Added Impermanence to services runned by cyper-controller

nixos/roles/filebrowser.nix

@@ -1,5 +1,13 @@
-{ ... }:
 {
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/filebrowser";
+      user = "filebrowser";
+      group = "filebrowser";
+      mode = "0750";
+    }
+  ];
+
   services.filebrowser = {
     enable = true;
 

nixos/roles/frontpage/frontpage.nix

@@ -29,6 +29,33 @@ let
   ];
 in
 {
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/flame-phil";
+      user = "root";
+      group = "root";
+      mode = "0755";
+    }
+    {
+      directory = "/var/lib/flame-calvin";
+      user = "root";
+      group = "root";
+      mode = "0755";
+    }
+    {
+      directory = "/var/lib/docker";
+      user = "root";
+      group = "root";
+      mode = "0710";
+    }
+    {
+      directory = "/var/lib/private";
+      user = "root";
+      group = "root";
+      mode = "0700";
+    }
+  ];
+
   sops.secrets = lib.listToAttrs (
     map ({ name, ... }: lib.nameValuePair "flame_${name}_password" { }) instances
   );

nixos/roles/gitea.nix

@@ -47,6 +47,21 @@ in
     };
   };
 
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/gitea";
+      user = "gitea";
+      group = "gitea";
+      mode = "0750";
+    }
+    {
+      directory = "/var/lib/postgresql";
+      user = "postgres";
+      group = "postgres";
+      mode = "0750";
+    }
+  ];
+
   systemd.services = {
     gitea-db-password = {
       description = "Set gitea postgres user password";

nixos/roles/kanidm.nix

@@ -5,6 +5,15 @@ let
   certDir = "/var/lib/kanidm/tls";
 in
 {
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/kanidm";
+      user = "kanidm";
+      group = "kanidm";
+      mode = "0750";
+    }
+  ];
+
   systemd.services.kanidm-selfsigned-cert = {
     description = "Generate self-signed TLS certificate for Kanidm";
     wantedBy = [ "kanidm.service" ];

nixos/roles/monitoring.nix

@@ -41,6 +41,15 @@ in
     };
   };
 
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/grafana";
+      user = "grafana";
+      group = "grafana";
+      mode = "0750";
+    }
+  ];
+
   users.groups.gs1200-exporter = { };
 
   services = {

nixos/roles/octoprint.nix

@@ -48,6 +48,16 @@ let
 in
 {
   nixpkgs.overlays = [ octoprint-overlay ];
+
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/octoprint";
+      user = "octoprint";
+      group = "octoprint";
+      mode = "0750";
+    }
+  ];
+
   services.octoprint = {
     enable = true;
     host = "0.0.0.0";

nixos/roles/unifi.nix

@@ -1,6 +1,15 @@
 { pkgs, ... }:
 
 {
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/unifi";
+      user = "unifi";
+      group = "unifi";
+      mode = "0750";
+    }
+  ];
+
   services.unifi = {
     enable = true;
     unifiPackage = pkgs.unifi;

nixos/roles/vaultwarden.nix

@@ -12,6 +12,16 @@ in
     owner = "vaultwarden";
     group = "vaultwarden";
   };
+
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/vaultwarden";
+      user = "vaultwarden";
+      group = "vaultwarden";
+      mode = "0750";
+    }
+  ];
+
   services.vaultwarden = {
     enable = true;
     package = pkgs.oidcwarden;
@@ -31,7 +41,9 @@ in
       SSO_PKCE = false;
     };
   };
+
   networking.firewall.allowedTCPPorts = [ port ];
+
   systemd = {
     services.vaultwarden-backup-rotate = {
       description = "Rotate old Vaultwarden backups";

nixos/roles/wyl.nix

@@ -6,6 +6,16 @@ let
   iface = config.systemd.network.networks."10-ethernet".matchConfig.Name;
 in
 {
+
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/watchyourlan";
+      user = "watchyourlan";
+      group = "watchyourlan";
+      mode = "0750";
+    }
+  ];
+
   networking.firewall.allowedTCPPorts = [ 8840 ];
 
   systemd.services.watchyourlan = {