mirror of
https://github.com/tuxdotrs/tawm.git
synced 2025-07-06 21:16:35 +05:30
feat: add impermanence
This commit is contained in:
@ -2,49 +2,93 @@
|
||||
modulesPath,
|
||||
inputs,
|
||||
username,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
inputs.disko.nixosModules.default
|
||||
(import ./disko.nix {device = "/dev/sda";})
|
||||
(import ./disko.nix {device = "/dev/vda";})
|
||||
|
||||
../common
|
||||
../../modules/nixos/virtualisation/docker.nix
|
||||
../../modules/nixos/selfhosted/containers/cs2.nix
|
||||
];
|
||||
|
||||
tux.services.openssh.enable = true;
|
||||
|
||||
sops.secrets = {
|
||||
"cs2_secrets/SRCDS_TOKEN" = {
|
||||
sopsFile = ./secrets.yaml;
|
||||
nixpkgs = {
|
||||
hostPlatform = "x86_64-linux";
|
||||
};
|
||||
|
||||
boot = {
|
||||
initrd.systemd = {
|
||||
enable = lib.mkForce true;
|
||||
|
||||
services.wipe-my-fs = {
|
||||
wantedBy = ["initrd.target"];
|
||||
after = ["initrd-root-device.target"];
|
||||
before = ["sysroot.mount"];
|
||||
unitConfig.DefaultDependencies = "no";
|
||||
serviceConfig.Type = "oneshot";
|
||||
script = ''
|
||||
mkdir /btrfs_tmp
|
||||
mount /dev/disk/by-partlabel/disk-primary-root /btrfs_tmp
|
||||
|
||||
if [[ -e /btrfs_tmp/root ]]; then
|
||||
mkdir -p /btrfs_tmp/old_roots
|
||||
timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/root)" "+%Y-%m-%-d_%H:%M:%S")
|
||||
mv /btrfs_tmp/root "/btrfs_tmp/old_roots/$timestamp"
|
||||
fi
|
||||
|
||||
delete_subvolume_recursively() {
|
||||
IFS=$'\n'
|
||||
for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
|
||||
delete_subvolume_recursively "/btrfs_tmp/$i"
|
||||
done
|
||||
btrfs subvolume delete "$1"
|
||||
}
|
||||
|
||||
for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do
|
||||
delete_subvolume_recursively "$i"
|
||||
done
|
||||
|
||||
btrfs subvolume create /btrfs_tmp/root
|
||||
umount /btrfs_tmp
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
"cs2_secrets/CS2_RCONPW" = {
|
||||
sopsFile = ./secrets.yaml;
|
||||
};
|
||||
|
||||
"cs2_secrets/CS2_PW" = {
|
||||
sopsFile = ./secrets.yaml;
|
||||
loader = {
|
||||
grub = {
|
||||
efiSupport = true;
|
||||
efiInstallAsRemovable = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
nixpkgs.hostPlatform = "x86_64-linux";
|
||||
networking.hostName = "capella";
|
||||
|
||||
networking = {
|
||||
hostName = "capella";
|
||||
firewall.enable = false;
|
||||
};
|
||||
|
||||
boot.loader.grub = {
|
||||
efiSupport = true;
|
||||
efiInstallAsRemovable = true;
|
||||
users = {
|
||||
users.${username} = {
|
||||
password = "${username}";
|
||||
hashedPasswordFile = lib.mkForce null;
|
||||
};
|
||||
};
|
||||
|
||||
programs.fuse.userAllowOther = true;
|
||||
fileSystems."/persist".neededForBoot = true;
|
||||
environment.persistence."/persist" = {
|
||||
enable = false;
|
||||
hideMounts = true;
|
||||
directories = [
|
||||
"/var/log"
|
||||
"/var/lib/nixos"
|
||||
];
|
||||
files = [
|
||||
"/etc/ssh/ssh_host_ed25519_key"
|
||||
"/etc/ssh/ssh_host_ed25519_key.pub"
|
||||
"/etc/ssh/ssh_host_rsa_key"
|
||||
"/etc/ssh/ssh_host_rsa_key.pub"
|
||||
];
|
||||
};
|
||||
|
||||
home-manager.users.${username} = {
|
||||
|
||||
@ -1,50 +1,49 @@
|
||||
{device ? throw "Set this to the disk device, e.g. /dev/nvme0n1", ...}: {
|
||||
disko.devices = {
|
||||
disk.primary = {
|
||||
inherit device;
|
||||
type = "disk";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
boot = {
|
||||
name = "boot";
|
||||
size = "1M";
|
||||
type = "EF02";
|
||||
};
|
||||
esp = {
|
||||
name = "ESP";
|
||||
size = "500M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
};
|
||||
};
|
||||
root = {
|
||||
name = "root";
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "lvm_pv";
|
||||
vg = "pool";
|
||||
};
|
||||
disko.devices.disk.primary = {
|
||||
inherit device;
|
||||
type = "disk";
|
||||
content = {
|
||||
type = "gpt"; # GPT partitioning scheme
|
||||
partitions = {
|
||||
boot = {
|
||||
name = "boot";
|
||||
size = "1M";
|
||||
type = "EF02";
|
||||
};
|
||||
# EFI Partition
|
||||
ESP = {
|
||||
size = "512M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = ["defaults" "umask=0077"];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
lvm_vg = {
|
||||
pool = {
|
||||
type = "lvm_vg";
|
||||
lvs = {
|
||||
root = {
|
||||
size = "100%FREE";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/";
|
||||
mountOptions = [
|
||||
"defaults"
|
||||
];
|
||||
# Btrfs Root Partition
|
||||
root = {
|
||||
size = "100%"; # Use remaining space
|
||||
type = "8300"; # Linux filesystem type
|
||||
content = {
|
||||
type = "btrfs";
|
||||
subvolumes = {
|
||||
"/root" = {
|
||||
mountOptions = ["compress=zstd"]; # Compression for better performance
|
||||
mountpoint = "/"; # Root subvolume
|
||||
};
|
||||
"/persist" = {
|
||||
mountOptions = ["compress=zstd"]; # Compression for persistent data
|
||||
mountpoint = "/persist"; # Persistent subvolume
|
||||
};
|
||||
"/nix" = {
|
||||
mountOptions = [
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
"noacl"
|
||||
]; # Optimize for Nix store
|
||||
mountpoint = "/nix"; # Nix subvolume
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@ -1,3 +1,14 @@
|
||||
{...}: {
|
||||
{username, ...}: {
|
||||
home.persistence."/persist/home/${username}" = {
|
||||
directories = [
|
||||
"Projects"
|
||||
".ssh"
|
||||
];
|
||||
files = [
|
||||
".zsh_history"
|
||||
];
|
||||
allowOther = true;
|
||||
};
|
||||
|
||||
home.stateVersion = "24.11";
|
||||
}
|
||||
|
||||
@ -1,33 +0,0 @@
|
||||
cs2_secrets:
|
||||
SRCDS_TOKEN: ENC[AES256_GCM,data:WKUUPlgPbAQHItF6RUoAyTxJBVHhm8j4pBCtKnKB+D9Bpnv89rOHhgoEarI=,iv:r25P7Z/5EZgh0jzCLScyfVee2K4WmhD54iJUcVL6Txo=,tag:7xnXaeBkzTGFFaYEWhmmkQ==,type:str]
|
||||
CS2_RCONPW: ENC[AES256_GCM,data:KEyA7qVQbhIh+Aonv0o4o3QtuRgQKEs=,iv:KkqDqXJarbvU2coPUEpNL43cPIGTkGI3RVYKGK/dT5Q=,tag:koNljlFITRY2EHjstcVrEA==,type:str]
|
||||
CS2_PW: ENC[AES256_GCM,data:O1uNUjhOCnx0LeiLo1aJPPJ3YA2dwwk=,iv:iBSv4YEgqD49vfjSdbtzv4RE5pXw2yNkS4waseg5qQw=,tag:IVRZZxlV5YoSWHmLEAptlQ==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
age:
|
||||
- recipient: age14vktfes95f33vuefwnmuvryas7az04u76dsgyhfvsx73czkvmp2q7njkl4
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEL0lPSUtjNWRNeTRQdzly
|
||||
Sm5hL2Z6OSs4VmJlSTgzZ1FBMjN0cjNLQmo4CjFkdGx1T0MxTm5EQ2ZKR0gyM2Vp
|
||||
M3NwUDA3V21ic01JWWNpeWNIVVBBekkKLS0tIFNuT2o1TCtWMVBxVmh6T295bDNr
|
||||
bGpaeC9JbTBUVk1KYmFSTnlSMm9ybEkK0n7HZAHvjm7T0mvea1zgQJMo5aoah+bs
|
||||
vi3eg3dq6gKSVXYtsnMKMXF34Uh11UFb3Nrzhbg5JIfgYYsDi4asRQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1y4luzn2jls7rvgphej23srvdlx563lxq29tvf66vhwwzaf7c3f3qzvresh
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpK0JGbDZqZ2pobXdHaXlw
|
||||
U0t5TUVkSytNUmk3c3VuSzV0NnJuTkx1VGgwCnlNSzZ6a1FJSWMvbjdlS0s5YjVE
|
||||
Ni9yVlFLVWNBZ2QwSi92NnhTOEs3R3MKLS0tIDg2MnI5ZEFJdDUzTjJVUDJXaTZz
|
||||
QURYbkh3ckFTNG9RRG01eDRoZWVtM3MKd5+k09WBzx27iJ0A5Ek2bUiKCxoLfnMq
|
||||
T2uRF77ElbZQRklicxBNdM895io/PLdMBocerTb4dWRE+I8FGwDCYg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2025-01-10T22:54:08Z"
|
||||
mac: ENC[AES256_GCM,data:qirA0ifdYXv92LPOJy6iYGplGRl4sWlu/3yBoSSXU2jEMnTQ0JD3a0ogOaRuwXH9VHKkSuRYBbAcJt0Y9lMCTJ9nDL6xdSx0V6PxpQxxlDvtTo7YL4IgGM7wHol3CiooTssV/eQtc0rxb7WCuOunZOE43km0MKSRbURxPBd68KY=,iv:wkE5Pxxa/qQxGwBy+GoRtv6eFWB8CRNRBwKOLWRUNVc=,tag:xaDvKe9AMdJ5lpIyx75BFA==,type:str]
|
||||
pgp: []
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.9.2
|
||||
Reference in New Issue
Block a user