From 9bea436a74286fecd8647025dce2000f3d1c4f39 Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Sun, 25 Oct 2026 13:09:56 +0100
Subject: enode: unencrypted disko btrfs setup attempt

---
 hosts/enode/impermenance.nix | 66 ++++++++++++++++++++++++++++++--------------
 1 file changed, 45 insertions(+), 21 deletions(-)

(limited to 'hosts/enode/impermenance.nix')

diff --git a/hosts/enode/impermenance.nix b/hosts/enode/impermenance.nix
index 9915bb1..c15ea85 100644
--- a/hosts/enode/impermenance.nix
+++ b/hosts/enode/impermenance.nix
@@ -1,31 +1,21 @@
-{ lib, ... }: {
-  boot.initrd.postDeviceCommands = lib.mkAfter ''
-    echo "Rollback running" > /mnt/rollback.log
-    mkdir -p /mnt
-    mount -t btrfs /dev/mapper/cryptroot /mnt
-
-    # Recursively delete all nested subvolumes inside /mnt/root
-    btrfs subvolume list -o /mnt/root | cut -f9 -d' ' | while read subvolume; do
-      echo "Deleting /$subvolume subvolume..." >> /mnt/rollback.log
-      btrfs subvolume delete "/mnt/$subvolume"
-    done
-
-    echo "Deleting /root subvolume..." >> /mnt/rollback.log
-    btrfs subvolume delete /mnt/root
-
-    echo "Restoring blank /root subvolume..." >> /mnt/rollback.log
-    btrfs subvolume snapshot /mnt/root-blank /mnt/root
-
-    umount /mnt
-  '';
-
+{ utils, ... }: {
   # Use /persist as the persistence root, matching Disko's mountpoint
   environment.persistence."/persist" = {
     hideMounts = true;
     directories = [
+      "/var/lib/nixos"
+      "/var/lib/systemd/coredump"
+      "/var/lib/systemd/timers"
+
       "/var/lib/backups"
       "/var/lib/headscale"
       "/var/lib/caddy" # for certs
+      {
+        directory = "/var/lib/secrets";
+        user = "root";
+        group = "root";
+        mode = "u=rwx,g=,o=";
+      }
     ];
     files = [
       "/etc/machine-id"
@@ -33,4 +23,38 @@
       "/etc/passwd"
     ];
   };
+
+  boot.initrd.systemd.services.wipe-root = {
+    # Specify dependencies explicitly
+    unitConfig.DefaultDependencies = false;
+    serviceConfig.Type = "oneshot";
+    wantedBy = [ "initrd.target" ];
+    before = [ "sysroot.mount" ]; # before any fs are mounted
+
+    # Wait for the disk to appear
+    requires = [
+      "${utils.escapeSystemPath "/dev/disk/by-label/root"}.device"
+    ];
+    after = [
+      "${utils.escapeSystemPath "/dev/disk/by-label/root"}.device"
+      # Allow hibernation to resume before trying to alter any data
+      "local-fs-pre.target"
+    ];
+
+    script = ''
+      mkdir /btrfs_tmp
+      mount /dev/disk/by-label/root /btrfs_tmp
+      trap 'umount /btrfs_tmp' EXIT
+      if [ -e /btrfs_tmp/root ]; then
+        mkdir -p /btrfs_tmp/old_roots
+        timestamp="$(date --date="@$(stat -c %Y /btrfs_tmp/root)" "+%Y-%m-%-d_%H:%M:%S")"
+        mv /btrfs_tmp/root "/btrfs_tmp/old_roots/$timestamp"
+      fi
+
+      find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30 -print0 |
+        xargs --null -I '{}' btrfs subvolume delete --recursive '{}'
+
+      btrfs subvolume create /btrfs_tmp/root
+    '';
+  };
 }
-- 
cgit v1.3.1