From cd7305394491c4506bc15395a68d7437c4952514 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 21 Dec 2021 12:48:51 +0100
Subject: [PATCH 1/2] tv vim: admit nftables

---
 tv/2configs/vim.nix  | 1 +
 tv/5pkgs/vim/nix.nix | 1 +
 2 files changed, 2 insertions(+)

diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index c0125ecfa..fed74c921 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -25,6 +25,7 @@ let {
     pkgs.tv.vimPlugins.vim
     pkgs.vimPlugins.fzfWrapper
     pkgs.vimPlugins.undotree
+    pkgs.vimPlugins.vim-nftables
   ];
 
   dirs = {
diff --git a/tv/5pkgs/vim/nix.nix b/tv/5pkgs/vim/nix.nix
index c121d815f..6715af737 100644
--- a/tv/5pkgs/vim/nix.nix
+++ b/tv/5pkgs/vim/nix.nix
@@ -136,6 +136,7 @@ with import <stockholm/lib>;
       javascript.extraStart = comment "js";
       lua = {};
       markdown.extraStart = writerExt "md";
+      nftables = {};
       #nginx = {};
       python.extraStart = alts [
         (comment "py")

From e888b00a6bd600fedbd58c06934af8d5deeb35a2 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 21 Dec 2021 15:27:44 +0100
Subject: [PATCH 2/2] secret service: don't be wanted by multi-user.target

This fixes an issue causing secret-trigger-*.service to be restarted on
every activation because after triggering these services are dead, this
in turn causes restarts of secret-*.service.

And finally this caused the issue of always restarting tinc services
as they are PartOf= a couple of secert-*.service.
---
 krebs/3modules/secret.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/krebs/3modules/secret.nix b/krebs/3modules/secret.nix
index 978939f69..0c5e1cdcd 100644
--- a/krebs/3modules/secret.nix
+++ b/krebs/3modules/secret.nix
@@ -27,7 +27,6 @@ in {
     systemd.services =
       mapAttrs'
         (name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
-          wantedBy = ["multi-user.target"];
           serviceConfig = {
             Type = "oneshot";
             ExecStart = "${pkgs.systemd}/bin/systemctl restart ${shell.escape file.service}";