diff options
Diffstat (limited to 'hosts')
| -rw-r--r-- | hosts/enode/default.nix | 10 | ||||
| -rw-r--r-- | hosts/enode/disko.nix | 140 | ||||
| -rw-r--r-- | hosts/enode/impermenance.nix | 66 |
3 files changed, 115 insertions, 101 deletions
diff --git a/hosts/enode/default.nix b/hosts/enode/default.nix index 8df17db..d52cd6e 100644 --- a/hosts/enode/default.nix +++ b/hosts/enode/default.nix @@ -1,6 +1,7 @@ { pkgs, inputs, + modulesPath, ... }: { @@ -10,16 +11,9 @@ ./headscale.nix ./caddy.nix ./disko.nix + "${modulesPath}/installer/cd-dvd/installation-cd-minimal.nix" ]; - boot.initrd.luks.devices = { - cryptroot = { - device = "/dev/disk/by-partlabel/luks"; - allowDiscards = true; - preLVM = true; - }; - }; - services.btrfs.autoScrub = { enable = true; interval = "weekly"; diff --git a/hosts/enode/disko.nix b/hosts/enode/disko.nix index d9dfb20..2f51ab4 100644 --- a/hosts/enode/disko.nix +++ b/hosts/enode/disko.nix @@ -4,75 +4,68 @@ let format = "vfat"; mountpoint = "/boot"; mountOptions = [ - "default" + "umask=0077" ]; }; - cryptroot = { - type = "luks"; - name = "cryptroot"; - content = { - type = "btrfs"; - extraArgs = [ - "-L" - "nixos" - "-f" - ]; - subvolumes = { - "/root" = { - mountpoint = "/"; - mountOptions = [ - "subvol=root" - "compress=zstd" - "noatime" - ]; - }; - "/root-blank" = { - mountOptions = [ - "subvol=root-blank" - "nodatacow" - "noatime" - ]; - }; - "/home" = { - mountpoint = "/home"; - mountOptions = [ - "subvol=home" - "compress=zstd" - "noatime" - ]; - }; - "/nix" = { - mountpoint = "/nix"; - mountOptions = [ - "subvol=nix" - "compress=zstd" - "noatime" - ]; - }; - "/persist" = { - mountpoint = "/persist"; - mountOptions = [ - "subvol=persist" - "compress=zstd" - "noatime" - ]; - }; - "/lib" = { - mountpoint = "/var/lib"; - mountOptions = [ - "subvol=lib" - "compress=zstd" - "noatime" - ]; - }; - "/log" = { - mountpoint = "/var/log"; - mountOptions = [ - "subvol=log" - "compress=zstd" - "noatime" - ]; - }; + rootPartition = { + type = "btrfs"; + extraArgs = [ "-f" ]; # override existing partition + subvolumes = { + "/root" = { + mountpoint = "/"; + mountOptions = [ + "subvol=root" + "compress=zstd" + "noatime" + ]; + }; + "/home" = { + mountOptions = [ + "subvol=home" + "compress=zstd" + "noatime" + ]; + mountpoint = "/home"; + }; + "/nix" = { + mountOptions = [ + "subvol=nix" + "compress=zstd" + "noatime" + ]; + mountpoint = "/nix"; + }; + "/log" = { + mountpoint = "/var/log"; + mountOptions = [ + "subvol=log" + "compress=zstd" + "noatime" + ]; + }; + "/lib" = { + mountpoint = "/var/lib"; + mountOptions = [ + "subvol=lib" + "compress=zstd" + "noatime" + ]; + }; + "/persist" = { + mountpoint = "/var/lib/persist"; + mountOptions = [ + "subvol=persist" + "compress=zstd" + "noatime" + ]; + }; + "/secrets" = { + mountpoint = "/var/lib/secrets"; + mountOptions = [ + "subvol=secrets" + "compress=zstd" + "noatime" + ]; }; }; }; @@ -81,26 +74,29 @@ in disko.devices.disk.vm-disk = { type = "disk"; device = "/dev/vda"; + imageSize = "10G"; content = { type = "gpt"; partitions = { ESP = { - label = "boot"; + priority = 1; name = "ESP"; + label = "boot"; size = "1G"; type = "EF00"; content = espPartition; }; - luks = { + root = { size = "100%"; - label = "luks"; - content = cryptroot; + name = "root"; + label = "root"; + content = rootPartition; }; }; }; }; + fileSystems."/var/lib/persist".neededForBoot = true; fileSystems."/var/log".neededForBoot = true; fileSystems."/var/lib".neededForBoot = true; - fileSystems."/persist".neededForBoot = true; } diff --git a/hosts/enode/impermenance.nix b/hosts/enode/impermenance.nix index 9915bb1..c15ea85 100644 --- a/hosts/enode/impermenance.nix +++ b/hosts/enode/impermenance.nix @@ -1,31 +1,21 @@ -{ lib, ... }: { - boot.initrd.postDeviceCommands = lib.mkAfter '' - echo "Rollback running" > /mnt/rollback.log - mkdir -p /mnt - mount -t btrfs /dev/mapper/cryptroot /mnt - - # Recursively delete all nested subvolumes inside /mnt/root - btrfs subvolume list -o /mnt/root | cut -f9 -d' ' | while read subvolume; do - echo "Deleting /$subvolume subvolume..." >> /mnt/rollback.log - btrfs subvolume delete "/mnt/$subvolume" - done - - echo "Deleting /root subvolume..." >> /mnt/rollback.log - btrfs subvolume delete /mnt/root - - echo "Restoring blank /root subvolume..." >> /mnt/rollback.log - btrfs subvolume snapshot /mnt/root-blank /mnt/root - - umount /mnt - ''; - +{ utils, ... }: { # Use /persist as the persistence root, matching Disko's mountpoint environment.persistence."/persist" = { hideMounts = true; directories = [ + "/var/lib/nixos" + "/var/lib/systemd/coredump" + "/var/lib/systemd/timers" + "/var/lib/backups" "/var/lib/headscale" "/var/lib/caddy" # for certs + { + directory = "/var/lib/secrets"; + user = "root"; + group = "root"; + mode = "u=rwx,g=,o="; + } ]; files = [ "/etc/machine-id" @@ -33,4 +23,38 @@ "/etc/passwd" ]; }; + + boot.initrd.systemd.services.wipe-root = { + # Specify dependencies explicitly + unitConfig.DefaultDependencies = false; + serviceConfig.Type = "oneshot"; + wantedBy = [ "initrd.target" ]; + before = [ "sysroot.mount" ]; # before any fs are mounted + + # Wait for the disk to appear + requires = [ + "${utils.escapeSystemPath "/dev/disk/by-label/root"}.device" + ]; + after = [ + "${utils.escapeSystemPath "/dev/disk/by-label/root"}.device" + # Allow hibernation to resume before trying to alter any data + "local-fs-pre.target" + ]; + + script = '' + mkdir /btrfs_tmp + mount /dev/disk/by-label/root /btrfs_tmp + trap 'umount /btrfs_tmp' EXIT + if [ -e /btrfs_tmp/root ]; then + mkdir -p /btrfs_tmp/old_roots + timestamp="$(date --date="@$(stat -c %Y /btrfs_tmp/root)" "+%Y-%m-%-d_%H:%M:%S")" + mv /btrfs_tmp/root "/btrfs_tmp/old_roots/$timestamp" + fi + + find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30 -print0 | + xargs --null -I '{}' btrfs subvolume delete --recursive '{}' + + btrfs subvolume create /btrfs_tmp/root + ''; + }; } |