From 1165dc44aa99f02650ea75a10e5b2ec440ebfc52 Mon Sep 17 00:00:00 2001
From: oddlama <oddlama@oddlama.org>
Date: Sun, 14 Jan 2024 14:53:05 +0100
Subject: [PATCH] feat(samba): add bunker share for very important data

---
 hosts/sire/default.nix                 |  15 ++-
 hosts/sire/guests/samba.nix            | 131 +++++++++++++++----------
 hosts/sire/secrets/samba/local.nix.age |  22 ++---
 3 files changed, 105 insertions(+), 63 deletions(-)

diff --git a/hosts/sire/default.nix b/hosts/sire/default.nix
index 2b7c11c..8639923 100644
--- a/hosts/sire/default.nix
+++ b/hosts/sire/default.nix
@@ -44,7 +44,11 @@
   # services.telegraf.extraConfig.inputs.github = {};
 
   guests = let
-    mkGuest = guestName: {enableStorageDataset ? false, ...}: {
+    mkGuest = guestName: {
+      enableStorageDataset ? false,
+      enableBunkerDataset ? false,
+      ...
+    }: {
       autostart = true;
       zfs."/state" = {
         # TODO make one option out of that? and split into two readonly options automatically?
@@ -59,6 +63,10 @@
         pool = "storage";
         dataset = "safe/guests/${guestName}";
       };
+      zfs."/bunker" = lib.mkIf enableBunkerDataset {
+        pool = "storage";
+        dataset = "bunker/guests/${guestName}";
+      };
       modules = [
         ../../modules
         ./guests/common.nix
@@ -105,7 +113,10 @@
   in
     lib.mkIf (!minimal) (
       {}
-      // mkMicrovm "samba" {enableStorageDataset = true;}
+      // mkMicrovm "samba" {
+        enableStorageDataset = true;
+        enableBunkerDataset = true;
+      }
       // mkMicrovm "grafana" {}
       // mkMicrovm "influxdb" {}
       // mkMicrovm "loki" {}
diff --git a/hosts/sire/guests/samba.nix b/hosts/sire/guests/samba.nix
index fbaecbb..750cf03 100644
--- a/hosts/sire/guests/samba.nix
+++ b/hosts/sire/guests/samba.nix
@@ -5,6 +5,58 @@
 }: let
   smbUsers = config.repo.secrets.local.samba.users;
   smbGroups = config.repo.secrets.local.samba.groups;
+
+  mkPersistent = persistRoot: directory: owner: {
+    ${persistRoot}.directories = [
+      {
+        inherit directory;
+        user = owner;
+        group = owner;
+        mode = "0750";
+      }
+    ];
+  };
+
+  mkShare = id: path: cfg: {
+    ${id} =
+      {
+        inherit path;
+        public = "no";
+        writable = "yes";
+        "create mask" = "0740";
+        "directory mask" = "0750";
+        "acl allow execute always" = "yes";
+      }
+      // cfg;
+  };
+
+  mkGroupShares = group: {enableBunker ? false, ...}:
+    [
+      (mkShare group "/shares/groups/${group}" {
+        "valid users" = "@${group}";
+        "force user" = group;
+        "force group" = group;
+      })
+    ]
+    ++ lib.optional enableBunker (
+      mkShare "${group}-bunker" "/shares/groups/${group}-bunker" {
+        "valid users" = "@${group}";
+        "force user" = group;
+        "force group" = group;
+      }
+    );
+
+  mkUserShares = user: {enableBunker ? false, ...}:
+    [
+      (mkShare user "/shares/users/${user}" {
+        "valid users" = user;
+      })
+    ]
+    ++ lib.optional enableBunker (
+      mkShare "${user}-bunker" "/shares/users/${user}-bunker" {
+        "valid users" = user;
+      }
+    );
 in {
   age.secrets."samba-passdb.tdb" = {
     rekeyFile = config.node.secretsDir + "/samba-passdb.tdb.age";
@@ -37,28 +89,32 @@ in {
     '';
   };
 
-  environment.persistence."/persist".files = [
-    "/etc/ssh/ssh_host_rsa_key"
-    "/etc/ssh/ssh_host_rsa_key.pub"
-  ];
-
   fileSystems."/storage".neededForBoot = true;
-  environment.persistence."/storage" = {
-    hideMounts = true;
-    directories =
-      lib.flip lib.mapAttrsToList smbUsers (name: _: {
-        directory = "/shares/users/${name}";
-        user = name;
-        group = name;
-        mode = "0750";
-      })
-      ++ lib.flip lib.mapAttrsToList smbGroups (name: _: {
-        directory = "/shares/groups/${name}";
-        user = name;
-        group = name;
-        mode = "0750";
-      });
-  };
+  fileSystems."/bunker".neededForBoot = true;
+  environment.persistence = lib.mkMerge ([
+      {
+        "/persist".files = [
+          "/etc/ssh/ssh_host_rsa_key"
+          "/etc/ssh/ssh_host_rsa_key.pub"
+        ];
+      }
+    ]
+    ++ lib.flatten (
+      lib.flip lib.mapAttrsToList smbUsers (
+        name: {enableBunker ? false, ...}:
+          [(mkPersistent "/storage" "/shares/users/${name}" name)]
+          ++ lib.optional enableBunker (
+            mkPersistent "/bunker" "/shares/users/${name}-bunker" name
+          )
+      )
+      ++ lib.flip lib.mapAttrsToList smbGroups (
+        name: {enableBunker ? false, ...}:
+          [(mkPersistent "/storage" "/shares/groups/${name}" name)]
+          ++ lib.optional enableBunker (
+            mkPersistent "/bunker" "/shares/groups/${name}-bunker" name
+          )
+      )
+    ));
 
   services.samba = {
     enable = true;
@@ -121,35 +177,10 @@ in {
       "fruit:wipe_intentionally_left_blank_rfork = yes"
       "fruit:delete_empty_adfiles = yes"
     ];
-    shares = let
-      mkShare = path: cfg:
-        {
-          inherit path;
-          public = "no";
-          writable = "yes";
-          "create mask" = "0740";
-          "directory mask" = "0750";
-          # "force create mode" = "0660";
-          # "force directory mode" = "0770";
-          "acl allow execute always" = "yes";
-        }
-        // cfg;
-
-      mkGroupShare = group:
-        mkShare "/shares/groups/${group}" {
-          "valid users" = "@${group}";
-          "force user" = group;
-          "force group" = group;
-        };
-
-      mkUserShare = user:
-        mkShare "/shares/users/${user}" {
-          "valid users" = user;
-        };
-    in
-      {}
-      // lib.mapAttrs (name: _: mkUserShare name) smbUsers
-      // lib.mapAttrs (name: _: mkGroupShare name) smbGroups;
+    shares = lib.mkMerge (lib.flatten (
+      lib.mapAttrsToList mkUserShares smbUsers
+      ++ lib.mapAttrsToList mkGroupShares smbGroups
+    ));
   };
 
   users.users = let
diff --git a/hosts/sire/secrets/samba/local.nix.age b/hosts/sire/secrets/samba/local.nix.age
index 949b563..75eefdc 100644
--- a/hosts/sire/secrets/samba/local.nix.age
+++ b/hosts/sire/secrets/samba/local.nix.age
@@ -1,12 +1,12 @@
 age-encryption.org/v1
--> X25519 fKbik0Nwn3w0RFtyYjRx3NIRR6p1ePjwN1rQeQUKnC0
-FESp5Xwwuu3hifwpoalYD75/g994HsDJb6a7lasAH98
--> piv-p256 xqSe8Q A/f8+j/94A2oU2/SynYRewGBZbPWy1rGU5pnUPksXkwH
-n+KeTBbXvjCu9GZypD8Vmz2uuN1XaZpDfX40TNk74js
--> *:l-grease D8U!RlB wkBn7Zl4
-PLWQ+OcE+p/gZ9AaOl5RmO8C5IO5rQD3GIazmdWs/ImIbPFgSY7NM+Tb4j/qrQez
-
---- 2ucK0s28/BTrnfxnm0vOvqsmOXLXBEnsxHMRHYUyLHo
-�b��oѯVo}��]3Kп�pp�\��Yi�}:FH��^
�U�>�R���eM`0�+��կ�����놪��1�50:F�Y2M�^[u���ZMy;�k�]z8��a~M�ԟ�1�c�/��U�3)�r��ǖU�>������x?�6x�6`!R_ψ�����挦�᷎���&�(.�{x��?r�h����B}̨N��#���g[���2aR��lR�T�ϣ�9W��۠]���I���2
6���l�?�������
-~�Xߵ���O��φ#�!��.���*�Ĥmjh*C���}�{!���
-�&�N��m#vEFb˖3C�d\}�ajR�[��[�+�p2%���ȭ���/|5��(��-�����a��d��_@���g�|.��o�+�[�V�`�tP���
\ No newline at end of file
+-> X25519 XPiCVTwoNp+wxBHO+VroeCoWNHVsdtjeSEX4cLCnHFY
+RWmVk3RrtU3qOBjvBbYJ9qSf34PHXAUVhnC9fdFCEf4
+-> piv-p256 xqSe8Q A4hKgmiwNm99B4RVisUnKDDj4r6KtOOpeVCBM35Z/V76
+OLj3c+OIFfqbclocmoIKuKEaOengs0cCipI4wNRrbaQ
+-> 46$NeX?-grease Z'&t |s}Wh:
+P0L0T0ObtToRodYfse+ETpl3GWGAbLlVFrJJackWMgkOWIjkU8YvKmQHcQ7QTSc7
+bFyyf1pDEkkAGAZEzoqnem+0sZN4bcqNuZJKqkzCaJDeJvrui0sCfyj0
+--- HCDoDWmBPaPfC3oh/qroi2nMtBI3PvmAfhlRpPpktJk
+e��>�~�/Ĭ�ƻo�!e܎���~Fh��������eFd����R
˲0%E�TxV\�7���%��z�BѢ&q�Ւ��e=p�R��	K΍c����Zپ���4��w�~�s
+b<[�u���<g�}W8uY�?��`'��\O�T�(tJ}ߝ5ns(W�V�R�"�d�LHG��1�<�m�OYS���.�`�7A�c�Z����y��
1"`�.3�l�����s�g�7�t
��EmAemvGұ����$�^j�)*ᩦ������=h�Sa�Y�P�1]7ۈ��/-R��5P�q£"�$)������^��`�"~Tu�.=;�?.�m��0���-��?O�!�K,�B���	ܸN?��Yh�=��_���<ۯR[�>���	Z6Q��
k���!������!$K[�QU;fg�|��P쐆K��VQh~���
+���e��K�E1�ޝA����ΜtUD\;ş
\ No newline at end of file