.consul;
         defaultText = literalExpression "pkgs.consul";
-        description = ''
+        description = lib.mdDoc ''
           The package used for the Consul agent and CLI.
         '';
       };
@@ -46,7 +46,7 @@ in
       webUi = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Enables the web interface on the consul http port.
         '';
       };
@@ -54,7 +54,7 @@ in
       leaveOnStop = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           If enabled, causes a leave action to be sent when closing consul.
           This allows a clean termination of the node, but permanently removes
           it from the cluster. You probably don't want this option unless you
@@ -68,7 +68,7 @@ in
         advertise = mkOption {
           type = types.nullOr types.str;
           default = null;
-          description = ''
+          description = lib.mdDoc ''
             The name of the interface to pull the advertise_addr from.
           '';
         };
@@ -76,7 +76,7 @@ in
         bind = mkOption {
           type = types.nullOr types.str;
           default = null;
-          description = ''
+          description = lib.mdDoc ''
             The name of the interface to pull the bind_addr from.
           '';
         };
@@ -85,7 +85,7 @@ in
       forceAddrFamily = mkOption {
         type = types.enum [ "any" "ipv4" "ipv6" ];
         default = "any";
-        description = ''
+        description = lib.mdDoc ''
           Whether to bind ipv4/ipv6 or both kind of addresses.
         '';
       };
@@ -93,7 +93,7 @@ in
       forceIpv4 = mkOption {
         type = types.nullOr types.bool;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Deprecated: Use consul.forceAddrFamily instead.
           Whether we should force the interfaces to only pull ipv4 addresses.
         '';
@@ -102,7 +102,7 @@ in
       dropPrivileges = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Whether the consul agent should be run as a non-root consul user.
         '';
       };
@@ -110,7 +110,7 @@ in
       extraConfig = mkOption {
         default = { };
         type = types.attrsOf types.anything;
-        description = ''
+        description = lib.mdDoc ''
           Extra configuration options which are serialized to json and added
           to the config.json file.
         '';
@@ -119,7 +119,7 @@ in
       extraConfigFiles = mkOption {
         default = [ ];
         type = types.listOf types.str;
-        description = ''
+        description = lib.mdDoc ''
           Additional configuration files to pass to consul
           NOTE: These will not trigger the service to be restarted when altered.
         '';
@@ -129,32 +129,32 @@ in
         enable = mkEnableOption "consul-alerts";
 
         package = mkOption {
-          description = "Package to use for consul-alerts.";
+          description = lib.mdDoc "Package to use for consul-alerts.";
           default = pkgs.consul-alerts;
           defaultText = literalExpression "pkgs.consul-alerts";
           type = types.package;
         };
 
         listenAddr = mkOption {
-          description = "Api listening address.";
+          description = lib.mdDoc "Api listening address.";
           default = "localhost:9000";
           type = types.str;
         };
 
         consulAddr = mkOption {
-          description = "Consul api listening adddress";
+          description = lib.mdDoc "Consul api listening adddress";
           default = "localhost:8500";
           type = types.str;
         };
 
         watchChecks = mkOption {
-          description = "Whether to enable check watcher.";
+          description = lib.mdDoc "Whether to enable check watcher.";
           default = true;
           type = types.bool;
         };
 
         watchEvents = mkOption {
-          description = "Whether to enable event watcher.";
+          description = lib.mdDoc "Whether to enable event watcher.";
           default = true;
           type = types.bool;
         };
diff --git a/nixos/modules/services/networking/coredns.nix b/nixos/modules/services/networking/coredns.nix
index 88615d8e610f..9a4140e9d58a 100644
--- a/nixos/modules/services/networking/coredns.nix
+++ b/nixos/modules/services/networking/coredns.nix
@@ -24,7 +24,7 @@ in {
       default = pkgs.coredns;
       defaultText = literalExpression "pkgs.coredns";
       type = types.package;
-      description = "Coredns package to use.";
+      description = lib.mdDoc "Coredns package to use.";
     };
   };
 
diff --git a/nixos/modules/services/networking/corerad.nix b/nixos/modules/services/networking/corerad.nix
index 9d79d5d7686b..88428eba5589 100644
--- a/nixos/modules/services/networking/corerad.nix
+++ b/nixos/modules/services/networking/corerad.nix
@@ -36,8 +36,8 @@ in {
           };
         }
       '';
-      description = ''
-        Configuration for CoreRAD, see <link xlink:href="https://github.com/mdlayher/corerad/blob/main/internal/config/reference.toml"/>
+      description = lib.mdDoc ''
+        Configuration for CoreRAD, see <https://github.com/mdlayher/corerad/blob/main/internal/config/reference.toml>
         for supported values. Ignored if configFile is set.
       '';
     };
@@ -45,14 +45,14 @@ in {
     configFile = mkOption {
       type = types.path;
       example = literalExpression ''"''${pkgs.corerad}/etc/corerad/corerad.toml"'';
-      description = "Path to CoreRAD TOML configuration file.";
+      description = lib.mdDoc "Path to CoreRAD TOML configuration file.";
     };
 
     package = mkOption {
       default = pkgs.corerad;
       defaultText = literalExpression "pkgs.corerad";
       type = types.package;
-      description = "CoreRAD package to use.";
+      description = lib.mdDoc "CoreRAD package to use.";
     };
   };
 
diff --git a/nixos/modules/services/networking/coturn.nix b/nixos/modules/services/networking/coturn.nix
index ce563c31136f..788c51aed6b0 100644
--- a/nixos/modules/services/networking/coturn.nix
+++ b/nixos/modules/services/networking/coturn.nix
@@ -44,7 +44,7 @@ in {
       listening-port = mkOption {
         type = types.int;
         default = 3478;
-        description = ''
+        description = lib.mdDoc ''
           TURN listener port for UDP and TCP.
           Note: actually, TLS and DTLS sessions can connect to the
           "plain" TCP and UDP port(s), too - if allowed by configuration.
@@ -53,7 +53,7 @@ in {
       tls-listening-port = mkOption {
         type = types.int;
         default = 5349;
-        description = ''
+        description = lib.mdDoc ''
           TURN listener port for TLS.
           Note: actually, "plain" TCP and UDP sessions can connect to the TLS and
           DTLS port(s), too - if allowed by configuration. The TURN server
@@ -69,7 +69,7 @@ in {
         type = types.int;
         default = cfg.listening-port + 1;
         defaultText = literalExpression "listening-port + 1";
-        description = ''
+        description = lib.mdDoc ''
           Alternative listening port for UDP and TCP listeners;
           default (or zero) value means "listening port plus one".
           This is needed for RFC 5780 support
@@ -84,7 +84,7 @@ in {
         type = types.int;
         default = cfg.tls-listening-port + 1;
         defaultText = literalExpression "tls-listening-port + 1";
-        description = ''
+        description = lib.mdDoc ''
           Alternative listening port for TLS and DTLS protocols.
         '';
       };
@@ -92,7 +92,7 @@ in {
         type = types.listOf types.str;
         default = [];
         example = [ "203.0.113.42" "2001:DB8::42" ];
-        description = ''
+        description = lib.mdDoc ''
           Listener IP addresses of relay server.
           If no IP(s) specified in the config file or in the command line options,
           then all IPv4 and IPv6 system IPs will be used for listening.
@@ -102,7 +102,7 @@ in {
         type = types.listOf types.str;
         default = [];
         example = [ "203.0.113.42" "2001:DB8::42" ];
-        description = ''
+        description = lib.mdDoc ''
           Relay address (the local IP address that will be used to relay the
           packets to the peer).
           Multiple relay addresses may be used.
@@ -118,28 +118,28 @@ in {
       min-port = mkOption {
         type = types.int;
         default = 49152;
-        description = ''
+        description = lib.mdDoc ''
           Lower bound of UDP relay endpoints
         '';
       };
       max-port = mkOption {
         type = types.int;
         default = 65535;
-        description = ''
+        description = lib.mdDoc ''
           Upper bound of UDP relay endpoints
         '';
       };
       lt-cred-mech = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Use long-term credential mechanism.
         '';
       };
       no-auth = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           This option is opposite to lt-cred-mech.
           (TURN Server with no-auth option allows anonymous access).
           If neither option is defined, and no users are defined,
@@ -151,7 +151,7 @@ in {
       use-auth-secret = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           TURN REST API flag.
           Flag that sets a special authorization option that is based upon authentication secret.
           This feature can be used with the long-term authentication mechanism, only.
@@ -175,7 +175,7 @@ in {
       static-auth-secret = mkOption {
         type = types.nullOr types.str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           'Static' authentication secret value (a string) for TURN REST API only.
           If not set, then the turn server
           will try to use the 'dynamic' value in turn_secret table
@@ -186,7 +186,7 @@ in {
       static-auth-secret-file = mkOption {
         type = types.nullOr types.str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Path to the file containing the static authentication secret.
         '';
       };
@@ -195,7 +195,7 @@ in {
         default = config.networking.hostName;
         defaultText = literalExpression "config.networking.hostName";
         example = "example.com";
-        description = ''
+        description = lib.mdDoc ''
           The default realm to be used for the users when no explicit
           origin/realm relationship was found in the database, or if the TURN
           server is not using any database (just the commands-line settings
@@ -207,7 +207,7 @@ in {
         type = types.nullOr types.str;
         default = null;
         example = "/var/lib/acme/example.com/fullchain.pem";
-        description = ''
+        description = lib.mdDoc ''
           Certificate file in PEM format.
         '';
       };
@@ -215,21 +215,21 @@ in {
         type = types.nullOr types.str;
         default = null;
         example = "/var/lib/acme/example.com/key.pem";
-        description = ''
+        description = lib.mdDoc ''
           Private key file in PEM format.
         '';
       };
       dh-file = mkOption {
         type = types.nullOr types.str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Use custom DH TLS key, stored in PEM format in the file.
         '';
       };
       secure-stun = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Require authentication of the STUN Binding request.
           By default, the clients are allowed anonymous access to the STUN Binding functionality.
         '';
@@ -237,28 +237,28 @@ in {
       no-cli = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Turn OFF the CLI support.
         '';
       };
       cli-ip = mkOption {
         type = types.str;
         default = "127.0.0.1";
-        description = ''
+        description = lib.mdDoc ''
           Local system IP address to be used for CLI server endpoint.
         '';
       };
       cli-port = mkOption {
         type = types.int;
         default = 5766;
-        description = ''
+        description = lib.mdDoc ''
           CLI server port.
         '';
       };
       cli-password = mkOption {
         type = types.nullOr types.str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           CLI access password.
           For the security reasons, it is recommended to use the encrypted
           for of the password (see the -P command in the turnadmin utility).
@@ -267,37 +267,37 @@ in {
       no-udp = mkOption {
         type = types.bool;
         default = false;
-        description = "Disable UDP client listener";
+        description = lib.mdDoc "Disable UDP client listener";
       };
       no-tcp = mkOption {
         type = types.bool;
         default = false;
-        description = "Disable TCP client listener";
+        description = lib.mdDoc "Disable TCP client listener";
       };
       no-tls = mkOption {
         type = types.bool;
         default = false;
-        description = "Disable TLS client listener";
+        description = lib.mdDoc "Disable TLS client listener";
       };
       no-dtls = mkOption {
         type = types.bool;
         default = false;
-        description = "Disable DTLS client listener";
+        description = lib.mdDoc "Disable DTLS client listener";
       };
       no-udp-relay = mkOption {
         type = types.bool;
         default = false;
-        description = "Disable UDP relay endpoints";
+        description = lib.mdDoc "Disable UDP relay endpoints";
       };
       no-tcp-relay = mkOption {
         type = types.bool;
         default = false;
-        description = "Disable TCP relay endpoints";
+        description = lib.mdDoc "Disable TCP relay endpoints";
       };
       extraConfig = mkOption {
         type = types.lines;
         default = "";
-        description = "Additional configuration options";
+        description = lib.mdDoc "Additional configuration options";
       };
     };
   };
diff --git a/nixos/modules/services/networking/croc.nix b/nixos/modules/services/networking/croc.nix
index d044979e10df..82035856733c 100644
--- a/nixos/modules/services/networking/croc.nix
+++ b/nixos/modules/services/networking/croc.nix
@@ -10,12 +10,12 @@ in
     ports = lib.mkOption {
       type = with types; listOf port;
       default = [9009 9010 9011 9012 9013];
-      description = "Ports of the relay.";
+      description = lib.mdDoc "Ports of the relay.";
     };
     pass = lib.mkOption {
       type = with types; either path str;
       default = "pass123";
-      description = "Password or passwordfile for the relay.";
+      description = lib.mdDoc "Password or passwordfile for the relay.";
     };
     openFirewall = lib.mkEnableOption "opening of the peer port(s) in the firewall";
     debug = lib.mkEnableOption "debug logs";
diff --git a/nixos/modules/services/networking/dante.nix b/nixos/modules/services/networking/dante.nix
index 20d4faa1cdb1..5ddbee88609b 100644
--- a/nixos/modules/services/networking/dante.nix
+++ b/nixos/modules/services/networking/dante.nix
@@ -23,7 +23,7 @@ in
 
       config = mkOption {
         type        = types.lines;
-        description = ''
+        description = lib.mdDoc ''
           Contents of Dante's configuration file.
           NOTE: user.privileged, user.unprivileged and logoutput are set by the service.
         '';
diff --git a/nixos/modules/services/networking/ddclient.nix b/nixos/modules/services/networking/ddclient.nix
index 43a50af8f9b5..a0e9405343ba 100644
--- a/nixos/modules/services/networking/ddclient.nix
+++ b/nixos/modules/services/networking/ddclient.nix
@@ -63,7 +63,7 @@ with lib;
       enable = mkOption {
         default = false;
         type = bool;
-        description = ''
+        description = lib.mdDoc ''
           Whether to synchronise your machine's IP address with a dynamic DNS provider (e.g. dyndns.org).
         '';
       };
@@ -72,7 +72,7 @@ with lib;
         type = package;
         default = pkgs.ddclient;
         defaultText = "pkgs.ddclient";
-        description = ''
+        description = lib.mdDoc ''
           The ddclient executable package run by the service.
         '';
       };
@@ -80,7 +80,7 @@ with lib;
       domains = mkOption {
         default = [ "" ];
         type = listOf str;
-        description = ''
+        description = lib.mdDoc ''
           Domain name(s) to synchronize.
         '';
       };
@@ -90,7 +90,7 @@ with lib;
         default = lib.optionalString (config.services.ddclient.protocol == "nsupdate") "${pkgs.bind.dnsutils}/bin/nsupdate";
         defaultText = "";
         type = str;
-        description = ''
+        description = lib.mdDoc ''
           User name.
         '';
       };
@@ -98,7 +98,7 @@ with lib;
       passwordFile = mkOption {
         default = null;
         type = nullOr str;
-        description = ''
+        description = lib.mdDoc ''
           A file containing the password or a TSIG key in named format when using the nsupdate protocol.
         '';
       };
@@ -106,16 +106,16 @@ with lib;
       interval = mkOption {
         default = "10min";
         type = str;
-        description = ''
+        description = lib.mdDoc ''
           The interval at which to run the check and update.
-          See <command>man 7 systemd.time</command> for the format.
+          See {command}`man 7 systemd.time` for the format.
         '';
       };
 
       configFile = mkOption {
         default = null;
         type = nullOr path;
-        description = ''
+        description = lib.mdDoc ''
           Path to configuration file.
           When set this overrides the generated configuration from module options.
         '';
@@ -125,7 +125,7 @@ with lib;
       protocol = mkOption {
         default = "dyndns2";
         type = str;
-        description = ''
+        description = lib.mdDoc ''
           Protocol to use with dynamic DNS provider (see https://sourceforge.net/p/ddclient/wiki/protocols).
         '';
       };
@@ -133,7 +133,7 @@ with lib;
       server = mkOption {
         default = "";
         type = str;
-        description = ''
+        description = lib.mdDoc ''
           Server address.
         '';
       };
@@ -141,7 +141,7 @@ with lib;
       ssl = mkOption {
         default = true;
         type = bool;
-        description = ''
+        description = lib.mdDoc ''
           Whether to use SSL/TLS to connect to dynamic DNS provider.
         '';
       };
@@ -149,7 +149,7 @@ with lib;
       ipv6 = mkOption {
         default = false;
         type = bool;
-        description = ''
+        description = lib.mdDoc ''
           Whether to use IPv6.
         '';
       };
@@ -158,7 +158,7 @@ with lib;
       quiet = mkOption {
         default = false;
         type = bool;
-        description = ''
+        description = lib.mdDoc ''
           Print no messages for unnecessary updates.
         '';
       };
@@ -166,7 +166,7 @@ with lib;
       script = mkOption {
         default = "";
         type = str;
-        description = ''
+        description = lib.mdDoc ''
           script as required by some providers.
         '';
       };
@@ -174,7 +174,7 @@ with lib;
       use = mkOption {
         default = "web, web=checkip.dyndns.com/, web-skip='Current IP Address: '";
         type = str;
-        description = ''
+        description = lib.mdDoc ''
           Method to determine the IP address to send to the dynamic DNS provider.
         '';
       };
@@ -182,7 +182,7 @@ with lib;
       verbose = mkOption {
         default = false;
         type = bool;
-        description = ''
+        description = lib.mdDoc ''
           Print verbose information.
         '';
       };
@@ -190,7 +190,7 @@ with lib;
       zone = mkOption {
         default = "";
         type = str;
-        description = ''
+        description = lib.mdDoc ''
           zone as required by some providers.
         '';
       };
@@ -198,7 +198,7 @@ with lib;
       extraConfig = mkOption {
         default = "";
         type = lines;
-        description = ''
+        description = lib.mdDoc ''
           Extra configuration. Contents will be added verbatim to the configuration file.
         '';
       };
diff --git a/nixos/modules/services/networking/dhcpcd.nix b/nixos/modules/services/networking/dhcpcd.nix
index a4c8608c31db..6b7ce828919c 100644
--- a/nixos/modules/services/networking/dhcpcd.nix
+++ b/nixos/modules/services/networking/dhcpcd.nix
@@ -103,7 +103,7 @@ in
     networking.dhcpcd.enable = mkOption {
       type = types.bool;
       default = true;
-      description = ''
+      description = lib.mdDoc ''
         Whether to enable dhcpcd for device configuration. This is mainly to
         explicitly disable dhcpcd (for example when using networkd).
       '';
@@ -112,7 +112,7 @@ in
     networking.dhcpcd.persistent = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
           Whenever to leave interfaces configured on dhcpcd daemon
           shutdown. Set to true if you have your root or store mounted
           over the network or this machine accepts SSH connections
@@ -124,7 +124,7 @@ in
     networking.dhcpcd.denyInterfaces = mkOption {
       type = types.listOf types.str;
       default = [];
-      description = ''
+      description = lib.mdDoc ''
          Disable the DHCP client for any interface whose name matches
          any of the shell glob patterns in this list. The purpose of
          this option is to blacklist virtual interfaces such as those
@@ -135,7 +135,7 @@ in
     networking.dhcpcd.allowInterfaces = mkOption {
       type = types.nullOr (types.listOf types.str);
       default = null;
-      description = ''
+      description = lib.mdDoc ''
          Enable the DHCP client for any interface whose name matches
          any of the shell glob patterns in this list. Any interface not
          explicitly matched by this pattern will be denied. This pattern only
@@ -146,7 +146,7 @@ in
     networking.dhcpcd.extraConfig = mkOption {
       type = types.lines;
       default = "";
-      description = ''
+      description = lib.mdDoc ''
          Literal string to append to the config file generated for dhcpcd.
       '';
     };
@@ -164,7 +164,7 @@ in
     networking.dhcpcd.wait = mkOption {
       type = types.enum [ "background" "any" "ipv4" "ipv6" "both" "if-carrier-up" ];
       default = "any";
-      description = ''
+      description = lib.mdDoc ''
         This option specifies when the dhcpcd service will fork to background.
         If set to "background", dhcpcd will fork to background immediately.
         If set to "ipv4" or "ipv6", dhcpcd will wait for the corresponding IP
diff --git a/nixos/modules/services/networking/dhcpd.nix b/nixos/modules/services/networking/dhcpd.nix
index 49950efc0a1b..0bd5e4ef5535 100644
--- a/nixos/modules/services/networking/dhcpd.nix
+++ b/nixos/modules/services/networking/dhcpd.nix
@@ -77,7 +77,7 @@ let
       hostName = mkOption {
         type = types.str;
         example = "foo";
-        description = ''
+        description = lib.mdDoc ''
           Hostname which is assigned statically to the machine.
         '';
       };
@@ -85,7 +85,7 @@ let
       ethernetAddress = mkOption {
         type = types.str;
         example = "00:16:76:9a:32:1d";
-        description = ''
+        description = lib.mdDoc ''
           MAC address of the machine.
         '';
       };
@@ -93,7 +93,7 @@ let
       ipAddress = mkOption {
         type = types.str;
         example = "192.168.1.10";
-        description = ''
+        description = lib.mdDoc ''
           IP address of the machine.
         '';
       };
@@ -106,7 +106,7 @@ let
     enable = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         Whether to enable the DHCPv${postfix} server.
       '';
     };
@@ -124,7 +124,7 @@ let
           range 192.168.1.100 192.168.1.200;
         }
       '';
-      description = ''
+      description = lib.mdDoc ''
         Extra text to be appended to the DHCP server configuration
         file. Currently, you almost certainly need to specify something
         there, such as the options specifying the subnet mask, DNS servers,
@@ -135,7 +135,7 @@ let
     extraFlags = mkOption {
       type = types.listOf types.str;
       default = [];
-      description = ''
+      description = lib.mdDoc ''
         Additional command line flags to be passed to the dhcpd daemon.
       '';
     };
@@ -143,7 +143,7 @@ let
     configFile = mkOption {
       type = types.nullOr types.path;
       default = null;
-      description = ''
+      description = lib.mdDoc ''
         The path of the DHCP server configuration file.  If no file
         is specified, a file is generated using the other options.
       '';
@@ -152,7 +152,7 @@ let
     interfaces = mkOption {
       type = types.listOf types.str;
       default = ["eth0"];
-      description = ''
+      description = lib.mdDoc ''
         The interfaces on which the DHCP server should listen.
       '';
     };
@@ -170,7 +170,7 @@ let
           ipAddress = "192.168.1.11";
         }
       ];
-      description = ''
+      description = lib.mdDoc ''
         A list mapping Ethernet addresses to IPv${postfix} addresses for the
         DHCP server.
       '';
@@ -179,7 +179,7 @@ let
     authoritative = mkOption {
       type = types.bool;
       default = true;
-      description = ''
+      description = lib.mdDoc ''
         Whether the DHCP server shall send DHCPNAK messages to misconfigured
         clients. If this is not done, clients may be unable to get a correct
         IP address after changing subnets until their old lease has expired.
diff --git a/nixos/modules/services/networking/dnscache.nix b/nixos/modules/services/networking/dnscache.nix
index 7452210de47f..eff13f69f470 100644
--- a/nixos/modules/services/networking/dnscache.nix
+++ b/nixos/modules/services/networking/dnscache.nix
@@ -38,26 +38,26 @@ in {
       enable = mkOption {
         default = false;
         type = types.bool;
-        description = "Whether to run the dnscache caching dns server.";
+        description = lib.mdDoc "Whether to run the dnscache caching dns server.";
       };
 
       ip = mkOption {
         default = "0.0.0.0";
         type = types.str;
-        description = "IP address on which to listen for connections.";
+        description = lib.mdDoc "IP address on which to listen for connections.";
       };
 
       clientIps = mkOption {
         default = [ "127.0.0.1" ];
         type = types.listOf types.str;
-        description = "Client IP addresses (or prefixes) from which to accept connections.";
+        description = lib.mdDoc "Client IP addresses (or prefixes) from which to accept connections.";
         example = ["192.168" "172.23.75.82"];
       };
 
       domainServers = mkOption {
         default = { };
         type = types.attrsOf (types.listOf types.str);
-        description = ''
+        description = lib.mdDoc ''
           Table of {hostname: server} pairs to use as authoritative servers for hosts (and subhosts).
           If entry for @ is not specified predefined list of root servers is used.
         '';
@@ -72,7 +72,7 @@ in {
       forwardOnly = mkOption {
         default = false;
         type = types.bool;
-        description = ''
+        description = lib.mdDoc ''
           Whether to treat root servers (for @) as caching
           servers, requesting addresses the same way a client does. This is
           needed if you want to use e.g. Google DNS as your upstream DNS.
diff --git a/nixos/modules/services/networking/dnscrypt-proxy2.nix b/nixos/modules/services/networking/dnscrypt-proxy2.nix
index 316e6e37f9da..ff7934101039 100644
--- a/nixos/modules/services/networking/dnscrypt-proxy2.nix
+++ b/nixos/modules/services/networking/dnscrypt-proxy2.nix
@@ -9,9 +9,9 @@ in
     enable = mkEnableOption "dnscrypt-proxy2";
 
     settings = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         Attrset that is converted and passed as TOML config file.
-        For available params, see: <link xlink:href="https://github.com/DNSCrypt/dnscrypt-proxy/blob/${pkgs.dnscrypt-proxy2.version}/dnscrypt-proxy/example-dnscrypt-proxy.toml"/>
+        For available params, see: <https://github.com/DNSCrypt/dnscrypt-proxy/blob/${pkgs.dnscrypt-proxy2.version}/dnscrypt-proxy/example-dnscrypt-proxy.toml>
       '';
       example = literalExpression ''
         {
@@ -28,8 +28,8 @@ in
     };
 
     upstreamDefaults = mkOption {
-      description = ''
-        Whether to base the config declared in <option>services.dnscrypt-proxy2.settings</option> on the upstream example config (<link xlink:href="https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml"/>)
+      description = lib.mdDoc ''
+        Whether to base the config declared in {option}`services.dnscrypt-proxy2.settings` on the upstream example config (<https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml>)
 
         Disable this if you want to declare your dnscrypt config from scratch.
       '';
@@ -38,8 +38,8 @@ in
     };
 
     configFile = mkOption {
-      description = ''
-        Path to TOML config file. See: <link xlink:href="https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml"/>
+      description = lib.mdDoc ''
+        Path to TOML config file. See: <https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml>
         If this option is set, it will override any configuration done in options.services.dnscrypt-proxy2.settings.
       '';
       example = "/etc/dnscrypt-proxy/dnscrypt-proxy.toml";
diff --git a/nixos/modules/services/networking/dnscrypt-wrapper.nix b/nixos/modules/services/networking/dnscrypt-wrapper.nix
index c2add170e9cc..5df1e8b51a52 100644
--- a/nixos/modules/services/networking/dnscrypt-wrapper.nix
+++ b/nixos/modules/services/networking/dnscrypt-wrapper.nix
@@ -129,7 +129,7 @@ in {
     address = mkOption {
       type = types.str;
       default = "127.0.0.1";
-      description = ''
+      description = lib.mdDoc ''
         The DNSCrypt wrapper will bind to this IP address.
       '';
     };
@@ -137,7 +137,7 @@ in {
     port = mkOption {
       type = types.int;
       default = 5353;
-      description = ''
+      description = lib.mdDoc ''
         The DNSCrypt wrapper will listen for DNS queries on this port.
       '';
     };
@@ -147,9 +147,9 @@ in {
       default = "2.dnscrypt-cert.${config.networking.hostName}";
       defaultText = literalExpression ''"2.dnscrypt-cert.''${config.networking.hostName}"'';
       example = "2.dnscrypt-cert.myresolver";
-      description = ''
+      description = lib.mdDoc ''
         The name that will be given to this DNSCrypt resolver.
-        Note: the resolver name must start with <literal>2.dnscrypt-cert.</literal>.
+        Note: the resolver name must start with `2.dnscrypt-cert.`.
       '';
     };
 
@@ -157,7 +157,7 @@ in {
       type = types.nullOr types.path;
       default = null;
       example = "/etc/secrets/public.key";
-      description = ''
+      description = lib.mdDoc ''
         The filepath to the provider public key. If not given a new
         provider key pair will be generated on the first run.
       '';
@@ -167,7 +167,7 @@ in {
       type = types.nullOr types.path;
       default = null;
       example = "/etc/secrets/secret.key";
-      description = ''
+      description = lib.mdDoc ''
         The filepath to the provider secret key. If not given a new
         provider key pair will be generated on the first run.
       '';
@@ -176,7 +176,7 @@ in {
     upstream.address = mkOption {
       type = types.str;
       default = "127.0.0.1";
-      description = ''
+      description = lib.mdDoc ''
         The IP address of the upstream DNS server DNSCrypt will "wrap".
       '';
     };
@@ -184,7 +184,7 @@ in {
     upstream.port = mkOption {
       type = types.int;
       default = 53;
-      description = ''
+      description = lib.mdDoc ''
         The port of the upstream DNS server DNSCrypt will "wrap".
       '';
     };
@@ -192,7 +192,7 @@ in {
     keys.expiration = mkOption {
       type = types.int;
       default = 30;
-      description = ''
+      description = lib.mdDoc ''
         The duration (in days) of the time-limited secret key.
         This will be automatically rotated before expiration.
       '';
@@ -201,7 +201,7 @@ in {
     keys.checkInterval = mkOption {
       type = types.int;
       default = 1440;
-      description = ''
+      description = lib.mdDoc ''
         The time interval (in minutes) between key expiration checks.
       '';
     };
diff --git a/nixos/modules/services/networking/dnsdist.nix b/nixos/modules/services/networking/dnsdist.nix
index c7c6a79864cb..44503248cf89 100644
--- a/nixos/modules/services/networking/dnsdist.nix
+++ b/nixos/modules/services/networking/dnsdist.nix
@@ -15,19 +15,19 @@ in {
 
       listenAddress = mkOption {
         type = types.str;
-        description = "Listen IP Address";
+        description = lib.mdDoc "Listen IP Address";
         default = "0.0.0.0";
       };
       listenPort = mkOption {
         type = types.int;
-        description = "Listen port";
+        description = lib.mdDoc "Listen port";
         default = 53;
       };
 
       extraConfig = mkOption {
         type = types.lines;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           Extra lines to be added verbatim to dnsdist.conf.
         '';
       };
diff --git a/nixos/modules/services/networking/dnsmasq.nix b/nixos/modules/services/networking/dnsmasq.nix
index 59a3ca2f28e3..cfc37b74b9a9 100644
--- a/nixos/modules/services/networking/dnsmasq.nix
+++ b/nixos/modules/services/networking/dnsmasq.nix
@@ -32,7 +32,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to run dnsmasq.
         '';
       };
@@ -40,7 +40,7 @@ in
       resolveLocalQueries = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Whether dnsmasq should resolve local queries (i.e. add 127.0.0.1 to
           /etc/resolv.conf).
         '';
@@ -50,7 +50,7 @@ in
         type = types.listOf types.str;
         default = [];
         example = [ "8.8.8.8" "8.8.4.4" ];
-        description = ''
+        description = lib.mdDoc ''
           The DNS servers which dnsmasq should query.
         '';
       };
@@ -58,7 +58,7 @@ in
       alwaysKeepRunning = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           If enabled, systemd will always respawn dnsmasq even if shut down manually. The default, disabled, will only restart it on error.
         '';
       };
@@ -66,9 +66,9 @@ in
       extraConfig = mkOption {
         type = types.lines;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           Extra configuration directives that should be added to
-          <literal>dnsmasq.conf</literal>.
+          `dnsmasq.conf`.
         '';
       };
 
diff --git a/nixos/modules/services/networking/doh-proxy-rust.nix b/nixos/modules/services/networking/doh-proxy-rust.nix
index efd492e23f8c..bfd88430d78c 100644
--- a/nixos/modules/services/networking/doh-proxy-rust.nix
+++ b/nixos/modules/services/networking/doh-proxy-rust.nix
@@ -16,9 +16,9 @@ in {
       type = types.listOf types.str;
       default = [];
       example = [ "--server-address=9.9.9.9:53" ];
-      description = ''
+      description = lib.mdDoc ''
         A list of command-line flags to pass to doh-proxy. For details on the
-        available options, see <link xlink:href="https://github.com/jedisct1/doh-server#usage"/>.
+        available options, see <https://github.com/jedisct1/doh-server#usage>.
       '';
     };
 
diff --git a/nixos/modules/services/networking/ejabberd.nix b/nixos/modules/services/networking/ejabberd.nix
index daf8d5c42475..3feafc3bb3bd 100644
--- a/nixos/modules/services/networking/ejabberd.nix
+++ b/nixos/modules/services/networking/ejabberd.nix
@@ -26,63 +26,63 @@ in {
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = "Whether to enable ejabberd server";
+        description = lib.mdDoc "Whether to enable ejabberd server";
       };
 
       package = mkOption {
         type = types.package;
         default = pkgs.ejabberd;
         defaultText = literalExpression "pkgs.ejabberd";
-        description = "ejabberd server package to use";
+        description = lib.mdDoc "ejabberd server package to use";
       };
 
       user = mkOption {
         type = types.str;
         default = "ejabberd";
-        description = "User under which ejabberd is ran";
+        description = lib.mdDoc "User under which ejabberd is ran";
       };
 
       group = mkOption {
         type = types.str;
         default = "ejabberd";
-        description = "Group under which ejabberd is ran";
+        description = lib.mdDoc "Group under which ejabberd is ran";
       };
 
       spoolDir = mkOption {
         type = types.path;
         default = "/var/lib/ejabberd";
-        description = "Location of the spooldir of ejabberd";
+        description = lib.mdDoc "Location of the spooldir of ejabberd";
       };
 
       logsDir = mkOption {
         type = types.path;
         default = "/var/log/ejabberd";
-        description = "Location of the logfile directory of ejabberd";
+        description = lib.mdDoc "Location of the logfile directory of ejabberd";
       };
 
       configFile = mkOption {
         type = types.nullOr types.path;
-        description = "Configuration file for ejabberd in YAML format";
+        description = lib.mdDoc "Configuration file for ejabberd in YAML format";
         default = null;
       };
 
       ctlConfig = mkOption {
         type = types.lines;
         default = "";
-        description = "Configuration of ejabberdctl";
+        description = lib.mdDoc "Configuration of ejabberdctl";
       };
 
       loadDumps = mkOption {
         type = types.listOf types.path;
         default = [];
-        description = "Configuration dumps that should be loaded on the first startup";
+        description = lib.mdDoc "Configuration dumps that should be loaded on the first startup";
         example = literalExpression "[ ./myejabberd.dump ]";
       };
 
       imagemagick = mkOption {
         type = types.bool;
         default = false;
-        description = "Add ImageMagick to server's path; allows for image thumbnailing";
+        description = lib.mdDoc "Add ImageMagick to server's path; allows for image thumbnailing";
       };
     };
 
diff --git a/nixos/modules/services/networking/envoy.nix b/nixos/modules/services/networking/envoy.nix
index b7f859c73d9d..6f3080d19e2b 100644
--- a/nixos/modules/services/networking/envoy.nix
+++ b/nixos/modules/services/networking/envoy.nix
@@ -39,7 +39,7 @@ in
           };
         }
       '';
-      description = ''
+      description = lib.mdDoc ''
         Specify the configuration for Envoy in Nix.
       '';
     };
diff --git a/nixos/modules/services/networking/epmd.nix b/nixos/modules/services/networking/epmd.nix
index 75d78476e578..534b80906211 100644
--- a/nixos/modules/services/networking/epmd.nix
+++ b/nixos/modules/services/networking/epmd.nix
@@ -11,7 +11,7 @@ in
     enable = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         Whether to enable socket activation for Erlang Port Mapper Daemon (epmd),
         which acts as a name server on all hosts involved in distributed
         Erlang computations.
@@ -21,7 +21,7 @@ in
       type = types.package;
       default = pkgs.erlang;
       defaultText = literalExpression "pkgs.erlang";
-      description = ''
+      description = lib.mdDoc ''
         The Erlang package to use to get epmd binary. That way you can re-use
         an Erlang runtime that is already installed for other purposes.
       '';
@@ -30,7 +30,7 @@ in
       {
         type = types.str;
         default = "[::]:4369";
-        description = ''
+        description = lib.mdDoc ''
           the listenStream used by the systemd socket.
           see https://www.freedesktop.org/software/systemd/man/systemd.socket.html#ListenStream= for more informations.
           use this to change the port epmd will run on.
diff --git a/nixos/modules/services/networking/ergo.nix b/nixos/modules/services/networking/ergo.nix
index 6e55a7cfff6c..0dbb862b8ecd 100644
--- a/nixos/modules/services/networking/ergo.nix
+++ b/nixos/modules/services/networking/ergo.nix
@@ -38,20 +38,20 @@ in {
       dataDir = mkOption {
         type = types.path;
         default = "/var/lib/ergo";
-        description = "The data directory for the Ergo node.";
+        description = lib.mdDoc "The data directory for the Ergo node.";
       };
 
       listen = {
         ip = mkOption {
           type = types.str;
           default = "0.0.0.0";
-          description = "IP address on which the Ergo node should listen.";
+          description = lib.mdDoc "IP address on which the Ergo node should listen.";
         };
 
         port = mkOption {
           type = types.port;
           default = 9006;
-          description = "Listen port for the Ergo node.";
+          description = lib.mdDoc "Listen port for the Ergo node.";
         };
       };
 
@@ -60,20 +60,20 @@ in {
         type = types.nullOr types.str;
         default = null;
         example = "324dcf027dd4a30a932c441f365a25e86b173defa4b8e58948253471b81b72cf";
-        description = "Hex-encoded Blake2b256 hash of an API key as a 64-chars long Base16 string.";
+        description = lib.mdDoc "Hex-encoded Blake2b256 hash of an API key as a 64-chars long Base16 string.";
        };
 
        listen = {
         ip = mkOption {
           type = types.str;
           default = "0.0.0.0";
-          description = "IP address that the Ergo node API should listen on if <option>api.keyHash</option> is defined.";
+          description = lib.mdDoc "IP address that the Ergo node API should listen on if {option}`api.keyHash` is defined.";
           };
 
         port = mkOption {
           type = types.port;
           default = 9052;
-          description = "Listen port for the API endpoint if <option>api.keyHash</option> is defined.";
+          description = lib.mdDoc "Listen port for the API endpoint if {option}`api.keyHash` is defined.";
         };
        };
       };
@@ -81,26 +81,26 @@ in {
       testnet = mkOption {
          type = types.bool;
          default = false;
-         description = "Connect to testnet network instead of the default mainnet.";
+         description = lib.mdDoc "Connect to testnet network instead of the default mainnet.";
       };
 
       user = mkOption {
         type = types.str;
         default = "ergo";
-        description = "The user as which to run the Ergo node.";
+        description = lib.mdDoc "The user as which to run the Ergo node.";
       };
 
       group = mkOption {
         type = types.str;
         default = cfg.user;
         defaultText = literalExpression "config.${opt.user}";
-        description = "The group as which to run the Ergo node.";
+        description = lib.mdDoc "The group as which to run the Ergo node.";
       };
 
       openFirewall = mkOption {
         type = types.bool;
         default = false;
-        description = "Open ports in the firewall for the Ergo node as well as the API.";
+        description = lib.mdDoc "Open ports in the firewall for the Ergo node as well as the API.";
       };
     };
   };
diff --git a/nixos/modules/services/networking/ergochat.nix b/nixos/modules/services/networking/ergochat.nix
index cfaf69fc6139..5e815a9eff20 100644
--- a/nixos/modules/services/networking/ergochat.nix
+++ b/nixos/modules/services/networking/ergochat.nix
@@ -9,7 +9,7 @@ in {
       openFilesLimit = lib.mkOption {
         type = lib.types.int;
         default = 1024;
-        description = ''
+        description = lib.mdDoc ''
           Maximum number of open files. Limits the clients and server connections.
         '';
       };
@@ -18,15 +18,15 @@ in {
         type = lib.types.path;
         default = (pkgs.formats.yaml {}).generate "ergo.conf" cfg.settings;
         defaultText = "generated config file from <literal>.settings</literal>";
-        description = ''
+        description = lib.mdDoc ''
           Path to configuration file.
-          Setting this will skip any configuration done via <literal>.settings</literal>
+          Setting this will skip any configuration done via `.settings`
         '';
       };
 
       settings = lib.mkOption {
         type = (pkgs.formats.yaml {}).type;
-        description = ''
+        description = lib.mdDoc ''
           Ergo IRC daemon configuration file.
           https://raw.githubusercontent.com/ergochat/ergo/master/default.yaml
         '';
diff --git a/nixos/modules/services/networking/eternal-terminal.nix b/nixos/modules/services/networking/eternal-terminal.nix
index 0dcf3d28f4e0..e90b6103a218 100644
--- a/nixos/modules/services/networking/eternal-terminal.nix
+++ b/nixos/modules/services/networking/eternal-terminal.nix
@@ -21,7 +21,7 @@ in
       port = mkOption {
         default = 2022;
         type = types.int;
-        description = ''
+        description = lib.mdDoc ''
           The port the server should listen on. Will use the server's default (2022) if not specified.
 
           Make sure to open this port in the firewall if necessary.
@@ -31,7 +31,7 @@ in
       verbosity = mkOption {
         default = 0;
         type = types.enum (lib.range 0 9);
-        description = ''
+        description = lib.mdDoc ''
           The verbosity level (0-9).
         '';
       };
@@ -39,7 +39,7 @@ in
       silent = mkOption {
         default = false;
         type = types.bool;
-        description = ''
+        description = lib.mdDoc ''
           If enabled, disables all logging.
         '';
       };
@@ -47,7 +47,7 @@ in
       logSize = mkOption {
         default = 20971520;
         type = types.int;
-        description = ''
+        description = lib.mdDoc ''
           The maximum log size.
         '';
       };
diff --git a/nixos/modules/services/networking/expressvpn.nix b/nixos/modules/services/networking/expressvpn.nix
index d8ae6528a4d4..30de6987d31f 100644
--- a/nixos/modules/services/networking/expressvpn.nix
+++ b/nixos/modules/services/networking/expressvpn.nix
@@ -5,7 +5,7 @@ with lib;
   options.services.expressvpn.enable = mkOption {
     type = types.bool;
     default = false;
-    description = ''
+    description = lib.mdDoc ''
       Enable the ExpressVPN daemon.
     '';
   };
diff --git a/nixos/modules/services/networking/fakeroute.nix b/nixos/modules/services/networking/fakeroute.nix
index 7916ad4098a7..ed6b1a3c4d26 100644
--- a/nixos/modules/services/networking/fakeroute.nix
+++ b/nixos/modules/services/networking/fakeroute.nix
@@ -19,7 +19,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to enable the fakeroute service.
         '';
       };
@@ -33,7 +33,7 @@ in
           "198.116.142.34"
           "63.199.8.242"
         ];
-        description = ''
+        description = lib.mdDoc ''
          Fake route that will appear after the real
          one to any host running a traceroute.
         '';
diff --git a/nixos/modules/services/networking/ferm.nix b/nixos/modules/services/networking/ferm.nix
index 8e03f30efc00..7faebcef6300 100644
--- a/nixos/modules/services/networking/ferm.nix
+++ b/nixos/modules/services/networking/ferm.nix
@@ -28,13 +28,13 @@ in {
         '';
       };
       config = mkOption {
-        description = "Verbatim ferm.conf configuration.";
+        description = lib.mdDoc "Verbatim ferm.conf configuration.";
         default = "";
         defaultText = literalDocBook "empty firewall, allows any traffic";
         type = types.lines;
       };
       package = mkOption {
-        description = "The ferm package.";
+        description = lib.mdDoc "The ferm package.";
         type = types.package;
         default = pkgs.ferm;
         defaultText = literalExpression "pkgs.ferm";
diff --git a/nixos/modules/services/networking/fireqos.nix b/nixos/modules/services/networking/fireqos.nix
index 0b34f0b6b8b4..5469bce58c60 100644
--- a/nixos/modules/services/networking/fireqos.nix
+++ b/nixos/modules/services/networking/fireqos.nix
@@ -28,7 +28,7 @@ in {
           class web commit 50kbit
             match tcp ports 80,443
       '';
-      description = ''
+      description = lib.mdDoc ''
         The FireQOS configuration goes here.
       '';
     };
diff --git a/nixos/modules/services/networking/firewall.nix b/nixos/modules/services/networking/firewall.nix
index c213a5516a49..48cb83e344ec 100644
--- a/nixos/modules/services/networking/firewall.nix
+++ b/nixos/modules/services/networking/firewall.nix
@@ -258,7 +258,7 @@ let
       apply = canonicalizePortList;
       example = [ 22 80 ];
       description =
-        ''
+        lib.mdDoc ''
           List of TCP ports on which incoming connections are
           accepted.
         '';
@@ -269,7 +269,7 @@ let
       default = [ ];
       example = [ { from = 8999; to = 9003; } ];
       description =
-        ''
+        lib.mdDoc ''
           A range of TCP ports on which incoming connections are
           accepted.
         '';
@@ -281,7 +281,7 @@ let
       apply = canonicalizePortList;
       example = [ 53 ];
       description =
-        ''
+        lib.mdDoc ''
           List of open UDP ports.
         '';
     };
@@ -291,7 +291,7 @@ let
       default = [ ];
       example = [ { from = 60000; to = 61000; } ];
       description =
-        ''
+        lib.mdDoc ''
           Range of open UDP ports.
         '';
     };
@@ -310,7 +310,7 @@ in
         type = types.bool;
         default = true;
         description =
-          ''
+          lib.mdDoc ''
             Whether to enable the firewall.  This is a simple stateful
             firewall that blocks connection attempts to unauthorised TCP
             or UDP ports on this machine.  It does not affect packet
@@ -324,7 +324,7 @@ in
         defaultText = literalExpression "pkgs.iptables";
         example = literalExpression "pkgs.iptables-legacy";
         description =
-          ''
+          lib.mdDoc ''
             The iptables package to use for running the firewall service."
           '';
       };
@@ -333,7 +333,7 @@ in
         type = types.bool;
         default = true;
         description =
-          ''
+          lib.mdDoc ''
             Whether to log rejected or dropped incoming connections.
             Note: The logs are found in the kernel logs, i.e. dmesg
             or journalctl -k.
@@ -344,7 +344,7 @@ in
         type = types.bool;
         default = false;
         description =
-          ''
+          lib.mdDoc ''
             Whether to log all rejected or dropped incoming packets.
             This tends to give a lot of log messages, so it's mostly
             useful for debugging.
@@ -357,8 +357,8 @@ in
         type = types.bool;
         default = true;
         description =
-          ''
-            If <option>networking.firewall.logRefusedPackets</option>
+          lib.mdDoc ''
+            If {option}`networking.firewall.logRefusedPackets`
             and this option are enabled, then only log packets
             specifically directed at this machine, i.e., not broadcasts
             or multicasts.
@@ -369,7 +369,7 @@ in
         type = types.bool;
         default = false;
         description =
-          ''
+          lib.mdDoc ''
             If set, refused packets are rejected rather than dropped
             (ignored).  This means that an ICMP "port unreachable" error
             message is sent back to the client (or a TCP RST packet in
@@ -383,7 +383,7 @@ in
         default = [ ];
         example = [ "enp0s2" ];
         description =
-          ''
+          lib.mdDoc ''
             Traffic coming in from these interfaces will be accepted
             unconditionally.  Traffic from the loopback (lo) interface
             will always be accepted.
@@ -394,7 +394,7 @@ in
         type = types.bool;
         default = true;
         description =
-          ''
+          lib.mdDoc ''
             Whether to respond to incoming ICMPv4 echo requests
             ("pings").  ICMPv6 pings are always allowed because the
             larger address space of IPv6 makes network scanning much
@@ -407,7 +407,7 @@ in
         default = null;
         example = "--limit 1/minute --limit-burst 5";
         description =
-          ''
+          lib.mdDoc ''
             If pings are allowed, this allows setting rate limits
             on them.  If non-null, this option should be in the form of
             flags like "--limit 1/minute --limit-burst 5"
@@ -420,7 +420,7 @@ in
         defaultText = literalDocBook "<literal>true</literal> if supported by the chosen kernel";
         example = "loose";
         description =
-          ''
+          lib.mdDoc ''
             Performs a reverse path filter test on a packet.  If a reply
             to the packet would not be sent via the same interface that
             the packet arrived on, it is refused.
@@ -440,7 +440,7 @@ in
         type = types.bool;
         default = false;
         description =
-          ''
+          lib.mdDoc ''
             Logs dropped packets failing the reverse path filter test if
             the option networking.firewall.checkReversePath is enabled.
           '';
@@ -451,7 +451,7 @@ in
         default = [ ];
         example = [ "ftp" "irc" "sane" "sip" "tftp" "amanda" "h323" "netbios_sn" "pptp" "snmp" ];
         description =
-          ''
+          lib.mdDoc ''
             List of connection-tracking helpers that are auto-loaded.
             The complete list of possible values is given in the example.
 
@@ -471,7 +471,7 @@ in
         type = types.bool;
         default = false;
         description =
-          ''
+          lib.mdDoc ''
             Whether to auto-load connection-tracking helpers.
             See the description at networking.firewall.connectionTrackingModules
 
@@ -484,7 +484,7 @@ in
         default = "";
         example = "iptables -A INPUT -p icmp -j ACCEPT";
         description =
-          ''
+          lib.mdDoc ''
             Additional shell commands executed as part of the firewall
             initialisation script.  These are executed just before the
             final "reject" firewall rule is added, so they can be used
@@ -497,7 +497,7 @@ in
         default = [ ];
         example = literalExpression "[ pkgs.ipset ]";
         description =
-          ''
+          lib.mdDoc ''
             Additional packages to be included in the environment of the system
             as well as the path of networking.firewall.extraCommands.
           '';
@@ -508,7 +508,7 @@ in
         default = "";
         example = "iptables -P INPUT ACCEPT";
         description =
-          ''
+          lib.mdDoc ''
             Additional shell commands executed as part of the firewall
             shutdown script.  These are executed just after the removal
             of the NixOS input rule, or if the service enters a failed
@@ -520,7 +520,7 @@ in
         default = { };
         type = with types; attrsOf (submodule [ { options = commonOptions; } ]);
         description =
-          ''
+          lib.mdDoc ''
             Interface-specific open ports.
           '';
       };
diff --git a/nixos/modules/services/networking/flannel.nix b/nixos/modules/services/networking/flannel.nix
index 4698c1f682c9..547b6e03949b 100644
--- a/nixos/modules/services/networking/flannel.nix
+++ b/nixos/modules/services/networking/flannel.nix
@@ -17,14 +17,14 @@ in {
     enable = mkEnableOption "flannel";
 
     package = mkOption {
-      description = "Package to use for flannel";
+      description = lib.mdDoc "Package to use for flannel";
       type = types.package;
       default = pkgs.flannel;
       defaultText = literalExpression "pkgs.flannel";
     };
 
     publicIp = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         IP accessible by other nodes for inter-host communication.
         Defaults to the IP of the interface being used for communication.
       '';
@@ -33,7 +33,7 @@ in {
     };
 
     iface = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         Interface to use (IP or name) for inter-host communication.
         Defaults to the interface for the default route on the machine.
       '';
@@ -43,38 +43,38 @@ in {
 
     etcd = {
       endpoints = mkOption {
-        description = "Etcd endpoints";
+        description = lib.mdDoc "Etcd endpoints";
         type = types.listOf types.str;
         default = ["http://127.0.0.1:2379"];
       };
 
       prefix = mkOption {
-        description = "Etcd key prefix";
+        description = lib.mdDoc "Etcd key prefix";
         type = types.str;
         default = "/coreos.com/network";
       };
 
       caFile = mkOption {
-        description = "Etcd certificate authority file";
+        description = lib.mdDoc "Etcd certificate authority file";
         type = types.nullOr types.path;
         default = null;
       };
 
       certFile = mkOption {
-        description = "Etcd cert file";
+        description = lib.mdDoc "Etcd cert file";
         type = types.nullOr types.path;
         default = null;
       };
 
       keyFile = mkOption {
-        description = "Etcd key file";
+        description = lib.mdDoc "Etcd key file";
         type = types.nullOr types.path;
         default = null;
       };
     };
 
     kubeconfig = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         Path to kubeconfig to use for storing flannel config using the
         Kubernetes API
       '';
@@ -88,7 +88,7 @@ in {
     };
 
     nodeName = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         Needed when running with Kubernetes as backend as this cannot be auto-detected";
       '';
       type = types.nullOr types.str;
@@ -100,13 +100,13 @@ in {
     };
 
     storageBackend = mkOption {
-      description = "Determines where flannel stores its configuration at runtime";
+      description = lib.mdDoc "Determines where flannel stores its configuration at runtime";
       type = types.enum ["etcd" "kubernetes"];
       default = "etcd";
     };
 
     subnetLen = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         The size of the subnet allocated to each host. Defaults to 24 (i.e. /24)
         unless the Network was configured to be smaller than a /24 in which case
         it is one less than the network.
@@ -116,7 +116,7 @@ in {
     };
 
     subnetMin = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         The beginning of IP range which the subnet allocation should start with.
         Defaults to the first subnet of Network.
       '';
@@ -125,7 +125,7 @@ in {
     };
 
     subnetMax = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         The end of IP range which the subnet allocation should start with.
         Defaults to the last subnet of Network.
       '';
@@ -134,7 +134,7 @@ in {
     };
 
     backend = mkOption {
-      description = "Type of backend to use and specific configurations for that backend.";
+      description = lib.mdDoc "Type of backend to use and specific configurations for that backend.";
       type = types.attrs;
       default = {
         Type = "vxlan";
diff --git a/nixos/modules/services/networking/freenet.nix b/nixos/modules/services/networking/freenet.nix
index 3da3ab0c7df4..e1737e820a51 100644
--- a/nixos/modules/services/networking/freenet.nix
+++ b/nixos/modules/services/networking/freenet.nix
@@ -22,13 +22,13 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = "Enable the Freenet daemon";
+        description = lib.mdDoc "Enable the Freenet daemon";
       };
 
       nice = mkOption {
         type = types.int;
         default = 10;
-        description = "Set the nice level for the Freenet daemon";
+        description = lib.mdDoc "Set the nice level for the Freenet daemon";
       };
 
     };
diff --git a/nixos/modules/services/networking/freeradius.nix b/nixos/modules/services/networking/freeradius.nix
index 7fa3a8fa17fa..6c6777c8a572 100644
--- a/nixos/modules/services/networking/freeradius.nix
+++ b/nixos/modules/services/networking/freeradius.nix
@@ -38,7 +38,7 @@ let
     configDir = mkOption {
       type = types.path;
       default = "/etc/raddb";
-      description = ''
+      description = lib.mdDoc ''
         The path of the freeradius server configuration directory.
       '';
     };
@@ -46,7 +46,7 @@ let
     debug = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         Whether to enable debug logging for freeradius (-xx
         option). This should not be left on, since it includes
         sensitive data such as passwords in the logs.
diff --git a/nixos/modules/services/networking/frr.nix b/nixos/modules/services/networking/frr.nix
index 98452123f030..71b66b71ee42 100644
--- a/nixos/modules/services/networking/frr.nix
+++ b/nixos/modules/services/networking/frr.nix
@@ -57,7 +57,7 @@ let
         type = types.nullOr types.path;
         default = null;
         example = "/etc/frr/${daemonName service}.conf";
-        description = ''
+        description = lib.mdDoc ''
           Configuration file to use for FRR ${daemonName service}.
           By default the NixOS generated files are used.
         '';
@@ -86,7 +86,7 @@ let
             };
           in
             examples.${service} or "";
-        description = ''
+        description = lib.mdDoc ''
           ${daemonName service} configuration statements.
         '';
       };
@@ -94,7 +94,7 @@ let
       vtyListenAddress = mkOption {
         type = types.str;
         default = "localhost";
-        description = ''
+        description = lib.mdDoc ''
           Address to bind to for the VTY interface.
         '';
       };
@@ -102,7 +102,7 @@ let
       vtyListenPort = mkOption {
         type = types.nullOr types.int;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           TCP Port to bind to for the VTY interface.
         '';
       };
@@ -110,7 +110,7 @@ let
       extraOptions = mkOption {
         type = types.listOf types.str;
         default = [];
-        description = ''
+        description = lib.mdDoc ''
           Extra options for the daemon.
         '';
       };
@@ -128,7 +128,7 @@ in
           enable = mkOption {
             type = types.bool;
             default = any isEnabled services;
-            description = ''
+            description = lib.mdDoc ''
               Whether to enable the Zebra routing manager.
 
               The Zebra routing manager is automatically enabled
diff --git a/nixos/modules/services/networking/gateone.nix b/nixos/modules/services/networking/gateone.nix
index e68f8a47d5c0..dc4a65f020d4 100644
--- a/nixos/modules/services/networking/gateone.nix
+++ b/nixos/modules/services/networking/gateone.nix
@@ -10,12 +10,12 @@ options = {
       pidDir = mkOption {
         default = "/run/gateone";
         type = types.path;
-        description = "Path of pid files for GateOne.";
+        description = lib.mdDoc "Path of pid files for GateOne.";
       };
       settingsDir = mkOption {
         default = "/var/lib/gateone";
         type = types.path;
-        description = "Path of configuration files for GateOne.";
+        description = lib.mdDoc "Path of configuration files for GateOne.";
       };
     };
 };
diff --git a/nixos/modules/services/networking/ghostunnel.nix b/nixos/modules/services/networking/ghostunnel.nix
index 7a62d378e2c6..6cac6a69b067 100644
--- a/nixos/modules/services/networking/ghostunnel.nix
+++ b/nixos/modules/services/networking/ghostunnel.nix
@@ -23,14 +23,14 @@ let
       options = {
 
         listen = mkOption {
-          description = ''
+          description = lib.mdDoc ''
             Address and port to listen on (can be HOST:PORT, unix:PATH).
           '';
           type = types.str;
         };
 
         target = mkOption {
-          description = ''
+          description = lib.mdDoc ''
             Address to forward connections to (can be HOST:PORT or unix:PATH).
           '';
           type = types.str;
@@ -76,7 +76,7 @@ let
         };
 
         disableAuthentication = mkOption {
-          description = ''
+          description = lib.mdDoc ''
             Disable client authentication, no client certificate will be required.
           '';
           type = types.bool;
@@ -84,7 +84,7 @@ let
         };
 
         allowAll = mkOption {
-          description = ''
+          description = lib.mdDoc ''
             If true, allow all clients, do not check client cert subject.
           '';
           type = types.bool;
@@ -92,7 +92,7 @@ let
         };
 
         allowCN = mkOption {
-          description = ''
+          description = lib.mdDoc ''
             Allow client if common name appears in the list.
           '';
           type = types.listOf types.str;
@@ -100,7 +100,7 @@ let
         };
 
         allowOU = mkOption {
-          description = ''
+          description = lib.mdDoc ''
             Allow client if organizational unit name appears in the list.
           '';
           type = types.listOf types.str;
@@ -108,7 +108,7 @@ let
         };
 
         allowDNS = mkOption {
-          description = ''
+          description = lib.mdDoc ''
             Allow client if DNS subject alternative name appears in the list.
           '';
           type = types.listOf types.str;
@@ -116,7 +116,7 @@ let
         };
 
         allowURI = mkOption {
-          description = ''
+          description = lib.mdDoc ''
             Allow client if URI subject alternative name appears in the list.
           '';
           type = types.listOf types.str;
@@ -130,7 +130,7 @@ let
         };
 
         unsafeTarget = mkOption {
-          description = ''
+          description = lib.mdDoc ''
             If set, does not limit target to localhost, 127.0.0.1, [::1], or UNIX sockets.
 
             This is meant to protect against accidental unencrypted traffic on
@@ -216,14 +216,14 @@ in
     services.ghostunnel.enable = mkEnableOption "ghostunnel";
 
     services.ghostunnel.package = mkOption {
-      description = "The ghostunnel package to use.";
+      description = lib.mdDoc "The ghostunnel package to use.";
       type = types.package;
       default = pkgs.ghostunnel;
       defaultText = literalExpression "pkgs.ghostunnel";
     };
 
     services.ghostunnel.servers = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         Server mode ghostunnels (TLS listener -> plain TCP/UNIX target)
       '';
       type = types.attrsOf (types.submodule module);
diff --git a/nixos/modules/services/networking/git-daemon.nix b/nixos/modules/services/networking/git-daemon.nix
index 6be72505c216..80b15eedbbd4 100644
--- a/nixos/modules/services/networking/git-daemon.nix
+++ b/nixos/modules/services/networking/git-daemon.nix
@@ -15,7 +15,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Enable Git daemon, which allows public hosting of git repositories
           without any access controls. This is mostly intended for read-only access.
 
@@ -31,7 +31,7 @@ in
         type = types.str;
         default = "";
         example = "/srv/git/";
-        description = ''
+        description = lib.mdDoc ''
           Remap all the path requests as relative to the given path. For example,
           if you set base-path to /srv/git, then if you later try to pull
           git://example.com/hello.git, Git daemon will interpret the path as /srv/git/hello.git.
@@ -41,7 +41,7 @@ in
       exportAll = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Publish all directories that look like Git repositories (have the objects
           and refs subdirectories), even if they do not have the git-daemon-export-ok file.
 
@@ -57,7 +57,7 @@ in
         type = types.listOf types.str;
         default = [];
         example = [ "/srv/git" "/home/user/git/repo2" ];
-        description = ''
+        description = lib.mdDoc ''
           A whitelist of paths of git repositories, or directories containing repositories
           all of which would be published. Paths must not end in "/".
 
@@ -70,31 +70,31 @@ in
         type = types.str;
         default = "";
         example = "example.com";
-        description = "Listen on a specific IP address or hostname.";
+        description = lib.mdDoc "Listen on a specific IP address or hostname.";
       };
 
       port = mkOption {
         type = types.port;
         default = 9418;
-        description = "Port to listen on.";
+        description = lib.mdDoc "Port to listen on.";
       };
 
       options = mkOption {
         type = types.str;
         default = "";
-        description = "Extra configuration options to be passed to Git daemon.";
+        description = lib.mdDoc "Extra configuration options to be passed to Git daemon.";
       };
 
       user = mkOption {
         type = types.str;
         default = "git";
-        description = "User under which Git daemon would be running.";
+        description = lib.mdDoc "User under which Git daemon would be running.";
       };
 
       group = mkOption {
         type = types.str;
         default = "git";
-        description = "Group under which Git daemon would be running.";
+        description = lib.mdDoc "Group under which Git daemon would be running.";
       };
 
     };
diff --git a/nixos/modules/services/networking/globalprotect-vpn.nix b/nixos/modules/services/networking/globalprotect-vpn.nix
index 976fdf2b962a..19d6e8bfac69 100644
--- a/nixos/modules/services/networking/globalprotect-vpn.nix
+++ b/nixos/modules/services/networking/globalprotect-vpn.nix
@@ -16,9 +16,9 @@ in
     enable = mkEnableOption "globalprotect";
 
     csdWrapper = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         A script that will produce a Host Integrity Protection (HIP) report,
-        as described at <link xlink:href="https://www.infradead.org/openconnect/hip.html" />
+        as described at <https://www.infradead.org/openconnect/hip.html>
       '';
       default = null;
       example = literalExpression ''"''${pkgs.openconnect}/libexec/openconnect/hipreport.sh"'';
diff --git a/nixos/modules/services/networking/gnunet.nix b/nixos/modules/services/networking/gnunet.nix
index 5c41967d279b..2ab9097e7f7d 100644
--- a/nixos/modules/services/networking/gnunet.nix
+++ b/nixos/modules/services/networking/gnunet.nix
@@ -47,7 +47,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to run the GNUnet daemon.  GNUnet is GNU's anonymous
           peer-to-peer communication and file sharing framework.
         '';
@@ -57,7 +57,7 @@ in
         quota = mkOption {
           type = types.int;
           default = 1024;
-          description = ''
+          description = lib.mdDoc ''
             Maximum file system usage (in MiB) for file sharing.
           '';
         };
@@ -67,7 +67,7 @@ in
         port = mkOption {
           type = types.port;
           default = 2086;  # assigned by IANA
-          description = ''
+          description = lib.mdDoc ''
             The UDP port for use by GNUnet.
           '';
         };
@@ -77,7 +77,7 @@ in
         port = mkOption {
           type = types.port;
           default = 2086;  # assigned by IANA
-          description = ''
+          description = lib.mdDoc ''
             The TCP port for use by GNUnet.
           '';
         };
@@ -87,7 +87,7 @@ in
         maxNetDownBandwidth = mkOption {
           type = types.int;
           default = 50000;
-          description = ''
+          description = lib.mdDoc ''
             Maximum bandwidth usage (in bits per second) for GNUnet
             when downloading data.
           '';
@@ -96,7 +96,7 @@ in
         maxNetUpBandwidth = mkOption {
           type = types.int;
           default = 50000;
-          description = ''
+          description = lib.mdDoc ''
             Maximum bandwidth usage (in bits per second) for GNUnet
             when downloading data.
           '';
@@ -105,7 +105,7 @@ in
         hardNetUpBandwidth = mkOption {
           type = types.int;
           default = 0;
-          description = ''
+          description = lib.mdDoc ''
             Hard bandwidth limit (in bits per second) when uploading
             data.
           '';
@@ -116,7 +116,7 @@ in
         type = types.package;
         default = pkgs.gnunet;
         defaultText = literalExpression "pkgs.gnunet";
-        description = "Overridable attribute of the gnunet package to use.";
+        description = lib.mdDoc "Overridable attribute of the gnunet package to use.";
         example = literalExpression "pkgs.gnunet_git";
       };
 
diff --git a/nixos/modules/services/networking/go-neb.nix b/nixos/modules/services/networking/go-neb.nix
index 765834fad83e..ffa7923d6fbe 100644
--- a/nixos/modules/services/networking/go-neb.nix
+++ b/nixos/modules/services/networking/go-neb.nix
@@ -13,7 +13,7 @@ in {
 
     bindAddress = mkOption {
       type = types.str;
-      description = "Port (and optionally address) to listen on.";
+      description = lib.mdDoc "Port (and optionally address) to listen on.";
       default = ":4050";
     };
 
@@ -21,25 +21,25 @@ in {
       type = types.nullOr types.path;
       default = null;
       example = "/run/keys/go-neb.env";
-      description = ''
+      description = lib.mdDoc ''
         Environment variables from this file will be interpolated into the
-        final config file using envsubst with this syntax: <literal>$ENVIRONMENT</literal>
-        or <literal>''${VARIABLE}</literal>.
-        The file should contain lines formatted as <literal>SECRET_VAR=SECRET_VALUE</literal>.
+        final config file using envsubst with this syntax: `$ENVIRONMENT`
+        or `''${VARIABLE}`.
+        The file should contain lines formatted as `SECRET_VAR=SECRET_VALUE`.
         This is useful to avoid putting secrets into the nix store.
       '';
     };
 
     baseUrl = mkOption {
       type = types.str;
-      description = "Public-facing endpoint that can receive webhooks.";
+      description = lib.mdDoc "Public-facing endpoint that can receive webhooks.";
     };
 
     config = mkOption {
       inherit (settingsFormat) type;
-      description = ''
-        Your <filename>config.yaml</filename> as a Nix attribute set.
-        See <link xlink:href="https://github.com/matrix-org/go-neb/blob/master/config.sample.yaml">config.sample.yaml</link>
+      description = lib.mdDoc ''
+        Your {file}`config.yaml` as a Nix attribute set.
+        See [config.sample.yaml](https://github.com/matrix-org/go-neb/blob/master/config.sample.yaml)
         for possible options.
       '';
     };
diff --git a/nixos/modules/services/networking/go-shadowsocks2.nix b/nixos/modules/services/networking/go-shadowsocks2.nix
index afbd7ea27c65..e3f99f68d61f 100644
--- a/nixos/modules/services/networking/go-shadowsocks2.nix
+++ b/nixos/modules/services/networking/go-shadowsocks2.nix
@@ -9,7 +9,7 @@ in {
 
     listenAddress = mkOption {
       type = types.str;
-      description = "Server listen address or URL";
+      description = lib.mdDoc "Server listen address or URL";
       example = "ss://AEAD_CHACHA20_POLY1305:your-password@:8488";
     };
   };
diff --git a/nixos/modules/services/networking/gobgpd.nix b/nixos/modules/services/networking/gobgpd.nix
index 29ef9a5cf1e3..f1e2095708f9 100644
--- a/nixos/modules/services/networking/gobgpd.nix
+++ b/nixos/modules/services/networking/gobgpd.nix
@@ -13,9 +13,9 @@ in {
     settings = mkOption {
       type = format.type;
       default = { };
-      description = ''
+      description = lib.mdDoc ''
         GoBGP configuration. Refer to
-        <link xlink:href="https://github.com/osrg/gobgp#documentation"/>
+        <https://github.com/osrg/gobgp#documentation>
         for details on supported values.
       '';
       example = literalExpression ''
diff --git a/nixos/modules/services/networking/gvpe.nix b/nixos/modules/services/networking/gvpe.nix
index 4fad37ba15ee..5ecf78d09efc 100644
--- a/nixos/modules/services/networking/gvpe.nix
+++ b/nixos/modules/services/networking/gvpe.nix
@@ -47,7 +47,7 @@ in
       nodename = mkOption {
         default = null;
         type = types.nullOr types.str;
-        description =''
+        description =lib.mdDoc ''
           GVPE node name
         '';
       };
@@ -68,7 +68,7 @@ in
           on alpha if-up = if-up-0
           on alpha pid-file = /var/gvpe/gvpe.pid
         '';
-        description = ''
+        description = lib.mdDoc ''
           GVPE config contents
         '';
       };
@@ -76,14 +76,14 @@ in
         default = null;
         type = types.nullOr types.path;
         example = "/root/my-gvpe-conf";
-        description = ''
+        description = lib.mdDoc ''
           GVPE config file, if already present
         '';
       };
       ipAddress = mkOption {
         default = null;
         type = types.nullOr types.str;
-        description = ''
+        description = lib.mdDoc ''
           IP address to assign to GVPE interface
         '';
       };
@@ -91,14 +91,14 @@ in
         default = null;
         type = types.nullOr types.str;
         example = "10.0.0.0/8";
-        description = ''
+        description = lib.mdDoc ''
           IP subnet assigned to GVPE network
         '';
       };
       customIFSetup = mkOption {
         default = "";
         type = types.lines;
-        description = ''
+        description = lib.mdDoc ''
           Additional commands to apply in ifup script
         '';
       };
diff --git a/nixos/modules/services/networking/hans.nix b/nixos/modules/services/networking/hans.nix
index 2639b4b68001..f74d602be933 100644
--- a/nixos/modules/services/networking/hans.nix
+++ b/nixos/modules/services/networking/hans.nix
@@ -41,21 +41,21 @@ in
             server = mkOption {
               type = types.str;
               default = "";
-              description = "IP address of server running hans";
+              description = lib.mdDoc "IP address of server running hans";
               example = "192.0.2.1";
             };
 
             extraConfig = mkOption {
               type = types.str;
               default = "";
-              description = "Additional command line parameters";
+              description = lib.mdDoc "Additional command line parameters";
               example = "-v";
             };
 
             passwordFile = mkOption {
               type = types.str;
               default = "";
-              description = "File that containts password";
+              description = lib.mdDoc "File that containts password";
             };
 
           };
@@ -66,33 +66,33 @@ in
         enable = mkOption {
           type = types.bool;
           default = false;
-          description = "enable hans server";
+          description = lib.mdDoc "enable hans server";
         };
 
         ip = mkOption {
           type = types.str;
           default = "";
-          description = "The assigned ip range";
+          description = lib.mdDoc "The assigned ip range";
           example = "198.51.100.0";
         };
 
         respondToSystemPings = mkOption {
           type = types.bool;
           default = false;
-          description = "Force hans respond to ordinary pings";
+          description = lib.mdDoc "Force hans respond to ordinary pings";
         };
 
         extraConfig = mkOption {
           type = types.str;
           default = "";
-          description = "Additional command line parameters";
+          description = lib.mdDoc "Additional command line parameters";
           example = "-v";
         };
 
         passwordFile = mkOption {
           type = types.str;
           default = "";
-          description = "File that containts password";
+          description = lib.mdDoc "File that containts password";
         };
       };
 
diff --git a/nixos/modules/services/networking/haproxy.nix b/nixos/modules/services/networking/haproxy.nix
index e9d72b35499d..e0b686434b6e 100644
--- a/nixos/modules/services/networking/haproxy.nix
+++ b/nixos/modules/services/networking/haproxy.nix
@@ -20,7 +20,7 @@ with lib;
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to enable HAProxy, the reliable, high performance TCP/HTTP
           load balancer.
         '';
@@ -29,21 +29,21 @@ with lib;
       user = mkOption {
         type = types.str;
         default = "haproxy";
-        description = "User account under which haproxy runs.";
+        description = lib.mdDoc "User account under which haproxy runs.";
       };
 
       group = mkOption {
         type = types.str;
         default = "haproxy";
-        description = "Group account under which haproxy runs.";
+        description = lib.mdDoc "Group account under which haproxy runs.";
       };
 
       config = mkOption {
         type = types.nullOr types.lines;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Contents of the HAProxy configuration file,
-          <filename>haproxy.conf</filename>.
+          {file}`haproxy.conf`.
         '';
       };
     };
diff --git a/nixos/modules/services/networking/headscale.nix b/nixos/modules/services/networking/headscale.nix
index 5b07beadb45f..527f56e01295 100644
--- a/nixos/modules/services/networking/headscale.nix
+++ b/nixos/modules/services/networking/headscale.nix
@@ -18,7 +18,7 @@ in
         type = types.package;
         default = pkgs.headscale;
         defaultText = literalExpression "pkgs.headscale";
-        description = ''
+        description = lib.mdDoc ''
           Which headscale package to use for the running server.
         '';
       };
@@ -52,7 +52,7 @@ in
       serverUrl = mkOption {
         type = types.str;
         default = "http://127.0.0.1:8080";
-        description = ''
+        description = lib.mdDoc ''
           The url clients will connect to.
         '';
         example = "https://myheadscale.example.com:443";
@@ -61,7 +61,7 @@ in
       address = mkOption {
         type = types.str;
         default = "127.0.0.1";
-        description = ''
+        description = lib.mdDoc ''
           Listening address of headscale.
         '';
         example = "0.0.0.0";
@@ -70,7 +70,7 @@ in
       port = mkOption {
         type = types.port;
         default = 8080;
-        description = ''
+        description = lib.mdDoc ''
           Listening port of headscale.
         '';
         example = 443;
@@ -79,7 +79,7 @@ in
       privateKeyFile = mkOption {
         type = types.path;
         default = "${dataDir}/private.key";
-        description = ''
+        description = lib.mdDoc ''
           Path to private key file, generated automatically if it does not exist.
         '';
       };
@@ -88,18 +88,18 @@ in
         urls = mkOption {
           type = types.listOf types.str;
           default = [ "https://controlplane.tailscale.com/derpmap/default" ];
-          description = ''
+          description = lib.mdDoc ''
             List of urls containing DERP maps.
-            See <link xlink:href="https://tailscale.com/blog/how-tailscale-works/">How Tailscale works</link> for more information on DERP maps.
+            See [How Tailscale works](https://tailscale.com/blog/how-tailscale-works/) for more information on DERP maps.
           '';
         };
 
         paths = mkOption {
           type = types.listOf types.path;
           default = [ ];
-          description = ''
+          description = lib.mdDoc ''
             List of file paths containing DERP maps.
-            See <link xlink:href="https://tailscale.com/blog/how-tailscale-works/">How Tailscale works</link> for more information on DERP maps.
+            See [How Tailscale works](https://tailscale.com/blog/how-tailscale-works/) for more information on DERP maps.
           '';
         };
 
@@ -107,7 +107,7 @@ in
         autoUpdate = mkOption {
           type = types.bool;
           default = true;
-          description = ''
+          description = lib.mdDoc ''
             Whether to automatically update DERP maps on a set frequency.
           '';
           example = false;
@@ -116,7 +116,7 @@ in
         updateFrequency = mkOption {
           type = types.str;
           default = "24h";
-          description = ''
+          description = lib.mdDoc ''
             Frequency to update DERP maps.
           '';
           example = "5m";
@@ -127,7 +127,7 @@ in
       ephemeralNodeInactivityTimeout = mkOption {
         type = types.str;
         default = "30m";
-        description = ''
+        description = lib.mdDoc ''
           Time before an inactive ephemeral node is deleted.
         '';
         example = "5m";
@@ -138,58 +138,58 @@ in
           type = types.enum [ "sqlite3" "postgres" ];
           example = "postgres";
           default = "sqlite3";
-          description = "Database engine to use.";
+          description = lib.mdDoc "Database engine to use.";
         };
 
         host = mkOption {
           type = types.nullOr types.str;
           default = null;
           example = "127.0.0.1";
-          description = "Database host address.";
+          description = lib.mdDoc "Database host address.";
         };
 
         port = mkOption {
           type = types.nullOr types.port;
           default = null;
           example = 3306;
-          description = "Database host port.";
+          description = lib.mdDoc "Database host port.";
         };
 
         name = mkOption {
           type = types.nullOr types.str;
           default = null;
           example = "headscale";
-          description = "Database name.";
+          description = lib.mdDoc "Database name.";
         };
 
         user = mkOption {
           type = types.nullOr types.str;
           default = null;
           example = "headscale";
-          description = "Database user.";
+          description = lib.mdDoc "Database user.";
         };
 
         passwordFile = mkOption {
           type = types.nullOr types.path;
           default = null;
           example = "/run/keys/headscale-dbpassword";
-          description = ''
+          description = lib.mdDoc ''
             A file containing the password corresponding to
-            <option>database.user</option>.
+            {option}`database.user`.
           '';
         };
 
         path = mkOption {
           type = types.nullOr types.str;
           default = "${dataDir}/db.sqlite";
-          description = "Path to the sqlite3 database file.";
+          description = lib.mdDoc "Path to the sqlite3 database file.";
         };
       };
 
       logLevel = mkOption {
         type = types.str;
         default = "info";
-        description = ''
+        description = lib.mdDoc ''
           headscale log level.
         '';
         example = "debug";
@@ -199,7 +199,7 @@ in
         nameservers = mkOption {
           type = types.listOf types.str;
           default = [ "1.1.1.1" ];
-          description = ''
+          description = lib.mdDoc ''
             List of nameservers to pass to Tailscale clients.
           '';
         };
@@ -207,7 +207,7 @@ in
         domains = mkOption {
           type = types.listOf types.str;
           default = [ ];
-          description = ''
+          description = lib.mdDoc ''
             Search domains to inject to Tailscale clients.
           '';
           example = [ "mydomain.internal" ];
@@ -226,12 +226,12 @@ in
         baseDomain = mkOption {
           type = types.str;
           default = "";
-          description = ''
+          description = lib.mdDoc ''
             Defines the base domain to create the hostnames for MagicDNS.
-            <option>baseDomain</option> must be a FQDNs, without the trailing dot.
+            {option}`baseDomain` must be a FQDNs, without the trailing dot.
             The FQDN of the hosts will be
-            <literal>hostname.namespace.base_domain</literal> (e.g.
-            <literal>myhost.mynamespace.example.com</literal>).
+            `hostname.namespace.base_domain` (e.g.
+            `myhost.mynamespace.example.com`).
           '';
         };
       };
@@ -240,7 +240,7 @@ in
         issuer = mkOption {
           type = types.str;
           default = "";
-          description = ''
+          description = lib.mdDoc ''
             URL to OpenID issuer.
           '';
           example = "https://openid.example.com";
@@ -249,7 +249,7 @@ in
         clientId = mkOption {
           type = types.str;
           default = "";
-          description = ''
+          description = lib.mdDoc ''
             OpenID Connect client ID.
           '';
         };
@@ -257,7 +257,7 @@ in
         clientSecretFile = mkOption {
           type = types.nullOr types.path;
           default = null;
-          description = ''
+          description = lib.mdDoc ''
             Path to OpenID Connect client secret file.
           '';
         };
@@ -265,7 +265,7 @@ in
         domainMap = mkOption {
           type = types.attrsOf types.str;
           default = { };
-          description = ''
+          description = lib.mdDoc ''
             Domain map is used to map incomming users (by their email) to
             a namespace. The key can be a string, or regex.
           '';
@@ -281,25 +281,25 @@ in
           hostname = mkOption {
             type = types.nullOr types.str;
             default = "";
-            description = ''
+            description = lib.mdDoc ''
               Domain name to request a TLS certificate for.
             '';
           };
           challengeType = mkOption {
             type = types.enum [ "TLS_ALPN-01" "HTTP-01" ];
             default = "HTTP-01";
-            description = ''
+            description = lib.mdDoc ''
               Type of ACME challenge to use, currently supported types:
-              <literal>HTTP-01</literal> or <literal>TLS_ALPN-01</literal>.
+              `HTTP-01` or `TLS_ALPN-01`.
             '';
           };
           httpListen = mkOption {
             type = types.nullOr types.str;
             default = ":http";
-            description = ''
+            description = lib.mdDoc ''
               When HTTP-01 challenge is chosen, letsencrypt must set up a
               verification endpoint, and it will be listening on:
-              <literal>:http = port 80</literal>.
+              `:http = port 80`.
             '';
           };
         };
@@ -307,14 +307,14 @@ in
         certFile = mkOption {
           type = types.nullOr types.path;
           default = null;
-          description = ''
+          description = lib.mdDoc ''
             Path to already created certificate.
           '';
         };
         keyFile = mkOption {
           type = types.nullOr types.path;
           default = null;
-          description = ''
+          description = lib.mdDoc ''
             Path to key for already created certificate.
           '';
         };
@@ -323,7 +323,7 @@ in
       aclPolicyFile = mkOption {
         type = types.nullOr types.path;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Path to a file containg ACL policies.
         '';
       };
@@ -331,10 +331,10 @@ in
       settings = mkOption {
         type = settingsFormat.type;
         default = { };
-        description = ''
-          Overrides to <filename>config.yaml</filename> as a Nix attribute set.
+        description = lib.mdDoc ''
+          Overrides to {file}`config.yaml` as a Nix attribute set.
           This option is ideal for overriding settings not exposed as Nix options.
-          Check the <link xlink:href="https://github.com/juanfont/headscale/blob/main/config-example.yaml">example config</link>
+          Check the [example config](https://github.com/juanfont/headscale/blob/main/config-example.yaml)
           for possible options.
         '';
       };
diff --git a/nixos/modules/services/networking/hostapd.nix b/nixos/modules/services/networking/hostapd.nix
index f719ff59cc7f..ec1a7a58b1e0 100644
--- a/nixos/modules/services/networking/hostapd.nix
+++ b/nixos/modules/services/networking/hostapd.nix
@@ -53,13 +53,13 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Enable putting a wireless interface into infrastructure mode,
           allowing other wireless devices to associate with the wireless
           interface and do wireless networking. A simple access point will
-          <option>enable hostapd.wpa</option>,
-          <option>hostapd.wpaPassphrase</option>, and
-          <option>hostapd.ssid</option>, as well as DHCP on the wireless
+          {option}`enable hostapd.wpa`,
+          {option}`hostapd.wpaPassphrase`, and
+          {option}`hostapd.ssid`, as well as DHCP on the wireless
           interface to provide IP addresses to the associated stations, and
           NAT (from the wireless interface to an upstream interface).
         '';
@@ -69,15 +69,15 @@ in
         default = "";
         example = "wlp2s0";
         type = types.str;
-        description = ''
-          The interfaces <command>hostapd</command> will use.
+        description = lib.mdDoc ''
+          The interfaces {command}`hostapd` will use.
         '';
       };
 
       noScan = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Do not scan for overlapping BSSs in HT40+/- mode.
           Caution: turning this on will violate regulatory requirements!
         '';
@@ -87,8 +87,8 @@ in
         default = "nl80211";
         example = "hostapd";
         type = types.str;
-        description = ''
-          Which driver <command>hostapd</command> will use.
+        description = lib.mdDoc ''
+          Which driver {command}`hostapd` will use.
           Most applications will probably use the default.
         '';
       };
@@ -97,13 +97,13 @@ in
         default = "nixos";
         example = "mySpecialSSID";
         type = types.str;
-        description = "SSID to be used in IEEE 802.11 management frames.";
+        description = lib.mdDoc "SSID to be used in IEEE 802.11 management frames.";
       };
 
       hwMode = mkOption {
         default = "g";
         type = types.enum [ "a" "b" "g" ];
-        description = ''
+        description = lib.mdDoc ''
           Operation mode.
           (a = IEEE 802.11a, b = IEEE 802.11b, g = IEEE 802.11g).
         '';
@@ -113,11 +113,11 @@ in
         default = 7;
         example = 11;
         type = types.int;
-        description = ''
+        description = lib.mdDoc ''
           Channel number (IEEE 802.11)
           Please note that some drivers do not use this value from
-          <command>hostapd</command> and the channel will need to be configured
-          separately with <command>iwconfig</command>.
+          {command}`hostapd` and the channel will need to be configured
+          separately with {command}`iwconfig`.
         '';
       };
 
@@ -125,15 +125,15 @@ in
         default = "wheel";
         example = "network";
         type = types.str;
-        description = ''
-          Members of this group can control <command>hostapd</command>.
+        description = lib.mdDoc ''
+          Members of this group can control {command}`hostapd`.
         '';
       };
 
       wpa = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Enable WPA (IEEE 802.11i/D3.0) to authenticate with the access point.
         '';
       };
@@ -142,7 +142,7 @@ in
         default = "my_sekret";
         example = "any_64_char_string";
         type = types.str;
-        description = ''
+        description = lib.mdDoc ''
           WPA-PSK (pre-shared-key) passphrase. Clients will need this
           passphrase to associate with this access point.
           Warning: This passphrase will get put into a world-readable file in
@@ -153,7 +153,7 @@ in
       logLevel = mkOption {
         default = 2;
         type = types.int;
-        description = ''
+        description = lib.mdDoc ''
           Levels (minimum value for logged events):
           0 = verbose debugging
           1 = debugging
@@ -167,7 +167,7 @@ in
         default = null;
         example = "US";
         type = with types; nullOr str;
-        description = ''
+        description = lib.mdDoc ''
           Country code (ISO/IEC 3166-1). Used to set regulatory domain.
           Set as needed to indicate country in which device is operating.
           This can limit available channels and transmit power.
@@ -187,7 +187,7 @@ in
           ht_capab=[HT40-][SHORT-GI-40][DSSS_CCK-40]
           '';
         type = types.lines;
-        description = "Extra configuration options to put in hostapd.conf.";
+        description = lib.mdDoc "Extra configuration options to put in hostapd.conf.";
       };
     };
   };
diff --git a/nixos/modules/services/networking/htpdate.nix b/nixos/modules/services/networking/htpdate.nix
index 6954e5b060c4..8b9bb2888dac 100644
--- a/nixos/modules/services/networking/htpdate.nix
+++ b/nixos/modules/services/networking/htpdate.nix
@@ -19,7 +19,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Enable htpdate daemon.
         '';
       };
@@ -27,7 +27,7 @@ in
       extraOptions = mkOption {
         type = types.str;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           Additional command line arguments to pass to htpdate.
         '';
       };
@@ -35,7 +35,7 @@ in
       servers = mkOption {
         type = types.listOf types.str;
         default = [ "www.google.com" ];
-        description = ''
+        description = lib.mdDoc ''
           HTTP servers to use for time synchronization.
         '';
       };
@@ -44,7 +44,7 @@ in
         type = types.str;
         default = "";
         example = "127.0.0.1:8118";
-        description = ''
+        description = lib.mdDoc ''
           HTTP proxy used for requests.
         '';
       };
diff --git a/nixos/modules/services/networking/https-dns-proxy.nix b/nixos/modules/services/networking/https-dns-proxy.nix
index 85d6c362b466..4b6e302e445f 100644
--- a/nixos/modules/services/networking/https-dns-proxy.nix
+++ b/nixos/modules/services/networking/https-dns-proxy.nix
@@ -45,20 +45,20 @@ in
     enable = mkEnableOption "https-dns-proxy daemon";
 
     address = mkOption {
-      description = "The address on which to listen";
+      description = lib.mdDoc "The address on which to listen";
       type = types.str;
       default = "127.0.0.1";
     };
 
     port = mkOption {
-      description = "The port on which to listen";
+      description = lib.mdDoc "The port on which to listen";
       type = types.port;
       default = 5053;
     };
 
     provider = {
       kind = mkOption {
-        description = ''
+        description = lib.mdDoc ''
           The upstream provider to use or custom in case you do not trust any of
           the predefined providers or just want to use your own.
 
@@ -74,18 +74,18 @@ in
       };
 
       ips = mkOption {
-        description = "The custom provider IPs";
+        description = lib.mdDoc "The custom provider IPs";
         type = types.listOf types.str;
       };
 
       url = mkOption {
-        description = "The custom provider URL";
+        description = lib.mdDoc "The custom provider URL";
         type = types.str;
       };
     };
 
     preferIPv4 = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         https_dns_proxy will by default use IPv6 and fail if it is not available.
         To play it safe, we choose IPv4.
       '';
@@ -94,7 +94,7 @@ in
     };
 
     extraArgs = mkOption {
-      description = "Additional arguments to pass to the process.";
+      description = lib.mdDoc "Additional arguments to pass to the process.";
       type = types.listOf types.str;
       default = [ "-v" ];
     };
diff --git a/nixos/modules/services/networking/hylafax/options.nix b/nixos/modules/services/networking/hylafax/options.nix
index 8f621b61002f..bc289132a760 100644
--- a/nixos/modules/services/networking/hylafax/options.nix
+++ b/nixos/modules/services/networking/hylafax/options.nix
@@ -37,17 +37,17 @@ let
       name = mkOption {
         type = nonEmptyStr;
         example = "ttyS1";
-        description = ''
+        description = lib.mdDoc ''
           Name of modem device,
-          will be searched for in <filename>/dev</filename>.
+          will be searched for in {file}`/dev`.
         '';
       };
       type = mkOption {
         type = nonEmptyStr;
         example = "cirrus";
-        description = ''
+        description = lib.mdDoc ''
           Name of modem configuration file,
-          will be searched for in <filename>config</filename>
+          will be searched for in {file}`config`
           in the spooling area directory.
         '';
       };
@@ -59,11 +59,11 @@ let
           FAXNumber = "123456";
           LocalIdentifier = "LostInBerlin";
         };
-        description = ''
+        description = lib.mdDoc ''
           Attribute set of values for the given modem.
           ${commonDescr}
           Options defined here override options in
-          <option>commonModemConfig</option> for this modem.
+          {option}`commonModemConfig` for this modem.
         '';
       };
     };
@@ -124,9 +124,9 @@ in
       type = bool;
       default = true;
       example = false;
-      description = ''
+      description = lib.mdDoc ''
         Autostart the HylaFAX queue manager at system start.
-        If this is <literal>false</literal>, the queue manager
+        If this is `false`, the queue manager
         will still be started if there are pending
         jobs or if a user tries to connect to it.
       '';
@@ -136,34 +136,34 @@ in
       type = nullOr nonEmptyStr;
       default = null;
       example = "49";
-      description = "Country code for server and all modems.";
+      description = lib.mdDoc "Country code for server and all modems.";
     };
 
     areaCode = mkOption {
       type = nullOr nonEmptyStr;
       default = null;
       example = "30";
-      description = "Area code for server and all modems.";
+      description = lib.mdDoc "Area code for server and all modems.";
     };
 
     longDistancePrefix = mkOption {
       type = nullOr str;
       default = null;
       example = "0";
-      description = "Long distance prefix for server and all modems.";
+      description = lib.mdDoc "Long distance prefix for server and all modems.";
     };
 
     internationalPrefix = mkOption {
       type = nullOr str;
       default = null;
       example = "00";
-      description = "International prefix for server and all modems.";
+      description = lib.mdDoc "International prefix for server and all modems.";
     };
 
     spoolAreaPath = mkOption {
       type = path;
       default = "/var/spool/fax";
-      description = ''
+      description = lib.mdDoc ''
         The spooling area will be created/maintained
         at the location given here.
       '';
@@ -197,11 +197,11 @@ in
       type = path;
       example = literalExpression ''"''${pkgs.postfix}/bin/sendmail"'';
       # '' ;  # fix vim
-      description = ''
-        Path to <filename>sendmail</filename> program.
+      description = lib.mdDoc ''
+        Path to {file}`sendmail` program.
         The default uses the local sendmail wrapper
-        (see <option>config.services.mail.sendmailSetuidWrapper</option>),
-        otherwise the <filename>false</filename>
+        (see {option}`config.services.mail.sendmailSetuidWrapper`),
+        otherwise the {file}`false`
         binary to cause an error if used.
       '';
     };
@@ -209,9 +209,9 @@ in
     hfaxdConfig = mkOption {
       type = configAttrType;
       example.RecvqProtection = "0400";
-      description = ''
+      description = lib.mdDoc ''
         Attribute set of lines for the global
-        hfaxd config file <filename>etc/hfaxd.conf</filename>.
+        hfaxd config file {file}`etc/hfaxd.conf`.
         ${commonDescr}
       '';
     };
@@ -222,9 +222,9 @@ in
         InternationalPrefix = "00";
         LongDistancePrefix = "0";
       };
-      description = ''
+      description = lib.mdDoc ''
         Attribute set of lines for the global
-        faxq config file <filename>etc/config</filename>.
+        faxq config file {file}`etc/config`.
         ${commonDescr}
       '';
     };
@@ -254,7 +254,7 @@ in
           LocalIdentifier = "Smith";
         };
       };
-      description = ''
+      description = lib.mdDoc ''
         Description of installed modems.
         At least on modem must be defined
         to enable the HylaFAX server.
@@ -265,7 +265,7 @@ in
       type = lines;
       default = "";
       example = "chmod 0755 .  # everyone may read my faxes";
-      description = ''
+      description = lib.mdDoc ''
         Additional shell code that is executed within the
         spooling area directory right after its setup.
       '';
@@ -280,16 +280,16 @@ in
       type = nullOr nonEmptyStr;
       default = null;
       example = "daily";
-      description = ''
+      description = lib.mdDoc ''
         Purge old files from the spooling area with
-        <filename>faxcron</filename> with the given frequency
+        {file}`faxcron` with the given frequency
         (see systemd.time(7)).
       '';
     };
     faxcron.infoDays = mkOption {
       type = ints.positive;
       default = 30;
-      description = ''
+      description = lib.mdDoc ''
         Set the expiration time for data in the
         remote machine information directory in days.
       '';
@@ -297,7 +297,7 @@ in
     faxcron.logDays = mkOption {
       type = ints.positive;
       default = 30;
-      description = ''
+      description = lib.mdDoc ''
         Set the expiration time for
         session trace log files in days.
       '';
@@ -305,7 +305,7 @@ in
     faxcron.rcvDays = mkOption {
       type = ints.positive;
       default = 7;
-      description = ''
+      description = lib.mdDoc ''
         Set the expiration time for files in
         the received facsimile queue in days.
       '';
@@ -320,9 +320,9 @@ in
       type = nullOr nonEmptyStr;
       default = null;
       example = "daily";
-      description = ''
+      description = lib.mdDoc ''
         Purge old files from the spooling area with
-        <filename>faxcron</filename> with the given frequency
+        {file}`faxcron` with the given frequency
         (see systemd.time(7)).
       '';
     };
@@ -330,12 +330,12 @@ in
       type = enum [ "never" "as-flagged" "always" ];
       default = "as-flagged";
       example = "always";
-      description = ''
+      description = lib.mdDoc ''
         Enable or suppress job archiving:
-        <literal>never</literal> disables job archiving,
-        <literal>as-flagged</literal> archives jobs that
+        `never` disables job archiving,
+        `as-flagged` archives jobs that
         have been flagged for archiving by sendfax,
-        <literal>always</literal> forces archiving of all jobs.
+        `always` forces archiving of all jobs.
         See also sendfax(1) and faxqclean(8).
       '';
     };
@@ -343,7 +343,7 @@ in
       type = ints.positive;
       default = 15;
       example = literalExpression "24*60";
-      description = ''
+      description = lib.mdDoc ''
         Set the job
         age threshold (in minutes) that controls how long
         jobs may reside in the doneq directory.
@@ -353,7 +353,7 @@ in
       type = ints.positive;
       default = 60;
       example = literalExpression "24*60";
-      description = ''
+      description = lib.mdDoc ''
         Set the document
         age threshold (in minutes) that controls how long
         unreferenced files may reside in the docq directory.
diff --git a/nixos/modules/services/networking/i2pd.nix b/nixos/modules/services/networking/i2pd.nix
index 06f3420b8ff8..fb83778fcf7e 100644
--- a/nixos/modules/services/networking/i2pd.nix
+++ b/nixos/modules/services/networking/i2pd.nix
@@ -24,29 +24,29 @@ let
     name = mkOption {
       type = types.str;
       default = name;
-      description = "The endpoint name.";
+      description = lib.mdDoc "The endpoint name.";
     };
     address = mkOption {
       type = types.str;
       default = addr;
-      description = "Bind address for ${name} endpoint.";
+      description = lib.mdDoc "Bind address for ${name} endpoint.";
     };
     port = mkOption {
       type = types.port;
       default = port;
-      description = "Bind port for ${name} endpoint.";
+      description = lib.mdDoc "Bind port for ${name} endpoint.";
     };
   };
 
   i2cpOpts = name: {
     length = mkOption {
       type = types.int;
-      description = "Guaranteed minimum hops for ${name} tunnels.";
+      description = lib.mdDoc "Guaranteed minimum hops for ${name} tunnels.";
       default = 3;
     };
     quantity = mkOption {
       type = types.int;
-      description = "Number of simultaneous ${name} tunnels.";
+      description = lib.mdDoc "Number of simultaneous ${name} tunnels.";
       default = 5;
     };
   };
@@ -56,7 +56,7 @@ let
       keys = mkOption {
         type = with types; nullOr str;
         default = keyloc;
-        description = ''
+        description = lib.mdDoc ''
           File to persist ${lib.toUpper name} keys.
         '';
       };
@@ -64,12 +64,12 @@ let
       outbound = i2cpOpts name;
       latency.min = mkOption {
         type = with types; nullOr int;
-        description = "Min latency for tunnels.";
+        description = lib.mdDoc "Min latency for tunnels.";
         default = null;
       };
       latency.max = mkOption {
         type = with types; nullOr int;
-        description = "Max latency for tunnels.";
+        description = lib.mdDoc "Max latency for tunnels.";
         default = null;
       };
     };
@@ -79,17 +79,17 @@ let
     inbound = i2cpOpts name;
     crypto.tagsToSend = mkOption {
       type = types.int;
-      description = "Number of ElGamal/AES tags to send.";
+      description = lib.mdDoc "Number of ElGamal/AES tags to send.";
       default = 40;
     };
     destination = mkOption {
       type = types.str;
-      description = "Remote endpoint, I2P hostname or b32.i2p address.";
+      description = lib.mdDoc "Remote endpoint, I2P hostname or b32.i2p address.";
     };
     keys = mkOption {
       type = types.str;
       default = name + "-keys.dat";
-      description = "Keyset used for tunnel identity.";
+      description = lib.mdDoc "Keyset used for tunnel identity.";
     };
   } // mkEndpointOpt name "127.0.0.1" 0;
 
@@ -259,7 +259,7 @@ in
         type = types.package;
         default = pkgs.i2pd;
         defaultText = literalExpression "pkgs.i2pd";
-        description = ''
+        description = lib.mdDoc ''
           i2pd package to use.
         '';
       };
@@ -267,12 +267,12 @@ in
       logLevel = mkOption {
         type = types.enum ["debug" "info" "warn" "error"];
         default = "error";
-        description = ''
-          The log level. <command>i2pd</command> defaults to "info"
+        description = lib.mdDoc ''
+          The log level. {command}`i2pd` defaults to "info"
           but that generates copious amounts of log messages.
 
           We default to "error" which is similar to the default log
-          level of <command>tor</command>.
+          level of {command}`tor`.
         '';
       };
 
@@ -281,7 +281,7 @@ in
       address = mkOption {
         type = with types; nullOr str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Your external IP or hostname.
         '';
       };
@@ -289,7 +289,7 @@ in
       family = mkOption {
         type = with types; nullOr str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Specify a family the router belongs to.
         '';
       };
@@ -297,7 +297,7 @@ in
       dataDir = mkOption {
         type = with types; nullOr str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Alternative path to storage of i2pd data (RI, keys, peer profiles, ...)
         '';
       };
@@ -305,7 +305,7 @@ in
       share = mkOption {
         type = types.int;
         default = 100;
-        description = ''
+        description = lib.mdDoc ''
           Limit of transit traffic from max bandwidth in percents.
         '';
       };
@@ -313,7 +313,7 @@ in
       ifname = mkOption {
         type = with types; nullOr str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Network interface to bind to.
         '';
       };
@@ -321,7 +321,7 @@ in
       ifname4 = mkOption {
         type = with types; nullOr str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           IPv4 interface to bind to.
         '';
       };
@@ -329,7 +329,7 @@ in
       ifname6 = mkOption {
         type = with types; nullOr str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           IPv6 interface to bind to.
         '';
       };
@@ -337,7 +337,7 @@ in
       ntcpProxy = mkOption {
         type = with types; nullOr str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Proxy URL for NTCP transport.
         '';
       };
@@ -360,7 +360,7 @@ in
       netid = mkOption {
         type = types.int;
         default = 2;
-        description = ''
+        description = lib.mdDoc ''
           I2P overlay netid.
         '';
       };
@@ -368,16 +368,16 @@ in
       bandwidth = mkOption {
         type = with types; nullOr int;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
            Set a router bandwidth limit integer in KBps.
-           If not set, <command>i2pd</command> defaults to 32KBps.
+           If not set, {command}`i2pd` defaults to 32KBps.
         '';
       };
 
       port = mkOption {
         type = with types; nullOr int;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           I2P listen port. If no one is given the router will pick between 9111 and 30777.
         '';
       };
@@ -390,7 +390,7 @@ in
       upnp.name = mkOption {
         type = types.str;
         default = "I2Pd";
-        description = ''
+        description = lib.mdDoc ''
           Name i2pd appears in UPnP forwardings list.
         '';
       };
@@ -411,7 +411,7 @@ in
       reseed.file = mkOption {
         type = with types; nullOr str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Full path to SU3 file to reseed from.
         '';
       };
@@ -419,7 +419,7 @@ in
       reseed.urls = mkOption {
         type = with types; listOf str;
         default = [];
-        description = ''
+        description = lib.mdDoc ''
           Reseed URLs.
         '';
       };
@@ -427,7 +427,7 @@ in
       reseed.floodfill = mkOption {
         type = with types; nullOr str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Path to router info of floodfill to reseed from.
         '';
       };
@@ -435,7 +435,7 @@ in
       reseed.zipfile = mkOption {
         type = with types; nullOr str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Path to local .zip file to reseed from.
         '';
       };
@@ -443,7 +443,7 @@ in
       reseed.proxy = mkOption {
         type = with types; nullOr str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           URL for reseed proxy, supports http/socks.
         '';
       };
@@ -451,7 +451,7 @@ in
      addressbook.defaulturl = mkOption {
         type = types.str;
         default = "http://joajgazyztfssty4w2on5oaqksz6tqoxbduy553y34mf4byv6gpq.b32.i2p/export/alive-hosts.txt";
-        description = ''
+        description = lib.mdDoc ''
           AddressBook subscription URL for initial setup
         '';
       };
@@ -462,7 +462,7 @@ in
           "http://i2p-projekt.i2p/hosts.txt"
           "http://stats.i2p/cgi-bin/newhosts.txt"
         ];
-        description = ''
+        description = lib.mdDoc ''
           AddressBook subscription URLs
         '';
       };
@@ -472,7 +472,7 @@ in
       trust.family = mkOption {
         type = with types; nullOr str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Router Familiy to trust for first hops.
         '';
       };
@@ -480,7 +480,7 @@ in
       trust.routers = mkOption {
         type = with types; listOf str;
         default = [];
-        description = ''
+        description = lib.mdDoc ''
           Only connect to the listed routers.
         '';
       };
@@ -497,7 +497,7 @@ in
       ntcp2.port = mkOption {
         type = types.int;
         default = 0;
-        description = ''
+        description = lib.mdDoc ''
           Port to listen for incoming NTCP2 connections (0=auto).
         '';
       };
@@ -505,7 +505,7 @@ in
       limits.transittunnels = mkOption {
         type = types.int;
         default = 2500;
-        description = ''
+        description = lib.mdDoc ''
           Maximum number of active transit sessions.
         '';
       };
@@ -513,7 +513,7 @@ in
       limits.coreSize = mkOption {
         type = types.int;
         default = 0;
-        description = ''
+        description = lib.mdDoc ''
           Maximum size of corefile in Kb (0 - use system limit).
         '';
       };
@@ -521,7 +521,7 @@ in
       limits.openFiles = mkOption {
         type = types.int;
         default = 0;
-        description = ''
+        description = lib.mdDoc ''
           Maximum number of open files (0 - use system default).
         '';
       };
@@ -529,7 +529,7 @@ in
       limits.ntcpHard = mkOption {
         type = types.int;
         default = 0;
-        description = ''
+        description = lib.mdDoc ''
           Maximum number of active transit sessions.
         '';
       };
@@ -537,7 +537,7 @@ in
       limits.ntcpSoft = mkOption {
         type = types.int;
         default = 0;
-        description = ''
+        description = lib.mdDoc ''
           Threshold to start probabalistic backoff with ntcp sessions (default: use system limit).
         '';
       };
@@ -545,7 +545,7 @@ in
       limits.ntcpThreads = mkOption {
         type = types.int;
         default = 1;
-        description = ''
+        description = lib.mdDoc ''
           Maximum number of threads used by NTCP DH worker.
         '';
       };
@@ -555,7 +555,7 @@ in
       yggdrasil.address = mkOption {
         type = with types; nullOr str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Your local yggdrasil address. Specify it if you want to bind your router to a
           particular address.
         '';
@@ -568,7 +568,7 @@ in
         user = mkOption {
           type = types.str;
           default = "i2pd";
-          description = ''
+          description = lib.mdDoc ''
             Username for webconsole access
           '';
         };
@@ -576,7 +576,7 @@ in
         pass = mkOption {
           type = types.str;
           default = "i2pd";
-          description = ''
+          description = lib.mdDoc ''
             Password for webconsole access.
           '';
         };
@@ -584,7 +584,7 @@ in
         strictHeaders = mkOption {
           type = with types; nullOr bool;
           default = null;
-          description = ''
+          description = lib.mdDoc ''
             Enable strict host checking on WebUI.
           '';
         };
@@ -592,7 +592,7 @@ in
         hostname = mkOption {
           type = with types; nullOr str;
           default = null;
-          description = ''
+          description = lib.mdDoc ''
             Expected hostname for WebUI.
           '';
         };
@@ -603,7 +603,7 @@ in
         outproxy = mkOption {
           type = with types; nullOr str;
           default = null;
-          description = "Upstream outproxy bind address.";
+          description = lib.mdDoc "Upstream outproxy bind address.";
         };
       };
       proto.socksProxy = (mkKeyedEndpointOpt "socksproxy" "127.0.0.1" 4447 "socksproxy-keys.dat")
@@ -612,12 +612,12 @@ in
         outproxy = mkOption {
           type = types.str;
           default = "127.0.0.1";
-          description = "Upstream outproxy bind address.";
+          description = lib.mdDoc "Upstream outproxy bind address.";
         };
         outproxyPort = mkOption {
           type = types.int;
           default = 4444;
-          description = "Upstream outproxy bind port.";
+          description = lib.mdDoc "Upstream outproxy bind port.";
         };
       };
 
@@ -634,7 +634,7 @@ in
               destinationPort = mkOption {
                 type = with types; nullOr int;
                 default = null;
-                description = "Connect to particular port at destination.";
+                description = lib.mdDoc "Connect to particular port at destination.";
               };
             } // commonTunOpts name;
             config = {
@@ -642,7 +642,7 @@ in
             };
           }
         ));
-        description = ''
+        description = lib.mdDoc ''
           Connect to someone as a client and establish a local accept endpoint
         '';
       };
@@ -655,12 +655,12 @@ in
               inPort = mkOption {
                 type = types.int;
                 default = 0;
-                description = "Service port. Default to the tunnel's listen port.";
+                description = lib.mdDoc "Service port. Default to the tunnel's listen port.";
               };
               accessList = mkOption {
                 type = with types; listOf str;
                 default = [];
-                description = "I2P nodes that are allowed to connect to this service.";
+                description = lib.mdDoc "I2P nodes that are allowed to connect to this service.";
               };
             } // commonTunOpts name;
             config = {
@@ -668,7 +668,7 @@ in
             };
           }
         ));
-        description = ''
+        description = lib.mdDoc ''
           Serve something on I2P network at port and delegate requests to address inPort.
         '';
       };
diff --git a/nixos/modules/services/networking/icecream/daemon.nix b/nixos/modules/services/networking/icecream/daemon.nix
index 8593c94e34dc..f94832c4778b 100644
--- a/nixos/modules/services/networking/icecream/daemon.nix
+++ b/nixos/modules/services/networking/icecream/daemon.nix
@@ -16,14 +16,14 @@ in {
 
       openFirewall = mkOption {
         type = types.bool;
-        description = ''
+        description = lib.mdDoc ''
           Whether to automatically open receive port in the firewall.
         '';
       };
 
       openBroadcast = mkOption {
         type = types.bool;
-        description = ''
+        description = lib.mdDoc ''
           Whether to automatically open the firewall for scheduler discovery.
         '';
       };
@@ -31,7 +31,7 @@ in {
       cacheLimit = mkOption {
         type = types.ints.u16;
         default = 256;
-        description = ''
+        description = lib.mdDoc ''
           Maximum size in Megabytes of cache used to store compile environments of compile clients.
         '';
       };
@@ -39,7 +39,7 @@ in {
       netName = mkOption {
         type = types.str;
         default = "ICECREAM";
-        description = ''
+        description = lib.mdDoc ''
           Network name to connect to. A scheduler with the same name needs to be running.
         '';
       };
@@ -47,7 +47,7 @@ in {
       noRemote = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Prevent jobs from other nodes being scheduled on this daemon.
         '';
       };
@@ -55,7 +55,7 @@ in {
       schedulerHost = mkOption {
         type = types.nullOr types.str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Explicit scheduler hostname, useful in firewalled environments.
 
           Uses scheduler autodiscovery via broadcast if set to null.
@@ -65,7 +65,7 @@ in {
       maxProcesses = mkOption {
         type = types.nullOr types.ints.u16;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Maximum number of compile jobs started in parallel for this daemon.
 
           Uses the number of CPUs if set to null.
@@ -75,7 +75,7 @@ in {
       nice = mkOption {
         type = types.int;
         default = 5;
-        description = ''
+        description = lib.mdDoc ''
           The level of niceness to use.
         '';
       };
@@ -83,7 +83,7 @@ in {
       hostname = mkOption {
         type = types.nullOr types.str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Hostname of the daemon in the icecream infrastructure.
 
           Uses the hostname retrieved via uname if set to null.
@@ -93,7 +93,7 @@ in {
       user = mkOption {
         type = types.str;
         default = "icecc";
-        description = ''
+        description = lib.mdDoc ''
           User to run the icecream daemon as. Set to root to enable receive of
           remote compile environments.
         '';
@@ -103,13 +103,13 @@ in {
         default = pkgs.icecream;
         defaultText = literalExpression "pkgs.icecream";
         type = types.package;
-        description = "Icecream package to use.";
+        description = lib.mdDoc "Icecream package to use.";
       };
 
       extraArgs = mkOption {
         type = types.listOf types.str;
         default = [];
-        description = "Additional command line parameters.";
+        description = lib.mdDoc "Additional command line parameters.";
         example = [ "-v" ];
       };
     };
diff --git a/nixos/modules/services/networking/icecream/scheduler.nix b/nixos/modules/services/networking/icecream/scheduler.nix
index 14fbc966b989..51f3988fe584 100644
--- a/nixos/modules/services/networking/icecream/scheduler.nix
+++ b/nixos/modules/services/networking/icecream/scheduler.nix
@@ -16,7 +16,7 @@ in {
       netName = mkOption {
         type = types.nullOr types.str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Network name for the icecream scheduler.
 
           Uses the default ICECREAM if null.
@@ -26,14 +26,14 @@ in {
       port = mkOption {
         type = types.port;
         default = 8765;
-        description = ''
+        description = lib.mdDoc ''
           Server port to listen for icecream daemon requests.
         '';
       };
 
       openFirewall = mkOption {
         type = types.bool;
-        description = ''
+        description = lib.mdDoc ''
           Whether to automatically open the daemon port in the firewall.
         '';
       };
@@ -41,7 +41,7 @@ in {
       openTelnet = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to open the telnet TCP port on 8766.
         '';
       };
@@ -49,7 +49,7 @@ in {
       persistentClientConnection = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to prevent clients from connecting to a better scheduler.
         '';
       };
@@ -58,13 +58,13 @@ in {
         default = pkgs.icecream;
         defaultText = literalExpression "pkgs.icecream";
         type = types.package;
-        description = "Icecream package to use.";
+        description = lib.mdDoc "Icecream package to use.";
       };
 
       extraArgs = mkOption {
         type = types.listOf types.str;
         default = [];
-        description = "Additional command line parameters";
+        description = lib.mdDoc "Additional command line parameters";
         example = [ "-v" ];
       };
     };
diff --git a/nixos/modules/services/networking/inspircd.nix b/nixos/modules/services/networking/inspircd.nix
index 81c367ec8f7d..f2464b9a11fa 100644
--- a/nixos/modules/services/networking/inspircd.nix
+++ b/nixos/modules/services/networking/inspircd.nix
@@ -19,10 +19,10 @@ in {
         default = pkgs.inspircd;
         defaultText = lib.literalExpression "pkgs.inspircd";
         example = lib.literalExpression "pkgs.inspircdMinimal";
-        description = ''
+        description = lib.mdDoc ''
           The InspIRCd package to use. This is mainly useful
           to specify an overridden version of the
-          <literal>pkgs.inspircd</literal> dervivation, for
+          `pkgs.inspircd` dervivation, for
           example if you want to use a more minimal InspIRCd
           distribution with less modules enabled or with
           modules enabled which can't be distributed in binary
@@ -32,13 +32,13 @@ in {
 
       config = lib.mkOption {
         type = lib.types.lines;
-        description = ''
-          Verbatim <literal>inspircd.conf</literal> file.
+        description = lib.mdDoc ''
+          Verbatim `inspircd.conf` file.
           For a list of options, consult the
-          <link xlink:href="https://docs.inspircd.org/3/configuration/">InspIRCd documentation</link>, the
-          <link xlink:href="https://docs.inspircd.org/3/modules/">Module documentation</link>
+          [InspIRCd documentation](https://docs.inspircd.org/3/configuration/), the
+          [Module documentation](https://docs.inspircd.org/3/modules/)
           and the example configuration files distributed
-          with <literal>pkgs.inspircd.doc</literal>
+          with `pkgs.inspircd.doc`
         '';
       };
     };
diff --git a/nixos/modules/services/networking/iodine.nix b/nixos/modules/services/networking/iodine.nix
index e241afe3269b..c24f118ce898 100644
--- a/nixos/modules/services/networking/iodine.nix
+++ b/nixos/modules/services/networking/iodine.nix
@@ -52,28 +52,28 @@ in
                 server = mkOption {
                   type = types.str;
                   default = "";
-                  description = "Hostname of server running iodined";
+                  description = lib.mdDoc "Hostname of server running iodined";
                   example = "tunnel.mydomain.com";
                 };
 
                 relay = mkOption {
                   type = types.str;
                   default = "";
-                  description = "DNS server to use as an intermediate relay to the iodined server";
+                  description = lib.mdDoc "DNS server to use as an intermediate relay to the iodined server";
                   example = "8.8.8.8";
                 };
 
                 extraConfig = mkOption {
                   type = types.str;
                   default = "";
-                  description = "Additional command line parameters";
+                  description = lib.mdDoc "Additional command line parameters";
                   example = "-l 192.168.1.10 -p 23";
                 };
 
                 passwordFile = mkOption {
                   type = types.str;
                   default = "";
-                  description = "Path to a file containing the password.";
+                  description = lib.mdDoc "Path to a file containing the password.";
                 };
               };
             }
@@ -85,34 +85,34 @@ in
         enable = mkOption {
           type = types.bool;
           default = false;
-          description = "enable iodined server";
+          description = lib.mdDoc "enable iodined server";
         };
 
         ip = mkOption {
           type = types.str;
           default = "";
-          description = "The assigned ip address or ip range";
+          description = lib.mdDoc "The assigned ip address or ip range";
           example = "172.16.10.1/24";
         };
 
         domain = mkOption {
           type = types.str;
           default = "";
-          description = "Domain or subdomain of which nameservers point to us";
+          description = lib.mdDoc "Domain or subdomain of which nameservers point to us";
           example = "tunnel.mydomain.com";
         };
 
         extraConfig = mkOption {
           type = types.str;
           default = "";
-          description = "Additional command line parameters";
+          description = lib.mdDoc "Additional command line parameters";
           example = "-l 192.168.1.10 -p 23";
         };
 
         passwordFile = mkOption {
           type = types.str;
           default = "";
-          description = "File that contains password";
+          description = lib.mdDoc "File that contains password";
         };
       };
 
diff --git a/nixos/modules/services/networking/iperf3.nix b/nixos/modules/services/networking/iperf3.nix
index 0fe378b225d7..0c308f8e7c09 100644
--- a/nixos/modules/services/networking/iperf3.nix
+++ b/nixos/modules/services/networking/iperf3.nix
@@ -7,52 +7,52 @@ let
     port = mkOption {
       type        = types.ints.u16;
       default     = 5201;
-      description = "Server port to listen on for iperf3 client requsts.";
+      description = lib.mdDoc "Server port to listen on for iperf3 client requsts.";
     };
     affinity = mkOption {
       type        = types.nullOr types.ints.unsigned;
       default     = null;
-      description = "CPU affinity for the process.";
+      description = lib.mdDoc "CPU affinity for the process.";
     };
     bind = mkOption {
       type        = types.nullOr types.str;
       default     = null;
-      description = "Bind to the specific interface associated with the given address.";
+      description = lib.mdDoc "Bind to the specific interface associated with the given address.";
     };
     openFirewall = mkOption {
       type = types.bool;
       default = false;
-      description = "Open ports in the firewall for iperf3.";
+      description = lib.mdDoc "Open ports in the firewall for iperf3.";
     };
     verbose = mkOption {
       type        = types.bool;
       default     = false;
-      description = "Give more detailed output.";
+      description = lib.mdDoc "Give more detailed output.";
     };
     forceFlush = mkOption {
       type        = types.bool;
       default     = false;
-      description = "Force flushing output at every interval.";
+      description = lib.mdDoc "Force flushing output at every interval.";
     };
     debug = mkOption {
       type        = types.bool;
       default     = false;
-      description = "Emit debugging output.";
+      description = lib.mdDoc "Emit debugging output.";
     };
     rsaPrivateKey = mkOption {
       type        = types.nullOr types.path;
       default     = null;
-      description = "Path to the RSA private key (not password-protected) used to decrypt authentication credentials from the client.";
+      description = lib.mdDoc "Path to the RSA private key (not password-protected) used to decrypt authentication credentials from the client.";
     };
     authorizedUsersFile = mkOption {
       type        = types.nullOr types.path;
       default     = null;
-      description = "Path to the configuration file containing authorized users credentials to run iperf tests.";
+      description = lib.mdDoc "Path to the configuration file containing authorized users credentials to run iperf tests.";
     };
     extraFlags = mkOption {
       type        = types.listOf types.str;
       default     = [ ];
-      description = "Extra flags to pass to iperf3(1).";
+      description = lib.mdDoc "Extra flags to pass to iperf3(1).";
     };
   };
 
diff --git a/nixos/modules/services/networking/iscsi/initiator.nix b/nixos/modules/services/networking/iscsi/initiator.nix
index 051c9c7bff3c..7414a705a257 100644
--- a/nixos/modules/services/networking/iscsi/initiator.nix
+++ b/nixos/modules/services/networking/iscsi/initiator.nix
@@ -12,16 +12,16 @@ in
     discoverPortal = mkOption {
       type = nullOr str;
       default = null;
-      description = "Portal to discover targets on";
+      description = lib.mdDoc "Portal to discover targets on";
     };
     name = mkOption {
       type = str;
-      description = "Name of this iscsi initiator";
+      description = lib.mdDoc "Name of this iscsi initiator";
       example = "iqn.2020-08.org.linux-iscsi.initiatorhost:example";
     };
     package = mkOption {
       type = package;
-      description = "openiscsi package to use";
+      description = lib.mdDoc "openiscsi package to use";
       default = pkgs.openiscsi;
       defaultText = literalExpression "pkgs.openiscsi";
     };
@@ -29,11 +29,11 @@ in
     extraConfig = mkOption {
       type = str;
       default = "";
-      description = "Lines to append to default iscsid.conf";
+      description = lib.mdDoc "Lines to append to default iscsid.conf";
     };
 
     extraConfigFile = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         Append an additional file's contents to /etc/iscsid.conf. Use a non-store path
         and store passwords in this file.
       '';
diff --git a/nixos/modules/services/networking/iscsi/root-initiator.nix b/nixos/modules/services/networking/iscsi/root-initiator.nix
index c12aca1bc24d..b55fda672521 100644
--- a/nixos/modules/services/networking/iscsi/root-initiator.nix
+++ b/nixos/modules/services/networking/iscsi/root-initiator.nix
@@ -19,7 +19,7 @@ in
   # machines to be up.
   options.boot.iscsi-initiator = with types; {
     name = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         Name of the iSCSI initiator to boot from. Note, booting from iscsi
         requires networkd based networking.
       '';
@@ -29,7 +29,7 @@ in
     };
 
     discoverPortal = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         iSCSI portal to boot from.
       '';
       default = null;
@@ -38,7 +38,7 @@ in
     };
 
     target = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         Name of the iSCSI target to boot from.
       '';
       default = null;
@@ -47,7 +47,7 @@ in
     };
 
     logLevel = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         Higher numbers elicits more logs.
       '';
       default = 1;
@@ -56,7 +56,7 @@ in
     };
 
     loginAll = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         Do not log into a specific target on the portal, but to all that we discover.
         This overrides setting target.
       '';
@@ -65,13 +65,13 @@ in
     };
 
     extraIscsiCommands = mkOption {
-      description = "Extra iscsi commands to run in the initrd.";
+      description = lib.mdDoc "Extra iscsi commands to run in the initrd.";
       default = "";
       type = lines;
     };
 
     extraConfig = mkOption {
-      description = "Extra lines to append to /etc/iscsid.conf";
+      description = lib.mdDoc "Extra lines to append to /etc/iscsid.conf";
       default = null;
       type = nullOr lines;
     };
diff --git a/nixos/modules/services/networking/iscsi/target.nix b/nixos/modules/services/networking/iscsi/target.nix
index 8a10e7d346ae..5bdac4336ce6 100644
--- a/nixos/modules/services/networking/iscsi/target.nix
+++ b/nixos/modules/services/networking/iscsi/target.nix
@@ -14,7 +14,7 @@ in
       config = mkOption {
         type = attrs;
         default = {};
-        description = ''
+        description = lib.mdDoc ''
           Content of /etc/target/saveconfig.json
           This file is normally read and written by targetcli
         '';
diff --git a/nixos/modules/services/networking/iwd.nix b/nixos/modules/services/networking/iwd.nix
index 5c1480e7e2fb..4921fe2c76cc 100644
--- a/nixos/modules/services/networking/iwd.nix
+++ b/nixos/modules/services/networking/iwd.nix
@@ -32,9 +32,9 @@ in
         };
       };
 
-      description = ''
+      description = lib.mdDoc ''
         Options passed to iwd.
-        See <link xlink:href="https://iwd.wiki.kernel.org/networkconfigurationsettings">here</link> for supported options.
+        See [here](https://iwd.wiki.kernel.org/networkconfigurationsettings) for supported options.
       '';
     };
   };
diff --git a/nixos/modules/services/networking/jibri/default.nix b/nixos/modules/services/networking/jibri/default.nix
index 113a7aa4384a..4ac5bae22cc9 100644
--- a/nixos/modules/services/networking/jibri/default.nix
+++ b/nixos/modules/services/networking/jibri/default.nix
@@ -93,9 +93,9 @@ in
     config = mkOption {
       type = attrs;
       default = { };
-      description = ''
+      description = lib.mdDoc ''
         Jibri configuration.
-        See <link xlink:href="https://github.com/jitsi/jibri/blob/master/src/main/resources/reference.conf" />
+        See <https://github.com/jitsi/jibri/blob/master/src/main/resources/reference.conf>
         for default configuration with comments.
       '';
     };
@@ -136,7 +136,7 @@ in
         exit 0
         '''''';
       '';
-      description = ''
+      description = lib.mdDoc ''
         This script runs when jibri finishes recording a video of a conference.
       '';
     };
@@ -145,14 +145,14 @@ in
       type = bool;
       default = false;
       example = true;
-      description = ''
+      description = lib.mdDoc ''
         Whether to enable the flag "--ignore-certificate-errors" for the Chromium browser opened by Jibri.
         Intended for use in automated tests or anywhere else where using a verified cert for Jitsi-Meet is not possible.
       '';
     };
 
     xmppEnvironments = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         XMPP servers to connect to.
       '';
       example = literalExpression ''
@@ -189,54 +189,54 @@ in
           xmppServerHosts = mkOption {
             type = listOf str;
             example = [ "xmpp.example.org" ];
-            description = ''
+            description = lib.mdDoc ''
               Hostnames of the XMPP servers to connect to.
             '';
           };
           xmppDomain = mkOption {
             type = str;
             example = "xmpp.example.org";
-            description = ''
+            description = lib.mdDoc ''
               The base XMPP domain.
             '';
           };
           control.muc.domain = mkOption {
             type = str;
-            description = ''
+            description = lib.mdDoc ''
               The domain part of the MUC to connect to for control.
             '';
           };
           control.muc.roomName = mkOption {
             type = str;
             default = "JibriBrewery";
-            description = ''
+            description = lib.mdDoc ''
               The room name of the MUC to connect to for control.
             '';
           };
           control.muc.nickname = mkOption {
             type = str;
             default = "jibri";
-            description = ''
+            description = lib.mdDoc ''
               The nickname for this Jibri instance in the MUC.
             '';
           };
           control.login.domain = mkOption {
             type = str;
-            description = ''
+            description = lib.mdDoc ''
               The domain part of the JID for this Jibri instance.
             '';
           };
           control.login.username = mkOption {
             type = str;
             default = "jvb";
-            description = ''
+            description = lib.mdDoc ''
               User part of the JID.
             '';
           };
           control.login.passwordFile = mkOption {
             type = str;
             example = "/run/keys/jibri-xmpp1";
-            description = ''
+            description = lib.mdDoc ''
               File containing the password for the user.
             '';
           };
@@ -244,28 +244,28 @@ in
           call.login.domain = mkOption {
             type = str;
             example = "recorder.xmpp.example.org";
-            description = ''
+            description = lib.mdDoc ''
               The domain part of the JID for the recorder.
             '';
           };
           call.login.username = mkOption {
             type = str;
             default = "recorder";
-            description = ''
+            description = lib.mdDoc ''
               User part of the JID for the recorder.
             '';
           };
           call.login.passwordFile = mkOption {
             type = str;
             example = "/run/keys/jibri-recorder-xmpp1";
-            description = ''
+            description = lib.mdDoc ''
               File containing the password for the user.
             '';
           };
           disableCertificateVerification = mkOption {
             type = bool;
             default = false;
-            description = ''
+            description = lib.mdDoc ''
               Whether to skip validation of the server's certificate.
             '';
           };
@@ -274,7 +274,7 @@ in
             type = str;
             default = "0";
             example = "conference.";
-            description = ''
+            description = lib.mdDoc ''
               The prefix to strip from the room's JID domain to derive the call URL.
             '';
           };
@@ -282,7 +282,7 @@ in
             type = str;
             default = "0";
             example = "1 hour";
-            description = ''
+            description = lib.mdDoc ''
               The duration that the Jibri session can be.
               A value of zero means indefinitely.
             '';
diff --git a/nixos/modules/services/networking/jicofo.nix b/nixos/modules/services/networking/jicofo.nix
index 647119b9039e..3b9038f56741 100644
--- a/nixos/modules/services/networking/jicofo.nix
+++ b/nixos/modules/services/networking/jicofo.nix
@@ -12,7 +12,7 @@ in
     xmppHost = mkOption {
       type = str;
       example = "localhost";
-      description = ''
+      description = lib.mdDoc ''
         Hostname of the XMPP server to connect to.
       '';
     };
@@ -20,17 +20,17 @@ in
     xmppDomain = mkOption {
       type = nullOr str;
       example = "meet.example.org";
-      description = ''
+      description = lib.mdDoc ''
         Domain name of the XMMP server to which to connect as a component.
 
-        If null, <option>xmppHost</option> is used.
+        If null, {option}`xmppHost` is used.
       '';
     };
 
     componentPasswordFile = mkOption {
       type = str;
       example = "/run/keys/jicofo-component";
-      description = ''
+      description = lib.mdDoc ''
         Path to file containing component secret.
       '';
     };
@@ -38,7 +38,7 @@ in
     userName = mkOption {
       type = str;
       default = "focus";
-      description = ''
+      description = lib.mdDoc ''
         User part of the JID for XMPP user connection.
       '';
     };
@@ -46,7 +46,7 @@ in
     userDomain = mkOption {
       type = str;
       example = "auth.meet.example.org";
-      description = ''
+      description = lib.mdDoc ''
         Domain part of the JID for XMPP user connection.
       '';
     };
@@ -54,7 +54,7 @@ in
     userPasswordFile = mkOption {
       type = str;
       example = "/run/keys/jicofo-user";
-      description = ''
+      description = lib.mdDoc ''
         Path to file containing password for XMPP user connection.
       '';
     };
@@ -62,7 +62,7 @@ in
     bridgeMuc = mkOption {
       type = str;
       example = "jvbbrewery@internal.meet.example.org";
-      description = ''
+      description = lib.mdDoc ''
         JID of the internal MUC used to communicate with Videobridges.
       '';
     };
@@ -75,8 +75,8 @@ in
           "org.jitsi.jicofo.auth.URL" = "XMPP:jitsi-meet.example.com";
         }
       '';
-      description = ''
-        Contents of the <filename>sip-communicator.properties</filename> configuration file for jicofo.
+      description = lib.mdDoc ''
+        Contents of the {file}`sip-communicator.properties` configuration file for jicofo.
       '';
     };
   };
diff --git a/nixos/modules/services/networking/jitsi-videobridge.nix b/nixos/modules/services/networking/jitsi-videobridge.nix
index abb0bd0a25e1..36e7616d7550 100644
--- a/nixos/modules/services/networking/jitsi-videobridge.nix
+++ b/nixos/modules/services/networking/jitsi-videobridge.nix
@@ -67,19 +67,19 @@ in
           };
         }
       '';
-      description = ''
+      description = lib.mdDoc ''
         Videobridge configuration.
 
-        See <link xlink:href="https://github.com/jitsi/jitsi-videobridge/blob/master/src/main/resources/reference.conf" />
+        See <https://github.com/jitsi/jitsi-videobridge/blob/master/src/main/resources/reference.conf>
         for default configuration with comments.
       '';
     };
 
     xmppConfigs = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         XMPP servers to connect to.
 
-        See <link xlink:href="https://github.com/jitsi/jitsi-videobridge/blob/master/doc/muc.md" /> for more information.
+        See <https://github.com/jitsi/jitsi-videobridge/blob/master/doc/muc.md> for more information.
       '';
       default = { };
       example = literalExpression ''
@@ -98,7 +98,7 @@ in
           hostName = mkOption {
             type = str;
             example = "xmpp.example.org";
-            description = ''
+            description = lib.mdDoc ''
               Hostname of the XMPP server to connect to. Name of the attribute set is used by default.
             '';
           };
@@ -106,35 +106,35 @@ in
             type = nullOr str;
             default = null;
             example = "auth.xmpp.example.org";
-            description = ''
+            description = lib.mdDoc ''
               Domain part of JID of the XMPP user, if it is different from hostName.
             '';
           };
           userName = mkOption {
             type = str;
             default = "jvb";
-            description = ''
+            description = lib.mdDoc ''
               User part of the JID.
             '';
           };
           passwordFile = mkOption {
             type = str;
             example = "/run/keys/jitsi-videobridge-xmpp1";
-            description = ''
+            description = lib.mdDoc ''
               File containing the password for the user.
             '';
           };
           mucJids = mkOption {
             type = str;
             example = "jvbbrewery@internal.xmpp.example.org";
-            description = ''
+            description = lib.mdDoc ''
               JID of the MUC to join. JiCoFo needs to be configured to join the same MUC.
             '';
           };
           mucNickname = mkOption {
             # Upstream DEBs use UUID, let's use hostname instead.
             type = str;
-            description = ''
+            description = lib.mdDoc ''
               Videobridges use the same XMPP account and need to be distinguished by the
               nickname (aka resource part of the JID). By default, system hostname is used.
             '';
@@ -142,7 +142,7 @@ in
           disableCertificateVerification = mkOption {
             type = bool;
             default = false;
-            description = ''
+            description = lib.mdDoc ''
               Whether to skip validation of the server's certificate.
             '';
           };
@@ -161,7 +161,7 @@ in
         type = nullOr str;
         default = null;
         example = "192.168.1.42";
-        description = ''
+        description = lib.mdDoc ''
           Local address when running behind NAT.
         '';
       };
@@ -170,7 +170,7 @@ in
         type = nullOr str;
         default = null;
         example = "1.2.3.4";
-        description = ''
+        description = lib.mdDoc ''
           Public address when running behind NAT.
         '';
       };
@@ -179,7 +179,7 @@ in
     extraProperties = mkOption {
       type = attrsOf str;
       default = { };
-      description = ''
+      description = lib.mdDoc ''
         Additional Java properties passed to jitsi-videobridge.
       '';
     };
@@ -187,14 +187,14 @@ in
     openFirewall = mkOption {
       type = bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         Whether to open ports in the firewall for the videobridge.
       '';
     };
 
     apis = mkOption {
       type = with types; listOf str;
-      description = ''
+      description = lib.mdDoc ''
         What is passed as --apis= parameter. If this is empty, "none" is passed.
         Needed for monitoring jitsi.
       '';
diff --git a/nixos/modules/services/networking/kea.nix b/nixos/modules/services/networking/kea.nix
index 994c511bdc2d..d9d6e3f42ceb 100644
--- a/nixos/modules/services/networking/kea.nix
+++ b/nixos/modules/services/networking/kea.nix
@@ -35,7 +35,7 @@ in
 {
   options.services.kea = with types; {
     ctrl-agent = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         Kea Control Agent configuration
       '';
       default = {};
@@ -46,7 +46,7 @@ in
           extraArgs = mkOption {
             type = listOf str;
             default = [];
-            description = ''
+            description = lib.mdDoc ''
               List of additonal arguments to pass to the daemon.
             '';
           };
@@ -65,8 +65,8 @@ in
           settings = mkOption {
             type = format.type;
             default = null;
-            description = ''
-              Kea Control Agent configuration as an attribute set, see <link xlink:href="https://kea.readthedocs.io/en/kea-${package.version}/arm/agent.html"/>.
+            description = lib.mdDoc ''
+              Kea Control Agent configuration as an attribute set, see <https://kea.readthedocs.io/en/kea-${package.version}/arm/agent.html>.
             '';
           };
         };
@@ -74,7 +74,7 @@ in
     };
 
     dhcp4 = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         DHCP4 Server configuration
       '';
       default = {};
@@ -85,7 +85,7 @@ in
           extraArgs = mkOption {
             type = listOf str;
             default = [];
-            description = ''
+            description = lib.mdDoc ''
               List of additonal arguments to pass to the daemon.
             '';
           };
@@ -125,8 +125,8 @@ in
                 } ];
               } ];
             };
-            description = ''
-              Kea DHCP4 configuration as an attribute set, see <link xlink:href="https://kea.readthedocs.io/en/kea-${package.version}/arm/dhcp4-srv.html"/>.
+            description = lib.mdDoc ''
+              Kea DHCP4 configuration as an attribute set, see <https://kea.readthedocs.io/en/kea-${package.version}/arm/dhcp4-srv.html>.
             '';
           };
         };
@@ -134,7 +134,7 @@ in
     };
 
     dhcp6 = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         DHCP6 Server configuration
       '';
       default = {};
@@ -145,7 +145,7 @@ in
           extraArgs = mkOption {
             type = listOf str;
             default = [];
-            description = ''
+            description = lib.mdDoc ''
               List of additonal arguments to pass to the daemon.
             '';
           };
@@ -186,8 +186,8 @@ in
                 } ];
               } ];
             };
-            description = ''
-              Kea DHCP6 configuration as an attribute set, see <link xlink:href="https://kea.readthedocs.io/en/kea-${package.version}/arm/dhcp6-srv.html"/>.
+            description = lib.mdDoc ''
+              Kea DHCP6 configuration as an attribute set, see <https://kea.readthedocs.io/en/kea-${package.version}/arm/dhcp6-srv.html>.
             '';
           };
         };
@@ -195,7 +195,7 @@ in
     };
 
     dhcp-ddns = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         Kea DHCP-DDNS configuration
       '';
       default = {};
@@ -206,7 +206,7 @@ in
           extraArgs = mkOption {
             type = listOf str;
             default = [];
-            description = ''
+            description = lib.mdDoc ''
               List of additonal arguments to pass to the daemon.
             '';
           };
@@ -239,8 +239,8 @@ in
                 ddns-domains = [ ];
               };
             };
-            description = ''
-              Kea DHCP-DDNS configuration as an attribute set, see <link xlink:href="https://kea.readthedocs.io/en/kea-${package.version}/arm/ddns.html"/>.
+            description = lib.mdDoc ''
+              Kea DHCP-DDNS configuration as an attribute set, see <https://kea.readthedocs.io/en/kea-${package.version}/arm/ddns.html>.
             '';
           };
         };
diff --git a/nixos/modules/services/networking/keybase.nix b/nixos/modules/services/networking/keybase.nix
index 495102cb7eee..ae10aebb86e2 100644
--- a/nixos/modules/services/networking/keybase.nix
+++ b/nixos/modules/services/networking/keybase.nix
@@ -14,7 +14,7 @@ in {
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = "Whether to start the Keybase service.";
+        description = lib.mdDoc "Whether to start the Keybase service.";
       };
 
     };
diff --git a/nixos/modules/services/networking/knot.nix b/nixos/modules/services/networking/knot.nix
index a58a03997b3b..20f11f0cd592 100644
--- a/nixos/modules/services/networking/knot.nix
+++ b/nixos/modules/services/networking/knot.nix
@@ -42,7 +42,7 @@ in {
       extraArgs = mkOption {
         type = types.listOf types.str;
         default = [];
-        description = ''
+        description = lib.mdDoc ''
           List of additional command line paramters for knotd
         '';
       };
@@ -50,7 +50,7 @@ in {
       keyFiles = mkOption {
         type = types.listOf types.path;
         default = [];
-        description = ''
+        description = lib.mdDoc ''
           A list of files containing additional configuration
           to be included using the include directive. This option
           allows to include configuration like TSIG keys without
@@ -63,7 +63,7 @@ in {
       extraConfig = mkOption {
         type = types.lines;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           Extra lines to be added verbatim to knot.conf
         '';
       };
@@ -72,7 +72,7 @@ in {
         type = types.package;
         default = pkgs.knot-dns;
         defaultText = literalExpression "pkgs.knot-dns";
-        description = ''
+        description = lib.mdDoc ''
           Which Knot DNS package to use
         '';
       };
diff --git a/nixos/modules/services/networking/kresd.nix b/nixos/modules/services/networking/kresd.nix
index 28b8be7a9a0d..623e477ca7a8 100644
--- a/nixos/modules/services/networking/kresd.nix
+++ b/nixos/modules/services/networking/kresd.nix
@@ -50,10 +50,10 @@ in {
     enable = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         Whether to enable knot-resolver domain name server.
         DNSSEC validation is turned on by default.
-        You can run <literal>sudo nc -U /run/knot-resolver/control/1</literal>
+        You can run `sudo nc -U /run/knot-resolver/control/1`
         and give commands interactively to kresd@1.service.
       '';
     };
@@ -69,7 +69,7 @@ in {
     extraConfig = mkOption {
       type = types.lines;
       default = "";
-      description = ''
+      description = lib.mdDoc ''
         Extra lines to be added verbatim to the generated configuration file.
       '';
     };
@@ -77,7 +77,7 @@ in {
       type = with types; listOf str;
       default = [ "[::1]:53" "127.0.0.1:53" ];
       example = [ "53" ];
-      description = ''
+      description = lib.mdDoc ''
         What addresses and ports the server should listen on.
         For detailed syntax see ListenStream in man systemd.socket.
       '';
@@ -86,7 +86,7 @@ in {
       type = with types; listOf str;
       default = [];
       example = [ "198.51.100.1:853" "[2001:db8::1]:853" "853" ];
-      description = ''
+      description = lib.mdDoc ''
         Addresses and ports on which kresd should provide DNS over TLS (see RFC 7858).
         For detailed syntax see ListenStream in man systemd.socket.
       '';
@@ -95,7 +95,7 @@ in {
       type = with types; listOf str;
       default = [];
       example = [ "198.51.100.1:443" "[2001:db8::1]:443" "443" ];
-      description = ''
+      description = lib.mdDoc ''
         Addresses and ports on which kresd should provide DNS over HTTPS/2 (see RFC 8484).
         For detailed syntax see ListenStream in man systemd.socket.
       '';
@@ -103,7 +103,7 @@ in {
     instances = mkOption {
       type = types.ints.unsigned;
       default = 1;
-      description = ''
+      description = lib.mdDoc ''
         The number of instances to start.  They will be called kresd@{1,2,...}.service.
         Knot Resolver uses no threads, so this is the way to scale.
         You can dynamically start/stop them at will, so this is just system default.
diff --git a/nixos/modules/services/networking/lambdabot.nix b/nixos/modules/services/networking/lambdabot.nix
index 3005e5824554..8609bc971962 100644
--- a/nixos/modules/services/networking/lambdabot.nix
+++ b/nixos/modules/services/networking/lambdabot.nix
@@ -21,20 +21,20 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = "Enable the Lambdabot IRC bot";
+        description = lib.mdDoc "Enable the Lambdabot IRC bot";
       };
 
       package = mkOption {
         type = types.package;
         default = pkgs.lambdabot;
         defaultText = literalExpression "pkgs.lambdabot";
-        description = "Used lambdabot package";
+        description = lib.mdDoc "Used lambdabot package";
       };
 
       script = mkOption {
         type = types.str;
         default = "";
-        description = "Lambdabot script";
+        description = lib.mdDoc "Lambdabot script";
       };
 
     };
diff --git a/nixos/modules/services/networking/libreswan.nix b/nixos/modules/services/networking/libreswan.nix
index 429167aed9d7..08ffcca8a5ac 100644
--- a/nixos/modules/services/networking/libreswan.nix
+++ b/nixos/modules/services/networking/libreswan.nix
@@ -60,7 +60,7 @@ in
             protostack=netkey
             virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10
         '';
-        description = "Options to go in the 'config setup' section of the Libreswan IPsec configuration";
+        description = lib.mdDoc "Options to go in the 'config setup' section of the Libreswan IPsec configuration";
       };
 
       connections = mkOption {
@@ -79,7 +79,7 @@ in
             ''';
           }
         '';
-        description = "A set of connections to define for the Libreswan IPsec service";
+        description = lib.mdDoc "A set of connections to define for the Libreswan IPsec service";
       };
 
       policies = mkOption {
@@ -105,10 +105,10 @@ in
       disableRedirects = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Whether to disable send and accept redirects for all nework interfaces.
-          See the Libreswan <link xlink:href="https://libreswan.org/wiki/FAQ#Why_is_it_recommended_to_disable_send_redirects_in_.2Fproc.2Fsys.2Fnet_.3F">
-          FAQ</link> page for why this is recommended.
+          See the Libreswan [
+          FAQ](https://libreswan.org/wiki/FAQ#Why_is_it_recommended_to_disable_send_redirects_in_.2Fproc.2Fsys.2Fnet_.3F) page for why this is recommended.
         '';
       };
 
diff --git a/nixos/modules/services/networking/lldpd.nix b/nixos/modules/services/networking/lldpd.nix
index d5de9c45d84b..41a3713fcefe 100644
--- a/nixos/modules/services/networking/lldpd.nix
+++ b/nixos/modules/services/networking/lldpd.nix
@@ -15,7 +15,7 @@ in
       type = types.listOf types.str;
       default = [];
       example = [ "-c" "-k" "-I eth0" ];
-      description = "List of command line parameters for lldpd";
+      description = lib.mdDoc "List of command line parameters for lldpd";
     };
   };
 
diff --git a/nixos/modules/services/networking/logmein-hamachi.nix b/nixos/modules/services/networking/logmein-hamachi.nix
index 11cbdda2f845..7c00b82e3b34 100644
--- a/nixos/modules/services/networking/logmein-hamachi.nix
+++ b/nixos/modules/services/networking/logmein-hamachi.nix
@@ -18,7 +18,7 @@ in
       type = types.bool;
       default = false;
       description =
-        ''
+        lib.mdDoc ''
           Whether to enable LogMeIn Hamachi, a proprietary
           (closed source) commercial VPN software.
         '';
diff --git a/nixos/modules/services/networking/lokinet.nix b/nixos/modules/services/networking/lokinet.nix
index cf091341c839..6dc33faa82b4 100644
--- a/nixos/modules/services/networking/lokinet.nix
+++ b/nixos/modules/services/networking/lokinet.nix
@@ -13,14 +13,14 @@ in with lib; {
       type = types.package;
       default = pkgs.lokinet;
       defaultText = literalExpression "pkgs.lokinet";
-      description = "Lokinet package to use.";
+      description = lib.mdDoc "Lokinet package to use.";
     };
 
     useLocally = mkOption {
       type = types.bool;
       default = false;
       example = true;
-      description = "Whether to use Lokinet locally.";
+      description = lib.mdDoc "Whether to use Lokinet locally.";
     };
 
     settings = mkOption {
@@ -33,14 +33,14 @@ in with lib; {
               bind = mkOption {
                 type = str;
                 default = "127.3.2.1";
-                description = "Address to bind to for handling DNS requests.";
+                description = lib.mdDoc "Address to bind to for handling DNS requests.";
               };
 
               upstream = mkOption {
                 type = listOf str;
                 default = [ "9.9.9.10" ];
                 example = [ "1.1.1.1" "8.8.8.8" ];
-                description = ''
+                description = lib.mdDoc ''
                   Upstream resolver(s) to use as fallback for non-loki addresses.
                   Multiple values accepted.
                 '';
@@ -51,7 +51,7 @@ in with lib; {
               exit = mkOption {
                 type = bool;
                 default = false;
-                description = ''
+                description = lib.mdDoc ''
                   Whether to act as an exit node. Beware that this
                   increases demand on the server and may pose liability concerns.
                   Enable at your own risk.
@@ -76,7 +76,7 @@ in with lib; {
                 type = nullOr str;
                 default = null;
                 example = "snappkey.private";
-                description = ''
+                description = lib.mdDoc ''
                   The private key to persist address with. If not specified the address will be ephemeral.
                   This keyfile is generated automatically if the specified file doesn't exist.
                 '';
diff --git a/nixos/modules/services/networking/lxd-image-server.nix b/nixos/modules/services/networking/lxd-image-server.nix
index d326626eed44..44f93a5c56ec 100644
--- a/nixos/modules/services/networking/lxd-image-server.nix
+++ b/nixos/modules/services/networking/lxd-image-server.nix
@@ -15,17 +15,17 @@ in
 
       group = mkOption {
         type = types.str;
-        description = "Group assigned to the user and the webroot directory.";
+        description = lib.mdDoc "Group assigned to the user and the webroot directory.";
         default = "nginx";
         example = "www-data";
       };
 
       settings = mkOption {
         type = format.type;
-        description = ''
+        description = lib.mdDoc ''
           Configuration for lxd-image-server.
 
-          Example see <link xlink:href="https://github.com/Avature/lxd-image-server/blob/master/config.toml"/>.
+          Example see <https://github.com/Avature/lxd-image-server/blob/master/config.toml>.
         '';
         default = {};
       };
@@ -34,7 +34,7 @@ in
         enable = mkEnableOption "nginx";
         domain = mkOption {
           type = types.str;
-          description = "Domain to use for nginx virtual host.";
+          description = lib.mdDoc "Domain to use for nginx virtual host.";
           example = "images.example.org";
         };
       };
diff --git a/nixos/modules/services/networking/matterbridge.nix b/nixos/modules/services/networking/matterbridge.nix
index 9186eee26abf..f75be9b4e37b 100644
--- a/nixos/modules/services/networking/matterbridge.nix
+++ b/nixos/modules/services/networking/matterbridge.nix
@@ -23,7 +23,7 @@ in
         type = with types; nullOr str;
         default = null;
         example = "/etc/nixos/matterbridge.toml";
-        description = ''
+        description = lib.mdDoc ''
           The path to the matterbridge configuration file.
         '';
       };
@@ -62,10 +62,10 @@ in
               account="mattermost.work"
               channel="off-topic"
         '';
-        description = ''
+        description = lib.mdDoc ''
           WARNING: THIS IS INSECURE, as your password will end up in
-          <filename>/nix/store</filename>, thus publicly readable. Use
-          <literal>services.matterbridge.configPath</literal> instead.
+          {file}`/nix/store`, thus publicly readable. Use
+          `services.matterbridge.configPath` instead.
 
           The matterbridge configuration file in the TOML file format.
         '';
@@ -73,7 +73,7 @@ in
       user = mkOption {
         type = types.str;
         default = "matterbridge";
-        description = ''
+        description = lib.mdDoc ''
           User which runs the matterbridge service.
         '';
       };
@@ -81,7 +81,7 @@ in
       group = mkOption {
         type = types.str;
         default = "matterbridge";
-        description = ''
+        description = lib.mdDoc ''
           Group which runs the matterbridge service.
         '';
       };
diff --git a/nixos/modules/services/networking/minidlna.nix b/nixos/modules/services/networking/minidlna.nix
index 57c37718e7cb..0cac41f58da3 100644
--- a/nixos/modules/services/networking/minidlna.nix
+++ b/nixos/modules/services/networking/minidlna.nix
@@ -14,25 +14,25 @@ in
   options.services.minidlna.enable = mkOption {
     type = types.bool;
     default = false;
-    description = ''
+    description = lib.mdDoc ''
       Whether to enable MiniDLNA, a simple DLNA server.
       It serves media files such as video and music to DLNA client devices
       such as televisions and media players. If you use the firewall consider
-      adding the following: <literal>services.minidlna.openFirewall = true;</literal>
+      adding the following: `services.minidlna.openFirewall = true;`
     '';
   };
 
   options.services.minidlna.openFirewall = mkOption {
     type = types.bool;
     default = false;
-    description = ''
+    description = lib.mdDoc ''
       Whether to open both HTTP (TCP) and SSDP (UDP) ports in the firewall.
     '';
   };
 
   options.services.minidlna.settings = mkOption {
     default = {};
-    description = ''
+    description = lib.mdDoc ''
       The contents of MiniDLNA's configuration file.
       When the service is activated, a basic template is generated
       from the current options opened here.
@@ -44,21 +44,21 @@ in
         type = types.listOf types.str;
         default = [];
         example = [ "/data/media" "V,/home/alice/video" ];
-        description = ''
+        description = lib.mdDoc ''
           Directories to be scanned for media files.
-          The prefixes <literal>A,</literal>,<literal>V,</literal> and
-          <literal>P,</literal> restrict a directory to audio, video
+          The prefixes `A,`,`V,` and
+          `P,` restrict a directory to audio, video
           or image files. The directories must be accessible to the
-          <literal>minidlna</literal> user account.
+          `minidlna` user account.
         '';
       };
       options.notify_interval = mkOption {
         type = types.int;
         default = 90000;
-        description = ''
+        description = lib.mdDoc ''
           The interval between announces (in seconds).
           Instead of waiting on announces, one can open port UDP 1900 or
-          set <literal>openFirewall</literal> option to use SSDP discovery.
+          set `openFirewall` option to use SSDP discovery.
           Furthermore announce interval has now been set as 90000 in order
           to prevent disconnects with certain clients and to rely solely
           on the SSDP method.
@@ -76,47 +76,47 @@ in
       options.port = mkOption {
         type = types.port;
         default = 8200;
-        description = "Port number for HTTP traffic (descriptions, SOAP, media transfer).";
+        description = lib.mdDoc "Port number for HTTP traffic (descriptions, SOAP, media transfer).";
       };
       options.db_dir = mkOption {
         type = types.path;
         default = "/var/cache/minidlna";
         example = "/tmp/minidlna";
-        description = "Specify the directory where you want MiniDLNA to store its database and album art cache.";
+        description = lib.mdDoc "Specify the directory where you want MiniDLNA to store its database and album art cache.";
       };
       options.friendly_name = mkOption {
         type = types.str;
         default = "${config.networking.hostName} MiniDLNA";
         defaultText = literalExpression "config.networking.hostName";
         example = "rpi3";
-        description = "Name that the DLNA server presents to clients.";
+        description = lib.mdDoc "Name that the DLNA server presents to clients.";
       };
       options.root_container = mkOption {
         type = types.str;
         default = ".";
         example = "B";
-        description = "Use a different container as the root of the directory tree presented to clients.";
+        description = lib.mdDoc "Use a different container as the root of the directory tree presented to clients.";
       };
       options.log_level = mkOption {
         type = types.str;
         default = "warn";
         example = "general,artwork,database,inotify,scanner,metadata,http,ssdp,tivo=warn";
-        description = "Defines the type of messages that should be logged and down to which level of importance.";
+        description = lib.mdDoc "Defines the type of messages that should be logged and down to which level of importance.";
       };
       options.inotify = mkOption {
         type = types.enum [ "yes" "no" ];
         default = "no";
-        description = "Whether to enable inotify monitoring to automatically discover new files.";
+        description = lib.mdDoc "Whether to enable inotify monitoring to automatically discover new files.";
       };
       options.enable_tivo = mkOption {
         type = types.enum [ "yes" "no" ];
         default = "no";
-        description = "Support for streaming .jpg and .mp3 files to a TiVo supporting HMO.";
+        description = lib.mdDoc "Support for streaming .jpg and .mp3 files to a TiVo supporting HMO.";
       };
       options.wide_links = mkOption {
         type = types.enum [ "yes" "no" ];
         default = "no";
-        description = "Set this to yes to allow symlinks that point outside user-defined media_dirs.";
+        description = lib.mdDoc "Set this to yes to allow symlinks that point outside user-defined media_dirs.";
       };
     };
   };
diff --git a/nixos/modules/services/networking/miniupnpd.nix b/nixos/modules/services/networking/miniupnpd.nix
index c095d9948546..524270edd1c6 100644
--- a/nixos/modules/services/networking/miniupnpd.nix
+++ b/nixos/modules/services/networking/miniupnpd.nix
@@ -23,7 +23,7 @@ in
 
       externalInterface = mkOption {
         type = types.str;
-        description = ''
+        description = lib.mdDoc ''
           Name of the external interface.
         '';
       };
@@ -31,7 +31,7 @@ in
       internalIPs = mkOption {
         type = types.listOf types.str;
         example = [ "192.168.1.1/24" "enp1s0" ];
-        description = ''
+        description = lib.mdDoc ''
           The IP address ranges to listen on.
         '';
       };
@@ -41,7 +41,7 @@ in
       upnp = mkOption {
         default = true;
         type = types.bool;
-        description = ''
+        description = lib.mdDoc ''
           Whether to enable UPNP support.
         '';
       };
@@ -49,7 +49,7 @@ in
       appendConfig = mkOption {
         type = types.lines;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           Configuration lines appended to the MiniUPnP config.
         '';
       };
diff --git a/nixos/modules/services/networking/miredo.nix b/nixos/modules/services/networking/miredo.nix
index b7f657efb712..5e42678c32f3 100644
--- a/nixos/modules/services/networking/miredo.nix
+++ b/nixos/modules/services/networking/miredo.nix
@@ -26,7 +26,7 @@ in
         type = types.package;
         default = pkgs.miredo;
         defaultText = literalExpression "pkgs.miredo";
-        description = ''
+        description = lib.mdDoc ''
           The package to use for the miredo daemon's binary.
         '';
       };
@@ -34,7 +34,7 @@ in
       serverAddress = mkOption {
         default = "teredo.remlab.net";
         type = types.str;
-        description = ''
+        description = lib.mdDoc ''
           The hostname or primary IPv4 address of the Teredo server.
           This setting is required if Miredo runs as a Teredo client.
           "teredo.remlab.net" is an experimental service for testing only.
@@ -45,7 +45,7 @@ in
       interfaceName = mkOption {
         default = "teredo";
         type = types.str;
-        description = ''
+        description = lib.mdDoc ''
           Name of the network tunneling interface.
         '';
       };
@@ -53,7 +53,7 @@ in
       bindAddress = mkOption {
         default = null;
         type = types.nullOr types.str;
-        description = ''
+        description = lib.mdDoc ''
           Depending on the local firewall/NAT rules, you might need to force
           Miredo to use a fixed UDP port and or IPv4 address.
         '';
@@ -62,7 +62,7 @@ in
       bindPort = mkOption {
         default = null;
         type = types.nullOr types.str;
-        description = ''
+        description = lib.mdDoc ''
           Depending on the local firewall/NAT rules, you might need to force
           Miredo to use a fixed UDP port and or IPv4 address.
         '';
diff --git a/nixos/modules/services/networking/mjpg-streamer.nix b/nixos/modules/services/networking/mjpg-streamer.nix
index dbc35e2e71c0..8b490f0248bc 100644
--- a/nixos/modules/services/networking/mjpg-streamer.nix
+++ b/nixos/modules/services/networking/mjpg-streamer.nix
@@ -17,7 +17,7 @@ in {
       inputPlugin = mkOption {
         type = types.str;
         default = "input_uvc.so";
-        description = ''
+        description = lib.mdDoc ''
           Input plugin. See plugins documentation for more information.
         '';
       };
@@ -25,8 +25,8 @@ in {
       outputPlugin = mkOption {
         type = types.str;
         default = "output_http.so -w @www@ -n -p 5050";
-        description = ''
-          Output plugin. <literal>@www@</literal> is substituted for default mjpg-streamer www directory.
+        description = lib.mdDoc ''
+          Output plugin. `@www@` is substituted for default mjpg-streamer www directory.
           See plugins documentation for more information.
         '';
       };
@@ -34,13 +34,13 @@ in {
       user = mkOption {
         type = types.str;
         default = "mjpg-streamer";
-        description = "mjpg-streamer user name.";
+        description = lib.mdDoc "mjpg-streamer user name.";
       };
 
       group = mkOption {
         type = types.str;
         default = "video";
-        description = "mjpg-streamer group name.";
+        description = lib.mdDoc "mjpg-streamer group name.";
       };
 
     };
diff --git a/nixos/modules/services/networking/monero.nix b/nixos/modules/services/networking/monero.nix
index 8bed89917c85..032f6df4e79e 100644
--- a/nixos/modules/services/networking/monero.nix
+++ b/nixos/modules/services/networking/monero.nix
@@ -55,7 +55,7 @@ in
       dataDir = mkOption {
         type = types.str;
         default = "/var/lib/monero";
-        description = ''
+        description = lib.mdDoc ''
           The directory where Monero stores its data files.
         '';
       };
@@ -63,7 +63,7 @@ in
       mining.enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to mine monero.
         '';
       };
@@ -71,7 +71,7 @@ in
       mining.address = mkOption {
         type = types.str;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           Monero address where to send mining rewards.
         '';
       };
@@ -79,16 +79,16 @@ in
       mining.threads = mkOption {
         type = types.addCheck types.int (x: x>=0);
         default = 0;
-        description = ''
+        description = lib.mdDoc ''
           Number of threads used for mining.
-          Set to <literal>0</literal> to use all available.
+          Set to `0` to use all available.
         '';
       };
 
       rpc.user = mkOption {
         type = types.nullOr types.str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           User name for RPC connections.
         '';
       };
@@ -96,7 +96,7 @@ in
       rpc.password = mkOption {
         type = types.nullOr types.str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Password for RPC connections.
         '';
       };
@@ -104,7 +104,7 @@ in
       rpc.address = mkOption {
         type = types.str;
         default = "127.0.0.1";
-        description = ''
+        description = lib.mdDoc ''
           IP address the RPC server will bind to.
         '';
       };
@@ -112,7 +112,7 @@ in
       rpc.port = mkOption {
         type = types.port;
         default = 18081;
-        description = ''
+        description = lib.mdDoc ''
           Port the RPC server will bind to.
         '';
       };
@@ -120,7 +120,7 @@ in
       rpc.restricted = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to restrict RPC to view only commands.
         '';
       };
@@ -128,43 +128,43 @@ in
       limits.upload = mkOption {
         type = types.addCheck types.int (x: x>=-1);
         default = -1;
-        description = ''
+        description = lib.mdDoc ''
           Limit of the upload rate in kB/s.
-          Set to <literal>-1</literal> to leave unlimited.
+          Set to `-1` to leave unlimited.
         '';
       };
 
       limits.download = mkOption {
         type = types.addCheck types.int (x: x>=-1);
         default = -1;
-        description = ''
+        description = lib.mdDoc ''
           Limit of the download rate in kB/s.
-          Set to <literal>-1</literal> to leave unlimited.
+          Set to `-1` to leave unlimited.
         '';
       };
 
       limits.threads = mkOption {
         type = types.addCheck types.int (x: x>=0);
         default = 0;
-        description = ''
+        description = lib.mdDoc ''
           Maximum number of threads used for a parallel job.
-          Set to <literal>0</literal> to leave unlimited.
+          Set to `0` to leave unlimited.
         '';
       };
 
       limits.syncSize = mkOption {
         type = types.addCheck types.int (x: x>=0);
         default = 0;
-        description = ''
+        description = lib.mdDoc ''
           Maximum number of blocks to sync at once.
-          Set to <literal>0</literal> for adaptive.
+          Set to `0` for adaptive.
         '';
       };
 
       extraNodes = mkOption {
         type = types.listOf types.str;
         default = [ ];
-        description = ''
+        description = lib.mdDoc ''
           List of additional peer IP addresses to add to the local list.
         '';
       };
@@ -172,7 +172,7 @@ in
       priorityNodes = mkOption {
         type = types.listOf types.str;
         default = [ ];
-        description = ''
+        description = lib.mdDoc ''
           List of peer IP addresses to connect to and
           attempt to keep the connection open.
         '';
@@ -190,7 +190,7 @@ in
       extraConfig = mkOption {
         type = types.lines;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           Extra lines to be added verbatim to monerod configuration.
         '';
       };
diff --git a/nixos/modules/services/networking/morty.nix b/nixos/modules/services/networking/morty.nix
index dff2f482ca6b..cc5d7998f36b 100644
--- a/nixos/modules/services/networking/morty.nix
+++ b/nixos/modules/services/networking/morty.nix
@@ -22,43 +22,43 @@ in
       ipv6 = mkOption {
         type = types.bool;
         default = true;
-        description = "Allow IPv6 HTTP requests?";
+        description = lib.mdDoc "Allow IPv6 HTTP requests?";
       };
 
       key = mkOption {
         type = types.str;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           HMAC url validation key (hexadecimal encoded).
           Leave blank to disable. Without validation key, anyone can
           submit proxy requests. Leave blank to disable.
-          Generate with <literal>printf %s somevalue | openssl dgst -sha1 -hmac somekey</literal>
+          Generate with `printf %s somevalue | openssl dgst -sha1 -hmac somekey`
         '';
       };
 
       timeout = mkOption {
         type = types.int;
         default = 2;
-        description = "Request timeout in seconds.";
+        description = lib.mdDoc "Request timeout in seconds.";
       };
 
       package = mkOption {
         type = types.package;
         default = pkgs.morty;
         defaultText = literalExpression "pkgs.morty";
-        description = "morty package to use.";
+        description = lib.mdDoc "morty package to use.";
       };
 
       port = mkOption {
         type = types.int;
         default = 3000;
-        description = "Listing port";
+        description = lib.mdDoc "Listing port";
       };
 
       listenAddress = mkOption {
         type = types.str;
         default = "127.0.0.1";
-        description = "The address on which the service listens";
+        description = lib.mdDoc "The address on which the service listens";
       };
 
     };
diff --git a/nixos/modules/services/networking/mosquitto.nix b/nixos/modules/services/networking/mosquitto.nix
index 70c6725d1035..49f0cc90122b 100644
--- a/nixos/modules/services/networking/mosquitto.nix
+++ b/nixos/modules/services/networking/mosquitto.nix
@@ -36,7 +36,7 @@ let
       password = mkOption {
         type = uniq (nullOr str);
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Specifies the (clear text) password for the MQTT User.
         '';
       };
@@ -45,7 +45,7 @@ let
         type = uniq (nullOr types.path);
         example = "/path/to/file";
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Specifies the path to a file containing the
           clear text password for the MQTT user.
         '';
@@ -77,7 +77,7 @@ let
         type = listOf str;
         example = [ "read A/B" "readwrite A/#" ];
         default = [];
-        description = ''
+        description = lib.mdDoc ''
           Control client access to topics on the broker.
         '';
       };
@@ -231,7 +231,7 @@ let
     options = {
       port = mkOption {
         type = port;
-        description = ''
+        description = lib.mdDoc ''
           Port to listen on. Must be set to 0 to listen on a unix domain socket.
         '';
         default = 1883;
@@ -259,7 +259,7 @@ let
       users = mkOption {
         type = attrsOf userOptions;
         example = { john = { password = "123456"; acl = [ "readwrite john/#" ]; }; };
-        description = ''
+        description = lib.mdDoc ''
           A set of users and their passwords and ACLs.
         '';
         default = {};
@@ -267,7 +267,7 @@ let
 
       omitPasswordAuth = mkOption {
         type = bool;
-        description = ''
+        description = lib.mdDoc ''
           Omits password checking, allowing anyone to log in with any user name unless
           other mandatory authentication methods (eg TLS client certificates) are configured.
         '';
@@ -276,7 +276,7 @@ let
 
       acl = mkOption {
         type = listOf str;
-        description = ''
+        description = lib.mdDoc ''
           Additional ACL items to prepend to the generated ACL file.
         '';
         example = [ "pattern read #" "topic readwrite anon/report/#" ];
@@ -287,7 +287,7 @@ let
         type = submodule {
           freeformType = attrsOf optionType;
         };
-        description = ''
+        description = lib.mdDoc ''
           Additional settings for this listener.
         '';
         default = {};
@@ -354,14 +354,14 @@ let
           options = {
             address = mkOption {
               type = str;
-              description = ''
+              description = lib.mdDoc ''
                 Address of the remote MQTT broker.
               '';
             };
 
             port = mkOption {
               type = port;
-              description = ''
+              description = lib.mdDoc ''
                 Port of the remote MQTT broker.
               '';
               default = 1883;
@@ -369,17 +369,17 @@ let
           };
         });
         default = [];
-        description = ''
+        description = lib.mdDoc ''
           Remote endpoints for the bridge.
         '';
       };
 
       topics = mkOption {
         type = listOf str;
-        description = ''
+        description = lib.mdDoc ''
           Topic patterns to be shared between the two brokers.
-          Refer to the <link xlink:href="https://mosquitto.org/man/mosquitto-conf-5.html">
-          mosquitto.conf documentation</link> for details on the format.
+          Refer to the [
+          mosquitto.conf documentation](https://mosquitto.org/man/mosquitto-conf-5.html) for details on the format.
         '';
         default = [];
         example = [ "# both 2 local/topic/ remote/topic/" ];
@@ -389,7 +389,7 @@ let
         type = submodule {
           freeformType = attrsOf optionType;
         };
-        description = ''
+        description = lib.mdDoc ''
           Additional settings for this bridge.
         '';
         default = {};
@@ -449,7 +449,7 @@ let
       type = package;
       default = pkgs.mosquitto;
       defaultText = literalExpression "pkgs.mosquitto";
-      description = ''
+      description = lib.mdDoc ''
         Mosquitto package to use.
       '';
     };
@@ -457,7 +457,7 @@ let
     bridges = mkOption {
       type = attrsOf bridgeOptions;
       default = {};
-      description = ''
+      description = lib.mdDoc ''
         Bridges to build to other MQTT brokers.
       '';
     };
@@ -465,7 +465,7 @@ let
     listeners = mkOption {
       type = listOf listenerOptions;
       default = {};
-      description = ''
+      description = lib.mdDoc ''
         Listeners to configure on this broker.
       '';
     };
@@ -483,7 +483,7 @@ let
 
     logDest = mkOption {
       type = listOf (either path (enum [ "stdout" "stderr" "syslog" "topic" "dlt" ]));
-      description = ''
+      description = lib.mdDoc ''
         Destinations to send log messages to.
       '';
       default = [ "stderr" ];
@@ -492,7 +492,7 @@ let
     logType = mkOption {
       type = listOf (enum [ "debug" "error" "warning" "notice" "information"
                             "subscribe" "unsubscribe" "websockets" "none" "all" ]);
-      description = ''
+      description = lib.mdDoc ''
         Types of messages to log.
       '';
       default = [];
@@ -500,7 +500,7 @@ let
 
     persistence = mkOption {
       type = bool;
-      description = ''
+      description = lib.mdDoc ''
         Enable persistent storage of subscriptions and messages.
       '';
       default = true;
@@ -509,7 +509,7 @@ let
     dataDir = mkOption {
       default = "/var/lib/mosquitto";
       type = types.path;
-      description = ''
+      description = lib.mdDoc ''
         The data directory.
       '';
     };
@@ -518,7 +518,7 @@ let
       type = submodule {
         freeformType = attrsOf optionType;
       };
-      description = ''
+      description = lib.mdDoc ''
         Global configuration options for the mosquitto broker.
       '';
       default = {};
diff --git a/nixos/modules/services/networking/mozillavpn.nix b/nixos/modules/services/networking/mozillavpn.nix
index e35ba65314e9..71cbb0470412 100644
--- a/nixos/modules/services/networking/mozillavpn.nix
+++ b/nixos/modules/services/networking/mozillavpn.nix
@@ -4,7 +4,7 @@
   options.services.mozillavpn.enable = lib.mkOption {
     type = lib.types.bool;
     default = false;
-    description = ''
+    description = lib.mdDoc ''
       Enable the Mozilla VPN daemon.
     '';
   };
diff --git a/nixos/modules/services/networking/mstpd.nix b/nixos/modules/services/networking/mstpd.nix
index bd71010ce549..ba82c5ac8232 100644
--- a/nixos/modules/services/networking/mstpd.nix
+++ b/nixos/modules/services/networking/mstpd.nix
@@ -9,7 +9,7 @@ with lib;
     enable = mkOption {
       default = false;
       type = types.bool;
-      description = ''
+      description = lib.mdDoc ''
         Whether to enable the multiple spanning tree protocol daemon.
       '';
     };
diff --git a/nixos/modules/services/networking/mtprotoproxy.nix b/nixos/modules/services/networking/mtprotoproxy.nix
index d896f227b82c..7ff1cb0b2da3 100644
--- a/nixos/modules/services/networking/mtprotoproxy.nix
+++ b/nixos/modules/services/networking/mtprotoproxy.nix
@@ -42,7 +42,7 @@ in
       port = mkOption {
         type = types.int;
         default = 3256;
-        description = ''
+        description = lib.mdDoc ''
           TCP port to accept mtproto connections on.
         '';
       };
@@ -53,7 +53,7 @@ in
           tg = "00000000000000000000000000000000";
           tg2 = "0123456789abcdef0123456789abcdef";
         };
-        description = ''
+        description = lib.mdDoc ''
           Allowed users and their secrets. A secret is a 32 characters long hex string.
         '';
       };
@@ -61,7 +61,7 @@ in
       secureOnly = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Don't allow users to connect in non-secure mode (without random padding).
         '';
       };
@@ -71,7 +71,7 @@ in
         default = null;
         # Taken from mtproxyproto's repo.
         example = "3c09c680b76ee91a4c25ad51f742267d";
-        description = ''
+        description = lib.mdDoc ''
           Tag for advertising that can be obtained from @MTProxybot.
         '';
       };
@@ -82,7 +82,7 @@ in
         example = {
           STATS_PRINT_PERIOD = 600;
         };
-        description = ''
+        description = lib.mdDoc ''
           Extra configuration options for mtprotoproxy.
         '';
       };
diff --git a/nixos/modules/services/networking/mtr-exporter.nix b/nixos/modules/services/networking/mtr-exporter.nix
index ca261074ebde..b95af08d3634 100644
--- a/nixos/modules/services/networking/mtr-exporter.nix
+++ b/nixos/modules/services/networking/mtr-exporter.nix
@@ -14,32 +14,32 @@ in {
         target = mkOption {
           type = types.str;
           example = "example.org";
-          description = "Target to check using MTR.";
+          description = lib.mdDoc "Target to check using MTR.";
         };
 
         interval = mkOption {
           type = types.int;
           default = 60;
-          description = "Interval between MTR checks in seconds.";
+          description = lib.mdDoc "Interval between MTR checks in seconds.";
         };
 
         port = mkOption {
           type = types.port;
           default = 8080;
-          description = "Listen port for MTR exporter.";
+          description = lib.mdDoc "Listen port for MTR exporter.";
         };
 
         address = mkOption {
           type = types.str;
           default = "127.0.0.1";
-          description = "Listen address for MTR exporter.";
+          description = lib.mdDoc "Listen address for MTR exporter.";
         };
 
         mtrFlags = mkOption {
           type = with types; listOf str;
           default = [];
           example = ["-G1"];
-          description = "Additional flags to pass to MTR.";
+          description = lib.mdDoc "Additional flags to pass to MTR.";
         };
       };
     };
diff --git a/nixos/modules/services/networking/mullvad-vpn.nix b/nixos/modules/services/networking/mullvad-vpn.nix
index 9ec1ddc929e1..ca60682b4b8b 100644
--- a/nixos/modules/services/networking/mullvad-vpn.nix
+++ b/nixos/modules/services/networking/mullvad-vpn.nix
@@ -7,9 +7,9 @@ with lib;
   options.services.mullvad-vpn.enable = mkOption {
     type = types.bool;
     default = false;
-    description = ''
+    description = lib.mdDoc ''
       This option enables Mullvad VPN daemon.
-      This sets <option>networking.firewall.checkReversePath</option> to "loose", which might be undesirable for security.
+      This sets {option}`networking.firewall.checkReversePath` to "loose", which might be undesirable for security.
     '';
   };
 
diff --git a/nixos/modules/services/networking/multipath.nix b/nixos/modules/services/networking/multipath.nix
index 1a44184ff6dc..3dc6be96e7a7 100644
--- a/nixos/modules/services/networking/multipath.nix
+++ b/nixos/modules/services/networking/multipath.nix
@@ -26,7 +26,7 @@ in {
 
     package = mkOption {
       type = package;
-      description = "multipath-tools package to use";
+      description = lib.mdDoc "multipath-tools package to use";
       default = pkgs.multipath-tools;
       defaultText = "pkgs.multipath-tools";
     };
@@ -44,7 +44,7 @@ in {
           }, ...
         ]
       '';
-      description = ''
+      description = lib.mdDoc ''
         This option allows you to define arrays for use in multipath
         groups.
       '';
@@ -54,62 +54,62 @@ in {
           vendor = mkOption {
             type = str;
             example = "COMPELNT";
-            description = "Regular expression to match the vendor name";
+            description = lib.mdDoc "Regular expression to match the vendor name";
           };
 
           product = mkOption {
             type = str;
             example = "Compellent Vol";
-            description = "Regular expression to match the product name";
+            description = lib.mdDoc "Regular expression to match the product name";
           };
 
           revision = mkOption {
             type = nullOr str;
             default = null;
-            description = "Regular expression to match the product revision";
+            description = lib.mdDoc "Regular expression to match the product revision";
           };
 
           product_blacklist = mkOption {
             type = nullOr str;
             default = null;
-            description = "Products with the given vendor matching this string are blacklisted";
+            description = lib.mdDoc "Products with the given vendor matching this string are blacklisted";
           };
 
           alias_prefix = mkOption {
             type = nullOr str;
             default = null;
-            description = "The user_friendly_names prefix to use for this device type, instead of the default mpath";
+            description = lib.mdDoc "The user_friendly_names prefix to use for this device type, instead of the default mpath";
           };
 
           vpd_vendor = mkOption {
             type = nullOr str;
             default = null;
-            description = "The vendor specific vpd page information, using the vpd page abbreviation";
+            description = lib.mdDoc "The vendor specific vpd page information, using the vpd page abbreviation";
           };
 
           hardware_handler = mkOption {
             type = nullOr (enum [ "emc" "rdac" "hp_sw" "alua" "ana" ]);
             default = null;
-            description = "The hardware handler to use for this device type";
+            description = lib.mdDoc "The hardware handler to use for this device type";
           };
 
           # Optional arguments
           path_grouping_policy = mkOption {
             type = nullOr (enum [ "failover" "multibus" "group_by_serial" "group_by_prio" "group_by_node_name" ]);
             default = null; # real default: "failover"
-            description = "The default path grouping policy to apply to unspecified multipaths";
+            description = lib.mdDoc "The default path grouping policy to apply to unspecified multipaths";
           };
 
           uid_attribute = mkOption {
             type = nullOr str;
             default = null;
-            description = "The udev attribute providing a unique path identifier (WWID)";
+            description = lib.mdDoc "The udev attribute providing a unique path identifier (WWID)";
           };
 
           getuid_callout = mkOption {
             type = nullOr str;
             default = null;
-            description = ''
+            description = lib.mdDoc ''
               (Superseded by uid_attribute) The default program and args to callout
               to obtain a unique path identifier. Should be specified with an absolute path.
             '';
@@ -123,13 +123,13 @@ in {
               ''"historical-service-time 0"''
             ]);
             default = null; # real default: "service-time 0"
-            description = "The default path selector algorithm to use; they are offered by the kernel multipath target";
+            description = lib.mdDoc "The default path selector algorithm to use; they are offered by the kernel multipath target";
           };
 
           path_checker = mkOption {
             type = enum [ "readsector0" "tur" "emc_clariion" "hp_sw" "rdac" "directio" "cciss_tur" "none" ];
             default = "tur";
-            description = "The default method used to determine the paths state";
+            description = lib.mdDoc "The default method used to determine the paths state";
           };
 
           prio = mkOption {
@@ -138,31 +138,31 @@ in {
               "random" "weightedpath" "path_latency" "ana" "datacore" "iet"
             ]);
             default = null; # real default: "const"
-            description = "The name of the path priority routine";
+            description = lib.mdDoc "The name of the path priority routine";
           };
 
           prio_args = mkOption {
             type = nullOr str;
             default = null;
-            description = "Arguments to pass to to the prio function";
+            description = lib.mdDoc "Arguments to pass to to the prio function";
           };
 
           features = mkOption {
             type = nullOr str;
             default = null;
-            description = "Specify any device-mapper features to be used";
+            description = lib.mdDoc "Specify any device-mapper features to be used";
           };
 
           failback = mkOption {
             type = nullOr str;
             default = null; # real default: "manual"
-            description = "Tell multipathd how to manage path group failback. Quote integers as strings";
+            description = lib.mdDoc "Tell multipathd how to manage path group failback. Quote integers as strings";
           };
 
           rr_weight = mkOption {
             type = nullOr (enum [ "priorities" "uniform" ]);
             default = null; # real default: "uniform"
-            description = ''
+            description = lib.mdDoc ''
               If set to priorities the multipath configurator will assign path weights
               as "path prio * rr_min_io".
             '';
@@ -171,13 +171,13 @@ in {
           no_path_retry = mkOption {
             type = nullOr str;
             default = null; # real default: "fail"
-            description = "Specify what to do when all paths are down. Quote integers as strings";
+            description = lib.mdDoc "Specify what to do when all paths are down. Quote integers as strings";
           };
 
           rr_min_io = mkOption {
             type = nullOr int;
             default = null; # real default: 1000
-            description = ''
+            description = lib.mdDoc ''
               Number of I/O requests to route to a path before switching to the next in the
               same path group. This is only for Block I/O (BIO) based multipath and
               only apply to round-robin path_selector.
@@ -187,7 +187,7 @@ in {
           rr_min_io_rq = mkOption {
             type = nullOr int;
             default = null; # real default: 1
-            description = ''
+            description = lib.mdDoc ''
               Number of I/O requests to route to a path before switching to the next in the
               same path group. This is only for Request based multipath and
               only apply to round-robin path_selector.
@@ -197,7 +197,7 @@ in {
           fast_io_fail_tmo = mkOption {
             type = nullOr str;
             default = null; # real default: 5
-            description = ''
+            description = lib.mdDoc ''
               Specify the number of seconds the SCSI layer will wait after a problem has been
               detected on a FC remote port before failing I/O to devices on that remote port.
               This should be smaller than dev_loss_tmo. Setting this to "off" will disable
@@ -208,7 +208,7 @@ in {
           dev_loss_tmo = mkOption {
             type = nullOr str;
             default = null; # real default: 600
-            description = ''
+            description = lib.mdDoc ''
               Specify the number of seconds the SCSI layer will wait after a problem has
               been detected on a FC remote port before removing it from the system. This
               can be set to "infinity" which sets it to the max value of 2147483647
@@ -224,7 +224,7 @@ in {
           flush_on_last_del = mkOption {
             type = nullOr (enum [ "yes" "no" ]);
             default = null; # real default: "no"
-            description = ''
+            description = lib.mdDoc ''
               If set to "yes" multipathd will disable queueing when the last path to a
               device has been deleted.
             '';
@@ -233,7 +233,7 @@ in {
           user_friendly_names = mkOption {
             type = nullOr (enum [ "yes" "no" ]);
             default = null; # real default: "no"
-            description = ''
+            description = lib.mdDoc ''
               If set to "yes", using the bindings file /etc/multipath/bindings
               to assign a persistent and unique alias to the multipath, in the
               form of mpath. If set to "no" use the WWID as the alias. In either
@@ -245,7 +245,7 @@ in {
           detect_prio = mkOption {
             type = nullOr (enum [ "yes" "no" ]);
             default = null; # real default: "yes"
-            description = ''
+            description = lib.mdDoc ''
               If set to "yes", multipath will try to detect if the device supports
               SCSI-3 ALUA. If so, the device will automatically use the sysfs
               prioritizer if the required sysf attributes access_state and
@@ -257,7 +257,7 @@ in {
           detect_checker = mkOption {
             type = nullOr (enum [ "yes" "no" ]);
             default = null; # real default: "yes"
-            description = ''
+            description = lib.mdDoc ''
               If set to "yes", multipath will try to detect if the device supports
               SCSI-3 ALUA. If so, the device will automatically use the tur checker.
               If set to "no", the checker will be selected as usual.
@@ -267,7 +267,7 @@ in {
           deferred_remove = mkOption {
             type = nullOr (enum [ "yes" "no" ]);
             default = null; # real default: "no"
-            description = ''
+            description = lib.mdDoc ''
               If set to "yes", multipathd will do a deferred remove instead of a
               regular remove when the last path device has been deleted. This means
               that if the multipath device is still in use, it will be freed when
@@ -279,7 +279,7 @@ in {
           san_path_err_threshold = mkOption {
             type = nullOr str;
             default = null;
-            description = ''
+            description = lib.mdDoc ''
               If set to a value greater than 0, multipathd will watch paths and check
               how many times a path has been failed due to errors.If the number of
               failures on a particular path is greater then the san_path_err_threshold,
@@ -292,7 +292,7 @@ in {
           san_path_err_forget_rate = mkOption {
             type = nullOr str;
             default = null;
-            description = ''
+            description = lib.mdDoc ''
               If set to a value greater than 0, multipathd will check whether the path
               failures has exceeded the san_path_err_threshold within this many checks
               i.e san_path_err_forget_rate. If so we will not reinstante the path till
@@ -303,7 +303,7 @@ in {
           san_path_err_recovery_time = mkOption {
             type = nullOr str;
             default = null;
-            description = ''
+            description = lib.mdDoc ''
               If set to a value greater than 0, multipathd will make sure that when
               path failures has exceeded the san_path_err_threshold within
               san_path_err_forget_rate then the path will be placed in failed state
@@ -316,61 +316,61 @@ in {
           marginal_path_err_sample_time = mkOption {
             type = nullOr int;
             default = null;
-            description = "One of the four parameters of supporting path check based on accounting IO error such as intermittent error";
+            description = lib.mdDoc "One of the four parameters of supporting path check based on accounting IO error such as intermittent error";
           };
 
           marginal_path_err_rate_threshold = mkOption {
             type = nullOr int;
             default = null;
-            description = "The error rate threshold as a permillage (1/1000)";
+            description = lib.mdDoc "The error rate threshold as a permillage (1/1000)";
           };
 
           marginal_path_err_recheck_gap_time = mkOption {
             type = nullOr str;
             default = null;
-            description = "One of the four parameters of supporting path check based on accounting IO error such as intermittent error";
+            description = lib.mdDoc "One of the four parameters of supporting path check based on accounting IO error such as intermittent error";
           };
 
           marginal_path_double_failed_time = mkOption {
             type = nullOr str;
             default = null;
-            description = "One of the four parameters of supporting path check based on accounting IO error such as intermittent error";
+            description = lib.mdDoc "One of the four parameters of supporting path check based on accounting IO error such as intermittent error";
           };
 
           delay_watch_checks = mkOption {
             type = nullOr str;
             default = null;
-            description = "This option is deprecated, and mapped to san_path_err_forget_rate";
+            description = lib.mdDoc "This option is deprecated, and mapped to san_path_err_forget_rate";
           };
 
           delay_wait_checks = mkOption {
             type = nullOr str;
             default = null;
-            description = "This option is deprecated, and mapped to san_path_err_recovery_time";
+            description = lib.mdDoc "This option is deprecated, and mapped to san_path_err_recovery_time";
           };
 
           skip_kpartx = mkOption {
             type = nullOr (enum [ "yes" "no" ]);
             default = null; # real default: "no"
-            description = "If set to yes, kpartx will not automatically create partitions on the device";
+            description = lib.mdDoc "If set to yes, kpartx will not automatically create partitions on the device";
           };
 
           max_sectors_kb = mkOption {
             type = nullOr int;
             default = null;
-            description = "Sets the max_sectors_kb device parameter on all path devices and the multipath device to the specified value";
+            description = lib.mdDoc "Sets the max_sectors_kb device parameter on all path devices and the multipath device to the specified value";
           };
 
           ghost_delay = mkOption {
             type = nullOr int;
             default = null;
-            description = "Sets the number of seconds that multipath will wait after creating a device with only ghost paths before marking it ready for use in systemd";
+            description = lib.mdDoc "Sets the number of seconds that multipath will wait after creating a device with only ghost paths before marking it ready for use in systemd";
           };
 
           all_tg_pt = mkOption {
             type = nullOr str;
             default = null;
-            description = "Set the 'all targets ports' flag when registering keys with mpathpersist";
+            description = lib.mdDoc "Set the 'all targets ports' flag when registering keys with mpathpersist";
           };
 
         };
@@ -380,7 +380,7 @@ in {
     defaults = mkOption {
       type = nullOr str;
       default = null;
-      description = ''
+      description = lib.mdDoc ''
         This section defines default values for attributes which are used
         whenever no values are given in the appropriate device or multipath
         sections.
@@ -390,7 +390,7 @@ in {
     blacklist = mkOption {
       type = nullOr str;
       default = null;
-      description = ''
+      description = lib.mdDoc ''
         This section defines which devices should be excluded from the
         multipath topology discovery.
       '';
@@ -399,7 +399,7 @@ in {
     blacklist_exceptions = mkOption {
       type = nullOr str;
       default = null;
-      description = ''
+      description = lib.mdDoc ''
         This section defines which devices should be included in the
         multipath topology discovery, despite being listed in the
         blacklist section.
@@ -409,7 +409,7 @@ in {
     overrides = mkOption {
       type = nullOr str;
       default = null;
-      description = ''
+      description = lib.mdDoc ''
         This section defines values for attributes that should override the
         device-specific settings for all devices.
       '';
@@ -418,13 +418,13 @@ in {
     extraConfig = mkOption {
       type = nullOr str;
       default = null;
-      description = "Lines to append to default multipath.conf";
+      description = lib.mdDoc "Lines to append to default multipath.conf";
     };
 
     extraConfigFile = mkOption {
       type = nullOr str;
       default = null;
-      description = "Append an additional file's contents to /etc/multipath.conf";
+      description = lib.mdDoc "Append an additional file's contents to /etc/multipath.conf";
     };
 
     pathGroups = mkOption {
@@ -439,7 +439,7 @@ in {
           }, ...
         ]
       '';
-      description = ''
+      description = lib.mdDoc ''
         This option allows you to define multipath groups as described
         in http://christophe.varoqui.free.fr/usage.html.
       '';
@@ -449,34 +449,34 @@ in {
           alias = mkOption {
             type = int;
             example = 1001234;
-            description = "The name of the multipath device";
+            description = lib.mdDoc "The name of the multipath device";
           };
 
           wwid = mkOption {
             type = hexStr;
             example = "360080e500043b35c0123456789abcdef";
-            description = "The identifier for the multipath device";
+            description = lib.mdDoc "The identifier for the multipath device";
           };
 
           array = mkOption {
             type = str;
             default = null;
             example = "bigarray.example.com";
-            description = "The DNS name of the storage array";
+            description = lib.mdDoc "The DNS name of the storage array";
           };
 
           fsType = mkOption {
             type = nullOr str;
             default = null;
             example = "zfs";
-            description = "Type of the filesystem";
+            description = lib.mdDoc "Type of the filesystem";
           };
 
           options = mkOption {
             type = nullOr str;
             default = null;
             example = "ro";
-            description = "Options used to mount the file system";
+            description = lib.mdDoc "Options used to mount the file system";
           };
 
         };
diff --git a/nixos/modules/services/networking/murmur.nix b/nixos/modules/services/networking/murmur.nix
index 84b9936aa623..3bff9faa6a36 100644
--- a/nixos/modules/services/networking/murmur.nix
+++ b/nixos/modules/services/networking/murmur.nix
@@ -56,13 +56,13 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = "If enabled, start the Murmur Mumble server.";
+        description = lib.mdDoc "If enabled, start the Murmur Mumble server.";
       };
 
       openFirewall = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Open ports in the firewall for the Murmur Mumble server.
         '';
       };
@@ -70,17 +70,17 @@ in
       autobanAttempts = mkOption {
         type = types.int;
         default = 10;
-        description = ''
+        description = lib.mdDoc ''
           Number of attempts a client is allowed to make in
-          <literal>autobanTimeframe</literal> seconds, before being
-          banned for <literal>autobanTime</literal>.
+          `autobanTimeframe` seconds, before being
+          banned for `autobanTime`.
         '';
       };
 
       autobanTimeframe = mkOption {
         type = types.int;
         default = 120;
-        description = ''
+        description = lib.mdDoc ''
           Timeframe in which a client can connect without being banned
           for repeated attempts (in seconds).
         '';
@@ -89,51 +89,51 @@ in
       autobanTime = mkOption {
         type = types.int;
         default = 300;
-        description = "The amount of time an IP ban lasts (in seconds).";
+        description = lib.mdDoc "The amount of time an IP ban lasts (in seconds).";
       };
 
       logFile = mkOption {
         type = types.nullOr types.path;
         default = null;
         example = "/var/log/murmur/murmurd.log";
-        description = "Path to the log file for Murmur daemon. Empty means log to journald.";
+        description = lib.mdDoc "Path to the log file for Murmur daemon. Empty means log to journald.";
       };
 
       welcometext = mkOption {
         type = types.str;
         default = "";
-        description = "Welcome message for connected clients.";
+        description = lib.mdDoc "Welcome message for connected clients.";
       };
 
       port = mkOption {
         type = types.port;
         default = 64738;
-        description = "Ports to bind to (UDP and TCP).";
+        description = lib.mdDoc "Ports to bind to (UDP and TCP).";
       };
 
       hostName = mkOption {
         type = types.str;
         default = "";
-        description = "Host to bind to. Defaults binding on all addresses.";
+        description = lib.mdDoc "Host to bind to. Defaults binding on all addresses.";
       };
 
       package = mkOption {
         type = types.package;
         default = pkgs.murmur;
         defaultText = literalExpression "pkgs.murmur";
-        description = "Overridable attribute of the murmur package to use.";
+        description = lib.mdDoc "Overridable attribute of the murmur package to use.";
       };
 
       password = mkOption {
         type = types.str;
         default = "";
-        description = "Required password to join server, if specified.";
+        description = lib.mdDoc "Required password to join server, if specified.";
       };
 
       bandwidth = mkOption {
         type = types.int;
         default = 72000;
-        description = ''
+        description = lib.mdDoc ''
           Maximum bandwidth (in bits per second) that clients may send
           speech at.
         '';
@@ -142,25 +142,25 @@ in
       users = mkOption {
         type = types.int;
         default = 100;
-        description = "Maximum number of concurrent clients allowed.";
+        description = lib.mdDoc "Maximum number of concurrent clients allowed.";
       };
 
       textMsgLength = mkOption {
         type = types.int;
         default = 5000;
-        description = "Max length of text messages. Set 0 for no limit.";
+        description = lib.mdDoc "Max length of text messages. Set 0 for no limit.";
       };
 
       imgMsgLength = mkOption {
         type = types.int;
         default = 131072;
-        description = "Max length of image messages. Set 0 for no limit.";
+        description = lib.mdDoc "Max length of image messages. Set 0 for no limit.";
       };
 
       allowHtml = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Allow HTML in client messages, comments, and channel
           descriptions.
         '';
@@ -169,7 +169,7 @@ in
       logDays = mkOption {
         type = types.int;
         default = 31;
-        description = ''
+        description = lib.mdDoc ''
           How long to store RPC logs for in the database. Set 0 to
           keep logs forever, or -1 to disable DB logging.
         '';
@@ -178,7 +178,7 @@ in
       bonjour = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Enable Bonjour auto-discovery, which allows clients over
           your LAN to automatically discover Murmur servers.
         '';
@@ -187,13 +187,13 @@ in
       sendVersion = mkOption {
         type = types.bool;
         default = true;
-        description = "Send Murmur version in UDP response.";
+        description = lib.mdDoc "Send Murmur version in UDP response.";
       };
 
       registerName = mkOption {
         type = types.str;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           Public server registration name, and also the name of the
           Root channel. Even if you don't publicly register your
           server, you probably still want to set this.
@@ -203,7 +203,7 @@ in
       registerPassword = mkOption {
         type = types.str;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           Public server registry password, used authenticate your
           server to the registry to prevent impersonation; required for
           subsequent registry updates.
@@ -213,7 +213,7 @@ in
       registerUrl = mkOption {
         type = types.str;
         default = "";
-        description = "URL website for your server.";
+        description = lib.mdDoc "URL website for your server.";
       };
 
       registerHostname = mkOption {
@@ -230,31 +230,31 @@ in
       clientCertRequired = mkOption {
         type = types.bool;
         default = false;
-        description = "Require clients to authenticate via certificates.";
+        description = lib.mdDoc "Require clients to authenticate via certificates.";
       };
 
       sslCert = mkOption {
         type = types.str;
         default = "";
-        description = "Path to your SSL certificate.";
+        description = lib.mdDoc "Path to your SSL certificate.";
       };
 
       sslKey = mkOption {
         type = types.str;
         default = "";
-        description = "Path to your SSL key.";
+        description = lib.mdDoc "Path to your SSL key.";
       };
 
       sslCa = mkOption {
         type = types.str;
         default = "";
-        description = "Path to your SSL CA certificate.";
+        description = lib.mdDoc "Path to your SSL CA certificate.";
       };
 
       extraConfig = mkOption {
         type = types.lines;
         default = "";
-        description = "Extra configuration to put into murmur.ini.";
+        description = lib.mdDoc "Extra configuration to put into murmur.ini.";
       };
 
       environmentFile = mkOption {
diff --git a/nixos/modules/services/networking/mxisd.nix b/nixos/modules/services/networking/mxisd.nix
index 1509671bc54a..9ddc2094b6df 100644
--- a/nixos/modules/services/networking/mxisd.nix
+++ b/nixos/modules/services/networking/mxisd.nix
@@ -43,7 +43,7 @@ in {
         type = types.package;
         default = pkgs.ma1sd;
         defaultText = literalExpression "pkgs.ma1sd";
-        description = "The mxisd/ma1sd package to use";
+        description = lib.mdDoc "The mxisd/ma1sd package to use";
       };
 
       environmentFile = mkOption {
@@ -58,20 +58,20 @@ in {
       dataDir = mkOption {
         type = types.str;
         default = "/var/lib/mxisd";
-        description = "Where data mxisd/ma1sd uses resides";
+        description = lib.mdDoc "Where data mxisd/ma1sd uses resides";
       };
 
       extraConfig = mkOption {
         type = types.attrs;
         default = {};
-        description = "Extra options merged into the mxisd/ma1sd configuration";
+        description = lib.mdDoc "Extra options merged into the mxisd/ma1sd configuration";
       };
 
       matrix = {
 
         domain = mkOption {
           type = types.str;
-          description = ''
+          description = lib.mdDoc ''
             the domain of the matrix homeserver
           '';
         };
@@ -83,7 +83,7 @@ in {
         name = mkOption {
           type = types.nullOr types.str;
           default = null;
-          description = ''
+          description = lib.mdDoc ''
             Public hostname of mxisd/ma1sd, if different from the Matrix domain.
           '';
         };
@@ -91,7 +91,7 @@ in {
         port = mkOption {
           type = types.nullOr types.int;
           default = null;
-          description = ''
+          description = lib.mdDoc ''
             HTTP port to listen on (unencrypted)
           '';
         };
diff --git a/nixos/modules/services/networking/namecoind.nix b/nixos/modules/services/networking/namecoind.nix
index 8f7a5123f7e1..45a90741465a 100644
--- a/nixos/modules/services/networking/namecoind.nix
+++ b/nixos/modules/services/networking/namecoind.nix
@@ -49,7 +49,7 @@ in
       wallet = mkOption {
         type = types.path;
         default = "${dataDir}/wallet.dat";
-        description = ''
+        description = lib.mdDoc ''
           Wallet file. The ownership of the file has to be
           namecoin:namecoin, and the permissions must be 0640.
         '';
@@ -58,7 +58,7 @@ in
       generate = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to generate (mine) Namecoins.
         '';
       };
@@ -66,7 +66,7 @@ in
       extraNodes = mkOption {
         type = types.listOf types.str;
         default = [ ];
-        description = ''
+        description = lib.mdDoc ''
           List of additional peer IP addresses to connect to.
         '';
       };
@@ -74,7 +74,7 @@ in
       trustedNodes = mkOption {
         type = types.listOf types.str;
         default = [ ];
-        description = ''
+        description = lib.mdDoc ''
           List of the only peer IP addresses to connect to. If specified
           no other connection will be made.
         '';
@@ -83,7 +83,7 @@ in
       rpc.user = mkOption {
         type = types.nullOr types.str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           User name for RPC connections.
         '';
       };
@@ -91,7 +91,7 @@ in
       rpc.password = mkOption {
         type = types.nullOr types.str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Password for RPC connections.
         '';
       };
@@ -99,7 +99,7 @@ in
       rpc.address = mkOption {
         type = types.str;
         default = "0.0.0.0";
-        description = ''
+        description = lib.mdDoc ''
           IP address the RPC server will bind to.
         '';
       };
@@ -107,7 +107,7 @@ in
       rpc.port = mkOption {
         type = types.port;
         default = 8332;
-        description = ''
+        description = lib.mdDoc ''
           Port the RPC server will bind to.
         '';
       };
@@ -116,7 +116,7 @@ in
         type = types.nullOr types.path;
         default = null;
         example = "/var/lib/namecoind/server.cert";
-        description = ''
+        description = lib.mdDoc ''
           Certificate file for securing RPC connections.
         '';
       };
@@ -125,7 +125,7 @@ in
         type = types.nullOr types.path;
         default = null;
         example = "/var/lib/namecoind/server.pem";
-        description = ''
+        description = lib.mdDoc ''
           Key file for securing RPC connections.
         '';
       };
@@ -134,7 +134,7 @@ in
       rpc.allowFrom = mkOption {
         type = types.listOf types.str;
         default = [ "127.0.0.1" ];
-        description = ''
+        description = lib.mdDoc ''
           List of IP address ranges allowed to use the RPC API.
           Wiledcards (*) can be user to specify a range.
         '';
diff --git a/nixos/modules/services/networking/nar-serve.nix b/nixos/modules/services/networking/nar-serve.nix
index 745138186a20..09f019d41bb7 100644
--- a/nixos/modules/services/networking/nar-serve.nix
+++ b/nixos/modules/services/networking/nar-serve.nix
@@ -15,7 +15,7 @@ in
       port = mkOption {
         type = types.port;
         default = 8383;
-        description = ''
+        description = lib.mdDoc ''
           Port number where nar-serve will listen on.
         '';
       };
diff --git a/nixos/modules/services/networking/nat.nix b/nixos/modules/services/networking/nat.nix
index 2e58cd699b25..0eb9b158e686 100644
--- a/nixos/modules/services/networking/nat.nix
+++ b/nixos/modules/services/networking/nat.nix
@@ -136,7 +136,7 @@ in
       type = types.bool;
       default = false;
       description =
-        ''
+        lib.mdDoc ''
           Whether to enable Network Address Translation (NAT).
         '';
     };
@@ -145,7 +145,7 @@ in
       type = types.bool;
       default = false;
       description =
-        ''
+        lib.mdDoc ''
           Whether to enable IPv6 NAT.
         '';
     };
@@ -155,7 +155,7 @@ in
       default = [];
       example = [ "eth0" ];
       description =
-        ''
+        lib.mdDoc ''
           The interfaces for which to perform NAT. Packets coming from
           these interface and destined for the external interface will
           be rewritten.
@@ -167,7 +167,7 @@ in
       default = [];
       example = [ "192.168.1.0/24" ];
       description =
-        ''
+        lib.mdDoc ''
           The IP address ranges for which to perform NAT.  Packets
           coming from these addresses (on any interface) and destined
           for the external interface will be rewritten.
@@ -179,7 +179,7 @@ in
       default = [];
       example = [ "fc00::/64" ];
       description =
-        ''
+        lib.mdDoc ''
           The IPv6 address ranges for which to perform NAT.  Packets
           coming from these addresses (on any interface) and destined
           for the external interface will be rewritten.
@@ -191,7 +191,7 @@ in
       default = null;
       example = "eth1";
       description =
-        ''
+        lib.mdDoc ''
           The name of the external network interface.
         '';
     };
@@ -201,7 +201,7 @@ in
       default = null;
       example = "203.0.113.123";
       description =
-        ''
+        lib.mdDoc ''
           The public IP address to which packets from the local
           network are to be rewritten.  If this is left empty, the
           IP address associated with the external interface will be
@@ -214,7 +214,7 @@ in
       default = null;
       example = "2001:dc0:2001:11::175";
       description =
-        ''
+        lib.mdDoc ''
           The public IPv6 address to which packets from the local
           network are to be rewritten.  If this is left empty, the
           IP address associated with the external interface will be
@@ -228,27 +228,27 @@ in
           sourcePort = mkOption {
             type = types.either types.int (types.strMatching "[[:digit:]]+:[[:digit:]]+");
             example = 8080;
-            description = "Source port of the external interface; to specify a port range, use a string with a colon (e.g. \"60000:61000\")";
+            description = lib.mdDoc "Source port of the external interface; to specify a port range, use a string with a colon (e.g. \"60000:61000\")";
           };
 
           destination = mkOption {
             type = types.str;
             example = "10.0.0.1:80";
-            description = "Forward connection to destination ip:port (or [ipv6]:port); to specify a port range, use ip:start-end";
+            description = lib.mdDoc "Forward connection to destination ip:port (or [ipv6]:port); to specify a port range, use ip:start-end";
           };
 
           proto = mkOption {
             type = types.str;
             default = "tcp";
             example = "udp";
-            description = "Protocol of forwarded connection";
+            description = lib.mdDoc "Protocol of forwarded connection";
           };
 
           loopbackIPs = mkOption {
             type = types.listOf types.str;
             default = [];
             example = literalExpression ''[ "55.1.2.3" ]'';
-            description = "Public IPs for NAT reflection; for connections to `loopbackip:sourcePort' from the host itself and from other hosts behind NAT";
+            description = lib.mdDoc "Public IPs for NAT reflection; for connections to `loopbackip:sourcePort' from the host itself and from other hosts behind NAT";
           };
         };
       });
@@ -258,7 +258,7 @@ in
         { sourcePort = 8080; destination = "[fc00::2]:80"; proto = "tcp"; }
       ];
       description =
-        ''
+        lib.mdDoc ''
           List of forwarded ports from the external interface to
           internal destinations by using DNAT. Destination can be
           IPv6 if IPv6 NAT is enabled.
@@ -270,7 +270,7 @@ in
       default = null;
       example = "10.0.0.1";
       description =
-        ''
+        lib.mdDoc ''
           The local IP address to which all traffic that does not match any
           forwarding rule is forwarded.
         '';
@@ -281,7 +281,7 @@ in
       default = "";
       example = "iptables -A INPUT -p icmp -j ACCEPT";
       description =
-        ''
+        lib.mdDoc ''
           Additional shell commands executed as part of the nat
           initialisation script.
         '';
@@ -292,7 +292,7 @@ in
       default = "";
       example = "iptables -D INPUT -p icmp -j ACCEPT || true";
       description =
-        ''
+        lib.mdDoc ''
           Additional shell commands executed as part of the nat
           teardown script.
         '';
diff --git a/nixos/modules/services/networking/nats.nix b/nixos/modules/services/networking/nats.nix
index 3e86a4f07bc7..41e38add69fe 100644
--- a/nixos/modules/services/networking/nats.nix
+++ b/nixos/modules/services/networking/nats.nix
@@ -21,20 +21,20 @@ in {
       user = mkOption {
         type = types.str;
         default = "nats";
-        description = "User account under which NATS runs.";
+        description = lib.mdDoc "User account under which NATS runs.";
       };
 
       group = mkOption {
         type = types.str;
         default = "nats";
-        description = "Group under which NATS runs.";
+        description = lib.mdDoc "Group under which NATS runs.";
       };
 
       serverName = mkOption {
         default = "nats";
         example = "n1-c3";
         type = types.str;
-        description = ''
+        description = lib.mdDoc ''
           Name of the NATS server, must be unique if clustered.
         '';
       };
@@ -44,7 +44,7 @@ in {
       port = mkOption {
         default = 4222;
         type = types.port;
-        description = ''
+        description = lib.mdDoc ''
           Port on which to listen.
         '';
       };
@@ -52,7 +52,7 @@ in {
       dataDir = mkOption {
         default = "/var/lib/nats";
         type = types.path;
-        description = ''
+        description = lib.mdDoc ''
           The NATS data directory. Only used if JetStream is enabled, for
           storing stream metadata and messages.
 
@@ -74,10 +74,10 @@ in {
             };
           };
         '';
-        description = ''
+        description = lib.mdDoc ''
           Declarative NATS configuration. See the
-          <link xlink:href="https://docs.nats.io/nats-server/configuration">
-          NATS documentation</link> for a list of options.
+          [
+          NATS documentation](https://docs.nats.io/nats-server/configuration) for a list of options.
         '';
       };
     };
diff --git a/nixos/modules/services/networking/nbd.nix b/nixos/modules/services/networking/nbd.nix
index df3358f51876..3a813d10257d 100644
--- a/nixos/modules/services/networking/nbd.nix
+++ b/nixos/modules/services/networking/nbd.nix
@@ -48,7 +48,7 @@ in
         listenPort = mkOption {
           type = types.port;
           default = 10809;
-          description = "Port to listen on. The port is NOT automatically opened in the firewall.";
+          description = lib.mdDoc "Port to listen on. The port is NOT automatically opened in the firewall.";
         };
 
         extraOptions = mkOption {
@@ -64,14 +64,14 @@ in
         };
 
         exports = mkOption {
-          description = "Files or block devices to make available over the network.";
+          description = lib.mdDoc "Files or block devices to make available over the network.";
           default = { };
           type = with types; attrsOf
             (submodule {
               options = {
                 path = mkOption {
                   type = str;
-                  description = "File or block device to export.";
+                  description = lib.mdDoc "File or block device to export.";
                   example = "/dev/sdb1";
                 };
 
@@ -79,7 +79,7 @@ in
                   type = nullOr (listOf str);
                   default = null;
                   example = [ "10.10.0.0/24" "127.0.0.1" ];
-                  description = "IPs and subnets that are authorized to connect for this device. If not specified, the server will allow all connections.";
+                  description = lib.mdDoc "IPs and subnets that are authorized to connect for this device. If not specified, the server will allow all connections.";
                 };
 
                 extraOptions = mkOption {
@@ -100,7 +100,7 @@ in
 
         listenAddress = mkOption {
           type = with types; nullOr str;
-          description = "Address to listen on. If not specified, the server will listen on all interfaces.";
+          description = lib.mdDoc "Address to listen on. If not specified, the server will listen on all interfaces.";
           default = null;
           example = "10.10.0.1";
         };
diff --git a/nixos/modules/services/networking/ncdns.nix b/nixos/modules/services/networking/ncdns.nix
index c8d1b6718e2e..8ee787b7d797 100644
--- a/nixos/modules/services/networking/ncdns.nix
+++ b/nixos/modules/services/networking/ncdns.nix
@@ -59,7 +59,7 @@ in
       address = mkOption {
         type = types.str;
         default = "[::1]";
-        description = ''
+        description = lib.mdDoc ''
           The IP address the ncdns resolver will bind to.  Leave this unchanged
           if you do not wish to directly expose the resolver.
         '';
@@ -68,7 +68,7 @@ in
       port = mkOption {
         type = types.port;
         default = 5333;
-        description = ''
+        description = lib.mdDoc ''
           The port the ncdns resolver will bind to.
         '';
       };
@@ -96,7 +96,7 @@ in
         type = types.str;
         default = "";
         example = "root@example.com";
-        description = ''
+        description = lib.mdDoc ''
           An email address for the SOA record at the bit zone.
           If you are only using ncdns locally you can ignore this.
         '';
@@ -105,9 +105,9 @@ in
       identity.address = mkOption {
         type = types.str;
         default = "127.127.127.127";
-        description = ''
+        description = lib.mdDoc ''
           The IP address the hostname specified in
-          <option>services.ncdns.identity.hostname</option> should resolve to.
+          {option}`services.ncdns.identity.hostname` should resolve to.
           If you are only using ncdns locally you can ignore this.
         '';
       };
@@ -136,7 +136,7 @@ in
       dnssec.keys.private = mkOption {
         type = types.path;
         default = defaultFiles.private;
-        description = ''
+        description = lib.mdDoc ''
           Path to the file containing the KSK private key.
         '';
       };
@@ -157,7 +157,7 @@ in
       dnssec.keys.zonePrivate = mkOption {
         type = types.path;
         default = defaultFiles.zonePrivate;
-        description = ''
+        description = lib.mdDoc ''
           Path to the file containing the ZSK private key.
         '';
       };
@@ -189,8 +189,8 @@ in
     services.pdns-recursor.resolveNamecoin = mkOption {
       type = types.bool;
       default = false;
-      description = ''
-        Resolve <literal>.bit</literal> top-level domains using ncdns and namecoin.
+      description = lib.mdDoc ''
+        Resolve `.bit` top-level domains using ncdns and namecoin.
       '';
     };
 
diff --git a/nixos/modules/services/networking/ndppd.nix b/nixos/modules/services/networking/ndppd.nix
index 6046ac860cfa..ed97fe233b8a 100644
--- a/nixos/modules/services/networking/ndppd.nix
+++ b/nixos/modules/services/networking/ndppd.nix
@@ -26,7 +26,7 @@ let
     options = {
       interface = mkOption {
         type = types.nullOr types.str;
-        description = ''
+        description = lib.mdDoc ''
           Listen for any Neighbor Solicitation messages on this interface,
           and respond to them according to a set of rules.
           Defaults to the name of the attrset.
@@ -35,14 +35,14 @@ let
       };
       router = mkOption {
         type = types.bool;
-        description = ''
+        description = lib.mdDoc ''
           Turns on or off the router flag for Neighbor Advertisement Messages.
         '';
         default = true;
       };
       timeout = mkOption {
         type = types.int;
-        description = ''
+        description = lib.mdDoc ''
           Controls how long to wait for a Neighbor Advertisment Message before
           invalidating the entry, in milliseconds.
         '';
@@ -50,7 +50,7 @@ let
       };
       ttl = mkOption {
         type = types.int;
-        description = ''
+        description = lib.mdDoc ''
           Controls how long a valid or invalid entry remains in the cache, in
           milliseconds.
         '';
@@ -58,7 +58,7 @@ let
       };
       rules = mkOption {
         type = types.attrsOf rule;
-        description = ''
+        description = lib.mdDoc ''
           This is a rule that the target address is to match against. If no netmask
           is provided, /128 is assumed. You may have several rule sections, and the
           addresses may or may not overlap.
@@ -72,7 +72,7 @@ let
     options = {
       network = mkOption {
         type = types.nullOr types.str;
-        description = ''
+        description = lib.mdDoc ''
           This is the target address is to match against. If no netmask
           is provided, /128 is assumed. The addresses of serveral rules
           may or may not overlap.
@@ -82,7 +82,7 @@ let
       };
       method = mkOption {
         type = types.enum [ "static" "iface" "auto" ];
-        description = ''
+        description = lib.mdDoc ''
           static: Immediately answer any Neighbor Solicitation Messages
             (if they match the IP rule).
           iface: Forward the Neighbor Solicitation Message through the specified
@@ -95,7 +95,7 @@ let
       };
       interface = mkOption {
         type = types.nullOr types.str;
-        description = "Interface to use when method is iface.";
+        description = lib.mdDoc "Interface to use when method is iface.";
         default = null;
       };
     };
@@ -124,12 +124,12 @@ in {
     };
     configFile = mkOption {
       type = types.nullOr types.path;
-      description = "Path to configuration file.";
+      description = lib.mdDoc "Path to configuration file.";
       default = null;
     };
     routeTTL = mkOption {
       type = types.int;
-      description = ''
+      description = lib.mdDoc ''
         This tells 'ndppd' how often to reload the route file /proc/net/ipv6_route,
         in milliseconds.
       '';
@@ -137,7 +137,7 @@ in {
     };
     proxies = mkOption {
       type = types.attrsOf proxy;
-      description = ''
+      description = lib.mdDoc ''
         This sets up a listener, that will listen for any Neighbor Solicitation
         messages, and respond to them according to a set of rules.
       '';
diff --git a/nixos/modules/services/networking/nebula.nix b/nixos/modules/services/networking/nebula.nix
index c83cd9d521c6..2bedafc5d9fe 100644
--- a/nixos/modules/services/networking/nebula.nix
+++ b/nixos/modules/services/networking/nebula.nix
@@ -17,45 +17,45 @@ in
   options = {
     services.nebula = {
       networks = mkOption {
-        description = "Nebula network definitions.";
+        description = lib.mdDoc "Nebula network definitions.";
         default = {};
         type = types.attrsOf (types.submodule {
           options = {
             enable = mkOption {
               type = types.bool;
               default = true;
-              description = "Enable or disable this network.";
+              description = lib.mdDoc "Enable or disable this network.";
             };
 
             package = mkOption {
               type = types.package;
               default = pkgs.nebula;
               defaultText = literalExpression "pkgs.nebula";
-              description = "Nebula derivation to use.";
+              description = lib.mdDoc "Nebula derivation to use.";
             };
 
             ca = mkOption {
               type = types.path;
-              description = "Path to the certificate authority certificate.";
+              description = lib.mdDoc "Path to the certificate authority certificate.";
               example = "/etc/nebula/ca.crt";
             };
 
             cert = mkOption {
               type = types.path;
-              description = "Path to the host certificate.";
+              description = lib.mdDoc "Path to the host certificate.";
               example = "/etc/nebula/host.crt";
             };
 
             key = mkOption {
               type = types.path;
-              description = "Path to the host key.";
+              description = lib.mdDoc "Path to the host key.";
               example = "/etc/nebula/host.key";
             };
 
             staticHostMap = mkOption {
               type = types.attrsOf (types.listOf (types.str));
               default = {};
-              description = ''
+              description = lib.mdDoc ''
                 The static host map defines a set of hosts with fixed IP addresses on the internet (or any network).
                 A host can have multiple fixed IP addresses defined here, and nebula will try each when establishing a tunnel.
               '';
@@ -65,13 +65,13 @@ in
             isLighthouse = mkOption {
               type = types.bool;
               default = false;
-              description = "Whether this node is a lighthouse.";
+              description = lib.mdDoc "Whether this node is a lighthouse.";
             };
 
             lighthouses = mkOption {
               type = types.listOf types.str;
               default = [];
-              description = ''
+              description = lib.mdDoc ''
                 List of IPs of lighthouse hosts this node should report to and query from. This should be empty on lighthouse
                 nodes. The IPs should be the lighthouse's Nebula IPs, not their external IPs.
               '';
@@ -81,19 +81,19 @@ in
             listen.host = mkOption {
               type = types.str;
               default = "0.0.0.0";
-              description = "IP address to listen on.";
+              description = lib.mdDoc "IP address to listen on.";
             };
 
             listen.port = mkOption {
               type = types.port;
               default = 4242;
-              description = "Port number to listen on.";
+              description = lib.mdDoc "Port number to listen on.";
             };
 
             tun.disable = mkOption {
               type = types.bool;
               default = false;
-              description = ''
+              description = lib.mdDoc ''
                 When tun is disabled, a lighthouse can be started without a local tun interface (and therefore without root).
               '';
             };
@@ -101,29 +101,29 @@ in
             tun.device = mkOption {
               type = types.nullOr types.str;
               default = null;
-              description = "Name of the tun device. Defaults to nebula.\${networkName}.";
+              description = lib.mdDoc "Name of the tun device. Defaults to nebula.\${networkName}.";
             };
 
             firewall.outbound = mkOption {
               type = types.listOf types.attrs;
               default = [];
-              description = "Firewall rules for outbound traffic.";
+              description = lib.mdDoc "Firewall rules for outbound traffic.";
               example = [ { port = "any"; proto = "any"; host = "any"; } ];
             };
 
             firewall.inbound = mkOption {
               type = types.listOf types.attrs;
               default = [];
-              description = "Firewall rules for inbound traffic.";
+              description = lib.mdDoc "Firewall rules for inbound traffic.";
               example = [ { port = "any"; proto = "any"; host = "any"; } ];
             };
 
             settings = mkOption {
               type = format.type;
               default = {};
-              description = ''
+              description = lib.mdDoc ''
                 Nebula configuration. Refer to
-                <link xlink:href="https://github.com/slackhq/nebula/blob/master/examples/config.yml"/>
+                <https://github.com/slackhq/nebula/blob/master/examples/config.yml>
                 for details on supported values.
               '';
               example = literalExpression ''
diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix
index 242afd548df3..7abdf16b1534 100644
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@@ -157,10 +157,10 @@ in {
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to use NetworkManager to obtain an IP address and other
           configuration for all network interfaces that are not manually
-          configured. If enabled, a group <literal>networkmanager</literal>
+          configured. If enabled, a group `networkmanager`
           will be created. Add all users that should have permission
           to change network settings to this group.
         '';
@@ -243,7 +243,7 @@ in {
           in
           types.listOf networkManagerPluginPackage;
         default = [ ];
-        description = ''
+        description = lib.mdDoc ''
           List of NetworkManager plug-ins to enable.
           Some plug-ins are enabled by the NetworkManager module by default.
         '';
@@ -252,7 +252,7 @@ in {
       dhcp = mkOption {
         type = types.enum [ "dhcpcd" "internal" ];
         default = "internal";
-        description = ''
+        description = lib.mdDoc ''
           Which program (or internal library) should be used for DHCP.
         '';
       };
@@ -260,7 +260,7 @@ in {
       firewallBackend = mkOption {
         type = types.enum [ "iptables" "nftables" "none" ];
         default = "iptables";
-        description = ''
+        description = lib.mdDoc ''
           Which firewall backend should be used for configuring masquerading with shared mode.
           If set to none, NetworkManager doesn't manage the configuration at all.
         '';
@@ -269,7 +269,7 @@ in {
       logLevel = mkOption {
         type = types.enum [ "OFF" "ERR" "WARN" "INFO" "DEBUG" "TRACE" ];
         default = "WARN";
-        description = ''
+        description = lib.mdDoc ''
           Set the default logging verbosity level.
         '';
       };
@@ -277,7 +277,7 @@ in {
       appendNameservers = mkOption {
         type = types.listOf types.str;
         default = [];
-        description = ''
+        description = lib.mdDoc ''
           A list of name servers that should be appended
           to the ones configured in NetworkManager or received by DHCP.
         '';
@@ -286,7 +286,7 @@ in {
       insertNameservers = mkOption {
         type = types.listOf types.str;
         default = [];
-        description = ''
+        description = lib.mdDoc ''
           A list of name servers that should be inserted before
           the ones configured in NetworkManager or received by DHCP.
         '';
@@ -300,16 +300,16 @@ in {
         backend = mkOption {
           type = types.enum [ "wpa_supplicant" "iwd" ];
           default = "wpa_supplicant";
-          description = ''
+          description = lib.mdDoc ''
             Specify the Wi-Fi backend used for the device.
-            Currently supported are <option>wpa_supplicant</option> or <option>iwd</option> (experimental).
+            Currently supported are {option}`wpa_supplicant` or {option}`iwd` (experimental).
           '';
         };
 
         powersave = mkOption {
           type = types.nullOr types.bool;
           default = null;
-          description = ''
+          description = lib.mdDoc ''
             Whether to enable Wi-Fi power saving.
           '';
         };
@@ -317,7 +317,7 @@ in {
         scanRandMacAddress = mkOption {
           type = types.bool;
           default = true;
-          description = ''
+          description = lib.mdDoc ''
             Whether to enable MAC address randomization of a Wi-Fi device
             during scanning.
           '';
@@ -348,7 +348,7 @@ in {
           options = {
             source = mkOption {
               type = types.path;
-              description = ''
+              description = lib.mdDoc ''
                 Path to the hook script.
               '';
             };
@@ -380,7 +380,7 @@ in {
             ''';
             type = "basic";
         } ]'';
-        description = ''
+        description = lib.mdDoc ''
           A list of scripts which will be executed in response to  network  events.
         '';
       };
@@ -401,10 +401,10 @@ in {
       enableFccUnlock = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Enable FCC unlock procedures. Since release 1.18.4, the ModemManager daemon no longer
           automatically performs the FCC unlock procedure by default. See
-          <link xlink:href="https://modemmanager.org/docs/modemmanager/fcc-unlock/">the docs</link>
+          [the docs](https://modemmanager.org/docs/modemmanager/fcc-unlock/)
           for more details.
         '';
       };
diff --git a/nixos/modules/services/networking/nextdns.nix b/nixos/modules/services/networking/nextdns.nix
index b070eeec894f..697fa605049e 100644
--- a/nixos/modules/services/networking/nextdns.nix
+++ b/nixos/modules/services/networking/nextdns.nix
@@ -10,13 +10,13 @@ in {
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = "Whether to enable the NextDNS DNS/53 to DoH Proxy service.";
+        description = lib.mdDoc "Whether to enable the NextDNS DNS/53 to DoH Proxy service.";
       };
       arguments = mkOption {
         type = types.listOf types.str;
         default = [];
         example = [ "-config" "10.0.3.0/24=abcdef" ];
-        description = "Additional arguments to be passed to nextdns run.";
+        description = lib.mdDoc "Additional arguments to be passed to nextdns run.";
       };
     };
   };
diff --git a/nixos/modules/services/networking/nftables.nix b/nixos/modules/services/networking/nftables.nix
index b911f97491eb..4e7d5ce59ce8 100644
--- a/nixos/modules/services/networking/nftables.nix
+++ b/nixos/modules/services/networking/nftables.nix
@@ -77,7 +77,7 @@ in
         }
       '';
       description =
-        ''
+        lib.mdDoc ''
           The ruleset to be used with nftables.  Should be in a format that
           can be loaded using "/bin/nft -f".  The ruleset is updated atomically.
         '';
@@ -90,7 +90,7 @@ in
       };
       defaultText = literalDocBook ''a file with the contents of <option>networking.nftables.ruleset</option>'';
       description =
-        ''
+        lib.mdDoc ''
           The ruleset file to be used with nftables.  Should be in a format that
           can be loaded using "nft -f".  The ruleset is updated atomically.
         '';
diff --git a/nixos/modules/services/networking/nghttpx/backend-params-submodule.nix b/nixos/modules/services/networking/nghttpx/backend-params-submodule.nix
index 6523f4b8b9e0..510dc02b5c9f 100644
--- a/nixos/modules/services/networking/nghttpx/backend-params-submodule.nix
+++ b/nixos/modules/services/networking/nghttpx/backend-params-submodule.nix
@@ -3,7 +3,7 @@
     proto = lib.mkOption {
       type        = lib.types.enum [ "h2" "http/1.1" ];
       default     = "http/1.1";
-      description = ''
+      description = lib.mdDoc ''
         This option configures the protocol the backend server expects
         to use.
 
@@ -15,7 +15,7 @@
     tls = lib.mkOption {
       type        = lib.types.bool;
       default     = false;
-      description = ''
+      description = lib.mdDoc ''
         This option determines whether nghttpx will negotiate its
         connection with a backend server using TLS or not. The burden
         is on the backend server to provide the TLS certificate!
@@ -28,7 +28,7 @@
     sni = lib.mkOption {
       type        = lib.types.nullOr lib.types.str;
       default     = null;
-      description = ''
+      description = lib.mdDoc ''
         Override the TLS SNI field value. This value (in nghttpx)
         defaults to the host value of the backend configuration.
 
@@ -40,7 +40,7 @@
     fall = lib.mkOption {
       type        = lib.types.int;
       default     = 0;
-      description = ''
+      description = lib.mdDoc ''
         If nghttpx cannot connect to the backend N times in a row, the
         backend is assumed to be offline and is excluded from load
         balancing. If N is 0 the backend is never excluded from load
@@ -54,7 +54,7 @@
     rise = lib.mkOption {
       type        = lib.types.int;
       default     = 0;
-      description = ''
+      description = lib.mdDoc ''
         If the backend is excluded from load balancing, nghttpx will
         periodically attempt to make a connection to the backend. If
         the connection is successful N times in a row the backend is
@@ -69,7 +69,7 @@
     affinity = lib.mkOption {
       type        = lib.types.enum [ "ip" "none" ];
       default     = "none";
-      description = ''
+      description = lib.mdDoc ''
         If "ip" is given, client IP based session affinity is
         enabled. If "none" is given, session affinity is disabled.
 
@@ -91,7 +91,7 @@
     dns = lib.mkOption {
       type        = lib.types.bool;
       default     = false;
-      description = ''
+      description = lib.mdDoc ''
         Name resolution of a backends host name is done at start up,
         or configuration reload. If "dns" is true, name resolution
         takes place dynamically.
@@ -108,7 +108,7 @@
     redirect-if-not-tls = lib.mkOption {
       type        = lib.types.bool;
       default     = false;
-      description = ''
+      description = lib.mdDoc ''
         If true, a backend match requires the frontend connection be
         TLS encrypted. If it is not, nghttpx responds to the request
         with a 308 status code and https URI the client should use
diff --git a/nixos/modules/services/networking/nghttpx/frontend-params-submodule.nix b/nixos/modules/services/networking/nghttpx/frontend-params-submodule.nix
index 33c8572bd14f..66c6d7efa6a0 100644
--- a/nixos/modules/services/networking/nghttpx/frontend-params-submodule.nix
+++ b/nixos/modules/services/networking/nghttpx/frontend-params-submodule.nix
@@ -3,7 +3,7 @@
     tls = lib.mkOption {
       type        = lib.types.enum [ "tls" "no-tls" ];
       default     = "tls";
-      description = ''
+      description = lib.mdDoc ''
         Enable or disable TLS. If true (enabled) the key and
         certificate must be configured for nghttpx.
 
@@ -15,7 +15,7 @@
     sni-fwd = lib.mkOption {
       type    = lib.types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         When performing a match to select a backend server, SNI host
         name received from the client is used instead of the request
         host. See --backend option about the pattern match.
@@ -28,7 +28,7 @@
     api = lib.mkOption {
       type        = lib.types.bool;
       default     = false;
-      description = ''
+      description = lib.mdDoc ''
         Enable API access for this frontend. This enables you to
         dynamically modify nghttpx at run-time therefore this feature
         is disabled by default and should be turned on with care.
@@ -41,7 +41,7 @@
     healthmon = lib.mkOption {
       type        = lib.types.bool;
       default     = false;
-      description = ''
+      description = lib.mdDoc ''
         Make this frontend a health monitor endpoint. Any request
         received on this frontend is responded to with a 200 OK.
 
@@ -53,7 +53,7 @@
     proxyproto = lib.mkOption {
       type        = lib.types.bool;
       default     = false;
-      description = ''
+      description = lib.mdDoc ''
         Accept PROXY protocol version 1 on frontend connection.
 
         Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-f
diff --git a/nixos/modules/services/networking/nghttpx/server-options.nix b/nixos/modules/services/networking/nghttpx/server-options.nix
index ef23bfd793c5..48e2a3045596 100644
--- a/nixos/modules/services/networking/nghttpx/server-options.nix
+++ b/nixos/modules/services/networking/nghttpx/server-options.nix
@@ -3,14 +3,14 @@
     host = lib.mkOption {
       type        = lib.types.str;
       example     = "127.0.0.1";
-      description = ''
+      description = lib.mdDoc ''
         Server host address.
       '';
     };
     port = lib.mkOption {
       type        = lib.types.int;
       example     = 5088;
-      description = ''
+      description = lib.mdDoc ''
         Server host port.
       '';
     };
diff --git a/nixos/modules/services/networking/nghttpx/tls-submodule.nix b/nixos/modules/services/networking/nghttpx/tls-submodule.nix
index 8f3cdaae2c81..bb6cdae07e58 100644
--- a/nixos/modules/services/networking/nghttpx/tls-submodule.nix
+++ b/nixos/modules/services/networking/nghttpx/tls-submodule.nix
@@ -4,7 +4,7 @@
       type        = lib.types.str;
       example     = "/etc/ssl/keys/mykeyfile.key";
       default     = "/etc/ssl/keys/server.key";
-      description = ''
+      description = lib.mdDoc ''
         Path to the TLS key file.
       '';
     };
@@ -13,7 +13,7 @@
       type        = lib.types.str;
       example     = "/etc/ssl/certs/mycert.crt";
       default     = "/etc/ssl/certs/server.crt";
-      description = ''
+      description = lib.mdDoc ''
         Path to the TLS certificate file.
       '';
     };
diff --git a/nixos/modules/services/networking/ngircd.nix b/nixos/modules/services/networking/ngircd.nix
index c0b9c98fb4bf..f6c7415c1d3b 100644
--- a/nixos/modules/services/networking/ngircd.nix
+++ b/nixos/modules/services/networking/ngircd.nix
@@ -23,13 +23,13 @@ in {
       enable = mkEnableOption "the ngircd IRC server";
 
       config = mkOption {
-        description = "The ngircd configuration (see ngircd.conf(5)).";
+        description = lib.mdDoc "The ngircd configuration (see ngircd.conf(5)).";
 
         type = types.lines;
       };
 
       package = mkOption {
-        description = "The ngircd package.";
+        description = lib.mdDoc "The ngircd package.";
 
         type = types.package;
 
diff --git a/nixos/modules/services/networking/nix-serve.nix b/nixos/modules/services/networking/nix-serve.nix
index 432938d59d90..04cbc0c0d8f8 100644
--- a/nixos/modules/services/networking/nix-serve.nix
+++ b/nixos/modules/services/networking/nix-serve.nix
@@ -13,7 +13,7 @@ in
       port = mkOption {
         type = types.port;
         default = 5000;
-        description = ''
+        description = lib.mdDoc ''
           Port number where nix-serve will listen on.
         '';
       };
@@ -21,7 +21,7 @@ in
       bindAddress = mkOption {
         type = types.str;
         default = "0.0.0.0";
-        description = ''
+        description = lib.mdDoc ''
           IP address where nix-serve will bind its listening socket.
         '';
       };
@@ -29,7 +29,7 @@ in
       openFirewall = mkOption {
         type = types.bool;
         default = false;
-        description = "Open ports in the firewall for nix-serve.";
+        description = lib.mdDoc "Open ports in the firewall for nix-serve.";
       };
 
       secretKeyFile = mkOption {
@@ -50,7 +50,7 @@ in
       extraParams = mkOption {
         type = types.separatedString " ";
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           Extra command line parameters for nix-serve.
         '';
       };
diff --git a/nixos/modules/services/networking/nix-store-gcs-proxy.nix b/nixos/modules/services/networking/nix-store-gcs-proxy.nix
index 0012302db2e3..531b2bde7633 100644
--- a/nixos/modules/services/networking/nix-store-gcs-proxy.nix
+++ b/nixos/modules/services/networking/nix-store-gcs-proxy.nix
@@ -9,18 +9,18 @@ let
         default = true;
         type = types.bool;
         example = true;
-        description = "Whether to enable proxy for this bucket";
+        description = lib.mdDoc "Whether to enable proxy for this bucket";
       };
       bucketName = mkOption {
         type = types.str;
         default = name;
         example = "my-bucket-name";
-        description = "Name of Google storage bucket";
+        description = lib.mdDoc "Name of Google storage bucket";
       };
       address = mkOption {
         type = types.str;
         example = "localhost:3000";
-        description = "The address of the proxy.";
+        description = lib.mdDoc "The address of the proxy.";
       };
     };
   };
@@ -31,7 +31,7 @@ in
   options.services.nix-store-gcs-proxy = mkOption {
     type = types.attrsOf (types.submodule opts);
     default = {};
-    description = ''
+    description = lib.mdDoc ''
       An attribute set describing an HTTP to GCS proxy that allows us to use GCS
       bucket via HTTP protocol.
     '';
diff --git a/nixos/modules/services/networking/nixops-dns.nix b/nixos/modules/services/networking/nixops-dns.nix
index 5e33d872ea45..4abdb50d6942 100644
--- a/nixos/modules/services/networking/nixops-dns.nix
+++ b/nixos/modules/services/networking/nixops-dns.nix
@@ -12,7 +12,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to enable the nixops-dns resolution
           of NixOps virtual machines via dnsmasq and fake domain name.
         '';
@@ -20,7 +20,7 @@ in
 
       user = mkOption {
         type = types.str;
-        description = ''
+        description = lib.mdDoc ''
           The user the nixops-dns daemon should run as.
           This should be the user, which is also used for nixops and
           have the .nixops directory in its home.
@@ -29,7 +29,7 @@ in
 
       domain = mkOption {
         type = types.str;
-        description = ''
+        description = lib.mdDoc ''
           Fake domain name to resolve to NixOps virtual machines.
 
           For example "ops" will resolve "vm.ops".
diff --git a/nixos/modules/services/networking/nntp-proxy.nix b/nixos/modules/services/networking/nntp-proxy.nix
index a5973cd59334..618ed0a93f1d 100644
--- a/nixos/modules/services/networking/nntp-proxy.nix
+++ b/nixos/modules/services/networking/nntp-proxy.nix
@@ -65,7 +65,7 @@ in
         type = types.str;
         default = "";
         example = "ssl-eu.astraweb.com";
-        description = ''
+        description = lib.mdDoc ''
           Upstream server address
         '';
       };
@@ -73,7 +73,7 @@ in
       upstreamPort = mkOption {
         type = types.int;
         default = 563;
-        description = ''
+        description = lib.mdDoc ''
           Upstream server port
         '';
       };
@@ -81,7 +81,7 @@ in
       upstreamMaxConnections = mkOption {
         type = types.int;
         default = 20;
-        description = ''
+        description = lib.mdDoc ''
           Upstream server maximum allowed concurrent connections
         '';
       };
@@ -89,7 +89,7 @@ in
       upstreamUser = mkOption {
         type = types.str;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           Upstream server username
         '';
       };
@@ -97,7 +97,7 @@ in
       upstreamPassword = mkOption {
         type = types.str;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           Upstream server password
         '';
       };
@@ -106,7 +106,7 @@ in
         type = types.str;
         default = "127.0.0.1";
         example = "[::]";
-        description = ''
+        description = lib.mdDoc ''
           Proxy listen address (IPv6 literal addresses need to be enclosed in "[" and "]" characters)
         '';
       };
@@ -114,7 +114,7 @@ in
       port = mkOption {
         type = types.int;
         default = 5555;
-        description = ''
+        description = lib.mdDoc ''
           Proxy listen port
         '';
       };
@@ -123,7 +123,7 @@ in
         type = types.str;
         default = "key.pem";
         example = "/path/to/your/key.file";
-        description = ''
+        description = lib.mdDoc ''
           Proxy ssl key path
         '';
       };
@@ -132,7 +132,7 @@ in
         type = types.str;
         default = "cert.pem";
         example = "/path/to/your/cert.file";
-        description = ''
+        description = lib.mdDoc ''
           Proxy ssl certificate path
         '';
       };
@@ -140,7 +140,7 @@ in
       prohibitPosting = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Whether to prohibit posting to the upstream server
         '';
       };
@@ -149,7 +149,7 @@ in
         type = types.enum [ "error" "warning" "notice" "info" "debug" ];
         default = "info";
         example = "error";
-        description = ''
+        description = lib.mdDoc ''
           Verbosity level
         '';
       };
@@ -159,7 +159,7 @@ in
           options = {
             username = mkOption {
               type = types.str;
-              description = ''
+              description = lib.mdDoc ''
                 Username
               '';
             };
@@ -176,13 +176,13 @@ in
             maxConnections = mkOption {
               type = types.int;
               default = 1;
-              description = ''
+              description = lib.mdDoc ''
                 Maximum number of concurrent connections to the proxy for this user
               '';
             };
           };
         });
-        description = ''
+        description = lib.mdDoc ''
           NNTP-Proxy user configuration
         '';
 
diff --git a/nixos/modules/services/networking/nomad.nix b/nixos/modules/services/networking/nomad.nix
index 43333af5e2fe..73b6f13327fa 100644
--- a/nixos/modules/services/networking/nomad.nix
+++ b/nixos/modules/services/networking/nomad.nix
@@ -14,7 +14,7 @@ in
         type = types.package;
         default = pkgs.nomad;
         defaultText = literalExpression "pkgs.nomad";
-        description = ''
+        description = lib.mdDoc ''
           The package used for the Nomad agent and CLI.
         '';
       };
@@ -33,7 +33,7 @@ in
       dropPrivileges = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Whether the nomad agent should be run as a non-root nomad user.
         '';
       };
@@ -41,7 +41,7 @@ in
       enableDocker = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Enable Docker support. Needed for Nomad's docker driver.
 
           Note that the docker group membership is effectively equivalent
@@ -52,7 +52,7 @@ in
       extraSettingsPaths = mkOption {
         type = types.listOf types.path;
         default = [ ];
-        description = ''
+        description = lib.mdDoc ''
           Additional settings paths used to configure nomad. These can be files or directories.
         '';
         example = literalExpression ''
@@ -63,7 +63,7 @@ in
       extraSettingsPlugins = mkOption {
         type = types.listOf (types.either types.package types.path);
         default = [ ];
-        description = ''
+        description = lib.mdDoc ''
           Additional plugins dir used to configure nomad.
         '';
         example = literalExpression ''
@@ -75,23 +75,23 @@ in
       settings = mkOption {
         type = format.type;
         default = { };
-        description = ''
-          Configuration for Nomad. See the <link xlink:href="https://www.nomadproject.io/docs/configuration">documentation</link>
+        description = lib.mdDoc ''
+          Configuration for Nomad. See the [documentation](https://www.nomadproject.io/docs/configuration)
           for supported values.
 
-          Notes about <literal>data_dir</literal>:
+          Notes about `data_dir`:
 
-          If <literal>data_dir</literal> is set to a value other than the
-          default value of <literal>"/var/lib/nomad"</literal> it is the Nomad
+          If `data_dir` is set to a value other than the
+          default value of `"/var/lib/nomad"` it is the Nomad
           cluster manager's responsibility to make sure that this directory
           exists and has the appropriate permissions.
 
-          Additionally, if <literal>dropPrivileges</literal> is
-          <literal>true</literal> then <literal>data_dir</literal>
-          <emphasis>cannot</emphasis> be customized. Setting
-          <literal>dropPrivileges</literal> to <literal>true</literal> enables
-          the <literal>DynamicUser</literal> feature of systemd which directly
-          manages and operates on <literal>StateDirectory</literal>.
+          Additionally, if `dropPrivileges` is
+          `true` then `data_dir`
+          *cannot* be customized. Setting
+          `dropPrivileges` to `true` enables
+          the `DynamicUser` feature of systemd which directly
+          manages and operates on `StateDirectory`.
         '';
         example = literalExpression ''
           {
diff --git a/nixos/modules/services/networking/nsd.nix b/nixos/modules/services/networking/nsd.nix
index a51fc5345342..1102fc85d40a 100644
--- a/nixos/modules/services/networking/nsd.nix
+++ b/nixos/modules/services/networking/nsd.nix
@@ -201,7 +201,7 @@ let
       allowAXFRFallback = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           If NSD as secondary server should be allowed to AXFR if the primary
           server does not allow IXFR.
         '';
@@ -243,7 +243,7 @@ let
         # to default values, breaking the parent inheriting function.
         type = types.attrsOf types.anything;
         default = {};
-        description = ''
+        description = lib.mdDoc ''
           Children zones inherit all options of their parents. Attributes
           defined in a child will overwrite the ones of its parent. Only
           leaf zones will be actually served. This way it's possible to
@@ -256,7 +256,7 @@ let
       data = mkOption {
         type = types.lines;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           The actual zone data. This is the content of your zone file.
           Use imports or pkgs.lib.readFile if you don't want this data in your config file.
         '';
@@ -268,17 +268,17 @@ let
         algorithm = mkOption {
           type = types.str;
           default = "RSASHA256";
-          description = "Which algorithm to use for DNSSEC";
+          description = lib.mdDoc "Which algorithm to use for DNSSEC";
         };
         keyttl = mkOption {
           type = types.str;
           default = "1h";
-          description = "TTL for dnssec records";
+          description = lib.mdDoc "TTL for dnssec records";
         };
         coverage = mkOption {
           type = types.str;
           default = "1y";
-          description = ''
+          description = lib.mdDoc ''
             The length of time to ensure that keys will be correct; no action will be taken to create new keys to be activated after this time.
           '';
         };
@@ -289,7 +289,7 @@ let
                       postPublish = "1w";
                       rollPeriod = "1mo";
                     };
-          description = "Key policy for zone signing keys";
+          description = lib.mdDoc "Key policy for zone signing keys";
         };
         ksk = mkOption {
           type = keyPolicy;
@@ -298,14 +298,14 @@ let
                       postPublish = "1mo";
                       rollPeriod = "0";
                     };
-          description = "Key policy for key signing keys";
+          description = lib.mdDoc "Key policy for key signing keys";
         };
       };
 
       maxRefreshSecs = mkOption {
         type = types.nullOr types.int;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Limit refresh time for secondary zones. This is the timer which
           checks to see if the zone has to be refetched when it expires.
           Normally the value from the SOA record is used, but this  option
@@ -316,7 +316,7 @@ let
       minRefreshSecs = mkOption {
         type = types.nullOr types.int;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Limit refresh time for secondary zones.
         '';
       };
@@ -324,7 +324,7 @@ let
       maxRetrySecs = mkOption {
         type = types.nullOr types.int;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Limit retry time for secondary zones. This is the timeout after
           a failed fetch attempt for the zone. Normally the value from
           the SOA record is used, but this option restricts that value.
@@ -334,7 +334,7 @@ let
       minRetrySecs = mkOption {
         type = types.nullOr types.int;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Limit retry time for secondary zones.
         '';
       };
@@ -362,7 +362,7 @@ let
       notifyRetry = mkOption {
         type = types.int;
         default = 5;
-        description = ''
+        description = lib.mdDoc ''
           Specifies the number of retries for failed notifies. Set this along with notify.
         '';
       };
@@ -371,7 +371,7 @@ let
         type = types.nullOr types.str;
         default = null;
         example = "2000::1@1234";
-        description = ''
+        description = lib.mdDoc ''
           This address will be used for zone-transfere requests if configured
           as a secondary server or notifications in case of a primary server.
           Supply either a plain IPv4 or IPv6 address with an optional port
@@ -400,7 +400,7 @@ let
       rrlWhitelist = mkOption {
         type = with types; listOf (enum [ "nxdomain" "error" "referral" "any" "rrsig" "wildcard" "nodata" "dnskey" "positive" "all" ]);
         default = [];
-        description = ''
+        description = lib.mdDoc ''
           Whitelists the given rrl-types.
         '';
       };
@@ -409,7 +409,7 @@ let
         type = types.nullOr types.str;
         default = null;
         example = "%s";
-        description = ''
+        description = lib.mdDoc ''
           When set to something distinct to null NSD is able to collect
           statistics per zone. All statistics of this zone(s) will be added
           to the group specified by this given name. Use "%s" to use the zones
@@ -424,19 +424,19 @@ let
     options = {
       keySize = mkOption {
         type = types.int;
-        description = "Key size in bits";
+        description = lib.mdDoc "Key size in bits";
       };
       prePublish = mkOption {
         type = types.str;
-        description = "How long in advance to publish new keys";
+        description = lib.mdDoc "How long in advance to publish new keys";
       };
       postPublish = mkOption {
         type = types.str;
-        description = "How long after deactivation to keep a key in the zone";
+        description = lib.mdDoc "How long after deactivation to keep a key in the zone";
       };
       rollPeriod = mkOption {
         type = types.str;
-        description = "How frequently to change keys";
+        description = lib.mdDoc "How frequently to change keys";
       };
     };
   };
@@ -486,7 +486,7 @@ in
     dnssecInterval = mkOption {
       type = types.str;
       default = "1h";
-      description = ''
+      description = lib.mdDoc ''
         How often to check whether dnssec key rollover is required
       '';
     };
@@ -494,7 +494,7 @@ in
     extraConfig = mkOption {
       type = types.lines;
       default = "";
-      description = ''
+      description = lib.mdDoc ''
         Extra nsd config.
       '';
     };
@@ -502,7 +502,7 @@ in
     hideVersion = mkOption {
       type = types.bool;
       default = true;
-      description = ''
+      description = lib.mdDoc ''
         Whether NSD should answer VERSION.BIND and VERSION.SERVER CHAOS class queries.
       '';
     };
@@ -510,7 +510,7 @@ in
     identity = mkOption {
       type = types.str;
       default = "unidentified server";
-      description = ''
+      description = lib.mdDoc ''
         Identify the server (CH TXT ID.SERVER entry).
       '';
     };
@@ -518,7 +518,7 @@ in
     interfaces = mkOption {
       type = types.listOf types.str;
       default = [ "127.0.0.0" "::1" ];
-      description = ''
+      description = lib.mdDoc ''
         What addresses the server should listen to.
       '';
     };
@@ -526,7 +526,7 @@ in
     ipFreebind = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         Whether to bind to nonlocal addresses and interfaces that are down.
         Similar to ip-transparent.
       '';
@@ -535,7 +535,7 @@ in
     ipTransparent = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         Allow binding to non local addresses.
       '';
     };
@@ -543,7 +543,7 @@ in
     ipv4 = mkOption {
       type = types.bool;
       default = true;
-      description = ''
+      description = lib.mdDoc ''
         Whether to listen on IPv4 connections.
       '';
     };
@@ -551,7 +551,7 @@ in
     ipv4EDNSSize = mkOption {
       type = types.int;
       default = 4096;
-      description = ''
+      description = lib.mdDoc ''
         Preferred EDNS buffer size for IPv4.
       '';
     };
@@ -559,7 +559,7 @@ in
     ipv6 = mkOption {
       type = types.bool;
       default = true;
-      description = ''
+      description = lib.mdDoc ''
         Whether to listen on IPv6 connections.
       '';
     };
@@ -567,7 +567,7 @@ in
     ipv6EDNSSize = mkOption {
       type = types.int;
       default = 4096;
-      description = ''
+      description = lib.mdDoc ''
         Preferred EDNS buffer size for IPv6.
       '';
     };
@@ -575,7 +575,7 @@ in
     logTimeAscii = mkOption {
       type = types.bool;
       default = true;
-      description = ''
+      description = lib.mdDoc ''
         Log time in ascii, if false then in unix epoch seconds.
       '';
     };
@@ -583,7 +583,7 @@ in
     nsid = mkOption {
       type = types.nullOr types.str;
       default = null;
-      description = ''
+      description = lib.mdDoc ''
         NSID identity (hex string, or "ascii_somestring").
       '';
     };
@@ -591,7 +591,7 @@ in
     port = mkOption {
       type = types.int;
       default = 53;
-      description = ''
+      description = lib.mdDoc ''
         Port the service should bind do.
       '';
     };
@@ -600,7 +600,7 @@ in
       type = types.bool;
       default = pkgs.stdenv.isLinux;
       defaultText = literalExpression "pkgs.stdenv.isLinux";
-      description = ''
+      description = lib.mdDoc ''
         Whether to enable SO_REUSEPORT on all used sockets. This lets multiple
         processes bind to the same port. This speeds up operation especially
         if the server count is greater than one and makes fast restarts less
@@ -611,7 +611,7 @@ in
     rootServer = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         Whether this server will be a root server (a DNS root server, you
         usually don't want that).
       '';
@@ -622,7 +622,7 @@ in
     serverCount = mkOption {
       type = types.int;
       default = 1;
-      description = ''
+      description = lib.mdDoc ''
         Number of NSD servers to fork. Put the number of CPUs to use here.
       '';
     };
@@ -630,7 +630,7 @@ in
     statistics = mkOption {
       type = types.nullOr types.int;
       default = null;
-      description = ''
+      description = lib.mdDoc ''
         Statistics are produced every number of seconds. Prints to log.
         If null no statistics are logged.
       '';
@@ -639,7 +639,7 @@ in
     tcpCount = mkOption {
       type = types.int;
       default = 100;
-      description = ''
+      description = lib.mdDoc ''
         Maximum number of concurrent TCP connections per server.
       '';
     };
@@ -647,7 +647,7 @@ in
     tcpQueryCount = mkOption {
       type = types.int;
       default = 0;
-      description = ''
+      description = lib.mdDoc ''
         Maximum number of queries served on a single TCP connection.
         0 means no maximum.
       '';
@@ -656,7 +656,7 @@ in
     tcpTimeout = mkOption {
       type = types.int;
       default = 120;
-      description = ''
+      description = lib.mdDoc ''
         TCP timeout in seconds.
       '';
     };
@@ -664,7 +664,7 @@ in
     verbosity = mkOption {
       type = types.int;
       default = 0;
-      description = ''
+      description = lib.mdDoc ''
         Verbosity level.
       '';
     };
@@ -672,7 +672,7 @@ in
     version = mkOption {
       type = types.nullOr types.str;
       default = null;
-      description = ''
+      description = lib.mdDoc ''
         The version string replied for CH TXT version.server and version.bind
         queries. Will use the compiled package version on null.
         See hideVersion for enabling/disabling this responses.
@@ -682,7 +682,7 @@ in
     xfrdReloadTimeout = mkOption {
       type = types.int;
       default = 1;
-      description = ''
+      description = lib.mdDoc ''
         Number of seconds between reloads triggered by xfrd.
       '';
     };
@@ -690,7 +690,7 @@ in
     zonefilesCheck = mkOption {
       type = types.bool;
       default = true;
-      description = ''
+      description = lib.mdDoc ''
         Whether to check mtime of all zone files on start and sighup.
       '';
     };
@@ -703,14 +703,14 @@ in
           algorithm = mkOption {
             type = types.str;
             default = "hmac-sha256";
-            description = ''
+            description = lib.mdDoc ''
               Authentication algorithm for this key.
             '';
           };
 
           keyFile = mkOption {
             type = types.path;
-            description = ''
+            description = lib.mdDoc ''
               Path to the file which contains the actual base64 encoded
               key. The key will be copied into "${stateDir}/private" before
               NSD starts. The copied file is only accessibly by the NSD
@@ -728,7 +728,7 @@ in
           };
         }
       '';
-      description = ''
+      description = lib.mdDoc ''
         Define your TSIG keys here.
       '';
     };
@@ -741,7 +741,7 @@ in
       ipv4PrefixLength = mkOption {
         type = types.nullOr types.int;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           IPv4 prefix length. Addresses are grouped by netblock.
         '';
       };
@@ -749,7 +749,7 @@ in
       ipv6PrefixLength = mkOption {
         type = types.nullOr types.int;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           IPv6 prefix length. Addresses are grouped by netblock.
         '';
       };
@@ -757,7 +757,7 @@ in
       ratelimit = mkOption {
         type = types.int;
         default = 200;
-        description = ''
+        description = lib.mdDoc ''
           Max qps allowed from any query source.
           0 means unlimited. With an verbosity of 2 blocked and
           unblocked subnets will be logged.
@@ -767,7 +767,7 @@ in
       slip = mkOption {
         type = types.nullOr types.int;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Number of packets that get discarded before replying a SLIP response.
           0 disables SLIP responses. 1 will make every response a SLIP response.
         '';
@@ -776,7 +776,7 @@ in
       size = mkOption {
         type = types.int;
         default = 1000000;
-        description = ''
+        description = lib.mdDoc ''
           Size of the hashtable. More buckets use more memory but lower
           the chance of hash hash collisions.
         '';
@@ -785,7 +785,7 @@ in
       whitelistRatelimit = mkOption {
         type = types.int;
         default = 2000;
-        description = ''
+        description = lib.mdDoc ''
           Max qps allowed from whitelisted sources.
           0 means unlimited. Set the rrl-whitelist option for specific
           queries to apply this limit instead of the default to them.
@@ -802,7 +802,7 @@ in
       controlCertFile = mkOption {
         type = types.path;
         default = "/etc/nsd/nsd_control.pem";
-        description = ''
+        description = lib.mdDoc ''
           Path to the client certificate signed with the server certificate.
           This file is used by nsd-control and generated by nsd-control-setup.
         '';
@@ -811,7 +811,7 @@ in
       controlKeyFile = mkOption {
         type = types.path;
         default = "/etc/nsd/nsd_control.key";
-        description = ''
+        description = lib.mdDoc ''
           Path to the client private key, which is used by nsd-control
           but not by the server. This file is generated by nsd-control-setup.
         '';
@@ -820,7 +820,7 @@ in
       interfaces = mkOption {
         type = types.listOf types.str;
         default = [ "127.0.0.1" "::1" ];
-        description = ''
+        description = lib.mdDoc ''
           Which interfaces NSD should bind to for remote control.
         '';
       };
@@ -828,7 +828,7 @@ in
       port = mkOption {
         type = types.int;
         default = 8952;
-        description = ''
+        description = lib.mdDoc ''
           Port number for remote control operations (uses TLS over TCP).
         '';
       };
@@ -836,7 +836,7 @@ in
       serverCertFile = mkOption {
         type = types.path;
         default = "/etc/nsd/nsd_server.pem";
-        description = ''
+        description = lib.mdDoc ''
           Path to the server self signed certificate, which is used by the server
           but and by nsd-control. This file is generated by nsd-control-setup.
         '';
@@ -845,7 +845,7 @@ in
       serverKeyFile = mkOption {
         type = types.path;
         default = "/etc/nsd/nsd_server.key";
-        description = ''
+        description = lib.mdDoc ''
           Path to the server private key, which is used by the server
           but not by nsd-control. This file is generated by nsd-control-setup.
         '';
@@ -887,7 +887,7 @@ in
           };
         }
       '';
-      description = ''
+      description = lib.mdDoc ''
         Define your zones here. Zones can cascade other zones and therefore
         inherit settings from parent zones. Look at the definition of
         children to learn about inheritance and child zones.
diff --git a/nixos/modules/services/networking/ntopng.nix b/nixos/modules/services/networking/ntopng.nix
index 022fc923edaa..e6344d7ff3b3 100644
--- a/nixos/modules/services/networking/ntopng.nix
+++ b/nixos/modules/services/networking/ntopng.nix
@@ -43,7 +43,7 @@ in
       enable = mkOption {
         default = false;
         type = types.bool;
-        description = ''
+        description = lib.mdDoc ''
           Enable ntopng, a high-speed web-based traffic analysis and flow
           collection tool.
 
@@ -63,7 +63,7 @@ in
         default = [ "any" ];
         example = [ "eth0" "wlan0" ];
         type = types.listOf types.str;
-        description = ''
+        description = lib.mdDoc ''
           List of interfaces to monitor. Use "any" to monitor all interfaces.
         '';
       };
@@ -71,7 +71,7 @@ in
       httpPort = mkOption {
         default = 3000;
         type = types.int;
-        description = ''
+        description = lib.mdDoc ''
           Sets the HTTP port of the embedded web server.
         '';
       };
@@ -79,7 +79,7 @@ in
       redis.address = mkOption {
         type = types.str;
         example = literalExpression "config.services.redis.ntopng.unixSocket";
-        description = ''
+        description = lib.mdDoc ''
           Redis address - may be a Unix socket or a network host and port.
         '';
       };
@@ -87,10 +87,10 @@ in
       redis.createInstance = mkOption {
         type = types.nullOr types.str;
         default = if versionAtLeast config.system.stateVersion "22.05" then "ntopng" else "";
-        description = ''
-          Local Redis instance name. Set to <literal>null</literal> to disable
-          local Redis instance. Defaults to <literal>""</literal> for
-          <literal>system.stateVersion</literal> older than 22.05.
+        description = lib.mdDoc ''
+          Local Redis instance name. Set to `null` to disable
+          local Redis instance. Defaults to `""` for
+          `system.stateVersion` older than 22.05.
         '';
       };
 
@@ -102,7 +102,7 @@ in
           --disable-login
         '';
         type = types.lines;
-        description = ''
+        description = lib.mdDoc ''
           Overridable configuration file contents to use for ntopng. By
           default, use the contents automatically generated by NixOS.
         '';
@@ -111,10 +111,10 @@ in
       extraConfig = mkOption {
         default = "";
         type = types.lines;
-        description = ''
+        description = lib.mdDoc ''
           Configuration lines that will be appended to the generated ntopng
           configuration file. Note that this mechanism does not work when the
-          manual <option>configText</option> option is used.
+          manual {option}`configText` option is used.
         '';
       };
 
diff --git a/nixos/modules/services/networking/ntp/chrony.nix b/nixos/modules/services/networking/ntp/chrony.nix
index 34728455a212..a89c7769152e 100644
--- a/nixos/modules/services/networking/ntp/chrony.nix
+++ b/nixos/modules/services/networking/ntp/chrony.nix
@@ -35,7 +35,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to synchronise your machine's time using chrony.
           Make sure you disable NTP if you enable this service.
         '';
@@ -45,7 +45,7 @@ in
         type = types.package;
         default = pkgs.chrony;
         defaultText = literalExpression "pkgs.chrony";
-        description = ''
+        description = lib.mdDoc ''
           Which chrony package to use.
         '';
       };
@@ -54,7 +54,7 @@ in
         default = config.networking.timeServers;
         defaultText = literalExpression "config.networking.timeServers";
         type = types.listOf types.str;
-        description = ''
+        description = lib.mdDoc ''
           The set of NTP servers from which to synchronise.
         '';
       };
@@ -62,7 +62,7 @@ in
       serverOption = mkOption {
         default = "iburst";
         type = types.enum [ "iburst" "offline" ];
-        description = ''
+        description = lib.mdDoc ''
           Set option for server directives.
 
           Use "iburst" to rapidly poll on startup. Recommended if your machine
@@ -76,7 +76,7 @@ in
       enableNTS = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to enable Network Time Security authentication.
           Make sure it is supported by your selected NTP server(s).
         '';
@@ -86,7 +86,7 @@ in
         enabled = mkOption {
           type = types.bool;
           default = true;
-          description = ''
+          description = lib.mdDoc ''
             Allow chronyd to make a rapid measurement of the system clock error
             at boot time, and to correct the system clock by stepping before
             normal operation begins.
@@ -96,7 +96,7 @@ in
         threshold = mkOption {
           type = types.either types.float types.int;
           default = 1000; # by default, same threshold as 'ntpd -g' (1000s)
-          description = ''
+          description = lib.mdDoc ''
             The threshold of system clock error (in seconds) above which the
             clock will be stepped. If the correction required is less than the
             threshold, a slew is used instead.
@@ -107,15 +107,15 @@ in
       directory = mkOption {
         type = types.str;
         default = "/var/lib/chrony";
-        description = "Directory where chrony state is stored.";
+        description = lib.mdDoc "Directory where chrony state is stored.";
       };
 
       extraConfig = mkOption {
         type = types.lines;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           Extra configuration directives that should be added to
-          <literal>chrony.conf</literal>
+          `chrony.conf`
         '';
       };
 
@@ -123,7 +123,7 @@ in
         default = [];
         example = [ "-s" ];
         type = types.listOf types.str;
-        description = "Extra flags passed to the chronyd command.";
+        description = lib.mdDoc "Extra flags passed to the chronyd command.";
       };
     };
   };
diff --git a/nixos/modules/services/networking/ntp/ntpd.nix b/nixos/modules/services/networking/ntp/ntpd.nix
index 12be0d045a85..47922f5e1499 100644
--- a/nixos/modules/services/networking/ntp/ntpd.nix
+++ b/nixos/modules/services/networking/ntp/ntpd.nix
@@ -79,7 +79,7 @@ in
         default = config.networking.timeServers;
         defaultText = literalExpression "config.networking.timeServers";
         type = types.listOf types.str;
-        description = ''
+        description = lib.mdDoc ''
           The set of NTP servers from which to synchronise.
         '';
       };
@@ -90,14 +90,14 @@ in
         example = ''
           fudge 127.127.1.0 stratum 10
         '';
-        description = ''
-          Additional text appended to <filename>ntp.conf</filename>.
+        description = lib.mdDoc ''
+          Additional text appended to {file}`ntp.conf`.
         '';
       };
 
       extraFlags = mkOption {
         type = types.listOf types.str;
-        description = "Extra flags passed to the ntpd command.";
+        description = lib.mdDoc "Extra flags passed to the ntpd command.";
         example = literalExpression ''[ "--interface=eth0" ]'';
         default = [];
       };
diff --git a/nixos/modules/services/networking/ntp/openntpd.nix b/nixos/modules/services/networking/ntp/openntpd.nix
index e86b71291f96..2a766a134f77 100644
--- a/nixos/modules/services/networking/ntp/openntpd.nix
+++ b/nixos/modules/services/networking/ntp/openntpd.nix
@@ -35,8 +35,8 @@ in
         listen on 127.0.0.1
         listen on ::1
       '';
-      description = ''
-        Additional text appended to <filename>openntpd.conf</filename>.
+      description = lib.mdDoc ''
+        Additional text appended to {file}`openntpd.conf`.
       '';
     };
 
@@ -44,7 +44,7 @@ in
       type = with types; separatedString " ";
       default = "";
       example = "-s";
-      description = ''
+      description = lib.mdDoc ''
         Extra options used when launching openntpd.
       '';
     };
diff --git a/nixos/modules/services/networking/nullidentdmod.nix b/nixos/modules/services/networking/nullidentdmod.nix
index b0d338a27941..85f5c799a310 100644
--- a/nixos/modules/services/networking/nullidentdmod.nix
+++ b/nixos/modules/services/networking/nullidentdmod.nix
@@ -7,7 +7,7 @@ in {
 
     userid = mkOption {
       type = nullOr str;
-      description = "User ID to return. Set to null to return a random string each time.";
+      description = lib.mdDoc "User ID to return. Set to null to return a random string each time.";
       default = null;
       example = "alice";
     };
diff --git a/nixos/modules/services/networking/nylon.nix b/nixos/modules/services/networking/nylon.nix
index a20fa615af80..3eb15c23bef5 100644
--- a/nixos/modules/services/networking/nylon.nix
+++ b/nixos/modules/services/networking/nylon.nix
@@ -29,7 +29,7 @@ let
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Enables nylon as a running service upon activation.
         '';
       };
@@ -37,13 +37,13 @@ let
       name = mkOption {
         type = types.str;
         default = "";
-        description = "The name of this nylon instance.";
+        description = lib.mdDoc "The name of this nylon instance.";
       };
 
       nrConnections = mkOption {
         type = types.int;
         default = 10;
-        description = ''
+        description = lib.mdDoc ''
           The number of allowed simultaneous connections to the daemon, default 10.
         '';
       };
@@ -51,7 +51,7 @@ let
       logging = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Enable logging, default is no logging.
         '';
       };
@@ -59,7 +59,7 @@ let
       verbosity = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Enable verbose output, default is to not be verbose.
         '';
       };
@@ -67,7 +67,7 @@ let
       acceptInterface = mkOption {
         type = types.str;
         default = "lo";
-        description = ''
+        description = lib.mdDoc ''
           Tell nylon which interface to listen for client requests on, default is "lo".
         '';
       };
@@ -75,7 +75,7 @@ let
       bindInterface = mkOption {
         type = types.str;
         default = "enp3s0f0";
-        description = ''
+        description = lib.mdDoc ''
           Tell nylon which interface to use as an uplink, default is "enp3s0f0".
         '';
       };
@@ -83,7 +83,7 @@ let
       port = mkOption {
         type = types.int;
         default = 1080;
-        description = ''
+        description = lib.mdDoc ''
           What port to listen for client requests, default is 1080.
         '';
       };
@@ -91,7 +91,7 @@ let
       allowedIPRanges = mkOption {
         type = with types; listOf str;
         default = [ "192.168.0.0/16" "127.0.0.1/8" "172.16.0.1/12" "10.0.0.0/8" ];
-        description = ''
+        description = lib.mdDoc ''
            Allowed client IP ranges are evaluated first, defaults to ARIN IPv4 private ranges:
              [ "192.168.0.0/16" "127.0.0.0/8" "172.16.0.0/12" "10.0.0.0/8" ]
         '';
@@ -100,7 +100,7 @@ let
       deniedIPRanges = mkOption {
         type = with types; listOf str;
         default = [ "0.0.0.0/0" ];
-        description = ''
+        description = lib.mdDoc ''
           Denied client IP ranges, these gets evaluated after the allowed IP ranges, defaults to all IPv4 addresses:
             [ "0.0.0.0/0" ]
           To block all other access than the allowed.
diff --git a/nixos/modules/services/networking/ofono.nix b/nixos/modules/services/networking/ofono.nix
index 460b06443c41..6192857cd3ed 100644
--- a/nixos/modules/services/networking/ofono.nix
+++ b/nixos/modules/services/networking/ofono.nix
@@ -25,7 +25,7 @@ in
         type = types.listOf types.package;
         default = [];
         example = literalExpression "[ pkgs.modem-manager-gui ]";
-        description = ''
+        description = lib.mdDoc ''
           The list of plugins to install.
         '';
       };
diff --git a/nixos/modules/services/networking/oidentd.nix b/nixos/modules/services/networking/oidentd.nix
index feb84806ba99..7c7883c94611 100644
--- a/nixos/modules/services/networking/oidentd.nix
+++ b/nixos/modules/services/networking/oidentd.nix
@@ -11,7 +11,7 @@ with lib;
     services.oidentd.enable = mkOption {
       default = false;
       type = types.bool;
-      description = ''
+      description = lib.mdDoc ''
         Whether to enable ‘oidentd’, an implementation of the Ident
         protocol (RFC 1413).  It allows remote systems to identify the
         name of the user associated with a TCP connection.
diff --git a/nixos/modules/services/networking/onedrive.nix b/nixos/modules/services/networking/onedrive.nix
index 0256a6a41115..5a531d7a47fd 100644
--- a/nixos/modules/services/networking/onedrive.nix
+++ b/nixos/modules/services/networking/onedrive.nix
@@ -29,14 +29,14 @@ in {
     enable = lib.mkOption {
       type = lib.types.bool;
       default = false;
-      description = "Enable OneDrive service";
+      description = lib.mdDoc "Enable OneDrive service";
     };
 
      package = lib.mkOption {
        type = lib.types.package;
        default = pkgs.onedrive;
        defaultText = lib.literalExpression "pkgs.onedrive";
-       description = ''
+       description = lib.mdDoc ''
          OneDrive package to use.
        '';
      };
diff --git a/nixos/modules/services/networking/openconnect.nix b/nixos/modules/services/networking/openconnect.nix
index bc873b2198bc..c5313bb305a2 100644
--- a/nixos/modules/services/networking/openconnect.nix
+++ b/nixos/modules/services/networking/openconnect.nix
@@ -11,25 +11,25 @@ let
     options = {
       autoStart = mkOption {
         default = true;
-        description = "Whether this VPN connection should be started automatically.";
+        description = lib.mdDoc "Whether this VPN connection should be started automatically.";
         type = types.bool;
       };
 
       gateway = mkOption {
-        description = "Gateway server to connect to.";
+        description = lib.mdDoc "Gateway server to connect to.";
         example = "gateway.example.com";
         type = types.str;
       };
 
       protocol = mkOption {
-        description = "Protocol to use.";
+        description = lib.mdDoc "Protocol to use.";
         example = "anyconnect";
         type =
           types.enum [ "anyconnect" "array" "nc" "pulse" "gp" "f5" "fortinet" ];
       };
 
       user = mkOption {
-        description = "Username to authenticate with.";
+        description = lib.mdDoc "Username to authenticate with.";
         example = "example-user";
         type = types.nullOr types.str;
       };
@@ -49,14 +49,14 @@ let
       };
 
       certificate = mkOption {
-        description = "Certificate to authenticate with.";
+        description = lib.mdDoc "Certificate to authenticate with.";
         default = null;
         example = "/var/lib/secrets/openconnect_certificate.pem";
         type = with types; nullOr (either path pkcs11);
       };
 
       privateKey = mkOption {
-        description = "Private key to authenticate with.";
+        description = lib.mdDoc "Private key to authenticate with.";
         example = "/var/lib/secrets/openconnect_private_key.pem";
         default = null;
         type = with types; nullOr (either path pkcs11);
@@ -118,7 +118,7 @@ in {
     package = mkPackageOption pkgs "openconnect" { };
 
     interfaces = mkOption {
-      description = "OpenConnect interfaces.";
+      description = lib.mdDoc "OpenConnect interfaces.";
       default = { };
       example = {
         openconnect0 = {
diff --git a/nixos/modules/services/networking/openvpn.nix b/nixos/modules/services/networking/openvpn.nix
index cf3f79fc578f..752b4d67d47e 100644
--- a/nixos/modules/services/networking/openvpn.nix
+++ b/nixos/modules/services/networking/openvpn.nix
@@ -130,20 +130,20 @@ in
 
           config = mkOption {
             type = types.lines;
-            description = ''
+            description = lib.mdDoc ''
               Configuration of this OpenVPN instance.  See
-              <citerefentry><refentrytitle>openvpn</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+              {manpage}`openvpn(8)`
               for details.
 
               To import an external config file, use the following definition:
-              <literal>config = "config /path/to/config.ovpn"</literal>
+              `config = "config /path/to/config.ovpn"`
             '';
           };
 
           up = mkOption {
             default = "";
             type = types.lines;
-            description = ''
+            description = lib.mdDoc ''
               Shell commands executed when the instance is starting.
             '';
           };
@@ -151,7 +151,7 @@ in
           down = mkOption {
             default = "";
             type = types.lines;
-            description = ''
+            description = lib.mdDoc ''
               Shell commands executed when the instance is shutting down.
             '';
           };
@@ -159,13 +159,13 @@ in
           autoStart = mkOption {
             default = true;
             type = types.bool;
-            description = "Whether this OpenVPN instance should be started automatically.";
+            description = lib.mdDoc "Whether this OpenVPN instance should be started automatically.";
           };
 
           updateResolvConf = mkOption {
             default = false;
             type = types.bool;
-            description = ''
+            description = lib.mdDoc ''
               Use the script from the update-resolv-conf package to automatically
               update resolv.conf with the DNS information provided by openvpn. The
               script will be run after the "up" commands and before the "down" commands.
@@ -174,7 +174,7 @@ in
 
           authUserPass = mkOption {
             default = null;
-            description = ''
+            description = lib.mdDoc ''
               This option can be used to store the username / password credentials
               with the "auth-user-pass" authentication method.
 
@@ -184,12 +184,12 @@ in
 
               options = {
                 username = mkOption {
-                  description = "The username to store inside the credentials file.";
+                  description = lib.mdDoc "The username to store inside the credentials file.";
                   type = types.str;
                 };
 
                 password = mkOption {
-                  description = "The password to store inside the credentials file.";
+                  description = lib.mdDoc "The password to store inside the credentials file.";
                   type = types.str;
                 };
               };
diff --git a/nixos/modules/services/networking/ostinato.nix b/nixos/modules/services/networking/ostinato.nix
index 4da11984b9fc..808ccdd4e0cf 100644
--- a/nixos/modules/services/networking/ostinato.nix
+++ b/nixos/modules/services/networking/ostinato.nix
@@ -31,7 +31,7 @@ in
       port = mkOption {
         type = types.int;
         default = 7878;
-        description = ''
+        description = lib.mdDoc ''
           Port to listen on.
         '';
       };
@@ -39,7 +39,7 @@ in
       rateAccuracy = mkOption {
         type = types.enum [ "High" "Low" ];
         default = "High";
-        description = ''
+        description = lib.mdDoc ''
           To ensure that the actual transmit rate is as close as possible to
           the configured transmit rate, Drone runs a busy-wait loop.
           While this provides the maximum accuracy possible, the CPU
@@ -52,7 +52,7 @@ in
         address = mkOption {
           type = types.str;
           default = "0.0.0.0";
-          description = ''
+          description = lib.mdDoc ''
             By default, the Drone RPC server will listen on all interfaces and
             local IPv4 adresses for incoming connections from clients.  Specify
             a single IPv4 or IPv6 address if you want to restrict that.
@@ -66,7 +66,7 @@ in
           type = types.listOf types.str;
           default = [];
           example = [ "eth*" "lo*" ];
-          description = ''
+          description = lib.mdDoc ''
             For a port to pass the filter and appear on the port list managed
             by drone, it be allowed by this include list.
           '';
@@ -75,7 +75,7 @@ in
           type = types.listOf types.str;
           default = [];
           example = [ "usbmon*" "eth0" ];
-          description = ''
+          description = lib.mdDoc ''
             A list of ports does not appear on the port list managed by drone.
           '';
         };
diff --git a/nixos/modules/services/networking/pdns-recursor.nix b/nixos/modules/services/networking/pdns-recursor.nix
index a986f83141c4..7319793101c5 100644
--- a/nixos/modules/services/networking/pdns-recursor.nix
+++ b/nixos/modules/services/networking/pdns-recursor.nix
@@ -32,7 +32,7 @@ in {
     dns.address = mkOption {
       type = oneOrMore types.str;
       default = [ "::" "0.0.0.0" ];
-      description = ''
+      description = lib.mdDoc ''
         IP addresses Recursor DNS server will bind to.
       '';
     };
@@ -40,7 +40,7 @@ in {
     dns.port = mkOption {
       type = types.int;
       default = 53;
-      description = ''
+      description = lib.mdDoc ''
         Port number Recursor DNS server will bind to.
       '';
     };
@@ -53,7 +53,7 @@ in {
         "::1/128" "fc00::/7" "fe80::/10"
       ];
       example = [ "0.0.0.0/0" "::/0" ];
-      description = ''
+      description = lib.mdDoc ''
         IP address ranges of clients allowed to make DNS queries.
       '';
     };
@@ -61,7 +61,7 @@ in {
     api.address = mkOption {
       type = types.str;
       default = "0.0.0.0";
-      description = ''
+      description = lib.mdDoc ''
         IP address Recursor REST API server will bind to.
       '';
     };
@@ -69,7 +69,7 @@ in {
     api.port = mkOption {
       type = types.int;
       default = 8082;
-      description = ''
+      description = lib.mdDoc ''
         Port number Recursor REST API server will bind to.
       '';
     };
@@ -78,7 +78,7 @@ in {
       type = types.listOf types.str;
       default = [ "127.0.0.1" "::1" ];
       example = [ "0.0.0.0/0" "::/0" ];
-      description = ''
+      description = lib.mdDoc ''
         IP address ranges of clients allowed to make API requests.
       '';
     };
@@ -86,7 +86,7 @@ in {
     exportHosts = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
        Whether to export names and IP addresses defined in /etc/hosts.
       '';
     };
@@ -94,7 +94,7 @@ in {
     forwardZones = mkOption {
       type = types.attrs;
       default = {};
-      description = ''
+      description = lib.mdDoc ''
         DNS zones to be forwarded to other authoritative servers.
       '';
     };
@@ -103,7 +103,7 @@ in {
       type = types.attrs;
       example = { eth = "[::1]:5353"; };
       default = {};
-      description = ''
+      description = lib.mdDoc ''
         DNS zones to be forwarded to other recursive servers.
       '';
     };
@@ -111,7 +111,7 @@ in {
     dnssecValidation = mkOption {
       type = types.enum ["off" "process-no-validate" "process" "log-fail" "validate"];
       default = "validate";
-      description = ''
+      description = lib.mdDoc ''
         Controls the level of DNSSEC processing done by the PowerDNS Recursor.
         See https://doc.powerdns.com/md/recursor/dnssec/ for a detailed explanation.
       '';
@@ -120,11 +120,11 @@ in {
     serveRFC1918 = mkOption {
       type = types.bool;
       default = true;
-      description = ''
+      description = lib.mdDoc ''
         Whether to directly resolve the RFC1918 reverse-mapping domains:
-        <literal>10.in-addr.arpa</literal>,
-        <literal>168.192.in-addr.arpa</literal>,
-        <literal>16-31.172.in-addr.arpa</literal>
+        `10.in-addr.arpa`,
+        `168.192.in-addr.arpa`,
+        `16-31.172.in-addr.arpa`
         This saves load on the AS112 servers.
       '';
     };
@@ -138,11 +138,11 @@ in {
           log-common-errors = true;
         }
       '';
-      description = ''
+      description = lib.mdDoc ''
         PowerDNS Recursor settings. Use this option to configure Recursor
         settings not exposed in a NixOS option or to bypass one.
         See the full documentation at
-        <link xlink:href="https://doc.powerdns.com/recursor/settings.html"/>
+        <https://doc.powerdns.com/recursor/settings.html>
         for the available options.
       '';
     };
@@ -150,9 +150,9 @@ in {
     luaConfig = mkOption {
       type = types.lines;
       default = "";
-      description = ''
+      description = lib.mdDoc ''
         The content Lua configuration file for PowerDNS Recursor. See
-        <link xlink:href="https://doc.powerdns.com/recursor/lua-config/index.html"/>.
+        <https://doc.powerdns.com/recursor/lua-config/index.html>.
       '';
     };
   };
diff --git a/nixos/modules/services/networking/pdnsd.nix b/nixos/modules/services/networking/pdnsd.nix
index 24b5bbc5104e..03c9005413b5 100644
--- a/nixos/modules/services/networking/pdnsd.nix
+++ b/nixos/modules/services/networking/pdnsd.nix
@@ -29,33 +29,33 @@ in
           cacheDir = mkOption {
             type = types.str;
             default = "/var/cache/pdnsd";
-            description = "Directory holding the pdnsd cache";
+            description = lib.mdDoc "Directory holding the pdnsd cache";
           };
 
           globalConfig = mkOption {
             type = types.lines;
             default = "";
-            description = ''
+            description = lib.mdDoc ''
               Global configuration that should be added to the global directory
-              of <literal>pdnsd.conf</literal>.
+              of `pdnsd.conf`.
             '';
           };
 
           serverConfig = mkOption {
             type = types.lines;
             default = "";
-            description = ''
+            description = lib.mdDoc ''
               Server configuration that should be added to the server directory
-              of <literal>pdnsd.conf</literal>.
+              of `pdnsd.conf`.
             '';
           };
 
           extraConfig = mkOption {
             type = types.lines;
             default = "";
-            description = ''
+            description = lib.mdDoc ''
               Extra configuration directives that should be added to
-              <literal>pdnsd.conf</literal>.
+              `pdnsd.conf`.
             '';
           };
         };
diff --git a/nixos/modules/services/networking/pixiecore.nix b/nixos/modules/services/networking/pixiecore.nix
index d2642c82c2d3..c88081af6203 100644
--- a/nixos/modules/services/networking/pixiecore.nix
+++ b/nixos/modules/services/networking/pixiecore.nix
@@ -15,13 +15,13 @@ in
       openFirewall = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Open ports (67, 69 UDP and 4011, 'port', 'statusPort' TCP) in the firewall for Pixiecore.
         '';
       };
 
       mode = mkOption {
-        description = "Which mode to use";
+        description = lib.mdDoc "Which mode to use";
         default = "boot";
         type = types.enum [ "api" "boot" ];
       };
@@ -29,61 +29,61 @@ in
       debug = mkOption {
         type = types.bool;
         default = false;
-        description = "Log more things that aren't directly related to booting a recognized client";
+        description = lib.mdDoc "Log more things that aren't directly related to booting a recognized client";
       };
 
       dhcpNoBind = mkOption {
         type = types.bool;
         default = false;
-        description = "Handle DHCP traffic without binding to the DHCP server port";
+        description = lib.mdDoc "Handle DHCP traffic without binding to the DHCP server port";
       };
 
       kernel = mkOption {
         type = types.str or types.path;
         default = "";
-        description = "Kernel path. Ignored unless mode is set to 'boot'";
+        description = lib.mdDoc "Kernel path. Ignored unless mode is set to 'boot'";
       };
 
       initrd = mkOption {
         type = types.str or types.path;
         default = "";
-        description = "Initrd path. Ignored unless mode is set to 'boot'";
+        description = lib.mdDoc "Initrd path. Ignored unless mode is set to 'boot'";
       };
 
       cmdLine = mkOption {
         type = types.str;
         default = "";
-        description = "Kernel commandline arguments. Ignored unless mode is set to 'boot'";
+        description = lib.mdDoc "Kernel commandline arguments. Ignored unless mode is set to 'boot'";
       };
 
       listen = mkOption {
         type = types.str;
         default = "0.0.0.0";
-        description = "IPv4 address to listen on";
+        description = lib.mdDoc "IPv4 address to listen on";
       };
 
       port = mkOption {
         type = types.port;
         default = 80;
-        description = "Port to listen on for HTTP";
+        description = lib.mdDoc "Port to listen on for HTTP";
       };
 
       statusPort = mkOption {
         type = types.port;
         default = 80;
-        description = "HTTP port for status information (can be the same as --port)";
+        description = lib.mdDoc "HTTP port for status information (can be the same as --port)";
       };
 
       apiServer = mkOption {
         type = types.str;
         example = "localhost:8080";
-        description = "host:port to connect to the API. Ignored unless mode is set to 'api'";
+        description = lib.mdDoc "host:port to connect to the API. Ignored unless mode is set to 'api'";
       };
 
       extraArguments = mkOption {
         type = types.listOf types.str;
         default = [];
-        description = "Additional command line arguments to pass to Pixiecore";
+        description = lib.mdDoc "Additional command line arguments to pass to Pixiecore";
       };
     };
   };
diff --git a/nixos/modules/services/networking/pleroma.nix b/nixos/modules/services/networking/pleroma.nix
index 9b8382392c0a..03868c8cc769 100644
--- a/nixos/modules/services/networking/pleroma.nix
+++ b/nixos/modules/services/networking/pleroma.nix
@@ -10,26 +10,26 @@ in {
         type = types.package;
         default = pkgs.pleroma;
         defaultText = literalExpression "pkgs.pleroma";
-        description = "Pleroma package to use.";
+        description = lib.mdDoc "Pleroma package to use.";
       };
 
       user = mkOption {
         type = types.str;
         default = "pleroma";
-        description = "User account under which pleroma runs.";
+        description = lib.mdDoc "User account under which pleroma runs.";
       };
 
       group = mkOption {
         type = types.str;
         default = "pleroma";
-        description = "Group account under which pleroma runs.";
+        description = lib.mdDoc "Group account under which pleroma runs.";
       };
 
       stateDir = mkOption {
         type = types.str;
         default = "/var/lib/pleroma";
         readOnly = true;
-        description = "Directory where the pleroma service will save the uploads and static files.";
+        description = lib.mdDoc "Directory where the pleroma service will save the uploads and static files.";
       };
 
       configs = mkOption {
@@ -59,11 +59,11 @@ in {
       secretConfigFile = mkOption {
         type = types.str;
         default = "/var/lib/pleroma/secrets.exs";
-        description = ''
+        description = lib.mdDoc ''
           Path to the file containing your secret pleroma configuration.
 
-          <emphasis>DO NOT POINT THIS OPTION TO THE NIX
-          STORE</emphasis>, the store being world-readable, it'll
+          *DO NOT POINT THIS OPTION TO THE NIX
+          STORE*, the store being world-readable, it'll
           compromise all your secrets.
         '';
       };
diff --git a/nixos/modules/services/networking/polipo.nix b/nixos/modules/services/networking/polipo.nix
index 1ff9388346b6..d820e1b397b8 100644
--- a/nixos/modules/services/networking/polipo.nix
+++ b/nixos/modules/services/networking/polipo.nix
@@ -26,26 +26,26 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = "Whether to run the polipo caching web proxy.";
+        description = lib.mdDoc "Whether to run the polipo caching web proxy.";
       };
 
       proxyAddress = mkOption {
         type = types.str;
         default = "127.0.0.1";
-        description = "IP address on which Polipo will listen.";
+        description = lib.mdDoc "IP address on which Polipo will listen.";
       };
 
       proxyPort = mkOption {
         type = types.int;
         default = 8123;
-        description = "TCP port on which Polipo will listen.";
+        description = lib.mdDoc "TCP port on which Polipo will listen.";
       };
 
       allowedClients = mkOption {
         type = types.listOf types.str;
         default = [ "127.0.0.1" "::1" ];
         example = [ "127.0.0.1" "::1" "134.157.168.0/24" "2001:660:116::/48" ];
-        description = ''
+        description = lib.mdDoc ''
           List of IP addresses or network addresses that may connect to Polipo.
         '';
       };
@@ -54,7 +54,7 @@ in
         type = types.str;
         default = "";
         example = "localhost:8124";
-        description = ''
+        description = lib.mdDoc ''
           Hostname and port number of an HTTP parent proxy;
           it should have the form ‘host:port’.
         '';
@@ -64,7 +64,7 @@ in
         type = types.str;
         default = "";
         example = "localhost:9050";
-        description = ''
+        description = lib.mdDoc ''
           Hostname and port number of an SOCKS parent proxy;
           it should have the form ‘host:port’.
         '';
@@ -73,7 +73,7 @@ in
       extraConfig = mkOption {
         type = types.lines;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           Polio configuration. Contents will be added
           verbatim to the configuration file.
         '';
diff --git a/nixos/modules/services/networking/powerdns.nix b/nixos/modules/services/networking/powerdns.nix
index b035698456c0..f7c72361dfa1 100644
--- a/nixos/modules/services/networking/powerdns.nix
+++ b/nixos/modules/services/networking/powerdns.nix
@@ -13,9 +13,9 @@ in {
       extraConfig = mkOption {
         type = types.lines;
         default = "launch=bind";
-        description = ''
+        description = lib.mdDoc ''
           PowerDNS configuration. Refer to
-          <link xlink:href="https://doc.powerdns.com/authoritative/settings.html"/>
+          <https://doc.powerdns.com/authoritative/settings.html>
           for details on supported values.
         '';
       };
diff --git a/nixos/modules/services/networking/pppd.nix b/nixos/modules/services/networking/pppd.nix
index d1ed25b0238f..d923b49dda29 100644
--- a/nixos/modules/services/networking/pppd.nix
+++ b/nixos/modules/services/networking/pppd.nix
@@ -18,12 +18,12 @@ in
         default = pkgs.ppp;
         defaultText = literalExpression "pkgs.ppp";
         type = types.package;
-        description = "pppd package to use.";
+        description = lib.mdDoc "pppd package to use.";
       };
 
       peers = mkOption {
         default = {};
-        description = "pppd peers.";
+        description = lib.mdDoc "pppd peers.";
         type = types.attrsOf (types.submodule (
           { name, ... }:
           {
@@ -32,27 +32,27 @@ in
                 type = types.str;
                 default = name;
                 example = "dialup";
-                description = "Name of the PPP peer.";
+                description = lib.mdDoc "Name of the PPP peer.";
               };
 
               enable = mkOption {
                 type = types.bool;
                 default = true;
                 example = false;
-                description = "Whether to enable this PPP peer.";
+                description = lib.mdDoc "Whether to enable this PPP peer.";
               };
 
               autostart = mkOption {
                 type = types.bool;
                 default = true;
                 example = false;
-                description = "Whether the PPP session is automatically started at boot time.";
+                description = lib.mdDoc "Whether the PPP session is automatically started at boot time.";
               };
 
               config = mkOption {
                 type = types.lines;
                 default = "";
-                description = "pppd configuration for this peer, see the pppd(8) man page.";
+                description = lib.mdDoc "pppd configuration for this peer, see the pppd(8) man page.";
               };
             };
           }));
diff --git a/nixos/modules/services/networking/pptpd.nix b/nixos/modules/services/networking/pptpd.nix
index 423e14e998f8..d16496a2cb52 100644
--- a/nixos/modules/services/networking/pptpd.nix
+++ b/nixos/modules/services/networking/pptpd.nix
@@ -9,31 +9,31 @@ with lib;
 
       serverIp = mkOption {
         type        = types.str;
-        description = "The server-side IP address.";
+        description = lib.mdDoc "The server-side IP address.";
         default     = "10.124.124.1";
       };
 
       clientIpRange = mkOption {
         type        = types.str;
-        description = "The range from which client IPs are drawn.";
+        description = lib.mdDoc "The range from which client IPs are drawn.";
         default     = "10.124.124.2-11";
       };
 
       maxClients = mkOption {
         type        = types.int;
-        description = "The maximum number of simultaneous connections.";
+        description = lib.mdDoc "The maximum number of simultaneous connections.";
         default     = 10;
       };
 
       extraPptpdOptions = mkOption {
         type        = types.lines;
-        description = "Adds extra lines to the pptpd configuration file.";
+        description = lib.mdDoc "Adds extra lines to the pptpd configuration file.";
         default     = "";
       };
 
       extraPppdOptions = mkOption {
         type        = types.lines;
-        description = "Adds extra lines to the pppd options file.";
+        description = lib.mdDoc "Adds extra lines to the pppd options file.";
         default     = "";
         example     = ''
           ms-dns 8.8.8.8
diff --git a/nixos/modules/services/networking/prayer.nix b/nixos/modules/services/networking/prayer.nix
index 513509eaca3a..01e961997a77 100644
--- a/nixos/modules/services/networking/prayer.nix
+++ b/nixos/modules/services/networking/prayer.nix
@@ -46,7 +46,7 @@ in
       port = mkOption {
         default = 2080;
         type = types.port;
-        description = ''
+        description = lib.mdDoc ''
           Port the prayer http server is listening to.
         '';
       };
@@ -54,7 +54,7 @@ in
       extraConfig = mkOption {
         type = types.lines;
         default = "" ;
-        description = ''
+        description = lib.mdDoc ''
           Extra configuration. Contents will be added verbatim to the configuration file.
         '';
       };
diff --git a/nixos/modules/services/networking/privoxy.nix b/nixos/modules/services/networking/privoxy.nix
index 7bc964d5f34a..1ad5b155feb2 100644
--- a/nixos/modules/services/networking/privoxy.nix
+++ b/nixos/modules/services/networking/privoxy.nix
@@ -58,7 +58,7 @@ in
     enableTor = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         Whether to configure Privoxy to use Tor's faster SOCKS port,
         suitable for HTTP.
       '';
@@ -106,8 +106,8 @@ in
     userActions = mkOption {
       type = types.lines;
       default = "";
-      description = ''
-        Actions to be included in a <literal>user.action</literal> file. This
+      description = lib.mdDoc ''
+        Actions to be included in a `user.action` file. This
         will have a higher priority and can be used to override all other
         actions.
       '';
@@ -116,8 +116,8 @@ in
     userFilters = mkOption {
       type = types.lines;
       default = "";
-      description = ''
-        Filters to be included in a <literal>user.filter</literal> file. This
+      description = lib.mdDoc ''
+        Filters to be included in a `user.filter` file. This
         will have a higher priority and can be used to override all other
         filters definitions.
       '';
@@ -130,13 +130,13 @@ in
         options.listen-address = mkOption {
           type = types.str;
           default = "127.0.0.1:8118";
-          description = "Pair of address:port the proxy server is listening to.";
+          description = lib.mdDoc "Pair of address:port the proxy server is listening to.";
         };
 
         options.enable-edit-actions = mkOption {
           type = types.bool;
           default = false;
-          description = "Whether the web-based actions file editor may be used.";
+          description = lib.mdDoc "Whether the web-based actions file editor may be used.";
         };
 
         options.actionsfile = mkOption {
@@ -146,7 +146,7 @@ in
           apply = x: x ++ optional (cfg.userActions != "")
             (toString (pkgs.writeText "user.actions" cfg.userActions));
           default = [ "match-all.action" "default.action" ];
-          description = ''
+          description = lib.mdDoc ''
             List of paths to Privoxy action files. These paths may either be
             absolute or relative to the privoxy configuration directory.
           '';
@@ -157,7 +157,7 @@ in
           default = [ "default.filter" ];
           apply = x: x ++ optional (cfg.userFilters != "")
             (toString (pkgs.writeText "user.filter" cfg.userFilters));
-          description = ''
+          description = lib.mdDoc ''
             List of paths to Privoxy filter files. These paths may either be
             absolute or relative to the privoxy configuration directory.
           '';
diff --git a/nixos/modules/services/networking/prosody.nix b/nixos/modules/services/networking/prosody.nix
index 9e8db04e6224..f32c7adbd2c3 100644
--- a/nixos/modules/services/networking/prosody.nix
+++ b/nixos/modules/services/networking/prosody.nix
@@ -10,19 +10,19 @@ let
 
       key = mkOption {
         type = types.path;
-        description = "Path to the key file.";
+        description = lib.mdDoc "Path to the key file.";
       };
 
       # TODO: rename to certificate to match the prosody config
       cert = mkOption {
         type = types.path;
-        description = "Path to the certificate file.";
+        description = lib.mdDoc "Path to the certificate file.";
       };
 
       extraOptions = mkOption {
         type = types.attrs;
         default = {};
-        description = "Extra SSL configuration options.";
+        description = lib.mdDoc "Extra SSL configuration options.";
       };
 
     };
@@ -32,11 +32,11 @@ let
     options = {
       url = mkOption {
         type = types.str;
-        description = "URL of the endpoint you want to make discoverable";
+        description = lib.mdDoc "URL of the endpoint you want to make discoverable";
       };
       description = mkOption {
         type = types.str;
-        description = "A short description of the endpoint you want to advertise";
+        description = lib.mdDoc "A short description of the endpoint you want to advertise";
       };
     };
   };
@@ -46,216 +46,216 @@ let
     roster = mkOption {
       type = types.bool;
       default = true;
-      description = "Allow users to have a roster";
+      description = lib.mdDoc "Allow users to have a roster";
     };
 
     saslauth = mkOption {
       type = types.bool;
       default = true;
-      description = "Authentication for clients and servers. Recommended if you want to log in.";
+      description = lib.mdDoc "Authentication for clients and servers. Recommended if you want to log in.";
     };
 
     tls = mkOption {
       type = types.bool;
       default = true;
-      description = "Add support for secure TLS on c2s/s2s connections";
+      description = lib.mdDoc "Add support for secure TLS on c2s/s2s connections";
     };
 
     dialback = mkOption {
       type = types.bool;
       default = true;
-      description = "s2s dialback support";
+      description = lib.mdDoc "s2s dialback support";
     };
 
     disco = mkOption {
       type = types.bool;
       default = true;
-      description = "Service discovery";
+      description = lib.mdDoc "Service discovery";
     };
 
     # Not essential, but recommended
     carbons = mkOption {
       type = types.bool;
       default = true;
-      description = "Keep multiple clients in sync";
+      description = lib.mdDoc "Keep multiple clients in sync";
     };
 
     csi = mkOption {
       type = types.bool;
       default = true;
-      description = "Implements the CSI protocol that allows clients to report their active/inactive state to the server";
+      description = lib.mdDoc "Implements the CSI protocol that allows clients to report their active/inactive state to the server";
     };
 
     cloud_notify = mkOption {
       type = types.bool;
       default = true;
-      description = "Push notifications to inform users of new messages or other pertinent information even when they have no XMPP clients online";
+      description = lib.mdDoc "Push notifications to inform users of new messages or other pertinent information even when they have no XMPP clients online";
     };
 
     pep = mkOption {
       type = types.bool;
       default = true;
-      description = "Enables users to publish their mood, activity, playing music and more";
+      description = lib.mdDoc "Enables users to publish their mood, activity, playing music and more";
     };
 
     private = mkOption {
       type = types.bool;
       default = true;
-      description = "Private XML storage (for room bookmarks, etc.)";
+      description = lib.mdDoc "Private XML storage (for room bookmarks, etc.)";
     };
 
     blocklist = mkOption {
       type = types.bool;
       default = true;
-      description = "Allow users to block communications with other users";
+      description = lib.mdDoc "Allow users to block communications with other users";
     };
 
     vcard = mkOption {
       type = types.bool;
       default = false;
-      description = "Allow users to set vCards";
+      description = lib.mdDoc "Allow users to set vCards";
     };
 
     vcard_legacy = mkOption {
       type = types.bool;
       default = true;
-      description = "Converts users profiles and Avatars between old and new formats";
+      description = lib.mdDoc "Converts users profiles and Avatars between old and new formats";
     };
 
     bookmarks = mkOption {
       type = types.bool;
       default = true;
-      description = "Allows interop between older clients that use XEP-0048: Bookmarks in its 1.0 version and recent clients which use it in PEP";
+      description = lib.mdDoc "Allows interop between older clients that use XEP-0048: Bookmarks in its 1.0 version and recent clients which use it in PEP";
     };
 
     # Nice to have
     version = mkOption {
       type = types.bool;
       default = true;
-      description = "Replies to server version requests";
+      description = lib.mdDoc "Replies to server version requests";
     };
 
     uptime = mkOption {
       type = types.bool;
       default = true;
-      description = "Report how long server has been running";
+      description = lib.mdDoc "Report how long server has been running";
     };
 
     time = mkOption {
       type = types.bool;
       default = true;
-      description = "Let others know the time here on this server";
+      description = lib.mdDoc "Let others know the time here on this server";
     };
 
     ping = mkOption {
       type = types.bool;
       default = true;
-      description = "Replies to XMPP pings with pongs";
+      description = lib.mdDoc "Replies to XMPP pings with pongs";
     };
 
     register = mkOption {
       type = types.bool;
       default = true;
-      description = "Allow users to register on this server using a client and change passwords";
+      description = lib.mdDoc "Allow users to register on this server using a client and change passwords";
     };
 
     mam = mkOption {
       type = types.bool;
       default = true;
-      description = "Store messages in an archive and allow users to access it";
+      description = lib.mdDoc "Store messages in an archive and allow users to access it";
     };
 
     smacks = mkOption {
       type = types.bool;
       default = true;
-      description = "Allow a client to resume a disconnected session, and prevent message loss";
+      description = lib.mdDoc "Allow a client to resume a disconnected session, and prevent message loss";
     };
 
     # Admin interfaces
     admin_adhoc = mkOption {
       type = types.bool;
       default = true;
-      description = "Allows administration via an XMPP client that supports ad-hoc commands";
+      description = lib.mdDoc "Allows administration via an XMPP client that supports ad-hoc commands";
     };
 
     http_files = mkOption {
       type = types.bool;
       default = true;
-      description = "Serve static files from a directory over HTTP";
+      description = lib.mdDoc "Serve static files from a directory over HTTP";
     };
 
     proxy65 = mkOption {
       type = types.bool;
       default = true;
-      description = "Enables a file transfer proxy service which clients behind NAT can use";
+      description = lib.mdDoc "Enables a file transfer proxy service which clients behind NAT can use";
     };
 
     admin_telnet = mkOption {
       type = types.bool;
       default = false;
-      description = "Opens telnet console interface on localhost port 5582";
+      description = lib.mdDoc "Opens telnet console interface on localhost port 5582";
     };
 
     # HTTP modules
     bosh = mkOption {
       type = types.bool;
       default = false;
-      description = "Enable BOSH clients, aka 'Jabber over HTTP'";
+      description = lib.mdDoc "Enable BOSH clients, aka 'Jabber over HTTP'";
     };
 
     websocket = mkOption {
       type = types.bool;
       default = false;
-      description = "Enable WebSocket support";
+      description = lib.mdDoc "Enable WebSocket support";
     };
 
     # Other specific functionality
     limits = mkOption {
       type = types.bool;
       default = false;
-      description = "Enable bandwidth limiting for XMPP connections";
+      description = lib.mdDoc "Enable bandwidth limiting for XMPP connections";
     };
 
     groups = mkOption {
       type = types.bool;
       default = false;
-      description = "Shared roster support";
+      description = lib.mdDoc "Shared roster support";
     };
 
     server_contact_info = mkOption {
       type = types.bool;
       default = false;
-      description = "Publish contact information for this service";
+      description = lib.mdDoc "Publish contact information for this service";
     };
 
     announce = mkOption {
       type = types.bool;
       default = false;
-      description = "Send announcement to all online users";
+      description = lib.mdDoc "Send announcement to all online users";
     };
 
     welcome = mkOption {
       type = types.bool;
       default = false;
-      description = "Welcome users who register accounts";
+      description = lib.mdDoc "Welcome users who register accounts";
     };
 
     watchregistrations = mkOption {
       type = types.bool;
       default = false;
-      description = "Alert admins of registrations";
+      description = lib.mdDoc "Alert admins of registrations";
     };
 
     motd = mkOption {
       type = types.bool;
       default = false;
-      description = "Send a message to users when they log in";
+      description = lib.mdDoc "Send a message to users when they log in";
     };
 
     legacyauth = mkOption {
       type = types.bool;
       default = false;
-      description = "Legacy authentication. Only used by some old clients and bots";
+      description = lib.mdDoc "Legacy authentication. Only used by some old clients and bots";
     };
   };
 
@@ -279,27 +279,27 @@ let
     options = {
       domain = mkOption {
         type = types.str;
-        description = "Domain name of the MUC";
+        description = lib.mdDoc "Domain name of the MUC";
       };
       name = mkOption {
         type = types.str;
-        description = "The name to return in service discovery responses for the MUC service itself";
+        description = lib.mdDoc "The name to return in service discovery responses for the MUC service itself";
         default = "Prosody Chatrooms";
       };
       restrictRoomCreation = mkOption {
         type = types.enum [ true false "admin" "local" ];
         default = false;
-        description = "Restrict room creation to server admins";
+        description = lib.mdDoc "Restrict room creation to server admins";
       };
       maxHistoryMessages = mkOption {
         type = types.int;
         default = 20;
-        description = "Specifies a limit on what each room can be configured to keep";
+        description = lib.mdDoc "Specifies a limit on what each room can be configured to keep";
       };
       roomLocking = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Enables room locking, which means that a room must be
           configured before it can be used. Locked rooms are invisible
           and cannot be entered by anyone but the creator
@@ -308,7 +308,7 @@ let
       roomLockTimeout = mkOption {
         type = types.int;
         default = 300;
-        description = ''
+        description = lib.mdDoc ''
           Timout after which the room is destroyed or unlocked if not
           configured, in seconds
        '';
@@ -316,7 +316,7 @@ let
       tombstones = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           When a room is destroyed, it leaves behind a tombstone which
           prevents the room being entered or recreated. It also allows
           anyone who was not in the room at the time it was destroyed
@@ -329,7 +329,7 @@ let
       tombstoneExpiry = mkOption {
         type = types.int;
         default = 2678400;
-        description = ''
+        description = lib.mdDoc ''
           This settings controls how long a tombstone is considered
           valid. It defaults to 31 days. After this time, the room in
           question can be created again.
@@ -339,7 +339,7 @@ let
       vcard_muc = mkOption {
         type = types.bool;
         default = true;
-      description = "Adds the ability to set vCard for Multi User Chat rooms";
+      description = lib.mdDoc "Adds the ability to set vCard for Multi User Chat rooms";
       };
 
       # Extra parameters. Defaulting to prosody default values.
@@ -350,42 +350,42 @@ let
       roomDefaultPublic = mkOption {
         type = types.bool;
         default = true;
-        description = "If set, the MUC rooms will be public by default.";
+        description = lib.mdDoc "If set, the MUC rooms will be public by default.";
       };
       roomDefaultMembersOnly = mkOption {
         type = types.bool;
         default = false;
-        description = "If set, the MUC rooms will only be accessible to the members by default.";
+        description = lib.mdDoc "If set, the MUC rooms will only be accessible to the members by default.";
       };
       roomDefaultModerated = mkOption {
         type = types.bool;
         default = false;
-        description = "If set, the MUC rooms will be moderated by default.";
+        description = lib.mdDoc "If set, the MUC rooms will be moderated by default.";
       };
       roomDefaultPublicJids = mkOption {
         type = types.bool;
         default = false;
-        description = "If set, the MUC rooms will display the public JIDs by default.";
+        description = lib.mdDoc "If set, the MUC rooms will display the public JIDs by default.";
       };
       roomDefaultChangeSubject = mkOption {
         type = types.bool;
         default = false;
-        description = "If set, the rooms will display the public JIDs by default.";
+        description = lib.mdDoc "If set, the rooms will display the public JIDs by default.";
       };
       roomDefaultHistoryLength = mkOption {
         type = types.int;
         default = 20;
-        description = "Number of history message sent to participants by default.";
+        description = lib.mdDoc "Number of history message sent to participants by default.";
       };
       roomDefaultLanguage = mkOption {
         type = types.str;
         default = "en";
-        description = "Default room language.";
+        description = lib.mdDoc "Default room language.";
       };
       extraConfig = mkOption {
         type = types.lines;
         default = "";
-        description = "Additional MUC specific configuration";
+        description = lib.mdDoc "Additional MUC specific configuration";
       };
     };
   };
@@ -394,30 +394,30 @@ let
     options = {
       domain = mkOption {
         type = types.nullOr types.str;
-        description = "Domain name for the http-upload service";
+        description = lib.mdDoc "Domain name for the http-upload service";
       };
       uploadFileSizeLimit = mkOption {
         type = types.str;
         default = "50 * 1024 * 1024";
-        description = "Maximum file size, in bytes. Defaults to 50MB.";
+        description = lib.mdDoc "Maximum file size, in bytes. Defaults to 50MB.";
       };
       uploadExpireAfter = mkOption {
         type = types.str;
         default = "60 * 60 * 24 * 7";
-        description = "Max age of a file before it gets deleted, in seconds.";
+        description = lib.mdDoc "Max age of a file before it gets deleted, in seconds.";
       };
       userQuota = mkOption {
         type = types.nullOr types.int;
         default = null;
         example = 1234;
-        description = ''
+        description = lib.mdDoc ''
           Maximum size of all uploaded files per user, in bytes. There
           will be no quota if this option is set to null.
         '';
       };
       httpUploadPath = mkOption {
         type = types.str;
-        description = ''
+        description = lib.mdDoc ''
           Directory where the uploaded files will be stored. By
           default, uploaded files are put in a sub-directory of the
           default Prosody storage path (usually /var/lib/prosody).
@@ -434,25 +434,25 @@ let
       # TODO: require attribute
       domain = mkOption {
         type = types.str;
-        description = "Domain name";
+        description = lib.mdDoc "Domain name";
       };
 
       enabled = mkOption {
         type = types.bool;
         default = false;
-        description = "Whether to enable the virtual host";
+        description = lib.mdDoc "Whether to enable the virtual host";
       };
 
       ssl = mkOption {
         type = types.nullOr (types.submodule sslOpts);
         default = null;
-        description = "Paths to SSL files";
+        description = lib.mdDoc "Paths to SSL files";
       };
 
       extraConfig = mkOption {
         type = types.lines;
         default = "";
-        description = "Additional virtual host specific configuration";
+        description = lib.mdDoc "Additional virtual host specific configuration";
       };
 
     };
@@ -472,13 +472,13 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = "Whether to enable the prosody server";
+        description = lib.mdDoc "Whether to enable the prosody server";
       };
 
       xmppComplianceSuite = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           The XEP-0423 defines a set of recommended XEPs to implement
           for a server. It's generally a good idea to implement this
           set of extensions if you want to provide your users with a
@@ -498,7 +498,7 @@ in
 
       package = mkOption {
         type = types.package;
-        description = "Prosody package to use";
+        description = lib.mdDoc "Prosody package to use";
         default = pkgs.prosody;
         defaultText = literalExpression "pkgs.prosody";
         example = literalExpression ''
@@ -512,7 +512,7 @@ in
       dataDir = mkOption {
         type = types.path;
         default = "/var/lib/prosody";
-        description = ''
+        description = lib.mdDoc ''
           The prosody home directory used to store all data. If left as the default value
           this directory will automatically be created before the prosody server starts, otherwise
           you are responsible for ensuring the directory exists with appropriate ownership
@@ -523,7 +523,7 @@ in
       disco_items = mkOption {
         type = types.listOf (types.submodule discoOpts);
         default = [];
-        description = "List of discoverable items you want to advertise.";
+        description = lib.mdDoc "List of discoverable items you want to advertise.";
       };
 
       user = mkOption {
@@ -557,38 +557,38 @@ in
       allowRegistration = mkOption {
         type = types.bool;
         default = false;
-        description = "Allow account creation";
+        description = lib.mdDoc "Allow account creation";
       };
 
       # HTTP server-related options
       httpPorts = mkOption {
         type = types.listOf types.int;
-        description = "Listening HTTP ports list for this service.";
+        description = lib.mdDoc "Listening HTTP ports list for this service.";
         default = [ 5280 ];
       };
 
       httpInterfaces = mkOption {
         type = types.listOf types.str;
         default = [ "*" "::" ];
-        description = "Interfaces on which the HTTP server will listen on.";
+        description = lib.mdDoc "Interfaces on which the HTTP server will listen on.";
       };
 
       httpsPorts = mkOption {
         type = types.listOf types.int;
-        description = "Listening HTTPS ports list for this service.";
+        description = lib.mdDoc "Listening HTTPS ports list for this service.";
         default = [ 5281 ];
       };
 
       httpsInterfaces = mkOption {
         type = types.listOf types.str;
         default = [ "*" "::" ];
-        description = "Interfaces on which the HTTPS server will listen on.";
+        description = lib.mdDoc "Interfaces on which the HTTPS server will listen on.";
       };
 
       c2sRequireEncryption = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Force clients to use encrypted connections? This option will
           prevent clients from authenticating unless they are using encryption.
         '';
@@ -597,7 +597,7 @@ in
       s2sRequireEncryption = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Force servers to use encrypted connections? This option will
           prevent servers from authenticating unless they are using encryption.
           Note that this is different from authentication.
@@ -607,7 +607,7 @@ in
       s2sSecureAuth = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Force certificate authentication for server-to-server connections?
           This provides ideal security, but requires servers you communicate
           with to support encryption AND present valid, trusted certificates.
@@ -619,7 +619,7 @@ in
         type = types.listOf types.str;
         default = [];
         example = [ "insecure.example.com" ];
-        description = ''
+        description = lib.mdDoc ''
           Some servers have invalid or self-signed certificates. You can list
           remote domains here that will not be required to authenticate using
           certificates. They will be authenticated using DNS instead, even
@@ -631,7 +631,7 @@ in
         type = types.listOf types.str;
         default = [];
         example = [ "jabber.org" ];
-        description = ''
+        description = lib.mdDoc ''
           Even if you leave s2s_secure_auth disabled, you can still require valid
           certificates for some domains by specifying a list here.
         '';
@@ -643,17 +643,17 @@ in
       extraModules = mkOption {
         type = types.listOf types.str;
         default = [];
-        description = "Enable custom modules";
+        description = lib.mdDoc "Enable custom modules";
       };
 
       extraPluginPaths = mkOption {
         type = types.listOf types.path;
         default = [];
-        description = "Addtional path in which to look find plugins/modules";
+        description = lib.mdDoc "Addtional path in which to look find plugins/modules";
       };
 
       uploadHttp = mkOption {
-        description = ''
+        description = lib.mdDoc ''
           Configures the Prosody builtin HTTP server to handle user uploads.
         '';
         type = types.nullOr (types.submodule uploadHttpOpts);
@@ -669,12 +669,12 @@ in
         example = [ {
           domain = "conference.my-xmpp-example-host.org";
         } ];
-        description = "Multi User Chat (MUC) configuration";
+        description = lib.mdDoc "Multi User Chat (MUC) configuration";
       };
 
       virtualHosts = mkOption {
 
-        description = "Define the virtual hosts";
+        description = lib.mdDoc "Define the virtual hosts";
 
         type = with types; attrsOf (submodule vHostOpts);
 
@@ -697,27 +697,27 @@ in
       ssl = mkOption {
         type = types.nullOr (types.submodule sslOpts);
         default = null;
-        description = "Paths to SSL files";
+        description = lib.mdDoc "Paths to SSL files";
       };
 
       admins = mkOption {
         type = types.listOf types.str;
         default = [];
         example = [ "admin1@example.com" "admin2@example.com" ];
-        description = "List of administrators of the current host";
+        description = lib.mdDoc "List of administrators of the current host";
       };
 
       authentication = mkOption {
         type = types.enum [ "internal_plain" "internal_hashed" "cyrus" "anonymous" ];
         default = "internal_hashed";
         example = "internal_plain";
-        description = "Authentication mechanism used for logins.";
+        description = lib.mdDoc "Authentication mechanism used for logins.";
       };
 
       extraConfig = mkOption {
         type = types.lines;
         default = "";
-        description = "Additional prosody configuration";
+        description = lib.mdDoc "Additional prosody configuration";
       };
 
     };
diff --git a/nixos/modules/services/networking/quassel.nix b/nixos/modules/services/networking/quassel.nix
index 844c9a6b8b35..a4b203ea0018 100644
--- a/nixos/modules/services/networking/quassel.nix
+++ b/nixos/modules/services/networking/quassel.nix
@@ -22,7 +22,7 @@ in
       certificateFile = mkOption {
         type = types.nullOr types.str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Path to the certificate used for SSL connections with clients.
         '';
       };
@@ -30,7 +30,7 @@ in
       requireSSL = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Require SSL for connections from clients.
         '';
       };
@@ -39,7 +39,7 @@ in
         type = types.package;
         default = pkgs.quasselDaemon;
         defaultText = literalExpression "pkgs.quasselDaemon";
-        description = ''
+        description = lib.mdDoc ''
           The package of the quassel daemon.
         '';
       };
@@ -57,7 +57,7 @@ in
       portNumber = mkOption {
         type = types.port;
         default = 4242;
-        description = ''
+        description = lib.mdDoc ''
           The port number the Quassel daemon will be listening to.
         '';
       };
@@ -68,7 +68,7 @@ in
           "/home/''${config.${opt.user}}/.config/quassel-irc.org"
         '';
         type = types.str;
-        description = ''
+        description = lib.mdDoc ''
           The directory holding configuration files, the SQlite database and the SSL Cert.
         '';
       };
@@ -76,7 +76,7 @@ in
       user = mkOption {
         default = null;
         type = types.nullOr types.str;
-        description = ''
+        description = lib.mdDoc ''
           The existing user the Quassel daemon should run as. If left empty, a default "quassel" user will be created.
         '';
       };
diff --git a/nixos/modules/services/networking/quicktun.nix b/nixos/modules/services/networking/quicktun.nix
index 438e67d5ebb6..e2282b9aaf7c 100644
--- a/nixos/modules/services/networking/quicktun.nix
+++ b/nixos/modules/services/networking/quicktun.nix
@@ -13,7 +13,7 @@ with lib;
 
     services.quicktun = mkOption {
       default = { };
-      description = "QuickTun tunnels";
+      description = lib.mdDoc "QuickTun tunnels";
       type = types.attrsOf (types.submodule {
         options = {
           tunMode = mkOption {
diff --git a/nixos/modules/services/networking/quorum.nix b/nixos/modules/services/networking/quorum.nix
index bddcd18c7fbe..67027ae3f857 100644
--- a/nixos/modules/services/networking/quorum.nix
+++ b/nixos/modules/services/networking/quorum.nix
@@ -18,82 +18,82 @@ in {
       user = mkOption {
         type = types.str;
         default = "quorum";
-        description = "The user as which to run quorum.";
+        description = lib.mdDoc "The user as which to run quorum.";
       };
 
       group = mkOption {
         type = types.str;
         default = cfg.user;
         defaultText = literalExpression "config.${opt.user}";
-        description = "The group as which to run quorum.";
+        description = lib.mdDoc "The group as which to run quorum.";
       };
 
       port = mkOption {
         type = types.port;
         default = 21000;
-        description = "Override the default port on which to listen for connections.";
+        description = lib.mdDoc "Override the default port on which to listen for connections.";
       };
 
       nodekeyFile = mkOption {
         type = types.path;
         default = "${dataDir}/nodekey";
-        description = "Path to the nodekey.";
+        description = lib.mdDoc "Path to the nodekey.";
       };
 
       staticNodes = mkOption {
         type = types.listOf types.str;
         default = [];
         example = [ "enode://dd333ec28f0a8910c92eb4d336461eea1c20803eed9cf2c056557f986e720f8e693605bba2f4e8f289b1162e5ac7c80c914c7178130711e393ca76abc1d92f57@0.0.0.0:30303?discport=0" ];
-        description = "List of validator nodes.";
+        description = lib.mdDoc "List of validator nodes.";
       };
 
       privateconfig = mkOption {
         type = types.str;
         default = "ignore";
-        description = "Configuration of privacy transaction manager.";
+        description = lib.mdDoc "Configuration of privacy transaction manager.";
       };
 
       syncmode = mkOption {
         type = types.enum [ "fast" "full" "light" ];
         default = "full";
-        description = "Blockchain sync mode.";
+        description = lib.mdDoc "Blockchain sync mode.";
       };
 
       blockperiod = mkOption {
         type = types.int;
         default = 5;
-        description = "Default minimum difference between two consecutive block's timestamps in seconds.";
+        description = lib.mdDoc "Default minimum difference between two consecutive block's timestamps in seconds.";
       };
 
       permissioned = mkOption {
         type = types.bool;
         default = true;
-        description = "Allow only a defined list of nodes to connect.";
+        description = lib.mdDoc "Allow only a defined list of nodes to connect.";
       };
 
       rpc = {
         enable = mkOption {
           type = types.bool;
           default = true;
-          description = "Enable RPC interface.";
+          description = lib.mdDoc "Enable RPC interface.";
         };
 
         address = mkOption {
           type = types.str;
           default = "0.0.0.0";
-          description = "Listening address for RPC connections.";
+          description = lib.mdDoc "Listening address for RPC connections.";
         };
 
         port = mkOption {
           type = types.port;
           default = 22004;
-          description = "Override the default port on which to listen for RPC connections.";
+          description = lib.mdDoc "Override the default port on which to listen for RPC connections.";
         };
 
         api = mkOption {
           type = types.str;
           default = "admin,db,eth,debug,miner,net,shh,txpool,personal,web3,quorum,istanbul";
-          description = "API's offered over the HTTP-RPC interface.";
+          description = lib.mdDoc "API's offered over the HTTP-RPC interface.";
         };
       };
 
@@ -101,31 +101,31 @@ in {
         enable = mkOption {
           type = types.bool;
           default = true;
-          description = "Enable WS-RPC interface.";
+          description = lib.mdDoc "Enable WS-RPC interface.";
         };
 
         address = mkOption {
           type = types.str;
           default = "0.0.0.0";
-          description = "Listening address for WS-RPC connections.";
+          description = lib.mdDoc "Listening address for WS-RPC connections.";
         };
 
         port = mkOption {
           type = types.port;
           default = 8546;
-          description = "Override the default port on which to listen for WS-RPC connections.";
+          description = lib.mdDoc "Override the default port on which to listen for WS-RPC connections.";
         };
 
         api = mkOption {
           type = types.str;
           default = "admin,db,eth,debug,miner,net,shh,txpool,personal,web3,quorum,istanbul";
-          description = "API's offered over the WS-RPC interface.";
+          description = lib.mdDoc "API's offered over the WS-RPC interface.";
         };
 
        origins = mkOption {
           type = types.str;
           default = "*";
-          description = "Origins from which to accept websockets requests";
+          description = lib.mdDoc "Origins from which to accept websockets requests";
        };
      };
 
@@ -160,7 +160,7 @@ in {
           parentHash = "0x0000000000000000000000000000000000000000000000000000000000000000";
           timestamp = "0x00";
           }'';
-        description = "Blockchain genesis settings.";
+        description = lib.mdDoc "Blockchain genesis settings.";
       };
      };
   };
diff --git a/nixos/modules/services/networking/r53-ddns.nix b/nixos/modules/services/networking/r53-ddns.nix
index a8839762d530..77738c755313 100644
--- a/nixos/modules/services/networking/r53-ddns.nix
+++ b/nixos/modules/services/networking/r53-ddns.nix
@@ -15,22 +15,22 @@ in
       interval = mkOption {
         type = types.str;
         default = "15min";
-        description = "How often to update the entry";
+        description = lib.mdDoc "How often to update the entry";
       };
 
       zoneID = mkOption {
         type = types.str;
-        description = "The ID of your zone in Route53";
+        description = lib.mdDoc "The ID of your zone in Route53";
       };
 
       domain = mkOption {
         type = types.str;
-        description = "The name of your domain in Route53";
+        description = lib.mdDoc "The name of your domain in Route53";
       };
 
       hostname = mkOption {
         type = types.str;
-        description = ''
+        description = lib.mdDoc ''
           Manually specify the hostname. Otherwise the tool will try to use the name
           returned by the OS (Call to gethostname)
         '';
@@ -38,7 +38,7 @@ in
 
       environmentFile = mkOption {
         type = types.str;
-        description = ''
+        description = lib.mdDoc ''
           File containing the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
           in the format of an EnvironmentFile as described by systemd.exec(5)
         '';
diff --git a/nixos/modules/services/networking/radicale.nix b/nixos/modules/services/networking/radicale.nix
index 227bafc1d0e8..687cf206e145 100644
--- a/nixos/modules/services/networking/radicale.nix
+++ b/nixos/modules/services/networking/radicale.nix
@@ -28,7 +28,7 @@ in {
     enable = mkEnableOption "Radicale CalDAV and CardDAV server";
 
     package = mkOption {
-      description = "Radicale package to use.";
+      description = lib.mdDoc "Radicale package to use.";
       # Default cannot be pkgs.radicale because non-null values suppress
       # warnings about incompatible configuration and storage formats.
       type = with types; nullOr package // { inherit (package) description; };
@@ -39,21 +39,21 @@ in {
     config = mkOption {
       type = types.str;
       default = "";
-      description = ''
+      description = lib.mdDoc ''
         Radicale configuration, this will set the service
         configuration file.
-        This option is mutually exclusive with <option>settings</option>.
-        This option is deprecated.  Use <option>settings</option> instead.
+        This option is mutually exclusive with {option}`settings`.
+        This option is deprecated.  Use {option}`settings` instead.
       '';
     };
 
     settings = mkOption {
       type = format.type;
       default = { };
-      description = ''
+      description = lib.mdDoc ''
         Configuration for Radicale. See
-        <link xlink:href="https://radicale.org/3.0.html#documentation/configuration" />.
-        This option is mutually exclusive with <option>config</option>.
+        <https://radicale.org/3.0.html#documentation/configuration>.
+        This option is mutually exclusive with {option}`config`.
       '';
       example = literalExpression ''
         server = {
@@ -72,12 +72,12 @@ in {
 
     rights = mkOption {
       type = format.type;
-      description = ''
+      description = lib.mdDoc ''
         Configuration for Radicale's rights file. See
-        <link xlink:href="https://radicale.org/3.0.html#documentation/authentication-and-rights" />.
-        This option only works in conjunction with <option>settings</option>.
-        Setting this will also set <option>settings.rights.type</option> and
-        <option>settings.rights.file</option> to approriate values.
+        <https://radicale.org/3.0.html#documentation/authentication-and-rights>.
+        This option only works in conjunction with {option}`settings`.
+        Setting this will also set {option}`settings.rights.type` and
+        {option}`settings.rights.file` to approriate values.
       '';
       default = { };
       example = literalExpression ''
@@ -102,7 +102,7 @@ in {
     extraArgs = mkOption {
       type = types.listOf types.str;
       default = [];
-      description = "Extra arguments passed to the Radicale daemon.";
+      description = lib.mdDoc "Extra arguments passed to the Radicale daemon.";
     };
   };
 
diff --git a/nixos/modules/services/networking/radvd.nix b/nixos/modules/services/networking/radvd.nix
index fb3eb71a8ce1..72590eda4ee6 100644
--- a/nixos/modules/services/networking/radvd.nix
+++ b/nixos/modules/services/networking/radvd.nix
@@ -22,9 +22,9 @@ in
       type = types.bool;
       default = false;
       description =
-        ''
+        lib.mdDoc ''
           Whether to enable the Router Advertisement Daemon
-          (<command>radvd</command>), which provides link-local
+          ({command}`radvd`), which provides link-local
           advertisements of IPv6 router addresses and prefixes using
           the Neighbor Discovery Protocol (NDP).  This enables
           stateless address autoconfiguration in IPv6 clients on the
@@ -36,7 +36,7 @@ in
       type = types.package;
       default = pkgs.radvd;
       defaultText = literalExpression "pkgs.radvd";
-      description = ''
+      description = lib.mdDoc ''
         The RADVD package to use for the RADVD service.
       '';
     };
@@ -51,7 +51,7 @@ in
           };
         '';
       description =
-        ''
+        lib.mdDoc ''
           The contents of the radvd configuration file.
         '';
     };
diff --git a/nixos/modules/services/networking/rdnssd.nix b/nixos/modules/services/networking/rdnssd.nix
index fd04bb8108f0..c63356e73468 100644
--- a/nixos/modules/services/networking/rdnssd.nix
+++ b/nixos/modules/services/networking/rdnssd.nix
@@ -21,10 +21,10 @@ in
       default = false;
       #default = config.networking.enableIPv6;
       description =
-        ''
+        lib.mdDoc ''
           Whether to enable the RDNSS daemon
-          (<command>rdnssd</command>), which configures DNS servers in
-          <filename>/etc/resolv.conf</filename> from RDNSS
+          ({command}`rdnssd`), which configures DNS servers in
+          {file}`/etc/resolv.conf` from RDNSS
           advertisements sent by IPv6 routers.
         '';
     };
diff --git a/nixos/modules/services/networking/redsocks.nix b/nixos/modules/services/networking/redsocks.nix
index 8481f9debf39..5aa9f003bad5 100644
--- a/nixos/modules/services/networking/redsocks.nix
+++ b/nixos/modules/services/networking/redsocks.nix
@@ -11,19 +11,19 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = "Whether to enable redsocks.";
+        description = lib.mdDoc "Whether to enable redsocks.";
       };
 
       log_debug = mkOption {
         type = types.bool;
         default = false;
-        description = "Log connection progress.";
+        description = lib.mdDoc "Log connection progress.";
       };
 
       log_info = mkOption {
         type = types.bool;
         default = false;
-        description = "Log start and end of client sessions.";
+        description = lib.mdDoc "Log start and end of client sessions.";
       };
 
       log = mkOption {
@@ -45,7 +45,7 @@ in
         type = with types; nullOr str;
         default = null;
         description =
-          ''
+          lib.mdDoc ''
             Chroot under which to run redsocks. Log file is opened before
             chroot, but if logging to syslog /etc/localtime may be required.
           '';
@@ -53,7 +53,7 @@ in
 
       redsocks = mkOption {
         description =
-          ''
+          lib.mdDoc ''
             Local port to proxy associations to be performed.
 
             The example shows how to configure a proxy to handle port 80 as HTTP
@@ -74,7 +74,7 @@ in
             type = types.str;
             default = "127.0.0.1";
             description =
-              ''
+              lib.mdDoc ''
                 IP on which redsocks should listen. Defaults to 127.0.0.1 for
                 security reasons.
               '';
@@ -83,13 +83,13 @@ in
           port = mkOption {
             type = types.int;
             default = 12345;
-            description = "Port on which redsocks should listen.";
+            description = lib.mdDoc "Port on which redsocks should listen.";
           };
 
           proxy = mkOption {
             type = types.str;
             description =
-              ''
+              lib.mdDoc ''
                 Proxy through which redsocks should forward incoming traffic.
                 Example: "example.org:8080"
               '';
@@ -97,20 +97,20 @@ in
 
           type = mkOption {
             type = types.enum [ "socks4" "socks5" "http-connect" "http-relay" ];
-            description = "Type of proxy.";
+            description = lib.mdDoc "Type of proxy.";
           };
 
           login = mkOption {
             type = with types; nullOr str;
             default = null;
-            description = "Login to send to proxy.";
+            description = lib.mdDoc "Login to send to proxy.";
           };
 
           password = mkOption {
             type = with types; nullOr str;
             default = null;
             description =
-              ''
+              lib.mdDoc ''
                 Password to send to proxy. WARNING, this will end up
                 world-readable in the store! Awaiting
                 https://github.com/NixOS/nix/issues/8 to be able to fix.
@@ -135,14 +135,14 @@ in
           redirectInternetOnly = mkOption {
             type = types.bool;
             default = true;
-            description = "Exclude all non-globally-routable IPs from redsocks";
+            description = lib.mdDoc "Exclude all non-globally-routable IPs from redsocks";
           };
 
           doNotRedirect = mkOption {
             type = with types; listOf str;
             default = [];
             description =
-              ''
+              lib.mdDoc ''
                 Iptables filters that if matched will get the packet off of
                 redsocks.
               '';
@@ -153,7 +153,7 @@ in
             type = with types; either bool str;
             default = false;
             description =
-              ''
+              lib.mdDoc ''
                 Conditions to make outbound packets go through this redsocks
                 instance.
 
diff --git a/nixos/modules/services/networking/resilio.nix b/nixos/modules/services/networking/resilio.nix
index 891278506417..05798a2c83ee 100644
--- a/nixos/modules/services/networking/resilio.nix
+++ b/nixos/modules/services/networking/resilio.nix
@@ -47,7 +47,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           If enabled, start the Resilio Sync daemon. Once enabled, you can
           interact with the service through the Web UI, or configure it in your
           NixOS configuration.
@@ -59,7 +59,7 @@ in
         example = "Voltron";
         default = config.networking.hostName;
         defaultText = literalExpression "config.networking.hostName";
-        description = ''
+        description = lib.mdDoc ''
           Name of the Resilio Sync device.
         '';
       };
@@ -68,7 +68,7 @@ in
         type = types.int;
         default = 0;
         example = 44444;
-        description = ''
+        description = lib.mdDoc ''
           Listening port. Defaults to 0 which randomizes the port.
         '';
       };
@@ -76,7 +76,7 @@ in
       checkForUpdates = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Determines whether to check for updates and alert the user
           about them in the UI.
         '';
@@ -85,7 +85,7 @@ in
       useUpnp = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Use Universal Plug-n-Play (UPnP)
         '';
       };
@@ -94,7 +94,7 @@ in
         type = types.int;
         default = 0;
         example = 1024;
-        description = ''
+        description = lib.mdDoc ''
           Download speed limit. 0 is unlimited (default).
         '';
       };
@@ -103,7 +103,7 @@ in
         type = types.int;
         default = 0;
         example = 1024;
-        description = ''
+        description = lib.mdDoc ''
           Upload speed limit. 0 is unlimited (default).
         '';
       };
@@ -112,7 +112,7 @@ in
         type = types.str;
         default = "[::1]";
         example = "0.0.0.0";
-        description = ''
+        description = lib.mdDoc ''
           HTTP address to bind to.
         '';
       };
@@ -120,7 +120,7 @@ in
       httpListenPort = mkOption {
         type = types.int;
         default = 9000;
-        description = ''
+        description = lib.mdDoc ''
           HTTP port to bind on.
         '';
       };
@@ -129,7 +129,7 @@ in
         type = types.str;
         example = "allyourbase";
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           HTTP web login username.
         '';
       };
@@ -138,7 +138,7 @@ in
         type = types.str;
         example = "arebelongtous";
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           HTTP web login password.
         '';
       };
@@ -146,23 +146,23 @@ in
       encryptLAN = mkOption {
         type = types.bool;
         default = true;
-        description = "Encrypt LAN data.";
+        description = lib.mdDoc "Encrypt LAN data.";
       };
 
       enableWebUI = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Enable Web UI for administration. Bound to the specified
-          <literal>httpListenAddress</literal> and
-          <literal>httpListenPort</literal>.
+          `httpListenAddress` and
+          `httpListenPort`.
           '';
       };
 
       storagePath = mkOption {
         type = types.path;
         default = "/var/lib/resilio-sync/";
-        description = ''
+        description = lib.mdDoc ''
           Where BitTorrent Sync will store it's database files (containing
           things like username info and licenses). Generally, you should not
           need to ever change this.
@@ -172,14 +172,14 @@ in
       apiKey = mkOption {
         type = types.str;
         default = "";
-        description = "API key, which enables the developer API.";
+        description = lib.mdDoc "API key, which enables the developer API.";
       };
 
       directoryRoot = mkOption {
         type = types.str;
         default = "";
         example = "/media";
-        description = "Default directory to add folders in the web UI.";
+        description = lib.mdDoc "Default directory to add folders in the web UI.";
       };
 
       sharedFolders = mkOption {
diff --git a/nixos/modules/services/networking/robustirc-bridge.nix b/nixos/modules/services/networking/robustirc-bridge.nix
index 255af79ec04b..c5afbaf8ea18 100644
--- a/nixos/modules/services/networking/robustirc-bridge.nix
+++ b/nixos/modules/services/networking/robustirc-bridge.nix
@@ -13,7 +13,7 @@ in
       extraFlags = mkOption {
         type = types.listOf types.str;
         default = [];
-        description = ''Extra flags passed to the <command>robustirc-bridge</command> command. See <link xlink:href="https://robustirc.net/docs/adminguide.html#_bridge">RobustIRC Documentation</link> or robustirc-bridge(1) for details.'';
+        description = lib.mdDoc ''Extra flags passed to the {command}`robustirc-bridge` command. See [RobustIRC Documentation](https://robustirc.net/docs/adminguide.html#_bridge) or robustirc-bridge(1) for details.'';
         example = [
           "-network robustirc.net"
         ];
diff --git a/nixos/modules/services/networking/routedns.nix b/nixos/modules/services/networking/routedns.nix
index e0f5eedd2c8e..6f3d769e8644 100644
--- a/nixos/modules/services/networking/routedns.nix
+++ b/nixos/modules/services/networking/routedns.nix
@@ -38,8 +38,8 @@ in
           };
         }
       '';
-      description = ''
-        Configuration for RouteDNS, see <link xlink:href="https://github.com/folbricht/routedns/blob/master/doc/configuration.md"/>
+      description = lib.mdDoc ''
+        Configuration for RouteDNS, see <https://github.com/folbricht/routedns/blob/master/doc/configuration.md>
         for more information.
       '';
     };
@@ -49,14 +49,14 @@ in
       defaultText = "A RouteDNS configuration file automatically generated by values from services.routedns.*";
       type = types.path;
       example = literalExpression ''"''${pkgs.routedns}/cmd/routedns/example-config/use-case-1.toml"'';
-      description = "Path to RouteDNS TOML configuration file.";
+      description = lib.mdDoc "Path to RouteDNS TOML configuration file.";
     };
 
     package = mkOption {
       default = pkgs.routedns;
       defaultText = literalExpression "pkgs.routedns";
       type = types.package;
-      description = "RouteDNS package to use.";
+      description = lib.mdDoc "RouteDNS package to use.";
     };
   };
 
diff --git a/nixos/modules/services/networking/sabnzbd.nix b/nixos/modules/services/networking/sabnzbd.nix
index 54eeba1a9ec1..18e1d9f48b25 100644
--- a/nixos/modules/services/networking/sabnzbd.nix
+++ b/nixos/modules/services/networking/sabnzbd.nix
@@ -21,25 +21,25 @@ in
         type = types.package;
         default = pkgs.sabnzbd;
         defaultText = "pkgs.sabnzbd";
-        description = "The sabnzbd executable package run by the service.";
+        description = lib.mdDoc "The sabnzbd executable package run by the service.";
       };
 
       configFile = mkOption {
         type = types.path;
         default = "/var/lib/sabnzbd/sabnzbd.ini";
-        description = "Path to config file.";
+        description = lib.mdDoc "Path to config file.";
       };
 
       user = mkOption {
         default = "sabnzbd";
         type = types.str;
-        description = "User to run the service as";
+        description = lib.mdDoc "User to run the service as";
       };
 
       group = mkOption {
         type = types.str;
         default = "sabnzbd";
-        description = "Group to run the service as";
+        description = lib.mdDoc "Group to run the service as";
       };
     };
   };
diff --git a/nixos/modules/services/networking/seafile.nix b/nixos/modules/services/networking/seafile.nix
index 2839ffb60a1f..6d99ef6c8bbb 100644
--- a/nixos/modules/services/networking/seafile.nix
+++ b/nixos/modules/services/networking/seafile.nix
@@ -46,7 +46,7 @@ in {
             SERVICE_URL = mkOption {
               type = types.str;
               example = "https://www.example.com";
-              description = ''
+              description = lib.mdDoc ''
                 Seahub public URL.
               '';
             };
@@ -54,9 +54,9 @@ in {
         };
       };
       default = { };
-      description = ''
+      description = lib.mdDoc ''
         Configuration for ccnet, see
-        <link xlink:href="https://manual.seafile.com/config/ccnet-conf/"/>
+        <https://manual.seafile.com/config/ccnet-conf/>
         for supported values.
       '';
     };
@@ -70,7 +70,7 @@ in {
             port = mkOption {
               type = types.port;
               default = 8082;
-              description = ''
+              description = lib.mdDoc ''
                 The tcp port used by seafile fileserver.
               '';
             };
@@ -78,7 +78,7 @@ in {
               type = types.str;
               default = "127.0.0.1";
               example = "0.0.0.0";
-              description = ''
+              description = lib.mdDoc ''
                 The binding address used by seafile fileserver.
               '';
             };
@@ -86,9 +86,9 @@ in {
         };
       };
       default = { };
-      description = ''
+      description = lib.mdDoc ''
         Configuration for seafile-server, see
-        <link xlink:href="https://manual.seafile.com/config/seafile-conf/"/>
+        <https://manual.seafile.com/config/seafile-conf/>
         for supported values.
       '';
     };
@@ -97,7 +97,7 @@ in {
       type = types.int;
       default = 4;
       example = 10;
-      description = ''
+      description = lib.mdDoc ''
         The number of gunicorn worker processes for handling requests.
       '';
     };
@@ -105,7 +105,7 @@ in {
     adminEmail = mkOption {
       example = "john@example.com";
       type = types.str;
-      description = ''
+      description = lib.mdDoc ''
         Seafile Seahub Admin Account Email.
       '';
     };
@@ -113,7 +113,7 @@ in {
     initialAdminPassword = mkOption {
       example = "someStrongPass";
       type = types.str;
-      description = ''
+      description = lib.mdDoc ''
         Seafile Seahub Admin Account initial password.
         Should be change via Seahub web front-end.
       '';
@@ -121,7 +121,7 @@ in {
 
     seafilePackage = mkOption {
       type = types.package;
-      description = "Which package to use for the seafile server.";
+      description = lib.mdDoc "Which package to use for the seafile server.";
       default = pkgs.seafile-server;
       defaultText = literalExpression "pkgs.seafile-server";
     };
diff --git a/nixos/modules/services/networking/searx.nix b/nixos/modules/services/networking/searx.nix
index 10dc27da7009..238479864f88 100644
--- a/nixos/modules/services/networking/searx.nix
+++ b/nixos/modules/services/networking/searx.nix
@@ -51,14 +51,14 @@ in
         type = types.bool;
         default = false;
         relatedPackages = [ "searx" ];
-        description = "Whether to enable Searx, the meta search engine.";
+        description = lib.mdDoc "Whether to enable Searx, the meta search engine.";
       };
 
       environmentFile = mkOption {
         type = types.nullOr types.path;
         default = null;
-        description = ''
-          Environment file (see <literal>systemd.exec(5)</literal>
+        description = lib.mdDoc ''
+          Environment file (see `systemd.exec(5)`
           "EnvironmentFile=" section for the syntax) to define variables for
           Searx. This option can be used to safely include secret keys into the
           Searx configuration.
@@ -117,7 +117,7 @@ in
         type = types.package;
         default = pkgs.searx;
         defaultText = literalExpression "pkgs.searx";
-        description = "searx package to use.";
+        description = lib.mdDoc "searx package to use.";
       };
 
       runInUwsgi = mkOption {
@@ -146,7 +146,7 @@ in
             chmod-socket = "660";             # allow the searx group to read/write to the socket
           }
         '';
-        description = ''
+        description = lib.mdDoc ''
           Additional configuration of the uWSGI vassal running searx. It
           should notably specify on which interfaces and ports the vassal
           should listen.
diff --git a/nixos/modules/services/networking/shadowsocks.nix b/nixos/modules/services/networking/shadowsocks.nix
index 7bea269a9ed0..8eee40711a6d 100644
--- a/nixos/modules/services/networking/shadowsocks.nix
+++ b/nixos/modules/services/networking/shadowsocks.nix
@@ -34,7 +34,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to run shadowsocks-libev shadowsocks server.
         '';
       };
@@ -42,7 +42,7 @@ in
       localAddress = mkOption {
         type = types.coercedTo types.str singleton (types.listOf types.str);
         default = [ "[::0]" "0.0.0.0" ];
-        description = ''
+        description = lib.mdDoc ''
           Local addresses to which the server binds.
         '';
       };
@@ -50,7 +50,7 @@ in
       port = mkOption {
         type = types.int;
         default = 8388;
-        description = ''
+        description = lib.mdDoc ''
           Port which the server uses.
         '';
       };
@@ -58,7 +58,7 @@ in
       password = mkOption {
         type = types.nullOr types.str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Password for connecting clients.
         '';
       };
@@ -66,7 +66,7 @@ in
       passwordFile = mkOption {
         type = types.nullOr types.path;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Password file with a password for connecting clients.
         '';
       };
@@ -74,7 +74,7 @@ in
       mode = mkOption {
         type = types.enum [ "tcp_only" "tcp_and_udp" "udp_only" ];
         default = "tcp_and_udp";
-        description = ''
+        description = lib.mdDoc ''
           Relay protocols.
         '';
       };
@@ -82,7 +82,7 @@ in
       fastOpen = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           use TCP fast-open
         '';
       };
@@ -90,8 +90,8 @@ in
       encryptionMethod = mkOption {
         type = types.str;
         default = "chacha20-ietf-poly1305";
-        description = ''
-          Encryption method. See <link xlink:href="https://github.com/shadowsocks/shadowsocks-org/wiki/AEAD-Ciphers"/>.
+        description = lib.mdDoc ''
+          Encryption method. See <https://github.com/shadowsocks/shadowsocks-org/wiki/AEAD-Ciphers>.
         '';
       };
 
@@ -99,7 +99,7 @@ in
         type = types.nullOr types.str;
         default = null;
         example = literalExpression ''"''${pkgs.shadowsocks-v2ray-plugin}/bin/v2ray-plugin"'';
-        description = ''
+        description = lib.mdDoc ''
           SIP003 plugin for shadowsocks
         '';
       };
@@ -108,7 +108,7 @@ in
         type = types.str;
         default = "";
         example = "server;host=example.com";
-        description = ''
+        description = lib.mdDoc ''
           Options to pass to the plugin if one was specified
         '';
       };
@@ -119,13 +119,13 @@ in
         example = {
           nameserver = "8.8.8.8";
         };
-        description = ''
+        description = lib.mdDoc ''
           Additional configuration for shadowsocks that is not covered by the
           provided options. The provided attrset will be serialized to JSON and
           has to contain valid shadowsocks options. Unfortunately most
           additional options are undocumented but it's easy to find out what is
           available by looking into the source code of
-          <link xlink:href="https://github.com/shadowsocks/shadowsocks-libev/blob/master/src/jconf.c"/>
+          <https://github.com/shadowsocks/shadowsocks-libev/blob/master/src/jconf.c>
         '';
       };
     };
diff --git a/nixos/modules/services/networking/shairport-sync.nix b/nixos/modules/services/networking/shairport-sync.nix
index eb61663e4d92..75684eea3ad1 100644
--- a/nixos/modules/services/networking/shairport-sync.nix
+++ b/nixos/modules/services/networking/shairport-sync.nix
@@ -19,7 +19,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Enable the shairport-sync daemon.
 
           Running with a local system-wide or remote pulseaudio server
@@ -30,7 +30,7 @@ in
       arguments = mkOption {
         type = types.str;
         default = "-v -o pa";
-        description = ''
+        description = lib.mdDoc ''
           Arguments to pass to the daemon. Defaults to a local pulseaudio
           server.
         '';
@@ -39,7 +39,7 @@ in
       openFirewall = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to automatically open ports in the firewall.
         '';
       };
@@ -47,7 +47,7 @@ in
       user = mkOption {
         type = types.str;
         default = "shairport";
-        description = ''
+        description = lib.mdDoc ''
           User account name under which to run shairport-sync. The account
           will be created.
         '';
@@ -56,7 +56,7 @@ in
       group = mkOption {
         type = types.str;
         default = "shairport";
-        description = ''
+        description = lib.mdDoc ''
           Group account name under which to run shairport-sync. The account
           will be created.
         '';
diff --git a/nixos/modules/services/networking/shellhub-agent.nix b/nixos/modules/services/networking/shellhub-agent.nix
index 57825945d9f7..c13f183d4fe0 100644
--- a/nixos/modules/services/networking/shellhub-agent.nix
+++ b/nixos/modules/services/networking/shellhub-agent.nix
@@ -19,7 +19,7 @@ in
       preferredHostname = mkOption {
         type = types.str;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           Set the device preferred hostname. This provides a hint to
           the server to use this as hostname if it is available.
         '';
@@ -28,7 +28,7 @@ in
       keepAliveInterval = mkOption {
         type = types.int;
         default = 30;
-        description = ''
+        description = lib.mdDoc ''
           Determine the interval to send the keep alive message to
           the server. This has a direct impact of the bandwidth
           used by the device.
@@ -38,7 +38,7 @@ in
       tenantId = mkOption {
         type = types.str;
         example = "ba0a880c-2ada-11eb-a35e-17266ef329d6";
-        description = ''
+        description = lib.mdDoc ''
           The tenant ID to use when connecting to the ShellHub
           Gateway.
         '';
@@ -47,7 +47,7 @@ in
       server = mkOption {
         type = types.str;
         default = "https://cloud.shellhub.io";
-        description = ''
+        description = lib.mdDoc ''
           Server address of ShellHub Gateway to connect.
         '';
       };
@@ -55,7 +55,7 @@ in
       privateKey = mkOption {
         type = types.path;
         default = "/var/lib/shellhub-agent/private.key";
-        description = ''
+        description = lib.mdDoc ''
           Location where to store the ShellHub Agent private
           key.
         '';
diff --git a/nixos/modules/services/networking/shorewall.nix b/nixos/modules/services/networking/shorewall.nix
index ac732d4b12e4..795295d1628f 100644
--- a/nixos/modules/services/networking/shorewall.nix
+++ b/nixos/modules/services/networking/shorewall.nix
@@ -23,12 +23,12 @@ in {
         type        = types.package;
         default     = pkgs.shorewall;
         defaultText = lib.literalExpression "pkgs.shorewall";
-        description = "The shorewall package to use.";
+        description = lib.mdDoc "The shorewall package to use.";
       };
       configs = lib.mkOption {
         type        = types.attrsOf types.lines;
         default     = {};
-        description = ''
+        description = lib.mdDoc ''
           This option defines the Shorewall configs.
           The attribute name defines the name of the config,
           and the attribute value defines the content of the config.
diff --git a/nixos/modules/services/networking/shorewall6.nix b/nixos/modules/services/networking/shorewall6.nix
index 4235c74a3f80..1d6d84eb89b3 100644
--- a/nixos/modules/services/networking/shorewall6.nix
+++ b/nixos/modules/services/networking/shorewall6.nix
@@ -23,12 +23,12 @@ in {
         type        = types.package;
         default     = pkgs.shorewall;
         defaultText = lib.literalExpression "pkgs.shorewall";
-        description = "The shorewall package to use.";
+        description = lib.mdDoc "The shorewall package to use.";
       };
       configs = lib.mkOption {
         type        = types.attrsOf types.lines;
         default     = {};
-        description = ''
+        description = lib.mdDoc ''
           This option defines the Shorewall configs.
           The attribute name defines the name of the config,
           and the attribute value defines the content of the config.
diff --git a/nixos/modules/services/networking/shout.nix b/nixos/modules/services/networking/shout.nix
index cca03a8f88a1..1ef21ad5bf8f 100644
--- a/nixos/modules/services/networking/shout.nix
+++ b/nixos/modules/services/networking/shout.nix
@@ -28,32 +28,32 @@ in {
     private = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         Make your shout instance private. You will need to configure user
-        accounts by adding entries in <filename>${shoutHome}/users</filename>.
+        accounts by adding entries in {file}`${shoutHome}/users`.
       '';
     };
 
     listenAddress = mkOption {
       type = types.str;
       default = "0.0.0.0";
-      description = "IP interface to listen on for http connections.";
+      description = lib.mdDoc "IP interface to listen on for http connections.";
     };
 
     port = mkOption {
       type = types.port;
       default = 9000;
-      description = "TCP port to listen on for http connections.";
+      description = lib.mdDoc "TCP port to listen on for http connections.";
     };
 
     configFile = mkOption {
       type = types.nullOr types.lines;
       default = null;
-      description = ''
-        Contents of Shout's <filename>config.js</filename> file.
+      description = lib.mdDoc ''
+        Contents of Shout's {file}`config.js` file.
 
         Used for backward compatibility, recommended way is now to use
-        the <literal>config</literal> option.
+        the `config` option.
 
         Documentation: http://shout-irc.com/docs/server/configuration.html
       '';
@@ -70,8 +70,8 @@ in {
           port = 6697;
         };
       };
-      description = ''
-        Shout <filename>config.js</filename> contents as attribute set (will be
+      description = lib.mdDoc ''
+        Shout {file}`config.js` contents as attribute set (will be
         converted to JSON to generate the configuration file).
 
         The options defined here will be merged to the default configuration file.
diff --git a/nixos/modules/services/networking/skydns.nix b/nixos/modules/services/networking/skydns.nix
index dea60a3862a3..f73a8718841a 100644
--- a/nixos/modules/services/networking/skydns.nix
+++ b/nixos/modules/services/networking/skydns.nix
@@ -13,45 +13,45 @@ in {
       machines = mkOption {
         default = [ "http://127.0.0.1:2379" ];
         type = types.listOf types.str;
-        description = "Skydns list of etcd endpoints to connect to.";
+        description = lib.mdDoc "Skydns list of etcd endpoints to connect to.";
       };
 
       tlsKey = mkOption {
         default = null;
         type = types.nullOr types.path;
-        description = "Skydns path of TLS client certificate - private key.";
+        description = lib.mdDoc "Skydns path of TLS client certificate - private key.";
       };
 
       tlsPem = mkOption {
         default = null;
         type = types.nullOr types.path;
-        description = "Skydns path of TLS client certificate - public key.";
+        description = lib.mdDoc "Skydns path of TLS client certificate - public key.";
       };
 
       caCert = mkOption {
         default = null;
         type = types.nullOr types.path;
-        description = "Skydns path of TLS certificate authority public key.";
+        description = lib.mdDoc "Skydns path of TLS certificate authority public key.";
       };
     };
 
     address = mkOption {
       default = "0.0.0.0:53";
       type = types.str;
-      description = "Skydns address to bind to.";
+      description = lib.mdDoc "Skydns address to bind to.";
     };
 
     domain = mkOption {
       default = "skydns.local.";
       type = types.str;
-      description = "Skydns default domain if not specified by etcd config.";
+      description = lib.mdDoc "Skydns default domain if not specified by etcd config.";
     };
 
     nameservers = mkOption {
       default = map (n: n + ":53") config.networking.nameservers;
       defaultText = literalExpression ''map (n: n + ":53") config.networking.nameservers'';
       type = types.listOf types.str;
-      description = "Skydns list of nameservers to forward DNS requests to when not authoritative for a domain.";
+      description = lib.mdDoc "Skydns list of nameservers to forward DNS requests to when not authoritative for a domain.";
       example = ["8.8.8.8:53" "8.8.4.4:53"];
     };
 
@@ -59,13 +59,13 @@ in {
       default = pkgs.skydns;
       defaultText = literalExpression "pkgs.skydns";
       type = types.package;
-      description = "Skydns package to use.";
+      description = lib.mdDoc "Skydns package to use.";
     };
 
     extraConfig = mkOption {
       default = {};
       type = types.attrsOf types.str;
-      description = "Skydns attribute set of extra config options passed as environment variables.";
+      description = lib.mdDoc "Skydns attribute set of extra config options passed as environment variables.";
     };
   };
 
diff --git a/nixos/modules/services/networking/smartdns.nix b/nixos/modules/services/networking/smartdns.nix
index 7f9df42ce9c1..aa132747885d 100644
--- a/nixos/modules/services/networking/smartdns.nix
+++ b/nixos/modules/services/networking/smartdns.nix
@@ -25,7 +25,7 @@ in {
     bindPort = mkOption {
       type = types.port;
       default = 53;
-      description = "DNS listening port number.";
+      description = lib.mdDoc "DNS listening port number.";
     };
 
     settings = mkOption {
@@ -42,9 +42,9 @@ in {
           speed-check-mode = "ping,tcp:80";
         };
       '';
-      description = ''
-        A set that will be generated into configuration file, see the <link xlink:href="https://github.com/pymumu/smartdns/blob/master/ReadMe_en.md#configuration-parameter">SmartDNS README</link> for details of configuration parameters.
-        You could override the options here like <option>services.smartdns.bindPort</option> by writing <literal>settings.bind = ":5353 -no-rule -group example";</literal>.
+      description = lib.mdDoc ''
+        A set that will be generated into configuration file, see the [SmartDNS README](https://github.com/pymumu/smartdns/blob/master/ReadMe_en.md#configuration-parameter) for details of configuration parameters.
+        You could override the options here like {option}`services.smartdns.bindPort` by writing `settings.bind = ":5353 -no-rule -group example";`.
       '';
     };
   };
diff --git a/nixos/modules/services/networking/smokeping.nix b/nixos/modules/services/networking/smokeping.nix
index bd71b158dbe3..217c16c8f37b 100644
--- a/nixos/modules/services/networking/smokeping.nix
+++ b/nixos/modules/services/networking/smokeping.nix
@@ -52,7 +52,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = "Enable the smokeping service";
+        description = lib.mdDoc "Enable the smokeping service";
       };
       alertConfig = mkOption {
         type = types.lines;
@@ -70,14 +70,14 @@ in
           pattern = >0%,*12*,>0%,*12*,>0%
           comment = loss 3 times  in a row;
         '';
-        description = "Configuration for alerts.";
+        description = lib.mdDoc "Configuration for alerts.";
       };
       cgiUrl = mkOption {
         type = types.str;
         default = "http://${cfg.hostName}:${toString cfg.port}/smokeping.cgi";
         defaultText = literalExpression ''"http://''${hostName}:''${toString port}/smokeping.cgi"'';
         example = "https://somewhere.example.com/smokeping.cgi";
-        description = "URL to the smokeping cgi.";
+        description = lib.mdDoc "URL to the smokeping cgi.";
       };
       config = mkOption {
         type = types.nullOr types.lines;
@@ -113,28 +113,28 @@ in
               MAX  0.5 144   7200
               MIN  0.5 144   7200
         '';
-        description = ''Configure the ping frequency and retention of the rrd files.
+        description = lib.mdDoc ''Configure the ping frequency and retention of the rrd files.
           Once set, changing the interval will require deletion or migration of all
           the collected data.'';
       };
       extraConfig = mkOption {
         type = types.lines;
         default = "";
-        description = "Any additional customization not already included.";
+        description = lib.mdDoc "Any additional customization not already included.";
       };
       hostName = mkOption {
         type = types.str;
         default = config.networking.fqdn;
         defaultText = literalExpression "config.networking.fqdn";
         example = "somewhere.example.com";
-        description = "DNS name for the urls generated in the cgi.";
+        description = lib.mdDoc "DNS name for the urls generated in the cgi.";
       };
       imgUrl = mkOption {
         type = types.str;
         default = "cache";
         defaultText = literalExpression ''"cache"'';
         example = "https://somewhere.example.com/cache";
-        description = ''
+        description = lib.mdDoc ''
           Base url for images generated in the cgi.
 
           The default is a relative URL to ensure it works also when e.g. forwarding
@@ -145,48 +145,48 @@ in
         type = types.enum ["original" "absolute" "relative"];
         default = "relative";
         example = "absolute";
-        description = "DNS name for the urls generated in the cgi.";
+        description = lib.mdDoc "DNS name for the urls generated in the cgi.";
       };
       mailHost = mkOption {
         type = types.str;
         default = "";
         example = "localhost";
-        description = "Use this SMTP server to send alerts";
+        description = lib.mdDoc "Use this SMTP server to send alerts";
       };
       owner = mkOption {
         type = types.str;
         default = "nobody";
         example = "Joe Admin";
-        description = "Real name of the owner of the instance";
+        description = lib.mdDoc "Real name of the owner of the instance";
       };
       ownerEmail = mkOption {
         type = types.str;
         default = "no-reply@${cfg.hostName}";
         defaultText = literalExpression ''"no-reply@''${hostName}"'';
         example = "no-reply@yourdomain.com";
-        description = "Email contact for owner";
+        description = lib.mdDoc "Email contact for owner";
       };
       package = mkOption {
         type = types.package;
         default = pkgs.smokeping;
         defaultText = literalExpression "pkgs.smokeping";
-        description = "Specify a custom smokeping package";
+        description = lib.mdDoc "Specify a custom smokeping package";
       };
       host = mkOption {
         type = types.nullOr types.str;
         default = "localhost";
         example = "192.0.2.1"; # rfc5737 example IP for documentation
-        description = ''
+        description = lib.mdDoc ''
           Host/IP to bind to for the web server.
 
-          Setting it to <literal>null</literal> skips passing the -h option to thttpd,
+          Setting it to `null` skips passing the -h option to thttpd,
           which makes it bind to all interfaces.
         '';
       };
       port = mkOption {
         type = types.int;
         default = 8081;
-        description = "TCP port to use for the web server.";
+        description = lib.mdDoc "TCP port to use for the web server.";
       };
       presentationConfig = mkOption {
         type = types.lines;
@@ -227,13 +227,13 @@ in
           "Last 10 Days"    10d
           "Last 360 Days"   360d
         '';
-        description = "presentation graph style";
+        description = lib.mdDoc "presentation graph style";
       };
       presentationTemplate = mkOption {
         type = types.str;
         default = "${pkgs.smokeping}/etc/basepage.html.dist";
         defaultText = literalExpression ''"''${pkgs.smokeping}/etc/basepage.html.dist"'';
-        description = "Default page layout for the web UI.";
+        description = lib.mdDoc "Default page layout for the web UI.";
       };
       probeConfig = mkOption {
         type = types.lines;
@@ -247,19 +247,19 @@ in
             binary = ''${config.security.wrapperDir}/fping
           '''
         '';
-        description = "Probe configuration";
+        description = lib.mdDoc "Probe configuration";
       };
       sendmail = mkOption {
         type = types.nullOr types.path;
         default = null;
         example = "/run/wrappers/bin/sendmail";
-        description = "Use this sendmail compatible script to deliver alerts";
+        description = lib.mdDoc "Use this sendmail compatible script to deliver alerts";
       };
       smokeMailTemplate = mkOption {
         type = types.str;
         default = "${cfg.package}/etc/smokemail.dist";
         defaultText = literalExpression ''"''${package}/etc/smokemail.dist"'';
-        description = "Specify the smokemail template for alerts.";
+        description = lib.mdDoc "Specify the smokemail template for alerts.";
       };
       targetConfig = mkOption {
         type = types.lines;
@@ -277,17 +277,17 @@ in
           title = This host
           host = localhost
         '';
-        description = "Target configuration";
+        description = lib.mdDoc "Target configuration";
       };
       user = mkOption {
         type = types.str;
         default = "smokeping";
-        description = "User that runs smokeping and (optionally) thttpd. A group of the same name will be created as well.";
+        description = lib.mdDoc "User that runs smokeping and (optionally) thttpd. A group of the same name will be created as well.";
       };
       webService = mkOption {
         type = types.bool;
         default = true;
-        description = "Enable a smokeping web interface";
+        description = lib.mdDoc "Enable a smokeping web interface";
       };
     };
 
diff --git a/nixos/modules/services/networking/sniproxy.nix b/nixos/modules/services/networking/sniproxy.nix
index adca5398e4ab..dedeb96f7369 100644
--- a/nixos/modules/services/networking/sniproxy.nix
+++ b/nixos/modules/services/networking/sniproxy.nix
@@ -23,19 +23,19 @@ in
       user = mkOption {
         type = types.str;
         default = "sniproxy";
-        description = "User account under which sniproxy runs.";
+        description = lib.mdDoc "User account under which sniproxy runs.";
       };
 
       group = mkOption {
         type = types.str;
         default = "sniproxy";
-        description = "Group under which sniproxy runs.";
+        description = lib.mdDoc "Group under which sniproxy runs.";
       };
 
       config = mkOption {
         type = types.lines;
         default = "";
-        description = "sniproxy.conf configuration excluding the daemon username and pid file.";
+        description = lib.mdDoc "sniproxy.conf configuration excluding the daemon username and pid file.";
         example = ''
           error_log {
             filename /var/log/sniproxy/error.log
diff --git a/nixos/modules/services/networking/snowflake-proxy.nix b/nixos/modules/services/networking/snowflake-proxy.nix
index 2124644ed9b5..d759b07e8bf0 100644
--- a/nixos/modules/services/networking/snowflake-proxy.nix
+++ b/nixos/modules/services/networking/snowflake-proxy.nix
@@ -11,25 +11,25 @@ in
       enable = mkEnableOption "System to defeat internet censorship";
 
       broker = mkOption {
-        description = "Broker URL (default \"https://snowflake-broker.torproject.net/\")";
+        description = lib.mdDoc "Broker URL (default \"https://snowflake-broker.torproject.net/\")";
         type = with types; nullOr str;
         default = null;
       };
 
       capacity = mkOption {
-        description = "Limits the amount of maximum concurrent clients allowed.";
+        description = lib.mdDoc "Limits the amount of maximum concurrent clients allowed.";
         type = with types; nullOr int;
         default = null;
       };
 
       relay = mkOption {
-        description = "websocket relay URL (default \"wss://snowflake.bamsoftware.com/\")";
+        description = lib.mdDoc "websocket relay URL (default \"wss://snowflake.bamsoftware.com/\")";
         type = with types; nullOr str;
         default = null;
       };
 
       stun = mkOption {
-        description = "STUN broker URL (default \"stun:stun.stunprotocol.org:3478\")";
+        description = lib.mdDoc "STUN broker URL (default \"stun:stun.stunprotocol.org:3478\")";
         type = with types; nullOr str;
         default = null;
       };
diff --git a/nixos/modules/services/networking/softether.nix b/nixos/modules/services/networking/softether.nix
index 5405f56871e9..47d10bf64ca3 100644
--- a/nixos/modules/services/networking/softether.nix
+++ b/nixos/modules/services/networking/softether.nix
@@ -22,7 +22,7 @@ in
         type = types.package;
         default = pkgs.softether;
         defaultText = literalExpression "pkgs.softether";
-        description = ''
+        description = lib.mdDoc ''
           softether derivation to use.
         '';
       };
@@ -36,14 +36,14 @@ in
         up = mkOption {
           type = types.lines;
           default = "";
-          description = ''
+          description = lib.mdDoc ''
             Shell commands executed when the Virtual Network Adapter(s) is/are starting.
           '';
         };
         down = mkOption {
           type = types.lines;
           default = "";
-          description = ''
+          description = lib.mdDoc ''
             Shell commands executed when the Virtual Network Adapter(s) is/are shutting down.
           '';
         };
@@ -52,7 +52,7 @@ in
       dataDir = mkOption {
         type = types.path;
         default = "/var/lib/softether";
-        description = ''
+        description = lib.mdDoc ''
           Data directory for SoftEther VPN.
         '';
       };
diff --git a/nixos/modules/services/networking/soju.nix b/nixos/modules/services/networking/soju.nix
index cb0acf4765ff..a92d274aea28 100644
--- a/nixos/modules/services/networking/soju.nix
+++ b/nixos/modules/services/networking/soju.nix
@@ -44,25 +44,25 @@ in
       type = types.str;
       default = config.networking.hostName;
       defaultText = literalExpression "config.networking.hostName";
-      description = "Server hostname.";
+      description = lib.mdDoc "Server hostname.";
     };
 
     tlsCertificate = mkOption {
       type = types.nullOr types.path;
       example = "/var/host.cert";
-      description = "Path to server TLS certificate.";
+      description = lib.mdDoc "Path to server TLS certificate.";
     };
 
     tlsCertificateKey = mkOption {
       type = types.nullOr types.path;
       example = "/var/host.key";
-      description = "Path to server TLS certificate key.";
+      description = lib.mdDoc "Path to server TLS certificate key.";
     };
 
     enableMessageLogging = mkOption {
       type = types.bool;
       default = true;
-      description = "Whether to enable message logging.";
+      description = lib.mdDoc "Whether to enable message logging.";
     };
 
     httpOrigins = mkOption {
@@ -90,7 +90,7 @@ in
     extraConfig = mkOption {
       type = types.lines;
       default = "";
-      description = "Lines added verbatim to the configuration file.";
+      description = lib.mdDoc "Lines added verbatim to the configuration file.";
     };
   };
 
diff --git a/nixos/modules/services/networking/solanum.nix b/nixos/modules/services/networking/solanum.nix
index dc066a245494..daa3650fc99a 100644
--- a/nixos/modules/services/networking/solanum.nix
+++ b/nixos/modules/services/networking/solanum.nix
@@ -44,16 +44,16 @@ in
             default_split_user_count = 0;
           };
         '';
-        description = ''
+        description = lib.mdDoc ''
           Solanum IRC daemon configuration file.
-          check <link xlink:href="https://github.com/solanum-ircd/solanum/blob/main/doc/reference.conf"/> for all options.
+          check <https://github.com/solanum-ircd/solanum/blob/main/doc/reference.conf> for all options.
         '';
       };
 
       openFilesLimit = mkOption {
         type = types.int;
         default = 1024;
-        description = ''
+        description = lib.mdDoc ''
           Maximum number of open files. Limits the clients and server connections.
         '';
       };
@@ -61,10 +61,10 @@ in
       motd = mkOption {
         type = types.nullOr types.lines;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Solanum MOTD text.
 
-          Solanum will read its MOTD from <literal>/etc/solanum/ircd.motd</literal>.
+          Solanum will read its MOTD from `/etc/solanum/ircd.motd`.
           If set, the value of this option will be written to this path.
         '';
       };
diff --git a/nixos/modules/services/networking/spacecookie.nix b/nixos/modules/services/networking/spacecookie.nix
index 400f3e26cc9a..4aa76de6f41a 100644
--- a/nixos/modules/services/networking/spacecookie.nix
+++ b/nixos/modules/services/networking/spacecookie.nix
@@ -32,7 +32,7 @@ in {
         default = pkgs.spacecookie;
         defaultText = literalExpression "pkgs.spacecookie";
         example = literalExpression "pkgs.haskellPackages.spacecookie";
-        description = ''
+        description = lib.mdDoc ''
           The spacecookie derivation to use. This can be used to
           override the used package or to use another version.
         '';
@@ -41,7 +41,7 @@ in {
       openFirewall = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to open the necessary port in the firewall for spacecookie.
         '';
       };
@@ -49,7 +49,7 @@ in {
       port = mkOption {
         type = types.port;
         default = 70;
-        description = ''
+        description = lib.mdDoc ''
           Port the gopher service should be exposed on.
         '';
       };
@@ -57,10 +57,10 @@ in {
       address = mkOption {
         type = types.str;
         default = "[::]";
-        description = ''
+        description = lib.mdDoc ''
           Address to listen on. Must be in the
-          <literal>ListenStream=</literal> syntax of
-          <link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd.socket.html">systemd.socket(5)</link>.
+          `ListenStream=` syntax of
+          [systemd.socket(5)](https://www.freedesktop.org/software/systemd/man/systemd.socket.html).
         '';
       };
 
@@ -71,7 +71,7 @@ in {
           options.hostname = mkOption {
             type = types.str;
             default = "localhost";
-            description = ''
+            description = lib.mdDoc ''
               The hostname the service is reachable via. Clients
               will use this hostname for further requests after
               loading the initial gopher menu.
@@ -81,11 +81,11 @@ in {
           options.root = mkOption {
             type = types.path;
             default = "/srv/gopher";
-            description = ''
+            description = lib.mdDoc ''
               The directory spacecookie should serve via gopher.
               Files in there need to be world-readable since
               the spacecookie service file sets
-              <literal>DynamicUser=true</literal>.
+              `DynamicUser=true`.
             '';
           };
 
@@ -96,7 +96,7 @@ in {
             hide-ips = mkOption {
               type = types.bool;
               default = true;
-              description = ''
+              description = lib.mdDoc ''
                 If enabled, spacecookie will hide personal
                 information of users like IP addresses from
                 log output.
@@ -110,7 +110,7 @@ in {
               # journald will add timestamps, so no need
               # to double up.
               default = true;
-              description = ''
+              description = lib.mdDoc ''
                 If enabled, spacecookie will not print timestamps
                 at the beginning of every log line.
               '';
@@ -123,18 +123,18 @@ in {
                 "error"
               ];
               default = "info";
-              description = ''
+              description = lib.mdDoc ''
                 Log level for the spacecookie service.
               '';
             };
           };
         };
 
-        description = ''
+        description = lib.mdDoc ''
           Settings for spacecookie. The settings set here are
           directly translated to the spacecookie JSON config
           file. See
-          <link xlink:href="https://sternenseemann.github.io/spacecookie/spacecookie.json.5.html">spacecookie.json(5)</link>
+          [spacecookie.json(5)](https://sternenseemann.github.io/spacecookie/spacecookie.json.5.html)
           for explanations of all options.
         '';
       };
diff --git a/nixos/modules/services/networking/spiped.nix b/nixos/modules/services/networking/spiped.nix
index 3c229ecfc72e..3e01ace54ad1 100644
--- a/nixos/modules/services/networking/spiped.nix
+++ b/nixos/modules/services/networking/spiped.nix
@@ -11,7 +11,7 @@ in
       enable = mkOption {
         type        = types.bool;
         default     = false;
-        description = "Enable the spiped service module.";
+        description = lib.mdDoc "Enable the spiped service module.";
       };
 
       config = mkOption {
@@ -21,32 +21,32 @@ in
               encrypt = mkOption {
                 type    = types.bool;
                 default = false;
-                description = ''
+                description = lib.mdDoc ''
                   Take unencrypted connections from the
-                  <literal>source</literal> socket and send encrypted
-                  connections to the <literal>target</literal> socket.
+                  `source` socket and send encrypted
+                  connections to the `target` socket.
                 '';
               };
 
               decrypt = mkOption {
                 type    = types.bool;
                 default = false;
-                description = ''
+                description = lib.mdDoc ''
                   Take encrypted connections from the
-                  <literal>source</literal> socket and send unencrypted
-                  connections to the <literal>target</literal> socket.
+                  `source` socket and send unencrypted
+                  connections to the `target` socket.
                 '';
               };
 
               source = mkOption {
                 type    = types.str;
-                description = ''
+                description = lib.mdDoc ''
                   Address on which spiped should listen for incoming
                   connections.  Must be in one of the following formats:
-                  <literal>/absolute/path/to/unix/socket</literal>,
-                  <literal>host.name:port</literal>,
-                  <literal>[ip.v4.ad.dr]:port</literal> or
-                  <literal>[ipv6::addr]:port</literal> - note that
+                  `/absolute/path/to/unix/socket`,
+                  `host.name:port`,
+                  `[ip.v4.ad.dr]:port` or
+                  `[ipv6::addr]:port` - note that
                   hostnames are resolved when spiped is launched and are
                   not re-resolved later; thus if DNS entries change
                   spiped will continue to connect to the expired
@@ -56,24 +56,24 @@ in
 
               target = mkOption {
                 type    = types.str;
-                description = "Address to which spiped should connect.";
+                description = lib.mdDoc "Address to which spiped should connect.";
               };
 
               keyfile = mkOption {
                 type    = types.path;
-                description = ''
+                description = lib.mdDoc ''
                   Name of a file containing the spiped key. As the
-                  daemon runs as the <literal>spiped</literal> user, the
+                  daemon runs as the `spiped` user, the
                   key file must be somewhere owned by that user. By
                   default, we recommend putting the keys for any spipe
-                  services in <literal>/var/lib/spiped</literal>.
+                  services in `/var/lib/spiped`.
                 '';
               };
 
               timeout = mkOption {
                 type = types.int;
                 default = 5;
-                description = ''
+                description = lib.mdDoc ''
                   Timeout, in seconds, after which an attempt to connect to
                   the target or a protocol handshake will be aborted (and the
                   connection dropped) if not completed
@@ -83,7 +83,7 @@ in
               maxConns = mkOption {
                 type = types.int;
                 default = 100;
-                description = ''
+                description = lib.mdDoc ''
                   Limit on the number of simultaneous connections allowed.
                 '';
               };
@@ -91,14 +91,14 @@ in
               waitForDNS = mkOption {
                 type = types.bool;
                 default = false;
-                description = ''
-                  Wait for DNS. Normally when <literal>spiped</literal> is
+                description = lib.mdDoc ''
+                  Wait for DNS. Normally when `spiped` is
                   launched it resolves addresses and binds to its source
                   socket before the parent process returns; with this option
                   it will daemonize first and retry failed DNS lookups until
-                  they succeed. This allows <literal>spiped</literal> to
+                  they succeed. This allows `spiped` to
                   launch even if DNS isn't set up yet, but at the expense of
-                  losing the guarantee that once <literal>spiped</literal> has
+                  losing the guarantee that once `spiped` has
                   finished launching it will be ready to create pipes.
                 '';
               };
@@ -106,13 +106,13 @@ in
               disableKeepalives = mkOption {
                 type = types.bool;
                 default = false;
-                description = "Disable transport layer keep-alives.";
+                description = lib.mdDoc "Disable transport layer keep-alives.";
               };
 
               weakHandshake = mkOption {
                 type = types.bool;
                 default = false;
-                description = ''
+                description = lib.mdDoc ''
                   Use fast/weak handshaking: This reduces the CPU time spent
                   in the initial connection setup, at the expense of losing
                   perfect forward secrecy.
@@ -122,7 +122,7 @@ in
               resolveRefresh = mkOption {
                 type = types.int;
                 default = 60;
-                description = ''
+                description = lib.mdDoc ''
                   Resolution refresh time for the target socket, in seconds.
                 '';
               };
@@ -130,7 +130,7 @@ in
               disableReresolution = mkOption {
                 type = types.bool;
                 default = false;
-                description = "Disable target address re-resolution.";
+                description = lib.mdDoc "Disable target address re-resolution.";
               };
             };
           }
@@ -155,11 +155,11 @@ in
           }
         '';
 
-        description = ''
+        description = lib.mdDoc ''
           Configuration for a secure pipe daemon. The daemon can be
           started, stopped, or examined using
-          <literal>systemctl</literal>, under the name
-          <literal>spiped@foo</literal>.
+          `systemctl`, under the name
+          `spiped@foo`.
         '';
       };
     };
diff --git a/nixos/modules/services/networking/squid.nix b/nixos/modules/services/networking/squid.nix
index db4f0d26b6f4..914cd7f320c9 100644
--- a/nixos/modules/services/networking/squid.nix
+++ b/nixos/modules/services/networking/squid.nix
@@ -108,32 +108,32 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = "Whether to run squid web proxy.";
+        description = lib.mdDoc "Whether to run squid web proxy.";
       };
 
       package = mkOption {
         default = pkgs.squid;
         defaultText = literalExpression "pkgs.squid";
         type = types.package;
-        description = "Squid package to use.";
+        description = lib.mdDoc "Squid package to use.";
       };
 
       proxyAddress = mkOption {
         type = types.nullOr types.str;
         default = null;
-        description = "IP address on which squid will listen.";
+        description = lib.mdDoc "IP address on which squid will listen.";
       };
 
       proxyPort = mkOption {
         type = types.int;
         default = 3128;
-        description = "TCP port on which squid will listen.";
+        description = lib.mdDoc "TCP port on which squid will listen.";
       };
 
       extraConfig = mkOption {
         type = types.lines;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           Squid configuration. Contents will be added
           verbatim to the configuration file.
         '';
@@ -142,7 +142,7 @@ in
       configText = mkOption {
         type = types.nullOr types.lines;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Verbatim contents of squid.conf. If null (default), use the
           autogenerated file from NixOS instead.
         '';
diff --git a/nixos/modules/services/networking/ssh/lshd.nix b/nixos/modules/services/networking/ssh/lshd.nix
index 862ff7df0540..41c4ec2d2951 100644
--- a/nixos/modules/services/networking/ssh/lshd.nix
+++ b/nixos/modules/services/networking/ssh/lshd.nix
@@ -21,7 +21,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to enable the GNU lshd SSH2 daemon, which allows
           secure remote login.
         '';
@@ -30,7 +30,7 @@ in
       portNumber = mkOption {
         default = 22;
         type = types.port;
-        description = ''
+        description = lib.mdDoc ''
           The port on which to listen for connections.
         '';
       };
@@ -38,7 +38,7 @@ in
       interfaces = mkOption {
         default = [];
         type = types.listOf types.str;
-        description = ''
+        description = lib.mdDoc ''
           List of network interfaces where listening for connections.
           When providing the empty list, `[]', lshd listens on all
           network interfaces.
@@ -49,7 +49,7 @@ in
       hostKey = mkOption {
         default = "/etc/lsh/host-key";
         type = types.str;
-        description = ''
+        description = lib.mdDoc ''
           Path to the server's private key.  Note that this key must
           have been created, e.g., using "lsh-keygen --server |
           lsh-writekey --server", so that you can run lshd.
@@ -59,31 +59,31 @@ in
       syslog = mkOption {
         type = types.bool;
         default = true;
-        description = "Whether to enable syslog output.";
+        description = lib.mdDoc "Whether to enable syslog output.";
       };
 
       passwordAuthentication = mkOption {
         type = types.bool;
         default = true;
-        description = "Whether to enable password authentication.";
+        description = lib.mdDoc "Whether to enable password authentication.";
       };
 
       publicKeyAuthentication = mkOption {
         type = types.bool;
         default = true;
-        description = "Whether to enable public key authentication.";
+        description = lib.mdDoc "Whether to enable public key authentication.";
       };
 
       rootLogin = mkOption {
         type = types.bool;
         default = false;
-        description = "Whether to enable remote root login.";
+        description = lib.mdDoc "Whether to enable remote root login.";
       };
 
       loginShell = mkOption {
         default = null;
         type = types.nullOr types.str;
-        description = ''
+        description = lib.mdDoc ''
           If non-null, override the default login shell with the
           specified value.
         '';
@@ -93,7 +93,7 @@ in
       srpKeyExchange = mkOption {
         default = false;
         type = types.bool;
-        description = ''
+        description = lib.mdDoc ''
           Whether to enable SRP key exchange and user authentication.
         '';
       };
@@ -101,18 +101,18 @@ in
       tcpForwarding = mkOption {
         type = types.bool;
         default = true;
-        description = "Whether to enable TCP/IP forwarding.";
+        description = lib.mdDoc "Whether to enable TCP/IP forwarding.";
       };
 
       x11Forwarding = mkOption {
         type = types.bool;
         default = true;
-        description = "Whether to enable X11 forwarding.";
+        description = lib.mdDoc "Whether to enable X11 forwarding.";
       };
 
       subsystems = mkOption {
         type = types.listOf types.path;
-        description = ''
+        description = lib.mdDoc ''
           List of subsystem-path pairs, where the head of the pair
           denotes the subsystem name, and the tail denotes the path to
           an executable implementing it.
diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index 52a50b892ec6..c6386ed6823d 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -32,13 +32,13 @@ let
       keys = mkOption {
         type = types.listOf types.singleLineStr;
         default = [];
-        description = ''
+        description = lib.mdDoc ''
           A list of verbatim OpenSSH public keys that should be added to the
           user's authorized keys. The keys are added to a file that the SSH
           daemon reads in addition to the the user's authorized_keys file.
-          You can combine the <literal>keys</literal> and
-          <literal>keyFiles</literal> options.
-          Warning: If you are using <literal>NixOps</literal> then don't use this
+          You can combine the `keys` and
+          `keyFiles` options.
+          Warning: If you are using `NixOps` then don't use this
           option since it will replace the key required for deployment via ssh.
         '';
         example = [
@@ -50,12 +50,12 @@ let
       keyFiles = mkOption {
         type = types.listOf types.path;
         default = [];
-        description = ''
+        description = lib.mdDoc ''
           A list of files each containing one OpenSSH public key that should be
           added to the user's authorized keys. The contents of the files are
           read at build time and added to a file that the SSH daemon reads in
           addition to the the user's authorized_keys file. You can combine the
-          <literal>keyFiles</literal> and <literal>keys</literal> options.
+          `keyFiles` and `keys` options.
         '';
       };
     };
@@ -93,7 +93,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to enable the OpenSSH secure shell daemon, which
           allows secure remote logins.
         '';
@@ -102,8 +102,8 @@ in
       startWhenNeeded = mkOption {
         type = types.bool;
         default = false;
-        description = ''
-          If set, <command>sshd</command> is socket-activated; that
+        description = lib.mdDoc ''
+          If set, {command}`sshd` is socket-activated; that
           is, instead of having it permanently running as a daemon,
           systemd will start an instance for each incoming connection.
         '';
@@ -112,7 +112,7 @@ in
       forwardX11 = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to allow X11 connections to be forwarded.
         '';
       };
@@ -120,17 +120,17 @@ in
       allowSFTP = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Whether to enable the SFTP subsystem in the SSH daemon.  This
-          enables the use of commands such as <command>sftp</command> and
-          <command>sshfs</command>.
+          enables the use of commands such as {command}`sftp` and
+          {command}`sshfs`.
         '';
       };
 
       sftpServerExecutable = mkOption {
         type = types.str;
         example = "internal-sftp";
-        description = ''
+        description = lib.mdDoc ''
           The sftp server executable.  Can be a path or "internal-sftp" to use
           the sftp server built into the sshd binary.
         '';
@@ -140,7 +140,7 @@ in
         type = with types; listOf str;
         default = [];
         example = [ "-f AUTHPRIV" "-l INFO" ];
-        description = ''
+        description = lib.mdDoc ''
           Commandline flags to add to sftp-server.
         '';
       };
@@ -148,7 +148,7 @@ in
       permitRootLogin = mkOption {
         default = "prohibit-password";
         type = types.enum ["yes" "without-password" "prohibit-password" "forced-commands-only" "no"];
-        description = ''
+        description = lib.mdDoc ''
           Whether the root user can login using ssh.
         '';
       };
@@ -167,7 +167,7 @@ in
       ports = mkOption {
         type = types.listOf types.port;
         default = [22];
-        description = ''
+        description = lib.mdDoc ''
           Specifies on which ports the SSH daemon listens.
         '';
       };
@@ -175,7 +175,7 @@ in
       openFirewall = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Whether to automatically open the specified ports in the firewall.
         '';
       };
@@ -186,14 +186,14 @@ in
             addr = mkOption {
               type = types.nullOr types.str;
               default = null;
-              description = ''
+              description = lib.mdDoc ''
                 Host, IPv4 or IPv6 address to listen to.
               '';
             };
             port = mkOption {
               type = types.nullOr types.int;
               default = null;
-              description = ''
+              description = lib.mdDoc ''
                 Port to listen to.
               '';
             };
@@ -201,10 +201,10 @@ in
         });
         default = [];
         example = [ { addr = "192.168.3.1"; port = 22; } { addr = "0.0.0.0"; port = 64022; } ];
-        description = ''
+        description = lib.mdDoc ''
           List of addresses and ports to listen on (ListenAddress directive
           in config). If port is not specified for address sshd will listen
-          on all ports specified by <literal>ports</literal> option.
+          on all ports specified by `ports` option.
           NOTE: this will override default listening on all local addresses and port 22.
           NOTE: setting this option won't automatically enable given ports
           in firewall configuration.
@@ -214,7 +214,7 @@ in
       passwordAuthentication = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Specifies whether password authentication is allowed.
         '';
       };
@@ -222,7 +222,7 @@ in
       kbdInteractiveAuthentication = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Specifies whether keyboard-interactive authentication is allowed.
         '';
       };
@@ -249,7 +249,7 @@ in
       banner = mkOption {
         type = types.nullOr types.lines;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Message to display to the remote user before authentication is allowed.
         '';
       };
@@ -273,7 +273,7 @@ in
       authorizedKeysCommand = mkOption {
         type = types.str;
         default = "none";
-        description = ''
+        description = lib.mdDoc ''
           Specifies a program to be used to look up the user's public
           keys. The program must be owned by root, not writable by group
           or others and specified by an absolute path.
@@ -283,7 +283,7 @@ in
       authorizedKeysCommandUser = mkOption {
         type = types.str;
         default = "nobody";
-        description = ''
+        description = lib.mdDoc ''
           Specifies the user under whose account the AuthorizedKeysCommand
           is run. It is recommended to use a dedicated user that has no
           other role on the host than running authorized keys commands.
@@ -354,7 +354,7 @@ in
       logLevel = mkOption {
         type = types.enum [ "QUIET" "FATAL" "ERROR" "INFO" "VERBOSE" "DEBUG" "DEBUG1" "DEBUG2" "DEBUG3" ];
         default = "INFO"; # upstream default
-        description = ''
+        description = lib.mdDoc ''
           Gives the verbosity level that is used when logging messages from sshd(8). The possible values are:
           QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. The default is INFO. DEBUG and DEBUG1
           are equivalent. DEBUG2 and DEBUG3 each specify higher levels of debugging output. Logging with a DEBUG level
@@ -365,7 +365,7 @@ in
       useDns = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Specifies whether sshd(8) should look up the remote host name, and to check that the resolved host name for
           the remote IP address maps back to the very same IP address.
           If this option is set to no (the default) then only addresses and not host names may be used in
@@ -376,16 +376,16 @@ in
       extraConfig = mkOption {
         type = types.lines;
         default = "";
-        description = "Verbatim contents of <filename>sshd_config</filename>.";
+        description = lib.mdDoc "Verbatim contents of {file}`sshd_config`.";
       };
 
       moduliFile = mkOption {
         example = "/etc/my-local-ssh-moduli;";
         type = types.path;
-        description = ''
-          Path to <literal>moduli</literal> file to install in
-          <literal>/etc/ssh/moduli</literal>. If this option is unset, then
-          the <literal>moduli</literal> file shipped with OpenSSH will be used.
+        description = lib.mdDoc ''
+          Path to `moduli` file to install in
+          `/etc/ssh/moduli`. If this option is unset, then
+          the `moduli` file shipped with OpenSSH will be used.
         '';
       };
 
diff --git a/nixos/modules/services/networking/sslh.nix b/nixos/modules/services/networking/sslh.nix
index abe96f60f811..03c0bd23141a 100644
--- a/nixos/modules/services/networking/sslh.nix
+++ b/nixos/modules/services/networking/sslh.nix
@@ -48,37 +48,37 @@ in
       verbose = mkOption {
         type = types.bool;
         default = false;
-        description = "Verbose logs.";
+        description = lib.mdDoc "Verbose logs.";
       };
 
       timeout = mkOption {
         type = types.int;
         default = 2;
-        description = "Timeout in seconds.";
+        description = lib.mdDoc "Timeout in seconds.";
       };
 
       transparent = mkOption {
         type = types.bool;
         default = false;
-        description = "Will the services behind sslh (Apache, sshd and so on) see the external IP and ports as if the external world connected directly to them";
+        description = lib.mdDoc "Will the services behind sslh (Apache, sshd and so on) see the external IP and ports as if the external world connected directly to them";
       };
 
       listenAddresses = mkOption {
         type = types.coercedTo types.str singleton (types.listOf types.str);
         default = [ "0.0.0.0" "[::]" ];
-        description = "Listening addresses or hostnames.";
+        description = lib.mdDoc "Listening addresses or hostnames.";
       };
 
       port = mkOption {
         type = types.int;
         default = 443;
-        description = "Listening port.";
+        description = lib.mdDoc "Listening port.";
       };
 
       appendConfig = mkOption {
         type = types.str;
         default = defaultAppendConfig;
-        description = "Verbatim configuration file.";
+        description = lib.mdDoc "Verbatim configuration file.";
       };
     };
   };
diff --git a/nixos/modules/services/networking/strongswan.nix b/nixos/modules/services/networking/strongswan.nix
index e3a97207be7f..f1b0a3f0d3b8 100644
--- a/nixos/modules/services/networking/strongswan.nix
+++ b/nixos/modules/services/networking/strongswan.nix
@@ -57,10 +57,10 @@ in
       type = types.listOf types.str;
       default = [];
       example = [ "/run/keys/ipsec-foo.secret" ];
-      description = ''
+      description = lib.mdDoc ''
         A list of paths to IPSec secret files. These
         files will be included into the main ipsec.secrets file with
-        the <literal>include</literal> directive. It is safer if these
+        the `include` directive. It is safer if these
         paths are absolute.
       '';
     };
@@ -69,9 +69,9 @@ in
       type = types.attrsOf types.str;
       default = {};
       example = { cachecrls = "yes"; strictcrlpolicy = "yes"; };
-      description = ''
+      description = lib.mdDoc ''
         A set of options for the ‘config setup’ section of the
-        <filename>ipsec.conf</filename> file. Defines general
+        {file}`ipsec.conf` file. Defines general
         configuration parameters.
       '';
     };
@@ -94,9 +94,9 @@ in
           };
         }
       '';
-      description = ''
+      description = lib.mdDoc ''
         A set of connections and their options for the ‘conn xxx’
-        sections of the <filename>ipsec.conf</filename> file.
+        sections of the {file}`ipsec.conf` file.
       '';
     };
 
@@ -110,9 +110,9 @@ in
           crluri = "http://crl2.strongswan.org/strongswan.crl";
         };
       };
-      description = ''
+      description = lib.mdDoc ''
         A set of CAs (certification authorities) and their options for
-        the ‘ca xxx’ sections of the <filename>ipsec.conf</filename>
+        the ‘ca xxx’ sections of the {file}`ipsec.conf`
         file.
       '';
     };
@@ -120,19 +120,19 @@ in
     managePlugins = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         If set to true, this option will disable automatic plugin loading and
         then tell strongSwan to enable the plugins specified in the
-        <option>enabledPlugins</option> option.
+        {option}`enabledPlugins` option.
       '';
     };
 
     enabledPlugins = mkOption {
       type = types.listOf types.str;
       default = [];
-      description = ''
+      description = lib.mdDoc ''
         A list of additional plugins to enable if
-        <option>managePlugins</option> is true.
+        {option}`managePlugins` is true.
       '';
     };
   };
diff --git a/nixos/modules/services/networking/stubby.nix b/nixos/modules/services/networking/stubby.nix
index 78c13798dde2..f9d6869ad97c 100644
--- a/nixos/modules/services/networking/stubby.nix
+++ b/nixos/modules/services/networking/stubby.nix
@@ -39,20 +39,20 @@ in {
             }];
           };
         '';
-        description = ''
+        description = lib.mdDoc ''
           Content of the Stubby configuration file. All Stubby settings may be set or queried
           here. The default settings are available at
-          <literal>pkgs.stubby.passthru.settingsExample</literal>. See
-          <link xlink:href="https://dnsprivacy.org/wiki/display/DP/Configuring+Stubby"/>.
+          `pkgs.stubby.passthru.settingsExample`. See
+          <https://dnsprivacy.org/wiki/display/DP/Configuring+Stubby>.
           A list of the public recursive servers can be found here:
-          <link xlink:href="https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Test+Servers"/>.
+          <https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Test+Servers>.
         '';
       };
 
       debugLogging = mkOption {
         default = false;
         type = types.bool;
-        description = "Enable or disable debug level logging.";
+        description = lib.mdDoc "Enable or disable debug level logging.";
       };
 
     };
diff --git a/nixos/modules/services/networking/stunnel.nix b/nixos/modules/services/networking/stunnel.nix
index 55fac27f92ce..d7311a24bb37 100644
--- a/nixos/modules/services/networking/stunnel.nix
+++ b/nixos/modules/services/networking/stunnel.nix
@@ -42,37 +42,37 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = "Whether to enable the stunnel TLS tunneling service.";
+        description = lib.mdDoc "Whether to enable the stunnel TLS tunneling service.";
       };
 
       user = mkOption {
         type = with types; nullOr str;
         default = "nobody";
-        description = "The user under which stunnel runs.";
+        description = lib.mdDoc "The user under which stunnel runs.";
       };
 
       group = mkOption {
         type = with types; nullOr str;
         default = "nogroup";
-        description = "The group under which stunnel runs.";
+        description = lib.mdDoc "The group under which stunnel runs.";
       };
 
       logLevel = mkOption {
         type = types.enum [ "emerg" "alert" "crit" "err" "warning" "notice" "info" "debug" ];
         default = "info";
-        description = "Verbosity of stunnel output.";
+        description = lib.mdDoc "Verbosity of stunnel output.";
       };
 
       fipsMode = mkOption {
         type = types.bool;
         default = false;
-        description = "Enable FIPS 140-2 mode required for compliance.";
+        description = lib.mdDoc "Enable FIPS 140-2 mode required for compliance.";
       };
 
       enableInsecureSSLv3 = mkOption {
         type = types.bool;
         default = false;
-        description = "Enable support for the insecure SSLv3 protocol.";
+        description = lib.mdDoc "Enable support for the insecure SSLv3 protocol.";
       };
 
 
diff --git a/nixos/modules/services/networking/supplicant.nix b/nixos/modules/services/networking/supplicant.nix
index e111b311d68f..0a48e73932e8 100644
--- a/nixos/modules/services/networking/supplicant.nix
+++ b/nixos/modules/services/networking/supplicant.nix
@@ -74,19 +74,19 @@ in
               type = types.nullOr types.path;
               default = null;
               example = literalExpression "/etc/wpa_supplicant.conf";
-              description = ''
-                External <literal>wpa_supplicant.conf</literal> configuration file.
-                The configuration options defined declaratively within <literal>networking.supplicant</literal> have
-                precedence over options defined in <literal>configFile</literal>.
+              description = lib.mdDoc ''
+                External `wpa_supplicant.conf` configuration file.
+                The configuration options defined declaratively within `networking.supplicant` have
+                precedence over options defined in `configFile`.
               '';
             };
 
             writable = mkOption {
               type = types.bool;
               default = false;
-              description = ''
-                Whether the configuration file at <literal>configFile.path</literal> should be written to by
-                <literal>wpa_supplicant</literal>.
+              description = lib.mdDoc ''
+                Whether the configuration file at `configFile.path` should be written to by
+                `wpa_supplicant`.
               '';
             };
 
@@ -109,12 +109,12 @@ in
               model_name=NixOS_Unstable
               model_number=2015
             '';
-            description = ''
-              Configuration options for <literal>wpa_supplicant.conf</literal>.
-              Options defined here have precedence over options in <literal>configFile</literal>.
-              NOTE: Do not write sensitive data into <literal>extraConf</literal> as it will
-              be world-readable in the <literal>nix-store</literal>. For sensitive information
-              use the <literal>configFile</literal> instead.
+            description = lib.mdDoc ''
+              Configuration options for `wpa_supplicant.conf`.
+              Options defined here have precedence over options in `configFile`.
+              NOTE: Do not write sensitive data into `extraConf` as it will
+              be world-readable in the `nix-store`. For sensitive information
+              use the `configFile` instead.
             '';
           };
 
@@ -123,19 +123,19 @@ in
             default = "";
             example = "-e/run/wpa_supplicant/entropy.bin";
             description =
-              "Command line arguments to add when executing <literal>wpa_supplicant</literal>.";
+              lib.mdDoc "Command line arguments to add when executing `wpa_supplicant`.";
           };
 
           driver = mkOption {
             type = types.nullOr types.str;
             default = "nl80211,wext";
-            description = "Force a specific wpa_supplicant driver.";
+            description = lib.mdDoc "Force a specific wpa_supplicant driver.";
           };
 
           bridge = mkOption {
             type = types.str;
             default = "";
-            description = "Name of the bridge interface that wpa_supplicant should listen at.";
+            description = lib.mdDoc "Name of the bridge interface that wpa_supplicant should listen at.";
           };
 
           userControlled = {
@@ -143,7 +143,7 @@ in
             enable = mkOption {
               type = types.bool;
               default = false;
-              description = ''
+              description = lib.mdDoc ''
                 Allow normal users to control wpa_supplicant through wpa_gui or wpa_cli.
                 This is useful for laptop users that switch networks a lot and don't want
                 to depend on a large package such as NetworkManager just to pick nearby
@@ -154,14 +154,14 @@ in
             socketDir = mkOption {
               type = types.str;
               default = "/run/wpa_supplicant";
-              description = "Directory of sockets for controlling wpa_supplicant.";
+              description = lib.mdDoc "Directory of sockets for controlling wpa_supplicant.";
             };
 
             group = mkOption {
               type = types.str;
               default = "wheel";
               example = "network";
-              description = "Members of this group can control wpa_supplicant.";
+              description = lib.mdDoc "Members of this group can control wpa_supplicant.";
             };
 
           };
@@ -184,21 +184,21 @@ in
         }
       '';
 
-      description = ''
-        Interfaces for which to start <command>wpa_supplicant</command>.
+      description = lib.mdDoc ''
+        Interfaces for which to start {command}`wpa_supplicant`.
         The supplicant is used to scan for and associate with wireless networks,
         or to authenticate with 802.1x capable network switches.
 
         The value of this option is an attribute set. Each attribute configures a
-        <command>wpa_supplicant</command> service, where the attribute name specifies
-        the name of the interface that <command>wpa_supplicant</command> operates on.
+        {command}`wpa_supplicant` service, where the attribute name specifies
+        the name of the interface that {command}`wpa_supplicant` operates on.
         The attribute name can be a space separated list of interfaces.
-        The attribute names <literal>WLAN</literal>, <literal>LAN</literal> and <literal>DBUS</literal>
-        have a special meaning. <literal>WLAN</literal> and <literal>LAN</literal> are
-        configurations for universal <command>wpa_supplicant</command> service that is
+        The attribute names `WLAN`, `LAN` and `DBUS`
+        have a special meaning. `WLAN` and `LAN` are
+        configurations for universal {command}`wpa_supplicant` service that is
         started for each WLAN interface or for each LAN interface, respectively.
-        <literal>DBUS</literal> defines a device-unrelated <command>wpa_supplicant</command>
-        service that can be accessed through <literal>D-Bus</literal>.
+        `DBUS` defines a device-unrelated {command}`wpa_supplicant`
+        service that can be accessed through `D-Bus`.
       '';
 
     };
diff --git a/nixos/modules/services/networking/supybot.nix b/nixos/modules/services/networking/supybot.nix
index 94b79c7e247f..df7d92189a77 100644
--- a/nixos/modules/services/networking/supybot.nix
+++ b/nixos/modules/services/networking/supybot.nix
@@ -16,7 +16,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = "Enable Supybot, an IRC bot (also known as Limnoria).";
+        description = lib.mdDoc "Enable Supybot, an IRC bot (also known as Limnoria).";
       };
 
       stateDir = mkOption {
@@ -25,12 +25,12 @@ in
           then "/var/lib/supybot"
           else "/home/supybot";
         defaultText = literalExpression "/var/lib/supybot";
-        description = "The root directory, logs and plugins are stored here";
+        description = lib.mdDoc "The root directory, logs and plugins are stored here";
       };
 
       configFile = mkOption {
         type = types.path;
-        description = ''
+        description = lib.mdDoc ''
           Path to initial supybot config file. This can be generated by
           running supybot-wizard.
 
@@ -42,12 +42,12 @@ in
       plugins = mkOption {
         type = types.attrsOf types.path;
         default = {};
-        description = ''
+        description = lib.mdDoc ''
           Attribute set of additional plugins that will be symlinked to the
-          <filename>plugin</filename> subdirectory.
+          {file}`plugin` subdirectory.
 
           Please note that you still need to add the plugins to the config
-          file (or with <literal>!load</literal>) using their attribute name.
+          file (or with `!load`) using their attribute name.
         '';
         example = literalExpression ''
           let
diff --git a/nixos/modules/services/networking/syncplay.nix b/nixos/modules/services/networking/syncplay.nix
index 7694b4bf990b..726f65671072 100644
--- a/nixos/modules/services/networking/syncplay.nix
+++ b/nixos/modules/services/networking/syncplay.nix
@@ -17,13 +17,13 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = "If enabled, start the Syncplay server.";
+        description = lib.mdDoc "If enabled, start the Syncplay server.";
       };
 
       port = mkOption {
         type = types.port;
         default = 8999;
-        description = ''
+        description = lib.mdDoc ''
           TCP port to bind to.
         '';
       };
@@ -31,7 +31,7 @@ in
       salt = mkOption {
         type = types.nullOr types.str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Salt to allow room operator passwords generated by this server
           instance to still work when the server is restarted.
         '';
@@ -40,16 +40,16 @@ in
       certDir = mkOption {
         type = types.nullOr types.path;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           TLS certificates directory to use for encryption. See
-          <link xlink:href="https://github.com/Syncplay/syncplay/wiki/TLS-support"/>.
+          <https://github.com/Syncplay/syncplay/wiki/TLS-support>.
         '';
       };
 
       user = mkOption {
         type = types.str;
         default = "nobody";
-        description = ''
+        description = lib.mdDoc ''
           User to use when running Syncplay.
         '';
       };
@@ -57,7 +57,7 @@ in
       group = mkOption {
         type = types.str;
         default = "nogroup";
-        description = ''
+        description = lib.mdDoc ''
           Group to use when running Syncplay.
         '';
       };
@@ -65,9 +65,9 @@ in
       passwordFile = mkOption {
         type = types.nullOr types.path;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Path to the file that contains the server password. If
-          <literal>null</literal>, the server doesn't require a password.
+          `null`, the server doesn't require a password.
         '';
       };
     };
diff --git a/nixos/modules/services/networking/syncthing-relay.nix b/nixos/modules/services/networking/syncthing-relay.nix
index f5ca63e78930..e92557d65455 100644
--- a/nixos/modules/services/networking/syncthing-relay.nix
+++ b/nixos/modules/services/networking/syncthing-relay.nix
@@ -28,7 +28,7 @@ in {
       type = types.str;
       default = "";
       example = "1.2.3.4";
-      description = ''
+      description = lib.mdDoc ''
         Address to listen on for relay traffic.
       '';
     };
@@ -36,9 +36,9 @@ in {
     port = mkOption {
       type = types.port;
       default = 22067;
-      description = ''
+      description = lib.mdDoc ''
         Port to listen on for relay traffic. This port should be added to
-        <literal>networking.firewall.allowedTCPPorts</literal>.
+        `networking.firewall.allowedTCPPorts`.
       '';
     };
 
@@ -46,7 +46,7 @@ in {
       type = types.str;
       default = "";
       example = "1.2.3.4";
-      description = ''
+      description = lib.mdDoc ''
         Address to listen on for serving the relay status API.
       '';
     };
@@ -54,16 +54,16 @@ in {
     statusPort = mkOption {
       type = types.port;
       default = 22070;
-      description = ''
+      description = lib.mdDoc ''
         Port to listen on for serving the relay status API. This port should be
-        added to <literal>networking.firewall.allowedTCPPorts</literal>.
+        added to `networking.firewall.allowedTCPPorts`.
       '';
     };
 
     pools = mkOption {
       type = types.nullOr (types.listOf types.str);
       default = null;
-      description = ''
+      description = lib.mdDoc ''
         Relay pools to join. If null, uses the default global pool.
       '';
     };
@@ -71,7 +71,7 @@ in {
     providedBy = mkOption {
       type = types.str;
       default = "";
-      description = ''
+      description = lib.mdDoc ''
         Human-readable description of the provider of the relay (you).
       '';
     };
@@ -79,7 +79,7 @@ in {
     globalRateBps = mkOption {
       type = types.nullOr types.ints.positive;
       default = null;
-      description = ''
+      description = lib.mdDoc ''
         Global bandwidth rate limit in bytes per second.
       '';
     };
@@ -87,7 +87,7 @@ in {
     perSessionRateBps = mkOption {
       type = types.nullOr types.ints.positive;
       default = null;
-      description = ''
+      description = lib.mdDoc ''
         Per session bandwidth rate limit in bytes per second.
       '';
     };
@@ -95,7 +95,7 @@ in {
     extraOptions = mkOption {
       type = types.listOf types.str;
       default = [];
-      description = ''
+      description = lib.mdDoc ''
         Extra command line arguments to pass to strelaysrv.
       '';
     };
diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index 66b85cd9d8a9..373fd03223d6 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -126,7 +126,7 @@ in {
             name = mkOption {
               type = types.str;
               default = name;
-              description = ''
+              description = lib.mdDoc ''
                 The name of the device.
               '';
             };
@@ -134,7 +134,7 @@ in {
             addresses = mkOption {
               type = types.listOf types.str;
               default = [];
-              description = ''
+              description = lib.mdDoc ''
                 The addresses used to connect to the device.
                 If this is left empty, dynamic configuration is attempted.
               '';
@@ -204,7 +204,7 @@ in {
             enable = mkOption {
               type = types.bool;
               default = true;
-              description = ''
+              description = lib.mdDoc ''
                 Whether to share this folder.
                 This option is useful when you want to define all folders
                 in one place, but not every machine should share all folders.
@@ -214,7 +214,7 @@ in {
             path = mkOption {
               type = types.str;
               default = name;
-              description = ''
+              description = lib.mdDoc ''
                 The path to the folder which should be shared.
               '';
             };
@@ -222,7 +222,7 @@ in {
             id = mkOption {
               type = types.str;
               default = name;
-              description = ''
+              description = lib.mdDoc ''
                 The ID of the folder. Must be the same on all devices.
               '';
             };
@@ -230,7 +230,7 @@ in {
             label = mkOption {
               type = types.str;
               default = name;
-              description = ''
+              description = lib.mdDoc ''
                 The label of the folder.
               '';
             };
@@ -311,7 +311,7 @@ in {
             rescanInterval = mkOption {
               type = types.int;
               default = 3600;
-              description = ''
+              description = lib.mdDoc ''
                 How often the folder should be rescanned for changes.
               '';
             };
@@ -319,7 +319,7 @@ in {
             type = mkOption {
               type = types.enum [ "sendreceive" "sendonly" "receiveonly" ];
               default = "sendreceive";
-              description = ''
+              description = lib.mdDoc ''
                 Whether to only send changes for this folder, only receive them
                 or both.
               '';
@@ -328,7 +328,7 @@ in {
             watch = mkOption {
               type = types.bool;
               default = true;
-              description = ''
+              description = lib.mdDoc ''
                 Whether the folder should be watched for changes by inotify.
               '';
             };
@@ -336,7 +336,7 @@ in {
             watchDelay = mkOption {
               type = types.int;
               default = 10;
-              description = ''
+              description = lib.mdDoc ''
                 The delay after an inotify event is triggered.
               '';
             };
@@ -344,7 +344,7 @@ in {
             ignorePerms = mkOption {
               type = types.bool;
               default = true;
-              description = ''
+              description = lib.mdDoc ''
                 Whether to ignore permission changes.
               '';
             };
@@ -377,7 +377,7 @@ in {
       guiAddress = mkOption {
         type = types.str;
         default = "127.0.0.1:8384";
-        description = ''
+        description = lib.mdDoc ''
           The address to serve the web interface at.
         '';
       };
@@ -385,7 +385,7 @@ in {
       systemService = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Whether to auto-launch Syncthing as a system service.
         '';
       };
@@ -426,7 +426,7 @@ in {
         type = types.path;
         default = "/var/lib/syncthing";
         example = "/home/yourUser";
-        description = ''
+        description = lib.mdDoc ''
           The path where synchronised directories will exist.
         '';
       };
@@ -435,7 +435,7 @@ in {
         cond = versionAtLeast config.system.stateVersion "19.03";
       in mkOption {
         type = types.path;
-        description = ''
+        description = lib.mdDoc ''
           The path where the settings and keys will exist.
         '';
         default = cfg.dataDir + optionalString cond "/.config/syncthing";
@@ -453,7 +453,7 @@ in {
         type = types.listOf types.str;
         default = [];
         example = [ "--reset-deltas" ];
-        description = ''
+        description = lib.mdDoc ''
           Extra flags passed to the syncthing command in the service definition.
         '';
       };
@@ -462,7 +462,7 @@ in {
         type = types.bool;
         default = false;
         example = true;
-        description = ''
+        description = lib.mdDoc ''
           Whether to open the default ports in the firewall: TCP/UDP 22000 for transfers
           and UDP 21027 for discovery.
 
@@ -477,7 +477,7 @@ in {
         type = types.package;
         default = pkgs.syncthing;
         defaultText = literalExpression "pkgs.syncthing";
-        description = ''
+        description = lib.mdDoc ''
           The Syncthing package to use.
         '';
       };
diff --git a/nixos/modules/services/networking/tailscale.nix b/nixos/modules/services/networking/tailscale.nix
index 39c9c6fc5b0d..12ac6d6da5a8 100644
--- a/nixos/modules/services/networking/tailscale.nix
+++ b/nixos/modules/services/networking/tailscale.nix
@@ -17,26 +17,26 @@ in {
     port = mkOption {
       type = types.port;
       default = 41641;
-      description = "The port to listen on for tunnel traffic (0=autoselect).";
+      description = lib.mdDoc "The port to listen on for tunnel traffic (0=autoselect).";
     };
 
     interfaceName = mkOption {
       type = types.str;
       default = "tailscale0";
-      description = ''The interface name for tunnel traffic. Use "userspace-networking" (beta) to not use TUN.'';
+      description = lib.mdDoc ''The interface name for tunnel traffic. Use "userspace-networking" (beta) to not use TUN.'';
     };
 
     permitCertUid = mkOption {
       type = types.nullOr types.nonEmptyStr;
       default = null;
-      description = "Username or user ID of the user allowed to to fetch Tailscale TLS certificates for the node.";
+      description = lib.mdDoc "Username or user ID of the user allowed to to fetch Tailscale TLS certificates for the node.";
     };
 
     package = mkOption {
       type = types.package;
       default = pkgs.tailscale;
       defaultText = literalExpression "pkgs.tailscale";
-      description = "The package to use for tailscale";
+      description = lib.mdDoc "The package to use for tailscale";
     };
   };
 
diff --git a/nixos/modules/services/networking/tcpcrypt.nix b/nixos/modules/services/networking/tcpcrypt.nix
index 5a91054e1668..f2115a6660cb 100644
--- a/nixos/modules/services/networking/tcpcrypt.nix
+++ b/nixos/modules/services/networking/tcpcrypt.nix
@@ -17,7 +17,7 @@ in
     networking.tcpcrypt.enable = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         Whether to enable opportunistic TCP encryption. If the other end
         speaks Tcpcrypt, then your traffic will be encrypted; otherwise
         it will be sent in clear text. Thus, Tcpcrypt alone provides no
diff --git a/nixos/modules/services/networking/teamspeak3.nix b/nixos/modules/services/networking/teamspeak3.nix
index c0ed08282aaf..3be9fb31ec79 100644
--- a/nixos/modules/services/networking/teamspeak3.nix
+++ b/nixos/modules/services/networking/teamspeak3.nix
@@ -19,7 +19,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to run the Teamspeak3 voice communication server daemon.
         '';
       };
@@ -27,7 +27,7 @@ in
       dataDir = mkOption {
         type = types.path;
         default = "/var/lib/teamspeak3-server";
-        description = ''
+        description = lib.mdDoc ''
           Directory to store TS3 database and other state/data files.
         '';
       };
@@ -35,7 +35,7 @@ in
       logPath = mkOption {
         type = types.path;
         default = "/var/log/teamspeak3-server/";
-        description = ''
+        description = lib.mdDoc ''
           Directory to store log files in.
         '';
       };
@@ -44,7 +44,7 @@ in
         type = types.nullOr types.str;
         default = null;
         example = "[::]";
-        description = ''
+        description = lib.mdDoc ''
           IP on which the server instance will listen for incoming voice connections. Defaults to any IP.
         '';
       };
@@ -52,7 +52,7 @@ in
       defaultVoicePort = mkOption {
         type = types.int;
         default = 9987;
-        description = ''
+        description = lib.mdDoc ''
           Default UDP port for clients to connect to virtual servers - used for first virtual server, subsequent ones will open on incrementing port numbers by default.
         '';
       };
@@ -61,7 +61,7 @@ in
         type = types.nullOr types.str;
         default = null;
         example = "[::]";
-        description = ''
+        description = lib.mdDoc ''
           IP on which the server instance will listen for incoming file transfer connections. Defaults to any IP.
         '';
       };
@@ -69,7 +69,7 @@ in
       fileTransferPort = mkOption {
         type = types.int;
         default = 30033;
-        description = ''
+        description = lib.mdDoc ''
           TCP port opened for file transfers.
         '';
       };
@@ -78,7 +78,7 @@ in
         type = types.nullOr types.str;
         default = null;
         example = "0.0.0.0";
-        description = ''
+        description = lib.mdDoc ''
           IP on which the server instance will listen for incoming ServerQuery connections. Defaults to any IP.
         '';
       };
@@ -86,7 +86,7 @@ in
       queryPort = mkOption {
         type = types.int;
         default = 10011;
-        description = ''
+        description = lib.mdDoc ''
           TCP port opened for ServerQuery connections.
         '';
       };
@@ -94,13 +94,13 @@ in
       openFirewall = mkOption {
         type = types.bool;
         default = false;
-        description = "Open ports in the firewall for the TeamSpeak3 server.";
+        description = lib.mdDoc "Open ports in the firewall for the TeamSpeak3 server.";
       };
 
       openFirewallServerQuery = mkOption {
         type = types.bool;
         default = false;
-        description = "Open ports in the firewall for the TeamSpeak3 serverquery (administration) system. Requires openFirewall.";
+        description = lib.mdDoc "Open ports in the firewall for the TeamSpeak3 serverquery (administration) system. Requires openFirewall.";
       };
 
     };
diff --git a/nixos/modules/services/networking/tedicross.nix b/nixos/modules/services/networking/tedicross.nix
index c7830289dca0..3d7f298efacd 100644
--- a/nixos/modules/services/networking/tedicross.nix
+++ b/nixos/modules/services/networking/tedicross.nix
@@ -57,9 +57,9 @@ in {
             debug = false;
           }
         '';
-        description = ''
-          <filename>settings.yaml</filename> configuration as a Nix attribute set.
-          Secret tokens should be specified using <option>environmentFile</option>
+        description = lib.mdDoc ''
+          {file}`settings.yaml` configuration as a Nix attribute set.
+          Secret tokens should be specified using {option}`environmentFile`
           instead of this world-readable file.
         '';
       };
@@ -67,10 +67,10 @@ in {
       environmentFile = mkOption {
         type = types.nullOr types.path;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           File containing environment variables to be passed to the TediCross service,
           in which secret tokens can be specified securely using the
-          <literal>TELEGRAM_BOT_TOKEN</literal> and <literal>DISCORD_BOT_TOKEN</literal>
+          `TELEGRAM_BOT_TOKEN` and `DISCORD_BOT_TOKEN`
           keys.
         '';
       };
diff --git a/nixos/modules/services/networking/teleport.nix b/nixos/modules/services/networking/teleport.nix
index 454791621800..d03648df34b0 100644
--- a/nixos/modules/services/networking/teleport.nix
+++ b/nixos/modules/services/networking/teleport.nix
@@ -33,11 +33,11 @@ in
             auth_service.enabled = false;
           }
         '';
-        description = ''
-          Contents of the <literal>teleport.yaml</literal> config file.
-          The <literal>--config</literal> arguments will only be passed if this set is not empty.
+        description = lib.mdDoc ''
+          Contents of the `teleport.yaml` config file.
+          The `--config` arguments will only be passed if this set is not empty.
 
-          See <link xlink:href="https://goteleport.com/docs/setup/reference/config/"/>.
+          See <https://goteleport.com/docs/setup/reference/config/>.
         '';
       };
 
@@ -61,13 +61,13 @@ in
         addr = mkOption {
           type = str;
           default = "127.0.0.1";
-          description = "Metrics and diagnostics address.";
+          description = lib.mdDoc "Metrics and diagnostics address.";
         };
 
         port = mkOption {
           type = int;
           default = 3000;
-          description = "Metrics and diagnostics port.";
+          description = lib.mdDoc "Metrics and diagnostics port.";
         };
       };
     };
diff --git a/nixos/modules/services/networking/tftpd.nix b/nixos/modules/services/networking/tftpd.nix
index c9c0a2b321d5..a4dc137daa4c 100644
--- a/nixos/modules/services/networking/tftpd.nix
+++ b/nixos/modules/services/networking/tftpd.nix
@@ -11,7 +11,7 @@ with lib;
     services.tftpd.enable = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         Whether to enable tftpd, a Trivial File Transfer Protocol server.
         The server will be run as an xinetd service.
       '';
@@ -20,7 +20,7 @@ with lib;
     services.tftpd.path = mkOption {
       type = types.path;
       default = "/srv/tftp";
-      description = ''
+      description = lib.mdDoc ''
         Where the tftp server files are stored.
       '';
     };
diff --git a/nixos/modules/services/networking/thelounge.nix b/nixos/modules/services/networking/thelounge.nix
index a5118fd8b339..8db541d8072b 100644
--- a/nixos/modules/services/networking/thelounge.nix
+++ b/nixos/modules/services/networking/thelounge.nix
@@ -28,11 +28,11 @@ in
     public = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         Make your The Lounge instance public.
-        Setting this to <literal>false</literal> will require you to configure user
-        accounts by using the (<command>thelounge</command>) command or by adding
-        entries in <filename>${dataDir}/users</filename>. You might need to restart
+        Setting this to `false` will require you to configure user
+        accounts by using the ({command}`thelounge`) command or by adding
+        entries in {file}`${dataDir}/users`. You might need to restart
         The Lounge after making changes to the state directory.
       '';
     };
@@ -40,7 +40,7 @@ in
     port = mkOption {
       type = types.port;
       default = 9000;
-      description = "TCP port to listen on for http connections.";
+      description = lib.mdDoc "TCP port to listen on for http connections.";
     };
 
     extraConfig = mkOption {
@@ -54,14 +54,14 @@ in
           port = 6697;
         };
       }'';
-      description = ''
-        The Lounge's <filename>config.js</filename> contents as attribute set (will be
+      description = lib.mdDoc ''
+        The Lounge's {file}`config.js` contents as attribute set (will be
         converted to JSON to generate the configuration file).
 
         The options defined here will be merged to the default configuration file.
-        Note: In case of duplicate configuration, options from <option>extraConfig</option> have priority.
+        Note: In case of duplicate configuration, options from {option}`extraConfig` have priority.
 
-        Documentation: <link xlink:href="https://thelounge.chat/docs/server/configuration" />
+        Documentation: <https://thelounge.chat/docs/server/configuration>
       '';
     };
 
@@ -69,9 +69,9 @@ in
       default = [ ];
       type = types.listOf types.package;
       example = literalExpression "[ pkgs.theLoungePlugins.themes.solarized ]";
-      description = ''
+      description = lib.mdDoc ''
         The Lounge plugins to install. Plugins can be found in
-        <literal>pkgs.theLoungePlugins.plugins</literal> and <literal>pkgs.theLoungePlugins.themes</literal>.
+        `pkgs.theLoungePlugins.plugins` and `pkgs.theLoungePlugins.themes`.
       '';
     };
   };
diff --git a/nixos/modules/services/networking/tinc.nix b/nixos/modules/services/networking/tinc.nix
index 31731b60d484..1f93d82f96eb 100644
--- a/nixos/modules/services/networking/tinc.nix
+++ b/nixos/modules/services/networking/tinc.nix
@@ -24,13 +24,13 @@ let
     options = {
       address = mkOption {
         type = types.str;
-        description = "The external IP address or hostname where the host can be reached.";
+        description = lib.mdDoc "The external IP address or hostname where the host can be reached.";
       };
 
       port = mkOption {
         type = types.nullOr types.port;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           The port where the host can be reached.
 
           If no port is specified, the default Port is used.
@@ -43,7 +43,7 @@ let
     options = {
       address = mkOption {
         type = types.str;
-        description = ''
+        description = lib.mdDoc ''
           The subnet of this host.
 
           Subnets can either be single MAC, IPv4 or IPv6 addresses, in which case
@@ -60,7 +60,7 @@ let
       prefixLength = mkOption {
         type = with types; nullOr (addCheck int (n: n >= 0 && n <= 128));
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           The prefix length of the subnet.
 
           If null, a subnet consisting of only that single address is assumed.
@@ -72,7 +72,7 @@ let
       weight = mkOption {
         type = types.ints.unsigned;
         default = 10;
-        description = ''
+        description = lib.mdDoc ''
           Indicates the priority over identical Subnets owned by different nodes.
 
           Lower values indicate higher priority. Packets will be sent to the
@@ -89,9 +89,9 @@ let
       addresses = mkOption {
         type = types.listOf (types.submodule addressSubmodule);
         default = [ ];
-        description = ''
+        description = lib.mdDoc ''
           The external address where the host can be reached. This will set this
-          host's <option>settings.Address</option> option.
+          host's {option}`settings.Address` option.
 
           This variable is only required if you want to connect to this host.
         '';
@@ -100,9 +100,9 @@ let
       subnets = mkOption {
         type = types.listOf (types.submodule subnetSubmodule);
         default = [ ];
-        description = ''
+        description = lib.mdDoc ''
           The subnets which this tinc daemon will serve. This will set this
-          host's <option>settings.Subnet</option> option.
+          host's {option}`settings.Subnet` option.
 
           Tinc tries to look up which other daemon it should send a packet to by
           searching the appropriate subnet. If the packet matches a subnet, it
@@ -114,24 +114,24 @@ let
       rsaPublicKey = mkOption {
         type = types.str;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           Legacy RSA public key of the host in PEM format, including start and
           end markers.
 
           This will be appended as-is in the host's configuration file.
 
           The ed25519 public key can be specified using the
-          <option>settings.Ed25519PublicKey</option> option instead.
+          {option}`settings.Ed25519PublicKey` option instead.
         '';
       };
 
       settings = mkOption {
         default = { };
         type = types.submodule { freeformType = tincConfType; };
-        description = ''
+        description = lib.mdDoc ''
           Configuration for this host.
 
-          See <link xlink:href="https://tinc-vpn.org/documentation-1.1/Host-configuration-variables.html"/>
+          See <https://tinc-vpn.org/documentation-1.1/Host-configuration-variables.html>
           for supported values.
         '';
       };
@@ -167,10 +167,10 @@ in
             extraConfig = mkOption {
               default = "";
               type = types.lines;
-              description = ''
+              description = lib.mdDoc ''
                 Extra lines to add to the tinc service configuration file.
 
-                Note that using the declarative <option>service.tinc.networks.&lt;name&gt;.settings</option>
+                Note that using the declarative {option}`service.tinc.networks.<name>.settings`
                 option is preferred.
               '';
             };
@@ -178,7 +178,7 @@ in
             name = mkOption {
               default = null;
               type = types.nullOr types.str;
-              description = ''
+              description = lib.mdDoc ''
                 The name of the node which is used as an identifier when communicating
                 with the remote nodes in the mesh. If null then the hostname of the system
                 is used to derive a name (note that tinc may replace non-alphanumeric characters in
@@ -189,7 +189,7 @@ in
             ed25519PrivateKeyFile = mkOption {
               default = null;
               type = types.nullOr types.path;
-              description = ''
+              description = lib.mdDoc ''
                 Path of the private ed25519 keyfile.
               '';
             };
@@ -197,7 +197,7 @@ in
             rsaPrivateKeyFile = mkOption {
               default = null;
               type = types.nullOr types.path;
-              description = ''
+              description = lib.mdDoc ''
                 Path of the private RSA keyfile.
               '';
             };
@@ -205,9 +205,9 @@ in
             debugLevel = mkOption {
               default = 0;
               type = types.addCheck types.int (l: l >= 0 && l <= 5);
-              description = ''
+              description = lib.mdDoc ''
                 The amount of debugging information to add to the log. 0 means little
-                logging while 5 is the most logging. <command>man tincd</command> for
+                logging while 5 is the most logging. {command}`man tincd` for
                 more details.
               '';
             };
@@ -215,11 +215,11 @@ in
             hosts = mkOption {
               default = { };
               type = types.attrsOf types.lines;
-              description = ''
+              description = lib.mdDoc ''
                 The name of the host in the network as well as the configuration for that host.
                 This name should only contain alphanumerics and underscores.
 
-                Note that using the declarative <option>service.tinc.networks.&lt;name&gt;.hostSettings</option>
+                Note that using the declarative {option}`service.tinc.networks.<name>.hostSettings`
                 option is preferred.
               '';
             };
@@ -249,7 +249,7 @@ in
                 }
               '';
               type = types.attrsOf (types.submodule hostSubmodule);
-              description = ''
+              description = lib.mdDoc ''
                 The name of the host in the network as well as the configuration for that host.
                 This name should only contain alphanumerics and underscores.
               '';
@@ -258,7 +258,7 @@ in
             interfaceType = mkOption {
               default = "tun";
               type = types.enum [ "tun" "tap" ];
-              description = ''
+              description = lib.mdDoc ''
                 The type of virtual interface used for the network connection.
               '';
             };
@@ -266,7 +266,7 @@ in
             listenAddress = mkOption {
               default = null;
               type = types.nullOr types.str;
-              description = ''
+              description = lib.mdDoc ''
                 The ip address to listen on for incoming connections.
               '';
             };
@@ -274,7 +274,7 @@ in
             bindToAddress = mkOption {
               default = null;
               type = types.nullOr types.str;
-              description = ''
+              description = lib.mdDoc ''
                 The ip address to bind to (both listen on and send packets from).
               '';
             };
@@ -283,7 +283,7 @@ in
               type = types.package;
               default = pkgs.tinc_pre;
               defaultText = literalExpression "pkgs.tinc_pre";
-              description = ''
+              description = lib.mdDoc ''
                 The package to use for the tinc daemon's binary.
               '';
             };
@@ -291,7 +291,7 @@ in
             chroot = mkOption {
               default = false;
               type = types.bool;
-              description = ''
+              description = lib.mdDoc ''
                 Change process root directory to the directory where the config file is located (/etc/tinc/netname/), for added security.
                 The chroot is performed after all the initialization is done, after writing pid files and opening network sockets.
 
@@ -309,10 +309,10 @@ in
                   Mode = "switch";
                 }
               '';
-              description = ''
+              description = lib.mdDoc ''
                 Configuration of the Tinc daemon for this network.
 
-                See <link xlink:href="https://tinc-vpn.org/documentation-1.1/Main-configuration-variables.html"/>
+                See <https://tinc-vpn.org/documentation-1.1/Main-configuration-variables.html>
                 for supported values.
               '';
             };
@@ -337,7 +337,7 @@ in
           };
         }));
 
-        description = ''
+        description = lib.mdDoc ''
           Defines the tinc networks which will be started.
           Each network invokes a different daemon.
         '';
diff --git a/nixos/modules/services/networking/tinydns.nix b/nixos/modules/services/networking/tinydns.nix
index 2c44ad49296d..ea91af5f1967 100644
--- a/nixos/modules/services/networking/tinydns.nix
+++ b/nixos/modules/services/networking/tinydns.nix
@@ -10,19 +10,19 @@ with lib;
       enable = mkOption {
         default = false;
         type = types.bool;
-        description = "Whether to run the tinydns dns server";
+        description = lib.mdDoc "Whether to run the tinydns dns server";
       };
 
       data = mkOption {
         type = types.lines;
         default = "";
-        description = "The DNS data to serve, in the format described by tinydns-data(8)";
+        description = lib.mdDoc "The DNS data to serve, in the format described by tinydns-data(8)";
       };
 
       ip = mkOption {
         default = "0.0.0.0";
         type = types.str;
-        description = "IP address on which to listen for connections";
+        description = lib.mdDoc "IP address on which to listen for connections";
       };
     };
   };
diff --git a/nixos/modules/services/networking/tox-bootstrapd.nix b/nixos/modules/services/networking/tox-bootstrapd.nix
index 7c13724e084a..e6dc36bf9ecf 100644
--- a/nixos/modules/services/networking/tox-bootstrapd.nix
+++ b/nixos/modules/services/networking/tox-bootstrapd.nix
@@ -23,7 +23,7 @@ in
             type = types.bool;
             default = false;
             description =
-              ''
+              lib.mdDoc ''
                 Whether to enable the Tox DHT bootstrap daemon.
               '';
           };
@@ -31,23 +31,23 @@ in
           port = mkOption {
             type = types.int;
             default = 33445;
-            description = "Listening port (UDP).";
+            description = lib.mdDoc "Listening port (UDP).";
           };
 
           keysFile = mkOption {
             type = types.str;
             default = "${WorkingDirectory}/keys";
-            description = "Node key file.";
+            description = lib.mdDoc "Node key file.";
           };
 
           extraConfig = mkOption {
             type = types.lines;
             default = "";
             description =
-              ''
+              lib.mdDoc ''
                 Configuration for bootstrap daemon.
-                See <link xlink:href="https://github.com/irungentoo/toxcore/blob/master/other/bootstrap_daemon/tox-bootstrapd.conf"/>
-                and <link xlink:href="http://wiki.tox.im/Nodes"/>.
+                See <https://github.com/irungentoo/toxcore/blob/master/other/bootstrap_daemon/tox-bootstrapd.conf>
+                and <http://wiki.tox.im/Nodes>.
              '';
           };
       };
diff --git a/nixos/modules/services/networking/tox-node.nix b/nixos/modules/services/networking/tox-node.nix
index c6e5c2d6e819..9371066be8e2 100644
--- a/nixos/modules/services/networking/tox-node.nix
+++ b/nixos/modules/services/networking/tox-node.nix
@@ -33,42 +33,42 @@ in {
     logType = mkOption {
       type = types.enum [ "Stderr" "Stdout" "Syslog" "None" ];
       default = "Stderr";
-      description = "Logging implementation.";
+      description = lib.mdDoc "Logging implementation.";
     };
     keysFile = mkOption {
       type = types.str;
       default = "${homeDir}/keys";
-      description = "Path to the file where DHT keys are stored.";
+      description = lib.mdDoc "Path to the file where DHT keys are stored.";
     };
     udpAddress = mkOption {
       type = types.str;
       default = "0.0.0.0:33445";
-      description = "UDP address to run DHT node.";
+      description = lib.mdDoc "UDP address to run DHT node.";
     };
     tcpAddresses = mkOption {
       type = types.listOf types.str;
       default = [ "0.0.0.0:33445" ];
-      description = "TCP addresses to run TCP relay.";
+      description = lib.mdDoc "TCP addresses to run TCP relay.";
     };
     tcpConnectionLimit = mkOption {
       type = types.int;
       default = 8192;
-      description = "Maximum number of active TCP connections relay can hold";
+      description = lib.mdDoc "Maximum number of active TCP connections relay can hold";
     };
     lanDiscovery = mkOption {
       type = types.bool;
       default = true;
-      description = "Enable local network discovery.";
+      description = lib.mdDoc "Enable local network discovery.";
     };
     threads = mkOption {
       type = types.int;
       default = 1;
-      description = "Number of threads for execution";
+      description = lib.mdDoc "Number of threads for execution";
     };
     motd = mkOption {
       type = types.str;
       default = "Hi from tox-rs! I'm up {{uptime}}. TCP: incoming {{tcp_packets_in}}, outgoing {{tcp_packets_out}}, UDP: incoming {{udp_packets_in}}, outgoing {{udp_packets_out}}";
-      description = "Message of the day";
+      description = lib.mdDoc "Message of the day";
     };
   };
 
diff --git a/nixos/modules/services/networking/toxvpn.nix b/nixos/modules/services/networking/toxvpn.nix
index 18cf7672d5f4..618726b0640d 100644
--- a/nixos/modules/services/networking/toxvpn.nix
+++ b/nixos/modules/services/networking/toxvpn.nix
@@ -10,20 +10,20 @@ with lib;
       localip = mkOption {
         type        = types.str;
         default     = "10.123.123.1";
-        description = "your ip on the vpn";
+        description = lib.mdDoc "your ip on the vpn";
       };
 
       port = mkOption {
         type        = types.int;
         default     = 33445;
-        description = "udp port for toxcore, port-forward to help with connectivity if you run many nodes behind one NAT";
+        description = lib.mdDoc "udp port for toxcore, port-forward to help with connectivity if you run many nodes behind one NAT";
       };
 
       auto_add_peers = mkOption {
         type        = types.listOf types.str;
         default     = [];
         example     = [ "toxid1" "toxid2" ];
-        description = "peers to automatically connect to on startup";
+        description = lib.mdDoc "peers to automatically connect to on startup";
       };
     };
   };
diff --git a/nixos/modules/services/networking/trickster.nix b/nixos/modules/services/networking/trickster.nix
index ac260a14d9a2..0b696e412b4d 100644
--- a/nixos/modules/services/networking/trickster.nix
+++ b/nixos/modules/services/networking/trickster.nix
@@ -15,7 +15,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Enable Trickster.
         '';
       };
@@ -24,7 +24,7 @@ in
         type = types.package;
         default = pkgs.trickster;
         defaultText = literalExpression "pkgs.trickster";
-        description = ''
+        description = lib.mdDoc ''
           Package that should be used for trickster.
         '';
       };
@@ -32,7 +32,7 @@ in
       configFile = mkOption {
         type = types.nullOr types.path;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Path to configuration file.
         '';
       };
@@ -40,7 +40,7 @@ in
       instance-id = mkOption {
         type = types.nullOr types.int;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Instance ID for when running multiple processes (default null).
         '';
       };
@@ -48,7 +48,7 @@ in
       log-level = mkOption {
         type = types.str;
         default = "info";
-        description = ''
+        description = lib.mdDoc ''
           Level of Logging to use (debug, info, warn, error) (default "info").
         '';
       };
@@ -56,7 +56,7 @@ in
       metrics-port = mkOption {
         type = types.port;
         default = 8082;
-        description = ''
+        description = lib.mdDoc ''
           Port that the /metrics endpoint will listen on.
         '';
       };
@@ -64,7 +64,7 @@ in
       origin-type = mkOption {
         type = types.enum [ "prometheus" "influxdb" ];
         default = "prometheus";
-        description = ''
+        description = lib.mdDoc ''
           Type of origin (prometheus, influxdb)
         '';
       };
@@ -72,7 +72,7 @@ in
       origin-url = mkOption {
         type = types.str;
         default = "http://prometheus:9090";
-        description = ''
+        description = lib.mdDoc ''
           URL to the Origin. Enter it like you would in grafana, e.g., http://prometheus:9090 (default http://prometheus:9090).
         '';
       };
@@ -80,7 +80,7 @@ in
       profiler-port = mkOption {
         type = types.nullOr types.port;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Port that the /debug/pprof endpoint will listen on.
         '';
       };
@@ -88,7 +88,7 @@ in
       proxy-port = mkOption {
         type = types.port;
         default = 9090;
-        description = ''
+        description = lib.mdDoc ''
           Port that the Proxy server will listen on.
         '';
       };
diff --git a/nixos/modules/services/networking/tvheadend.nix b/nixos/modules/services/networking/tvheadend.nix
index 19a10a03bd9b..dd5fa209be6b 100644
--- a/nixos/modules/services/networking/tvheadend.nix
+++ b/nixos/modules/services/networking/tvheadend.nix
@@ -13,13 +13,13 @@ in
       httpPort = mkOption {
         type        = types.int;
         default     = 9981;
-        description = "Port to bind HTTP to.";
+        description = lib.mdDoc "Port to bind HTTP to.";
       };
 
       htspPort = mkOption {
         type        = types.int;
         default     = 9982;
-        description = "Port to bind HTSP to.";
+        description = lib.mdDoc "Port to bind HTSP to.";
       };
     };
   };
diff --git a/nixos/modules/services/networking/ucarp.nix b/nixos/modules/services/networking/ucarp.nix
index 189e4f99cefe..7e8b1026db70 100644
--- a/nixos/modules/services/networking/ucarp.nix
+++ b/nixos/modules/services/networking/ucarp.nix
@@ -32,30 +32,30 @@ in {
 
     interface = mkOption {
       type = types.str;
-      description = "Network interface to bind to.";
+      description = lib.mdDoc "Network interface to bind to.";
       example = "eth0";
     };
 
     srcIp = mkOption {
       type = types.str;
-      description = "Source (real) IP address of this host.";
+      description = lib.mdDoc "Source (real) IP address of this host.";
     };
 
     vhId = mkOption {
       type = types.ints.between 1 255;
-      description = "Virtual IP identifier shared between CARP hosts.";
+      description = lib.mdDoc "Virtual IP identifier shared between CARP hosts.";
       example = 1;
     };
 
     passwordFile = mkOption {
       type = types.str;
-      description = "File containing shared password between CARP hosts.";
+      description = lib.mdDoc "File containing shared password between CARP hosts.";
       example = "/run/keys/ucarp-password";
     };
 
     preempt = mkOption {
       type = types.bool;
-      description = ''
+      description = lib.mdDoc ''
         Enable preemptive failover.
         Thus, this host becomes the CARP master as soon as possible.
       '';
@@ -64,30 +64,30 @@ in {
 
     neutral = mkOption {
       type = types.bool;
-      description = "Do not run downscript at start if the host is the backup.";
+      description = lib.mdDoc "Do not run downscript at start if the host is the backup.";
       default = false;
     };
 
     addr = mkOption {
       type = types.str;
-      description = "Virtual shared IP address.";
+      description = lib.mdDoc "Virtual shared IP address.";
     };
 
     advBase = mkOption {
       type = types.ints.unsigned;
-      description = "Advertisement frequency in seconds.";
+      description = lib.mdDoc "Advertisement frequency in seconds.";
       default = 1;
     };
 
     advSkew = mkOption {
       type = types.ints.unsigned;
-      description = "Advertisement skew in seconds.";
+      description = lib.mdDoc "Advertisement skew in seconds.";
       default = 0;
     };
 
     upscript = mkOption {
       type = types.path;
-      description = ''
+      description = lib.mdDoc ''
         Command to run after become master, the interface name, virtual address
         and optional extra parameters are passed as arguments.
       '';
@@ -101,7 +101,7 @@ in {
 
     downscript = mkOption {
       type = types.path;
-      description = ''
+      description = lib.mdDoc ''
         Command to run after become backup, the interface name, virtual address
         and optional extra parameters are passed as arguments.
       '';
@@ -115,37 +115,37 @@ in {
 
     deadratio = mkOption {
       type = types.ints.unsigned;
-      description = "Ratio to consider a host as dead.";
+      description = lib.mdDoc "Ratio to consider a host as dead.";
       default = 3;
     };
 
     shutdown = mkOption {
       type = types.bool;
-      description = "Call downscript at exit.";
+      description = lib.mdDoc "Call downscript at exit.";
       default = false;
     };
 
     ignoreIfState = mkOption {
       type = types.bool;
-      description = "Ignore interface state, e.g., down or no carrier.";
+      description = lib.mdDoc "Ignore interface state, e.g., down or no carrier.";
       default = false;
     };
 
     noMcast = mkOption {
       type = types.bool;
-      description = "Use broadcast instead of multicast advertisements.";
+      description = lib.mdDoc "Use broadcast instead of multicast advertisements.";
       default = false;
     };
 
     extraParam = mkOption {
       type = types.nullOr types.str;
-      description = "Extra parameter to pass to the up/down scripts.";
+      description = lib.mdDoc "Extra parameter to pass to the up/down scripts.";
       default = null;
     };
 
     package = mkOption {
       type = types.package;
-      description = ''
+      description = lib.mdDoc ''
         Package that should be used for ucarp.
 
         Please note that the default package, pkgs.ucarp, has not received any
diff --git a/nixos/modules/services/networking/unbound.nix b/nixos/modules/services/networking/unbound.nix
index 87873c8c1e83..7460ba3df7b9 100644
--- a/nixos/modules/services/networking/unbound.nix
+++ b/nixos/modules/services/networking/unbound.nix
@@ -46,31 +46,31 @@ in {
         type = types.package;
         default = pkgs.unbound-with-systemd;
         defaultText = literalExpression "pkgs.unbound-with-systemd";
-        description = "The unbound package to use";
+        description = lib.mdDoc "The unbound package to use";
       };
 
       user = mkOption {
         type = types.str;
         default = "unbound";
-        description = "User account under which unbound runs.";
+        description = lib.mdDoc "User account under which unbound runs.";
       };
 
       group = mkOption {
         type = types.str;
         default = "unbound";
-        description = "Group under which unbound runs.";
+        description = lib.mdDoc "Group under which unbound runs.";
       };
 
       stateDir = mkOption {
         type = types.path;
         default = "/var/lib/unbound";
-        description = "Directory holding all state for unbound to run.";
+        description = lib.mdDoc "Directory holding all state for unbound to run.";
       };
 
       resolveLocalQueries = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Whether unbound should resolve local queries (i.e. add 127.0.0.1 to
           /etc/resolv.conf).
         '';
@@ -79,7 +79,7 @@ in {
       enableRootTrustAnchor = mkOption {
         default = true;
         type = types.bool;
-        description = "Use and update root trust anchor for DNSSEC validation.";
+        description = lib.mdDoc "Use and update root trust anchor for DNSSEC validation.";
       };
 
       localControlSocketPath = mkOption {
@@ -90,16 +90,16 @@ in {
         # but I haven't verified yet.
         type = types.nullOr types.str;
         example = "/run/unbound/unbound.ctl";
-        description = ''
-          When not set to <literal>null</literal> this option defines the path
+        description = lib.mdDoc ''
+          When not set to `null` this option defines the path
           at which the unbound remote control socket should be created at. The
-          socket will be owned by the unbound user (<literal>unbound</literal>)
-          and group will be <literal>nogroup</literal>.
+          socket will be owned by the unbound user (`unbound`)
+          and group will be `nogroup`.
 
           Users that should be permitted to access the socket must be in the
-          <literal>config.services.unbound.group</literal> group.
+          `config.services.unbound.group` group.
 
-          If this option is <literal>null</literal> remote control will not be
+          If this option is `null` remote control will not be
           enabled. Unbounds default values apply.
         '';
       };
diff --git a/nixos/modules/services/networking/unifi.nix b/nixos/modules/services/networking/unifi.nix
index e88daae1fbba..d30f7c89633b 100644
--- a/nixos/modules/services/networking/unifi.nix
+++ b/nixos/modules/services/networking/unifi.nix
@@ -17,7 +17,7 @@ in
     services.unifi.enable = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         Whether or not to enable the unifi controller service.
       '';
     };
@@ -26,7 +26,7 @@ in
       type = types.package;
       default = pkgs.jre8;
       defaultText = literalExpression "pkgs.jre8";
-      description = ''
+      description = lib.mdDoc ''
         The JRE package to use. Check the release notes to ensure it is supported.
       '';
     };
@@ -35,7 +35,7 @@ in
       type = types.package;
       default = pkgs.unifiLTS;
       defaultText = literalExpression "pkgs.unifiLTS";
-      description = ''
+      description = lib.mdDoc ''
         The unifi package to use.
       '';
     };
@@ -44,7 +44,7 @@ in
       type = types.package;
       default = pkgs.mongodb;
       defaultText = literalExpression "pkgs.mongodb";
-      description = ''
+      description = lib.mdDoc ''
         The mongodb package to use.
       '';
     };
@@ -52,7 +52,7 @@ in
     services.unifi.openFirewall = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         Whether or not to open the minimum required ports on the firewall.
 
         This is necessary to allow firmware upgrades and device discovery to
@@ -65,7 +65,7 @@ in
       type = types.nullOr types.int;
       default = null;
       example = 1024;
-      description = ''
+      description = lib.mdDoc ''
         Set the initial heap size for the JVM in MB. If this option isn't set, the
         JVM will decide this value at runtime.
       '';
@@ -75,7 +75,7 @@ in
       type = types.nullOr types.int;
       default = null;
       example = 4096;
-      description = ''
+      description = lib.mdDoc ''
         Set the maximimum heap size for the JVM in MB. If this option isn't set, the
         JVM will decide this value at runtime.
       '';
diff --git a/nixos/modules/services/networking/uptermd.nix b/nixos/modules/services/networking/uptermd.nix
index b845a00649eb..387478de99eb 100644
--- a/nixos/modules/services/networking/uptermd.nix
+++ b/nixos/modules/services/networking/uptermd.nix
@@ -13,15 +13,15 @@ in
       openFirewall = mkOption {
         type = types.bool;
         default = false;
-        description = ''
-          Whether to open the firewall for the port in <option>services.uptermd.port</option>.
+        description = lib.mdDoc ''
+          Whether to open the firewall for the port in {option}`services.uptermd.port`.
         '';
       };
 
       port = mkOption {
         type = types.port;
         default = 2222;
-        description = ''
+        description = lib.mdDoc ''
           Port the server will listen on.
         '';
       };
@@ -30,7 +30,7 @@ in
         type = types.str;
         default = "[::]";
         example = "127.0.0.1";
-        description = ''
+        description = lib.mdDoc ''
           Address the server will listen on.
         '';
       };
@@ -39,7 +39,7 @@ in
         type = types.nullOr types.path;
         default = null;
         example = "/run/keys/upterm_host_ed25519_key";
-        description = ''
+        description = lib.mdDoc ''
           Path to SSH host key. If not defined, an ed25519 keypair is generated automatically.
         '';
       };
@@ -48,7 +48,7 @@ in
         type = types.listOf types.str;
         default = [];
         example = [ "--debug" ];
-        description = ''
+        description = lib.mdDoc ''
           Extra flags passed to the uptermd command.
         '';
       };
diff --git a/nixos/modules/services/networking/v2ray.nix b/nixos/modules/services/networking/v2ray.nix
index 95e8761ba5cc..f063ddfed0a7 100644
--- a/nixos/modules/services/networking/v2ray.nix
+++ b/nixos/modules/services/networking/v2ray.nix
@@ -9,10 +9,10 @@ with lib;
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to run v2ray server.
 
-          Either <literal>configFile</literal> or <literal>config</literal> must be specified.
+          Either `configFile` or `config` must be specified.
         '';
       };
 
@@ -20,7 +20,7 @@ with lib;
         type = types.package;
         default = pkgs.v2ray;
         defaultText = literalExpression "pkgs.v2ray";
-        description = ''
+        description = lib.mdDoc ''
           Which v2ray package to use.
         '';
       };
@@ -29,12 +29,12 @@ with lib;
         type = types.nullOr types.str;
         default = null;
         example = "/etc/v2ray/config.json";
-        description = ''
+        description = lib.mdDoc ''
           The absolute path to the configuration file.
 
-          Either <literal>configFile</literal> or <literal>config</literal> must be specified.
+          Either `configFile` or `config` must be specified.
 
-          See <link xlink:href="https://www.v2fly.org/en_US/config/overview.html"/>.
+          See <https://www.v2fly.org/en_US/config/overview.html>.
         '';
       };
 
diff --git a/nixos/modules/services/networking/vsftpd.nix b/nixos/modules/services/networking/vsftpd.nix
index d205302051e1..b26adbf8719b 100644
--- a/nixos/modules/services/networking/vsftpd.nix
+++ b/nixos/modules/services/networking/vsftpd.nix
@@ -154,18 +154,18 @@ in
       userlist = mkOption {
         default = [];
         type = types.listOf types.str;
-        description = "See <option>userlistFile</option>.";
+        description = lib.mdDoc "See {option}`userlistFile`.";
       };
 
       userlistFile = mkOption {
         type = types.path;
         default = pkgs.writeText "userlist" (concatMapStrings (x: "${x}\n") cfg.userlist);
         defaultText = literalExpression ''pkgs.writeText "userlist" (concatMapStrings (x: "''${x}\n") cfg.userlist)'';
-        description = ''
-          Newline separated list of names to be allowed/denied if <option>userlistEnable</option>
-          is <literal>true</literal>. Meaning see <option>userlistDeny</option>.
+        description = lib.mdDoc ''
+          Newline separated list of names to be allowed/denied if {option}`userlistEnable`
+          is `true`. Meaning see {option}`userlistDeny`.
 
-          The default is a file containing the users from <option>userlist</option>.
+          The default is a file containing the users from {option}`userlist`.
 
           If explicitely set to null userlist_file will not be set in vsftpd's config file.
         '';
@@ -174,8 +174,8 @@ in
       enableVirtualUsers = mkOption {
         type = types.bool;
         default = false;
-        description = ''
-          Whether to enable the <literal>pam_userdb</literal>-based
+        description = lib.mdDoc ''
+          Whether to enable the `pam_userdb`-based
           virtual user system
         '';
       };
@@ -218,7 +218,7 @@ in
         type = types.nullOr types.str;
         default = null;
         example = "/var/www/$USER";
-        description = ''
+        description = lib.mdDoc ''
           This option represents a directory which vsftpd will try to
           change into after a local (i.e. non- anonymous) login.
 
@@ -229,7 +229,7 @@ in
       anonymousUserHome = mkOption {
         type = types.path;
         default = "/home/ftp/";
-        description = ''
+        description = lib.mdDoc ''
           Directory to consider the HOME of the anonymous user.
         '';
       };
@@ -237,27 +237,27 @@ in
       rsaCertFile = mkOption {
         type = types.nullOr types.path;
         default = null;
-        description = "RSA certificate file.";
+        description = lib.mdDoc "RSA certificate file.";
       };
 
       rsaKeyFile = mkOption {
         type = types.nullOr types.path;
         default = null;
-        description = "RSA private key file.";
+        description = lib.mdDoc "RSA private key file.";
       };
 
       anonymousUmask = mkOption {
         type = types.str;
         default = "077";
         example = "002";
-        description = "Anonymous write umask.";
+        description = lib.mdDoc "Anonymous write umask.";
       };
 
       extraConfig = mkOption {
         type = types.lines;
         default = "";
         example = "ftpd_banner=Hello";
-        description = "Extra configuration to add at the bottom of the generated configuration file.";
+        description = lib.mdDoc "Extra configuration to add at the bottom of the generated configuration file.";
       };
 
     } // (listToAttrs (catAttrs "nixosOption" optionDescription));
diff --git a/nixos/modules/services/networking/wasabibackend.nix b/nixos/modules/services/networking/wasabibackend.nix
index b6dcd940915a..00d772a718c6 100644
--- a/nixos/modules/services/networking/wasabibackend.nix
+++ b/nixos/modules/services/networking/wasabibackend.nix
@@ -34,32 +34,32 @@ in {
       dataDir = mkOption {
         type = types.path;
         default = "/var/lib/wasabibackend";
-        description = "The data directory for the Wasabi backend node.";
+        description = lib.mdDoc "The data directory for the Wasabi backend node.";
       };
 
       customConfigFile = mkOption {
         type = types.nullOr types.path;
         default = null;
-        description = "Defines the path to a custom configuration file that is copied to the user's directory. Overrides any config options.";
+        description = lib.mdDoc "Defines the path to a custom configuration file that is copied to the user's directory. Overrides any config options.";
       };
 
       network = mkOption {
         type = types.enum [ "mainnet" "testnet" "regtest" ];
         default = "mainnet";
-        description = "The network to use for the Wasabi backend service.";
+        description = lib.mdDoc "The network to use for the Wasabi backend service.";
       };
 
       endpoint = {
         ip = mkOption {
           type = types.str;
           default = "127.0.0.1";
-          description = "IP address for P2P connection to bitcoind.";
+          description = lib.mdDoc "IP address for P2P connection to bitcoind.";
         };
 
         port = mkOption {
           type = types.port;
           default = 8333;
-          description = "Port for P2P connection to bitcoind.";
+          description = lib.mdDoc "Port for P2P connection to bitcoind.";
         };
       };
 
@@ -67,45 +67,45 @@ in {
         ip = mkOption {
           type = types.str;
           default = "127.0.0.1";
-          description = "IP address for RPC connection to bitcoind.";
+          description = lib.mdDoc "IP address for RPC connection to bitcoind.";
         };
 
         port = mkOption {
           type = types.port;
           default = 8332;
-          description = "Port for RPC connection to bitcoind.";
+          description = lib.mdDoc "Port for RPC connection to bitcoind.";
         };
 
         user = mkOption {
           type = types.str;
           default = "bitcoin";
-          description = "RPC user for the bitcoin endpoint.";
+          description = lib.mdDoc "RPC user for the bitcoin endpoint.";
         };
 
         password = mkOption {
           type = types.str;
           default = "password";
-          description = "RPC password for the bitcoin endpoint. Warning: this is stored in cleartext in the Nix store! Use <literal>configFile</literal> or <literal>passwordFile</literal> if needed.";
+          description = lib.mdDoc "RPC password for the bitcoin endpoint. Warning: this is stored in cleartext in the Nix store! Use `configFile` or `passwordFile` if needed.";
         };
 
         passwordFile = mkOption {
           type = types.nullOr types.path;
           default = null;
-          description = "File that contains the password of the RPC user.";
+          description = lib.mdDoc "File that contains the password of the RPC user.";
         };
       };
 
       user = mkOption {
         type = types.str;
         default = "wasabibackend";
-        description = "The user as which to run the wasabibackend node.";
+        description = lib.mdDoc "The user as which to run the wasabibackend node.";
       };
 
       group = mkOption {
         type = types.str;
         default = cfg.user;
         defaultText = literalExpression "config.${opt.user}";
-        description = "The group as which to run the wasabibackend node.";
+        description = lib.mdDoc "The group as which to run the wasabibackend node.";
       };
     };
   };
diff --git a/nixos/modules/services/networking/websockify.nix b/nixos/modules/services/networking/websockify.nix
index f7e014e03efb..45a3487bd337 100644
--- a/nixos/modules/services/networking/websockify.nix
+++ b/nixos/modules/services/networking/websockify.nix
@@ -6,7 +6,7 @@ let cfg = config.services.networking.websockify; in {
   options = {
     services.networking.websockify = {
       enable = mkOption {
-        description = "Whether to enable websockify to forward websocket connections to TCP connections.";
+        description = lib.mdDoc "Whether to enable websockify to forward websocket connections to TCP connections.";
 
         default = false;
 
@@ -14,19 +14,19 @@ let cfg = config.services.networking.websockify; in {
       };
 
       sslCert = mkOption {
-        description = "Path to the SSL certificate.";
+        description = lib.mdDoc "Path to the SSL certificate.";
         type = types.path;
       };
 
       sslKey = mkOption {
-        description = "Path to the SSL key.";
+        description = lib.mdDoc "Path to the SSL key.";
         default = cfg.sslCert;
         defaultText = literalExpression "config.services.networking.websockify.sslCert";
         type = types.path;
       };
 
       portMap = mkOption {
-        description = "Ports to map by default.";
+        description = lib.mdDoc "Ports to map by default.";
         default = {};
         type = types.attrsOf types.int;
       };
diff --git a/nixos/modules/services/networking/wg-quick.nix b/nixos/modules/services/networking/wg-quick.nix
index d44fad4202bb..b43c3e851324 100644
--- a/nixos/modules/services/networking/wg-quick.nix
+++ b/nixos/modules/services/networking/wg-quick.nix
@@ -15,7 +15,7 @@ let
         example = "/secret/wg0.conf";
         default = null;
         type = with types; nullOr str;
-        description = ''
+        description = lib.mdDoc ''
           wg-quick .conf file, describing the interface.
           This overrides any other configuration interface configuration options.
           See wg-quick manpage for more details.
@@ -26,11 +26,11 @@ let
         example = [ "192.168.2.1/24" ];
         default = [];
         type = with types; listOf str;
-        description = "The IP addresses of the interface.";
+        description = lib.mdDoc "The IP addresses of the interface.";
       };
 
       autostart = mkOption {
-        description = "Whether to bring up this interface automatically during boot.";
+        description = lib.mdDoc "Whether to bring up this interface automatically during boot.";
         default = true;
         example = false;
         type = types.bool;
@@ -40,15 +40,15 @@ let
         example = [ "192.168.2.2" ];
         default = [];
         type = with types; listOf str;
-        description = "The IP addresses of DNS servers to configure.";
+        description = lib.mdDoc "The IP addresses of DNS servers to configure.";
       };
 
       privateKey = mkOption {
         example = "yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk=";
         type = with types; nullOr str;
         default = null;
-        description = ''
-          Base64 private key generated by <command>wg genkey</command>.
+        description = lib.mdDoc ''
+          Base64 private key generated by {command}`wg genkey`.
 
           Warning: Consider using privateKeyFile instead if you do not
           want to store the key in the world-readable Nix store.
@@ -59,8 +59,8 @@ let
         example = "/private/wireguard_key";
         type = with types; nullOr str;
         default = null;
-        description = ''
-          Private key file as generated by <command>wg genkey</command>.
+        description = lib.mdDoc ''
+          Private key file as generated by {command}`wg genkey`.
         '';
       };
 
@@ -68,7 +68,7 @@ let
         default = null;
         type = with types; nullOr int;
         example = 51820;
-        description = ''
+        description = lib.mdDoc ''
           16-bit port for listening. Optional; if not specified,
           automatically generated based on interface name.
         '';
@@ -78,7 +78,7 @@ let
         example = literalExpression ''"''${pkgs.iproute2}/bin/ip netns add foo"'';
         default = "";
         type = with types; coercedTo (listOf str) (concatStringsSep "\n") lines;
-        description = ''
+        description = lib.mdDoc ''
           Commands called at the start of the interface setup.
         '';
       };
@@ -87,7 +87,7 @@ let
         example = literalExpression ''"''${pkgs.iproute2}/bin/ip netns del foo"'';
         default = "";
         type = with types; coercedTo (listOf str) (concatStringsSep "\n") lines;
-        description = ''
+        description = lib.mdDoc ''
           Command called before the interface is taken down.
         '';
       };
@@ -96,7 +96,7 @@ let
         example = literalExpression ''"''${pkgs.iproute2}/bin/ip netns add foo"'';
         default = "";
         type = with types; coercedTo (listOf str) (concatStringsSep "\n") lines;
-        description = ''
+        description = lib.mdDoc ''
           Commands called after the interface setup.
         '';
       };
@@ -105,7 +105,7 @@ let
         example = literalExpression ''"''${pkgs.iproute2}/bin/ip netns del foo"'';
         default = "";
         type = with types; coercedTo (listOf str) (concatStringsSep "\n") lines;
-        description = ''
+        description = lib.mdDoc ''
           Command called after the interface is taken down.
         '';
       };
@@ -114,7 +114,7 @@ let
         example = "main";
         default = null;
         type = with types; nullOr str;
-        description = ''
+        description = lib.mdDoc ''
           The kernel routing table to add this interface's
           associated routes to. Setting this is useful for e.g. policy routing
           ("ip rule") or virtual routing and forwarding ("ip vrf"). Both
@@ -127,7 +127,7 @@ let
         example = 1248;
         default = null;
         type = with types; nullOr int;
-        description = ''
+        description = lib.mdDoc ''
           If not specified, the MTU is automatically determined
           from the endpoint addresses or the system default route, which is usually
           a sane choice. However, to manually specify an MTU to override this
@@ -137,7 +137,7 @@ let
 
       peers = mkOption {
         default = [];
-        description = "Peers linked to the interface.";
+        description = lib.mdDoc "Peers linked to the interface.";
         type = with types; listOf (submodule peerOpts);
       };
     };
@@ -150,15 +150,15 @@ let
       publicKey = mkOption {
         example = "xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=";
         type = types.str;
-        description = "The base64 public key to the peer.";
+        description = lib.mdDoc "The base64 public key to the peer.";
       };
 
       presharedKey = mkOption {
         default = null;
         example = "rVXs/Ni9tu3oDBLS4hOyAUAa1qTWVA3loR8eL20os3I=";
         type = with types; nullOr str;
-        description = ''
-          Base64 preshared key generated by <command>wg genpsk</command>.
+        description = lib.mdDoc ''
+          Base64 preshared key generated by {command}`wg genpsk`.
           Optional, and may be omitted. This option adds an additional layer of
           symmetric-key cryptography to be mixed into the already existing
           public-key cryptography, for post-quantum resistance.
@@ -172,8 +172,8 @@ let
         default = null;
         example = "/private/wireguard_psk";
         type = with types; nullOr str;
-        description = ''
-          File pointing to preshared key as generated by <command>wg genpsk</command>.
+        description = lib.mdDoc ''
+          File pointing to preshared key as generated by {command}`wg genpsk`.
           Optional, and may be omitted. This option adds an additional layer of
           symmetric-key cryptography to be mixed into the already existing
           public-key cryptography, for post-quantum resistance.
@@ -183,7 +183,7 @@ let
       allowedIPs = mkOption {
         example = [ "10.192.122.3/32" "10.192.124.1/24" ];
         type = with types; listOf str;
-        description = ''List of IP (v4 or v6) addresses with CIDR masks from
+        description = lib.mdDoc ''List of IP (v4 or v6) addresses with CIDR masks from
         which this peer is allowed to send incoming traffic and to which
         outgoing traffic for this peer is directed. The catch-all 0.0.0.0/0 may
         be specified for matching all IPv4 addresses, and ::/0 may be specified
@@ -194,7 +194,7 @@ let
         default = null;
         example = "demo.wireguard.io:12913";
         type = with types; nullOr str;
-        description = ''Endpoint IP or hostname of the peer, followed by a colon,
+        description = lib.mdDoc ''Endpoint IP or hostname of the peer, followed by a colon,
         and then a port number of the peer.'';
       };
 
@@ -202,7 +202,7 @@ let
         default = null;
         type = with types; nullOr int;
         example = 25;
-        description = ''This is optional and is by default off, because most
+        description = lib.mdDoc ''This is optional and is by default off, because most
         users will not need it. It represents, in seconds, between 1 and 65535
         inclusive, how often to send an authenticated empty packet to the peer,
         for the purpose of keeping a stateful firewall or NAT mapping valid
@@ -304,7 +304,7 @@ in {
   options = {
     networking.wg-quick = {
       interfaces = mkOption {
-        description = "Wireguard interfaces.";
+        description = lib.mdDoc "Wireguard interfaces.";
         default = {};
         example = {
           wg0 = {
diff --git a/nixos/modules/services/networking/wireguard.nix b/nixos/modules/services/networking/wireguard.nix
index a3c3c245f1d7..412e9c921f52 100644
--- a/nixos/modules/services/networking/wireguard.nix
+++ b/nixos/modules/services/networking/wireguard.nix
@@ -19,15 +19,15 @@ let
         example = [ "192.168.2.1/24" ];
         default = [];
         type = with types; listOf str;
-        description = "The IP addresses of the interface.";
+        description = lib.mdDoc "The IP addresses of the interface.";
       };
 
       privateKey = mkOption {
         example = "yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk=";
         type = with types; nullOr str;
         default = null;
-        description = ''
-          Base64 private key generated by <command>wg genkey</command>.
+        description = lib.mdDoc ''
+          Base64 private key generated by {command}`wg genkey`.
 
           Warning: Consider using privateKeyFile instead if you do not
           want to store the key in the world-readable Nix store.
@@ -37,9 +37,9 @@ let
       generatePrivateKeyFile = mkOption {
         default = false;
         type = types.bool;
-        description = ''
+        description = lib.mdDoc ''
           Automatically generate a private key with
-          <command>wg genkey</command>, at the privateKeyFile location.
+          {command}`wg genkey`, at the privateKeyFile location.
         '';
       };
 
@@ -47,8 +47,8 @@ let
         example = "/private/wireguard_key";
         type = with types; nullOr str;
         default = null;
-        description = ''
-          Private key file as generated by <command>wg genkey</command>.
+        description = lib.mdDoc ''
+          Private key file as generated by {command}`wg genkey`.
         '';
       };
 
@@ -56,7 +56,7 @@ let
         default = null;
         type = with types; nullOr int;
         example = 51820;
-        description = ''
+        description = lib.mdDoc ''
           16-bit port for listening. Optional; if not specified,
           automatically generated based on interface name.
         '';
@@ -66,7 +66,7 @@ let
         example = literalExpression ''"''${pkgs.iproute2}/bin/ip netns add foo"'';
         default = "";
         type = with types; coercedTo (listOf str) (concatStringsSep "\n") lines;
-        description = ''
+        description = lib.mdDoc ''
           Commands called at the start of the interface setup.
         '';
       };
@@ -77,20 +77,20 @@ let
         '';
         default = "";
         type = with types; coercedTo (listOf str) (concatStringsSep "\n") lines;
-        description = "Commands called at the end of the interface setup.";
+        description = lib.mdDoc "Commands called at the end of the interface setup.";
       };
 
       postShutdown = mkOption {
         example = literalExpression ''"''${pkgs.openresolv}/bin/resolvconf -d wg0"'';
         default = "";
         type = with types; coercedTo (listOf str) (concatStringsSep "\n") lines;
-        description = "Commands called after shutting down the interface.";
+        description = lib.mdDoc "Commands called after shutting down the interface.";
       };
 
       table = mkOption {
         default = "main";
         type = types.str;
-        description = ''
+        description = lib.mdDoc ''
           The kernel routing table to add this interface's
           associated routes to. Setting this is useful for e.g. policy routing
           ("ip rule") or virtual routing and forwarding ("ip vrf"). Both
@@ -101,7 +101,7 @@ let
 
       peers = mkOption {
         default = [];
-        description = "Peers linked to the interface.";
+        description = lib.mdDoc "Peers linked to the interface.";
         type = with types; listOf (submodule peerOpts);
       };
 
@@ -109,7 +109,7 @@ let
         example = false;
         default = true;
         type = types.bool;
-        description = ''
+        description = lib.mdDoc ''
           Determines whether to add allowed IPs as routes or not.
         '';
       };
@@ -152,15 +152,15 @@ let
       publicKey = mkOption {
         example = "xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=";
         type = types.str;
-        description = "The base64 public key of the peer.";
+        description = lib.mdDoc "The base64 public key of the peer.";
       };
 
       presharedKey = mkOption {
         default = null;
         example = "rVXs/Ni9tu3oDBLS4hOyAUAa1qTWVA3loR8eL20os3I=";
         type = with types; nullOr str;
-        description = ''
-          Base64 preshared key generated by <command>wg genpsk</command>.
+        description = lib.mdDoc ''
+          Base64 preshared key generated by {command}`wg genpsk`.
           Optional, and may be omitted. This option adds an additional layer of
           symmetric-key cryptography to be mixed into the already existing
           public-key cryptography, for post-quantum resistance.
@@ -174,8 +174,8 @@ let
         default = null;
         example = "/private/wireguard_psk";
         type = with types; nullOr str;
-        description = ''
-          File pointing to preshared key as generated by <command>wg genpsk</command>.
+        description = lib.mdDoc ''
+          File pointing to preshared key as generated by {command}`wg genpsk`.
           Optional, and may be omitted. This option adds an additional layer of
           symmetric-key cryptography to be mixed into the already existing
           public-key cryptography, for post-quantum resistance.
@@ -185,7 +185,7 @@ let
       allowedIPs = mkOption {
         example = [ "10.192.122.3/32" "10.192.124.1/24" ];
         type = with types; listOf str;
-        description = ''List of IP (v4 or v6) addresses with CIDR masks from
+        description = lib.mdDoc ''List of IP (v4 or v6) addresses with CIDR masks from
         which this peer is allowed to send incoming traffic and to which
         outgoing traffic for this peer is directed. The catch-all 0.0.0.0/0 may
         be specified for matching all IPv4 addresses, and ::/0 may be specified
@@ -216,12 +216,12 @@ let
         default = 0;
         example = 5;
         type = with types; int;
-        description = ''
-          Periodically re-execute the <literal>wg</literal> utility every
+        description = lib.mdDoc ''
+          Periodically re-execute the `wg` utility every
           this many seconds in order to let WireGuard notice DNS / hostname
           changes.
 
-          Setting this to <literal>0</literal> disables periodic reexecution.
+          Setting this to `0` disables periodic reexecution.
         '';
       };
 
@@ -229,7 +229,7 @@ let
         default = null;
         type = with types; nullOr int;
         example = 25;
-        description = ''This is optional and is by default off, because most
+        description = lib.mdDoc ''This is optional and is by default off, because most
         users will not need it. It represents, in seconds, between 1 and 65535
         inclusive, how often to send an authenticated empty packet to the peer,
         for the purpose of keeping a stateful firewall or NAT mapping valid
@@ -437,7 +437,7 @@ in
     networking.wireguard = {
 
       enable = mkOption {
-        description = "Whether to enable WireGuard.";
+        description = lib.mdDoc "Whether to enable WireGuard.";
         type = types.bool;
         # 2019-05-25: Backwards compatibility.
         default = cfg.interfaces != {};
@@ -446,7 +446,7 @@ in
       };
 
       interfaces = mkOption {
-        description = "WireGuard interfaces.";
+        description = lib.mdDoc "WireGuard interfaces.";
         default = {};
         example = {
           wg0 = {
diff --git a/nixos/modules/services/networking/wpa_supplicant.nix b/nixos/modules/services/networking/wpa_supplicant.nix
index 5a7975ae1782..e21c25e2f78f 100644
--- a/nixos/modules/services/networking/wpa_supplicant.nix
+++ b/nixos/modules/services/networking/wpa_supplicant.nix
@@ -183,7 +183,7 @@ in {
       driver = mkOption {
         type = types.str;
         default = "nl80211,wext";
-        description = "Force a specific wpa_supplicant driver.";
+        description = lib.mdDoc "Force a specific wpa_supplicant driver.";
       };
 
       allowAuxiliaryImperativeNetworks = mkEnableOption "support for imperative & declarative networks" // {
@@ -199,7 +199,7 @@ in {
       scanOnLowSignal = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Whether to periodically scan for (better) networks when the signal of
           the current one is low. This will make roaming between access points
           faster, but will consume more power.
@@ -209,7 +209,7 @@ in {
       fallbackToWPA2 = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Whether to fall back to WPA2 authentication protocols if WPA3 failed.
           This allows old wireless cards (that lack recent features required by
           WPA3) to connect to mixed WPA2/WPA3 access points.
@@ -331,9 +331,9 @@ in {
                 "OWE"
                 "DPP"
               ]);
-              description = ''
+              description = lib.mdDoc ''
                 The list of authentication protocols accepted by this network.
-                This corresponds to the <literal>key_mgmt</literal> option in wpa_supplicant.
+                This corresponds to the `key_mgmt` option in wpa_supplicant.
               '';
             };
 
@@ -369,8 +369,8 @@ in {
             hidden = mkOption {
               type = types.bool;
               default = false;
-              description = ''
-                Set this to <literal>true</literal> if the SSID of the network is hidden.
+              description = lib.mdDoc ''
+                Set this to `true` if the SSID of the network is hidden.
               '';
               example = literalExpression ''
                 { echelon = {
@@ -384,7 +384,7 @@ in {
             priority = mkOption {
               type = types.nullOr types.int;
               default = null;
-              description = ''
+              description = lib.mdDoc ''
                 By default, all networks will get same priority group (0). If some of the
                 networks are more desirable, this field can be used to change the order in
                 which wpa_supplicant goes through the networks when selecting a BSS. The
@@ -414,9 +414,9 @@ in {
 
           };
         });
-        description = ''
+        description = lib.mdDoc ''
           The network definitions to automatically connect to when
-           <command>wpa_supplicant</command> is running. If this
+           {command}`wpa_supplicant` is running. If this
            parameter is left empty wpa_supplicant will use
           /etc/wpa_supplicant.conf as the configuration file.
         '';
@@ -443,7 +443,7 @@ in {
         enable = mkOption {
           type = types.bool;
           default = false;
-          description = ''
+          description = lib.mdDoc ''
             Allow normal users to control wpa_supplicant through wpa_gui or wpa_cli.
             This is useful for laptop users that switch networks a lot and don't want
             to depend on a large package such as NetworkManager just to pick nearby
@@ -458,7 +458,7 @@ in {
           type = types.str;
           default = "wheel";
           example = "network";
-          description = "Members of this group can control wpa_supplicant.";
+          description = lib.mdDoc "Members of this group can control wpa_supplicant.";
         };
       };
 
@@ -466,7 +466,7 @@ in {
         type = types.bool;
         default = lib.length cfg.interfaces < 2;
         defaultText = literalExpression "length config.${opt.interfaces} < 2";
-        description = ''
+        description = lib.mdDoc ''
           Whether to enable the DBus control interface.
           This is only needed when using NetworkManager or connman.
         '';
diff --git a/nixos/modules/services/networking/x2goserver.nix b/nixos/modules/services/networking/x2goserver.nix
index d4adf6c5650e..3c2424b6f4f9 100644
--- a/nixos/modules/services/networking/x2goserver.nix
+++ b/nixos/modules/services/networking/x2goserver.nix
@@ -42,7 +42,7 @@ in {
     nxagentDefaultOptions = mkOption {
       type = types.listOf types.str;
       default = [ "-extension GLX" "-nolisten tcp" ];
-      description = ''
+      description = lib.mdDoc ''
         List of default nx agent options.
       '';
     };
diff --git a/nixos/modules/services/networking/xandikos.nix b/nixos/modules/services/networking/xandikos.nix
index 4bd45a76e673..649e9c7a668e 100644
--- a/nixos/modules/services/networking/xandikos.nix
+++ b/nixos/modules/services/networking/xandikos.nix
@@ -15,13 +15,13 @@ in
         type = types.package;
         default = pkgs.xandikos;
         defaultText = literalExpression "pkgs.xandikos";
-        description = "The Xandikos package to use.";
+        description = lib.mdDoc "The Xandikos package to use.";
       };
 
       address = mkOption {
         type = types.str;
         default = "localhost";
-        description = ''
+        description = lib.mdDoc ''
           The IP address on which Xandikos will listen.
           By default listens on localhost.
         '';
@@ -30,13 +30,13 @@ in
       port = mkOption {
         type = types.port;
         default = 8080;
-        description = "The port of the Xandikos web application";
+        description = lib.mdDoc "The port of the Xandikos web application";
       };
 
       routePrefix = mkOption {
         type = types.str;
         default = "/";
-        description = ''
+        description = lib.mdDoc ''
           Path to Xandikos.
           Useful when Xandikos is behind a reverse proxy.
         '';
@@ -52,14 +52,14 @@ in
             "--dump-dav-xml"
           ]
         '';
-        description = ''
+        description = lib.mdDoc ''
           Extra command line arguments to pass to xandikos.
         '';
       };
 
       nginx = mkOption {
         default = {};
-        description = ''
+        description = lib.mdDoc ''
           Configuration for nginx reverse proxy.
         '';
 
@@ -68,14 +68,14 @@ in
             enable = mkOption {
               type = types.bool;
               default = false;
-              description = ''
+              description = lib.mdDoc ''
                 Configure the nginx reverse proxy settings.
               '';
             };
 
             hostName = mkOption {
               type = types.str;
-              description = ''
+              description = lib.mdDoc ''
                 The hostname use to setup the virtualhost configuration
               '';
             };
diff --git a/nixos/modules/services/networking/xinetd.nix b/nixos/modules/services/networking/xinetd.nix
index 2f527ab156aa..6c633d4ead16 100644
--- a/nixos/modules/services/networking/xinetd.nix
+++ b/nixos/modules/services/networking/xinetd.nix
@@ -49,14 +49,14 @@ in
     services.xinetd.extraDefaults = mkOption {
       default = "";
       type = types.lines;
-      description = ''
+      description = lib.mdDoc ''
         Additional configuration lines added to the default section of xinetd's configuration.
       '';
     };
 
     services.xinetd.services = mkOption {
       default = [];
-      description = ''
+      description = lib.mdDoc ''
         A list of services provided by xinetd.
       '';
 
@@ -67,39 +67,39 @@ in
           name = mkOption {
             type = types.str;
             example = "login";
-            description = "Name of the service.";
+            description = lib.mdDoc "Name of the service.";
           };
 
           protocol = mkOption {
             type = types.str;
             default = "tcp";
             description =
-              "Protocol of the service.  Usually <literal>tcp</literal> or <literal>udp</literal>.";
+              lib.mdDoc "Protocol of the service.  Usually `tcp` or `udp`.";
           };
 
           port = mkOption {
             type = types.int;
             default = 0;
             example = 123;
-            description = "Port number of the service.";
+            description = lib.mdDoc "Port number of the service.";
           };
 
           user = mkOption {
             type = types.str;
             default = "nobody";
-            description = "User account for the service";
+            description = lib.mdDoc "User account for the service";
           };
 
           server = mkOption {
             type = types.str;
             example = "/foo/bin/ftpd";
-            description = "Path of the program that implements the service.";
+            description = lib.mdDoc "Path of the program that implements the service.";
           };
 
           serverArgs = mkOption {
             type = types.separatedString " ";
             default = "";
-            description = "Command-line arguments for the server program.";
+            description = lib.mdDoc "Command-line arguments for the server program.";
           };
 
           flags = mkOption {
@@ -111,9 +111,9 @@ in
           unlisted = mkOption {
             type = types.bool;
             default = false;
-            description = ''
+            description = lib.mdDoc ''
               Whether this server is listed in
-              <filename>/etc/services</filename>.  If so, the port
+              {file}`/etc/services`.  If so, the port
               number can be omitted.
             '';
           };
@@ -121,7 +121,7 @@ in
           extraConfig = mkOption {
             type = types.lines;
             default = "";
-            description = "Extra configuration-lines added to the section of the service.";
+            description = lib.mdDoc "Extra configuration-lines added to the section of the service.";
           };
 
         };
diff --git a/nixos/modules/services/networking/xl2tpd.nix b/nixos/modules/services/networking/xl2tpd.nix
index 9418488c1e94..c30a541d30ef 100644
--- a/nixos/modules/services/networking/xl2tpd.nix
+++ b/nixos/modules/services/networking/xl2tpd.nix
@@ -9,25 +9,25 @@ with lib;
 
       serverIp = mkOption {
         type        = types.str;
-        description = "The server-side IP address.";
+        description = lib.mdDoc "The server-side IP address.";
         default     = "10.125.125.1";
       };
 
       clientIpRange = mkOption {
         type        = types.str;
-        description = "The range from which client IPs are drawn.";
+        description = lib.mdDoc "The range from which client IPs are drawn.";
         default     = "10.125.125.2-11";
       };
 
       extraXl2tpOptions = mkOption {
         type        = types.lines;
-        description = "Adds extra lines to the xl2tpd configuration file.";
+        description = lib.mdDoc "Adds extra lines to the xl2tpd configuration file.";
         default     = "";
       };
 
       extraPppdOptions = mkOption {
         type        = types.lines;
-        description = "Adds extra lines to the pppd options file.";
+        description = lib.mdDoc "Adds extra lines to the pppd options file.";
         default     = "";
         example     = ''
           ms-dns 8.8.8.8
diff --git a/nixos/modules/services/networking/xrdp.nix b/nixos/modules/services/networking/xrdp.nix
index 747fb7a1f9c4..17caeab27264 100644
--- a/nixos/modules/services/networking/xrdp.nix
+++ b/nixos/modules/services/networking/xrdp.nix
@@ -48,7 +48,7 @@ in
         type = types.package;
         default = pkgs.xrdp;
         defaultText = literalExpression "pkgs.xrdp";
-        description = ''
+        description = lib.mdDoc ''
           The package to use for the xrdp daemon's binary.
         '';
       };
@@ -56,7 +56,7 @@ in
       port = mkOption {
         type = types.int;
         default = 3389;
-        description = ''
+        description = lib.mdDoc ''
           Specifies on which port the xrdp daemon listens.
         '';
       };
@@ -64,14 +64,14 @@ in
       openFirewall = mkOption {
         default = false;
         type = types.bool;
-        description = "Whether to open the firewall for the specified RDP port.";
+        description = lib.mdDoc "Whether to open the firewall for the specified RDP port.";
       };
 
       sslKey = mkOption {
         type = types.str;
         default = "/etc/xrdp/key.pem";
         example = "/path/to/your/key.pem";
-        description = ''
+        description = lib.mdDoc ''
           ssl private key path
           A self-signed certificate will be generated if file not exists.
         '';
@@ -81,7 +81,7 @@ in
         type = types.str;
         default = "/etc/xrdp/cert.pem";
         example = "/path/to/your/cert.pem";
-        description = ''
+        description = lib.mdDoc ''
           ssl certificate path
           A self-signed certificate will be generated if file not exists.
         '';
@@ -91,7 +91,7 @@ in
         type = types.str;
         default = "xterm";
         example = "xfce4-session";
-        description = ''
+        description = lib.mdDoc ''
           The script to run when user log in, usually a window manager, e.g. "icewm", "xfce4-session"
           This is per-user overridable, if file ~/startwm.sh exists it will be used instead.
         '';
@@ -101,7 +101,7 @@ in
         type = types.path;
         default = confDir;
         defaultText = literalDocBook "generated from configuration";
-        description = "The location of the config files for xrdp.";
+        description = lib.mdDoc "The location of the config files for xrdp.";
       };
     };
   };
diff --git a/nixos/modules/services/networking/yggdrasil.nix b/nixos/modules/services/networking/yggdrasil.nix
index ae681988ea11..07b2e2a2daf2 100644
--- a/nixos/modules/services/networking/yggdrasil.nix
+++ b/nixos/modules/services/networking/yggdrasil.nix
@@ -54,9 +54,9 @@ in {
         type = nullOr path;
         default = null;
         example = "/run/keys/yggdrasil.conf";
-        description = ''
+        description = lib.mdDoc ''
           A file which contains JSON configuration for yggdrasil.
-          See the <option>config</option> option for more information.
+          See the {option}`config` option for more information.
         '';
       };
 
@@ -86,7 +86,7 @@ in {
         type = listOf str;
         default = [];
         example = [ "tap*" ];
-        description = ''
+        description = lib.mdDoc ''
           Disable the DHCP client for any interface whose name matches
           any of the shell glob patterns in this list.  Use this
           option to prevent the DHCP client from broadcasting requests
@@ -100,7 +100,7 @@ in {
         type = package;
         default = pkgs.yggdrasil;
         defaultText = literalExpression "pkgs.yggdrasil";
-        description = "Yggdrasil package to use.";
+        description = lib.mdDoc "Yggdrasil package to use.";
       };
 
       persistentKeys = mkEnableOption ''
diff --git a/nixos/modules/services/networking/zerobin.nix b/nixos/modules/services/networking/zerobin.nix
index 16db25d62304..0be694915cb1 100644
--- a/nixos/modules/services/networking/zerobin.nix
+++ b/nixos/modules/services/networking/zerobin.nix
@@ -17,7 +17,7 @@ in
         dataDir = mkOption {
           type = types.str;
           default = "/var/lib/zerobin";
-          description = ''
+          description = lib.mdDoc ''
           Path to the 0bin data directory
           '';
         };
@@ -25,7 +25,7 @@ in
         user = mkOption {
           type = types.str;
           default = "zerobin";
-          description = ''
+          description = lib.mdDoc ''
           The user 0bin should run as
           '';
         };
@@ -33,7 +33,7 @@ in
         group = mkOption {
           type = types.str;
           default = "zerobin";
-          description = ''
+          description = lib.mdDoc ''
           The group 0bin should run as
           '';
         };
@@ -42,7 +42,7 @@ in
           type = types.int;
           default = 8000;
           example = 1357;
-          description = ''
+          description = lib.mdDoc ''
           The port zerobin should listen on
           '';
         };
@@ -51,7 +51,7 @@ in
           type = types.str;
           default = "localhost";
           example = "127.0.0.1";
-          description = ''
+          description = lib.mdDoc ''
           The address zerobin should listen to
           '';
         };
@@ -65,7 +65,7 @@ in
           )
           COMPRESSED_STATIC_FILE = True
           '';
-          description = ''
+          description = lib.mdDoc ''
           Extra configuration to be appended to the 0bin config file
           (see https://0bin.readthedocs.org/en/latest/en/options.html)
           '';
diff --git a/nixos/modules/services/networking/zeronet.nix b/nixos/modules/services/networking/zeronet.nix
index 8be6692561d2..2245204d4557 100644
--- a/nixos/modules/services/networking/zeronet.nix
+++ b/nixos/modules/services/networking/zeronet.nix
@@ -23,7 +23,7 @@ in with lib; {
       type = types.package;
       default = pkgs.zeronet;
       defaultText = literalExpression "pkgs.zeronet";
-      description = "ZeroNet package to use";
+      description = lib.mdDoc "ZeroNet package to use";
     };
 
     settings = mkOption {
@@ -31,9 +31,9 @@ in with lib; {
       default = {};
       example = literalExpression "{ global.tor = enable; }";
 
-      description = ''
-        <filename>zeronet.conf</filename> configuration. Refer to
-        <link xlink:href="https://zeronet.readthedocs.io/en/latest/faq/#is-it-possible-to-use-a-configuration-file"/>
+      description = lib.mdDoc ''
+        {file}`zeronet.conf` configuration. Refer to
+        <https://zeronet.readthedocs.io/en/latest/faq/#is-it-possible-to-use-a-configuration-file>
         for details on supported values;
       '';
     };
@@ -41,7 +41,7 @@ in with lib; {
     port = mkOption {
       type = types.port;
       default = 43110;
-      description = "Optional zeronet web UI port.";
+      description = lib.mdDoc "Optional zeronet web UI port.";
     };
 
     fileserverPort = mkOption {
@@ -49,19 +49,19 @@ in with lib; {
       # read-only config file and crashes
       type = types.port;
       default = 12261;
-      description = "Zeronet fileserver port.";
+      description = lib.mdDoc "Zeronet fileserver port.";
     };
 
     tor = mkOption {
       type = types.bool;
       default = false;
-      description = "Use TOR for zeronet traffic where possible.";
+      description = lib.mdDoc "Use TOR for zeronet traffic where possible.";
     };
 
     torAlways = mkOption {
       type = types.bool;
       default = false;
-      description = "Use TOR for all zeronet traffic.";
+      description = lib.mdDoc "Use TOR for all zeronet traffic.";
     };
   };
 
diff --git a/nixos/modules/services/networking/zerotierone.nix b/nixos/modules/services/networking/zerotierone.nix
index 3bc7d3ac0db5..572ae2e929d3 100644
--- a/nixos/modules/services/networking/zerotierone.nix
+++ b/nixos/modules/services/networking/zerotierone.nix
@@ -12,7 +12,7 @@ in
     default = [];
     example = [ "a8a2c3c10c1a68de" ];
     type = types.listOf types.str;
-    description = ''
+    description = lib.mdDoc ''
       List of ZeroTier Network IDs to join on startup
     '';
   };
@@ -20,7 +20,7 @@ in
   options.services.zerotierone.port = mkOption {
     default = 9993;
     type = types.int;
-    description = ''
+    description = lib.mdDoc ''
       Network port used by ZeroTier.
     '';
   };
@@ -29,7 +29,7 @@ in
     default = pkgs.zerotierone;
     defaultText = literalExpression "pkgs.zerotierone";
     type = types.package;
-    description = ''
+    description = lib.mdDoc ''
       ZeroTier One package to use.
     '';
   };
diff --git a/nixos/modules/services/networking/znc/options.nix b/nixos/modules/services/networking/znc/options.nix
index 0db051126e86..830df809155a 100644
--- a/nixos/modules/services/networking/znc/options.nix
+++ b/nixos/modules/services/networking/znc/options.nix
@@ -12,7 +12,7 @@ let
       server = mkOption {
         type = types.str;
         example = "irc.libera.chat";
-        description = ''
+        description = lib.mdDoc ''
           IRC server address.
         '';
       };
@@ -20,7 +20,7 @@ let
       port = mkOption {
         type = types.ints.u16;
         default = 6697;
-        description = ''
+        description = lib.mdDoc ''
           IRC server port.
         '';
       };
@@ -28,7 +28,7 @@ let
       password = mkOption {
         type = types.str;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           IRC server password, such as for a Slack gateway.
         '';
       };
@@ -36,7 +36,7 @@ let
       useSSL = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Whether to use SSL to connect to the IRC server.
         '';
       };
@@ -45,7 +45,7 @@ let
         type = types.listOf types.str;
         default = [ "simple_away" ];
         example = literalExpression ''[ "simple_away" "sasl" ]'';
-        description = ''
+        description = lib.mdDoc ''
           ZNC network modules to load.
         '';
       };
@@ -54,7 +54,7 @@ let
         type = types.listOf types.str;
         default = [];
         example = [ "nixos" ];
-        description = ''
+        description = lib.mdDoc ''
           IRC channels to join.
         '';
       };
@@ -62,7 +62,7 @@ let
       hasBitlbeeControlChannel = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to add the special Bitlbee operations channel.
         '';
       };
@@ -79,9 +79,9 @@ let
           JoinDelay = 0
           Nick = johntron
         '';
-        description = ''
+        description = lib.mdDoc ''
           Extra config for the network. Consider using
-          <option>services.znc.config</option> instead.
+          {option}`services.znc.config` instead.
         '';
       };
     };
@@ -137,7 +137,7 @@ in
           default = "znc";
           example = "johntron";
           type = types.str;
-          description = ''
+          description = lib.mdDoc ''
             The user name used to log in to the ZNC web admin interface.
           '';
         };
@@ -145,7 +145,7 @@ in
         networks = mkOption {
           default = { };
           type = with types; attrsOf (submodule networkOpts);
-          description = ''
+          description = lib.mdDoc ''
             IRC networks to connect the user to.
           '';
           example = literalExpression ''
@@ -164,7 +164,7 @@ in
           default = "znc-user";
           example = "john";
           type = types.str;
-          description = ''
+          description = lib.mdDoc ''
             The IRC nick.
           '';
         };
@@ -190,7 +190,7 @@ in
         port = mkOption {
           default = 5000;
           type = types.int;
-          description = ''
+          description = lib.mdDoc ''
             Specifies the port on which to listen.
           '';
         };
@@ -198,7 +198,7 @@ in
         useSSL = mkOption {
           default = true;
           type = types.bool;
-          description = ''
+          description = lib.mdDoc ''
             Indicates whether the ZNC server should use SSL when listening on
             the specified port. A self-signed certificate will be generated.
           '';
@@ -208,7 +208,7 @@ in
           type = types.nullOr types.str;
           default = null;
           example = "/znc/";
-          description = ''
+          description = lib.mdDoc ''
             An optional URI prefix for the ZNC web interface. Can be
             used to make ZNC available behind a reverse proxy.
           '';