diff --git a/flake.lock b/flake.lock index e6c6e94..f1fb516 100644 --- a/flake.lock +++ b/flake.lock @@ -7,11 +7,11 @@ ] }, "locked": { - "lastModified": 1715756862, - "narHash": "sha256-cNGZK/RNvb29giR2KtnbwU5lx2Kw+wWqAaeWqfYlPts=", + "lastModified": 1715872464, + "narHash": "sha256-mkZ3hrPG7d+qL7B6pQcrNfPh2mnQEJR3FHK93qCp6Uk=", "owner": "nix-community", "repo": "disko", - "rev": "cb1d6fba694ab3887600d606106f5a044ba1712c", + "rev": "5f6dbcce99d60dd77f96dfc66d06bbea149a40e1", "type": "github" }, "original": { @@ -40,6 +40,21 @@ "type": "github" } }, + "impermanence": { + "locked": { + "lastModified": 1708968331, + "narHash": "sha256-VUXLaPusCBvwM3zhGbRIJVeYluh2uWuqtj4WirQ1L9Y=", + "owner": "nix-community", + "repo": "impermanence", + "rev": "a33ef102a02ce77d3e39c25197664b7a636f9c30", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "impermanence", + "type": "github" + } + }, "nix-secrets": { "flake": false, "locked": { @@ -86,11 +101,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1715534503, - "narHash": "sha256-5ZSVkFadZbFP1THataCaSf0JH2cAH3S29hU9rrxTEqk=", + "lastModified": 1715787315, + "narHash": "sha256-cYApT0NXJfqBkKcci7D9Kr4CBYZKOQKDYA23q8XNuWg=", "owner": "nixos", "repo": "nixpkgs", - "rev": "2057814051972fa1453ddfb0d98badbea9b83c06", + "rev": "33d1e753c82ffc557b4a585c77de43d4c922ebb5", "type": "github" }, "original": { @@ -104,6 +119,7 @@ "inputs": { "disko": "disko", "home-manager": "home-manager", + "impermanence": "impermanence", "nix-secrets": "nix-secrets", "nixpkgs": "nixpkgs", "nixpkgs-unstable": "nixpkgs-unstable", diff --git a/flake.nix b/flake.nix index 0779022..4c93abd 100644 --- a/flake.nix +++ b/flake.nix @@ -17,6 +17,10 @@ inputs.nixpkgs.follows = "nixpkgs"; }; + impermanence = { + url = "github:nix-community/impermanence"; + }; + # Secrets management sops-nix = { url = "github:mic92/sops-nix"; @@ -34,6 +38,7 @@ nixpkgs, home-manager, disko, + #impermanence, ... } @ inputs: let @@ -73,19 +78,16 @@ bootstrap = nixpkgs.lib.nixosSystem { inherit specialArgs; modules = [ - #disko.nixosModules.disko - #./hosts/common/disks/gpt-bios-compact.nix - #./hosts/common/disks/std-disk-config.nix ./hosts/bootstrap ]; }; media = nixpkgs.lib.nixosSystem { inherit specialArgs; modules = [ - #disko.nixosModules.disko - #./hosts/common/disks/gpt-bios-compact.nix - #./hosts/common/disks/std-disk-config.nix ./hosts/media + home-manager.nixosModules.home-manager{ + home-manager.extraSpecialArgs = specialArgs; + } ]; }; }; diff --git a/home/media.nix b/home/media.nix index 38d3a2f..a443ef7 100644 --- a/home/media.nix +++ b/home/media.nix @@ -14,3 +14,4 @@ # Import users ./users/media ]; +} diff --git a/home/users/media/default.nix b/home/users/media/default.nix index c4f50f8..0cf0ee6 100644 --- a/home/users/media/default.nix +++ b/home/users/media/default.nix @@ -1,4 +1,4 @@ -{ config, pkgs, lib, outputs, ... }: +{ config, pkgs, lib, outputs, inputs, ... }: { home.username = "media"; @@ -6,6 +6,7 @@ home.stateVersion = "23.11"; imports = [ + inputs.impermanence.nixosModules.home-manager.impermanence ] ++ (builtins.attrValues outputs.homeManagerModules); # import all homeManagerModules? home.packages = [ @@ -32,6 +33,13 @@ ''; }; + home.persistence."/persist/home" = { + directories = [ + ".gnupg" + ".ssh" + ]; + allowOther = true; + }; home.file = { }; diff --git a/hosts/common/optional/btrfs-impermanence.nix b/hosts/common/optional/btrfs-impermanence.nix index 3fdb60f..e812848 100644 --- a/hosts/common/optional/btrfs-impermanence.nix +++ b/hosts/common/optional/btrfs-impermanence.nix @@ -24,4 +24,6 @@ boot.initrd.postDeviceCommands = lib.mkAfter '' btrfs subvolume create /btrfs_tmp/root umount /btrfs_tmp ''; + } + diff --git a/hosts/common/users/media/default.nix b/hosts/common/users/media/default.nix index 9c47b84..79a5ed9 100644 --- a/hosts/common/users/media/default.nix +++ b/hosts/common/users/media/default.nix @@ -1,6 +1,7 @@ { pkgs, inputs, config, lib, ... }: let pubKeys = lib.filesystem.listFilesRecursive (../keys); + hostname = config.networking.hostName; in { users.users.media = { @@ -18,6 +19,14 @@ in }; programs.zsh.enable = true; + programs.fuse.userAllowOther = true; + #home-manager.users.sam = + home-manager = { + extraSpecialArgs = { inherit inputs; }; + users = { + media = import ../../../../home/${hostname}.nix; + }; + }; environment.systemPackages = [ ]; diff --git a/hosts/media/default.nix b/hosts/media/default.nix index 3fdaa34..fac5f3d 100644 --- a/hosts/media/default.nix +++ b/hosts/media/default.nix @@ -4,9 +4,10 @@ imports = [ # Disk configuration - inputs.disko.nixosModules.disko - (import ../common/disks/std-disk-config.nix { device = "/dev/vda"; }) + #inputs.disko.nixosModules.disko + #(import ../common/disks/std-disk-config.nix { device = "/dev/vda"; }) ../common/optional/btrfs-impermanence.nix + inputs.impermanence.nixosModules.impermanence # Import core options ./hardware-configuration.nix @@ -17,6 +18,18 @@ ]; + fileSystems."/persist".neededForBoot = true; + environment.persistence."/persist/system" = { + hideMounts = true; + directories = [ + "/etc/nixos" + "/var/log" + "/var/lib/nixos" + "/var/lib/systemd/coredump" + "/etc/NetworkManager/system-connections" + ]; + }; + nixpkgs = { overlays = [ outputs.overlays.additions diff --git a/hosts/media/hardware-configuration.nix b/hosts/media/hardware-configuration.nix index f9c2647..ab1d5d8 100644 --- a/hosts/media/hardware-configuration.nix +++ b/hosts/media/hardware-configuration.nix @@ -9,10 +9,42 @@ ]; boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ]; - boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ "kvm-amd" ]; + boot.initrd.kernelModules = [ "dm-snapshot" ]; + boot.kernelModules = [ "kvm-intel" ]; boot.extraModulePackages = [ ]; + fileSystems."/" = + { device = "/dev/disk/by-uuid/d6657061-a847-49f8-9219-f9e668fe34aa"; + fsType = "btrfs"; + options = [ "subvol=root" ]; + }; + + fileSystems."/nix" = + { device = "/dev/disk/by-uuid/d6657061-a847-49f8-9219-f9e668fe34aa"; + fsType = "btrfs"; + options = [ "subvol=nix" ]; + }; + + fileSystems."/.swapvol" = + { device = "/dev/disk/by-uuid/d6657061-a847-49f8-9219-f9e668fe34aa"; + fsType = "btrfs"; + options = [ "subvol=swap" ]; + }; + + fileSystems."/persist" = + { device = "/dev/disk/by-uuid/d6657061-a847-49f8-9219-f9e668fe34aa"; + fsType = "btrfs"; + options = [ "subvol=persist" ]; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/7619-58F2"; + fsType = "vfat"; + options = [ "fmask=0022" "dmask=0022" ]; + }; + + swapDevices = [ ]; + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking # (the default) this is the recommended approach. When using systemd-networkd it's # still possible to use this option, but it's recommended to use it in conjunction