bekkalokk/website/fetch-gallery: use proper shellscript builder

hosts/bekkalokk/services/website/fetch-gallery.nix

@@ -37,9 +37,22 @@ in {
   };
 
   systemd.services.pvv-nettsiden-gallery-update = {
-    path = with pkgs; [ imagemagick gnutar gzip ];
+    serviceConfig = {
+      WorkingDirectory = galleryDir;
+      User = config.services.pvv-nettsiden.user;
+      Group = config.services.pvv-nettsiden.group;
 
-    script = ''
+      ExecStart = lib.getExe (pkgs.writeShellApplication {
+        name = "pvv-nettsiden-gallery-update-exec-start.sh";
+        runtimeInputs = with pkgs; [
+          coreutils
+          findutils
+          gnused
+          gnutar
+          gzip
+          imagemagick
+        ];
+        text = ''
           tar ${lib.cli.toCommandLineShellGNU { } {
             extract = true;
             file = "${transferDir}/gallery.tar.gz";
@@ -47,7 +60,7 @@ in {
           }}
 
           # Delete files and directories that exists in the gallery that don't exist in the tarball
-      filesToRemove=$(uniq -u <(sort <(find . -not -path './.thumbnails*') <(tar -tf '${transferDir}/gallery.tar.gz' | sed 's|/$||')))
+          filesToRemove="$(uniq -u <(sort <(find . -not -path './.thumbnails*') <(tar -tf '${transferDir}/gallery.tar.gz' | sed 's|/$||')))"
           while IFS= read -r fname; do
             rm -f "$fname" ||:
             rm -f ".thumbnails/$fname.png" ||:
@@ -56,7 +69,7 @@ in {
           find . -type d -empty -delete
 
           mkdir -p .thumbnails
-      images=$(find . -type f -not -path './.thumbnails*')
+          images="$(find . -type f -not -path './.thumbnails*')"
 
           while IFS= read -r fname; do
             # Skip this file if an up-to-date thumbnail already exists
@@ -72,11 +85,7 @@ in {
             touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
           done <<< "$images"
         '';
-
+      });
-    serviceConfig = {
-      WorkingDirectory = galleryDir;
-      User = config.services.pvv-nettsiden.user;
-      Group = config.services.pvv-nettsiden.group;
 
       AmbientCapabilities = [ "" ];
       CapabilityBoundingSet = [ "" ];