diff --git a/scripts/1clickservice.groovy b/scripts/1clickservice.groovy
index 14e0393..10f521e 100644
--- a/scripts/1clickservice.groovy
+++ b/scripts/1clickservice.groovy
@@ -90,61 +90,68 @@ pipeline {
                         done
                     """ 
                 }
-                sshagent(['f42347e9-e3b5-44af-a1af-c5e7b9775fee']) {
-                    sh """
-                        git clone 'ssh://git@gitea.arg.rip:8022/greyn/${servicename}.git'
-                        pushd ${servicename}
+                withCredentials([sshUserPrivateKey(credentialsId: 'f42347e9-e3b5-44af-a1af-c5e7b9775fee', keyFileVariable: 'PK')]) {
+                    sh """#!/bin/bash
 
-                        dbstartline=\$(sed -n '/---dbstart---]/=' Jenkinsfile)
-                        dbendline=\$(sed -n '/---dbend---/=' Jenkinsfile)
+                        #mkdir -p ~/.ssh
+                        #ssh-keyscan -t ed25519 gitea.arg.rip >> ~/.ssh/known_hosts
+                        #cat ~/.ssh/known_hosts
+                        #shit doesn't work. ssh in, git clone, get your shit set up for keys.
+                        git -c core.sshCommand="ssh -i '$PK'\" clone ssh://git@gitea.arg.rip:8022/greyn/${servicename}.git
+                        #fyi, future me: pushd is useless here, it pops out. Like it's loading a script and exiting.
                     """
                     script { //there's no "if" "step" so any "if" must be in a "script" step
-                        if(params.database){
-                            sh """
-                                sed -i -e '${dbstartline}d;${dbendline}d;' Jenkinsfile
+                        if(database){
+                            sh """#!/bin/bash
+                                pushd ${servicename}
+                                dbstartline=\$(sed -n '/---dbstart---/=' Jenkinsfile)
+                                dbendline=\$(sed -n '/---dbend---/=' Jenkinsfile)
+                                echo \"yes db\"
+                                sed -i -e '\${dbstartline}d;\${dbendline}d;' Jenkinsfile
 
                                 databasecredsid=\$(uuidgen)
 
-                                CRUMB=\$(curl -s 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,":",//crumb)')
-                                echo $CRUMB
-                                curl -H $CRUMB -X POST 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/job/gitea.arg.rip/job/${servicename}/credentials/store/folder/domain/greyn%20services/createCredentials' \
+                                CRUMB=\$(curl -s \"http://${env.JENKINS_USR}:'${env.JENKINS_PSW}'@alloces.lan:8080/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,\":\",//crumb)\")
+                                echo \$CRUMB
+                                curl -H \$CRUMB -X POST \"http://${env.JENKINS_USR}:'${env.JENKINS_PSW}\'@alloces.lan:8080/job/gitea.arg.rip/job/${servicename}/credentials/store/folder/domain/greyn%20services/createCredentials' \
                                 --data-urlencode 'json={
                                   "": "0",
                                   "credentials": {
                                     "scope": "GLOBAL",
-                                    "id": "$databasecredsid",
+                                    "id": "\$databasecredsid",
                                     "secret": "Host=${targetHost};Database=${servicename};Username=${servicename};Password=${env.pw_productiondatabase};IncludeErrorDetail=true;",
                                     "description": "database connection string",
                                     "\$class": "com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl"
                                   }
                                 }'
-                                sed -i 's/productiondatabase_connectionString=creds/productiondatabase_connectionString=credentials('$databasecredsid')/' Jenkinsfile
+                                sed -i 's/productiondatabase_connectionString=creds/productiondatabase_connectionString=credentials('\$databasecredsid')/' Jenkinsfile
 
                                 git add .
                                 git commit -m "set up for database"
                             """
                         }
                         else{
-                            sh """
-                                sed -i -e '${dbstartline},${dbendline}d;' Jenkinsfile
+                            sh """#!/bin/bash
+                                echo \"no db\"
+                                pushd ${servicename}
+                                sed -i -e '\${dbstartline},\${dbendline}d;' Jenkinsfile
                                 git add .
                                 git commit -m "stripped database lines"
                             """
                         }
                     
                         sh """
-                            popd
 
-                            env.usernameCredsId=\$(uuidgen)
+                            usernameCredsId=\$(uuidgen)
 
-                            CRUMB=\$(curl -s 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,":",//crumb)')
-                            echo $CRUMB
-                            curl -H $CRUMB -X POST 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/job/gitea.arg.rip/job/${servicename}/credentials/store/folder/domain/greyn%20services/createCredentials' \
+                            CRUMB=\$(curl 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,":",//crumb)')
+                            echo \$CRUMB
+                            curl -H \$CRUMB -X POST 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/job/gitea.arg.rip/job/${servicename}/credentials/store/folder/domain/greyn%20services/createCredentials' \
                             --data-urlencode 'json={
                               "": "0",
                               "credentials": {
                                 "scope": "GLOBAL",
-                                "id": "$env.usernameCredsId",
+                                "id": "\$usernameCredsId",
                                 "username": "${servicename}",
                                 "password": "${env.pw_linuxserviceaccount}",
                                 "description": "service account login",
@@ -159,18 +166,18 @@ pipeline {
                             privatekeycontent=\$(cat ${servicename}))
                             pubkeycontent=\$(cat ${servicename}.pub))
                             CRUMB=\$(url -s 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,":",//crumb)')
-                            echo $CRUMB
-                            curl -H $CRUMB -X POST 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/job/gitea.arg.rip/job/${servicename}/credentials/store/folder/domain/greyn%20services/createCredentials' \
+                            echo \$CRUMB
+                            curl -H \$CRUMB -X POST 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/job/gitea.arg.rip/job/${servicename}/credentials/store/folder/domain/greyn%20services/createCredentials' \
                             --data-urlencode 'json={
                               "": "0",
                               "credentials": {
                                 "scope": "GLOBAL",
-                                "id": "$env.usernameCredsId",
+                                "id": "\$usernameCredsId",
                                 "username": "${servicename}",
                                 "password": "",
                                 "privateKeySource": {
-                                    "stapler-class": "com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey$DirectEntryPrivateKeySource",
-                                      "privateKey": "$privatekeycontent",
+                                    "stapler-class": "com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey\$DirectEntryPrivateKeySource",
+                                      "privateKey": "\$privatekeycontent",
                                     },
                                     "description": "${servicename}",
                                     "stapler-class": "com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey"
@@ -199,15 +206,15 @@ pipeline {
                     sshagent([SUDOERSSH]) 
                     {
                         sh """ssh -tt ${SUDOER_USR}@${targetHost} username=${servicename} password=${env.pw_linuxserviceaccount} pubkeycontent=${env.pubkeycontent} 'echo "$SUDOER_PSW" | sudo -Sv && bash -s' << 'ENDSSH'
-                            useradd -m -s /bin/bash $username
-                            echo "$username:$password" | chpasswd
-                            loginctl enable-linger $username
-                            cd ~/home/$username
+                            useradd -m -s /bin/bash \$username
+                            echo "\$username:\$password" | chpasswd
+                            loginctl enable-linger \$username
+                            cd ~/home/\$username
                             mkdir .ssh
                             pushd .ssh
-                            echo $pubkeycontent > authorized_keys
+                            echo \$pubkeycontent > authorized_keys
                             popd
-                            chown -R $username:$username .ssh
+                            chown -R \$username:\$username .ssh
                         ENDSSH
                         """
                     }
@@ -231,9 +238,9 @@ pipeline {
                             
                             service_dev="${servicename}_dev"
                             sudo -u postgres psql && bash -s << 'ENDPSQL'
-                                create database $service_dev;
-                                create user $service_dev with encrypted password '$pw_developmentdatabase';
-                                grant all privileges on database $service_dev to $service_dev;
+                                create database \$service_dev;
+                                create user \$service_dev with encrypted password '\$pw_developmentdatabase';
+                                grant all privileges on database \$service_dev to \$service_dev;
                             ENDPSQL
                     
                         ENDSSH"""
@@ -245,11 +252,11 @@ pipeline {
             steps{
                 sshagent([SUDOERSSH])
                 {
-                    sh 'scp $servicename.service $servicename@${targetHost}:~/.config/systemd/user/$servicename.service'
-                    sh """ssh -tt SUDOER_USR@${targetHost} servicename=$servicename pw_productiondatabase=${env.pw_productiondatabase} pw_developmentdatabase=${env.pw_developmentdatabase} 'echo "$SUDOER_PSW" | sudo -Sv && bash -s' << 'ENDSSH'
+                    sh 'scp ${servicename}.service ${servicename}@${targetHost}:~/.config/systemd/user/${servicename}.service'
+                    sh """ssh -tt $SUDOER_USR@${targetHost} servicename=${servicename} pw_productiondatabase=${env.pw_productiondatabase} pw_developmentdatabase=${env.pw_developmentdatabase} 'echo "$SUDOER_PSW" | sudo -Sv && bash -s' << 'ENDSSH'
                         sudo -u ${servicename} && bash -s << 'ENDASSERVICE'
                             systemctl --user daemon-reload
-                            systemctl --user enable $servicename.service
+                            systemctl --user enable ${servicename}.service
                         ENDASSERVICE
                     ENDSSH"""
                 }