mini-2024-11-23-09-47-34

flake.nix

@@ -105,6 +105,9 @@
         system = "x86_64-linux";
         specialArgs = {inherit inputs outputs;};
         modules = [
+          inputs.nixos-hardware.nixosModules.common-cpu-intel
+          inputs.sops-nix.nixosModules.sops
+          impermanence.nixosModules.impermanence
           ./machine/mini/configuration.nix
         ];
       };

machine/mini/configuration.nix

@@ -18,8 +18,6 @@
 
   imports = [
     ./hardware-configuration.nix
-    inputs.nixos-hardware.nixosModules.common-cpu-intel
-    inputs.sops-nix.nixosModules.sops
     ../../configs/docker.nix
     ../../configs/common.nix
     ../../configs/user.nix
@@ -59,7 +57,73 @@
       efi.canTouchEfiVariables = true;
     };
 
-    extraModulePackages = with pkgs.linuxPackages; [rtl88x2bu];
+    initrd = {
+      availableKernelModules = ["r8169"];
+      systemd.users.root.shell = "/bin/cryptsetup-askpass";
+      network = {
+        enable = true;
+        ssh = {
+          enable = true;
+          port = 22;
+          authorizedKeys = [
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOYEaT0gH9yJM2Al0B+VGXdZB/b2qjZK7n01Weq0TcmQ alex@framework"
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN99h5reZdz9+DOyTRh8bPYWO+Dtv7TbkLbMdvi+Beio alex@desktop"
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIkURF5v9vRyEPhsK80kUgYh1vsS0APL4XyH4F3Fpyic alex@macbook"
+          ];
+          hostKeys = ["/persist/pre_boot_ssh_key"];
+        };
+      };
+      luks.devices = {
+        root = {
+          device = "/dev/disk/by-uuid/9287df9c-ec3c-4cd8-af3a-d253f9418f7b";
+          preLVM = true;
+        };
+      };
+
+      postDeviceCommands = pkgs.lib.mkBefore ''
+        mkdir -p /mnt
+
+        # We first mount the btrfs root to /mnt
+        # so we can manipulate btrfs subvolumes.
+        mount -o subvol=/ /dev/mapper/lvm-root /mnt
+
+        # While we're tempted to just delete /root and create
+        # a new snapshot from /root-blank, /root is already
+        # populated at this point with a number of subvolumes,
+        # which makes `btrfs subvolume delete` fail.
+        # So, we remove them first.
+        #
+        # /root contains subvolumes:
+        # - /root/var/lib/portables
+        # - /root/var/lib/machines
+        #
+        # I suspect these are related to systemd-nspawn, but
+        # since I don't use it I'm not 100% sure.
+        # Anyhow, deleting these subvolumes hasn't resulted
+        # in any issues so far, except for fairly
+        # benign-looking errors from systemd-tmpfiles.
+        btrfs subvolume list -o /mnt/root |
+        cut -f9 -d' ' |
+        while read subvolume; do
+          echo "deleting /$subvolume subvolume..."
+          btrfs subvolume delete "/mnt/$subvolume"
+        done &&
+        echo "deleting /root subvolume..." &&
+        btrfs subvolume delete /mnt/root
+
+        echo "restoring blank /root subvolume..."
+        btrfs subvolume snapshot /mnt/root-blank /mnt/root
+
+        # Once we're done rolling back to a blank snapshot,
+        # we can unmount /mnt and continue on the boot process.
+        umount /mnt
+      '';
+    };
+
+    supportedFilesystems = ["btrfs"];
+    kernelPackages = pkgs.linuxPackages_latest;
+
+    extraModulePackages = with pkgs.linuxPackages_latest; [rtl88x2bu];
   };
 
   time.timeZone = "Europe/Berlin";
@@ -69,13 +133,6 @@
     firewall = {enable = false;};
     interfaces = {
       enp3s0.useDHCP = true;
-      # wlp0s20u1u1.useDHCP = true;
-      wlp0s20u1u2.ipv4.addresses = [
-        {
-          address = "192.168.12.1";
-          prefixLength = 24;
-        }
-      ];
     };
 
     nftables.enable = true;
@@ -109,11 +166,31 @@
     # };
   };
 
-  environment.systemPackages = with pkgs; [
+  environment = {
-    nyx
+    systemPackages = with pkgs; [
-    snapraid
+      nyx
-    mergerfs
+      snapraid
-  ];
+      mergerfs
+    ];
+    persistence."/persist" = {
+      directories = [
+        # "/var/lib/docker"
+        "/var/lib/nixos"
+        "/var/lib/tor"
+        "/var/lib/tailscale"
+        "/var/lib/tuptime"
+        "/var/lib/vnstat"
+      ];
+      files = [
+        "/etc/machine-id"
+        "/etc/NIXOS"
+        "/etc/ssh/ssh_host_ed25519_key"
+        "/etc/ssh/ssh_host_ed25519_key.pub"
+        "/etc/ssh/ssh_host_rsa_key"
+        "/etc/ssh/ssh_host_rsa_key.pub"
+      ];
+    };
+  };
 
   hardware = {
     enableAllFirmware = true;
@@ -214,49 +291,39 @@
       extraUpFlags = "--advertise-exit-node --login-server=https://headscale.szczepan.ski";
     };
 
-    samba = {
-      enable = true;
-      securityType = "user";
-      extraConfig = ''
-        workgroup = WORKGROUP
-        server string = server
-        netbios name = server
-        security = user
-        guest account = nobody
-        map to guest = bad user
-        logging = systemd
-        max log size = 50
-      '';
-      shares = {
-        storage = {
-          path = "/mnt/storage";
-          browseable = "yes";
-          "read only" = "no";
-          "guest ok" = "no";
-          "create mask" = "0644";
-          "directory mask" = "0755";
-        };
-      };
-    };
-
     borgbackup.jobs.home = rec {
+      repo = "ssh://u278697-sub8@u278697.your-storagebox.de:23/./borg-backup-mini";
+
       compression = "auto,zstd";
       encryption = {
         mode = "repokey-blake2";
         passCommand = "cat ${config.sops.secrets.borg-key.path}";
       };
-      extraCreateArgs = "--list --stats --verbose --checkpoint-interval 600 --exclude-caches";
+      extraCreateArgs = "--stats --verbose --checkpoint-interval=600 --exclude-caches";
-      environment.BORG_RSH = "ssh -o StrictHostKeyChecking=no -i /home/alex/.ssh/id_ed25519";
+      extraPruneArgs = [
-      paths = ["/home/alex" "/var/lib"];
+        "--save-space"
-      repo = "ssh://u278697-sub8@u278697.your-storagebox.de:23/./borg-backup-mini";
+        "--stats"
+      ];
+      extraCompactArgs = [
+        "--cleanup-commits"
+      ];
+      environment = {
+        BORG_RSH = "ssh -i /home/alex/.ssh/id_ed55129";
+        BORG_BASE_DIR = "/persist/borg";
+      };
+      readWritePaths = ["/persist/borg"];
+      paths = ["/home/alex" "/persist"];
       startAt = "daily";
       prune.keep = {
         daily = 7;
         weekly = 4;
         monthly = 6;
       };
-      extraPruneArgs = "--save-space --list --stats";
+      exclude = [
-      exclude = ["/home/alex/.cache"];
+        "/home/alex/mounted"
+        "/home/alex/.cache"
+        "/persist/borg"
+      ];
     };
   };
 

machine/mini/hardware-configuration.nix

@@ -12,15 +12,78 @@
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "usbhid" "usb_storage" "sd_mod"];
+  boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "usbhid" "usb_storage" "sd_mod" "sr_mod"];
-  boot.initrd.kernelModules = [];
+  boot.initrd.kernelModules = ["dm-snapshot"];
   boot.kernelModules = ["kvm-intel"];
   boot.extraModulePackages = [];
 
   fileSystems = {
     "/" = {
-      device = "/dev/disk/by-uuid/8be3b4e5-7219-4427-bba4-340f1dc4b868";
+      device = "/dev/disk/by-uuid/01449b4a-4863-47dd-b213-5aefd014cd2d";
-      fsType = "ext4";
+      fsType = "btrfs";
+      options = [
+        "subvol=root"
+        "discard=async"
+        "compress=zstd"
+        "nodiratime"
+        "noatime"
+      ];
+    };
+
+    "/home" = {
+      device = "/dev/disk/by-uuid/01449b4a-4863-47dd-b213-5aefd014cd2d";
+      fsType = "btrfs";
+      options = [
+        "subvol=home"
+        "discard=async"
+        "compress=zstd"
+        "nodiratime"
+        "noatime"
+      ];
+    };
+
+    "/nix" = {
+      device = "/dev/disk/by-uuid/01449b4a-4863-47dd-b213-5aefd014cd2d";
+      fsType = "btrfs";
+      options = [
+        "subvol=nix"
+        "discard=async"
+        "compress=zstd"
+        "nodiratime"
+        "noatime"
+      ];
+    };
+
+    "/persist" = {
+      device = "/dev/disk/by-uuid/01449b4a-4863-47dd-b213-5aefd014cd2d";
+      fsType = "btrfs";
+      options = [
+        "subvol=persist"
+        "discard=async"
+        "compress=zstd"
+        "nodiratime"
+        "noatime"
+      ];
+      neededForBoot = true;
+    };
+
+    "/var/log" = {
+      device = "/dev/disk/by-uuid/01449b4a-4863-47dd-b213-5aefd014cd2d";
+      fsType = "btrfs";
+      options = [
+        "subvol=log"
+        "discard=async"
+        "compress=zstd"
+        "nodiratime"
+        "noatime"
+      ];
+      neededForBoot = true;
+    };
+
+    "/boot" = {
+      device = "/dev/disk/by-uuid/7222-8C3F";
+      fsType = "vfat";
+      options = ["fmask=0022" "dmask=0022"];
     };
 
     "/mnt/disk1" = {
@@ -46,14 +109,11 @@
       fsType = "ext4";
       options = ["nofail" "x-systemd.automount"];
     };
-
-    "/boot" = {
-      device = "/dev/disk/by-uuid/7C10-C8BD";
-      fsType = "vfat";
-    };
   };
 
-  swapDevices = [{device = "/dev/disk/by-uuid/edb5324f-3cd2-4b8c-bb05-cca045adeaf6";}];
+  swapDevices = [
+    {device = "/dev/disk/by-uuid/e59a0c55-7859-40ad-bf55-345708a67816";}
+  ];
 
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }