turns out there is a string-slicing function, I just overlooked it when writing this file (it's even a builtin). So let's use that instead.
move the monit config out of mail.nix, and add two checks: - has any systemd unit failed? - is the currently deployed commit the tip of the main branch of haccfiles?
