Added Impermanence to services runned by cyper-controller

flake.lock

@@ -936,12 +936,26 @@
         "type": "github"
       }
     },
+    "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1782175435,
+        "narHash": "sha256-EMzXKmnOtBQ2MnvpiNOm7E+kOMvdPrIKaeg52Tip2Uk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "89570f24e97e614aa34aa9ab1c927b6578a43775",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixvim": {
       "inputs": {
         "flake-parts": "flake-parts_2",
-        "nixpkgs": [
+        "nixpkgs": "nixpkgs_4",
-          "nixpkgs"
-        ],
         "systems": "systems_3"
       },
       "locked": {

flake.nix

@@ -63,7 +63,6 @@
     # declarative Neovim
     nixvim = {
       url = "github:nix-community/nixvim";
-      inputs.nixpkgs.follows = "nixpkgs";
     };
 
     # declarative Discord
@@ -269,6 +268,9 @@
         install-cyper-node-2 = mkInstall {
           hostName = "cyper-node-2";
         };
+        install-cyper-controller = mkInstall {
+          hostName = "cyper-controller";
+        };
       };
     };
 }

home/neovim/default.nix

@@ -32,6 +32,8 @@
 
   programs.nixvim = {
     enable = true;
+    nixpkgs.source = inputs.nixpkgs;
+
     defaultEditor = true;
     enableMan = false;
 

hosts/cyper-controller/configuration.nix

@@ -1,5 +1,6 @@
 {
   imports = [
+    ./disko.nix
     ./hardware-configuration.nix
     ./smb.nix
     ../../nixos/roles/monitoring.nix
@@ -11,7 +12,6 @@
     ../../nixos/roles/gitea.nix
     ../../nixos/roles/vaultwarden.nix
     ../../nixos/roles/frontpage
-    #../../nixos/roles/paperless-ngx.nix
     ../../nixos/roles/octoprint.nix
     ../../nixos/roles/matrix/postgres-backup.nix
     ../../nixos/roles/kanidm.nix
@@ -45,5 +45,6 @@
     };
     efi.canTouchEfiVariables = true;
   };
+
   system.stateVersion = "26.05";
 }

hosts/cyper-controller/disko.nix

@@ -0,0 +1,62 @@
+{
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/sda";
+    content = {
+      type = "gpt";
+      partitions = {
+        ESP = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = [
+              "fmask=0022"
+              "dmask=0022"
+            ];
+            extraArgs = [
+              "-n"
+              "NIXBOOT"
+            ];
+          };
+        };
+        swap = {
+          size = "8G";
+          content = {
+            type = "swap";
+            extraArgs = [
+              "-L"
+              "NIXSWAP"
+            ];
+          };
+        };
+        nix = {
+          size = "80G";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/nix";
+            extraArgs = [
+              "-L"
+              "NIXSTORE"
+            ];
+          };
+        };
+        persist = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/persist";
+            extraArgs = [
+              "-L"
+              "NIXPERSIST"
+            ];
+          };
+        };
+      };
+    };
+  };
+}

hosts/cyper-controller/hardware-configuration.nix

@@ -5,7 +5,6 @@
   primaryUser,
   ...
 }:
-
 {
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
@@ -17,6 +16,7 @@
       "ahci"
       "usb_storage"
       "sd_mod"
+      "nvme"
     ];
     initrd.kernelModules = [ ];
     kernelModules = [ "kvm-intel" ];
@@ -24,17 +24,13 @@
   };
 
   fileSystems = {
-    "/" = lib.mkForce {
+    "/" = {
-      device = "/dev/disk/by-label/NIXROOT";
+      device = "none";
-      fsType = "ext4";
+      fsType = "tmpfs";
-    };
-
-    "/boot" = lib.mkForce {
-      device = "/dev/disk/by-label/NIXBOOT";
-      fsType = "vfat";
       options = [
-        "fmask=0022"
+        "defaults"
-        "dmask=0022"
+        "size=2G"
+        "mode=755"
       ];
     };
 
@@ -70,6 +66,8 @@
       ];
     };
 
+    "/nix".neededForBoot = true;
+    "/persist".neededForBoot = true;
   };
 
   systemd.tmpfiles.rules = [
@@ -79,15 +77,7 @@
     "d /storage/backup 0755 ${primaryUser} users -"
   ];
 
-  swapDevices = [
-    {
-      device = "/swapfile";
-      size = 4096;
-    }
-  ];
-
   networking.useDHCP = lib.mkDefault true;
-
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

nixos/roles/filebrowser.nix

@@ -1,5 +1,13 @@
-{ ... }:
 {
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/filebrowser";
+      user = "filebrowser";
+      group = "filebrowser";
+      mode = "0750";
+    }
+  ];
+
   services.filebrowser = {
     enable = true;
 

nixos/roles/frontpage/frontpage.nix

@@ -29,6 +29,33 @@ let
   ];
 in
 {
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/flame-phil";
+      user = "root";
+      group = "root";
+      mode = "0755";
+    }
+    {
+      directory = "/var/lib/flame-calvin";
+      user = "root";
+      group = "root";
+      mode = "0755";
+    }
+    {
+      directory = "/var/lib/docker";
+      user = "root";
+      group = "root";
+      mode = "0710";
+    }
+    {
+      directory = "/var/lib/private";
+      user = "root";
+      group = "root";
+      mode = "0700";
+    }
+  ];
+
   sops.secrets = lib.listToAttrs (
     map ({ name, ... }: lib.nameValuePair "flame_${name}_password" { }) instances
   );

nixos/roles/gitea.nix

@@ -47,6 +47,21 @@ in
     };
   };
 
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/gitea";
+      user = "gitea";
+      group = "gitea";
+      mode = "0750";
+    }
+    {
+      directory = "/var/lib/postgresql";
+      user = "postgres";
+      group = "postgres";
+      mode = "0750";
+    }
+  ];
+
   systemd.services = {
     gitea-db-password = {
       description = "Set gitea postgres user password";

nixos/roles/kanidm.nix

@@ -5,6 +5,15 @@ let
   certDir = "/var/lib/kanidm/tls";
 in
 {
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/kanidm";
+      user = "kanidm";
+      group = "kanidm";
+      mode = "0750";
+    }
+  ];
+
   systemd.services.kanidm-selfsigned-cert = {
     description = "Generate self-signed TLS certificate for Kanidm";
     wantedBy = [ "kanidm.service" ];

nixos/roles/monitoring.nix

@@ -41,6 +41,15 @@ in
     };
   };
 
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/grafana";
+      user = "grafana";
+      group = "grafana";
+      mode = "0750";
+    }
+  ];
+
   users.groups.gs1200-exporter = { };
 
   services = {

nixos/roles/octoprint.nix

@@ -48,6 +48,16 @@ let
 in
 {
   nixpkgs.overlays = [ octoprint-overlay ];
+
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/octoprint";
+      user = "octoprint";
+      group = "octoprint";
+      mode = "0750";
+    }
+  ];
+
   services.octoprint = {
     enable = true;
     host = "0.0.0.0";

nixos/roles/unifi.nix

@@ -1,6 +1,15 @@
 { pkgs, ... }:
 
 {
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/unifi";
+      user = "unifi";
+      group = "unifi";
+      mode = "0750";
+    }
+  ];
+
   services.unifi = {
     enable = true;
     unifiPackage = pkgs.unifi;

nixos/roles/vaultwarden.nix

@@ -12,6 +12,16 @@ in
     owner = "vaultwarden";
     group = "vaultwarden";
   };
+
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/vaultwarden";
+      user = "vaultwarden";
+      group = "vaultwarden";
+      mode = "0750";
+    }
+  ];
+
   services.vaultwarden = {
     enable = true;
     package = pkgs.oidcwarden;
@@ -31,7 +41,9 @@ in
       SSO_PKCE = false;
     };
   };
+
   networking.firewall.allowedTCPPorts = [ port ];
+
   systemd = {
     services.vaultwarden-backup-rotate = {
       description = "Rotate old Vaultwarden backups";

nixos/roles/wyl.nix

@@ -6,6 +6,16 @@ let
   iface = config.systemd.network.networks."10-ethernet".matchConfig.Name;
 in
 {
+
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/watchyourlan";
+      user = "watchyourlan";
+      group = "watchyourlan";
+      mode = "0750";
+    }
+  ];
+
   networking.firewall.allowedTCPPorts = [ 8840 ];
 
   systemd.services.watchyourlan = {