mirrors_public/oddlama_nix-config
1
1
Fork 1
mirror of https://github.com/oddlama/nix-config.git synced 2025-10-11 07:10:39 +02:00
Code Activity

chore: simplify some impermanence, switch agenix-rekey cacheDir to /var/tmp

Browse source
This commit is contained in:
oddlama 2023-09-24 19:48:16 +02:00
parent b3f08ef7c3
commit 20207213c7
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
4 changed files with 13 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

10
flake.lock generated
View file

@ -52,12 +52,12 @@
"pre-commit-hooks": "pre-commit-hooks" "pre-commit-hooks": "pre-commit-hooks"
}, },
"locked": { "locked": {
"dirtyRev": "8e853a2094472ac2665b453de41832f0f6cf0aa9-dirty", "lastModified": 1695572027,
"dirtyShortRev": "8e853a2-dirty",
"lastModified": 1695571453,
"narHash": "sha256-Qws2IEoO/L7YGzXyweL5VlgHaTWR4UY7Apkbxhihrzg=", "narHash": "sha256-Qws2IEoO/L7YGzXyweL5VlgHaTWR4UY7Apkbxhihrzg=",
"type": "git", "owner": "oddlama",
"url": "file:///home/malte/projects/agenix-rekey" "repo": "agenix-rekey",
"rev": "0dbcb125b426050ff63e7453d051513ec063a352",
"type": "github"
}, },
"original": { "original": {
"owner": "oddlama", "owner": "oddlama",

41
modules/config/impermanence.nix
View file

@ -90,32 +90,16 @@ in {
hideMounts = true; hideMounts = true;
directories = directories =
[ [
{ "/var/tmp/agenix-rekey"
directory = "/var/lib/systemd"; "/var/lib/systemd"
user = "root"; "/var/log"
group = "root"; #{ directory = "/tmp"; mode = "1777"; }
mode = "0755"; #{ directory = "/var/tmp"; mode = "1777"; }
} "/var/spool"
{
directory = "/var/log";
user = "root";
group = "root";
mode = "0755";
}
#{ directory = "/tmp"; user = "root"; group = "root"; mode = "1777"; }
#{ directory = "/var/tmp"; user = "root"; group = "root"; mode = "1777"; }
{
directory = "/var/spool";
user = "root";
group = "root";
mode = "0755";
}
] ]
++ optionals config.networking.wireless.iwd.enable [ ++ optionals config.networking.wireless.iwd.enable [
{ {
directory = "/var/lib/iwd"; directory = "/var/lib/iwd";
user = "root";
group = "root";
mode = "0700"; mode = "0700";
} }
]; ];
@ -132,12 +116,7 @@ in {
]; ];
directories = directories =
[ [
{ "/var/lib/nixos"
directory = "/var/lib/nixos";
user = "root";
group = "root";
mode = "0755";
}
] ]
++ optionals config.security.acme.acceptTerms [ ++ optionals config.security.acme.acceptTerms [
{ {
@ -150,8 +129,6 @@ in {
++ optionals config.services.printing.enable [ ++ optionals config.services.printing.enable [
{ {
directory = "/var/lib/cups"; directory = "/var/lib/cups";
user = "root";
group = "root";
mode = "0700"; mode = "0700";
} }
] ]
@ -238,16 +215,12 @@ in {
++ optionals config.services.adguardhome.enable [ ++ optionals config.services.adguardhome.enable [
{ {
directory = "/var/lib/private/AdGuardHome"; directory = "/var/lib/private/AdGuardHome";
user = "root";
group = "root";
mode = "0700"; mode = "0700";
} }
] ]
++ optionals config.services.esphome.enable [ ++ optionals config.services.esphome.enable [
{ {
directory = "/var/lib/private/esphome"; directory = "/var/lib/private/esphome";
user = "root";
group = "root";
mode = "0700"; mode = "0700";
} }
] ]

2
modules/config/secrets.nix
View file

@ -26,7 +26,7 @@
forceRekeyOnSystem = builtins.extraBuiltins.unsafeCurrentSystem; forceRekeyOnSystem = builtins.extraBuiltins.unsafeCurrentSystem;
hostPubkey = config.node.secretsDir + "/host.pub"; hostPubkey = config.node.secretsDir + "/host.pub";
generatedSecretsDir = inputs.self.outPath + "/secrets/generated/${config.node.name}"; generatedSecretsDir = inputs.self.outPath + "/secrets/generated/${config.node.name}";
cacheDir = "\"\${XDG_CACHE_HOME:=$HOME/.cache}/agenix-rekey\""; cacheDir = "/var/tmp/agenix-rekey/\"$UID\"";
}; };
age.generators.basic-auth = { age.generators.basic-auth = {

1
users/modules/config/impermanence.nix
View file

@ -12,7 +12,6 @@ in {
home.persistence."/state".directories = home.persistence."/state".directories =
[ [
".cache/agenix-rekey" # agenix-rekey cache
".cache/fontconfig" ".cache/fontconfig"
".cache/nix" # nix eval cache ".cache/nix" # nix eval cache
".config/dconf" # some apps store their configuration using dconf ".config/dconf" # some apps store their configuration using dconf