From 9f2a34d83b841649cfd7cf0c483b839ed9d48687 Mon Sep 17 00:00:00 2001 From: oddlama Date: Mon, 4 Sep 2023 21:23:40 +0200 Subject: [PATCH] feat: allow defining impermanence dirs from home manager configs --- modules/config/impermanence.nix | 111 ++++++++++++++++++++++++----- users/common/default.nix | 1 + users/common/impermanence.nix | 52 ++++++++++++++ users/myuser/default.nix | 33 --------- users/myuser/graphical/default.nix | 40 +++++++---- 5 files changed, 173 insertions(+), 64 deletions(-) create mode 100644 users/common/impermanence.nix diff --git a/modules/config/impermanence.nix b/modules/config/impermanence.nix index 173195a..6f6bf56 100644 --- a/modules/config/impermanence.nix +++ b/modules/config/impermanence.nix @@ -2,10 +2,87 @@ config, lib, ... -}: { +}: let + inherit + (lib) + attrNames + flip + isAttrs + mapAttrs + mkMerge + mkOption + optionals + types + ; +in { # Give agenix access to the hostkey independent of impermanence activation age.identityPaths = ["/persist/etc/ssh/ssh_host_ed25519_key"]; + # Expose a home manager module for each user that allows extending + # environment.persistence.${sourceDir}.users.${userName} simply by + # specifying home.persistence.${sourceDir} in home manager. + home-manager.sharedModules = [ + { + options.home.persistence = mkOption { + description = "Additional persistence config for the given source path"; + default = {}; + type = types.attrsOf (types.submodule { + options = { + files = mkOption { + description = "Additional files to persist via NixOS impermanence."; + type = types.listOf (types.either types.attrs types.str); + default = []; + }; + + directories = mkOption { + description = "Additional directories to persist via NixOS impermanence."; + type = types.listOf (types.either types.attrs types.str); + default = []; + }; + }; + }); + }; + } + ]; + + # For each user that has a home-manager config, merge the locally defined + # persistence options that we defined above. + imports = let + mkUserFiles = map (x: + {mode = "600";} + // ( + if isAttrs x + then x + else {file = x;} + )); + mkUserDirs = map (x: + {mode = "700";} + // ( + if isAttrs x + then x + else {directory = x;} + )); + in [ + { + environment.persistence = mkMerge ( + flip map + (attrNames config.home-manager.users) + ( + user: let + hmUserCfg = config.home-manager.users.${user}; + in + flip mapAttrs hmUserCfg.home.persistence + (_: sourceCfg: { + users.${user} = { + files = mkUserFiles sourceCfg.files; + directories = mkUserDirs sourceCfg.directories; + }; + }) + ) + ); + } + ]; + # State that should be kept across reboots, but is otherwise # NOT important information in any way that needs to be backed up. fileSystems."/state".neededForBoot = true; @@ -34,7 +111,7 @@ mode = "0755"; } ] - ++ lib.optionals config.networking.wireless.iwd.enable [ + ++ optionals config.networking.wireless.iwd.enable [ { directory = "/var/lib/iwd"; user = "root"; @@ -62,7 +139,7 @@ mode = "0755"; } ] - ++ lib.optionals config.security.acme.acceptTerms [ + ++ optionals config.security.acme.acceptTerms [ { directory = "/var/lib/acme"; user = "acme"; @@ -70,7 +147,7 @@ mode = "0755"; } ] - ++ lib.optionals config.services.printing.enable [ + ++ optionals config.services.printing.enable [ { directory = "/var/lib/cups"; user = "root"; @@ -78,7 +155,7 @@ mode = "0700"; } ] - ++ lib.optionals config.services.fail2ban.enable [ + ++ optionals config.services.fail2ban.enable [ { directory = "/var/lib/fail2ban"; user = "fail2ban"; @@ -86,7 +163,7 @@ mode = "0750"; } ] - ++ lib.optionals config.services.postgresql.enable [ + ++ optionals config.services.postgresql.enable [ { directory = "/var/lib/postgresql"; user = "postgres"; @@ -94,7 +171,7 @@ mode = "0700"; } ] - ++ lib.optionals config.services.gitea.enable [ + ++ optionals config.services.gitea.enable [ { directory = config.services.gitea.stateDir; user = "gitea"; @@ -102,7 +179,7 @@ mode = "0700"; } ] - ++ lib.optionals config.services.caddy.enable [ + ++ optionals config.services.caddy.enable [ { directory = config.services.caddy.dataDir; user = "caddy"; @@ -110,7 +187,7 @@ mode = "0700"; } ] - ++ lib.optionals config.services.loki.enable [ + ++ optionals config.services.loki.enable [ { directory = "/var/lib/loki"; user = "loki"; @@ -118,7 +195,7 @@ mode = "0700"; } ] - ++ lib.optionals config.services.grafana.enable [ + ++ optionals config.services.grafana.enable [ { directory = config.services.grafana.dataDir; user = "grafana"; @@ -126,7 +203,7 @@ mode = "0700"; } ] - ++ lib.optionals config.services.kanidm.enableServer [ + ++ optionals config.services.kanidm.enableServer [ { directory = "/var/lib/kanidm"; user = "kanidm"; @@ -134,7 +211,7 @@ mode = "0700"; } ] - ++ lib.optionals config.services.vaultwarden.enable [ + ++ optionals config.services.vaultwarden.enable [ { directory = "/var/lib/vaultwarden"; user = "vaultwarden"; @@ -142,7 +219,7 @@ mode = "0700"; } ] - ++ lib.optionals config.services.influxdb2.enable [ + ++ optionals config.services.influxdb2.enable [ { directory = "/var/lib/influxdb2"; user = "influxdb2"; @@ -150,7 +227,7 @@ mode = "0700"; } ] - ++ lib.optionals config.services.telegraf.enable [ + ++ optionals config.services.telegraf.enable [ { directory = "/var/lib/telegraf"; user = "telegraf"; @@ -158,7 +235,7 @@ mode = "0700"; } ] - ++ lib.optionals config.services.adguardhome.enable [ + ++ optionals config.services.adguardhome.enable [ { directory = "/var/lib/private/AdGuardHome"; user = "root"; @@ -166,7 +243,7 @@ mode = "0700"; } ] - ++ lib.optionals config.services.esphome.enable [ + ++ optionals config.services.esphome.enable [ { directory = "/var/lib/private/esphome"; user = "root"; @@ -174,7 +251,7 @@ mode = "0700"; } ] - ++ lib.optionals config.services.home-assistant.enable [ + ++ optionals config.services.home-assistant.enable [ { directory = config.services.home-assistant.configDir; user = "hass"; diff --git a/users/common/default.nix b/users/common/default.nix index 5a4f923..11f0c36 100644 --- a/users/common/default.nix +++ b/users/common/default.nix @@ -4,6 +4,7 @@ ./git.nix ./htop.nix + ./impermanence.nix ./neovim.nix ./shell ./utils.nix diff --git a/users/common/impermanence.nix b/users/common/impermanence.nix new file mode 100644 index 0000000..392f97f --- /dev/null +++ b/users/common/impermanence.nix @@ -0,0 +1,52 @@ +{ + config, + nixosConfig, + ... +}: { + home.persistence."/state".files = + [ + # nothing yet ... + ] + ++ optionals config.programs.ssh.enable [ + ".ssh/known_hosts" + ]; + + home.persistence."/state".directories = + [ + ".cache/fontconfig" + ".cache/nix" # nix eval cache + ".cache/nix-index" + ] + ++ optionals config.programs.firefox.enable [ + ".cache/mozilla" + ] + ++ optionals config.programs.direnv.enable [ + ".local/share/direnv" + ] + ++ optionals config.programs.neovim.enable [ + ".local/share/nvim" + ".local/state/nvim" + ".cache/nvim" + ] + ++ optionals nixosConfig.hardware.nvidia.enable [ + ".cache/nvidia" # GLCache + ] + ++ optionals nixosConfig.services.pipewire.enable [ + ".local/state/wireplumber" + ]; + + home.persistence."/persist".directories = + [ + ".local/share/nix" # Repl history + ] + ++ optionals config.programs.firefox.enable [ + ".mozilla" + ] + ++ optionals config.programs.atuin.enable [ + ".local/share/atuin" + ] + ++ optionals nixosConfig.programs.steam.enable [ + ".local/share/Steam" + ".steam" + ]; +} diff --git a/users/myuser/default.nix b/users/myuser/default.nix index 4bfe1fe..f81cc3b 100644 --- a/users/myuser/default.nix +++ b/users/myuser/default.nix @@ -1,14 +1,9 @@ { config, - lib, pkgs, ... }: let myuser = config.repo.secrets.global.myuser.name; - mkUserDirs = map (directory: { - inherit directory; - mode = "700"; - }); in { users.groups.${myuser}.gid = config.users.users.${myuser}.uid; users.users.${myuser} = { @@ -25,40 +20,12 @@ in { # Needed for gtk programs.dconf.enable = true; - # TODO age.secrets = mapAttrs user.hmConfig.cfg.age.secrets users age.secrets.my-gpg-pubkey-yubikey = { rekeyFile = ./yubikey.gpg.age; group = myuser; mode = "640"; }; - # TODO numlock default on in sway and kernel console - # TODO make dataset for safe/persist/ and automount it - # TODO modularized based on hmConfig - environment.persistence."/state".users.${myuser}.directories = mkUserDirs [ - ".cache/fontconfig" - ".cache/mozilla" - ".cache/nix" # nix eval cache - ".cache/nix-index" - ".cache/nvidia" # GLCache - ".cache/nvim" - ".local/share/nvim" - ".local/state/direnv" - ".local/state/nix" - ".local/state/nvim" - ".local/state/wireplumber" - "Downloads" - ]; - - environment.persistence."/persist".users.${myuser}.directories = mkUserDirs [ - ".mozilla" - ".config/discord" # Bad Discord! BAD! Saves state in ,config tststs - ".config/Signal" # L take, electron. - ".local/share/atuin" - ".local/share/nix" # Repl history - "projects" - ]; - home-manager.users.${myuser} = { imports = [ ../common diff --git a/users/myuser/graphical/default.nix b/users/myuser/graphical/default.nix index 37091e0..b22dcb1 100644 --- a/users/myuser/graphical/default.nix +++ b/users/myuser/graphical/default.nix @@ -4,21 +4,33 @@ ./sway.nix ]; - home.packages = with pkgs; [ - discord - firefox - thunderbird - signal-desktop - chromium - zathura - feh - ]; + home = { + packages = with pkgs; [ + discord + firefox + thunderbird + signal-desktop + chromium + zathura + feh + ]; - # TODO VP9 hardware video decoding blocklisted - # TODO gpg switch to sk + # TODO VP9 hardware video decoding blocklisted + # TODO gpg switch to sk - home.shellAliases = { - p = "cd ~/projects"; - zf = "zathura --fork"; + shellAliases = { + p = "cd ~/projects"; + zf = "zathura --fork"; + }; + + persistence."/persist".directories = [ + ".config/discord" # Bad Discord! BAD! Saves its state in .config tststs + ".config/Signal" # L take, electron. + "projects" + ]; + + persistence."/state".directories = [ + "Downloads" + ]; }; }