diff --git a/rustfmt.toml b/rustfmt.toml
index c1578aa..3a3f3f1 100644
--- a/rustfmt.toml
+++ b/rustfmt.toml
@@ -1 +1,2 @@
 imports_granularity = "Module"
+group_imports = "StdExternalCrate"
diff --git a/warpgate-admin/src/api/known_hosts_detail.rs b/warpgate-admin/src/api/known_hosts_detail.rs
index 9ca5515..05a06cc 100644
--- a/warpgate-admin/src/api/known_hosts_detail.rs
+++ b/warpgate-admin/src/api/known_hosts_detail.rs
@@ -1,8 +1,9 @@
+use std::sync::Arc;
+
 use poem::web::Data;
 use poem_openapi::param::Path;
 use poem_openapi::{ApiResponse, OpenApi};
 use sea_orm::{DatabaseConnection, EntityTrait, ModelTrait};
-use std::sync::Arc;
 use tokio::sync::Mutex;
 use uuid::Uuid;
 pub struct Api;
diff --git a/warpgate-admin/src/api/known_hosts_list.rs b/warpgate-admin/src/api/known_hosts_list.rs
index a4bedc7..b0c1ba1 100644
--- a/warpgate-admin/src/api/known_hosts_list.rs
+++ b/warpgate-admin/src/api/known_hosts_list.rs
@@ -1,8 +1,9 @@
+use std::sync::Arc;
+
 use poem::web::Data;
 use poem_openapi::payload::Json;
 use poem_openapi::{ApiResponse, OpenApi};
 use sea_orm::{DatabaseConnection, EntityTrait};
-use std::sync::Arc;
 use tokio::sync::Mutex;
 use warpgate_db_entities::KnownHost;
 
diff --git a/warpgate-admin/src/api/logs.rs b/warpgate-admin/src/api/logs.rs
index 08998fc..91c176f 100644
--- a/warpgate-admin/src/api/logs.rs
+++ b/warpgate-admin/src/api/logs.rs
@@ -1,9 +1,10 @@
+use std::sync::Arc;
+
 use chrono::{DateTime, Utc};
 use poem::web::Data;
 use poem_openapi::payload::Json;
 use poem_openapi::{ApiResponse, Object, OpenApi};
 use sea_orm::{ColumnTrait, DatabaseConnection, EntityTrait, QueryFilter, QueryOrder, QuerySelect};
-use std::sync::Arc;
 use tokio::sync::Mutex;
 use uuid::Uuid;
 use warpgate_db_entities::LogEntry;
diff --git a/warpgate-admin/src/api/recordings_detail.rs b/warpgate-admin/src/api/recordings_detail.rs
index 7aedd18..22c70e3 100644
--- a/warpgate-admin/src/api/recordings_detail.rs
+++ b/warpgate-admin/src/api/recordings_detail.rs
@@ -1,3 +1,5 @@
+use std::sync::Arc;
+
 use bytes::Bytes;
 use futures::{SinkExt, StreamExt};
 use poem::error::{InternalServerError, NotFoundError};
@@ -9,7 +11,6 @@ use poem_openapi::payload::Json;
 use poem_openapi::{ApiResponse, OpenApi};
 use sea_orm::{DatabaseConnection, EntityTrait};
 use serde_json::json;
-use std::sync::Arc;
 use tokio::fs::File;
 use tokio::io::{AsyncBufReadExt, BufReader};
 use tokio::sync::Mutex;
diff --git a/warpgate-admin/src/api/sessions_detail.rs b/warpgate-admin/src/api/sessions_detail.rs
index f625dcb..e6d765d 100644
--- a/warpgate-admin/src/api/sessions_detail.rs
+++ b/warpgate-admin/src/api/sessions_detail.rs
@@ -1,9 +1,10 @@
+use std::sync::Arc;
+
 use poem::web::Data;
 use poem_openapi::param::Path;
 use poem_openapi::payload::Json;
 use poem_openapi::{ApiResponse, OpenApi};
 use sea_orm::{ColumnTrait, DatabaseConnection, EntityTrait, QueryFilter, QueryOrder};
-use std::sync::Arc;
 use tokio::sync::Mutex;
 use uuid::Uuid;
 use warpgate_common::{SessionSnapshot, State};
diff --git a/warpgate-admin/src/api/sessions_list.rs b/warpgate-admin/src/api/sessions_list.rs
index b23e984..db80fc3 100644
--- a/warpgate-admin/src/api/sessions_list.rs
+++ b/warpgate-admin/src/api/sessions_list.rs
@@ -1,4 +1,5 @@
-use super::pagination::{PaginatedResponse, PaginationParams};
+use std::sync::Arc;
+
 use futures::{SinkExt, StreamExt};
 use poem::session::Session;
 use poem::web::websocket::{Message, WebSocket};
@@ -8,10 +9,11 @@ use poem_openapi::param::Query;
 use poem_openapi::payload::Json;
 use poem_openapi::{ApiResponse, OpenApi};
 use sea_orm::{ColumnTrait, DatabaseConnection, EntityTrait, QueryFilter, QueryOrder};
-use std::sync::Arc;
 use tokio::sync::Mutex;
 use warpgate_common::{SessionSnapshot, State};
 
+use super::pagination::{PaginatedResponse, PaginationParams};
+
 pub struct Api;
 
 #[derive(ApiResponse)]
diff --git a/warpgate-admin/src/api/ssh_keys.rs b/warpgate-admin/src/api/ssh_keys.rs
index 62bd7c3..541d3bf 100644
--- a/warpgate-admin/src/api/ssh_keys.rs
+++ b/warpgate-admin/src/api/ssh_keys.rs
@@ -1,9 +1,10 @@
+use std::sync::Arc;
+
 use poem::web::Data;
 use poem_openapi::payload::Json;
 use poem_openapi::{ApiResponse, Object, OpenApi};
 use russh_keys::PublicKeyBase64;
 use serde::Serialize;
-use std::sync::Arc;
 use tokio::sync::Mutex;
 use warpgate_common::WarpgateConfig;
 
diff --git a/warpgate-admin/src/api/targets_list.rs b/warpgate-admin/src/api/targets_list.rs
index 94ae6bd..b489f1f 100644
--- a/warpgate-admin/src/api/targets_list.rs
+++ b/warpgate-admin/src/api/targets_list.rs
@@ -1,7 +1,8 @@
+use std::sync::Arc;
+
 use poem::web::Data;
 use poem_openapi::payload::Json;
 use poem_openapi::{ApiResponse, OpenApi};
-use std::sync::Arc;
 use tokio::sync::Mutex;
 use warpgate_common::{ConfigProvider, Target};
 
diff --git a/warpgate-admin/src/api/tickets_detail.rs b/warpgate-admin/src/api/tickets_detail.rs
index 4c84079..13d6311 100644
--- a/warpgate-admin/src/api/tickets_detail.rs
+++ b/warpgate-admin/src/api/tickets_detail.rs
@@ -1,8 +1,9 @@
+use std::sync::Arc;
+
 use poem::web::Data;
 use poem_openapi::param::Path;
 use poem_openapi::{ApiResponse, OpenApi};
 use sea_orm::{DatabaseConnection, EntityTrait, ModelTrait};
-use std::sync::Arc;
 use tokio::sync::Mutex;
 use uuid::Uuid;
 
diff --git a/warpgate-admin/src/api/tickets_list.rs b/warpgate-admin/src/api/tickets_list.rs
index f10403a..36c3801 100644
--- a/warpgate-admin/src/api/tickets_list.rs
+++ b/warpgate-admin/src/api/tickets_list.rs
@@ -1,10 +1,11 @@
+use std::sync::Arc;
+
 use anyhow::Context;
 use poem::web::Data;
 use poem_openapi::payload::Json;
 use poem_openapi::{ApiResponse, Object, OpenApi};
 use sea_orm::ActiveValue::Set;
 use sea_orm::{ActiveModelTrait, DatabaseConnection, EntityTrait};
-use std::sync::Arc;
 use tokio::sync::Mutex;
 use uuid::Uuid;
 use warpgate_common::helpers::hash::generate_ticket_secret;
diff --git a/warpgate-admin/src/api/users_list.rs b/warpgate-admin/src/api/users_list.rs
index f206adf..d63dc1b 100644
--- a/warpgate-admin/src/api/users_list.rs
+++ b/warpgate-admin/src/api/users_list.rs
@@ -1,7 +1,8 @@
+use std::sync::Arc;
+
 use poem::web::Data;
 use poem_openapi::payload::Json;
 use poem_openapi::{ApiResponse, OpenApi};
-use std::sync::Arc;
 use tokio::sync::Mutex;
 use warpgate_common::{ConfigProvider, UserSnapshot};
 
diff --git a/warpgate-common/src/auth.rs b/warpgate-common/src/auth.rs
index 228c5ba..d13e188 100644
--- a/warpgate-common/src/auth.rs
+++ b/warpgate-common/src/auth.rs
@@ -1,6 +1,7 @@
+use std::fmt::Debug;
+
 use crate::consts::TICKET_SELECTOR_PREFIX;
 use crate::Secret;
-use std::fmt::Debug;
 
 pub enum AuthSelector {
     User {
diff --git a/warpgate-common/src/config.rs b/warpgate-common/src/config.rs
index 47d36a1..19a15b5 100644
--- a/warpgate-common/src/config.rs
+++ b/warpgate-common/src/config.rs
@@ -1,9 +1,10 @@
-use poem_openapi::{Object, Union};
-use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::path::PathBuf;
 use std::time::Duration;
 
+use poem_openapi::{Object, Union};
+use serde::{Deserialize, Serialize};
+
 use crate::helpers::otp::OtpSecretKey;
 use crate::Secret;
 
diff --git a/warpgate-common/src/config_providers/file.rs b/warpgate-common/src/config_providers/file.rs
index 8215452..a29e9db 100644
--- a/warpgate-common/src/config_providers/file.rs
+++ b/warpgate-common/src/config_providers/file.rs
@@ -1,3 +1,16 @@
+use std::collections::HashSet;
+use std::sync::Arc;
+
+use anyhow::Result;
+use async_trait::async_trait;
+use data_encoding::BASE64_MIME;
+use sea_orm::ActiveValue::Set;
+use sea_orm::{ActiveModelTrait, DatabaseConnection, EntityTrait};
+use tokio::sync::Mutex;
+use tracing::*;
+use uuid::Uuid;
+use warpgate_db_entities::Ticket;
+
 use super::ConfigProvider;
 use crate::helpers::hash::verify_password_hash;
 use crate::helpers::otp::verify_totp;
@@ -5,17 +18,6 @@ use crate::{
     AuthCredential, AuthResult, ProtocolName, Target, User, UserAuthCredential, UserSnapshot,
     WarpgateConfig,
 };
-use anyhow::Result;
-use async_trait::async_trait;
-use data_encoding::BASE64_MIME;
-use sea_orm::ActiveValue::Set;
-use sea_orm::{ActiveModelTrait, DatabaseConnection, EntityTrait};
-use std::collections::HashSet;
-use std::sync::Arc;
-use tokio::sync::Mutex;
-use tracing::*;
-use uuid::Uuid;
-use warpgate_db_entities::Ticket;
 
 pub struct FileConfigProvider {
     db: Arc<Mutex<DatabaseConnection>>,
diff --git a/warpgate-common/src/config_providers/mod.rs b/warpgate-common/src/config_providers/mod.rs
index fa24592..0d078f6 100644
--- a/warpgate-common/src/config_providers/mod.rs
+++ b/warpgate-common/src/config_providers/mod.rs
@@ -1,16 +1,18 @@
 mod file;
-use crate::{ProtocolName, Secret, Target, UserSnapshot};
+use std::sync::Arc;
+
 use anyhow::Result;
 use async_trait::async_trait;
 use bytes::Bytes;
 pub use file::FileConfigProvider;
 use sea_orm::{ColumnTrait, DatabaseConnection, EntityTrait, QueryFilter};
-use std::sync::Arc;
 use tokio::sync::Mutex;
 use tracing::*;
 use uuid::Uuid;
 use warpgate_db_entities::Ticket;
 
+use crate::{ProtocolName, Secret, Target, UserSnapshot};
+
 pub enum AuthResult {
     Accepted { username: String },
     OtpNeeded,
diff --git a/warpgate-common/src/db/mod.rs b/warpgate-common/src/db/mod.rs
index b026b00..59cf416 100644
--- a/warpgate-common/src/db/mod.rs
+++ b/warpgate-common/src/db/mod.rs
@@ -1,14 +1,16 @@
-use crate::helpers::fs::secure_file;
-use crate::WarpgateConfig;
+use std::time::Duration;
+
 use anyhow::Result;
 use sea_orm::sea_query::Expr;
 use sea_orm::{
     ConnectOptions, Database, DatabaseConnection, EntityTrait, QueryFilter, TransactionTrait,
 };
-use std::time::Duration;
 use warpgate_db_entities::LogEntry;
 use warpgate_db_migrations::migrate_database;
 
+use crate::helpers::fs::secure_file;
+use crate::WarpgateConfig;
+
 pub async fn connect_to_db(config: &WarpgateConfig) -> Result<DatabaseConnection> {
     let mut url = url::Url::parse(&config.store.database_url.expose_secret()[..])?;
     if url.scheme() == "sqlite" {
diff --git a/warpgate-common/src/eventhub.rs b/warpgate-common/src/eventhub.rs
index c5f0417..36e323c 100644
--- a/warpgate-common/src/eventhub.rs
+++ b/warpgate-common/src/eventhub.rs
@@ -1,4 +1,5 @@
 use std::sync::Arc;
+
 use tokio::sync::mpsc::error::SendError;
 use tokio::sync::mpsc::{unbounded_channel, UnboundedReceiver, UnboundedSender};
 use tokio::sync::{Mutex, MutexGuard};
diff --git a/warpgate-common/src/helpers/hash.rs b/warpgate-common/src/helpers/hash.rs
index 2ceceea..37bf40d 100644
--- a/warpgate-common/src/helpers/hash.rs
+++ b/warpgate-common/src/helpers/hash.rs
@@ -1,4 +1,3 @@
-use crate::Secret;
 use anyhow::Result;
 use argon2::password_hash::rand_core::OsRng;
 use argon2::password_hash::{PasswordHash, PasswordHasher, PasswordVerifier, SaltString};
@@ -7,6 +6,8 @@ use data_encoding::HEXLOWER;
 use password_hash::errors::Error;
 use rand::Rng;
 
+use crate::Secret;
+
 pub fn hash_password(password: &str) -> String {
     let salt = SaltString::generate(&mut OsRng);
     let argon2 = Argon2::default();
diff --git a/warpgate-common/src/helpers/otp.rs b/warpgate-common/src/helpers/otp.rs
index 9f9ab50..491c3a7 100644
--- a/warpgate-common/src/helpers/otp.rs
+++ b/warpgate-common/src/helpers/otp.rs
@@ -1,11 +1,12 @@
 use std::time::SystemTime;
 
-use super::rng::get_crypto_rng;
-use crate::types::Secret;
 use bytes::Bytes;
 use rand::Rng;
 use totp_rs::{Algorithm, TOTP};
 
+use super::rng::get_crypto_rng;
+use crate::types::Secret;
+
 pub type OtpExposedSecretKey = Bytes;
 pub type OtpSecretKey = Secret<OtpExposedSecretKey>;
 
diff --git a/warpgate-common/src/helpers/serde_base64_secret.rs b/warpgate-common/src/helpers/serde_base64_secret.rs
index cd1b4be..c6c30a3 100644
--- a/warpgate-common/src/helpers/serde_base64_secret.rs
+++ b/warpgate-common/src/helpers/serde_base64_secret.rs
@@ -1,8 +1,9 @@
-use super::serde_base64;
-use crate::Secret;
 use bytes::Bytes;
 use serde::Serializer;
 
+use super::serde_base64;
+use crate::Secret;
+
 pub fn serialize<S: Serializer>(secret: &Secret<Bytes>, serializer: S) -> Result<S::Ok, S::Error> {
     serde_base64::serialize(secret.expose_secret().as_ref(), serializer)
 }
diff --git a/warpgate-common/src/logging/database.rs b/warpgate-common/src/logging/database.rs
index 723dad2..d5cf4bf 100644
--- a/warpgate-common/src/logging/database.rs
+++ b/warpgate-common/src/logging/database.rs
@@ -1,9 +1,8 @@
-use super::layer::ValuesLogLayer;
-use super::values::SerializedRecordValues;
+use std::sync::Arc;
+
 use once_cell::sync::OnceCell;
 use sea_orm::query::JsonValue;
 use sea_orm::{ActiveModelTrait, DatabaseConnection};
-use std::sync::Arc;
 use tokio::sync::Mutex;
 use tracing::*;
 use tracing_subscriber::registry::LookupSpan;
@@ -11,6 +10,9 @@ use tracing_subscriber::Layer;
 use uuid::Uuid;
 use warpgate_db_entities::LogEntry;
 
+use super::layer::ValuesLogLayer;
+use super::values::SerializedRecordValues;
+
 static LOG_SENDER: OnceCell<tokio::sync::broadcast::Sender<LogEntry::ActiveModel>> =
     OnceCell::new();
 
diff --git a/warpgate-common/src/logging/socket.rs b/warpgate-common/src/logging/socket.rs
index 58cb6b4..0e1b2a8 100644
--- a/warpgate-common/src/logging/socket.rs
+++ b/warpgate-common/src/logging/socket.rs
@@ -1,5 +1,3 @@
-use super::layer::ValuesLogLayer;
-use crate::WarpgateConfig;
 use bytes::BytesMut;
 use chrono::Local;
 use tokio::net::UnixDatagram;
@@ -7,6 +5,9 @@ use tracing::*;
 use tracing_subscriber::registry::LookupSpan;
 use tracing_subscriber::Layer;
 
+use super::layer::ValuesLogLayer;
+use crate::WarpgateConfig;
+
 static SKIP_KEY: &str = "is_socket_logging_error";
 
 pub async fn make_socket_logger_layer<S>(config: &WarpgateConfig) -> impl Layer<S>
diff --git a/warpgate-common/src/logging/values.rs b/warpgate-common/src/logging/values.rs
index 3b4762b..7708069 100644
--- a/warpgate-common/src/logging/values.rs
+++ b/warpgate-common/src/logging/values.rs
@@ -1,7 +1,8 @@
-use serde::Serialize;
 use std::collections::HashMap;
 use std::fmt::Debug;
 use std::ops::DerefMut;
+
+use serde::Serialize;
 use tracing::field::Visit;
 use tracing_core::Field;
 
diff --git a/warpgate-common/src/protocols/handle.rs b/warpgate-common/src/protocols/handle.rs
index 9a9a9b1..955a2b6 100644
--- a/warpgate-common/src/protocols/handle.rs
+++ b/warpgate-common/src/protocols/handle.rs
@@ -1,10 +1,12 @@
-use crate::{SessionId, SessionState, State, Target};
+use std::sync::Arc;
+
 use anyhow::{Context, Result};
 use sea_orm::{ColumnTrait, DatabaseConnection, EntityTrait, QueryFilter};
-use std::sync::Arc;
 use tokio::sync::Mutex;
 use warpgate_db_entities::Session;
 
+use crate::{SessionId, SessionState, State, Target};
+
 pub trait SessionHandle {
     fn close(&mut self);
 }
diff --git a/warpgate-common/src/protocols/mod.rs b/warpgate-common/src/protocols/mod.rs
index d204cad..cea12ef 100644
--- a/warpgate-common/src/protocols/mod.rs
+++ b/warpgate-common/src/protocols/mod.rs
@@ -1,9 +1,11 @@
 mod handle;
-use crate::Target;
+use std::net::SocketAddr;
+
 use anyhow::Result;
 use async_trait::async_trait;
 pub use handle::{SessionHandle, WarpgateServerHandle};
-use std::net::SocketAddr;
+
+use crate::Target;
 
 #[derive(Debug, thiserror::Error)]
 pub enum TargetTestError {
diff --git a/warpgate-common/src/recordings/mod.rs b/warpgate-common/src/recordings/mod.rs
index 9ba6382..27fe007 100644
--- a/warpgate-common/src/recordings/mod.rs
+++ b/warpgate-common/src/recordings/mod.rs
@@ -1,8 +1,9 @@
-use bytes::Bytes;
-use sea_orm::{ActiveModelTrait, DatabaseConnection};
 use std::collections::HashMap;
 use std::path::PathBuf;
 use std::sync::Arc;
+
+use bytes::Bytes;
+use sea_orm::{ActiveModelTrait, DatabaseConnection};
 use tokio::sync::{broadcast, Mutex};
 use tracing::*;
 use uuid::Uuid;
diff --git a/warpgate-common/src/recordings/writer.rs b/warpgate-common/src/recordings/writer.rs
index f355339..0b5f209 100644
--- a/warpgate-common/src/recordings/writer.rs
+++ b/warpgate-common/src/recordings/writer.rs
@@ -1,13 +1,10 @@
-use crate::helpers::fs::secure_file;
-use crate::try_block;
-
-use super::{Error, Result};
-use bytes::{Bytes, BytesMut};
-use sea_orm::{ActiveModelTrait, DatabaseConnection, EntityTrait};
 use std::collections::HashMap;
 use std::path::PathBuf;
 use std::sync::Arc;
 use std::time::{Duration, Instant};
+
+use bytes::{Bytes, BytesMut};
+use sea_orm::{ActiveModelTrait, DatabaseConnection, EntityTrait};
 use tokio::fs::File;
 use tokio::io::{AsyncWriteExt, BufWriter};
 use tokio::sync::{broadcast, mpsc, Mutex};
@@ -15,6 +12,10 @@ use tracing::*;
 use uuid::Uuid;
 use warpgate_db_entities::Recording;
 
+use super::{Error, Result};
+use crate::helpers::fs::secure_file;
+use crate::try_block;
+
 #[derive(Clone)]
 pub struct RecordingWriter {
     sender: mpsc::Sender<Bytes>,
diff --git a/warpgate-common/src/state.rs b/warpgate-common/src/state.rs
index 8435a2e..da607b0 100644
--- a/warpgate-common/src/state.rs
+++ b/warpgate-common/src/state.rs
@@ -1,14 +1,16 @@
-use crate::{ProtocolName, SessionHandle, SessionId, Target, WarpgateServerHandle};
-use anyhow::{Context, Result};
-use sea_orm::{ActiveModelTrait, DatabaseConnection, EntityTrait};
 use std::collections::HashMap;
 use std::net::SocketAddr;
 use std::sync::{Arc, Weak};
+
+use anyhow::{Context, Result};
+use sea_orm::{ActiveModelTrait, DatabaseConnection, EntityTrait};
 use tokio::sync::{broadcast, Mutex};
 use tracing::*;
 use uuid::Uuid;
 use warpgate_db_entities::Session;
 
+use crate::{ProtocolName, SessionHandle, SessionId, Target, WarpgateServerHandle};
+
 pub struct State {
     pub sessions: HashMap<SessionId, Arc<Mutex<SessionState>>>,
     db: Arc<Mutex<DatabaseConnection>>,
diff --git a/warpgate-common/src/types.rs b/warpgate-common/src/types.rs
index 7910b63..11f6463 100644
--- a/warpgate-common/src/types.rs
+++ b/warpgate-common/src/types.rs
@@ -1,8 +1,9 @@
+use std::fmt::Debug;
+
 use bytes::Bytes;
 use data_encoding::HEXLOWER;
 use rand::Rng;
 use serde::{Deserialize, Serialize};
-use std::fmt::Debug;
 use uuid::Uuid;
 
 use crate::helpers::rng::get_crypto_rng;
diff --git a/warpgate-db-migrations/src/m00002_create_session.rs b/warpgate-db-migrations/src/m00002_create_session.rs
index b36a9c3..3c3ed8a 100644
--- a/warpgate-db-migrations/src/m00002_create_session.rs
+++ b/warpgate-db-migrations/src/m00002_create_session.rs
@@ -2,10 +2,11 @@ use sea_orm::Schema;
 use sea_orm_migration::prelude::*;
 
 pub mod session {
-    use crate::m00001_create_ticket::ticket;
     use sea_orm::entity::prelude::*;
     use uuid::Uuid;
 
+    use crate::m00001_create_ticket::ticket;
+
     #[derive(Clone, Debug, PartialEq, Eq, DeriveEntityModel)]
     #[sea_orm(table_name = "sessions")]
     pub struct Model {
diff --git a/warpgate-db-migrations/src/m00003_create_recording.rs b/warpgate-db-migrations/src/m00003_create_recording.rs
index c3f8eef..e3b11e1 100644
--- a/warpgate-db-migrations/src/m00003_create_recording.rs
+++ b/warpgate-db-migrations/src/m00003_create_recording.rs
@@ -2,10 +2,11 @@ use sea_orm::Schema;
 use sea_orm_migration::prelude::*;
 
 pub mod recording {
-    use crate::m00002_create_session::session;
     use sea_orm::entity::prelude::*;
     use uuid::Uuid;
 
+    use crate::m00002_create_session::session;
+
     #[derive(Debug, Clone, PartialEq, Eq, EnumIter, DeriveActiveEnum)]
     #[sea_orm(rs_type = "String", db_type = "String(Some(16))")]
     pub enum RecordingKind {
diff --git a/warpgate-protocol-ssh/src/client/handler.rs b/warpgate-protocol-ssh/src/client/handler.rs
index 1a55f81..a211b89 100644
--- a/warpgate-protocol-ssh/src/client/handler.rs
+++ b/warpgate-protocol-ssh/src/client/handler.rs
@@ -1,15 +1,17 @@
-use crate::known_hosts::{KnownHostValidationResult, KnownHosts};
-use crate::ConnectionError;
+use std::pin::Pin;
+
 use futures::FutureExt;
 use russh::client::Session;
 use russh_keys::key::PublicKey;
 use russh_keys::PublicKeyBase64;
-use std::pin::Pin;
 use tokio::sync::mpsc::UnboundedSender;
 use tokio::sync::oneshot;
 use tracing::*;
 use warpgate_common::{Services, SessionId, TargetSSHOptions};
 
+use crate::known_hosts::{KnownHostValidationResult, KnownHosts};
+use crate::ConnectionError;
+
 #[derive(Debug)]
 pub enum ClientHandlerEvent {
     HostKeyReceived(PublicKey),
diff --git a/warpgate-protocol-ssh/src/client/mod.rs b/warpgate-protocol-ssh/src/client/mod.rs
index 13261a9..7fc48ae 100644
--- a/warpgate-protocol-ssh/src/client/mod.rs
+++ b/warpgate-protocol-ssh/src/client/mod.rs
@@ -1,11 +1,10 @@
 mod channel_direct_tcpip;
 mod channel_session;
 mod handler;
-use self::handler::ClientHandlerEvent;
-use super::{ChannelOperation, DirectTCPIPParams};
-use crate::client::handler::ClientHandlerError;
-use crate::helpers::PublicKeyAsOpenSSH;
-use crate::keys::load_client_keys;
+use std::collections::HashMap;
+use std::net::ToSocketAddrs;
+use std::sync::Arc;
+
 use anyhow::{Context, Result};
 use bytes::Bytes;
 use channel_direct_tcpip::DirectTCPIPChannel;
@@ -15,9 +14,6 @@ use handler::ClientHandler;
 use russh::client::Handle;
 use russh::{Preferred, Sig};
 use russh_keys::key::{self, PublicKey};
-use std::collections::HashMap;
-use std::net::ToSocketAddrs;
-use std::sync::Arc;
 use tokio::sync::mpsc::error::SendError;
 use tokio::sync::mpsc::{unbounded_channel, UnboundedReceiver, UnboundedSender};
 use tokio::sync::{oneshot, Mutex};
@@ -26,6 +22,12 @@ use tracing::*;
 use uuid::Uuid;
 use warpgate_common::{SSHTargetAuth, Services, SessionId, TargetSSHOptions};
 
+use self::handler::ClientHandlerEvent;
+use super::{ChannelOperation, DirectTCPIPParams};
+use crate::client::handler::ClientHandlerError;
+use crate::helpers::PublicKeyAsOpenSSH;
+use crate::keys::load_client_keys;
+
 #[derive(Debug, thiserror::Error)]
 pub enum ConnectionError {
     #[error("Host key mismatch")]
diff --git a/warpgate-protocol-ssh/src/keys.rs b/warpgate-protocol-ssh/src/keys.rs
index 811cf37..5e1ddfc 100644
--- a/warpgate-protocol-ssh/src/keys.rs
+++ b/warpgate-protocol-ssh/src/keys.rs
@@ -1,8 +1,9 @@
+use std::fs::{create_dir_all, File};
+use std::path::PathBuf;
+
 use anyhow::Result;
 use russh_keys::key::{KeyPair, SignatureHash};
 use russh_keys::{encode_pkcs8_pem, load_secret_key};
-use std::fs::{create_dir_all, File};
-use std::path::PathBuf;
 use tracing::*;
 use warpgate_common::helpers::fs::secure_directory;
 use warpgate_common::WarpgateConfig;
diff --git a/warpgate-protocol-ssh/src/lib.rs b/warpgate-protocol-ssh/src/lib.rs
index bae2a86..eaf563e 100644
--- a/warpgate-protocol-ssh/src/lib.rs
+++ b/warpgate-protocol-ssh/src/lib.rs
@@ -6,7 +6,9 @@ pub mod helpers;
 mod keys;
 mod known_hosts;
 mod server;
-use crate::client::{RCCommand, RemoteClient};
+use std::fmt::Debug;
+use std::net::SocketAddr;
+
 use anyhow::Result;
 use async_trait::async_trait;
 pub use client::*;
@@ -14,13 +16,13 @@ pub use common::*;
 pub use keys::*;
 use russh_keys::PublicKeyBase64;
 pub use server::run_server;
-use std::fmt::Debug;
-use std::net::SocketAddr;
 use uuid::Uuid;
 use warpgate_common::{
     ProtocolName, ProtocolServer, Services, Target, TargetOptions, TargetTestError,
 };
 
+use crate::client::{RCCommand, RemoteClient};
+
 pub static PROTOCOL_NAME: ProtocolName = "SSH";
 
 #[derive(Clone)]
diff --git a/warpgate-protocol-ssh/src/server/mod.rs b/warpgate-protocol-ssh/src/server/mod.rs
index e1c7e35..ac6699b 100644
--- a/warpgate-protocol-ssh/src/server/mod.rs
+++ b/warpgate-protocol-ssh/src/server/mod.rs
@@ -2,20 +2,22 @@ mod russh_handler;
 mod service_output;
 mod session;
 mod session_handle;
-use crate::keys::load_host_keys;
-use crate::server::session_handle::SSHSessionHandle;
+use std::fmt::Debug;
+use std::net::SocketAddr;
+use std::sync::Arc;
+
 use anyhow::Result;
 use russh::MethodSet;
 pub use russh_handler::ServerHandler;
 pub use session::ServerSession;
-use std::fmt::Debug;
-use std::net::SocketAddr;
-use std::sync::Arc;
 use tokio::io::{AsyncRead, AsyncWrite};
 use tokio::net::TcpListener;
 use tracing::*;
 use warpgate_common::{Services, SessionStateInit};
 
+use crate::keys::load_host_keys;
+use crate::server::session_handle::SSHSessionHandle;
+
 pub async fn run_server(services: Services, address: SocketAddr) -> Result<()> {
     let russh_config = {
         let config = services.config.lock().await;
diff --git a/warpgate-protocol-ssh/src/server/service_output.rs b/warpgate-protocol-ssh/src/server/service_output.rs
index d8aa118..3dc2f9e 100644
--- a/warpgate-protocol-ssh/src/server/service_output.rs
+++ b/warpgate-protocol-ssh/src/server/service_output.rs
@@ -1,7 +1,8 @@
-use ansi_term::Colour;
-use anyhow::Result;
 use std::sync::atomic::AtomicBool;
 use std::sync::Arc;
+
+use ansi_term::Colour;
+use anyhow::Result;
 use tokio::sync::{mpsc, Mutex};
 
 pub const ERASE_PROGRESS_SPINNER: &str = "\r                        \r";
diff --git a/warpgate-protocol-ssh/src/server/session.rs b/warpgate-protocol-ssh/src/server/session.rs
index ee5d12e..6aff545 100644
--- a/warpgate-protocol-ssh/src/server/session.rs
+++ b/warpgate-protocol-ssh/src/server/session.rs
@@ -1,11 +1,10 @@
-use super::service_output::ServiceOutput;
-use super::session_handle::SessionHandleCommand;
-use crate::compat::ContextExt;
-use crate::server::service_output::ERASE_PROGRESS_SPINNER;
-use crate::{
-    ChannelOperation, ConnectionError, DirectTCPIPParams, PtyRequest, RCCommand, RCEvent, RCState,
-    RemoteClient, ServerChannelId, X11Request,
-};
+use std::borrow::Cow;
+use std::collections::hash_map::Entry::Vacant;
+use std::collections::HashMap;
+use std::net::{Ipv4Addr, SocketAddr};
+use std::str::FromStr;
+use std::sync::Arc;
+
 use ansi_term::Colour;
 use anyhow::{Context, Result};
 use bimap::BiMap;
@@ -14,12 +13,6 @@ use russh::server::Session;
 use russh::{CryptoVec, Sig};
 use russh_keys::key::PublicKey;
 use russh_keys::PublicKeyBase64;
-use std::borrow::Cow;
-use std::collections::hash_map::Entry::Vacant;
-use std::collections::HashMap;
-use std::net::{Ipv4Addr, SocketAddr};
-use std::str::FromStr;
-use std::sync::Arc;
 use tokio::sync::mpsc::{UnboundedReceiver, UnboundedSender};
 use tokio::sync::{oneshot, Mutex};
 use tracing::*;
@@ -35,6 +28,15 @@ use warpgate_common::{
     TargetOptions, TargetSSHOptions, WarpgateServerHandle,
 };
 
+use super::service_output::ServiceOutput;
+use super::session_handle::SessionHandleCommand;
+use crate::compat::ContextExt;
+use crate::server::service_output::ERASE_PROGRESS_SPINNER;
+use crate::{
+    ChannelOperation, ConnectionError, DirectTCPIPParams, PtyRequest, RCCommand, RCEvent, RCState,
+    RemoteClient, ServerChannelId, X11Request,
+};
+
 #[derive(Clone)]
 enum TargetSelection {
     None,
diff --git a/warpgate/src/commands/check.rs b/warpgate/src/commands/check.rs
index 7ad3309..ee13984 100644
--- a/warpgate/src/commands/check.rs
+++ b/warpgate/src/commands/check.rs
@@ -1,8 +1,10 @@
-use crate::config::load_config;
-use anyhow::{Context, Result};
 use std::net::ToSocketAddrs;
+
+use anyhow::{Context, Result};
 use tracing::*;
 
+use crate::config::load_config;
+
 pub(crate) async fn command(cli: &crate::Cli) -> Result<()> {
     let config = load_config(&cli.config, true)?;
     config
diff --git a/warpgate/src/commands/client_keys.rs b/warpgate/src/commands/client_keys.rs
index 6408291..c511b74 100644
--- a/warpgate/src/commands/client_keys.rs
+++ b/warpgate/src/commands/client_keys.rs
@@ -1,7 +1,8 @@
-use crate::config::load_config;
 use anyhow::Result;
 use warpgate_protocol_ssh::helpers::PublicKeyAsOpenSSH;
 
+use crate::config::load_config;
+
 pub(crate) async fn command(cli: &crate::Cli) -> Result<()> {
     let config = load_config(&cli.config, true)?;
     let keys = warpgate_protocol_ssh::load_client_keys(&config)?;
diff --git a/warpgate/src/commands/hash.rs b/warpgate/src/commands/hash.rs
index 7a982b8..31e34ba 100644
--- a/warpgate/src/commands/hash.rs
+++ b/warpgate/src/commands/hash.rs
@@ -1,6 +1,7 @@
+use std::io::stdin;
+
 use anyhow::Result;
 use dialoguer::theme::ColorfulTheme;
-use std::io::stdin;
 use warpgate_common::helpers::hash::hash_password;
 
 pub(crate) async fn command() -> Result<()> {
diff --git a/warpgate/src/commands/run.rs b/warpgate/src/commands/run.rs
index 3cc2137..f531882 100644
--- a/warpgate/src/commands/run.rs
+++ b/warpgate/src/commands/run.rs
@@ -1,7 +1,9 @@
-use crate::config::{load_config, watch_config};
+use std::net::ToSocketAddrs;
+
 use anyhow::Result;
 use futures::StreamExt;
-use std::net::ToSocketAddrs;
+#[cfg(target_os = "linux")]
+use sd_notify::NotifyState;
 use tracing::*;
 use warpgate_common::db::cleanup_db;
 use warpgate_common::logging::install_database_logger;
@@ -9,8 +11,7 @@ use warpgate_common::{ProtocolServer, Services};
 use warpgate_protocol_http::HTTPProtocolServer;
 use warpgate_protocol_ssh::SSHProtocolServer;
 
-#[cfg(target_os = "linux")]
-use sd_notify::NotifyState;
+use crate::config::{load_config, watch_config};
 
 pub(crate) async fn command(cli: &crate::Cli) -> Result<()> {
     let version = env!("CARGO_PKG_VERSION");
diff --git a/warpgate/src/commands/setup.rs b/warpgate/src/commands/setup.rs
index 8d09553..6953f31 100644
--- a/warpgate/src/commands/setup.rs
+++ b/warpgate/src/commands/setup.rs
@@ -1,10 +1,10 @@
-use crate::config::load_config;
-use anyhow::Result;
-use dialoguer::theme::ColorfulTheme;
-use rcgen::generate_simple_self_signed;
 use std::fs::{create_dir_all, File};
 use std::io::Write;
 use std::path::{Path, PathBuf};
+
+use anyhow::Result;
+use dialoguer::theme::ColorfulTheme;
+use rcgen::generate_simple_self_signed;
 use tracing::*;
 use warpgate_common::helpers::fs::{secure_directory, secure_file};
 use warpgate_common::helpers::hash::hash_password;
@@ -13,6 +13,8 @@ use warpgate_common::{
     User, UserAuthCredential, WarpgateConfigStore,
 };
 
+use crate::config::load_config;
+
 pub(crate) async fn command(cli: &crate::Cli) -> Result<()> {
     let version = env!("CARGO_PKG_VERSION");
     info!("Welcome to Warpgate {version}");
diff --git a/warpgate/src/commands/test_target.rs b/warpgate/src/commands/test_target.rs
index 029c3db..e92c8e4 100644
--- a/warpgate/src/commands/test_target.rs
+++ b/warpgate/src/commands/test_target.rs
@@ -1,8 +1,9 @@
-use crate::config::load_config;
 use anyhow::Result;
 use tracing::*;
 use warpgate_common::{ProtocolServer, Services, Target, TargetTestError};
 
+use crate::config::load_config;
+
 pub(crate) async fn command(cli: &crate::Cli, target_name: &String) -> Result<()> {
     let config = load_config(&cli.config, true)?;
 
diff --git a/warpgate/src/config.rs b/warpgate/src/config.rs
index ed2fd84..c5e2965 100644
--- a/warpgate/src/config.rs
+++ b/warpgate/src/config.rs
@@ -1,8 +1,9 @@
+use std::path::Path;
+use std::sync::Arc;
+
 use anyhow::{Context, Result};
 use config::{Config, Environment, File};
 use notify::{RecommendedWatcher, RecursiveMode, Watcher};
-use std::path::Path;
-use std::sync::Arc;
 use tokio::sync::{mpsc, Mutex};
 use tracing::*;
 use warpgate_common::helpers::fs::secure_file;
diff --git a/warpgate/src/logging.rs b/warpgate/src/logging.rs
index b319cd6..6255b23 100644
--- a/warpgate/src/logging.rs
+++ b/warpgate/src/logging.rs
@@ -1,4 +1,5 @@
 use std::sync::Arc;
+
 use time::{format_description, UtcOffset};
 use tracing_subscriber::filter::dynamic_filter_fn;
 use tracing_subscriber::fmt::time::OffsetTime;
diff --git a/warpgate/src/main.rs b/warpgate/src/main.rs
index 72062fc..6116a7b 100644
--- a/warpgate/src/main.rs
+++ b/warpgate/src/main.rs
@@ -2,13 +2,15 @@
 mod commands;
 mod config;
 mod logging;
-use crate::config::load_config;
+use std::path::PathBuf;
+
 use anyhow::Result;
 use clap::{ArgAction, StructOpt};
 use logging::init_logging;
-use std::path::PathBuf;
 use tracing::*;
 
+use crate::config::load_config;
+
 #[cfg(feature = "dhat-heap")]
 #[global_allocator]
 static ALLOC: dhat::Alloc = dhat::Alloc;