feat: put impermanence for services next to service definitions

hosts/ward/guests/adguardhome.nix

@@ -34,6 +34,13 @@ in {
     };
   };
 
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/private/AdGuardHome";
+      mode = "0700";
+    }
+  ];
+
   networking.firewall = {
     allowedTCPPorts = [53];
     allowedUDPPorts = [53];

hosts/ward/guests/forgejo.nix

@@ -61,6 +61,15 @@ in {
   # Recommended by forgejo: https://forgejo.org/docs/latest/admin/recommendations/#git-over-ssh
   services.openssh.settings.AcceptEnv = "GIT_PROTOCOL";
 
+  environment.persistence."/persist".directories = [
+    {
+      directory = config.services.gitea.stateDir;
+      user = "gitea";
+      group = "gitea";
+      mode = "0700";
+    }
+  ];
+
   services.gitea = {
     enable = true;
     package = pkgs.forgejo;

hosts/ward/guests/grafana.nix

@@ -75,6 +75,15 @@ in {
     };
   };
 
+  environment.persistence."/persist".directories = [
+    {
+      directory = config.services.grafana.dataDir;
+      user = "grafana";
+      group = "grafana";
+      mode = "0700";
+    }
+  ];
+
   services.grafana = {
     enable = true;
     settings = {

hosts/ward/guests/influxdb.nix

@@ -68,6 +68,15 @@ in {
     group = "influxdb2";
   };
 
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/influxdb2";
+      user = "influxdb2";
+      group = "influxdb2";
+      mode = "0700";
+    }
+  ];
+
   services.influxdb2 = {
     enable = true;
     settings = {

hosts/ward/guests/kanidm.nix

@@ -80,6 +80,15 @@ in {
     };
   };
 
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/kanidm";
+      user = "kanidm";
+      group = "kanidm";
+      mode = "0700";
+    }
+  ];
+
   services.kanidm = {
     enableServer = true;
     serverSettings = {

hosts/ward/guests/loki.nix

@@ -52,6 +52,15 @@ in {
     };
   };
 
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/loki";
+      user = "loki";
+      group = "loki";
+      mode = "0700";
+    }
+  ];
+
   services.loki = let
     lokiDir = "/var/lib/loki";
   in {

hosts/ward/guests/paperless.nix

@@ -46,6 +46,15 @@ in {
     };
   };
 
+  # TODO environment.persistence."/persist".directories = [
+  # TODO   {
+  # TODO     directory = "/var/lib/???";
+  # TODO     user = "???";
+  # TODO     group = "???";
+  # TODO     mode = "0700";
+  # TODO   }
+  # TODO ];
+
   services.paperless = {
     enable = true;
     address = "0.0.0.0";

hosts/ward/guests/vaultwarden.nix

@@ -18,6 +18,15 @@ in {
     group = "vaultwarden";
   };
 
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/vaultwarden";
+      user = "vaultwarden";
+      group = "vaultwarden";
+      mode = "0700";
+    }
+  ];
+
   nodes.sentinel = {
     networking.providedDomains.vaultwarden = vaultwardenDomain;
 

hosts/zackbiene/esphome.nix

@@ -1,4 +1,11 @@
 {config, ...}: {
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/private/esphome";
+      mode = "0700";
+    }
+  ];
+
   services.esphome = {
     enable = true;
     enableUnixSocket = true;

hosts/zackbiene/home-assistant.nix

@@ -9,6 +9,15 @@
 in {
   meta.wireguard-proxy.sentinel.allowedTCPPorts = [80];
 
+  environment.persistence."/persist".directories = [
+    {
+      directory = config.services.home-assistant.configDir;
+      user = "hass";
+      group = "hass";
+      mode = "0700";
+    }
+  ];
+
   services.home-assistant = {
     enable = true;
     extraComponents = [