hosts/common: clean up the journald persistence to support both *private* or plaintext storage, by config

hosts/common/systemd.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ config, lib, pkgs, ... }:
 let
   # N.B.: systemd doesn't like to honor its timeout settings.
   # a timeout of 20s is actually closer to 70s,
@@ -46,15 +46,15 @@ in
     })
   '';
 
-  # persist to PLAINTEXT, i.e. WORLD-READABLE
-  # sane.persist.sys.byStore.plaintext = [
-  #   { mode = "0755"; path = "/var/log/journal"; method = "bind"; }
-  # ];
-
-  # persist to private:
-  sane.persist.sys.byStore.private = [
-    { mode = "0755"; path = "/var/log/journal"; }
-  ];
+  sane.persist.sys.byPath."/var/log/journal" = {
+    # prefer to persist to private, because the journal can have sensitive info in it.
+    # but plaintext also works for scenarios where the system can't be unlocked.
+    store = "private";
+    # store = "plaintext";
+    # ordering of bind mounts is tricky for private store, so prefer symlink
+    method = "symlink";
+    acl.mode = "0750";
+  };
 
   # systemd-journal-flush.service switches journald from volatile to persistent storage partway through boot
   #   ExecStart=journalctl --flush
@@ -75,8 +75,12 @@ in
     description = "flush early logging data to persistent storage, but later in the boot than normal to avoid cycles";
     wantedBy = [ "systemd-journal-flush.service" ];
     serviceConfig.ExecStart = "journalctl --flush";
+    # ensure /var/log/journal symlink exists before starting:
+    serviceConfig.ExecStartPre = "-${lib.getExe' pkgs.systemd "systemd-tmpfiles"} --prefix=/var/log/journal --boot --create --graceful";
     unitConfig.DefaultDependencies = false;
-    unitConfig.RequiresMountsFor = [ "/mnt/persist/private" ];
+    unitConfig.RequiresMountsFor = [
+      config.sane.persist.sys.byPath."/var/log/journal".store.origin
+    ];
   };
 
   services.journald.extraConfig = ''