grr: fix the heccin quotes

... of the day
2026-05-28 17:21:12 +02:00 · 2026-05-26 22:26:39 +09:00
22 changed files with 188 additions and 388 deletions
--- a/base/default.nix
+++ b/base/default.nix
@@ -1,7 +1,6 @@
 {
  pkgs,
  lib,
-  inputs,
  fp,
  ...
 }:
@@ -36,7 +35,6 @@
    ./services/prometheus-node-exporter.nix
    ./services/prometheus-systemd-exporter.nix
    ./services/roowho2.nix
-    ./services/scrutiny-collector.nix
    ./services/smartd.nix
    ./services/thermald.nix
    ./services/uptimed.nix
@@ -44,8 +42,6 @@
    ./services/userdbd.nix
  ];

-  system.nixos.tags = lib.optionals (inputs.self.sourceInfo ? dirtyRev) [ "dirty" ];
-
  boot.tmp.cleanOnBoot = lib.mkDefault true;
  boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;

--- a/base/services/polkit.nix
+++ b/base/services/polkit.nix
@@ -6,12 +6,9 @@ in
  security.polkit.enable = true;

  environment.etc."polkit-1/rules.d/9-nixos-overrides.rules".text = lib.mkIf cfg.enable ''
-    polkit.addRule(function(action, subject) {
-       if (
-           action.id.startsWith("org.freedesktop.systemd1.") &&
-           subject.isInGroup("wheel")
-       ) {
-           return polkit.Result.AUTH_SELF_KEEP;
+    polkit.addAdminRule(function(action, subject) {
+        if(subject.isInGroup("wheel")) {
+            return ["unix-user:"+subject.user];
        }
    });
  '';
--- a/base/services/scrutiny-collector.nix
+++ b/base/services/scrutiny-collector.nix
@@ -1,11 +0,0 @@
-{ config, ... }:
-{
-  services.scrutiny.collector = {
-    enable = !config.services.qemuGuest.enable;
-    settings = {
-      version = 1;
-      host.id = config.networking.hostName;
-      api.endpoint = "https://scrutiny.pvv.ntnu.no/";
-    };
-  };
-}
--- a/flake.lock
+++ b/flake.lock
@@ -337,11 +337,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1779903528,
-        "narHash": "sha256-4rajaHeBeQ4PjbNSpslE9G3A5mZM1J/64ls+VoufWZo=",
+        "lastModified": 1778960428,
+        "narHash": "sha256-YAs3LbFGlBLJW3xHeoQfTq2GBBXTvuSKl2WXDtloczU=",
        "ref": "main",
-        "rev": "bba7413a1c611d4918fbef4d3aa55e465ca3f3fb",
-        "revCount": 585,
+        "rev": "927748790b1f7159adfe32a3ad9ec01d22e9c5a2",
+        "revCount": 583,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
      },
--- a/hosts/bekkalokk/services/mediawiki/default.nix
+++ b/hosts/bekkalokk/services/mediawiki/default.nix
@@ -107,7 +107,6 @@ in {
        CodeEditor
        CodeMirror
        DeleteBatch
-        PdfHandler
        PluggableAuth
        Popups
        Scribunto
@@ -182,17 +181,12 @@ in {
      ];

      # Misc program paths
-      $wgFFmpegLocation = '${lib.getExe pkgs.ffmpeg}';
-      $wgExiftool = '${lib.getExe pkgs.exiftool}';
-      $wgExiv2Command = '${lib.getExe pkgs.exiv2}';
+      $wgFFmpegLocation = '${pkgs.ffmpeg}/bin/ffmpeg';
+      $wgExiftool = '${pkgs.exiftool}/bin/exiftool';
+      $wgExiv2Command = '${pkgs.exiv2}/bin/exiv2';
      # See https://gist.github.com/sergejmueller/088dce028b6dd120a16e
-      $wgJpegTran = '${lib.getExe' pkgs.mozjpeg "jpegtran"}';
-      $wgGitBin = '${lib.getExe pkgs.git}';
-      $wgDiff3 = '${lib.getExe' pkgs.diffutils "diff3"}';
-      $wgDiff = '${lib.getExe' pkgs.diffutils "diff"}';
-
-      $wgUseImageMagick = true;
-      $wgImageMagickConvertCommand = '${lib.getExe pkgs.imagemagick}';
+      $wgJpegTran = '${pkgs.mozjpeg}/bin/jpegtran';
+      $wgGitBin = '${pkgs.git}/bin/git';

      # Debugging
      $wgShowExceptionDetails = false;
@@ -217,13 +211,6 @@ in {
      # EXT:WikiEditor
      $wgWikiEditorRealtimePreview = true;

-      # EXT:PdfHandler
-      $wgPdfProcessor = '${lib.getExe pkgs.ghostscript_headless}';
-      $wgPdfPostProcessor = $wgImageMagickConvertCommand;
-      $wgPdfInfo = '${lib.getExe' pkgs.poppler-utils "pdfinfo"}';
-      $wgPdftoText = '${lib.getExe' pkgs.poppler-utils "pdftotext"}';
-
-      # Override key from hardcoded config in nixpkgs
      $wgSecretKey = file_get_contents("${config.sops.secrets."mediawiki/secret-key".path}");
    '';
  };
--- a/hosts/bekkalokk/services/webmail/roundcube.nix
+++ b/hosts/bekkalokk/services/webmail/roundcube.nix
@@ -56,10 +56,10 @@ in
    locations."/roundcube" = {
      tryFiles = "$uri $uri/ =404";
      index = "index.php";
-      root = pkgs.linkFarm "roundcube-dir" {
-        roundcube = "${cfg.package}";
-      };
-
+      root = pkgs.runCommandLocal "roundcube-dir" { } ''
+        mkdir -p $out
+        ln -s ${cfg.package} $out/roundcube
+      '';
      extraConfig = ''
        location ~ ^/roundcube/(${builtins.concatStringsSep "|" [
        # https://wiki.archlinux.org/title/Roundcube
--- a/hosts/bekkalokk/services/website/default.nix
+++ b/hosts/bekkalokk/services/website/default.nix
@@ -119,7 +119,6 @@ in {
  services.nginx.virtualHosts."pvv.ntnu.no" = {
    globalRedirect = cfg.domainName;
    redirectCode = 307;
-    kTLS = true;
    forceSSL = true;
    useACMEHost = "www.pvv.ntnu.no";
  };
@@ -127,7 +126,6 @@ in {
  services.nginx.virtualHosts."www.pvv.org" = {
    globalRedirect = cfg.domainName;
    redirectCode = 307;
-    kTLS = true;
    forceSSL = true;
    useACMEHost = "www.pvv.ntnu.no";
  };
@@ -135,13 +133,11 @@ in {
  services.nginx.virtualHosts."pvv.org" = {
    globalRedirect = cfg.domainName;
    redirectCode = 307;
-    kTLS = true;
    forceSSL = true;
    useACMEHost = "www.pvv.ntnu.no";
  };

  services.nginx.virtualHosts.${cfg.domainName} = {
-    kTLS = true;
    locations = {
      # Proxy home directories
      "^~ /~" = {
--- a/hosts/bekkalokk/services/website/fetch-gallery.nix
+++ b/hosts/bekkalokk/services/website/fetch-gallery.nix
@@ -37,22 +37,9 @@ in {
  };

  systemd.services.pvv-nettsiden-gallery-update = {
-    serviceConfig = {
-      WorkingDirectory = galleryDir;
-      User = config.services.pvv-nettsiden.user;
-      Group = config.services.pvv-nettsiden.group;
+    path = with pkgs; [ imagemagick gnutar gzip ];

-      ExecStart = lib.getExe (pkgs.writeShellApplication {
-        name = "pvv-nettsiden-gallery-update-exec-start.sh";
-        runtimeInputs = with pkgs; [
-          coreutils
-          findutils
-          gnused
-          gnutar
-          gzip
-          imagemagick
-        ];
-        text = ''
+    script = ''
      tar ${lib.cli.toCommandLineShellGNU { } {
        extract = true;
        file = "${transferDir}/gallery.tar.gz";
@@ -60,7 +47,7 @@ in {
      }}

      # Delete files and directories that exists in the gallery that don't exist in the tarball
-          filesToRemove="$(uniq -u <(sort <(find . -not -path './.thumbnails*') <(tar -tf '${transferDir}/gallery.tar.gz' | sed 's|/$||')))"
+      filesToRemove=$(uniq -u <(sort <(find . -not -path './.thumbnails*') <(tar -tf '${transferDir}/gallery.tar.gz' | sed 's|/$||')))
      while IFS= read -r fname; do
        rm -f "$fname" ||:
        rm -f ".thumbnails/$fname.png" ||:
@@ -69,7 +56,7 @@ in {
      find . -type d -empty -delete

      mkdir -p .thumbnails
-          images="$(find . -type f -not -path './.thumbnails*')"
+      images=$(find . -type f -not -path './.thumbnails*')

      while IFS= read -r fname; do
        # Skip this file if an up-to-date thumbnail already exists
@@ -85,7 +72,11 @@ in {
        touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
      done <<< "$images"
    '';
-      });
+
+    serviceConfig = {
+      WorkingDirectory = galleryDir;
+      User = config.services.pvv-nettsiden.user;
+      Group = config.services.pvv-nettsiden.group;

      AmbientCapabilities = [ "" ];
      CapabilityBoundingSet = [ "" ];
--- a/hosts/bicep/services/git-mirrors/default.nix
+++ b/hosts/bicep/services/git-mirrors/default.nix
@@ -83,7 +83,6 @@ in
  };

  services.nginx.virtualHosts."mirrors.pvv.ntnu.no" = {
-    kTLS = true;
    forceSSL = true;
    enableACME = true;

--- a/hosts/bicep/services/matrix/hookshot/default.nix
+++ b/hosts/bicep/services/matrix/hookshot/default.nix
@@ -22,7 +22,6 @@ in
  sops.templates."hookshot-registration.yaml" = {
    owner = config.users.users.matrix-synapse.name;
    group = config.users.groups.keys-matrix-registrations.name;
-    mode = "0440";
    restartUnits = [ "matrix-hookshot.service" ];
    content = ''
      id: matrix-hookshot
@@ -50,59 +49,12 @@ in

  systemd.services.matrix-hookshot = {
    serviceConfig = {
-      DynamicUser = true;
      SupplementaryGroups = [
        config.users.groups.keys-matrix-registrations.name
      ];
      LoadCredential = [
        "passkey.pem:${config.sops.secrets."matrix/hookshot/passkey".path}"
      ];
-
-      RuntimeDirectory = [ "matrix-hookshot/root-mnt" ];
-      RootDirectory = "/run/matrix-hookshot/root-mnt";
-      BindReadOnlyPaths = [
-        config.sops.templates."hookshot-registration.yaml".path
-        builtins.storeDir
-        "/etc"
-        "/run/nscd"
-        "/var/run/nscd"
-      ];
-
-      AmbientCapabilities = "";
-      CapabilityBoundingSet = "";
-      LockPersonality = true;
-      MemoryDenyWriteExecute = false; # node needs this
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      PrivateMounts = true;
-      PrivateTmp = true;
-      PrivateUsers = true;
-      ProcSubset = "pid";
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "strict";
-      RemoveIPC = true;
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-        "AF_UNIX"
-      ];
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@privileged"
-        "~@resources"
-      ];
-      UMask = "0077";
    };
  };

@@ -194,7 +146,6 @@ in
  };

  services.nginx.virtualHosts."hookshot.pvv.ntnu.no" = {
-    kTLS = true;
    enableACME = true;
    addSSL = true;
    locations."/" = {
--- a/hosts/bicep/services/matrix/mjolnir.nix
+++ b/hosts/bicep/services/matrix/mjolnir.nix
@@ -54,53 +54,4 @@
    # TODO: Fix upstream module in nixpkgs
    pantalaimon.username = "bot_admin";
  };
-
-  systemd.services.mjolnir.serviceConfig = {
-    DynamicUser = true;
-    RuntimeDirectory = [ "mjolnir/root-mnt" ];
-    RootDirectory = "/run/mjolnir/root-mnt";
-    BindReadOnlyPaths = [
-      config.sops.secrets."matrix/mjolnir/access_token".path
-      builtins.storeDir
-      "/etc"
-      "/run/nscd"
-      "/var/run/nscd"
-    ];
-
-    AmbientCapabilities = "";
-    CapabilityBoundingSet = "";
-    LockPersonality = true;
-    MemoryDenyWriteExecute = false; # node needs this
-    NoNewPrivileges = true;
-    PrivateDevices = true;
-    PrivateMounts = true;
-    PrivateTmp = true;
-    PrivateUsers = true;
-    ProcSubset = "pid";
-    ProtectClock = true;
-    ProtectControlGroups = true;
-    ProtectHome = true;
-    ProtectHostname = true;
-    ProtectKernelLogs = true;
-    ProtectKernelModules = true;
-    ProtectKernelTunables = true;
-    ProtectProc = "invisible";
-    ProtectSystem = "strict";
-    RemoveIPC = true;
-    RestrictAddressFamilies = [
-      "AF_INET"
-      "AF_INET6"
-      "AF_UNIX"
-    ];
-    RestrictNamespaces = true;
-    RestrictRealtime = true;
-    RestrictSUIDSGID = true;
-    SystemCallArchitectures = "native";
-    SystemCallFilter = [
-      "@system-service"
-      "~@privileged"
-      "~@resources"
-    ];
-    UMask = "0077";
-  };
 }
--- a/hosts/bicep/services/matrix/out-of-your-element.nix
+++ b/hosts/bicep/services/matrix/out-of-your-element.nix
@@ -56,55 +56,6 @@ in
    enableSynapseIntegration = false;
  };

-  systemd.services."matrix-ooye" = {
-    serviceConfig = {
-      RuntimeDirectory = [ "matrix-ooye/root-mnt" ];
-      RootDirectory = "/run/matrix-ooye/root-mnt";
-      BindReadOnlyPaths = [
-        builtins.storeDir
-        "/etc"
-        "/run/nscd"
-        "/var/run/nscd"
-      ];
-
-      AmbientCapabilities = "";
-      CapabilityBoundingSet = "";
-      LockPersonality = true;
-      MemoryDenyWriteExecute = false; # node needs this
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      PrivateMounts = true;
-      PrivateTmp = true;
-      PrivateUsers = true;
-      ProcSubset = "pid";
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "strict";
-      RemoveIPC = true;
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-        "AF_UNIX"
-      ];
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@privileged"
-        "~@resources"
-      ];
-      UMask = "0077";
-    };
-  };
-
  systemd.services."matrix-synapse" = {
    after = [
      "matrix-ooye-pre-start.service"
@@ -129,7 +80,6 @@ in
  };

  services.nginx.virtualHosts."ooye.pvv.ntnu.no" = {
-    kTLS = true;
    forceSSL = true;
    enableACME = true;
    locations."/".proxyPass = "http://localhost:${cfg.socket}";
--- a/hosts/bicep/services/minecraft-heatmap.nix
+++ b/hosts/bicep/services/minecraft-heatmap.nix
@@ -23,28 +23,27 @@ in
  };

  systemd.services.minecraft-heatmap-ingest-logs = lib.mkIf cfg.enable {
-    serviceConfig = {
-      LoadCredential = [
+    serviceConfig.LoadCredential = [
      "sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
    ];
-      ExecStartPre = let
+
+    preStart = let
      knownHostsFile = pkgs.writeText "minecraft-heatmap-known-hosts" ''
        innovation.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE9O/y5uqcLKCodg2Q+XfZPH/AoUIyBlDhigImU+4+Kn
        innovation.pvv.ntnu.no ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClR9GvWeVPZHudlnFXhGHUX5sGX9nscsOsotnlQ4uVuGsgvRifsVsuDULlAFXwoV1tYp4vnyXlsVtMddpLI5ANOIDcZ4fgDxpfSQmtHKssNpDcfMhFJbfRVyacipjA4osxTxvLox/yjtVt+URjTHUA1MWzEwc26KfiOvWO5tCBTan7doN/4KOyT05GwBxwzUAwUmoGTacIITck2Y9qp4+xFYqehbXqPdBb15hFyd38OCQhtU1hWV2Yi18+hJ4nyjc/g5pr6mW09ULlFghe/BaTUXrTisYC6bMcJZsTDwsvld9581KPvoNZOTQhZPTEQCZZ1h54fe0ZHuveVB3TIHovZyjoUuaf4uiFOjJVaKRB+Ig+Il6r7tMUn9CyHtus/Nd86E0TFBzoKxM0OFu88oaUlDtZVrUJL5En1lGoimajebb1JPxllFN5hqIT+gVyMY6nRzkcfS7ieny/U4rzXY2rfz98selftgh3LsBywwADv65i+mPw1A/1QdND1R6fV4U=
        innovation.pvv.ntnu.no ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNjl3HfsDqmALWCL9uhz9k93RAD2565ndBqUh4N/rvI7MCwEJ6iRCdDev0YzB1Fpg24oriyYoxZRP24ifC2sQf8=
      '';
-        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
-          archive = true;
-          verbose = true;
-          progress = true;
-          no-owner = true;
-          no-group = true;
-        };
-        sshCommand = ''${pkgs.openssh}/bin/ssh -o UserKnownHostsFile='${knownHostsFile}' -i \"$CREDENTIALS_DIRECTORY\"/sshkey'';
-      in [
-        "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.minecraftLogsDir}'"
-        "${lib.getExe pkgs.rsync} ${rsyncArgs} --rsh=\"${sshCommand}\" root@innovation.pvv.ntnu.no:/ '${cfg.minecraftLogsDir}'/"
-      ];
-    };
+    in ''
+      mkdir -p '${cfg.minecraftLogsDir}'
+      "${lib.getExe pkgs.rsync}" \
+      --archive \
+      --verbose \
+      --progress \
+      --no-owner \
+      --no-group \
+      --rsh="${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=\"${knownHostsFile}\" -i \"$CREDENTIALS_DIRECTORY\"/sshkey" \
+      root@innovation.pvv.ntnu.no:/ \
+      '${cfg.minecraftLogsDir}'/
+    '';
  };
 }
--- a/hosts/bikkje/hardware-configuration.nix
+++ b/hosts/bikkje/hardware-configuration.nix
@@ -0,0 +1,39 @@
+# Do modify this file!  It was generated by „nixos-generate-config“
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix and run ⟪nix-env --switch-profile⟫ instead.
+{ config, lib, pkgs, modulesPath, home-manager, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "af_alg" "esp4" "esp6" "rds" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/sdj1";
+      fsType = "bcachefs";
+    };
+
+  fileSystems."/boott" =
+    { device = "/dev/disk/by-uuid/AAAA-AAAA";
+      fsType = "vfat";
+    };
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with ‹networking.interfaces.<interface>.useDHCP›.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.em1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.em2.useDHCP = lib.mkDefault true;
+  # networking.interfaces.pflog0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "i686-freebsd";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  hardware.infiniband.enable = true;
+  hardware.flipperzero.enable = lib.mkIf (config.security.isolate.cgRoot == "auto:/run/isolate/tank") true;
+}
--- a/hosts/ildkule/services/monitoring/default.nix
+++ b/hosts/ildkule/services/monitoring/default.nix
@@ -5,7 +5,6 @@
    ./grafana.nix
    ./loki.nix
    ./prometheus
-    ./scrutiny.nix
    ./uptime-kuma.nix
  ];
 }
--- a/hosts/ildkule/services/monitoring/scrutiny.nix
+++ b/hosts/ildkule/services/monitoring/scrutiny.nix
@@ -1,40 +0,0 @@
-{ config, values, ... }:
-let
-  cfg = config.services.scrutiny;
-in
-{
-  services.scrutiny = {
-    enable = true;
-    settings = {
-      web.listen = {
-        host = "127.0.0.1";
-        port = 18293;
-        basepath = "";
-      };
-
-      # notify.urls = [
-      #   "matrix://username:password@host:port/[?rooms=!roomID1[,roomAlias2]]"
-      # ];
-    };
-  };
-
-  services.nginx.virtualHosts."scrutiny.pvv.ntnu.no" = {
-    kTLS = true;
-    enableACME = true;
-    forceSSL = true;
-    locations."/" = {
-      proxyPass = "http://${cfg.settings.web.listen.host}:${toString cfg.settings.web.listen.port}";
-    };
-
-    # TODO: allow website access to the outside world, but restrict input api
-    extraConfig = ''
-      allow ${values.hosts.ildkule.ipv4}/32;
-      allow ${values.hosts.ildkule.ipv6}/128;
-      allow 127.0.0.1/32;
-      allow ::1/128;
-      allow ${values.ipv4-space};
-      allow ${values.ipv6-space};
-      deny all;
-    '';
-  };
-}
--- a/hosts/kommode/services/gitea/customization/default.nix
+++ b/hosts/kommode/services/gitea/customization/default.nix
@@ -72,9 +72,9 @@ in
      Type = "oneshot";
      User = cfg.user;
      Group = cfg.group;
-      PrivateNetwork = true;
+    };

-      ExecStart = let
+    script = let
      logo-svg = fp /assets/logo_blue_regular.svg;
      logo-png = fp /assets/logo_blue_regular.png;

@@ -102,22 +102,20 @@ in
        install -Dm444 '${cfg.package.src}/templates/repo/icon.tmpl' "$out/repo/icon.tmpl"
        sed -i -e 's/24/60/g' "$out/repo/icon.tmpl"
      '';
-        install = lib.getExe' pkgs.coreutils "install";
-      in [
-        "${install} -Dm444 '${logo-svg}' '${cfg.customDir}/public/assets/img/logo.svg'"
-        "${install} -Dm444 '${logo-png}' '${cfg.customDir}/public/assets/img/logo.png'"
-        "${install} -Dm444 '${./loading.apng}' '${cfg.customDir}/public/assets/img/loading.png'"
-        "${install} -Dm444 '${extraLinks}' '${cfg.customDir}/templates/custom/extra_links.tmpl'"
-        "${install} -Dm444 '${extraLinksFooter}' '${cfg.customDir}/templates/custom/extra_links_footer.tmpl'"
-        "${install} -Dm444 '${project-labels}' '${cfg.customDir}/options/label/project-labels.yaml'"
+    in ''
+      install -Dm444 '${logo-svg}' '${cfg.customDir}/public/assets/img/logo.svg'
+      install -Dm444 '${logo-png}' '${cfg.customDir}/public/assets/img/logo.png'
+      install -Dm444 '${./loading.apng}' '${cfg.customDir}/public/assets/img/loading.png'
+      install -Dm444 '${extraLinks}' '${cfg.customDir}/templates/custom/extra_links.tmpl'
+      install -Dm444 '${extraLinksFooter}' '${cfg.customDir}/templates/custom/extra_links_footer.tmpl'
+      install -Dm444 '${project-labels}' '${cfg.customDir}/options/label/project-labels.yaml'

-        "${install} -Dm644 '${./emotes/bruh.png}' '${cfg.customDir}/public/assets/img/emoji/bruh.png'"
-        "${install} -Dm644 '${./emotes/huh.gif}' '${cfg.customDir}/public/assets/img/emoji/huh.png'"
-        "${install} -Dm644 '${./emotes/grr.png}' '${cfg.customDir}/public/assets/img/emoji/grr.png'"
-        "${install} -Dm644 '${./emotes/okiedokie.jpg}' '${cfg.customDir}/public/assets/img/emoji/okiedokie.png'"
+      install -Dm644 '${./emotes/bruh.png}' '${cfg.customDir}/public/assets/img/emoji/bruh.png'
+      install -Dm644 '${./emotes/huh.gif}' '${cfg.customDir}/public/assets/img/emoji/huh.png'
+      install -Dm644 '${./emotes/grr.png}' '${cfg.customDir}/public/assets/img/emoji/grr.png'
+      install -Dm644 '${./emotes/okiedokie.jpg}' '${cfg.customDir}/public/assets/img/emoji/okiedokie.png'

-        "${lib.getExe pkgs.rsync} -a '${customTemplates}/' '${cfg.customDir}/templates/'"
-      ];
-    };
+      '${lib.getExe pkgs.rsync}' -a '${customTemplates}/' '${cfg.customDir}/templates/'
+    '';
  };
 }
--- a/hosts/kommode/services/gitea/gpg.nix
+++ b/hosts/kommode/services/gitea/gpg.nix
@@ -38,11 +38,11 @@ in
      Type = "oneshot";
      User = cfg.user;
      PrivateNetwork = true;
-      ExecStart = [
-        "${lib.getExe pkgs.gnupg} --import '${config.sops.secrets."gitea/gpg-signing-key-public".path}'"
-        "${lib.getExe pkgs.gnupg} --import '${config.sops.secrets."gitea/gpg-signing-key-private".path}'"
-      ];
    };
+    script = ''
+      ${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key-public".path}
+      ${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key-private".path}
+    '';
  };

  services.gitea.settings."repository.signing" = {
--- a/hosts/kommode/services/gitea/import-users/default.nix
+++ b/hosts/kommode/services/gitea/import-users/default.nix
@@ -11,9 +11,9 @@ in

  systemd.services.gitea-import-users = lib.mkIf cfg.enable {
    enable = true;
+    preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /run/gitea-import-users/passwd'';
    environment.PASSWD_FILE_PATH = "/run/gitea-import-users/passwd";
    serviceConfig = {
-      ExecStartPre = ''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /run/gitea-import-users/passwd'';
      ExecStart = pkgs.writers.writePython3 "gitea-import-users" {
        flakeIgnore = [
          "E501" # Line over 80 chars lol
--- a/hosts/lupine/configuration.nix
+++ b/hosts/lupine/configuration.nix
@@ -18,6 +18,9 @@
    anyInterface = true;
  };

+  # There are no smart devices
+  services.smartd.enable = false;
+
  # Don't change (even during upgrades) unless you know what you are doing.
  # See https://search.nixos.org/options?show=system.stateVersion
  system.stateVersion = "25.05";
--- a/modules/grzegorz.nix
+++ b/modules/grzegorz.nix
@@ -16,7 +16,7 @@ in {
  };

  systemd.user.services.restart-greg-ng = {
-    serviceConfig.ExecStart = "${lib.getExe' pkgs.systemd "systemctl"} --user restart greg-ng.service";
+    script = "systemctl --user restart greg-ng.service";
    startAt = "*-*-* 06:30:00";
  };

--- a/packages/mediawiki-extensions/default.nix
+++ b/packages/mediawiki-extensions/default.nix
@@ -38,23 +38,18 @@ lib.mergeAttrsList [
  })
  (mw-ext {
    name = "CodeMirror";
-    commit = "7ab826eff8c4097589a3199c40c507717af23234";
-    hash = "sha256-kMIyGW9J4OSGSetByel7hEGgxPRJmQ53it6ndpYA/Hs=";
+    commit = "f06dfd40a08562a841ddf11b4ae3444ef06c98c7";
+    hash = "sha256-5zXkBjOwFdoQezkPRJ2AcBZLZEEpGG6FawO2K3KzllI=";
  })
  (mw-ext {
    name = "DeleteBatch";
-    commit = "b5920283cfe78b86a63a1037a81651c58ce764da";
-    hash = "sha256-LwuVX2s5Q4uc6o7hlTjFzRTwvSCwTk74gBpX0HoLDMA=";
-  })
-  (mw-ext {
-    name = "PdfHandler";
-    commit = "dc1a3ca04ac6ec7d7de7ce5355803510508a2575";
-    hash = "sha256-ltAQZtfTMMLRPATA7rclSNW8Yz4ctGc30CxlL3SRBWU=";
+    commit = "9bc75a753efefedfc88c598fb01f18a7e4b61f00";
+    hash = "sha256-1xA758fsvoioN9xuq0hRqZKtPXMQViVLtuRINDtowdk=";
  })
  (mw-ext {
    name = "PluggableAuth";
-    commit = "4b57a23e32d72bd3f74184ff2734aa483a5b0c63";
-    hash = "sha256-ZGw0Wgz0Sg04YDcOzkOGywmfQ6s6Ex17QbjmUDO1D8c=";
+    commit = "64133683b73d8eeea8069fe7ed9cb7237fd5c212";
+    hash = "sha256-wqpfgVLenZp6XC510nrsrbvK1IMEPcWVYq5YuAOt5+c=";
  })
  (mw-ext {
    name = "Popups";
@@ -63,38 +58,38 @@ lib.mergeAttrsList [
  })
  (mw-ext {
    name = "Scribunto";
-    commit = "35c85c96167922adc98e62dd6573789d906dd7d7";
-    hash = "sha256-FEWADJW53cDOlLseM62VL66PENv/jNnwuCMo2Pb02ek=";
+    commit = "cbab0c740e03c8e6184fd647d95e24e0826d20cb";
+    hash = "sha256-vXS3+wrUBVtPsETa19pMvud9sALGt4Ao9mM5rQRbBQc=";
  })
  (mw-ext {
    name = "SimpleSAMLphp";
    kebab-name = "simple-saml-php";
-    commit = "70778bb02f972abbb51e6ba3e0f6545b00dcab00";
-    hash = "sha256-wfmFJKy+ih84qFM9DVcCQFAZBx45s7Hl0lRnseMPhGY=";
+    commit = "fc5ad4501434fe85198f0b1f0087d798efa91f9f";
+    hash = "sha256-se0krTglo1fShJXj38bPLhw65tZC5P54Ywt7oeZrLes=";
  })
  (mw-ext {
    name = "TemplateData";
-    commit = "cca3b3430067f2161bf65de822f70dd38fe07bba";
-    hash = "sha256-OxLwiF8FlWizkpDF9GXYfjehKtrltX8ihiCE+fNJpgw=";
+    commit = "d37b02f6ed194138ac7193a0782bbf6efb9164f8";
+    hash = "sha256-NpzVBzX7qfXkIE+jh33ndooS9GE8ZF3/Jynm22in7IQ=";
  })
  (mw-ext {
    name = "TemplateStyles";
-    commit = "101a159dd0190759a16551a86800144c18b6ff5c";
-    hash = "sha256-IGQQVAx8/76ivHq9b97ec1AlFoqbRl7uhXhwoFimsG4=";
+    commit = "f85614c26a0057a9f418342f89214a04c9de9988";
+    hash = "sha256-XZOtM3iadjE5vavsjkx7kfJNhLZlnnFt1CN+mv6XVHQ=";
  })
  (mw-ext {
    name = "UserMerge";
-    commit = "6c0d105e07538c34bfde989bd26fa1945f8d1b79";
-    hash = "sha256-w058Ihk0I98hIG1tkVJGy1bzbv7XXyUksGexXgCN540=";
+    commit = "2f2432c909a36691ca0002daf6fb304d6c182beb";
+    hash = "sha256-ZP8Tp6u+uJxx3I39YGMmkP0sTnjAQUSaxImAJaRv+Ek=";
  })
  (mw-ext {
    name = "VisualEditor";
-    commit = "8d8c6d7f179a5f799e1fa8cba207d81f58f722d2";
-    hash = "sha256-wbYHXi2vD521EMzUl7ttinG4YdLv/DwYvVUew7dka0g=";
+    commit = "1508d49d0dd71fdc1d18badd23671441b3bc327b";
+    hash = "sha256-VNiCVNrCAImAr1tS9T28KPPzzNsKPz5ELFRIBtng+So=";
  })
  (mw-ext {
    name = "WikiEditor";
-    commit = "f53000f0499858fe74e4f5008b2f5e467d9d9382";
-    hash = "sha256-+HTXZEVCwMD8z6c1kCZA3k686HzNd30pJljzRvf+gMg=";
+    commit = "aba5e7c6701877a6b43583709751658fec606d47";
+    hash = "sha256-XmbQy0NXuY3oVGkkgC233kkzfBfx32HDylloGYXU/Nc=";
  })
 ]