bluetooth: dont persist /var/lib/bluetooth

hosts/common/bluetooth.nix

@@ -1,6 +1,10 @@
 { lib, pkgs, ... }:
 
 {
+  # optionally: persist handshakes. can be useful when debugging, but might disrupt other keys
+  # sane.persist.sys.plaintext = [ "/var/lib/bluetooth" ];
+
+  sane.fs."/var/lib/bluetooth".generated.acl.mode = "0700";
   sane.fs."/var/lib/bluetooth/.secrets.stamp" = {
     wantedBeforeBy = [ "bluetooth.service" ];
     # XXX: install-bluetooth uses sed, but that's part of the default systemd unit path, it seems

hosts/common/default.nix

@@ -23,7 +23,6 @@
     "/var/backup"  # for e.g. postgres dumps
     # TODO: move elsewhere
     "/var/lib/alsa"                # preserve output levels, default devices
-    "/var/lib/bluetooth"           # preserve bluetooth handshakes
     "/var/lib/colord"              # preserve color calibrations (?)
     "/var/lib/machines"            # maybe not needed, but would be painful to add a VM and forget.
   ];

scripts/install-bluetooth

@@ -25,4 +25,5 @@ do
   condir="$destdir/$mac"
   test -d "$condir" || mkdir "$condir" || test -d "$condir"
   ln -sf --no-dereference "$srcdir/$f" "$condir/info"
+  touch "$condir/attributes"
 done