diff --git a/flake.nix b/flake.nix index 0616971..ba463cd 100644 --- a/flake.nix +++ b/flake.nix @@ -105,6 +105,9 @@ system = "x86_64-linux"; specialArgs = {inherit inputs outputs;}; modules = [ + inputs.nixos-hardware.nixosModules.common-cpu-intel + inputs.sops-nix.nixosModules.sops + impermanence.nixosModules.impermanence ./machine/mini/configuration.nix ]; }; diff --git a/machine/mini/configuration.nix b/machine/mini/configuration.nix index 0653790..9af85cc 100755 --- a/machine/mini/configuration.nix +++ b/machine/mini/configuration.nix @@ -18,8 +18,6 @@ imports = [ ./hardware-configuration.nix - inputs.nixos-hardware.nixosModules.common-cpu-intel - inputs.sops-nix.nixosModules.sops ../../configs/docker.nix ../../configs/common.nix ../../configs/user.nix @@ -59,7 +57,73 @@ efi.canTouchEfiVariables = true; }; - extraModulePackages = with pkgs.linuxPackages; [rtl88x2bu]; + initrd = { + availableKernelModules = ["r8169"]; + systemd.users.root.shell = "/bin/cryptsetup-askpass"; + network = { + enable = true; + ssh = { + enable = true; + port = 22; + authorizedKeys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOYEaT0gH9yJM2Al0B+VGXdZB/b2qjZK7n01Weq0TcmQ alex@framework" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN99h5reZdz9+DOyTRh8bPYWO+Dtv7TbkLbMdvi+Beio alex@desktop" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIkURF5v9vRyEPhsK80kUgYh1vsS0APL4XyH4F3Fpyic alex@macbook" + ]; + hostKeys = ["/persist/pre_boot_ssh_key"]; + }; + }; + luks.devices = { + root = { + device = "/dev/disk/by-uuid/9287df9c-ec3c-4cd8-af3a-d253f9418f7b"; + preLVM = true; + }; + }; + + postDeviceCommands = pkgs.lib.mkBefore '' + mkdir -p /mnt + + # We first mount the btrfs root to /mnt + # so we can manipulate btrfs subvolumes. + mount -o subvol=/ /dev/mapper/lvm-root /mnt + + # While we're tempted to just delete /root and create + # a new snapshot from /root-blank, /root is already + # populated at this point with a number of subvolumes, + # which makes `btrfs subvolume delete` fail. + # So, we remove them first. + # + # /root contains subvolumes: + # - /root/var/lib/portables + # - /root/var/lib/machines + # + # I suspect these are related to systemd-nspawn, but + # since I don't use it I'm not 100% sure. + # Anyhow, deleting these subvolumes hasn't resulted + # in any issues so far, except for fairly + # benign-looking errors from systemd-tmpfiles. + btrfs subvolume list -o /mnt/root | + cut -f9 -d' ' | + while read subvolume; do + echo "deleting /$subvolume subvolume..." + btrfs subvolume delete "/mnt/$subvolume" + done && + echo "deleting /root subvolume..." && + btrfs subvolume delete /mnt/root + + echo "restoring blank /root subvolume..." + btrfs subvolume snapshot /mnt/root-blank /mnt/root + + # Once we're done rolling back to a blank snapshot, + # we can unmount /mnt and continue on the boot process. + umount /mnt + ''; + }; + + supportedFilesystems = ["btrfs"]; + kernelPackages = pkgs.linuxPackages_latest; + + extraModulePackages = with pkgs.linuxPackages_latest; [rtl88x2bu]; }; time.timeZone = "Europe/Berlin"; @@ -69,13 +133,6 @@ firewall = {enable = false;}; interfaces = { enp3s0.useDHCP = true; - # wlp0s20u1u1.useDHCP = true; - wlp0s20u1u2.ipv4.addresses = [ - { - address = "192.168.12.1"; - prefixLength = 24; - } - ]; }; nftables.enable = true; @@ -109,11 +166,31 @@ # }; }; - environment.systemPackages = with pkgs; [ - nyx - snapraid - mergerfs - ]; + environment = { + systemPackages = with pkgs; [ + nyx + snapraid + mergerfs + ]; + persistence."/persist" = { + directories = [ + # "/var/lib/docker" + "/var/lib/nixos" + "/var/lib/tor" + "/var/lib/tailscale" + "/var/lib/tuptime" + "/var/lib/vnstat" + ]; + files = [ + "/etc/machine-id" + "/etc/NIXOS" + "/etc/ssh/ssh_host_ed25519_key" + "/etc/ssh/ssh_host_ed25519_key.pub" + "/etc/ssh/ssh_host_rsa_key" + "/etc/ssh/ssh_host_rsa_key.pub" + ]; + }; + }; hardware = { enableAllFirmware = true; @@ -214,49 +291,39 @@ extraUpFlags = "--advertise-exit-node --login-server=https://headscale.szczepan.ski"; }; - samba = { - enable = true; - securityType = "user"; - extraConfig = '' - workgroup = WORKGROUP - server string = server - netbios name = server - security = user - guest account = nobody - map to guest = bad user - logging = systemd - max log size = 50 - ''; - shares = { - storage = { - path = "/mnt/storage"; - browseable = "yes"; - "read only" = "no"; - "guest ok" = "no"; - "create mask" = "0644"; - "directory mask" = "0755"; - }; - }; - }; - borgbackup.jobs.home = rec { + repo = "ssh://u278697-sub8@u278697.your-storagebox.de:23/./borg-backup-mini"; + compression = "auto,zstd"; encryption = { mode = "repokey-blake2"; passCommand = "cat ${config.sops.secrets.borg-key.path}"; }; - extraCreateArgs = "--list --stats --verbose --checkpoint-interval 600 --exclude-caches"; - environment.BORG_RSH = "ssh -o StrictHostKeyChecking=no -i /home/alex/.ssh/id_ed25519"; - paths = ["/home/alex" "/var/lib"]; - repo = "ssh://u278697-sub8@u278697.your-storagebox.de:23/./borg-backup-mini"; + extraCreateArgs = "--stats --verbose --checkpoint-interval=600 --exclude-caches"; + extraPruneArgs = [ + "--save-space" + "--stats" + ]; + extraCompactArgs = [ + "--cleanup-commits" + ]; + environment = { + BORG_RSH = "ssh -i /home/alex/.ssh/id_ed55129"; + BORG_BASE_DIR = "/persist/borg"; + }; + readWritePaths = ["/persist/borg"]; + paths = ["/home/alex" "/persist"]; startAt = "daily"; prune.keep = { daily = 7; weekly = 4; monthly = 6; }; - extraPruneArgs = "--save-space --list --stats"; - exclude = ["/home/alex/.cache"]; + exclude = [ + "/home/alex/mounted" + "/home/alex/.cache" + "/persist/borg" + ]; }; }; diff --git a/machine/mini/hardware-configuration.nix b/machine/mini/hardware-configuration.nix index 4af81e9..d88bc7f 100644 --- a/machine/mini/hardware-configuration.nix +++ b/machine/mini/hardware-configuration.nix @@ -12,15 +12,78 @@ (modulesPath + "/installer/scan/not-detected.nix") ]; - boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "usbhid" "usb_storage" "sd_mod"]; - boot.initrd.kernelModules = []; + boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "usbhid" "usb_storage" "sd_mod" "sr_mod"]; + boot.initrd.kernelModules = ["dm-snapshot"]; boot.kernelModules = ["kvm-intel"]; boot.extraModulePackages = []; fileSystems = { "/" = { - device = "/dev/disk/by-uuid/8be3b4e5-7219-4427-bba4-340f1dc4b868"; - fsType = "ext4"; + device = "/dev/disk/by-uuid/01449b4a-4863-47dd-b213-5aefd014cd2d"; + fsType = "btrfs"; + options = [ + "subvol=root" + "discard=async" + "compress=zstd" + "nodiratime" + "noatime" + ]; + }; + + "/home" = { + device = "/dev/disk/by-uuid/01449b4a-4863-47dd-b213-5aefd014cd2d"; + fsType = "btrfs"; + options = [ + "subvol=home" + "discard=async" + "compress=zstd" + "nodiratime" + "noatime" + ]; + }; + + "/nix" = { + device = "/dev/disk/by-uuid/01449b4a-4863-47dd-b213-5aefd014cd2d"; + fsType = "btrfs"; + options = [ + "subvol=nix" + "discard=async" + "compress=zstd" + "nodiratime" + "noatime" + ]; + }; + + "/persist" = { + device = "/dev/disk/by-uuid/01449b4a-4863-47dd-b213-5aefd014cd2d"; + fsType = "btrfs"; + options = [ + "subvol=persist" + "discard=async" + "compress=zstd" + "nodiratime" + "noatime" + ]; + neededForBoot = true; + }; + + "/var/log" = { + device = "/dev/disk/by-uuid/01449b4a-4863-47dd-b213-5aefd014cd2d"; + fsType = "btrfs"; + options = [ + "subvol=log" + "discard=async" + "compress=zstd" + "nodiratime" + "noatime" + ]; + neededForBoot = true; + }; + + "/boot" = { + device = "/dev/disk/by-uuid/7222-8C3F"; + fsType = "vfat"; + options = ["fmask=0022" "dmask=0022"]; }; "/mnt/disk1" = { @@ -46,14 +109,11 @@ fsType = "ext4"; options = ["nofail" "x-systemd.automount"]; }; - - "/boot" = { - device = "/dev/disk/by-uuid/7C10-C8BD"; - fsType = "vfat"; - }; }; - swapDevices = [{device = "/dev/disk/by-uuid/edb5324f-3cd2-4b8c-bb05-cca045adeaf6";}]; + swapDevices = [ + {device = "/dev/disk/by-uuid/e59a0c55-7859-40ad-bf55-345708a67816";} + ]; hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; }