colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

impermanence: split the /home/colin perms fix into more appropriate places

Browse Source
This commit is contained in:
colin
2023-01-03 08:25:43 +00:00
parent e6ccd2e4f7
commit 2d7b3750cd
3 changed files with 49 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
hosts/common/users.nix
View File

@@ -71,6 +71,14 @@ in
security.pam.mount.enable = true; security.pam.mount.enable = true;
# ensure ~ perms are known to sane.fs module.
# TODO: this is generic enough to be lifted up into sane.fs itself.
sane.fs."/home/colin".dir.acl = {
user = "colin";
group = config.users.users.colin.group;
mode = config.users.users.colin.homeMode;
};
sane.impermanence.dirs.home.plaintext = [ sane.impermanence.dirs.home.plaintext = [
"archive" "archive"
"dev" "dev"

77
modules/impermanence/default.nix
View File

@@ -181,57 +181,36 @@ in
./stores ./stores
]; ];
config = mkIf cfg.enable (lib.mkMerge [ config = let
{ cfgFor = opt:
# TODO: move to sane.fs, to auto-ensure all user dirs? let
sane.fs."/home/colin".dir.acl = { store = opt.store;
user = "colin"; store-rel-path = pathFrom store.prefix opt.directory;
group = config.users.users.colin.group; backing-path = concatPaths [ store.mountpt store-rel-path ];
mode = config.users.users.colin.homeMode;
};
# N.B.: we have a similar problem with all mounts: # pass through the perm/mode overrides
# <crypt>/.cache/mozilla won't inherit <plain>/.cache perms. dir-acl = {
# this is less of a problem though, since we don't really support overlapping mounts like that in the first place. user = lib.mkIf (opt.user != null) opt.user;
# what is a problem is if the user specified some other dir we don't know about here. group = lib.mkIf (opt.group != null) opt.group;
# like "/var", and then "/nix/persist/var" has different perms and something mounts funny. mode = lib.mkIf (opt.mode != null) opt.mode;
# TODO: just add assertions that sane.fs."${backing}/${dest}".dir == sane.fs."${dest}" for each mount point?
sane.fs."/nix/persist/home/colin".dir.acl = config.sane.fs."/home/colin".dir.acl;
sane.fs."/mnt/impermanence/crypt/clearedonboot/home/colin".dir.acl = config.sane.fs."/home/colin".dir.acl;
}
(
let cfgFor = opt:
let
store = opt.store;
store-rel-path = pathFrom store.prefix opt.directory;
backing-path = concatPaths [ store.mountpt store-rel-path ];
# pass through the perm/mode overrides
dir-acl = {
user = lib.mkIf (opt.user != null) opt.user;
group = lib.mkIf (opt.group != null) opt.group;
mode = lib.mkIf (opt.mode != null) opt.mode;
};
in {
# create destination and backing directory, with correct perms
sane.fs."${opt.directory}" = {
# inherit perms & make sure we don't mount until after the mount point is setup correctly.
dir.acl = dir-acl;
mount.bind = backing-path;
mount.extraOptions = store.extraOptions;
};
sane.fs."${backing-path}" = {
# ensure the backing path has same perms as the mount point
dir.acl = config.sane.fs."${opt.directory}".dir.acl;
};
}; };
cfgs = builtins.map cfgFor cfg.dirs.all;
in { in {
sane.fs = lib.mkMerge (catAttrs "fs" (catAttrs "sane" cfgs)); # create destination and backing directory, with correct perms
} sane.fs."${opt.directory}" = {
) # inherit perms & make sure we don't mount until after the mount point is setup correctly.
dir.acl = dir-acl;
]); mount.bind = backing-path;
mount.extraOptions = store.extraOptions;
};
sane.fs."${backing-path}" = {
# ensure the backing path has same perms as the mount point.
# TODO: maybe we want to do this, crawling all the way up to the store base?
# that would simplify (remove) the code in stores/default.nix
dir.acl = config.sane.fs."${opt.directory}".dir.acl;
};
};
in mkIf cfg.enable {
sane.fs = lib.mkMerge (map (d: (cfgFor d).sane.fs) cfg.dirs.all);
};
} }

13
modules/impermanence/stores/default.nix
View File

@@ -11,5 +11,18 @@ in
]; ];
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# make sure that the store has the same acl as the main filesystem,
# particularly for /home/colin.
#
# N.B.: we have a similar problem with all mounts:
# <crypt>/.cache/mozilla won't inherit <plain>/.cache perms.
# this is less of a problem though, since we don't really support overlapping mounts like that in the first place.
# what is a problem is if the user specified some other dir we don't know about here.
# like "/var", and then "/nix/persist/var" has different perms and something mounts funny.
# TODO: just add assertions that sane.fs."${backing}/${dest}".dir == sane.fs."${dest}" for each mount point?
sane.fs = lib.mapAttrs' (_name: store: {
name = "${store.mountpt}/home/colin";
value.dir.acl = config.sane.fs."/home/colin".dir.acl;
}) cfg.stores;
}; };
} }