From: Alan T. DeKok <aland@freeradius.org>
Date: Tue, 12 Feb 2019 22:24:35 +0000 (-0500)
Subject: two spaces after '#'. No spaces at the end of a line.
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7bf85d9caf56bca28a64ceb4cc673cf43ec80ccd;p=thirdparty%2Ffreeradius-server.git

two spaces after '#'. No spaces at the end of a line.

via:

perl -p -i -e 's/^# ([^ \t])/#  $1/;s/^([ \t]+)# ([^ \t])/$1#  $2/;s/[ \t]+$//' raddb/mods-available/*
---

diff --git a/raddb/mods-available/abfab_psk_sql b/raddb/mods-available/abfab_psk_sql
index 91e387d39b5..601fc72514e 100644
--- a/raddb/mods-available/abfab_psk_sql
+++ b/raddb/mods-available/abfab_psk_sql
@@ -1,8 +1,8 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
-# $Id$
+#  $Id$
 
 #######################################################################
 #
@@ -16,16 +16,16 @@
 #
 
 #
-# sql { ... }:: See `sql` documentation.
+#  sql { ... }:: See `sql` documentation.
 #
 sql psksql {
 	#
-	# driver:: Database driver.
+	#  driver:: Database driver.
 	#
 	driver = "rlm_sql_sqlite"
 
 	#
-	# sqlite { ... }:: Database statement based on `driver` setting.
+	#  sqlite { ... }:: Database statement based on `driver` setting.
 	#
 	sqlite {
 		filename = "/var/lib/trust_router/keys"
diff --git a/raddb/mods-available/always b/raddb/mods-available/always
index c29acfdcf10..cb7ad260830 100644
--- a/raddb/mods-available/always
+++ b/raddb/mods-available/always
@@ -1,7 +1,7 @@
-# -*- text -*-
+#  -*- text -*-
+#
+#  :toc:
 #
-# :toc:
-# 
 #  $Id$
 
 #######################################################################
@@ -36,11 +36,11 @@
 	#  | `noop`     | Simulate a no-op.
 	#  | `updated`  | Indicate that the request has been updated.
 	#  |===
-	# 
+	#
 #	rcode = <value>
-	
+
 	#
-	# simulcount::  
+	#  simulcount::
 	#
 	#  If an instance of this module is listed in a `session {}`
 	#  section, this simulates a user having `<integer>` number of sessions.
@@ -48,7 +48,7 @@
 #	simulcount = <integer>
 
 	#
-	# mpp::
+	#  mpp::
 	#
 	#  If an instance is listed in a `session {}` section, this
 	#  simulates the user having multilink sessions.
diff --git a/raddb/mods-available/attr_filter b/raddb/mods-available/attr_filter
index fbe1e6f9111..81ca729c0d3 100644
--- a/raddb/mods-available/attr_filter
+++ b/raddb/mods-available/attr_filter
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
@@ -21,9 +21,9 @@
 	#  The `key` to use for filter the packets.
 	#
 #	key = "<value>"
-	
+
 	#
-	# filename::  
+	#  filename::
 	#
 	#  The `filename` with the attributes to filter.
 	#
diff --git a/raddb/mods-available/cache b/raddb/mods-available/cache
index 1116ae3896b..9ac9c3ddea4 100644
--- a/raddb/mods-available/cache
+++ b/raddb/mods-available/cache
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
@@ -30,11 +30,11 @@
 #
 
 #
-# ## Default instance
+#  ## Default instance
 #
 cache {
 	#
-	# driver::
+	#  driver::
 	#
 	#  The current backend datastore used to store the cache entries are:
 	#
@@ -192,16 +192,16 @@ cache {
 	#
 	update {
 		#
-		# <list>:<attribute> <op> <value>::
+		#  <list>:<attribute> <op> <value>::
 		#
 
-		# Cache all instances of `Reply-Message in the reply list.
+		#  Cache all instances of `Reply-Message in the reply list.
 		&reply:Reply-Message := &reply:Reply-Message
 
-		# Add our own to show when the cache was last updated.
+		#  Add our own to show when the cache was last updated.
 		&reply:Reply-Message := "Cache last updated at %t"
 
-		# Add your own value for `Class`.
+		#  Add your own value for `Class`.
 		&reply:Class := "%{randstr:ssssssssssssssssssssssssssssssss}"
 	}
 
@@ -215,9 +215,9 @@ cache {
 	#  [options="header,autowidth"]
 	#  |===
 	#  | Condition            | Description
-	#  | `Cache-TTL` of > `0` | Set the TTL of the entry to the new value 
+	#  | `Cache-TTL` of > `0` | Set the TTL of the entry to the new value
 	#                           (and reset the expiry timer).
-	#  | `Cache-TTL` of < `0` | Expire the existing entry and create a new 
+	#  | `Cache-TTL` of < `0` | Expire the existing entry and create a new
 	#                           one with TTL set to `Cache-TTL` * `-1`.
 	#  | `Cache-TTL` of `0`   | Expire the existing entry and create a new one.
 	#  |===
diff --git a/raddb/mods-available/cache_eap b/raddb/mods-available/cache_eap
index 70f0897d2d7..62ddad0ce32 100644
--- a/raddb/mods-available/cache_eap
+++ b/raddb/mods-available/cache_eap
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
@@ -58,17 +58,17 @@
 #
 cache cache_eap {
 	#
-	# key:: Cache key.
+	#  key:: Cache key.
 	#
 	key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
 
 	#
-	# ttl:: TTL for cache entries.
+	#  ttl:: TTL for cache entries.
 	#
 	ttl = 15
 
 	#
-	# update <section> { ... }::
+	#  update <section> { ... }::
 	#
 	update reply {
 		&reply: += &reply:
diff --git a/raddb/mods-available/cache_tls b/raddb/mods-available/cache_tls
index cf53aa7b71f..e1ee2b2b470 100644
--- a/raddb/mods-available/cache_tls
+++ b/raddb/mods-available/cache_tls
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
@@ -33,26 +33,26 @@
 #
 
 #
-# ### TLS Session Configuration
+#  ### TLS Session Configuration
 #
 cache cache_tls_session {
 	#
-	# driver:: `cache` driver.
+	#  driver:: `cache` driver.
 	#
 	driver = "rlm_cache_rbtree"
 
 	#
-	# key:: The `cache` key.
+	#  key:: The `cache` key.
 	#
 	key = &TLS-Session-Id
 
 	#
-	# ttl:: TTL for `cache` entries.
+	#  ttl:: TTL for `cache` entries.
 	#
 	ttl = 3600	# 60 mins
 
 	#
-	# update <section> { ... }::
+	#  update <section> { ... }::
 	#
 	update {
 		&session-state:TLS-Session-Data := &session-state:TLS-Session-Data
@@ -73,23 +73,23 @@ cache cache_tls_session {
 }
 
 #
-# ### OCSP Session Configuration
+#  ### OCSP Session Configuration
 #
-# In addition to TLS sessions, the OCSP queries can be cached.
+#  In addition to TLS sessions, the OCSP queries can be cached.
 #
 cache cache_ocsp {
 	#
-	# driver:: `cache` driver.
+	#  driver:: `cache` driver.
 	#
 	driver = "rlm_cache_rbtree"
 
 	#
-	# key:: `cache` key.
+	#  key:: `cache` key.
 	#
 	key = &session-state:TLS-Client-Cert-Serial
 
 	#
-	# update <section> { ... }::
+	#  update <section> { ... }::
 	#
 	update {
 		&control:TLS-OCSP-Cert-Valid := &TLS-OCSP-Cert-Valid
diff --git a/raddb/mods-available/chap b/raddb/mods-available/chap
index 37b39642e3a..e362fe2cb24 100644
--- a/raddb/mods-available/chap
+++ b/raddb/mods-available/chap
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
diff --git a/raddb/mods-available/cipher b/raddb/mods-available/cipher
index ff867c8e653..ffc0d029c97 100644
--- a/raddb/mods-available/cipher
+++ b/raddb/mods-available/cipher
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
@@ -55,7 +55,7 @@
 #
 
 #
-# ## Default instances
+#  ## Default instances
 #
 cipher {
 	#
@@ -97,9 +97,9 @@ cipher {
 		}
 
 		#
-		# signature_digest::
+		#  signature_digest::
 		#
-		# Digest used to ingest the plaintext before signing or verification.
+		#  Digest used to ingest the plaintext before signing or verification.
 		#
 #		signature_digest = "sha256"
 
diff --git a/raddb/mods-available/client b/raddb/mods-available/client
index 49c2a2c5169..23212c561ef 100644
--- a/raddb/mods-available/client
+++ b/raddb/mods-available/client
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
diff --git a/raddb/mods-available/couchbase b/raddb/mods-available/couchbase
index c45a8ac8f8c..0d007916121 100644
--- a/raddb/mods-available/couchbase
+++ b/raddb/mods-available/couchbase
@@ -1,62 +1,62 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
 #######################################################################
 #
-# = Couchbase Module
+#  = Couchbase Module
 #
-# The `couchbase` module is used to provides connections to a `Couchbase` database.
+#  The `couchbase` module is used to provides connections to a `Couchbase` database.
 #
 
 #
-# ## Default instance
+#  ## Default instance
 #
 couchbase {
 	#
-	# server:: List of Couchbase hosts (hosts may be space, tab, comma or semi-colon separated).
-	# Ports are optional if servers are listening on the standard port.
-	# 
-	# NOTE: Complete pool urls are preferred.
+	#  server:: List of Couchbase hosts (hosts may be space, tab, comma or semi-colon separated).
+	#  Ports are optional if servers are listening on the standard port.
+	#
+	#  NOTE: Complete pool urls are preferred.
 	#
 	server = "http://cb01.example.org:8091/ http://cb02.example.org:8091/"
 
 	#
-	# bucket:: Couchbase bucket name.
+	#  bucket:: Couchbase bucket name.
 	#
 	bucket = "radius"
 
 	#
-	# password:: Couchbase bucket password (optional).
+	#  password:: Couchbase bucket password (optional).
 	#
 #	password = "password"
 
 	#
-	# acct_key:: Couchbase accounting document key.
+	#  acct_key:: Couchbase accounting document key.
 	#
 	#  This key is dynamically expanded at run time.
 	#
 	acct_key = "radacct_%{%{Acct-Unique-Session-Id}:-%{Acct-Session-Id}}"
 
 	#
-	# doctype:: Value for the 'docType' element in the json body for accounting documents.
+	#  doctype:: Value for the 'docType' element in the json body for accounting documents.
 	#
 	doctype = "radacct"
 
 	#
-	# expire:: Accounting document expire time in seconds (0 = never).
+	#  expire:: Accounting document expire time in seconds (0 = never).
 	#
 	expire = 2592000
 
 	#
-	# update { ... }:: Map attribute names to json element names for accounting.
+	#  update { ... }:: Map attribute names to json element names for accounting.
 	#
-	# Configuration items are in the format `<radius attribute> = '<element name>'`
+	#  Configuration items are in the format `<radius attribute> = '<element name>'`
 	#
-	# NOTE: Element names should be *single quoted*.
-	# Attributes not in this map will not be recorded.
+	#  NOTE: Element names should be *single quoted*.
+	#  Attributes not in this map will not be recorded.
 	#
 	update {
 		&Acct-Session-Id	= 'sessionId'
@@ -88,29 +88,29 @@ couchbase {
 	}
 
 	#
-	# user_key:: Couchbase document key for user documents (`unlang` supported).
+	#  user_key:: Couchbase document key for user documents (`unlang` supported).
 	#
 	user_key = "raduser_%{md5:%{tolower:%{%{Stripped-User-Name}:-%{User-Name}}}}"
 
 	#
-	# read_clients:: Set to `yes` to read radius clients from the Couchbase view specified below.
-	# NOTE: Clients will *ONLY* be read on server *startup*.
+	#  read_clients:: Set to `yes` to read radius clients from the Couchbase view specified below.
+	#  NOTE: Clients will *ONLY* be read on server *startup*.
 	#
 #	read_clients = no
 
 	#
-	# client { ... }:: `Map` attribute names to jSON element names when loading clients.
+	#  client { ... }:: `Map` attribute names to jSON element names when loading clients.
 	#
-	# Configuration follows the same rules as the accounting `map` above.
+	#  Configuration follows the same rules as the accounting `map` above.
 	#
 	client {
 		#
-		# view:: Couchbase view that should return all available client documents.
+		#  view:: Couchbase view that should return all available client documents.
 		#
 		view = "_design/client/_view/by_id"
 
 		#
-		# template { ... }:: Sets default values (not obtained from couchbase) for new client entries.
+		#  template { ... }:: Sets default values (not obtained from couchbase) for new client entries.
 		#
 		template {
 #			login				= 'test'
@@ -120,9 +120,9 @@ couchbase {
 		}
 
 		#
-		# attribute { ... }:: Sets the client mappings following the format: `<client attribute> = '<element name>'`.
+		#  attribute { ... }:: Sets the client mappings following the format: `<client attribute> = '<element name>'`.
 		#
-		# The following attributes are required:
+		#  The following attributes are required:
 		#
 		#  [options="header,autowidth"]
 		#  |===
@@ -131,8 +131,8 @@ couchbase {
 		#  | `secret`                        | RADIUS shared secret.
 		#  |===
 		#
-		# NOTE: All attributes usually supported in a `client` definition are also
-		# supported here. Element names *should be single quoted*.
+		#  NOTE: All attributes usually supported in a `client` definition are also
+		#  supported here. Element names *should be single quoted*.
 		#
 		attribute {
 			ipaddr                          = 'clientIdentifier'
@@ -150,13 +150,13 @@ couchbase {
 	}
 
 	#
-	# pool { ... }:: The connection pool is new for >= `3.0`, and will be used in many
-	# modules, for all kinds of connection-related activity.
+	#  pool { ... }:: The connection pool is new for >= `3.0`, and will be used in many
+	#  modules, for all kinds of connection-related activity.
 	#
 	pool {
 		#
 		#  start:: Connections to create during module instantiation.
-		#  If the server cannot create specified number of connections 
+		#  If the server cannot create specified number of connections
 		#  during instantiation it will exit.
 		#  Set to `0` to allow the server to start without the couchbase
 		#  being available.
@@ -219,8 +219,8 @@ couchbase {
 		#
 		connect_timeout = 3.0
 
-		# [WARNING]
-		# ====
+		#  [WARNING]
+		#  ====
 		#  All configuration settings are enforced.  If a
 		#  connection is closed because of `idle_timeout`,
 		#  `uses`, or `lifetime`, then the total number of
@@ -230,6 +230,6 @@ couchbase {
 		#
 		#  The solution is to either lower the `min` connections,
 		#  or increase `lifetime`/`idle_timeout`.
-		# ====
+		#  ====
 	}
 }
diff --git a/raddb/mods-available/csv b/raddb/mods-available/csv
index 8de5ad96435..6fa5d76698c 100644
--- a/raddb/mods-available/csv
+++ b/raddb/mods-available/csv
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
@@ -14,7 +14,7 @@
 #
 #  WARNING: Multi-line fields are NOT allowed.
 #
-# ## Default instance
+#  ## Default instance
 #
 csv {
 	#
diff --git a/raddb/mods-available/cui b/raddb/mods-available/cui
index 4259ca1bdbd..5aa56021344 100644
--- a/raddb/mods-available/cui
+++ b/raddb/mods-available/cui
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
@@ -60,7 +60,7 @@ sql cuisql {
 	#  ====
 
 	#
-	# sqlite { ... }:: SQLite configuration.
+	#  sqlite { ... }:: SQLite configuration.
 	#
 	sqlite {
 		filename = ${radacctdir}/cui.sqlite
@@ -68,12 +68,12 @@ sql cuisql {
 	}
 
 	#
-	# logfile:: Write CUI queries to a logfile. Useful for debugging.
+	#  logfile:: Write CUI queries to a logfile. Useful for debugging.
 	#
 #	logfile = ${logdir}/cuilog.sql
 
 	#
-	# pool { ... }:: persistent connections to external resources.
+	#  pool { ... }:: persistent connections to external resources.
 	#
 	pool {
 		start = 5
@@ -86,15 +86,15 @@ sql cuisql {
 	}
 
 	#
-	# cui_table:: The name of the database table to use for store.
+	#  cui_table:: The name of the database table to use for store.
 	#
 	cui_table = "cui"
 
 	#
-	# sql_user_name:: `SQL-User-Name` is used as the user for SQL queries.
-	# Normally it is the same as `User-Name`, but sometimes it needs to be different.
-	# Then instead of editing `User-Name` (*which we dont' recommend*), you can
-	# set `SQL-User-Name` to the new value.
+	#  sql_user_name:: `SQL-User-Name` is used as the user for SQL queries.
+	#  Normally it is the same as `User-Name`, but sometimes it needs to be different.
+	#  Then instead of editing `User-Name` (*which we dont' recommend*), you can
+	#  set `SQL-User-Name` to the new value.
 	#
 	sql_user_name = "%{User-Name}"
 
diff --git a/raddb/mods-available/date b/raddb/mods-available/date
index 19ed9c24f9f..5731a538c19 100644
--- a/raddb/mods-available/date
+++ b/raddb/mods-available/date
@@ -1,26 +1,26 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
 #######################################################################
 #
-# = Date Module
+#  = Date Module
 #
-# The `date` module xlat does convert time formats.
+#  The `date` module xlat does convert time formats.
 #
 
 #
-# ## Default instance
+#  ## Default instance
 #
 
 #
-# ### Simple date
+#  ### Simple date
 #
 date {
 	#
-	# format:: 
+	#  format::
 	#
 	#  The `xlat` performs in three modes depending on the input it
 	#  is passed.
@@ -65,18 +65,18 @@ date {
 	format = "%b %e %Y %H:%M:%S %Z"
 
 	#
-	# utc::
+	#  utc::
 	#
-	# If `utc` is enabled then any conversions from a date
-	# attribute to a `string` will be made as UTC, not localtime.
+	#  If `utc` is enabled then any conversions from a date
+	#  attribute to a `string` will be made as UTC, not localtime.
 	#
-	# .Default is to use localtime.
+	#  .Default is to use localtime.
 	#
 #	utc = no
 }
 
 #
-# ### ISO format
+#  ### ISO format
 #
 #  The core `xlat`, `%T` returns the request timestamp in `ISO` format
 #  including milliseconds. This expansion returns it without the
diff --git a/raddb/mods-available/delay b/raddb/mods-available/delay
index 42b0b876b54..a3c53cf2ac3 100644
--- a/raddb/mods-available/delay
+++ b/raddb/mods-available/delay
@@ -1,12 +1,12 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
 #######################################################################
 #
-# = Delay Module
+#  = Delay Module
 #
 #  The `delay` module delays the processing of a request in a
 #  non-blocking fashion.
@@ -20,11 +20,11 @@
 #
 
 #
-# ## Default instance
+#  ## Default instance
 #
 
 #
-# ### Simple delay
+#  ### Simple delay
 #
 delay {
 	#
@@ -58,7 +58,7 @@ delay {
 }
 
 #
-# ### Delaying Access-Reject packets
+#  ### Delaying Access-Reject packets
 #
 #  The `delay_reject` module should be used in a `send Access-Reject` section, as
 #  the last module in that section.  When `delay_reject` is used
diff --git a/raddb/mods-available/detail b/raddb/mods-available/detail
index 55aaa71d807..4eead0120b0 100644
--- a/raddb/mods-available/detail
+++ b/raddb/mods-available/detail
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
diff --git a/raddb/mods-available/detail.example.com b/raddb/mods-available/detail.example.com
index 5f30e6aee85..4f036a0998b 100644
--- a/raddb/mods-available/detail.example.com
+++ b/raddb/mods-available/detail.example.com
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
@@ -32,7 +32,7 @@
 #  corner cases.
 
 #
-# ## Default instance
+#  ## Default instance
 #
 detail detail.example.com {
 	filename = ${radacctdir}/detail.example.com/detail-%Y-%m-%dT%H:%G:00
diff --git a/raddb/mods-available/detail.log b/raddb/mods-available/detail.log
index 145cd3a0c1a..1498a0d548f 100644
--- a/raddb/mods-available/detail.log
+++ b/raddb/mods-available/detail.log
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
diff --git a/raddb/mods-available/dhcp_sqlippool b/raddb/mods-available/dhcp_sqlippool
index b83d19fdee4..f616ddd90af 100644
--- a/raddb/mods-available/dhcp_sqlippool
+++ b/raddb/mods-available/dhcp_sqlippool
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
@@ -21,7 +21,7 @@
 #
 sqlippool dhcp_sqlippool {
 	#
-	# See the `sqlippool` module for common configuration explanation.
+	#  See the `sqlippool` module for common configuration explanation.
 	#
 
 	sql_module_instance = "sql"
@@ -31,20 +31,20 @@ sqlippool dhcp_sqlippool {
 	lease_duration = 7200
 
 	#
-	# NOTE: Client's MAC address is mapped to `Calling-Station-Id` in `policy.conf`.
+	#  NOTE: Client's MAC address is mapped to `Calling-Station-Id` in `policy.conf`.
 	#
 	pool_key = "%{Calling-Station-Id}"
 
 	attribute_name = DHCP-Your-IP-Address
 
-	# 
-	# The current sample is prepared to work with MySQL.
+	#
+	#  The current sample is prepared to work with MySQL.
 	#
 	$INCLUDE ${modconfdir}/sql/ippool-dhcp/mysql/queries.conf
 
-	# 
-	# NOTE: To use sqlite you need to add `%` to `safe_characters` in
-	# `raddb/mods-config/sql/main/sqlite/queries.conf.`
+	#
+	#  NOTE: To use sqlite you need to add `%` to `safe_characters` in
+	#  `raddb/mods-config/sql/main/sqlite/queries.conf.`
 	#
 #	$INCLUDE ${modconfdir}/sql/ippool-dhcp/sqlite/queries.conf
 
diff --git a/raddb/mods-available/dhcpv4 b/raddb/mods-available/dhcpv4
index 1c59f45b463..189b1acaddd 100644
--- a/raddb/mods-available/dhcpv4
+++ b/raddb/mods-available/dhcpv4
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
diff --git a/raddb/mods-available/digest b/raddb/mods-available/digest
index 66988a9b559..45dea280bb1 100644
--- a/raddb/mods-available/digest
+++ b/raddb/mods-available/digest
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
index 33136e73620..2195a5c7fc7 100644
--- a/raddb/mods-available/eap
+++ b/raddb/mods-available/eap
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
@@ -876,7 +876,7 @@ eap {
 		#  OCSP response to pass back to the TLS client.
 		#
 		#  staple { ... }::
-		#		
+		#
 		#  This allows TLS clients to check for certificate revocation before
 		#  divulging credentials to a (possibly rogue) server, that may be
 		#  presenting a compromised certificate.
@@ -965,13 +965,13 @@ eap {
 	}
 
 	#
-	# ### EAP-TLS
+	#  ### EAP-TLS
 	#
 	#  As of Version 3.0, the TLS configuration for `TLS-based`
 	#  EAP types is above in the `tls-config { ... }` section.
 	#
 	tls {
-		# Point to the common TLS configuration
+		#  Point to the common TLS configuration
 		tls = tls-common
 
 		#
@@ -1338,7 +1338,7 @@ eap {
 		pac_opaque_key = "0123456789abcdef0123456789ABCDEF"
 
 		#
-		# virtual_server:: Same as for `TTLS`, `PEAP`, etc.
+		#  virtual_server:: Same as for `TTLS`, `PEAP`, etc.
 		#
 		virtual_server = inner-tunnel
 	}
diff --git a/raddb/mods-available/eap_inner b/raddb/mods-available/eap_inner
index 3e208eb53e4..e15bb64306f 100644
--- a/raddb/mods-available/eap_inner
+++ b/raddb/mods-available/eap_inner
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
diff --git a/raddb/mods-available/echo b/raddb/mods-available/echo
index b80576f5d7f..f5194d5046b 100644
--- a/raddb/mods-available/echo
+++ b/raddb/mods-available/echo
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
@@ -40,7 +40,7 @@
 #
 
 #
-# ## Default instance
+#  ## Default instance
 #
 exec echo {
 	#
@@ -58,8 +58,8 @@ exec echo {
 
 	#
 	#  program:: The name of the program to execute, and it's
-	#  arguments. 
-	#  
+	#  arguments.
+	#
 	#  Dynamic translation is done on this field, so things like
 	#  the following example will work.
 	#
@@ -89,8 +89,8 @@ exec echo {
 
 	#
 	#  output_pairs::: Where to place the output attributes (if any) from
-	#  the executed program. 
-	# 
+	#  the executed program.
+	#
 	#  The values allowed, and the restrictions as to availability, are the
 	#  same as for the `input_pairs`.
 	#
@@ -114,7 +114,7 @@ exec echo {
 	#
 	#  Default is `10` seconds, which should be plenty for nearly
 	#  anything. Range is `1` to `30` seconds.
-	# 
+	#
 	#  WARNING: You are strongly encouraged to NOT increase this value.
 	#  Decreasing can be used to cause authentication to fail sooner
 	#  when you know it's going to fail anyway due to the time taken,
diff --git a/raddb/mods-available/escape b/raddb/mods-available/escape
index 4da8ef65051..256767fae14 100644
--- a/raddb/mods-available/escape
+++ b/raddb/mods-available/escape
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
diff --git a/raddb/mods-available/etc_group b/raddb/mods-available/etc_group
index 80f851e9463..723c1b7ec53 100644
--- a/raddb/mods-available/etc_group
+++ b/raddb/mods-available/etc_group
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
diff --git a/raddb/mods-available/exec b/raddb/mods-available/exec
index a140e3ac839..193ce638404 100644
--- a/raddb/mods-available/exec
+++ b/raddb/mods-available/exec
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
@@ -59,8 +59,8 @@ exec {
 
 	#
 	#  program:: The name of the program to execute, and it's
-	#  arguments. 
-	#  
+	#  arguments.
+	#
 	#  Dynamic translation is done on this field, so things like
 	#  the following example will work.
 	#
@@ -94,8 +94,8 @@ exec {
 
 	#
 	#  output_pairs::: Where to place the output attributes (if any) from
-	#  the executed program. 
-	# 
+	#  the executed program.
+	#
 	#  The values allowed, and the restrictions as to availability, are the
 	#  same as for the `input_pairs`.
 	#
@@ -122,7 +122,7 @@ exec {
 	#
 	#  Default is `10` seconds, which should be plenty for nearly
 	#  anything. Range is `1` to `30` seconds.
-	# 
+	#
 	#  WARNING: You are strongly encouraged to NOT increase this
 	#  value.  In fact, you are much better off decreasing it to a
 	#  lower value.  Doing so will improve network stability and
diff --git a/raddb/mods-available/expiration b/raddb/mods-available/expiration
index a8cb707124e..029e0e8ec5d 100644
--- a/raddb/mods-available/expiration
+++ b/raddb/mods-available/expiration
@@ -1,24 +1,24 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
 #######################################################################
 #
-# = Expiration Module
+#  = Expiration Module
 #
-# The `expiration` module manages the `Expiration` attribute.
+#  The `expiration` module manages the `Expiration` attribute.
 #
-# It should be included in the *end* of the `recv` section in order to
-# handle user `Expiration`. It should also be included in the `instantiate`
-# section in order to register the `Expiration` compare function.
+#  It should be included in the *end* of the `recv` section in order to
+#  handle user `Expiration`. It should also be included in the `instantiate`
+#  section in order to register the `Expiration` compare function.
 #
 
 #
-# ## Default instance
+#  ## Default instance
 #
-# This module takes no configuration.
+#  This module takes no configuration.
 #
 expiration {
 
diff --git a/raddb/mods-available/expr b/raddb/mods-available/expr
index a02a6414ea5..79c98408ea5 100644
--- a/raddb/mods-available/expr
+++ b/raddb/mods-available/expr
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
diff --git a/raddb/mods-available/files b/raddb/mods-available/files
index 25aa9db6621..ab2832ea8f3 100644
--- a/raddb/mods-available/files
+++ b/raddb/mods-available/files
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
@@ -18,32 +18,32 @@
 #
 files {
 	#
-	# moddir:: Search for files in a subdirectory of mods-config which
-	# matches this instance of the files module.
+	#  moddir:: Search for files in a subdirectory of mods-config which
+	#  matches this instance of the files module.
 	#
 	moddir = ${modconfdir}/${.:instance}
 
 	#
-	# key:: The default key attribute to use for matches.
+	#  key:: The default key attribute to use for matches.
 	#
-	# The content of this attribute is used to match the `name` of the entry.
+	#  The content of this attribute is used to match the `name` of the entry.
 	#
 #	key = "%{%{Stripped-User-Name}:-%{User-Name}}"
 
 	#
-	# filename:: The old `users` style file is now located here.
+	#  filename:: The old `users` style file is now located here.
 	#
 	filename = ${moddir}/authorize
 
 	#
-	# usersfile:: This is accepted for backwards compatibility
-	# It will be removed in a future release.
+	#  usersfile:: This is accepted for backwards compatibility
+	#  It will be removed in a future release.
 	#
 #	usersfile = ${moddir}/authorize
 
 	#
-	# WARNING: These are accepted for backwards compatibility.
-	# They will be renamed in a future release.
+	#  WARNING: These are accepted for backwards compatibility.
+	#  They will be renamed in a future release.
 	#
 	acctusersfile = ${moddir}/accounting
 	preproxy_usersfile = ${moddir}/pre-proxy
diff --git a/raddb/mods-available/idn b/raddb/mods-available/idn
index 793841ba900..c5bc30d3976 100644
--- a/raddb/mods-available/idn
+++ b/raddb/mods-available/idn
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
diff --git a/raddb/mods-available/json b/raddb/mods-available/json
index 7c4238c4396..9a559ccbd7c 100644
--- a/raddb/mods-available/json
+++ b/raddb/mods-available/json
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
@@ -9,58 +9,58 @@
 #
 #  = JSON Module
 #
-# The `json` module registers a `map` function to allow mapping fields
-# from JSON structures to attributes.
-#
-# The path through the JSON document's tree is specified with FR jpath,
-# which is the FreeRADIUS implementation of the jpath grammar described
-# at http://goessner.net/articles/JsonPath/
-#
-# Selectors currently implemented are:
-#
-# [options="header,autowidth"]
-# |===
-# | Selector                 | Description
-# | $                        | Root node (only valid at the start of the path).
-# | @                        | Current node (only valid at the start of the path).
-# | .<name>                  | A field within an object.
-# | [<idx>]                  | Index within an array.
-# | [<start>:<end>[:<step>]] | A slice within an array (identical to the Python syntax).
-# | [<idx>,<start>:<end>]    | Multiple indexes/slices within an array.
-# | .*                       | All the children of the current node.
-# | ..                       | Recursive descent.
-# |===
-#
-# [NOTE]
-# ====
-# * Automatic casting will occur between JSON and attribute types where possible.
-# * Assignment of JSON objects/arrays to strings is supported, in which case the
+#  The `json` module registers a `map` function to allow mapping fields
+#  from JSON structures to attributes.
+#
+#  The path through the JSON document's tree is specified with FR jpath,
+#  which is the FreeRADIUS implementation of the jpath grammar described
+#  at http://goessner.net/articles/JsonPath/
+#
+#  Selectors currently implemented are:
+#
+#  [options="header,autowidth"]
+#  |===
+#  | Selector                 | Description
+#  | $                        | Root node (only valid at the start of the path).
+#  | @                        | Current node (only valid at the start of the path).
+#  | .<name>                  | A field within an object.
+#  | [<idx>]                  | Index within an array.
+#  | [<start>:<end>[:<step>]] | A slice within an array (identical to the Python syntax).
+#  | [<idx>,<start>:<end>]    | Multiple indexes/slices within an array.
+#  | .*                       | All the children of the current node.
+#  | ..                       | Recursive descent.
+#  |===
+#
+#  [NOTE]
+#  ====
+#  * Automatic casting will occur between JSON and attribute types where possible.
+#  * Assignment of JSON objects/arrays to strings is supported, in which case the
 #   JSON serialized form of the object/array is used.
-# * If a jpath matches multiple nodes, unless the map includes the `+=` operator
-# * only the first node's value will be used.
-# * If the map uses `+=` then multiple instances of the attribute will be created,
+#  * If a jpath matches multiple nodes, unless the map includes the `+=` operator
+#  * only the first node's value will be used.
+#  * If the map uses `+=` then multiple instances of the attribute will be created,
 #   each holding a different node value.
-# ====
+#  ====
 #
 
 #
-# ## Default instance
+#  ## Default instance
 #
-# This module takes no configuration.
+#  This module takes no configuration.
 #
 json {
 
 }
 
 #
-# ## Sample
+#  ## Sample
 #
-# Assuming that you have the url http://example.org/api/user/$username
-# service replying some JSON content as below.
+#  Assuming that you have the url http://example.org/api/user/$username
+#  service replying some JSON content as below.
 #
-# [source, json]
-# ----
-# {
+#  [source, json]
+#  ----
+#  {
 #   "user": "bob",
 #   "account number": 7124503,
 #     "groups": {
@@ -69,16 +69,16 @@ json {
 #       "bob"
 #     }
 #   }
-# }
-# ----
+#  }
+#  ----
 #
-# Then, you can call using the module `rest` and access the JSON fields as below example.
+#  Then, you can call using the module `rest` and access the JSON fields as below example.
 #
-# [source, unlang]
-# ----
-# map json "%{rest:GET http://example.org/api/user/%{User-Name}" {
+#  [source, unlang]
+#  ----
+#  map json "%{rest:GET http://example.org/api/user/%{User-Name}" {
 #   &Tmp-Integer-0  := '$.account number'
 #   &Group          += '$.groups.*'
-# }
-# ----
+#  }
+#  ----
 #
diff --git a/raddb/mods-available/krb5 b/raddb/mods-available/krb5
index d0cf7beeb4d..6556e141ea5 100644
--- a/raddb/mods-available/krb5
+++ b/raddb/mods-available/krb5
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
@@ -121,25 +121,25 @@ krb5 {
 #
 #  You can configure the module with the following parameters:
 #
-# [source, unlang]
-# ----
-# krb5 {
+#  [source, unlang]
+#  ----
+#  krb5 {
 # 	# Keytab containing the key used by rlm_krb5
 # 	keytab = /path/to/keytab
 #
 # 	# Principal that is used by rlm_krb5
 # 	service_principal = radius/some.host.com
-# }
-# ----
+#  }
+#  ----
 #
 #  Make sure the keytab is readable by the user that is used to run `radiusd` and
 #  that your authorization configuration really uses `krb5` to do the
 #  authentication. You will need to add the following to the `authenticate`
 #  section of your `radiusd.conf` file:
 #
-# [source, unlang]
-# Auth-Type Kerberos {
+#  [source, unlang]
+#  Auth-Type Kerberos {
 # 	krb5
-# }
-# ----
+#  }
+#  ----
 #
diff --git a/raddb/mods-available/ldap b/raddb/mods-available/ldap
index a7bbe1e441c..1e101934258 100644
--- a/raddb/mods-available/ldap
+++ b/raddb/mods-available/ldap
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
@@ -110,17 +110,17 @@ ldap {
 	#
 	sasl {
 		#
-		# mech:: SASL mechanism.
+		#  mech:: SASL mechanism.
 		#
 #		mech = 'PLAIN'
 
 		#
-		# proxy:: SASL authorisation identity to proxy.
+		#  proxy:: SASL authorisation identity to proxy.
 		#
 #		proxy = 'autz_id'
 
 		#
-		# realm:: SASL realm. Used for kerberos.
+		#  realm:: SASL realm. Used for kerberos.
 		#
 #		realm = 'example.org'
 	}
@@ -672,16 +672,16 @@ ldap {
 	#
 	tls {
 		#
-		# start_tls:: Set this to `yes` to use TLS encrypted connections
-		# to the LDAP database by using the StartTLS extended operation.
+		#  start_tls:: Set this to `yes` to use TLS encrypted connections
+		#  to the LDAP database by using the StartTLS extended operation.
 		#
-		# The StartTLS operation is supposed to be used with normal ldap connections
-		# instead of using ldaps (port 636) connections
+		#  The StartTLS operation is supposed to be used with normal ldap connections
+		#  instead of using ldaps (port 636) connections
 		#
 #		start_tls = yes
 
 		#
-		# NOTE: If `start_tls = yes`, then fill up those such options with the certificate information.
+		#  NOTE: If `start_tls = yes`, then fill up those such options with the certificate information.
 		#
 #		ca_file	= ${certdir}/cacert.pem
 #		ca_path	= ${certdir}
@@ -690,9 +690,9 @@ ldap {
 #		random_file = /dev/urandom
 
 		#
-		# require_cert:: Certificate Verification requirements.
+		#  require_cert:: Certificate Verification requirements.
 		#
-		# Can be:
+		#  Can be:
 		#
 		#  [options="header,autowidth"]
 		#  |===
diff --git a/raddb/mods-available/linelog b/raddb/mods-available/linelog
index 6f448012878..e75faf5b632 100644
--- a/raddb/mods-available/linelog
+++ b/raddb/mods-available/linelog
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
@@ -397,7 +397,7 @@ linelog log_accounting {
 		Accounting-On = "NAS %{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}} (%{%{NAS-IP-Address}:-%{NAS-IPv6-Address}}) just came online"
 		Accounting-Off = "NAS %{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}} (%{%{NAS-IP-Address}:-%{NAS-IPv6-Address}}) just went offline"
 
-		# Don't log anything for other `Acct-Status-Type` 's.
+		#  Don't log anything for other `Acct-Status-Type` 's.
 		unknown = "NAS %{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}} (%{%{NAS-IP-Address}:-%{NAS-IPv6-Address}}) sent unknown Acct-Status-Type %{Acct-Status-Type}"
 	}
 }
diff --git a/raddb/mods-available/logintime b/raddb/mods-available/logintime
index c2daa05a49d..c4dc59c92f0 100644
--- a/raddb/mods-available/logintime
+++ b/raddb/mods-available/logintime
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
diff --git a/raddb/mods-available/logtee b/raddb/mods-available/logtee
index 62f38e26ff2..a6287ceb6f3 100644
--- a/raddb/mods-available/logtee
+++ b/raddb/mods-available/logtee
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 
 #  $Id$
 
diff --git a/raddb/mods-available/lua b/raddb/mods-available/lua
index b0c86d1ecc2..b42e7e01dca 100644
--- a/raddb/mods-available/lua
+++ b/raddb/mods-available/lua
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
diff --git a/raddb/mods-available/mac2ip b/raddb/mods-available/mac2ip
index e6c55615cf0..6c97eee8c74 100644
--- a/raddb/mods-available/mac2ip
+++ b/raddb/mods-available/mac2ip
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
diff --git a/raddb/mods-available/mac2vlan b/raddb/mods-available/mac2vlan
index 6b7c1dc1054..0532ed327ba 100644
--- a/raddb/mods-available/mac2vlan
+++ b/raddb/mods-available/mac2vlan
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
diff --git a/raddb/mods-available/mruby b/raddb/mods-available/mruby
index 5924c661f86..2b4eb721014 100644
--- a/raddb/mods-available/mruby
+++ b/raddb/mods-available/mruby
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
diff --git a/raddb/mods-available/mschap b/raddb/mods-available/mschap
index f0f3ff2442d..eb81017ec56 100644
--- a/raddb/mods-available/mschap
+++ b/raddb/mods-available/mschap
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
@@ -79,7 +79,7 @@ mschap {
 	#
 	#  You can also try setting the user name as:
 	#
-	# `... --username=%{mschap:User-Name} ...`
+	#  `... --username=%{mschap:User-Name} ...`
 	#
 	#  In that case, the `mschap` module will look at the `User-Name`
 	#  attribute, and do prefix/suffix checks in order to obtain the _best_
@@ -257,24 +257,24 @@ mschap {
 	}
 
 	#
-	# .Pass Change
+	#  .Pass Change
 	#
 	passchange {
 		#
-		# ntlm_auth:: Path and arguments to ntlm_auth for password change.
+		#  ntlm_auth:: Path and arguments to ntlm_auth for password change.
 		#
-		# ntlm_auth_username:: The user name for ntlm_auth password change.
+		#  ntlm_auth_username:: The user name for ntlm_auth password change.
 		#
-		# ntlm_auth_domain:: The domain name for ntlm_auth password change.
+		#  ntlm_auth_domain:: The domain name for ntlm_auth password change.
 		#
-		# This module support `MS-CHAPv2` (not v1) password
-		# change requests.  See `doc/modules/mschap.rst` for
-		# some IMPORTANT information.
+		#  This module support `MS-CHAPv2` (not v1) password
+		#  change requests.  See `doc/modules/mschap.rst` for
+		#  some IMPORTANT information.
 		#
-		# Samba/ntlm_auth - if you are using `ntlm_auth` to validate
-		# passwords, you will need to use `ntlm_auth` to change passwords.
+		#  Samba/ntlm_auth - if you are using `ntlm_auth` to validate
+		#  passwords, you will need to use `ntlm_auth` to change passwords.
 		#
-		# Uncomment the three lines below, and change the path to `ntlm_auth.
+		#  Uncomment the three lines below, and change the path to `ntlm_auth.
 		#
 #		ntlm_auth = "/usr/bin/ntlm_auth --helper-protocol=ntlm-change-password-1"
 #		ntlm_auth_username = "username: %{mschap:User-Name}"
diff --git a/raddb/mods-available/ntlm_auth b/raddb/mods-available/ntlm_auth
index e020af3ee06..a6f6d65dcb7 100644
--- a/raddb/mods-available/ntlm_auth
+++ b/raddb/mods-available/ntlm_auth
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
diff --git a/raddb/mods-available/opendirectory b/raddb/mods-available/opendirectory
index 73ace476e03..139e49ada25 100644
--- a/raddb/mods-available/opendirectory
+++ b/raddb/mods-available/opendirectory
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
diff --git a/raddb/mods-available/pam b/raddb/mods-available/pam
index 490b30020c3..16279aa3861 100644
--- a/raddb/mods-available/pam
+++ b/raddb/mods-available/pam
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
diff --git a/raddb/mods-available/pap b/raddb/mods-available/pap
index 34cb8179088..fc37afd7873 100644
--- a/raddb/mods-available/pap
+++ b/raddb/mods-available/pap
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
diff --git a/raddb/mods-available/passwd b/raddb/mods-available/passwd
index 71adf89255a..b85ee5ddd40 100644
--- a/raddb/mods-available/passwd
+++ b/raddb/mods-available/passwd
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
@@ -35,7 +35,7 @@ passwd etc_passwd {
 	#
 	#  WARNING: The symbols `\0` and `\n` are not allowed.
 	#
-	# The Default is `:`
+	#  The Default is `:`
 	#
 #	delimiter = ":"
 
@@ -64,12 +64,12 @@ passwd etc_passwd {
 	format = "*User-Name:Crypt-Password:"
 
 	#
-	# hash_size::
+	#  hash_size::
 	#
 	#  A future version of the server will have the module automatically
 	#  determine the hash size.  Having it set manually should not be
 	#  necessary.  It should be set to 50% of the number of lines in the file.
-	# 
+	#
 	#  WARNING: The value must be larger than zero.
 	#
 	hash_size = 100
diff --git a/raddb/mods-available/perl b/raddb/mods-available/perl
index abf181daae8..e11952aadde 100644
--- a/raddb/mods-available/perl
+++ b/raddb/mods-available/perl
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
@@ -37,7 +37,7 @@
 #
 #  The interface between FreeRADIUS and Perl is mostly strings.
 #
-#  Attributes of type `string` are copied to Perl as-is. 
+#  Attributes of type `string` are copied to Perl as-is.
 #  They are not escaped or interpreted.
 #
 #  Attributes of type `octets` are copied to Perl as-is.
@@ -77,7 +77,7 @@ perl {
 	#  FreeRADIUS server.
 	#
 	perl_flags = "-T"
-	
+
 	#
 	#  List of functions in the module to call. Uncomment and change if you
 	#  want to use function names other than the defaults.
diff --git a/raddb/mods-available/python b/raddb/mods-available/python
index e31c78fdf2b..f4302e169d5 100644
--- a/raddb/mods-available/python
+++ b/raddb/mods-available/python
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
@@ -95,7 +95,7 @@ python {
 
 	#
 	#  config { ... }::
-	#  
+	#
 	#  You can define configuration items (and nested sub-sections) in python `config { ... }`
 	#  section. These items will be accessible in the python script through `radiusd.config`
 	#  dict for instance:
diff --git a/raddb/mods-available/radius b/raddb/mods-available/radius
index 01a38660ce8..ba3e56dcc5a 100644
--- a/raddb/mods-available/radius
+++ b/raddb/mods-available/radius
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
@@ -210,7 +210,7 @@ radius {
 	#  ## Packets
 	#
 	#  Each packet can have it's own retransmission timers.
-	#  
+	#
 	#  The sections are named for each packet type. The contents
 	#  are the same for all packet types.  Only the relevant ones
 	#  are parsed (see `type` above).
diff --git a/raddb/mods-available/radutmp b/raddb/mods-available/radutmp
index f967eb2c0d5..1ee9f873c88 100644
--- a/raddb/mods-available/radutmp
+++ b/raddb/mods-available/radutmp
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
diff --git a/raddb/mods-available/redis b/raddb/mods-available/redis
index a778b1bfcce..e95bf88dd8a 100644
--- a/raddb/mods-available/redis
+++ b/raddb/mods-available/redis
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
@@ -146,7 +146,7 @@ redis {
 		#  ====
 		#  All configuration settings are enforced.  If a connection is closed because of
 		#  `idle_timeout`, `uses`, or `lifetime`, then the total number of connections MAY
-		#  fall below `min`. 
+		#  fall below `min`.
 		#
 		#  When that happens, it will open a new connection.  It will also log a *WARNING*
 		#  message.
diff --git a/raddb/mods-available/redis_ippool b/raddb/mods-available/redis_ippool
index 39b2f53e028..af88b1192f3 100644
--- a/raddb/mods-available/redis_ippool
+++ b/raddb/mods-available/redis_ippool
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
diff --git a/raddb/mods-available/rediswho b/raddb/mods-available/rediswho
index 6af2911ec05..50f744f3396 100644
--- a/raddb/mods-available/rediswho
+++ b/raddb/mods-available/rediswho
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
diff --git a/raddb/mods-available/rest b/raddb/mods-available/rest
index 7f32c14dff0..592c7d6eac5 100644
--- a/raddb/mods-available/rest
+++ b/raddb/mods-available/rest
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
@@ -15,7 +15,7 @@
 #
 
 #
-#  # Default instance 
+#  # Default instance
 #
 #  If you want different instances of `rest`, just replicate the section
 #  and give a name.
@@ -25,7 +25,7 @@
 #  [source,unlang]
 #  ----
 #  rest backend_check {
-#  ...	
+#  ...
 #  }
 #  ----
 #
@@ -40,7 +40,7 @@ rest {
 	#
 	tls {
 		#
-		# .Set options about the certificate.
+		#  .Set options about the certificate.
 		#
 #		ca_file	             = ${certdir}/cacert.pem
 #		ca_path	             = ${certdir}
@@ -174,7 +174,7 @@ rest {
 	#  The values of those attributes should be in the format:
 	#
 	#    <attribute>: <value>
-	#                                      
+	#
 	#  `control:REST-HTTP-Header` attributes will be consumed after each call
 	#  to the rest module, and each `%{rest:}` expansion.
 	#
@@ -240,7 +240,7 @@ rest {
 	#          "op":"+="
 	#      }
 	#  }
-	# ----
+	#  ----
 	#
 	#  [NOTE]
 	#  ====
@@ -424,7 +424,7 @@ rest {
 		#  ====
 		#  All configuration settings are enforced.  If a connection is closed because of
 		#  `idle_timeout`, `uses`, or `lifetime`, then the total number of connections MAY
-		#  fall below `min`. 
+		#  fall below `min`.
 		#
 		#  When that happens, it will open a new connection.  It will also log a *WARNING*
 		#  message.
diff --git a/raddb/mods-available/smbpasswd b/raddb/mods-available/smbpasswd
index 342d71979b5..f5eeae0570c 100644
--- a/raddb/mods-available/smbpasswd
+++ b/raddb/mods-available/smbpasswd
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
diff --git a/raddb/mods-available/soh b/raddb/mods-available/soh
index 9e42ea97a23..34c313e7be5 100644
--- a/raddb/mods-available/soh
+++ b/raddb/mods-available/soh
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
@@ -25,6 +25,6 @@ soh {
 	#  dhcp:: If enabled, It will do SoH over DHCP.
 	#
 	#  Default is `no`.
-	#	
+	#
 	dhcp = yes
 }
diff --git a/raddb/mods-available/sometimes b/raddb/mods-available/sometimes
index 78de2739ed8..93f1cfa20c7 100644
--- a/raddb/mods-available/sometimes
+++ b/raddb/mods-available/sometimes
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
diff --git a/raddb/mods-available/sql b/raddb/mods-available/sql
index 30d8a20a905..e8322d00ce2 100644
--- a/raddb/mods-available/sql
+++ b/raddb/mods-available/sql
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
@@ -33,16 +33,16 @@
 #
 sql {
 	#
-	# dialect:: The dialect of SQL you want to use.
+	#  dialect:: The dialect of SQL you want to use.
 	#
-	# NOTE: If you're using `rlm_sql_null`, then it should be the type of
-	# database the logged queries are going to be executed against.
+	#  NOTE: If you're using `rlm_sql_null`, then it should be the type of
+	#  database the logged queries are going to be executed against.
 	#
 	dialect = "sqlite"
 
 	#
-	# driver:: The sub-module to use to execute queries. This should match
-	# the database you're attempting to connect to.
+	#  driver:: The sub-module to use to execute queries. This should match
+	#  the database you're attempting to connect to.
 	#
 	#    * rlm_sql_cassandra
 	#    * rlm_sql_db2
@@ -58,14 +58,14 @@ sql {
 	driver = "rlm_sql_${dialect}"
 
 	#
-	# $-INCLUDE:: Include driver specific configuration file if one
-	# exists. These are in a separate configuration file
-	# in mods-config/sql/driver/<driver>.
+	#  $-INCLUDE:: Include driver specific configuration file if one
+	#  exists. These are in a separate configuration file
+	#  in mods-config/sql/driver/<driver>.
 	#
 	$-INCLUDE ${modconfdir}/sql/driver/${dialect}
 
 	#
-	# .Connection info:
+	#  .Connection info:
 	#
 #	server = "localhost"
 #	port = 3306
@@ -73,142 +73,142 @@ sql {
 #	password = "radpass"
 
 	#
-	# radius_db:: Database table configuration for everything.
+	#  radius_db:: Database table configuration for everything.
 	#
-	# WARNING: Except for Oracle database.
+	#  WARNING: Except for Oracle database.
 	#
 	radius_db = "radius"
 
 	#
-	# .If you are using `Oracle` then use this instead.
+	#  .If you are using `Oracle` then use this instead.
 	#
 #	radius_db = "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=localhost)(PORT=1521))(CONNECT_DATA=(SID=your_sid)))"
 
 	#
-	# .If you're using `postgresql` this can also be used instead of the connection info parameters.
+	#  .If you're using `postgresql` this can also be used instead of the connection info parameters.
 	#
 #	radius_db = "dbname=radius host=localhost user=radius password=raddpass"
 
 	#
-	# .If you're using `postgresql` this can also be used instead of the connection info parameters.
+	#  .If you're using `postgresql` this can also be used instead of the connection info parameters.
 	#
 #	radius_db = "dbname=radius host=localhost user=radius password=raddpass"
 
 	#
-	# NOTE: Postgreql doesn't take `tls{}` options in its module config like mysql does,
-	# if you want to use SSL connections then use this form of connection info parameter.
+	#  NOTE: Postgreql doesn't take `tls{}` options in its module config like mysql does,
+	#  if you want to use SSL connections then use this form of connection info parameter.
 	#
 #	radius_db = "host=localhost port=5432 dbname=radius user=radius password=raddpass sslmode=verify-full sslcert=/etc/ssl/client.crt sslkey=/etc/ssl/client.key sslrootcert=/etc/ssl/ca.crt"
 
 	#
-	# acct_table1::
-	# acct_table2::
+	#  acct_table1::
+	#  acct_table2::
 	#
-	# If you want both stop and start records logged to the same SQL table, leave this as is.
-	# If you want them in different tables, put the start table in `acct_table1` and stop
-	# table in `acct_table2`.
+	#  If you want both stop and start records logged to the same SQL table, leave this as is.
+	#  If you want them in different tables, put the start table in `acct_table1` and stop
+	#  table in `acct_table2`.
 	#
 	acct_table1 = "radacct"
 	acct_table2 = "radacct"
 
 	#
-	# postauth_table:: Allow for storing data after authentication.
+	#  postauth_table:: Allow for storing data after authentication.
 	#
 	postauth_table = "radpostauth"
 
 	#
-	# authcheck_table::
-	# groupcheck_table::
+	#  authcheck_table::
+	#  groupcheck_table::
 	#
-	# Tables containing `check` items.
+	#  Tables containing `check` items.
 	#
 	authcheck_table = "radcheck"
 	groupcheck_table = "radgroupcheck"
 
 	#
-	# authreply_table::
-	# groupreply_table::
+	#  authreply_table::
+	#  groupreply_table::
 	#
-	# Tables containing `reply` items.
+	#  Tables containing `reply` items.
 	#
 	authreply_table = "radreply"
 	groupreply_table = "radgroupreply"
 
 	#
-	# usergroup_table:: Table to keep group info.
+	#  usergroup_table:: Table to keep group info.
 	#
 	usergroup_table = "radusergroup"
 
 	#
-	# read_groups:: Read the groups from the database.
+	#  read_groups:: Read the groups from the database.
 	#
-	# If set to `yes`, we read the group tables unless `Fall-Through = no` in the reply table.
-	# If set to `no`, we do not read the group tables unless `Fall-Through = yes` in the
-	# reply table.
+	#  If set to `yes`, we read the group tables unless `Fall-Through = no` in the reply table.
+	#  If set to `no`, we do not read the group tables unless `Fall-Through = yes` in the
+	#  reply table.
 	#
-	# Default is `yes`.
+	#  Default is `yes`.
 	#
 #	read_groups = yes
 
 	#
-	# read_profiles:: Read the profiles from the database.
+	#  read_profiles:: Read the profiles from the database.
 	#
-	# If set to `yes`, we read profiles unless `Fall-Through = no` in the groupreply table.
-	# If set to `no` we do not read profiles unless `Fall-Through = yes` in the groupreply table.
+	#  If set to `yes`, we read profiles unless `Fall-Through = no` in the groupreply table.
+	#  If set to `no` we do not read profiles unless `Fall-Through = yes` in the groupreply table.
 	#
-	# Default is `yes`.
+	#  Default is `yes`.
 	#
 #	read_profiles = yes
 
 	#
-	# logfile:: Write SQL queries to a logfile.
+	#  logfile:: Write SQL queries to a logfile.
 	#
-	# This is potentially useful for tracing issues with authorization queries.
-	# See also `logfile` directives in `mods-config/sql/main/*/queries.conf`.
-	# You can enable per-section logging by enabling `logfile` there, or global logging by
-	# enabling `logfile` here.
+	#  This is potentially useful for tracing issues with authorization queries.
+	#  See also `logfile` directives in `mods-config/sql/main/*/queries.conf`.
+	#  You can enable per-section logging by enabling `logfile` there, or global logging by
+	#  enabling `logfile` here.
 	#
-	# Per-section logging can be disabled by setting "logfile = ''"
+	#  Per-section logging can be disabled by setting "logfile = ''"
 	#
 #	logfile = ${logdir}/sqllog.sql
 
 	#
-	# query_timeout:: Set the maximum query duration for `rlm_sql_mysql` and `rlm_sql_cassandra`.
+	#  query_timeout:: Set the maximum query duration for `rlm_sql_mysql` and `rlm_sql_cassandra`.
 	#
 #	query_timeout = 5
 
 	#
-	# pool { ... }::
+	#  pool { ... }::
 	#
-	# The connection pool is new for 3.0, and will be used in many modules, for all kinds of
-	# connection-related activity.
+	#  The connection pool is new for 3.0, and will be used in many modules, for all kinds of
+	#  connection-related activity.
 	#
-	# When the server is not threaded, the connection pool limits are ignored, and only one
-	# connection is used.
+	#  When the server is not threaded, the connection pool limits are ignored, and only one
+	#  connection is used.
 	#
-	# [NOTE]
-	# ====
-	# If you want to have multiple SQL modules re-use the same connection pool, use `pool = name`
-	# instead of a `pool` section.
+	#  [NOTE]
+	#  ====
+	#  If you want to have multiple SQL modules re-use the same connection pool, use `pool = name`
+	#  instead of a `pool` section.
 	#
-	# e.g:
+	#  e.g:
 	#
-	# [source,sql]
-	# ----
-	# sql1 {
+	#  [source,sql]
+	#  ----
+	#  sql1 {
 	#   ...
 	#   pool {
 	#     ...
 	#   }
-	# }
+	#  }
 	#
-	# # sql2 will use the connection pool from sql1
-	# sql2 {
+	#  # sql2 will use the connection pool from sql1
+	#  sql2 {
 	#   ...
 	#   pool = sql1
-	# }
-	# ----
-	# ====
+	#  }
+	#  ----
+	#  ====
 	#
 	pool {
 		#
@@ -264,7 +264,7 @@ sql {
 		retry_delay = 30
 
 		#
-		# lifetime:: The lifetime (in seconds) of the connection.
+		#  lifetime:: The lifetime (in seconds) of the connection.
 		#
 		lifetime = 0
 
@@ -306,15 +306,15 @@ sql {
 	}
 
 	#
-	# group_attribute:: The group attribute specific to this instance of `rlm_sql`.
+	#  group_attribute:: The group attribute specific to this instance of `rlm_sql`.
 	#
 	group_attribute = "${.:instance}-Group"
 
 	#
-	# .Read database-specific queries.
+	#  .Read database-specific queries.
 	#
-	# Not all drivers ship with `query.conf` or `schema.sql` files. For those which don't,
-	# please create them and contribute them back to the project.
+	#  Not all drivers ship with `query.conf` or `schema.sql` files. For those which don't,
+	#  please create them and contribute them back to the project.
 	#
 	$INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf
 }
diff --git a/raddb/mods-available/sqlcounter b/raddb/mods-available/sqlcounter
index af5bfecba8f..456f8e2e174 100644
--- a/raddb/mods-available/sqlcounter
+++ b/raddb/mods-available/sqlcounter
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
diff --git a/raddb/mods-available/sqlippool b/raddb/mods-available/sqlippool
index 918e3521f3c..a8a7ed2d849 100644
--- a/raddb/mods-available/sqlippool
+++ b/raddb/mods-available/sqlippool
@@ -1,6 +1,6 @@
-# -*- text -*-
+#  -*- text -*-
 #
-# :toc:
+#  :toc:
 #
 #  $Id$
 
@@ -57,7 +57,7 @@ sqlippool {
 	#
 	#  * Using `NAS-Port` gives behaviour similar to `rlm_ippool` and ACS. (default).
 	#  * Using `Calling-Station-Id` works for NAS that send fixed `NAS-Port`.
-	#  
+	#
 	#  WARNING: ONLY change this if you know what you are doing!
 	#
 	pool_key = "%{NAS-Port}"
diff --git a/raddb/mods-available/sradutmp b/raddb/mods-available/sradutmp
index 72e482b82a3..e54b106e1d7 100644
--- a/raddb/mods-available/sradutmp
+++ b/raddb/mods-available/sradutmp
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
@@ -8,15 +8,15 @@
 #
 #  = sRadutmp Module
 #
-# The `sradutmp` module is a _Safe Radutmp_.
+#  The `sradutmp` module is a _Safe Radutmp_.
 #
-# It does not contain caller ID, so it can be world-readable, and `radwho`
-# can work for normal users, without exposing any information that isn't
-# already exposed by who(1).
+#  It does not contain caller ID, so it can be world-readable, and `radwho`
+#  can work for normal users, without exposing any information that isn't
+#  already exposed by who(1).
 #
-# This is another _instance_ of the `radutmp` module, but it is given
-# then name `sradutmp` to identify it later in the `accounting`
-# section.
+#  This is another _instance_ of the `radutmp` module, but it is given
+#  then name `sradutmp` to identify it later in the `accounting`
+#  section.
 #
 
 #
diff --git a/raddb/mods-available/stats b/raddb/mods-available/stats
index 3453b942c05..b316c3aac1d 100644
--- a/raddb/mods-available/stats
+++ b/raddb/mods-available/stats
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
@@ -16,7 +16,7 @@
 #  input / output packets.
 #
 #  When listed in a `recv Status-Server` section, it will add global
-#  server statistics to the packet. 
+#  server statistics to the packet.
 #
 #  See `dictionary.freeradius`, and the `FreeRADIUS-Stats4` attributes,
 #  for a list of which attributes it adds.
diff --git a/raddb/mods-available/unbound b/raddb/mods-available/unbound
index 63508dd8878..27cb88777ca 100644
--- a/raddb/mods-available/unbound
+++ b/raddb/mods-available/unbound
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
@@ -16,6 +16,6 @@
 #  ## Default instance
 #
 unbound dns {
-	# filename = "${raddbdir}/mods-config/unbound/default.conf"
-	# timeout = 3000
+	#  filename = "${raddbdir}/mods-config/unbound/default.conf"
+	#  timeout = 3000
 }
diff --git a/raddb/mods-available/unix b/raddb/mods-available/unix
index a83a8f97d57..071026cdc4f 100644
--- a/raddb/mods-available/unix
+++ b/raddb/mods-available/unix
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
diff --git a/raddb/mods-available/unpack b/raddb/mods-available/unpack
index 631cf3f6344..9af0370804f 100644
--- a/raddb/mods-available/unpack
+++ b/raddb/mods-available/unpack
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
diff --git a/raddb/mods-available/utf8 b/raddb/mods-available/utf8
index 1e2a688e568..882d907408a 100644
--- a/raddb/mods-available/utf8
+++ b/raddb/mods-available/utf8
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
diff --git a/raddb/mods-available/wimax b/raddb/mods-available/wimax
index f4bf8816f9c..aa1355afe3e 100644
--- a/raddb/mods-available/wimax
+++ b/raddb/mods-available/wimax
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
@@ -94,7 +94,7 @@
 #  `FA-HA` = H(HA-RK, "FA-HA" | HA-IPv4 | FA-CoAv4 | SPI)
 #
 #  where `HA-IPv4` is as above.
-#  
+#
 #  and `FA-CoAv4` address of the `FA` as seen by the `HA`
 #  and `SPI` is the relevant `SPI` for the `HA-RK`.
 #
diff --git a/raddb/mods-available/winbind b/raddb/mods-available/winbind
index 3e9ec0f5a70..d0588908309 100644
--- a/raddb/mods-available/winbind
+++ b/raddb/mods-available/winbind
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
@@ -8,15 +8,15 @@
 #
 #  = WinModule
 #
-# The `winbind` module authenticate PAP users against Microsoft Active
-# Directory or Samba, via `winbind`.
+#  The `winbind` module authenticate PAP users against Microsoft Active
+#  Directory or Samba, via `winbind`.
 #
-# This module is for PAP authentication (where plaintext passwords
-# are sent in the `User-Password` attribute) only. For authenticating
-# `mschap` requests against AD/Samba see the options available in the
-# `rlm_mschap` module.
+#  This module is for PAP authentication (where plaintext passwords
+#  are sent in the `User-Password` attribute) only. For authenticating
+#  `mschap` requests against AD/Samba see the options available in the
+#  `rlm_mschap` module.
 #
-# NOTE: Samba version 4.2.1 or higher is required to use this module.
+#  NOTE: Samba version 4.2.1 or higher is required to use this module.
 #
 
 #
@@ -24,61 +24,61 @@
 #
 winbind {
 	#
-	# winbind_username:: The username to pass to `winbind` for authentication.
+	#  winbind_username:: The username to pass to `winbind` for authentication.
 	#
 	winbind_username = "%{%{Stripped-User-Name}:-%{User-Name}}"
 
 	#
-	# winbind_domain:: The windows domain.
+	#  winbind_domain:: The windows domain.
 	#
-	# While not required to be set, it is likely authentication will fail
-	# if it is not set correctly.
+	#  While not required to be set, it is likely authentication will fail
+	#  if it is not set correctly.
 	#
-	# This configuration option, as the username above, is also expanded before use.
+	#  This configuration option, as the username above, is also expanded before use.
 	#
-	# If unset then winbind will be queried for the correct value. If you
-	# actually want it blank it should be explicitly set here.
+	#  If unset then winbind will be queried for the correct value. If you
+	#  actually want it blank it should be explicitly set here.
 	#
 #	winbind_domain = ""
 
 	#
-	# group { ... }:: Group membership checking.
+	#  group { ... }:: Group membership checking.
 	#
 	group {
 		#
-		# group_search_username:: AD username to search for group searches.
+		#  group_search_username:: AD username to search for group searches.
 		#
-		# This should generally not include a realm, so `Stripped-User-Name`
-		# is likely the best attribute if it exists.
+		#  This should generally not include a realm, so `Stripped-User-Name`
+		#  is likely the best attribute if it exists.
 		#
 		group_search_username = "%{%{Stripped-User-Name}:-%{User-Name}}"
 
 		#
-		# group_add_domain:: Include the domain in group searches.
+		#  group_add_domain:: Include the domain in group searches.
 		#
-		# When this is enabled, winbind_domain is prepended to the
-		# username (as `domain\username`) before searching. This is
-		# generally required.
+		#  When this is enabled, winbind_domain is prepended to the
+		#  username (as `domain\username`) before searching. This is
+		#  generally required.
 		#
 #		group_add_domain = yes
 
 		#
-		# group_attribute:: Attribute to use for group comparisons.
+		#  group_attribute:: Attribute to use for group comparisons.
 		#
-		# This will normally be `Winbind-Group` if this instance is
-		# unnamed, otherwise it will be `name-Winbind-Group`. The
-		# name of this attribute can be overridden here.
+		#  This will normally be `Winbind-Group` if this instance is
+		#  unnamed, otherwise it will be `name-Winbind-Group`. The
+		#  name of this attribute can be overridden here.
 		#
 #		group_attribute = "Winbind-Group"
 	}
 
 	#
-	# pool { ... }::
+	#  pool { ... }::
 	#
-	# Information for the `winbind` connection pool.
+	#  Information for the `winbind` connection pool.
 	#
-	# The configuration items below are the same for all modules which
-	# use the new connection pool.
+	#  The configuration items below are the same for all modules which
+	#  use the new connection pool.
 	#
 	pool {
 		#
@@ -163,7 +163,7 @@ winbind {
 		#
 		#  [NOTE]
 		#  ====
-		#  All configuration settings are enforced.  If a connection is closed because of 
+		#  All configuration settings are enforced.  If a connection is closed because of
 		#  `idle_timeout`, `uses`, or `lifetime`, then the total
 		#  number of connections MAY fall below `min`.
 		#
diff --git a/raddb/mods-available/yubikey b/raddb/mods-available/yubikey
index 1475eb0ac27..93a576eeb2e 100644
--- a/raddb/mods-available/yubikey
+++ b/raddb/mods-available/yubikey
@@ -1,4 +1,4 @@
-# -*- text -*-
+#  -*- text -*-
 #
 #  :toc:
 #
@@ -55,7 +55,7 @@ yubikey {
 	#  Each account will need a password added (either using attribute `Cleartext-Password`,
 	#  `SSHA-Password`, etc.).
 	#
-	#  The module itself does not provide persistent storage as this would be duplicative of 
+	#  The module itself does not provide persistent storage as this would be duplicative of
 	#  functionality already in the server.
 	#
 	#  Yubikey authentication needs two attributes retrieved from persistent storage:
@@ -64,14 +64,14 @@ yubikey {
 	#  |===
 	#  | Attributes                 | Description
 	#  | `&control:Yubikey-Key`     | The AES key used to decrypt the OTP data.
-	#                                 The `Yubikey-Public-Id` and/or User-Name 
+	#                                 The `Yubikey-Public-Id` and/or User-Name
 	#                                 attributes may be used to retrieve the key.
 	#                                 The value is a `16-byte` binary blob.
 	#  | `&control:Yubikey-Counter` | This is compared with the counter in the OTP
 	#                                 data and used to prevent replay attacks.
 	#                                 This attribute will also be available in
 	#                                 the request list after successful decryption.
-	# |===
+	#  |===
 	#
 	#  NOTE: `Yubikey-Counter` isn't strictly required, but the server will generate
 	#  warnings if it's not present when `yubikey.authenticate` is called.
@@ -230,20 +230,20 @@ yubikey {
 			idle_timeout = 60
 
 			#
-			# spread:: Enable LRU (Least Recently Used).
+			#  spread:: Enable LRU (Least Recently Used).
 			#
-			# The `yubico` library uses `curl` multihandles. If the multihandle is reused
-			# before all requests are completed the connections are re-established.
+			#  The `yubico` library uses `curl` multihandles. If the multihandle is reused
+			#  before all requests are completed the connections are re-established.
 			#
-			# The cost of re-establishing the connections is greater than the benefit of
-			# maintaining a small pool of connections or optimising for link latency.
+			#  The cost of re-establishing the connections is greater than the benefit of
+			#  maintaining a small pool of connections or optimising for link latency.
 			#
 			spread = yes
 
 			#
 			#  [NOTE]
 			#  ====
-			#  All configuration settings are enforced.  If a connection is closed because of 
+			#  All configuration settings are enforced.  If a connection is closed because of
 			#  `idle_timeout`, `uses`, or `lifetime`, then the total
 			#  number of connections MAY fall below `min`.
 			#