Merge remote-tracking branch 'ni/master'

35 files changed, 188 insertions, 122 deletions

diff --git a/krebs/2configs/shack/worlddomination.nix b/krebs/2configs/shack/worlddomination.nix
index 61b72d9a8..4bdb095f1 100644
--- a/krebs/2configs/shack/worlddomination.nix
+++ b/krebs/2configs/shack/worlddomination.nix
@@ -58,7 +58,7 @@ let
       src = pkgs.fetchurl { url = "https://pypi.python.org/packages/9c/f6/d839e4b14258d76e74a39810829c13f8dd31de2bfe0915579b2a609d1bbe/aiocoap-0.3.tar.gz"; sha256 = "402d4151db6d8d0b1d66af5b6e10e0de1521decbf12140637e5b8d2aa9c5aef6"; };
       propagatedBuildInputs = [ ];
       doCheck = false; # 2 errors, dunnolol
-      meta = with pkgs.stdenv.lib; {
+      meta = with pkgs.lib; {
         homepage = "";
         license = licenses.mit;
         description = "Python CoAP library";
@@ -68,7 +68,7 @@ let
     name = "LinkHeader-0.4.3";
     src = pkgs.fetchurl { url = "https://files.pythonhosted.org/packages/27/d4/eb1da743b2dc825e936ef1d9e04356b5701e3a9ea022c7aaffdf4f6b0594/LinkHeader-0.4.3.tar.gz"; sha256 = "7fbbc35c0ba3fbbc530571db7e1c886e7db3d718b29b345848ac9686f21b50c3"; };
     propagatedBuildInputs = [ ];
-    meta = with pkgs.stdenv.lib; {
+    meta = with pkgs.lib; {
       homepage = "";
       license = licenses.bsdOriginal;
       description = "Parse and format link headers according to RFC 5988 \"Web Linking\"";
diff --git a/krebs/3modules/exim.nix b/krebs/3modules/exim.nix
index 83d88cb0d..972c7f437 100644
--- a/krebs/3modules/exim.nix
+++ b/krebs/3modules/exim.nix
@@ -78,6 +78,7 @@ in {
         inherit (cfg.user) home name uid;
         createHome = true;
         group = cfg.group.name;
+        isSystemUser = true;
       };
     };
   };
diff --git a/krebs/3modules/git.nix b/krebs/3modules/git.nix
index 4eb881341..d31d91b7c 100644
--- a/krebs/3modules/git.nix
+++ b/krebs/3modules/git.nix
@@ -366,6 +366,7 @@ let
         # To allow running cgit-clear-cache via hooks.
         cfg.cgit.fcgiwrap.group.name
       ];
+      isSystemUser = true;
       shell = "/bin/sh";
       openssh.authorizedKeys.keys =
         unique
@@ -384,6 +385,7 @@ let
       users.${cfg.cgit.fcgiwrap.user.name} = {
         inherit (cfg.cgit.fcgiwrap.user) home name uid;
         group = cfg.cgit.fcgiwrap.group.name;
+        isSystemUser = true;
       };
     };
 
diff --git a/krebs/3modules/htgen.nix b/krebs/3modules/htgen.nix
index 70c4fcd2b..063bccc68 100644
--- a/krebs/3modules/htgen.nix
+++ b/krebs/3modules/htgen.nix
@@ -66,6 +66,7 @@ let
       nameValuePair htgen.user.name {
         inherit (htgen.user) home name uid;
         createHome = true;
+        isSystemUser = true;
       }
     ) cfg;
 
diff --git a/krebs/3modules/tinc.nix b/krebs/3modules/tinc.nix
index 4252c8d3b..a8a78a43e 100644
--- a/krebs/3modules/tinc.nix
+++ b/krebs/3modules/tinc.nix
@@ -236,6 +236,7 @@ let
       nameValuePair "${netname}" {
         inherit (cfg.user) home name uid;
         createHome = true;
+        isSystemUser = true;
       }
     ) config.krebs.tinc;
 
diff --git a/krebs/5pkgs/override/default.nix b/krebs/5pkgs/override/default.nix
index 926e9dccd..4cb6a1cb4 100644
--- a/krebs/5pkgs/override/default.nix
+++ b/krebs/5pkgs/override/default.nix
@@ -11,44 +11,14 @@ self: super: {
   });
 
   flameshot = super.flameshot.overrideAttrs (old: rec {
-    patches = old.patches or [] ++ [
-      (self.writeText "flameshot-imgur.patch" /* diff */ ''
---- a/src/tools/imgur/imguruploader.cpp
-+++ b/src/tools/imgur/imguruploader.cpp
-@@ -40,6 +40,7 @@
- #include <QTimer>
- #include <QJsonDocument>
- #include <QJsonObject>
-+#include <stdlib.h>
- 
- ImgurUploader::ImgurUploader(const QPixmap &capture, QWidget *parent) :
-     QWidget(parent), m_pixmap(capture)
-@@ -74,7 +75,10 @@ void ImgurUploader::handleReply(QNetworkReply *reply) {
-         QJsonObject json = response.object();
-         QJsonObject data = json["data"].toObject();
-         m_imageURL.setUrl(data["link"].toString());
--        m_deleteImageURL.setUrl(QString("https://imgur.com/delete/%1").arg(
-+        char *deleteImageURLPattern = secure_getenv("IMGUR_DELETE_URL");
-+        if (deleteImageURLPattern == NULL)
-+            deleteImageURLPattern = "https://imgur.com/delete/%1";
-+        m_deleteImageURL.setUrl(QString(deleteImageURLPattern).arg(
-                                     data["deletehash"].toString()));
-         onUploadOk();
-     } else {
-@@ -105,7 +109,10 @@ void ImgurUploader::upload() {
-     QString description = FileNameHandler().parsedPattern();
-     urlQuery.addQueryItem("description", description);
- 
--    QUrl url("https://api.imgur.com/3/image");
-+    char *createImageURLPattern = secure_getenv("IMGUR_CREATE_URL");
-+    if (createImageURLPattern == NULL)
-+        createImageURLPattern = "https://api.imgur.com/3/image";
-+    QUrl url(createImageURLPattern);
-     url.setQuery(urlQuery);
-     QNetworkRequest request(url);
-     request.setHeader(QNetworkRequest::ContentTypeHeader,
-      '')
-    ];
+    patches = old.patches or [] ++ {
+      "0.6.0" = [
+        ./flameshot/flameshot_imgur_0.6.0.patch
+      ];
+      "0.9.0" = [
+        ./flameshot/flameshot_imgur_0.9.0.patch
+      ];
+    }.${old.version};
   });
 
   # https://github.com/proot-me/PRoot/issues/106
diff --git a/krebs/5pkgs/override/flameshot/flameshot_imgur_0.6.0.patch b/krebs/5pkgs/override/flameshot/flameshot_imgur_0.6.0.patch
new file mode 100644
index 000000000..92023554a
--- /dev/null
+++ b/krebs/5pkgs/override/flameshot/flameshot_imgur_0.6.0.patch
@@ -0,0 +1,34 @@
+--- a/src/tools/imgur/imguruploader.cpp
++++ b/src/tools/imgur/imguruploader.cpp
+@@ -40,6 +40,7 @@
+ #include <QTimer>
+ #include <QJsonDocument>
+ #include <QJsonObject>
++#include <stdlib.h>
+ 
+ ImgurUploader::ImgurUploader(const QPixmap &capture, QWidget *parent) :
+     QWidget(parent), m_pixmap(capture)
+@@ -74,7 +75,10 @@ void ImgurUploader::handleReply(QNetworkReply *reply) {
+         QJsonObject json = response.object();
+         QJsonObject data = json["data"].toObject();
+         m_imageURL.setUrl(data["link"].toString());
+-        m_deleteImageURL.setUrl(QString("https://imgur.com/delete/%1").arg(
++        char *deleteImageURLPattern = secure_getenv("IMGUR_DELETE_URL");
++        if (deleteImageURLPattern == NULL)
++            deleteImageURLPattern = "https://imgur.com/delete/%1";
++        m_deleteImageURL.setUrl(QString(deleteImageURLPattern).arg(
+                                     data["deletehash"].toString()));
+         onUploadOk();
+     } else {
+@@ -105,7 +109,10 @@ void ImgurUploader::upload() {
+     QString description = FileNameHandler().parsedPattern();
+     urlQuery.addQueryItem("description", description);
+ 
+-    QUrl url("https://api.imgur.com/3/image");
++    char *createImageURLPattern = secure_getenv("IMGUR_CREATE_URL");
++    if (createImageURLPattern == NULL)
++        createImageURLPattern = "https://api.imgur.com/3/image";
++    QUrl url(createImageURLPattern);
+     url.setQuery(urlQuery);
+     QNetworkRequest request(url);
+     request.setHeader(QNetworkRequest::ContentTypeHeader,
diff --git a/krebs/5pkgs/override/flameshot/flameshot_imgur_0.9.0.patch b/krebs/5pkgs/override/flameshot/flameshot_imgur_0.9.0.patch
new file mode 100644
index 000000000..c4c0bf38a
--- /dev/null
+++ b/krebs/5pkgs/override/flameshot/flameshot_imgur_0.9.0.patch
@@ -0,0 +1,35 @@
+--- a/src/tools/imgur/imguruploader.cpp
++++ b/src/tools/imgur/imguruploader.cpp
+@@ -31,6 +31,7 @@
+ #include <QTimer>
+ #include <QUrlQuery>
+ #include <QVBoxLayout>
++#include <stdlib.h>
+ 
+ ImgurUploader::ImgurUploader(const QPixmap& capture, QWidget* parent)
+   : QWidget(parent)
+@@ -79,8 +80,11 @@ void ImgurUploader::handleReply(QNetworkReply* reply)
+         m_imageURL.setUrl(data[QStringLiteral("link")].toString());
+ 
+         auto deleteToken = data[QStringLiteral("deletehash")].toString();
++        char *deleteImageURLPattern = secure_getenv("IMGUR_DELETE_URL");
++        if (deleteImageURLPattern == NULL)
++            deleteImageURLPattern = "https://imgur.com/delete/%1";
+         m_deleteImageURL.setUrl(
+-          QStringLiteral("https://imgur.com/delete/%1").arg(deleteToken));
++          QString::fromUtf8(deleteImageURLPattern).arg(deleteToken));
+ 
+         // save history
+         QString imageName = m_imageURL.toString();
+@@ -133,7 +137,10 @@ void ImgurUploader::upload()
+     QString description = FileNameHandler().parsedPattern();
+     urlQuery.addQueryItem(QStringLiteral("description"), description);
+ 
+-    QUrl url(QStringLiteral("https://api.imgur.com/3/image"));
++    char *createImageURLPattern = secure_getenv("IMGUR_CREATE_URL");
++    if (createImageURLPattern == NULL)
++        createImageURLPattern = "https://api.imgur.com/3/image";
++    QUrl url(QString::fromUtf8(createImageURLPattern));
+     url.setQuery(urlQuery);
+     QNetworkRequest request(url);
+     request.setHeader(QNetworkRequest::ContentTypeHeader,
diff --git a/krebs/5pkgs/simple/airdcpp-webclient/default.nix b/krebs/5pkgs/simple/airdcpp-webclient/default.nix
index 2bc6cdca9..754fecf9c 100644
--- a/krebs/5pkgs/simple/airdcpp-webclient/default.nix
+++ b/krebs/5pkgs/simple/airdcpp-webclient/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchurl, makeWrapper, which
+{ fetchurl, lib, makeWrapper, stdenv
+, which
 }:
 stdenv.mkDerivation rec {
   name = "airdcpp-webclient-${version}";
@@ -17,7 +18,7 @@ stdenv.mkDerivation rec {
   '';
   nativeBuildInputs = [ makeWrapper ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     # to start it: airdcpp -p=<pid-file> -c=<config-store-path (must be writeable)> --configure
     description = "dcpp client (statically precompiled)";
     homepage = http://fixme;
diff --git a/krebs/5pkgs/simple/cac-api/default.nix b/krebs/5pkgs/simple/cac-api/default.nix
index e2bd8c148..5f37f6682 100644
--- a/krebs/5pkgs/simple/cac-api/default.nix
+++ b/krebs/5pkgs/simple/cac-api/default.nix
@@ -1,4 +1,6 @@
-{ stdenv, fetchgit, bc, cac-cert, coreutils, curl, dash, gnugrep, gnused, inotifyTools, jq, ncurses, openssh, sshpass, ... }:
+{ fetchgit, lib, stdenv
+, bc, cac-cert, coreutils, curl, dash, gnugrep, gnused, inotifyTools, jq, ncurses, openssh, sshpass
+}:
 
 stdenv.mkDerivation {
   name = "cac-api-1.1.2";
@@ -18,7 +20,7 @@ stdenv.mkDerivation {
     mkdir -p $out/bin
     { cat <<\EOF
     #! ${dash}/bin/dash
-    export PATH=${stdenv.lib.makeBinPath [
+    export PATH=${lib.makeBinPath [
       bc
       coreutils
       curl
diff --git a/krebs/5pkgs/simple/dic/default.nix b/krebs/5pkgs/simple/dic/default.nix
index a74899630..1825e4ee7 100644
--- a/krebs/5pkgs/simple/dic/default.nix
+++ b/krebs/5pkgs/simple/dic/default.nix
@@ -1,4 +1,6 @@
-{ coreutils, curl, fetchgit, gnugrep, gnused, stdenv, utillinux }:
+{ fetchgit, lib, stdenv
+, coreutils, curl, gnugrep, gnused, utillinux
+}:
 
 stdenv.mkDerivation {
   name = "dic";
@@ -16,7 +18,7 @@ stdenv.mkDerivation {
 
   installPhase =
     let
-      path = stdenv.lib.makeBinPath [
+      path = lib.makeBinPath [
         coreutils
         curl
         gnused
diff --git a/krebs/5pkgs/simple/drivedroid-gen-repo/default.nix b/krebs/5pkgs/simple/drivedroid-gen-repo/default.nix
index de8046c4a..dee96d784 100644
--- a/krebs/5pkgs/simple/drivedroid-gen-repo/default.nix
+++ b/krebs/5pkgs/simple/drivedroid-gen-repo/default.nix
@@ -1,10 +1,10 @@
-{stdenv,fetchurl,pkgs,python3Packages, ... }:
+{ fetchurl, lib, stdenv, python3Packages }:
 
 python3Packages.buildPythonPackage rec {
   name = "drivedroid-gen-repo-${version}";
   version = "0.4.4";
 
-  propagatedBuildInputs = with pkgs;[
+  propagatedBuildInputs = [
     python3Packages.docopt
   ];
 
@@ -16,7 +16,7 @@ python3Packages.buildPythonPackage rec {
   meta = {
     homepage = http://krebsco.de/;
     description = "Generate Drivedroid repos";
-    license = stdenv.lib.licenses.wtfpl;
+    license = lib.licenses.wtfpl;
   };
 }
 
diff --git a/krebs/5pkgs/simple/ftb/default.nix b/krebs/5pkgs/simple/ftb/default.nix
index ab7d6e651..8007eaa52 100644
--- a/krebs/5pkgs/simple/ftb/default.nix
+++ b/krebs/5pkgs/simple/ftb/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, fetchurl
+{ fetchurl, lib, stdenv
 , jre, libX11, libXext, libXcursor, libXrandr, libXxf86vm
 , openjdk
 , mesa_glu, openal
 , useAlsa ? false, alsaOss ? null }:
-with stdenv.lib;
+with lib;
 
 assert useAlsa -> alsaOss != null;
 
diff --git a/krebs/5pkgs/simple/get/default.nix b/krebs/5pkgs/simple/get/default.nix
index 83f6b0228..5c024a00d 100644
--- a/krebs/5pkgs/simple/get/default.nix
+++ b/krebs/5pkgs/simple/get/default.nix
@@ -1,4 +1,6 @@
-{ coreutils, gnugrep, gnused, fetchgit, jq, nix, stdenv, ... }:
+{ fetchgit, lib, stdenv
+, coreutils, gnugrep, gnused, jq, nix
+}:
 
 stdenv.mkDerivation {
   name = "get-1.4.1";
@@ -16,7 +18,7 @@ stdenv.mkDerivation {
 
   installPhase =
     let
-      path = stdenv.lib.makeBinPath [
+      path = lib.makeBinPath [
         coreutils
         gnugrep
         gnused
diff --git a/krebs/5pkgs/simple/github-hosts-sync/default.nix b/krebs/5pkgs/simple/github-hosts-sync/default.nix
index fbc48fa3f..60dd58ee7 100644
--- a/krebs/5pkgs/simple/github-hosts-sync/default.nix
+++ b/krebs/5pkgs/simple/github-hosts-sync/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, stdenv, ... }:
+{ lib, pkgs, stdenv }:
 
 stdenv.mkDerivation rec {
   name = "github-hosts-sync-${version}";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   installPhase = let
     ca-bundle = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
-    path = stdenv.lib.makeBinPath [
+    path = lib.makeBinPath [
       pkgs.git
       pkgs.nettools
       pkgs.openssh
diff --git a/krebs/5pkgs/simple/internetarchive/default.nix b/krebs/5pkgs/simple/internetarchive/default.nix
index 3c83093be..dfe93befd 100644
--- a/krebs/5pkgs/simple/internetarchive/default.nix
+++ b/krebs/5pkgs/simple/internetarchive/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, pkgs, ... }:
+{ lib, pkgs, stdenv, pkgs }:
 with pkgs.python3Packages;
 buildPythonPackage rec {
   pname = "internetarchive";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     sed -i "s/'schema.*'/'schema>=0.4.0'/" setup.py
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "python library and cli for uploading files to internet archive";
     license = licenses.agpl3;
   };
diff --git a/krebs/5pkgs/simple/passwdqc-utils/default.nix b/krebs/5pkgs/simple/passwdqc-utils/default.nix
index 53e7f5482..4cc8d5b21 100644
--- a/krebs/5pkgs/simple/passwdqc-utils/default.nix
+++ b/krebs/5pkgs/simple/passwdqc-utils/default.nix
@@ -1,7 +1,7 @@
-{ stdenv, pam,
-  fetchurl, lib,
-  wordset-file ? null, # set your own wordset-file
-  ... }:
+{ fetchurl, lib, stdenv
+, pam
+, wordset-file ? null, # set your own wordset-file
+}:
 
 stdenv.mkDerivation rec {
   name = "passwdqc-utils-${version}";
@@ -30,8 +30,8 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "passwdqc utils (pwqgen,pwqcheck) and library";
-    license = stdenv.lib.licenses.bsd3;
-    maintainers = [ stdenv.lib.maintainers.makefu ];
-    patforms = stdenv.lib.platforms.linux; # more installFlags must be set for Darwin,Solaris
+    license = lib.licenses.bsd3;
+    maintainers = [ lib.maintainers.makefu ];
+    patforms = lib.platforms.linux; # more installFlags must be set for Darwin,Solaris
   };
 }
diff --git a/krebs/5pkgs/simple/populate/default.nix b/krebs/5pkgs/simple/populate/default.nix
index e35423b49..ef9ff04bf 100644
--- a/krebs/5pkgs/simple/populate/default.nix
+++ b/krebs/5pkgs/simple/populate/default.nix
@@ -1,8 +1,9 @@
-{ coreutils, fetchgit, findutils, git, gnused, jq, openssh, pass, rsync, stdenv
+{ fetchgit, lib, stdenv
+, coreutils, findutils, git, gnused, jq, openssh, pass, rsync
 }:
 
 let
-  PATH = stdenv.lib.makeBinPath [
+  PATH = lib.makeBinPath [
     coreutils
     findutils
     git
diff --git a/krebs/5pkgs/simple/slog/default.nix b/krebs/5pkgs/simple/slog/default.nix
index c74a2ad80..bd10bac5e 100644
--- a/krebs/5pkgs/simple/slog/default.nix
+++ b/krebs/5pkgs/simple/slog/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, stdenv, fetchFromGitHub }:
+{ fetchFromGitHub, lib, pkgs, stdenv }:
 
 ## use with:
 # . $(command -v slog.sh)
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     install -m755 slog.sh $out/bin
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "POSIX shell logging";
     license = licenses.mit;
   };
diff --git a/krebs/5pkgs/simple/ssh-audit.nix b/krebs/5pkgs/simple/ssh-audit.nix
index 7d2e6fb34..4574eb644 100644
--- a/krebs/5pkgs/simple/ssh-audit.nix
+++ b/krebs/5pkgs/simple/ssh-audit.nix
@@ -1,4 +1,4 @@
-{ fetchFromGitHub, python3Packages, stdenv }:
+{ fetchFromGitHub, lib, python3Packages, stdenv }:
 
 python3Packages.buildPythonPackage rec {
   inherit (meta) version;
@@ -46,9 +46,9 @@ python3Packages.buildPythonPackage rec {
   meta = {
     description = "tool for ssh server auditing";
     homepage = "https://github.com/arthepsy/ssh-audit";
-    license = stdenv.lib.licenses.mit;
+    license = lib.licenses.mit;
     maintainers = [
-      stdenv.lib.maintainers.tv
+      lib.maintainers.tv
     ];
     version = "1.7.0";
   };
diff --git a/krebs/5pkgs/simple/tinc_graphs/default.nix b/krebs/5pkgs/simple/tinc_graphs/default.nix
index 025e85df0..d281c9b50 100644
--- a/krebs/5pkgs/simple/tinc_graphs/default.nix
+++ b/krebs/5pkgs/simple/tinc_graphs/default.nix
@@ -1,4 +1,4 @@
-{stdenv,fetchurl,pkgs,python3Packages, ... }:
+{ fetchurl, lib, pkgs, python3Packages, stdenv }:
 
 python3Packages.buildPythonPackage rec {
   name = "tinc_graphs-${version}";
@@ -22,7 +22,7 @@ python3Packages.buildPythonPackage rec {
   meta = {
     homepage = http://krebsco.de/;
     description = "Create Graphs from Tinc Stats";
-    license = stdenv.lib.licenses.wtfpl;
+    license = lib.licenses.wtfpl;
   };
 }
 
diff --git a/krebs/5pkgs/simple/translate-shell/default.nix b/krebs/5pkgs/simple/translate-shell/default.nix
index 00ab226e5..cd698a2bd 100644
--- a/krebs/5pkgs/simple/translate-shell/default.nix
+++ b/krebs/5pkgs/simple/translate-shell/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl,pkgs,... }:
+{ fetchurl, lib, pkgs, stdenv }:
 let
   s =
   rec {
@@ -8,7 +8,7 @@ let
     url=https://github.com/soimort/translate-shell/archive/v0.9.0.9.tar.gz;
     sha256="1269j4yr9dr1d8c5kmysbzfplbgdg8apqnzs5w57d29sd7gz2i34";
   };
-  searchpath = with pkgs; stdenv.lib.makeSearchPath "bin" [
+  searchpath = with pkgs; lib.makeSearchPath "bin" [
     fribidi
     gawk
     bash
@@ -35,9 +35,9 @@ stdenv.mkDerivation {
   meta = {
     inherit (s) version;
     description = ''translate using google api'';
-    license = stdenv.lib.licenses.free;
-    maintainers = [stdenv.lib.maintainers.makefu];
-    platforms = stdenv.lib.platforms.linux ;
+    license = lib.licenses.free;
+    maintainers = [ lib.maintainers.makefu ];
+    platforms = lib.platforms.linux ;
   };
 }
 
diff --git a/krebs/5pkgs/simple/whatsupnix/default.nix b/krebs/5pkgs/simple/whatsupnix/default.nix
index 62ef597c8..61972bb05 100644
--- a/krebs/5pkgs/simple/whatsupnix/default.nix
+++ b/krebs/5pkgs/simple/whatsupnix/default.nix
@@ -1,4 +1,6 @@
-{ bash, coreutils, gawk, makeWrapper, nix, openssh, stdenv }:
+{ lib, makeWrapper, stdenv
+, bash, coreutils, gawk, nix, openssh
+}:
 
 stdenv.mkDerivation {
   name = "whatsupnix";
@@ -8,7 +10,7 @@ stdenv.mkDerivation {
     mkdir -p $out/bin
     cat - ${./whatsupnix.bash} > $out/bin/whatsupnix <<\EOF
     #! ${bash}/bin/bash
-    export PATH=${stdenv.lib.makeBinPath [ coreutils gawk nix openssh ]}
+    export PATH=${lib.makeBinPath [ coreutils gawk nix openssh ]}
     EOF
     chmod +x $out/bin/whatsupnix
   '';
diff --git a/krebs/5pkgs/test/infest-cac-centos7/default.nix b/krebs/5pkgs/test/infest-cac-centos7/default.nix
index 9b14bf486..c3fc0ee2b 100644
--- a/krebs/5pkgs/test/infest-cac-centos7/default.nix
+++ b/krebs/5pkgs/test/infest-cac-centos7/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, coreutils, makeWrapper,
-  cac-api, cac-cert, cac-panel, gnumake, gnused, jq, openssh, sshpass, proot,
-  ... }:
+{ lib, makeWrapper, stdenv
+, cac-api, cac-cert, cac-panel, coreutils, gnumake, gnused, jq, openssh, proot, sshpass
+}:
 
 stdenv.mkDerivation rec {
   name = "${shortname}-${version}";
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ makeWrapper ];
 
-  path = stdenv.lib.makeSearchPath "bin" [
+  path = lib.makeSearchPath "bin" [
     coreutils
     cac-api
     cac-panel
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
         --set REQUESTS_CA_BUNDLE ${cac-cert} \
         --set SSL_CERT_FILE ${cac-cert}
   '';
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://krebsco.de;
     description = "infest a CaC box with stockholm";
     license = licenses.wtfpl;
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 07e7ff11d..19e191b7b 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -38,7 +38,6 @@ with import <stockholm/lib>;
     }
     {
       i18n.defaultLocale = mkDefault "C.UTF-8";
-      security.hideProcessInformation = true;
       security.sudo.extraConfig = ''
         Defaults env_keep+="SSH_CLIENT XMONAD_SPAWN_WORKSPACE"
         Defaults mailto="${config.krebs.users.tv.mail}"
diff --git a/tv/2configs/gitrepos.nix b/tv/2configs/gitrepos.nix
index 2e73640ff..1586f3b33 100644
--- a/tv/2configs/gitrepos.nix
+++ b/tv/2configs/gitrepos.nix
@@ -33,7 +33,7 @@ let {
       cgit = {
         settings = {
           about-filter = pkgs.exec "krebs.cgit.about-filter" rec {
-            filename = "${pkgs.pythonPackages.markdown2}/bin/markdown2";
+            filename = "${pkgs.python3Packages.markdown2}/bin/markdown2";
             argv = [
               filename
               "--extras=fenced-code-blocks"
diff --git a/tv/2configs/pulse.nix b/tv/2configs/pulse.nix
index 79c31e9ec..f720ad473 100644
--- a/tv/2configs/pulse.nix
+++ b/tv/2configs/pulse.nix
@@ -116,6 +116,7 @@ in
       group = "pulse";
       extraGroups = [ "audio" ];
       home = "${runDir}/home";
+      isSystemUser = true;
     };
   };
 }
diff --git a/tv/5pkgs/override/default.nix b/tv/5pkgs/override/default.nix
index e6aae0f26..4fb2e8061 100644
--- a/tv/5pkgs/override/default.nix
+++ b/tv/5pkgs/override/default.nix
@@ -4,14 +4,16 @@ self: super: {
     # XXX cannot use `patches` because fzf has a custom patchPhase
     patchPhase = ''
       patch -Np1 < ${./f