Merge remote-tracking branch 'cd/master' into pre-merge

23 files changed, 97 insertions, 1476 deletions

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 126c6feb5..8c2a9ae43 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -4,23 +4,8 @@ with lib;
 
 {
   krebs.build.host = config.krebs.hosts.cd;
-  krebs.build.user = config.krebs.users.tv;
-
   krebs.build.target = "root@cd.internet";
 
-  krebs.build.source = {
-    git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
-    };
-    dir.secrets = {
-      path = "/home/tv/secrets/cd";
-    };
-    dir.stockholm = {
-      path = "/home/tv/stockholm";
-    };
-  };
-
   imports = [
     ../2configs/hw/CAC-Developer-2.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
@@ -115,7 +100,6 @@ with lib;
     iftop
     iotop
     iptables
-    mutt    # for mv
     nethogs
     ntp     # ntpate
     rxvt_unicode.terminfo
@@ -126,17 +110,4 @@ with lib;
     SystemMaxUse=1G
     RuntimeMaxUse=128M
   '';
-
-  users.extraUsers = {
-    mv = {
-      uid = 1338;
-      group = "users";
-      home = "/home/mv";
-      createHome = true;
-      useDefaultShell = true;
-      openssh.authorizedKeys.keys = [
-        config.krebs.users.mv.pubkey
-      ];
-    };
-  };
 }
diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix
index 55d83f8f3..9d8a0bcfa 100644
--- a/tv/1systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -17,23 +17,8 @@ in
 
 {
   krebs.build.host = config.krebs.hosts.mkdir;
-  krebs.build.user = config.krebs.users.tv;
-
   krebs.build.target = "root@${primary-addr4}";
 
-  krebs.build.source = {
-    git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
-    };
-    dir.secrets = {
-      path = "/home/tv/secrets/mkdir";
-    };
-    dir.stockholm = {
-      path = "/home/tv/stockholm";
-    };
-  };
-
   imports = [
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index c2bb4dc78..0c6c935a3 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -4,23 +4,9 @@ with lib;
 
 {
   krebs.build.host = config.krebs.hosts.nomic;
-  krebs.build.user = config.krebs.users.tv;
 
   krebs.build.target = "root@nomic.gg23";
 
-  krebs.build.source = {
-    git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
-    };
-    dir.secrets = {
-      path = "/home/tv/secrets/nomic";
-    };
-    dir.stockholm = {
-      path = "/home/tv/stockholm";
-    };
-  };
-
   imports = [
     ../2configs/hw/AO753.nix
     #../2configs/consul-server.nix
diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix
index 53f14d7df..1f1d975c9 100644
--- a/tv/1systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -17,23 +17,9 @@ in
 
 {
   krebs.build.host = config.krebs.hosts.rmdir;
-  krebs.build.user = config.krebs.users.tv;
 
   krebs.build.target = "root@rmdir.internet";
 
-  krebs.build.source = {
-    git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
-    };
-    dir.secrets = {
-      path = "/home/tv/secrets/rmdir";
-    };
-    dir.stockholm = {
-      path = "/home/tv/stockholm";
-    };
-  };
-
   imports = [
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 33292c608..3fa5481e2 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -4,24 +4,6 @@ with lib;
 
 {
   krebs.build.host = config.krebs.hosts.wu;
-  krebs.build.user = config.krebs.users.tv;
-
-  krebs.build.target = "root@wu";
-
-  krebs.build.source = {
-    git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
-      target-path = "/var/src/nixpkgs";
-    };
-    dir.secrets = {
-      path = "/home/tv/secrets/wu";
-    };
-    dir.stockholm = {
-      path = "/home/tv/stockholm";
-      target-path = "/var/src/stockholm";
-    };
-  };
 
   imports = [
     ../2configs/hw/w110er.nix
@@ -29,7 +11,6 @@ with lib;
     ../2configs/git.nix
     ../2configs/mail-client.nix
     ../2configs/xserver
-    ../2configs/z.nix
     {
       environment.systemPackages = with pkgs; [
 
@@ -62,31 +43,24 @@ with lib;
         bind # dig
         cac
         dic
-        ff
         file
         get
-        gitAndTools.qgit
         gnupg21
         haskellPackages.hledger
         htop
         jq
         manpages
         mkpasswd
-        mpv
         netcat
         nix-repl
         nmap
         nq
         p7zip
-        pavucontrol
         posix_man_pages
-        pssh
         push
         qrencode
-        sxiv
         texLive
         tmux
-        zathura
 
         #ack
         #apache-httpd
@@ -145,6 +119,8 @@ with lib;
         #xkill
         #xl2tpd
         #xsel
+
+        unison
       ];
     }
     {
@@ -180,122 +156,6 @@ with lib;
         ];
       };
     }
-    {
-      users.extraGroups = {
-        tv.gid = 1337;
-        slaves.gid = 3799582008; # genid slaves
-      };
-
-      users.extraUsers =
-        mapAttrs (name: user@{ extraGroups ? [], ... }: user // {
-          inherit name;
-          home = "/home/${name}";
-          createHome = true;
-          useDefaultShell = true;
-          group = "tv";
-          extraGroups = ["slaves"] ++ extraGroups;
-        }) {
-          ff = {
-            uid = 13378001;
-            extraGroups = [
-              "audio"
-              "video"
-            ];
-          };
-
-          cr = {
-            uid = 13378002;
-            extraGroups = [
-              "audio"
-              "video"
-            ];
-          };
-
-          fa = {
-            uid = 2300001;
-          };
-
-          rl = {
-            uid = 2300002;
-          };
-
-          tief = {
-            uid = 2300702;
-          };
-
-          btc-bitcoind = {
-            uid = 2301001;
-          };
-
-          btc-electrum = {
-            uid = 2301002;
-          };
-
-          ltc-litecoind = {
-            uid = 2301101;
-          };
-
-          eth = {
-            uid = 2302001;
-          };
-
-          emse-hsdb = {
-            uid = 4200101;
-          };
-
-          wine = {
-            uid = 13370400;
-            extraGroups = [
-              "audio"
-              "video"
-            ];
-          };
-
-          df = {
-            uid = 13370401;
-            extraGroups = [
-              "audio"
-              "video"
-            ];
-          };
-
-          xr = {
-            uid = 13370061;
-            extraGroups = [
-              "audio"
-              "video"
-            ];
-          };
-
-          "23" = {
-            uid = 13370023;
-          };
-
-          electrum = {
-            uid = 13370102;
-          };
-
-          skype = {
-            uid = 6660001;
-            extraGroups = [
-              "audio"
-            ];
-          };
-
-          onion = {
-            uid = 6660010;
-          };
-        };
-
-      security.sudo.extraConfig =
-        let
-          isSlave = u: elem "slaves" u.extraGroups;
-          masterOf = u: u.group;
-          slaves = filterAttrs (_: isSlave) config.users.extraUsers;
-          toSudoers = u: "${masterOf u} ALL=(${u.name}) NOPASSWD: ALL";
-        in
-        concatMapStringsSep "\n" toSudoers (attrValues slaves);
-    }
   ];
 
   boot.initrd.luks = {
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 607f89aea..94656ab61 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -4,22 +4,9 @@ with lib;
 
 {
   krebs.build.host = config.krebs.hosts.xu;
-  krebs.build.user = config.krebs.users.tv;
 
-  krebs.build.target = "root@xu";
-
-  krebs.build.source = {
-    git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
-    };
-    dir.secrets = {
-      path = "/home/tv/secrets/xu";
-    };
-    dir.stockholm = {
-      path = "/home/tv/stockholm";
-    };
-  };
+  krebs.build.source.git.nixpkgs.rev =
+    "7ae05edcdd14f6ace83ead9bf0d114e97c89a83a";
 
   imports = [
     ../2configs/hw/x220.nix
@@ -27,7 +14,6 @@ with lib;
     ../2configs/git.nix
     ../2configs/mail-client.nix
     ../2configs/xserver
-    ../2configs/z.nix
     {
       environment.systemPackages = with pkgs; [
 
@@ -60,29 +46,23 @@ with lib;
         bind # dig
         #cac
         dic
-        ff
         file
-        gitAndTools.qgit  #xserver
         gnupg21
         haskellPackages.hledger
         htop
         jq
         manpages
         mkpasswd
-        mpv #xserver
         netcat
         nix-repl
         nmap
         nq
         p7zip
-        pavucontrol #xserver
+        pass
         posix_man_pages
-        #pssh
         qrencode
-        sxiv #xserver
         texLive
         tmux
-        zathura #xserver
 
         #ack
         #apache-httpd
@@ -140,6 +120,8 @@ with lib;
         #xkill
         #xl2tpd
         #xsel
+
+        unison
       ];
     }
     {
@@ -176,125 +158,6 @@ with lib;
         ];
       };
     }
-    {
-      users.extraGroups = {
-        tv.gid = 1337;
-        slaves.gid = 3799582008; # genid slaves
-      };
-
-      users.extraUsers =
-        mapAttrs (name: user@{ extraGroups ? [], ... }: user // {
-          inherit name;
-          home = "/home/${name}";
-          createHome = true;
-          useDefaultShell = true;
-          group = "tv";
-          extraGroups = ["slaves"] ++ extraGroups;
-        }) {
-          ff = {
-            uid = 13378001;
-            extraGroups = [
-              "audio"
-              "video"
-            ];
-          };
-
-          cr = {
-            uid = 13378002;
-            extraGroups = [
-              "audio"
-              "video"
-              "bumblebee"
-            ];
-          };
-
-          fa = {
-            uid = 2300001;
-          };
-
-          rl = {
-            uid = 2300002;
-          };
-
-          tief = {
-            uid = 2300702;
-          };
-
-          btc-bitcoind = {
-            uid = 2301001;
-          };
-
-          btc-electrum = {
-            uid = 2301002;
-          };
-
-          ltc-litecoind = {
-            uid = 2301101;
-          };
-
-          eth = {
-            uid = 2302001;
-          };
-
-          emse-hsdb = {
-            uid = 4200101;
-          };
-
-          wine = {
-            uid = 13370400;
-            extraGroups = [
-              "audio"
-              "video"
-              "bumblebee"
-            ];
-          };
-
-          df = {
-            uid = 13370401;
-            extraGroups = [
-              "audio"
-              "video"
-              "bumblebee"
-            ];
-          };
-
-          xr = {
-            uid = 13370061;
-            extraGroups = [
-              "audio"
-              "video"
-            ];
-          };
-
-          "23" = {
-            uid = 13370023;
-          };
-
-          electrum = {
-            uid = 13370102;
-          };
-
-          skype = {
-            uid = 6660001;
-            extraGroups = [
-              "audio"
-            ];
-          };
-
-          onion = {
-            uid = 6660010;
-          };
-        };
-
-      security.sudo.extraConfig =
-        let
-          isSlave = u: elem "slaves" u.extraGroups;
-          masterOf = u: u.group;
-          slaves = filterAttrs (_: isSlave) config.users.extraUsers;
-          toSudoers = u: "${masterOf u} ALL=(${u.name}) NOPASSWD: ALL";
-        in
-        concatMapStringsSep "\n" toSudoers (attrValues slaves);
-    }
   ];
 
   boot.initrd.luks = {
@@ -349,7 +212,6 @@ with lib;
 
   security.setuidPrograms = [
     "sendmail"  # for cron
-    #"slock"
   ];
 
   services.printing.enable = true;
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index d3f4eed0d..3400c13b6 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -5,9 +5,29 @@ with lib;
 {
   krebs.enable = true;
 
+  krebs.build = {
+    user = config.krebs.users.tv;
+    target = mkDefault "root@${config.krebs.build.host.name}";
+    source = {
+      git.nixpkgs = {
+        url = mkDefault https://github.com/NixOS/nixpkgs;
+        rev = mkDefault "c44a593aa43bba6a0708f6f36065a514a5110613";
+        target-path = mkDefault "/var/src/nixpkgs";
+      };
+      dir.secrets = {
+        path = mkDefault "/home/tv/secrets/${config.krebs.build.host.name}";
+      };
+      dir.stockholm = {
+        path = mkDefault "/home/tv/stockholm";
+        target-path = mkDefault "/var/src/stockholm";
+      };
+    };
+  };
+
   networking.hostName = config.krebs.build.host.name;
 
   imports = [
+    <secrets>
     ./vim.nix
     {
       # stockholm dependencies
@@ -16,40 +36,14 @@ with lib;
       ];
     }
     {
-      # TODO never put hashedPassword into the store
-      users.extraUsers =
-        mapAttrs (_: h: { hashedPassword = h; })
-                 (import <secrets/hashedPasswords.nix>);
-    }
-    {
-      users.groups.subusers.gid = 1093178926; # genid subusers
-    }
-    {
-      users.defaultUserShell = "/run/current-system/sw/bin/bash";
-      users.mutableUsers = false;
-    }
-    {
-      users.extraUsers = {
-        root = {
-          openssh.authorizedKeys.keys = [
-            config.krebs.users.tv.pubkey
-            config.krebs.users.tv_xu.pubkey
-          ];
-        };
-        tv = {
-          uid = 1337;
-          group = "users";
-          home = "/home/tv";
-          createHome = true;
-          useDefaultShell = true;
-          extraGroups = [
-            "audio"
-            "video"
-            "wheel"
-          ];
-          openssh.authorizedKeys.keys = [
-            config.krebs.users.tv.pubkey
-          ];
+      users = {
+        defaultUserShell = "/run/current-system/sw/bin/bash";
+        mutableUsers = false;
+        users = {
+          tv = {
+            isNormalUser = true;
+            uid = 1337;
+          };
         };
       };
     }
@@ -94,6 +88,21 @@ with lib;
         ls = "ls -h --color=auto --group-directories-first";
         dmesg = "dmesg -L --reltime";
         view = "vim -R";
+
+        reload = "systemctl reload";
+        restart = "systemctl restart";
+        start = "systemctl start";
+        status = "systemctl status";
+        stop = "systemctl stop";
+      };
+
+      environment.variables = {
+        NIX_PATH =
+          with config.krebs.build.source; with dir; with git;
+          mkForce (concatStringsSep ":" [
+            "nixpkgs=${nixpkgs.target-path}"
+            "secrets=${stockholm.target-path}/null"
+          ]);
       };
 
       programs.bash = {
@@ -164,5 +173,13 @@ with lib;
         "sendmail"  # for sudo
       ];
     }
+    {
+      systemd.tmpfiles.rules = let
+        forUsers = flip map users;
+        isUser = { group, ... }: hasSuffix "users" group;
+        users = filter isUser (mapAttrsToList (_: id) config.users.users);
+      in forUsers (u: "d /run/xdg/${u.name} 0700 ${u.name} ${u.group} -");
+      environment.variables.XDG_RUNTIME_DIR = "/run/xdg/$LOGNAME";
+    }
   ];
 }
diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix
index 2520da173..4387be36a 100644
--- a/tv/2configs/git.nix
+++ b/tv/2configs/git.nix
@@ -1,6 +1,7 @@
 { config, lib, pkgs, ... }:
 
-with import ../4lib { inherit lib pkgs; };
+with lib;
+
 let
 
   out = {
@@ -20,26 +21,22 @@ let
   rules = concatMap make-rules (attrValues repos);
 
   public-repos = mapAttrs make-public-repo ({
+  } // mapAttrValues (setAttr "section" "1. Miscellaneous") {
     cac = {
       desc = "CloudAtCost command line interface";
     };
-    cgserver = {};
-    crude-mail-setup = {};
-    dot-xmonad = {};
     get = {};
     hack = {};
     load-env = {};
     make-snapshot = {};
     much = {};
-    nixos-infest = {};
     nixpkgs = {};
-    painload = {};
     push = {};
     regfish = {};
     stockholm = {
       desc = "take all the computers hostage, they'll love you!";
     };
-  } // mapAttrs (_: repo: repo // { section = "Haskell libraries"; }) {
+  } // mapAttrValues (setAttr "section" "2. Haskell libraries") {
     blessings = {};
     mime = {};
     quipper = {};
@@ -47,6 +44,13 @@ let
     wai-middleware-time = {};
     web-routes-wai-custom = {};
     xintmap = {};
+    xmonad-stockholm = {};
+  } // mapAttrValues (setAttr "section" "3. Museum") {
+    cgserver = {};
+    crude-mail-setup = {};
+    dot-xmonad = {};
+    nixos-infest = {};
+    painload = {};
   });
 
   restricted-repos = mapAttrs make-restricted-repo (
@@ -63,7 +67,7 @@ let
     inherit name desc section;
     public = true;
     hooks = {
-      post-receive = git.irc-announce {
+      post-receive = pkgs.git-hooks.irc-announce {
         # TODO make nick = config.krebs.build.host.name the default
         nick = config.krebs.build.host.name;
         channel = "#retiolum";
@@ -82,7 +86,7 @@ let
     with git // config.krebs.users;
     repo:
       singleton {
-        user = tv;
+        user = [ tv tv_xu ];
         repo = [ repo ];
         perm = push "refs/*" [ non-fast-forward create delete merge ];
       } ++
diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index 04b1480c1..0822fb5bf 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -64,6 +64,10 @@ let
             \ | hi TrailingSpace ctermbg=88
             \ | hi Normal ctermfg=White
 
+    au BufRead,BufNewFile *.hs so ${pkgs.writeText "hs.vim" ''
+      syn region String start=+\[[^|]*|+ end=+|]+
+    ''}
+
     au BufRead,BufNewFile *.nix so ${pkgs.writeText "nix.vim" ''
       setf nix
       set isk=@,48-57,_,192-255,-,'
diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix
index df00203be..afc2d699c 100644
--- a/tv/2configs/xserver/default.nix
+++ b/tv/2configs/xserver/default.nix
@@ -34,7 +34,14 @@ let
     };
 
     environment.systemPackages = [
+      pkgs.ff
+      pkgs.gitAndTools.qgit
+      pkgs.mpv
+      pkgs.pavucontrol
       pkgs.slock
+      pkgs.sxiv
+      pkgs.xsel
+      pkgs.zathura
     ];
 
     security.setuidPrograms = [
diff --git a/tv/2configs/z.nix b/tv/2configs/z.nix
deleted file mode 100644
index e5494ecc9..000000000
--- a/tv/2configs/z.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-{
-  krebs.per-user.z.packages = [
-    (pkgs.writeScriptBin "cr" ''
-      #! /bin/sh
-      set -efu
-      export LC_TIME=de_DE.utf8
-      exec ${pkgs.chromium}/bin/chromium \
-          --ssl-version-min=tls1 \
-          --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \
-          --disk-cache-size=50000000 \
-          "%@"
-    '')
-  ];
-
-  programs.bash.interactiveShellInit = ''
-    case ''${XMONAD_SPAWN_WORKSPACE-} in
-      za|zh|zj|zs)
-        exec sudo -u z -i
-      ;;
-    esac
-  '';
-
-  security.sudo.extraConfig = "tv ALL=(z) NOPASSWD: ALL";
-
-  users.users.z = {
-    extraGroups = [
-      "audio"
-      "vboxusers"
-      "video"
-    ];
-    group = "subusers";
-    home = "/home/z";
-    uid = 3043726074; # genid z
-    useDefaultShell = true;
-  };
-}
diff --git a/tv/4lib/default.nix b/tv/4lib/default.nix
deleted file mode 100644
index c099eb733..000000000
--- a/tv/4lib/default.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ lib, pkgs, ... }:
-
-lib // rec {
-
-  git = import ./git.nix {
-    inherit lib pkgs;
-  };
-
-  # TODO deprecate shell-escape for lass
-  shell-escape = lib.shell.escape;
-}
diff --git a/tv/4lib/git.nix b/tv/4lib/git.nix
deleted file mode 100644
index d8827115a..000000000
--- a/tv/4lib/git.nix
+++ /dev/null
@@ -1,202 +0,0 @@
-{ lib, pkgs, ... }:
-
-let
-  inherit (lib) addNames escapeShellArg makeSearchPath optionalString;
-
-  commands = addNames {
-    git-receive-pack = {};
-    git-upload-pack = {};
-  };
-
-  receive-modes = addNames {
-    fast-forward = {};
-    non-fast-forward = {};
-    create = {};
-    delete = {};
-    merge = {}; # TODO implement in git.nix
-  };
-
-  permissions = {
-    fetch = {
-      allow-commands = [
-        commands.git-upload-pack
-      ];
-    };
-
-    push = ref: extra-modes: {
-      allow-commands = [
-        commands.git-receive-pack
-        commands.git-upload-pack
-      ];
-      allow-receive-ref = ref;
-      allow-receive-modes = [ receive-modes.fast-forward ] ++ extra-modes;
-    };
-  };
-
-  refs = {
-    master = "refs/heads/master";
-    all-heads = "refs/heads/*";
-  };
-
-  irc-announce-script = pkgs.writeScript "irc-announce-script" ''
-    #! /bin/sh
-    set -euf
-
-    export PATH=${makeSearchPath "bin" (with pkgs; [
-      coreutils
-      gawk
-      gnused
-      netcat
-      nettools
-    ])}
-
-    IRC_SERVER=$1
-    IRC_PORT=$2
-    IRC_NICK=$3$$
-    IRC_CHANNEL=$4
-    message=$5
-
-    export IRC_CHANNEL # for privmsg_cat
-
-    # echo2 and cat2 are used output to both, stdout and stderr
-    # This is used to see what we send to the irc server. (debug output)
-    echo2() { echo "$*"; echo "$*" >&2; }
-    cat2() { tee /dev/stderr; }
-
-    # privmsg_cat transforms stdin to a privmsg
-    privmsg_cat() { awk '{ print "PRIVMSG "ENVIRON["IRC_CHANNEL"]" :"$0 }'; }
-
-    # ircin is used to feed the output of netcat back to the "irc client"
-    # so we can implement expect-like behavior with sed^_^
-    # XXX mkselfdestructingtmpfifo would be nice instead of this cruft
-    tmpdir="$(mktemp -d irc-announce_XXXXXXXX)"
-    cd "$tmpdir"
-    mkfifo ircin
-    trap "
-      rm ircin
-      cd '$OLDPWD'
-      rmdir '$tmpdir'
-      trap - EXIT INT QUIT
-    " EXIT INT QUIT
-
-    {
-      echo2 "USER $LOGNAME 0 * :$LOGNAME@$(hostname)"
-      echo2 "NICK $IRC_NICK"
-
-      # wait for MODE message
-      sed -n '/^:[^ ]* MODE /q'
-
-      echo2 "JOIN $IRC_CHANNEL"
-
-      printf '%s' "$message" \
-        | privmsg_cat \
-        | cat2
-
-      echo2 "PART $IRC_CHANNEL"
-
-      # wait for PART confirmation
-      sed -n '/:'"$IRC_NICK"'![^ ]* PART /q'
-
-      echo2 'QUIT :Gone to have lunch'
-    } < ircin \
-      | nc "$IRC_SERVER" "$IRC_PORT" | tee -a ircin
-  '';
-
-  hooks = {
-    # TODO make this a package?
-    irc-announce = { nick, channel, server, port ? 6667, verbose ? false }: ''
-      #! /bin/sh
-      set -euf
-
-      export PATH=${makeSearchPath "bin" (with pkgs; [
-        coreutils
-        git
-        gnused
-      ])}
-
-      green()  { printf '\x0303,99%s\x0F' "$1"; }
-      red()    { printf '\x0304,99%s\x0F' "$1"; }
-      orange() { printf '\x0307,99%s\x0F' "$1"; }
-      pink()   { printf '\x0313,99%s\x0F' "$1"; }
-      gray()   { printf '\x0314,99%s\x0F' "$1"; }
-
-      unset message
-      add_message() {
-        message="''${message+$message
-      }$*"
-      }
-
-      nick=${escapeShellArg nick}
-      channel=${escapeShellArg channel}
-      server=${escapeShellArg server}
-      port=${toString port}
-
-      host=$nick
-      cgit_endpoint=http://cgit.$host
-
-      empty=0000000000000000000000000000000000000000
-
-      while read oldrev newrev ref; do
-
-        if [ $oldrev = $empty ]; then
-          receive_mode=create
-        elif [ $newrev = $empty ]; then
-          receive_mode=delete
-        elif [ "$(git merge-base $oldrev $newrev)" = $oldrev ]; then
-          receive_mode=fast-forward
-        else
-          receive_mode=non-fast-forward
-        fi
-
-        h=$(echo $ref | sed 's:^refs/heads/::')
-
-        # empty_tree=$(git hash-object -t tree /dev/null)
-        empty_tree=4b825dc6
-
-        id=$(echo $newrev | cut -b-7)
-        id2=$(echo $oldrev | cut -b-7)
-        if [ $newrev = $empty ]; then id=$empty_tree; fi
-        if [ $oldrev = $empty ]; then id2=$empty_tree; fi
-
-        case $receive_mode in
-          create)
-            link="$cgit_endpoint/$GIT_SSH_REPO/?h=$h"
-            ;;
-          delete)
-            link="$cgit_endpoint/$GIT_SSH_REPO/ ($h)"
-            ;;
-          fast-forward|non-fast-forward)
-            link="$cgit_endpoint/$GIT_S