From 9bea436a74286fecd8647025dce2000f3d1c4f39 Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Sun, 25 Oct 2026 13:09:56 +0100
Subject: enode: unencrypted disko btrfs setup attempt

---
 hosts/enode/default.nix      |  10 +---
 hosts/enode/disko.nix        | 140 +++++++++++++++++++++----------------------
 hosts/enode/impermenance.nix |  66 +++++++++++++-------
 3 files changed, 115 insertions(+), 101 deletions(-)

diff --git a/hosts/enode/default.nix b/hosts/enode/default.nix
index 8df17db..d52cd6e 100644
--- a/hosts/enode/default.nix
+++ b/hosts/enode/default.nix
@@ -1,6 +1,7 @@
 {
   pkgs,
   inputs,
+  modulesPath,
   ...
 }:
 {
@@ -10,16 +11,9 @@
     ./headscale.nix
     ./caddy.nix
     ./disko.nix
+    "${modulesPath}/installer/cd-dvd/installation-cd-minimal.nix"
   ];
 
-  boot.initrd.luks.devices = {
-    cryptroot = {
-      device = "/dev/disk/by-partlabel/luks";
-      allowDiscards = true;
-      preLVM = true;
-    };
-  };
-
   services.btrfs.autoScrub = {
     enable = true;
     interval = "weekly";
diff --git a/hosts/enode/disko.nix b/hosts/enode/disko.nix
index d9dfb20..2f51ab4 100644
--- a/hosts/enode/disko.nix
+++ b/hosts/enode/disko.nix
@@ -4,75 +4,68 @@ let
     format = "vfat";
     mountpoint = "/boot";
     mountOptions = [
-      "default"
+      "umask=0077"
     ];
   };
-  cryptroot = {
-    type = "luks";
-    name = "cryptroot";
-    content = {
-      type = "btrfs";
-      extraArgs = [
-        "-L"
-        "nixos"
-        "-f"
-      ];
-      subvolumes = {
-        "/root" = {
-          mountpoint = "/";
-          mountOptions = [
-            "subvol=root"
-            "compress=zstd"
-            "noatime"
-          ];
-        };
-        "/root-blank" = {
-          mountOptions = [
-            "subvol=root-blank"
-            "nodatacow"
-            "noatime"
-          ];
-        };
-        "/home" = {
-          mountpoint = "/home";
-          mountOptions = [
-            "subvol=home"
-            "compress=zstd"
-            "noatime"
-          ];
-        };
-        "/nix" = {
-          mountpoint = "/nix";
-          mountOptions = [
-            "subvol=nix"
-            "compress=zstd"
-            "noatime"
-          ];
-        };
-        "/persist" = {
-          mountpoint = "/persist";
-          mountOptions = [
-            "subvol=persist"
-            "compress=zstd"
-            "noatime"
-          ];
-        };
-        "/lib" = {
-          mountpoint = "/var/lib";
-          mountOptions = [
-            "subvol=lib"
-            "compress=zstd"
-            "noatime"
-          ];
-        };
-        "/log" = {
-          mountpoint = "/var/log";
-          mountOptions = [
-            "subvol=log"
-            "compress=zstd"
-            "noatime"
-          ];
-        };
+  rootPartition = {
+    type = "btrfs";
+    extraArgs = [ "-f" ]; # override existing partition
+    subvolumes = {
+      "/root" = {
+        mountpoint = "/";
+        mountOptions = [
+          "subvol=root"
+          "compress=zstd"
+          "noatime"
+        ];
+      };
+      "/home" = {
+        mountOptions = [
+          "subvol=home"
+          "compress=zstd"
+          "noatime"
+        ];
+        mountpoint = "/home";
+      };
+      "/nix" = {
+        mountOptions = [
+          "subvol=nix"
+          "compress=zstd"
+          "noatime"
+        ];
+        mountpoint = "/nix";
+      };
+      "/log" = {
+        mountpoint = "/var/log";
+        mountOptions = [
+          "subvol=log"
+          "compress=zstd"
+          "noatime"
+        ];
+      };
+      "/lib" = {
+        mountpoint = "/var/lib";
+        mountOptions = [
+          "subvol=lib"
+          "compress=zstd"
+          "noatime"
+        ];
+      };
+      "/persist" = {
+        mountpoint = "/var/lib/persist";
+        mountOptions = [
+          "subvol=persist"
+          "compress=zstd"
+          "noatime"
+        ];
+      };
+      "/secrets" = {
+        mountpoint = "/var/lib/secrets";
+        mountOptions = [
+          "subvol=secrets"
+          "compress=zstd"
+          "noatime"
+        ];
       };
     };
   };
@@ -81,26 +74,29 @@ in
   disko.devices.disk.vm-disk = {
     type = "disk";
     device = "/dev/vda";
+    imageSize = "10G";
     content = {
       type = "gpt";
       partitions = {
         ESP = {
-          label = "boot";
+          priority = 1;
           name = "ESP";
+          label = "boot";
           size = "1G";
           type = "EF00";
           content = espPartition;
         };
-        luks = {
+        root = {
           size = "100%";
-          label = "luks";
-          content = cryptroot;
+          name = "root";
+          label = "root";
+          content = rootPartition;
         };
       };
     };
   };
 
+  fileSystems."/var/lib/persist".neededForBoot = true;
   fileSystems."/var/log".neededForBoot = true;
   fileSystems."/var/lib".neededForBoot = true;
-  fileSystems."/persist".neededForBoot = true;
 }
diff --git a/hosts/enode/impermenance.nix b/hosts/enode/impermenance.nix
index 9915bb1..c15ea85 100644
--- a/hosts/enode/impermenance.nix
+++ b/hosts/enode/impermenance.nix
@@ -1,31 +1,21 @@
-{ lib, ... }: {
-  boot.initrd.postDeviceCommands = lib.mkAfter ''
-    echo "Rollback running" > /mnt/rollback.log
-    mkdir -p /mnt
-    mount -t btrfs /dev/mapper/cryptroot /mnt
-
-    # Recursively delete all nested subvolumes inside /mnt/root
-    btrfs subvolume list -o /mnt/root | cut -f9 -d' ' | while read subvolume; do
-      echo "Deleting /$subvolume subvolume..." >> /mnt/rollback.log
-      btrfs subvolume delete "/mnt/$subvolume"
-    done
-
-    echo "Deleting /root subvolume..." >> /mnt/rollback.log
-    btrfs subvolume delete /mnt/root
-
-    echo "Restoring blank /root subvolume..." >> /mnt/rollback.log
-    btrfs subvolume snapshot /mnt/root-blank /mnt/root
-
-    umount /mnt
-  '';
-
+{ utils, ... }: {
   # Use /persist as the persistence root, matching Disko's mountpoint
   environment.persistence."/persist" = {
     hideMounts = true;
     directories = [
+      "/var/lib/nixos"
+      "/var/lib/systemd/coredump"
+      "/var/lib/systemd/timers"
+
       "/var/lib/backups"
       "/var/lib/headscale"
       "/var/lib/caddy" # for certs
+      {
+        directory = "/var/lib/secrets";
+        user = "root";
+        group = "root";
+        mode = "u=rwx,g=,o=";
+      }
     ];
     files = [
       "/etc/machine-id"
@@ -33,4 +23,38 @@
       "/etc/passwd"
     ];
   };
+
+  boot.initrd.systemd.services.wipe-root = {
+    # Specify dependencies explicitly
+    unitConfig.DefaultDependencies = false;
+    serviceConfig.Type = "oneshot";
+    wantedBy = [ "initrd.target" ];
+    before = [ "sysroot.mount" ]; # before any fs are mounted
+
+    # Wait for the disk to appear
+    requires = [
+      "${utils.escapeSystemPath "/dev/disk/by-label/root"}.device"
+    ];
+    after = [
+      "${utils.escapeSystemPath "/dev/disk/by-label/root"}.device"
+      # Allow hibernation to resume before trying to alter any data
+      "local-fs-pre.target"
+    ];
+
+    script = ''
+      mkdir /btrfs_tmp
+      mount /dev/disk/by-label/root /btrfs_tmp
+      trap 'umount /btrfs_tmp' EXIT
+      if [ -e /btrfs_tmp/root ]; then
+        mkdir -p /btrfs_tmp/old_roots
+        timestamp="$(date --date="@$(stat -c %Y /btrfs_tmp/root)" "+%Y-%m-%-d_%H:%M:%S")"
+        mv /btrfs_tmp/root "/btrfs_tmp/old_roots/$timestamp"
+      fi
+
+      find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30 -print0 |
+        xargs --null -I '{}' btrfs subvolume delete --recursive '{}'
+
+      btrfs subvolume create /btrfs_tmp/root
+    '';
+  };
 }
-- 
cgit v1.3.1