Move more host tooling to Nix

17 files changed, 17 insertions, 17 deletions

diff --git a/dot_config/waybar/executable_arch-audit-status.sh b/dot_config/waybar/executable_arch-audit-status.sh
index 73edf6f..3c25c18 100755
--- a/dot_config/waybar/executable_arch-audit-status.sh
+++ b/dot_config/waybar/executable_arch-audit-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Waybar custom/arch-audit: shows count of installed packages with known
 # CVEs that already have a fix available in the repos. Source of truth
 # is /run/arch-audit.txt, refreshed daily by arch-audit.timer (system
diff --git a/dot_config/waybar/executable_clip-picker.sh b/dot_config/waybar/executable_clip-picker.sh
index d7f5b61..c94e3de 100644
--- a/dot_config/waybar/executable_clip-picker.sh
+++ b/dot_config/waybar/executable_clip-picker.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Clipboard picker on top of cliphist + wofi (vim-nav, hide-search,
 # Alt-d to delete the highlighted entry).
 #
diff --git a/dot_config/waybar/executable_dock-status.sh b/dot_config/waybar/executable_dock-status.sh
index b8093fb..ca6d031 100644
--- a/dot_config/waybar/executable_dock-status.sh
+++ b/dot_config/waybar/executable_dock-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Detect a Lenovo ThinkPad USB-C Dock Gen2 by its distinctive built-in
 # ethernet adapter (17ef:a387). The dock's USB hubs share product IDs
 # with internal ThinkPad hubs on some models, but the ethernet is only
diff --git a/dot_config/waybar/executable_failed-units-status.sh b/dot_config/waybar/executable_failed-units-status.sh
index da7db49..9066904 100755
--- a/dot_config/waybar/executable_failed-units-status.sh
+++ b/dot_config/waybar/executable_failed-units-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Waybar custom/failed-units: shows count of failed systemd units across
 # the system bus and the current user's session bus. Hidden when zero.
 # Mako fires only on transition upward (count went up since last check),
diff --git a/dot_config/waybar/executable_lostfiles-status.sh b/dot_config/waybar/executable_lostfiles-status.sh
index f5f1099..be1adae 100755
--- a/dot_config/waybar/executable_lostfiles-status.sh
+++ b/dot_config/waybar/executable_lostfiles-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Waybar custom/lostfiles: shows count of filesystem entries not owned
 # by any pacman package (and not on lostfiles' built-in safe-list).
 # Source of truth is /run/lostfiles.txt, refreshed weekly by
diff --git a/dot_config/waybar/executable_mako-status.sh b/dot_config/waybar/executable_mako-status.sh
index 4e9f053..bab3765 100644
--- a/dot_config/waybar/executable_mako-status.sh
+++ b/dot_config/waybar/executable_mako-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Waybar status: count of currently-visible mako notifications. With
 # default-timeout=0 in mako/config, "visible" == "pending"; once a
 # notification is dismissed it's gone and never comes back.
diff --git a/dot_config/waybar/executable_memory-status.sh b/dot_config/waybar/executable_memory-status.sh
index 33ccc04..5b19ca5 100755
--- a/dot_config/waybar/executable_memory-status.sh
+++ b/dot_config/waybar/executable_memory-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Emit waybar JSON with memory usage. Used% uses a heat scale (green → red),
 # available% uses the inverse (red → green). Values embedded via Pango span.
 set -eu
diff --git a/dot_config/waybar/executable_pacdiff-status.sh b/dot_config/waybar/executable_pacdiff-status.sh
index c9278d2..92eb6a8 100755
--- a/dot_config/waybar/executable_pacdiff-status.sh
+++ b/dot_config/waybar/executable_pacdiff-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Waybar custom/pacdiff: shows count of unresolved .pacnew/.pacsave files.
 # Source of truth is `pacdiff -o` (output mode — lists differing files,
 # does nothing). Hidden when zero. Mako fires once when the count goes
diff --git a/dot_config/waybar/executable_snx-vpn-status.sh b/dot_config/waybar/executable_snx-vpn-status.sh
index 9088630..f88c3a0 100644
--- a/dot_config/waybar/executable_snx-vpn-status.sh
+++ b/dot_config/waybar/executable_snx-vpn-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Waybar custom/snx-vpn module: report the snx-rs (Check Point) tunnel
 # state. `snxctl status` is fast (talks over a local UDS to the daemon)
 # but might briefly stall during connect; cap it with `timeout`.
diff --git a/dot_config/waybar/executable_snx-vpn-toggle.sh b/dot_config/waybar/executable_snx-vpn-toggle.sh
index c21643b..80ced4c 100644
--- a/dot_config/waybar/executable_snx-vpn-toggle.sh
+++ b/dot_config/waybar/executable_snx-vpn-toggle.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Toggle the snx-rs (Check Point) tunnel.
 #
 # Refresh the waybar custom/snx-vpn module immediately with SIGRTMIN+9.
diff --git a/dot_config/waybar/executable_tb-unread.sh b/dot_config/waybar/executable_tb-unread.sh
index 200cb70..b969215 100644
--- a/dot_config/waybar/executable_tb-unread.sh
+++ b/dot_config/waybar/executable_tb-unread.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Emit waybar JSON with the count of unread messages in the protonmail-bridge
 # IMAP Inbox. Requires bridge credentials in `pass` at the paths below; the
 # bridge prints them via `protonmail-bridge --cli` → `info`.
diff --git a/dot_config/waybar/executable_update-status.sh b/dot_config/waybar/executable_update-status.sh
index 2317256..cbd899e 100755
--- a/dot_config/waybar/executable_update-status.sh
+++ b/dot_config/waybar/executable_update-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Waybar custom/update: gentle reminder that the system hasn't been
 # upgraded recently. Source of truth is /var/log/pacman.log — the last
 # "[PACMAN] starting full system upgrade" entry. No daemon, no -Sy
diff --git a/dot_config/waybar/executable_vpn-status.sh b/dot_config/waybar/executable_vpn-status.sh
index 3e6faba..9a5016f 100644
--- a/dot_config/waybar/executable_vpn-status.sh
+++ b/dot_config/waybar/executable_vpn-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Waybar custom/vpn module: report whether the wireguard interface
 # (managed by systemd-networkd) is admin-up. Pango markup makes the
 # state visually unambiguous (green shield up, red strikethrough down)
diff --git a/dot_config/waybar/executable_vpn-toggle.sh b/dot_config/waybar/executable_vpn-toggle.sh
index c348971..1a996df 100644
--- a/dot_config/waybar/executable_vpn-toggle.sh
+++ b/dot_config/waybar/executable_vpn-toggle.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Toggle the wireguard interface managed by systemd-networkd. Polkit
 # rule (etc/polkit-1/rules.d/50-networkd-wheel.rules) lets wheel-group
 # members invoke networkctl up/down without a password prompt.
diff --git a/dot_config/waybar/executable_webcam-status.sh b/dot_config/waybar/executable_webcam-status.sh
index 2441039..be78774 100644
--- a/dot_config/waybar/executable_webcam-status.sh
+++ b/dot_config/waybar/executable_webcam-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Emit waybar JSON when any /dev/video* device is held open by a process.
 # V4L2 capture (firefox, zoom, OBS, etc.) doesn't go through PipeWire's
 # privacy portal, so the built-in waybar privacy module never sees it.
diff --git a/dot_config/waybar/executable_wifi-status.sh b/dot_config/waybar/executable_wifi-status.sh
index 93b3048..2b3201b 100755
--- a/dot_config/waybar/executable_wifi-status.sh
+++ b/dot_config/waybar/executable_wifi-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Emit waybar JSON describing wifi link state.
 #
 # Uses iwd's D-Bus API for state + SSID (net.connman.iwd is a documented,
diff --git a/dot_config/waybar/executable_wifi-toggle.sh b/dot_config/waybar/executable_wifi-toggle.sh
index 2eb27bc..e57f11f 100644
--- a/dot_config/waybar/executable_wifi-toggle.sh
+++ b/dot_config/waybar/executable_wifi-toggle.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Toggle wifi (wlan0) Powered state via iwd's D-Bus API. Driven by waybar
 # on-click on the custom/wifi module.
 set -eu