From 708b00ac61e152dd61af0e59753d628f5b139239 Mon Sep 17 00:00:00 2001
From: DerGrumpf <phil.keier@hotmail.com>
Date: Sun, 28 Jun 2026 23:23:56 +0200
Subject: [PATCH] Added Impermanence and Disko setup to Proxy

---
 flake.nix                                    |  4 +
 hosts/cyper-proxy/configuration.nix          |  1 +
 hosts/cyper-proxy/disko.nix                  | 65 +++++++++++++++
 hosts/cyper-proxy/hardware-configuration.nix | 22 ++---
 nixos/roles/matrix/clients.nix               |  9 ++
 nixos/roles/matrix/discord-bridge.nix        |  9 ++
 nixos/roles/matrix/maubot.nix                | 17 +++-
 nixos/roles/matrix/meta-bridge.nix           | 15 ++++
 nixos/roles/matrix/mjolnir.nix               | 13 ++-
 nixos/roles/matrix/synapse.nix               | 88 +++++++++++++-------
 nixos/roles/matrix/whatsapp-bridge.nix       | 59 +++++++------
 11 files changed, 225 insertions(+), 77 deletions(-)
 create mode 100644 hosts/cyper-proxy/disko.nix

diff --git a/flake.nix b/flake.nix
index fa54599..1136839 100644
--- a/flake.nix
+++ b/flake.nix
@@ -271,6 +271,10 @@
         install-cyper-controller = mkInstall {
           hostName = "cyper-controller";
         };
+        install-cyper-proxy = mkInstall {
+          hostName = "cyper-proxy";
+          target = ""; # KVM console IP
+        };
       };
     };
 }
diff --git a/hosts/cyper-proxy/configuration.nix b/hosts/cyper-proxy/configuration.nix
index 3c04997..8283e34 100644
--- a/hosts/cyper-proxy/configuration.nix
+++ b/hosts/cyper-proxy/configuration.nix
@@ -1,6 +1,7 @@
 { ... }:
 {
   imports = [
+    ./disko.nix
     ./hardware-configuration.nix
     ../../nixos/roles/nginx.nix
     #    ../../nixos/roles/jitsi.nix
diff --git a/hosts/cyper-proxy/disko.nix b/hosts/cyper-proxy/disko.nix
new file mode 100644
index 0000000..aea91c7
--- /dev/null
+++ b/hosts/cyper-proxy/disko.nix
@@ -0,0 +1,65 @@
+{
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/vda";
+    content = {
+      type = "gpt";
+      partitions = {
+        boot = {
+          size = "1M";
+          type = "EF02";
+        };
+        ESP = {
+          size = "512M";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = [
+              "fmask=0022"
+              "dmask=0022"
+            ];
+            extraArgs = [
+              "-n"
+              "NIXBOOT"
+            ];
+          };
+        };
+        swap = {
+          size = "4G";
+          content = {
+            type = "swap";
+            extraArgs = [
+              "-L"
+              "NIXSWAP"
+            ];
+          };
+        };
+        nix = {
+          size = "40G";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/nix";
+            extraArgs = [
+              "-L"
+              "NIXSTORE"
+            ];
+          };
+        };
+        persist = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/persist";
+            extraArgs = [
+              "-L"
+              "NIXPERSIST"
+            ];
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/hosts/cyper-proxy/hardware-configuration.nix b/hosts/cyper-proxy/hardware-configuration.nix
index 46e3130..a3c9403 100644
--- a/hosts/cyper-proxy/hardware-configuration.nix
+++ b/hosts/cyper-proxy/hardware-configuration.nix
@@ -5,11 +5,6 @@
   ];
 
   boot = {
-    loader.grub = {
-      enable = true;
-      device = "/dev/vda";
-    };
-
     initrd = {
       availableKernelModules = [
         "ata_piix"
@@ -27,21 +22,18 @@
 
   fileSystems = {
     "/" = {
-      device = "/dev/disk/by-label/NIXROOT";
-      fsType = "ext4";
-    };
-
-    "/boot" = {
-      device = "/dev/disk/by-label/NIXBOOT";
-      fsType = "vfat";
+      device = "none";
+      fsType = "tmpfs";
       options = [
-        "fmask=0022"
-        "dmask=0022"
+        "defaults"
+        "size=2G"
+        "mode=755"
       ];
     };
   };
 
-  swapDevices = [ ];
+  fileSystems."/nix".neededForBoot = true;
+  fileSystems."/persist".neededForBoot = true;
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }
diff --git a/nixos/roles/matrix/clients.nix b/nixos/roles/matrix/clients.nix
index 62c6c92..57dc53d 100644
--- a/nixos/roles/matrix/clients.nix
+++ b/nixos/roles/matrix/clients.nix
@@ -149,6 +149,15 @@ let
 
 in
 {
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/containers";
+      user = "root";
+      group = "root";
+      mode = "0700";
+    }
+  ];
+
   services.nginx.virtualHosts = {
     "cinny.cyperpunk.de" = {
       forceSSL = true;
diff --git a/nixos/roles/matrix/discord-bridge.nix b/nixos/roles/matrix/discord-bridge.nix
index 0f61cf0..a3c6fc4 100644
--- a/nixos/roles/matrix/discord-bridge.nix
+++ b/nixos/roles/matrix/discord-bridge.nix
@@ -15,6 +15,15 @@
     };
   };
 
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/mautrix-discord";
+      user = "mautrix-discord";
+      group = "mautrix-discord";
+      mode = "0750";
+    }
+  ];
+
   systemd = {
     services = {
       mautrix-discord-env = {
diff --git a/nixos/roles/matrix/maubot.nix b/nixos/roles/matrix/maubot.nix
index 439b6c1..2a71ee2 100644
--- a/nixos/roles/matrix/maubot.nix
+++ b/nixos/roles/matrix/maubot.nix
@@ -1,8 +1,19 @@
 { config, pkgs, ... }:
 {
-  environment.systemPackages = with pkgs; [
-    maubot
-  ];
+  environment = {
+    systemPackages = with pkgs; [
+      maubot
+    ];
+
+    persistence."/persist".directories = [
+      {
+        directory = "/var/lib/maubot";
+        user = "maubot";
+        group = "maubot";
+        mode = "0750";
+      }
+    ];
+  };
 
   services = {
     maubot = {
diff --git a/nixos/roles/matrix/meta-bridge.nix b/nixos/roles/matrix/meta-bridge.nix
index 98e9c25..7f8f70e 100644
--- a/nixos/roles/matrix/meta-bridge.nix
+++ b/nixos/roles/matrix/meta-bridge.nix
@@ -19,6 +19,21 @@
     };
   };
 
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/mautrix-meta-facebook";
+      user = "mautrix-meta-facebook";
+      group = "mautrix-meta";
+      mode = "0750";
+    }
+    {
+      directory = "/var/lib/mautrix-meta-instagram";
+      user = "mautrix-meta-instagram";
+      group = "mautrix-meta";
+      mode = "0750";
+    }
+  ];
+
   systemd.services = {
     mautrix-meta-facebook-env = {
       before = [ "mautrix-meta-facebook-registration.service" ];
diff --git a/nixos/roles/matrix/mjolnir.nix b/nixos/roles/matrix/mjolnir.nix
index ff96a2c..8ae8c44 100644
--- a/nixos/roles/matrix/mjolnir.nix
+++ b/nixos/roles/matrix/mjolnir.nix
@@ -2,6 +2,15 @@
 {
   sops.secrets.mjolnir_access_token = { };
 
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/private";
+      user = "root";
+      group = "root";
+      mode = "0700";
+    }
+  ];
+
   services.draupnir = {
     enable = true;
     secrets.accessToken = config.sops.secrets.mjolnir_access_token.path;
@@ -11,7 +20,3 @@
     };
   };
 }
-
-#curl -X POST https://matrix.cyperpunk.de/_matrix/client/v3/login \
-#  -H "Content-Type: application/json" \
-#  -d '{"type":"m.login.password ","user":"mjolnir","password":"i318HXBRkt)Lh$nOPwq#6n9z&<W[XJ&2c4$Zf>7jV}-uQCE{<plwk;LZ)10*N<~1"}'
diff --git a/nixos/roles/matrix/synapse.nix b/nixos/roles/matrix/synapse.nix
index 598e455..c0a67ea 100644
--- a/nixos/roles/matrix/synapse.nix
+++ b/nixos/roles/matrix/synapse.nix
@@ -49,30 +49,44 @@ in
     };
   };
 
-  systemd.tmpfiles.rules = [
-    "d /var/www/matrix            0755 nginx nginx -"
-    "L+ /var/www/matrix/index.html   0644 nginx nginx - ${matrixIndexHtml}"
-    "L+ /var/www/matrix/register.php 0644 nginx nginx - ${matrixRegisterPhp}"
-    "L+ /var/www/matrix/style.css  0644 nginx nginx - ${matrixStyleCss}"
-    "L+ /var/www/matrix/app.js     0644 nginx nginx - ${matrixAppJs}"
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/matrix-synapse";
+      user = "matrix-synapse";
+      group = "matrix-synapse";
+      mode = "0700";
+    }
+    {
+      directory = "/var/lib/postgresql";
+      user = "postgres";
+      group = "postgres";
+      mode = "0750";
+    }
+    {
+      directory = "/var/lib/acme";
+      user = "acme";
+      group = "acme";
+      mode = "0755";
+    }
   ];
 
-  services.phpfpm.pools.matrix = {
-    user = "nginx";
-    group = "nginx";
-    settings = {
-      "listen.owner" = "nginx";
-      "listen.group" = "nginx";
-      "pm" = "dynamic";
-      "pm.max_children" = 10;
-      "pm.start_servers" = 2;
-      "pm.min_spare_servers" = 1;
-      "pm.max_spare_servers" = 3;
-    };
-    phpPackage = pkgs.php.withExtensions ({ enabled, all }: enabled ++ [ all.curl ]);
-  };
-
   services = {
+
+    phpfpm.pools.matrix = {
+      user = "nginx";
+      group = "nginx";
+      settings = {
+        "listen.owner" = "nginx";
+        "listen.group" = "nginx";
+        "pm" = "dynamic";
+        "pm.max_children" = 10;
+        "pm.start_servers" = 2;
+        "pm.min_spare_servers" = 1;
+        "pm.max_spare_servers" = 3;
+      };
+      phpPackage = pkgs.php.withExtensions ({ enabled, all }: enabled ++ [ all.curl ]);
+    };
+
     matrix-synapse = {
       enable = true;
       settings = {
@@ -237,9 +251,10 @@ in
         max_wal_senders = 5;
         wal_keep_size = "512MB";
         listen_addresses = lib.mkForce "127.0.0.1,100.109.10.91";
+        ssl = true;
       };
       authentication = lib.mkAfter ''
-        host replication replicator 100.0.0.0/8 scram-sha-256
+        hostssl replication replicator 100.0.0.0/8 scram-sha-256
       '';
     };
 
@@ -251,15 +266,26 @@ in
     };
   };
 
-  systemd.services = {
-    matrix-synapse.serviceConfig.ReadOnlyPaths = [
-      "/var/lib/mautrix-discord"
-      "/var/lib/mautrix-whatsapp"
+  systemd = {
+    services = {
+      matrix-synapse.serviceConfig.ReadOnlyPaths = [
+        "/var/lib/mautrix-discord"
+        "/var/lib/mautrix-whatsapp"
+      ];
+      postgresql.postStart = lib.mkAfter ''
+        PG_PASS=$(cat ${config.sops.secrets.pg_replication_password.path})
+        ${config.services.postgresql.package}/bin/psql -U postgres -c \
+          "ALTER ROLE replicator WITH PASSWORD '$PG_PASS';"
+      '';
+    };
+
+    tmpfiles.rules = [
+      "d /var/www/matrix            0755 nginx nginx -"
+      "L+ /var/www/matrix/index.html   0644 nginx nginx - ${matrixIndexHtml}"
+      "L+ /var/www/matrix/register.php 0644 nginx nginx - ${matrixRegisterPhp}"
+      "L+ /var/www/matrix/style.css  0644 nginx nginx - ${matrixStyleCss}"
+      "L+ /var/www/matrix/app.js     0644 nginx nginx - ${matrixAppJs}"
     ];
-    postgresql.postStart = lib.mkAfter ''
-      PG_PASS=$(cat ${config.sops.secrets.pg_replication_password.path})
-      ${config.services.postgresql.package}/bin/psql -U postgres -c \
-        "ALTER ROLE replicator WITH PASSWORD '$PG_PASS';"
-    '';
   };
+
 }
diff --git a/nixos/roles/matrix/whatsapp-bridge.nix b/nixos/roles/matrix/whatsapp-bridge.nix
index f6862c0..c3de741 100644
--- a/nixos/roles/matrix/whatsapp-bridge.nix
+++ b/nixos/roles/matrix/whatsapp-bridge.nix
@@ -1,29 +1,40 @@
-{ ... }:
 {
-  services.postgresql = {
-    ensureUsers = [
-      {
-        name = "mautrix-whatsapp";
-        ensureDBOwnership = true;
-      }
-    ];
-    ensureDatabases = [ "mautrix-whatsapp" ];
-  };
 
-  services.mautrix-whatsapp = {
-    enable = true;
-    settings = {
-      homeserver = {
-        address = "http://127.0.0.1:8008";
-        domain = "cyperpunk.de";
-      };
-      database = {
-        type = "postgres";
-        uri = "postgres:///mautrix-whatsapp?host=/run/postgresql&sslmode=disable";
-      };
-      bridge.permissions = {
-        "cyperpunk.de" = "user";
-        "@dergrumpf:cyperpunk.de" = "admin";
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/mautrix-whatsapp";
+      user = "mautrix-whatsapp";
+      group = "mautrix-whatsapp";
+      mode = "0750";
+    }
+  ];
+
+  services = {
+    postgresql = {
+      ensureUsers = [
+        {
+          name = "mautrix-whatsapp";
+          ensureDBOwnership = true;
+        }
+      ];
+      ensureDatabases = [ "mautrix-whatsapp" ];
+    };
+
+    mautrix-whatsapp = {
+      enable = true;
+      settings = {
+        homeserver = {
+          address = "http://127.0.0.1:8008";
+          domain = "cyperpunk.de";
+        };
+        database = {
+          type = "postgres";
+          uri = "postgres:///mautrix-whatsapp?host=/run/postgresql&sslmode=disable";
+        };
+        bridge.permissions = {
+          "cyperpunk.de" = "user";
+          "@dergrumpf:cyperpunk.de" = "admin";
+        };
       };
     };
   };