diff --git a/backupninja/client.sls b/backupninja/client.sls
index 451542a..2cac2b2 100644
--- a/backupninja/client.sls
+++ b/backupninja/client.sls
@@ -112,8 +112,7 @@
   file.managed:
   - name: /usr/local/sbin/duplicity_salt.sh
   - source: salt://backupninja/files/duplicity_salt.sh
-  - template: jinja
-  - mode: 700
+  - mode: 755
   - user: root
   - group: root
   - require:
diff --git a/backupninja/files/duplicity_salt.sh b/backupninja/files/duplicity_salt.sh
index 0317847..a03e792 100644
--- a/backupninja/files/duplicity_salt.sh
+++ b/backupninja/files/duplicity_salt.sh
@@ -1,12 +1,11 @@
-{%- from "backupninja/map.jinja" import client, service_grains with context -%}
 #!/bin/bash
 
 if [ $EUID -ne 0 ]; then
     exec /usr/bin/sudo $0 $*
 fi
 
-DUPLICITY_ARGS="--no-encryption --progress --ssl-cacert-file={{ client.cacert_file }}"
-BACKUP_URL="{{ client.target.url }}"
+DUPLICITY_ARGS="--progress $(grep -E '^options\ ?=' /etc/backup.d/200.backup.dup |cut -d = -f 2)"
+BACKUP_URL="$(grep -E '^desturl\ ?=' /etc/backup.d/200.backup.dup |cut -d = -f 2)"
 
 while getopts :f:d:v: opt; do
     case "$opt" in
@@ -22,20 +21,12 @@
 
 action_prepare() {
     trap action_cleanup INT TERM EXIT
-    {%- if client.target.auth.gss is defined %}
-    kinit -kt {{ client.target.auth.gss.get("keytab", "/etc/krb5.keytab") }} {{ client.target.auth.gss.get("principal", "host/$(hostname -f)") }}
-    {%- else %}
-    return 0
-    {%- endif %}
+    [ -f /etc/backup.d/100.kinit.sh ] && . /etc/backup.d/100.kinit.sh
 }
 
 action_cleanup() {
     trap true INT TERM EXIT
-    {%- if client.target.auth.gss is defined %}
-    kdestroy || true
-    {%- else %}
-    return 0
-    {%- endif %}
+    [ -f /etc/backup.d/999.kdestroy.sh ] && . /etc/backup.d/999.kdestroy.sh
 }
 
 restore() {