feat: migrate alpha and add impermanence

hosts/alpha/default.nix

@@ -1,13 +1,18 @@
 {
-  pkgs,
-  username,
-  config,
-  email,
+  modulesPath,
   inputs,
+  username,
+  lib,
+  email,
+  config,
   ...
 }: {
   imports = [
-    ./hardware.nix
+    (modulesPath + "/installer/scan/not-detected.nix")
+    (modulesPath + "/profiles/qemu-guest.nix")
+    inputs.disko.nixosModules.default
+    (import ./disko.nix {device = "/dev/vda";})
+
     ../common
     ../../modules/nixos/selfhosted/uptime-kuma.nix
   ];
@@ -17,6 +22,11 @@
 
   tux.services.tfolio.enable = true;
 
+  tux.services.nginxStreamProxy = {
+    enable = true;
+    upstreamServers = inputs.nix-secrets.proxy-servers;
+  };
+
   sops.secrets = {
     borg_encryption_key = {
       sopsFile = ./secrets.yaml;
@@ -31,13 +41,53 @@
     };
   };
 
+  nixpkgs = {
+    hostPlatform = "x86_64-linux";
+  };
+
   boot = {
-    kernelPackages = pkgs.linuxPackages_zen;
-    initrd.systemd.enable = true;
+    initrd.systemd = {
+      enable = lib.mkForce true;
+
+      services.wipe-my-fs = {
+        wantedBy = ["initrd.target"];
+        after = ["initrd-root-device.target"];
+        before = ["sysroot.mount"];
+        unitConfig.DefaultDependencies = "no";
+        serviceConfig.Type = "oneshot";
+        script = ''
+          mkdir /btrfs_tmp
+          mount /dev/disk/by-partlabel/disk-primary-root /btrfs_tmp
+
+          if [[ -e /btrfs_tmp/root ]]; then
+              mkdir -p /btrfs_tmp/old_roots
+              timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/root)" "+%Y-%m-%-d_%H:%M:%S")
+              mv /btrfs_tmp/root "/btrfs_tmp/old_roots/$timestamp"
+          fi
+
+          delete_subvolume_recursively() {
+              IFS=$'\n'
+              for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
+                  delete_subvolume_recursively "/btrfs_tmp/$i"
+              done
+              btrfs subvolume delete "$1"
+          }
+
+          for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do
+              delete_subvolume_recursively "$i"
+          done
+
+          btrfs subvolume create /btrfs_tmp/root
+          umount /btrfs_tmp
+        '';
+      };
+    };
 
     loader = {
-      grub.device = "/dev/sda";
-      timeout = 1;
+      grub = {
+        efiSupport = true;
+        efiInstallAsRemovable = true;
+      };
     };
   };
 
@@ -46,7 +96,7 @@
 
     firewall = {
       enable = true;
-      allowedTCPPorts = [80 443 22];
+      allowedTCPPorts = [80 443 22 23];
     };
   };
 
@@ -56,6 +106,7 @@
       defaults.email = "${email}";
       certs = {
         "tux.rs" = {
+          group = "nginx";
           domain = "*.tux.rs";
           extraDomainNames = ["tux.rs"];
           dnsProvider = "cloudflare";
@@ -70,11 +121,6 @@
 
   users.users.nginx.extraGroups = ["acme"];
 
-  tux.services.nginxStreamProxy = {
-    enable = true;
-    upstreamServers = inputs.nix-secrets.proxy-servers;
-  };
-
   services = {
     nginx = {
       recommendedGzipSettings = true;
@@ -89,8 +135,22 @@
     dconf.enable = true;
   };
 
+  programs.fuse.userAllowOther = true;
+  fileSystems."/persist".neededForBoot = true;
   environment.persistence."/persist" = {
-    enable = false;
+    hideMounts = true;
+    directories = [
+      "/var/log"
+      "/var/lib/acme"
+      "/var/lib/nixos"
+      "/var/lib/private"
+    ];
+    files = [
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+      "/etc/ssh/ssh_host_rsa_key"
+      "/etc/ssh/ssh_host_rsa_key.pub"
+    ];
   };
 
   home-manager.users.${username} = {
@@ -99,5 +159,5 @@
     ];
   };
 
-  system.stateVersion = "23.11";
+  system.stateVersion = "24.11";
 }