samhain: impermanence

config/hosts/samhain/meta.nix

@@ -1,6 +1,6 @@
 { config, lib, kw, ... }: with lib; {
   config = {
-    deploy.targets.personal = {
+    deploy.targets.samhain = {
       tf = {
         resources.samhain = {
           provider = "null";

config/hosts/samhain/nixos.nix

@@ -30,7 +30,7 @@ in
 
   fileSystems = {
     "/" = {
-      device = "rpool/safe/root";
+      device = "rpool/ephemeral/root";
       fsType = "zfs";
     };
     "/nix" = {
@@ -38,9 +38,19 @@ in
       fsType = "zfs";
     };
     "/home" = {
-      device = "rpool/safe/home";
+      device = "rpool/ephemeral/home";
       fsType = "zfs";
     };
+    "/persist/root" = {
+      device = "rpool/persist/root";
+      fsType = "zfs";
+      neededForBoot = true;
+    };
+    "/persist/home" = {
+      device = "rpool/persist/home";
+      fsType = "zfs";
+      neededForBoot = true;
+    };
     "/boot" = {
       device = "/dev/disk/by-uuid/AED6-D0D1";
       fsType = "vfat";
@@ -51,6 +61,54 @@ in
     };
   };
 
+
+  boot.initrd.postDeviceCommands = mkIf (config.fileSystems."/".fsType == "zfs") (mkAfter ''
+    zfs rollback -r ${config.fileSystems."/".device}@blank
+    zfs rollback -r ${config.fileSystems."/home".device}@blank
+  '');
+
+  programs.fuse.userAllowOther = true;
+
+  environment.persistence."/persist/root" = {
+    directories = [
+      "/var/log"
+      "/var/lib/systemd/coredump"
+      "/var/lib/acme"
+      "/var/lib/yggdrasil"
+      "/var/lib/kat/secrets"
+    ];
+    files = [
+      "/etc/machine-id"
+      "/etc/nix/id_rsa"
+      "/etc/ssh/ssh_host_rsa_key"
+      "/etc/ssh/ssh_host_rsa_key.pub"
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+    ];
+  };
+
+  home-manager.users.kat = {
+    home.persistence."/persist/home" = {
+      allowOther = true;
+      directories = [
+        ".local/share/weechat"
+        ".local/share/Mumble"
+        ".config/Mumble"
+        ".password-store"
+        ".gnupg"
+        ".mozilla"
+        "docs"
+        "media"
+        "mail"
+        "projects"
+        "shared"
+      ];
+      files = [
+        ".zsh_history"
+      ];
+    };
+  };
+
   swapDevices = [
     { device = "/dev/disk/by-uuid/89831a0f-93e6-4d30-85e4-09061259f140"; }
     { device = "/dev/disk/by-uuid/8f944315-fe1c-4095-90ce-50af03dd5e3f"; }

config/modules/home/default.nix

@@ -5,6 +5,7 @@
   imports = [
     (import (sources.arcexprs + "/modules")).home-manager
     (import (sources.katexprs + "/modules")).home
+    (import (sources.impermanence  + "/home-manager.nix"))
     ./vim.nix
     ./fvwm.nix
     ./deploy.nix

config/modules/nixos/default.nix

@@ -5,6 +5,7 @@
     [
       (import (sources.arcexprs + "/modules")).nixos
       (import (sources.katexprs + "/modules")).nixos
+      (import (sources.impermanence  + "/nixos.nix"))
       ./deploy.nix
       ./dyndns.nix
       ./secrets.nix

config/targets/personal/default.nix

@@ -2,7 +2,7 @@
 
 {
   deploy.targets.personal = {
-    nodeNames = [ "samhain" "yule" ];
+    nodeNames = [ "yule" ];
     tf = { config, ... }: {
       dns.records.ygg_grimoire = {
         tld = "kittywit.ch.";

nix/sources.json

@@ -59,6 +59,18 @@
         "url": "https://github.com/nix-community/home-manager/archive/bf6b85136b47ab1a76df4a90ea4850871147494a.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     },
+    "impermanence": {
+        "branch": "master",
+        "description": "Modules to help you handle persistent state on systems with ephemeral root storage [maintainer=@talyz]",
+        "homepage": "",
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "rev": "58558845bc68dcf2bb32caa80564f7fe3f6cbc61",
+        "sha256": "10z3g4knkvq838zbfq71pkfyl8cffrpavna448wf5mjscycp0gnv",
+        "type": "tarball",
+        "url": "https://github.com/nix-community/impermanence/archive/58558845bc68dcf2bb32caa80564f7fe3f6cbc61.tar.gz",
+        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
+    },
     "katexprs": {
         "branch": "main",
         "description": null,

shell.nix

@@ -68,8 +68,6 @@ pkgs.mkShell {
     nf-actions-test
   ] ++ config.runners.lazy.nativeBuildInputs;
 
-  HISTFILE = toString (config.deploy.dataDir + "/.history");
-
   shellHook = ''
     export HOME_HOSTNAME=$(hostname -s)
     export HOME_UID=$(id -u)