enode: disk setup, minor fixes

5 files changed, 204 insertions, 19 deletions

diff --git a/flake.lock b/flake.lock
index 8640783..fe6ed3b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -116,6 +116,48 @@
         "type": "github"
       }
     },
+    "home-manager_2": {
+      "inputs": {
+        "nixpkgs": [
+          "impermanence",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768598210,
+        "narHash": "sha256-kkgA32s/f4jaa4UG+2f8C225Qvclxnqs76mf8zvTVPg=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "c47b2cc64a629f8e075de52e4742de688f930dc6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "impermanence": {
+      "inputs": {
+        "home-manager": "home-manager_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1769548169,
+        "narHash": "sha256-03+JxvzmfwRu+5JafM0DLbxgHttOQZkUtDWBmeUkN8Y=",
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "rev": "7b1d382faf603b6d264f58627330f9faa5cba149",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "type": "github"
+      }
+    },
     "niri-flake": {
       "inputs": {
         "niri-stable": "niri-stable",
@@ -257,6 +299,7 @@
         "disko": "disko",
         "futils": "futils",
         "home-manager": "home-manager",
+        "impermanence": "impermanence",
         "niri-flake": "niri-flake",
         "nixpkgs": "nixpkgs",
         "sops-nix": "sops-nix",
diff --git a/flake.nix b/flake.nix
index 220cc27..546e2ed 100644
--- a/flake.nix
+++ b/flake.nix
@@ -28,6 +28,10 @@
       url = "github:epireyn/niri-flake";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    impermanence = {
+      url = "github:nix-community/impermanence";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
     # development stuff
     treefmt-nix = {
diff --git a/hosts/enode/default.nix b/hosts/enode/default.nix
index c2ba04e..c45d7f0 100644
--- a/hosts/enode/default.nix
+++ b/hosts/enode/default.nix
@@ -1,9 +1,31 @@
-{ pkgs, ... }: {
+{
+  pkgs,
+  inputs,
+  ...
+}:
+{
   imports = [
+    inputs.impermanence.nixosModules.impermanence
+    inputs.disko.nixosModules.disko
     ./headscale.nix
     ./caddy.nix
+    ./disko.nix
   ];
 
+  boot.initrd.luks.devices = {
+    cryptroot = {
+      device = "/dev/disk/by-partlabel/luks";
+      allowDiscards = true;
+      preLVM = true;
+    };
+  };
+
+  services.btrfs.autoScrub = {
+    enable = true;
+    interval = "weekly";
+    fileSystems = [ "/" ];
+  };
+
   networking = {
     networkmanager.enable = true;
     useDHCP = false;
@@ -23,6 +45,11 @@
       ];
     };
   };
+  time.timeZone = "Europe/Berlin";
+
+  security.sudo.extraConfig = ''
+    Defaults lecture = never
+  '';
 
   boot.loader = {
     systemd-boot.enable = true;
@@ -30,7 +57,7 @@
   };
 
   users = {
-      users.isabella = {
+    users.isabella = {
       isNormalUser = true;
       description = "Isabella Morgana Bastaja";
       extraGroups = [ "wheel" ];
@@ -43,6 +70,7 @@
     };
     mutableUsers = false;
   };
+  console.keyMap = "us";
 
   services.openssh = {
     enable = true;
diff --git a/hosts/enode/disko.nix b/hosts/enode/disko.nix
index 82e7d5f..d9dfb20 100644
--- a/hosts/enode/disko.nix
+++ b/hosts/enode/disko.nix
@@ -1,32 +1,106 @@
+let
+  espPartition = {
+    type = "filesystem";
+    format = "vfat";
+    mountpoint = "/boot";
+    mountOptions = [
+      "default"
+    ];
+  };
+  cryptroot = {
+    type = "luks";
+    name = "cryptroot";
+    content = {
+      type = "btrfs";
+      extraArgs = [
+        "-L"
+        "nixos"
+        "-f"
+      ];
+      subvolumes = {
+        "/root" = {
+          mountpoint = "/";
+          mountOptions = [
+            "subvol=root"
+            "compress=zstd"
+            "noatime"
+          ];
+        };
+        "/root-blank" = {
+          mountOptions = [
+            "subvol=root-blank"
+            "nodatacow"
+            "noatime"
+          ];
+        };
+        "/home" = {
+          mountpoint = "/home";
+          mountOptions = [
+            "subvol=home"
+            "compress=zstd"
+            "noatime"
+          ];
+        };
+        "/nix" = {
+          mountpoint = "/nix";
+          mountOptions = [
+            "subvol=nix"
+            "compress=zstd"
+            "noatime"
+          ];
+        };
+        "/persist" = {
+          mountpoint = "/persist";
+          mountOptions = [
+            "subvol=persist"
+            "compress=zstd"
+            "noatime"
+          ];
+        };
+        "/lib" = {
+          mountpoint = "/var/lib";
+          mountOptions = [
+            "subvol=lib"
+            "compress=zstd"
+            "noatime"
+          ];
+        };
+        "/log" = {
+          mountpoint = "/var/log";
+          mountOptions = [
+            "subvol=log"
+            "compress=zstd"
+            "noatime"
+          ];
+        };
+      };
+    };
+  };
+in
 {
   disko.devices.disk.vm-disk = {
-    device = "/dev/vda";
     type = "disk";
+    device = "/dev/vda";
     content = {
       type = "gpt";
       partitions = {
         ESP = {
-          type = "EF00";
+          label = "boot";
+          name = "ESP";
           size = "1G";
-          content = {
-            type = "filesystem";
-            format = "vfat";
-            mountpoint = "/boot";
-            mountOptions = [
-              "umask=0077"
-              "nofail"
-            ];
-          };
+          type = "EF00";
+          content = espPartition;
         };
-        root = {
+        luks = {
           size = "100%";
-          content = {
-            type = "filesystem";
-            format = "ext4";
-            mountpoint = "/";
-          };
+          label = "luks";
+          content = cryptroot;
         };
       };
     };
   };
+
+  fileSystems."/var/log".neededForBoot = true;
+  fileSystems."/var/lib".neededForBoot = true;
+  fileSystems."/persist".neededForBoot = true;
 }
diff --git a/hosts/enode/impermenance.nix b/hosts/enode/impermenance.nix
new file mode 100644
index 0000000..9915bb1
--- /dev/null
+++ b/hosts/enode/impermenance.nix
@@ -0,0 +1,36 @@
+{ lib, ... }: {
+  boot.initrd.postDeviceCommands = lib.mkAfter ''
+    echo "Rollback running" > /mnt/rollback.log
+    mkdir -p /mnt
+    mount -t btrfs /dev/mapper/cryptroot /mnt
+
+    # Recursively delete all nested subvolumes inside /mnt/root
+    btrfs subvolume list -o /mnt/root | cut -f9 -d' ' | while read subvolume; do
+      echo "Deleting /$subvolume subvolume..." >> /mnt/rollback.log
+      btrfs subvolume delete "/mnt/$subvolume"
+    done
+
+    echo "Deleting /root subvolume..." >> /mnt/rollback.log
+    btrfs subvolume delete /mnt/root
+
+    echo "Restoring blank /root subvolume..." >> /mnt/rollback.log
+    btrfs subvolume snapshot /mnt/root-blank /mnt/root
+
+    umount /mnt
+  '';
+
+  # Use /persist as the persistence root, matching Disko's mountpoint
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib/backups"
+      "/var/lib/headscale"
+      "/var/lib/caddy" # for certs
+    ];
+    files = [
+      "/etc/machine-id"
+      "/etc/shadow"
+      "/etc/passwd"
+    ];
+  };
+}