panoptikon: do not fail on diff

this was a weird one

modules/panoptikon.nix

@@ -79,30 +79,9 @@
       cfg.watchers;
 
       systemd.services =
-        {
+        lib.attrsets.mapAttrs' (watcherName: watcherOptions:
-          setup-panoptikon = {
-            enable = true;
-            wantedBy = ["multi-user.target"];
-            serviceConfig = {
-              Type = "oneshot";
-              User = "panoptikon";
-              Group = "panoptikon";
-              WorkingDirectory = "/var/lib/panoptikon";
-              Restart = "on-failure";
-              StartLimitBurst = 5;
-              RestartSec = 30;
-            };
-            script = ''
-              ${pkgs.git}/bin/git init --quiet
-              ${pkgs.git}/bin/git config user.email "panoptikon@${config.networking.hostName}"
-              ${pkgs.git}/bin/git config user.name Panoptikon
-            '';
-          };
-        }
-        // lib.attrsets.mapAttrs' (watcherName: watcherOptions:
           lib.nameValuePair "panoptikon-${watcherName}" {
             enable = true;
-            after = ["setup-panoptikon.service"];
             startAt = watcherOptions.frequency;
             serviceConfig = {
               Type = "oneshot";
@@ -120,20 +99,14 @@
             environment.PANOPTIKON_WATCHER = watcherName;
             wants = ["network-online.target"];
             script = ''
-              set -efu
+              set -fux
-
+              ${watcherOptions.script} > ${lib.escapeShellArg watcherName}
-              ${watcherOptions.script} > ${watcherName}
+              diff_output=$(${pkgs.diffutils}/bin/diff --new-file ${lib.escapeShellArg (watcherName + ".old")} ${lib.escapeShellArg watcherName} || :)
-
+              if [ -n "$diff_output" ]
-              diff_output=$(${pkgs.diffutils}/bin/diff --new-file ${watcherName}.old ${watcherName})
+              then
-
+                ${lib.strings.concatMapStringsSep "\n" (reporter: ''echo "$diff_output" | ${reporter} || :'') watcherOptions.reporters}
-              if [ -n "$diff_output" ]; then
-                ${lib.strings.concatMapStringsSep "\n" (reporter: ''
-                  echo "$diff_output" | ${reporter}
-                '') watcherOptions.reporters}
-                :
               fi
-
+              mv ${lib.escapeShellArg watcherName} ${lib.escapeShellArg (watcherName + ".old")}
-              mv ${watcherName} ${watcherName}.old
             '';
           })
         cfg.watchers;