colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

persist/{private,ephemeral}: mount via fuse

Browse Source 
gocryptfs is compatible with --drop-permissions style of mount.fuse3. only, i can't actually use that today because i need to keep permissions :o

but maybe i'll enable that in the future
This commit is contained in:
Colin
2024-08-03 18:51:58 +00:00
parent 2b3278eb7f
commit 74662df720
2 changed files with 13 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
modules/persist/stores/ephemeral.nix
View File

@@ -6,10 +6,11 @@ let
backing = sane-lib.path.concat [ persist-base "ephemeral" ]; backing = sane-lib.path.concat [ persist-base "ephemeral" ];
gocryptfs-ephemeral = pkgs.writeShellApplication { gocryptfs-ephemeral = pkgs.writeShellApplication {
name = "mount.fuse.gocryptfs-ephemeral"; name = "gocryptfs-ephemeral";
runtimeInputs = with pkgs; [ runtimeInputs = with pkgs; [
coreutils-full coreutils-full
gocryptfs gocryptfs
util-linux #< gocryptfs complains that it can't exec `logger`, otherwise
]; ];
text = '' text = ''
# mount invokes us like this. not sure if that's a guarantee or not: # mount invokes us like this. not sure if that's a guarantee or not:
@@ -25,7 +26,7 @@ let
# that's inconsequential: we just care that it's not *persisted*. # that's inconsequential: we just care that it's not *persisted*.
pw=$(dd if=/dev/random bs=128 count=1 | base64 --wrap=0) pw=$(dd if=/dev/random bs=128 count=1 | base64 --wrap=0)
echo "$pw" | gocryptfs -quiet -passfile /dev/stdin -init "$backing" echo "$pw" | gocryptfs -quiet -passfile /dev/stdin -init "$backing"
echo "$pw" | gocryptfs -quiet -passfile /dev/stdin "$@" echo "$pw" | exec gocryptfs -quiet -passfile /dev/stdin "$@"
''; '';
}; };
in in
@@ -40,11 +41,11 @@ lib.mkIf config.sane.persist.enable
}; };
fileSystems."${origin}" = { fileSystems."${origin}" = {
device = backing; device = "${lib.getExe gocryptfs-ephemeral}#${backing}";
fsType = "fuse.gocryptfs-ephemeral"; fsType = "fuse3";
options = [ options = [
# "nodev" # "Unknown parameter 'nodev'". gocryptfs requires this be passed as `-ko nodev` "nodev" # only works via mount.fuse; gocryptfs requires this be passed as `-ko nodev`
# "nosuid" # "Unknown parameter 'nosuid'". gocryptfs requires this be passed as `-ko nosuid` (also, nosuid is default) "nosuid" # only works via mount.fuse; gocryptfs requires this be passed as `-ko nosuid` (also, nosuid is default)
"allow_other" # root ends up being the user that mounts this, so need to make it visible to other users. "allow_other" # root ends up being the user that mounts this, so need to make it visible to other users.
# "defaults" # "unknown flag: --defaults. Try 'gocryptfs -help'" # "defaults" # "unknown flag: --defaults. Try 'gocryptfs -help'"
]; ];

11
modules/persist/stores/private.nix
View File

@@ -6,11 +6,12 @@ let
backing = sane-lib.path.concat [ persist-base "private" ]; backing = sane-lib.path.concat [ persist-base "private" ];
gocryptfs-private = pkgs.writeShellApplication { gocryptfs-private = pkgs.writeShellApplication {
name = "mount.fuse.gocryptfs-private"; name = "gocryptfs-private";
runtimeInputs = with pkgs; [ runtimeInputs = with pkgs; [
coreutils-full coreutils-full
gocryptfs gocryptfs
inotify-tools inotify-tools
util-linux #< gocryptfs complains that it can't exec `logger`, otherwise
]; ];
text = '' text = ''
# backing=$1 # backing=$1
@@ -89,14 +90,14 @@ lib.mkIf config.sane.persist.enable
}; };
fileSystems."${origin}" = { fileSystems."${origin}" = {
device = backing; device = "${lib.getExe gocryptfs-private}#${backing}";
fsType = "fuse.gocryptfs-private"; fsType = "fuse3";
options = [ options = [
# "auto" # "auto"
"nofail" "nofail"
# "nodev" # "Unknown parameter 'nodev'". gocryptfs requires this be passed as `-ko nodev`
# "noexec" # handful of scripts in ~/knowledge that are executable # "noexec" # handful of scripts in ~/knowledge that are executable
# "nosuid" # "Unknown parameter 'nosuid'". gocryptfs requires this be passed as `-ko nosuid` (also nosuid is default) "nodev" # only works via mount.fuse; gocryptfs requires this be passed as `-ko nodev`
"nosuid" # only works via mount.fuse; gocryptfs requires this be passed as `-ko nosuid` (also, nosuid is default)
"allow_other" # root ends up being the user that mounts this, so need to make it visible to other users. "allow_other" # root ends up being the user that mounts this, so need to make it visible to other users.
# "quiet" # "quiet"
# "defaults" # "unknown flag: --defaults. Try 'gocryptfs -help'" # "defaults" # "unknown flag: --defaults. Try 'gocryptfs -help'"