6 files changed, 9 insertions, 16 deletions
diff --git a/ops/machines/whitby/default.nix b/ops/machines/whitby/default.nix
index 3dd081f4cf..6d338c369f 100644
--- a/ops/machines/whitby/default.nix
+++ b/ops/machines/whitby/default.nix
@@ -595,7 +595,7 @@ in {
     groups.git = {};
     users.git = {
       group = "git";
-      isNormalUser = false;
+      isSystemUser = true;
       createHome = true;
       home = "/var/lib/git";
     };
diff --git a/ops/modules/clbot.nix b/ops/modules/clbot.nix
index ad33e25a4d..71ff2fbc32 100644
--- a/ops/modules/clbot.nix
+++ b/ops/modules/clbot.nix
@@ -66,7 +66,7 @@ in {
 
       users.clbot = {
         group = "clbot";
-        isNormalUser = false;
+        isSystemUser = true;
       };
     };
 
diff --git a/ops/modules/quassel.nix b/ops/modules/quassel.nix
index df26a39455..9c8692629a 100644
--- a/ops/modules/quassel.nix
+++ b/ops/modules/quassel.nix
@@ -66,7 +66,7 @@ in {
 
     users = {
       users.quassel = {
-        isNormalUser = false;
+        isSystemUser = true;
         group = "quassel";
       };
 
diff --git a/ops/modules/tvl-buildkite.nix b/ops/modules/tvl-buildkite.nix
index 2aa3b81811..05a5e9b5e7 100644
--- a/ops/modules/tvl-buildkite.nix
+++ b/ops/modules/tvl-buildkite.nix
@@ -39,6 +39,7 @@ in {
       users = builtins.listToAttrs (map (n: rec {
         name = "buildkite-agent-whitby-${toString n}";
         value = {
+          isSystemUser = true;
           group = lib.mkForce "buildkite-agents";
           extraGroups = [ name ];
         };
diff --git a/ops/modules/tvl-slapd/default.nix b/ops/modules/tvl-slapd/default.nix
index cbfdeff31e..dbcf139338 100644
--- a/ops/modules/tvl-slapd/default.nix
+++ b/ops/modules/tvl-slapd/default.nix
@@ -27,17 +27,6 @@ let
   inherit (depot.ops) users;
 
 in {
-  # Use our patched OpenLDAP derivation which enables stronger password hashing.
-  #
-  # Unfortunately the module for OpenLDAP has no package option, so we
-  # need to override it system-wide. Be aware that this triggers a
-  # *large* number of rebuilds of packages such as GPG and Python.
-  nixpkgs.overlays = [
-    (_: _: {
-      inherit (depot.third_party) openldap;
-    })
-  ];
-
   services.openldap = {
     enable = true;
 
@@ -58,7 +47,7 @@ in {
       };
 
       "cn=schema".includes =
-        map (schema: "${depot.third_party.openldap}/etc/schema/${schema}.ldif")
+        map (schema: "${pkgs.openldap}/etc/schema/${schema}.ldif")
             [ "core" "cosine" "inetorgperson" "nis" ];
     };
 
diff --git a/ops/modules/tvl-sso/default.nix b/ops/modules/tvl-sso/default.nix
index 8e33c708b7..d026c1e7c9 100644
--- a/ops/modules/tvl-sso/default.nix
+++ b/ops/modules/tvl-sso/default.nix
@@ -18,7 +18,10 @@ in {
         Restart = "always";
       };
     };
-    users.users.apereo-cas = {};
+    users.users.apereo-cas = {
+      isSystemUser = true;
+      group = "apereo-cas";
+    };
     users.groups.apereo-cas = {};
   };
 }