persist: lift sane.persist.dirs.{home,sys} up one level
This commit is contained in:
parent
426e0c3ae2
commit
fe816e9110
|
@ -18,7 +18,7 @@
|
||||||
sane.packages.enableConsolePkgs = true;
|
sane.packages.enableConsolePkgs = true;
|
||||||
sane.packages.enableSystemPkgs = true;
|
sane.packages.enableSystemPkgs = true;
|
||||||
|
|
||||||
sane.persist.dirs.sys.plaintext = [
|
sane.persist.sys.plaintext = [
|
||||||
"/var/log"
|
"/var/log"
|
||||||
"/var/backup" # for e.g. postgres dumps
|
"/var/backup" # for e.g. postgres dumps
|
||||||
# TODO: move elsewhere
|
# TODO: move elsewhere
|
||||||
|
|
|
@ -82,7 +82,7 @@ in
|
||||||
mode = config.users.users.colin.homeMode;
|
mode = config.users.users.colin.homeMode;
|
||||||
};
|
};
|
||||||
|
|
||||||
sane.persist.dirs.home.plaintext = [
|
sane.persist.home.plaintext = [
|
||||||
"archive"
|
"archive"
|
||||||
"dev"
|
"dev"
|
||||||
# TODO: records should be private
|
# TODO: records should be private
|
||||||
|
@ -100,7 +100,7 @@ in
|
||||||
".local/share/keyrings"
|
".local/share/keyrings"
|
||||||
];
|
];
|
||||||
# TODO: fix this ugly solution that allows moby to have firefox cache not erased every boot.
|
# TODO: fix this ugly solution that allows moby to have firefox cache not erased every boot.
|
||||||
sane.persist.dirs.home.cryptClearOnBoot = lib.mkIf (config.networking.hostName != "moby") [
|
sane.persist.home.cryptClearOnBoot = lib.mkIf (config.networking.hostName != "moby") [
|
||||||
# cache is probably too big to fit on the tmpfs
|
# cache is probably too big to fit on the tmpfs
|
||||||
# ".cache"
|
# ".cache"
|
||||||
config.sane.web-browser.cacheDir
|
config.sane.web-browser.cacheDir
|
||||||
|
@ -116,7 +116,7 @@ in
|
||||||
# used by password managers, e.g. unix `pass`
|
# used by password managers, e.g. unix `pass`
|
||||||
sane.fs."/home/colin/.password-store" = mkSymlink "/home/colin/knowledge/secrets/accounts";
|
sane.fs."/home/colin/.password-store" = mkSymlink "/home/colin/knowledge/secrets/accounts";
|
||||||
|
|
||||||
sane.persist.dirs.sys.plaintext = mkIf cfg.guest.enable [
|
sane.persist.sys.plaintext = mkIf cfg.guest.enable [
|
||||||
# intentionally allow other users to write to the guest folder
|
# intentionally allow other users to write to the guest folder
|
||||||
{ directory = "/home/guest"; user = "guest"; group = "users"; mode = "0775"; }
|
{ directory = "/home/guest"; user = "guest"; group = "users"; mode = "0775"; }
|
||||||
];
|
];
|
||||||
|
|
|
@ -52,7 +52,7 @@
|
||||||
remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
|
remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
|
||||||
dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
|
dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
|
||||||
};
|
};
|
||||||
sane.persist.dirs.home.plaintext = [
|
sane.persist.home.plaintext = [
|
||||||
".steam"
|
".steam"
|
||||||
".local/share/Steam"
|
".local/share/Steam"
|
||||||
];
|
];
|
||||||
|
|
|
@ -24,11 +24,11 @@
|
||||||
};
|
};
|
||||||
|
|
||||||
# usability compromises
|
# usability compromises
|
||||||
sane.persist.dirs.home.private = [
|
sane.persist.home.private = [
|
||||||
config.sane.web-browser.dotDir
|
config.sane.web-browser.dotDir
|
||||||
config.sane.web-browser.cacheDir
|
config.sane.web-browser.cacheDir
|
||||||
];
|
];
|
||||||
sane.persist.dirs.home.plaintext = [
|
sane.persist.home.plaintext = [
|
||||||
".config/pulse" # persist pulseaudio volume
|
".config/pulse" # persist pulseaudio volume
|
||||||
];
|
];
|
||||||
|
|
||||||
|
|
|
@ -42,12 +42,12 @@
|
||||||
};
|
};
|
||||||
sane.fs."/mnt/persist/ext".mount = {};
|
sane.fs."/mnt/persist/ext".mount = {};
|
||||||
|
|
||||||
sane.persist.dirs.sys.plaintext = [
|
sane.persist.sys.plaintext = [
|
||||||
# TODO: this is overly broad; only need media and share directories to be persisted
|
# TODO: this is overly broad; only need media and share directories to be persisted
|
||||||
{ user = "colin"; group = "users"; directory = "/var/lib/uninsane"; }
|
{ user = "colin"; group = "users"; directory = "/var/lib/uninsane"; }
|
||||||
];
|
];
|
||||||
# make sure large media is stored to the HDD
|
# make sure large media is stored to the HDD
|
||||||
sane.persist.dirs.sys.ext = [
|
sane.persist.sys.ext = [
|
||||||
{
|
{
|
||||||
user = "colin";
|
user = "colin";
|
||||||
group = "users";
|
group = "users";
|
||||||
|
|
|
@ -19,7 +19,7 @@
|
||||||
# XXX: avatar support works in MUCs but not DMs
|
# XXX: avatar support works in MUCs but not DMs
|
||||||
# lib.mkIf false
|
# lib.mkIf false
|
||||||
{
|
{
|
||||||
sane.persist.dirs.sys.plaintext = [
|
sane.persist.sys.plaintext = [
|
||||||
{ user = "ejabberd"; group = "ejabberd"; directory = "/var/lib/ejabberd"; }
|
{ user = "ejabberd"; group = "ejabberd"; directory = "/var/lib/ejabberd"; }
|
||||||
];
|
];
|
||||||
networking.firewall.allowedTCPPorts = [
|
networking.firewall.allowedTCPPorts = [
|
||||||
|
|
|
@ -16,7 +16,7 @@
|
||||||
owner = config.users.users.freshrss.name;
|
owner = config.users.users.freshrss.name;
|
||||||
mode = "0400";
|
mode = "0400";
|
||||||
};
|
};
|
||||||
sane.persist.dirs.sys.plaintext = [
|
sane.persist.sys.plaintext = [
|
||||||
{ user = "freshrss"; group = "freshrss"; directory = "/var/lib/freshrss"; }
|
{ user = "freshrss"; group = "freshrss"; directory = "/var/lib/freshrss"; }
|
||||||
];
|
];
|
||||||
|
|
||||||
|
|
|
@ -1,7 +1,7 @@
|
||||||
{ config, pkgs, lib, ... }:
|
{ config, pkgs, lib, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
sane.persist.dirs.sys.plaintext = [
|
sane.persist.sys.plaintext = [
|
||||||
# TODO: mode? could be more granular
|
# TODO: mode? could be more granular
|
||||||
{ user = "git"; group = "gitea"; directory = "/var/lib/gitea"; }
|
{ user = "git"; group = "gitea"; directory = "/var/lib/gitea"; }
|
||||||
];
|
];
|
||||||
|
|
|
@ -10,7 +10,7 @@
|
||||||
|
|
||||||
lib.mkIf false # i don't actively use ipfs anymore
|
lib.mkIf false # i don't actively use ipfs anymore
|
||||||
{
|
{
|
||||||
sane.persist.dirs.sys.plaintext = [
|
sane.persist.sys.plaintext = [
|
||||||
# TODO: mode? could be more granular
|
# TODO: mode? could be more granular
|
||||||
{ user = "261"; group = "261"; directory = "/var/lib/ipfs"; }
|
{ user = "261"; group = "261"; directory = "/var/lib/ipfs"; }
|
||||||
];
|
];
|
||||||
|
|
|
@ -1,7 +1,7 @@
|
||||||
{ ... }:
|
{ ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
sane.persist.dirs.sys.plaintext = [
|
sane.persist.sys.plaintext = [
|
||||||
# TODO: mode? we only need this to save Indexer creds ==> migrate to config?
|
# TODO: mode? we only need this to save Indexer creds ==> migrate to config?
|
||||||
{ user = "root"; group = "root"; directory = "/var/lib/jackett"; }
|
{ user = "root"; group = "root"; directory = "/var/lib/jackett"; }
|
||||||
];
|
];
|
||||||
|
|
|
@ -7,7 +7,7 @@ lib.mkIf false
|
||||||
networking.firewall.allowedUDPPorts = [
|
networking.firewall.allowedUDPPorts = [
|
||||||
1900 7359 # DLNA: https://jellyfin.org/docs/general/networking/index.html
|
1900 7359 # DLNA: https://jellyfin.org/docs/general/networking/index.html
|
||||||
];
|
];
|
||||||
sane.persist.dirs.sys.plaintext = [
|
sane.persist.sys.plaintext = [
|
||||||
# TODO: mode? could be more granular
|
# TODO: mode? could be more granular
|
||||||
{ user = "jellyfin"; group = "jellyfin"; directory = "/var/lib/jellyfin"; }
|
{ user = "jellyfin"; group = "jellyfin"; directory = "/var/lib/jellyfin"; }
|
||||||
];
|
];
|
||||||
|
|
|
@ -8,7 +8,7 @@
|
||||||
# ./irc.nix
|
# ./irc.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
sane.persist.dirs.sys.plaintext = [
|
sane.persist.sys.plaintext = [
|
||||||
{ user = "matrix-synapse"; group = "matrix-synapse"; directory = "/var/lib/matrix-synapse"; }
|
{ user = "matrix-synapse"; group = "matrix-synapse"; directory = "/var/lib/matrix-synapse"; }
|
||||||
];
|
];
|
||||||
services.matrix-synapse.enable = true;
|
services.matrix-synapse.enable = true;
|
||||||
|
|
|
@ -1,6 +1,6 @@
|
||||||
{ lib, ... }:
|
{ lib, ... }:
|
||||||
{
|
{
|
||||||
sane.persist.dirs.sys.plaintext = [
|
sane.persist.sys.plaintext = [
|
||||||
{ user = "matrix-synapse"; group = "matrix-synapse"; directory = "/var/lib/mx-puppet-discord"; }
|
{ user = "matrix-synapse"; group = "matrix-synapse"; directory = "/var/lib/mx-puppet-discord"; }
|
||||||
];
|
];
|
||||||
|
|
||||||
|
|
|
@ -1,7 +1,7 @@
|
||||||
{ config, lib, ... }:
|
{ config, lib, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
sane.persist.dirs.sys.plaintext = [
|
sane.persist.sys.plaintext = [
|
||||||
# TODO: mode?
|
# TODO: mode?
|
||||||
# user and group are both "matrix-appservice-irc"
|
# user and group are both "matrix-appservice-irc"
|
||||||
{ user = "993"; group = "992"; directory = "/var/lib/matrix-appservice-irc"; }
|
{ user = "993"; group = "992"; directory = "/var/lib/matrix-appservice-irc"; }
|
||||||
|
|
|
@ -1,7 +1,7 @@
|
||||||
{ ... }:
|
{ ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
sane.persist.dirs.sys.plaintext = [
|
sane.persist.sys.plaintext = [
|
||||||
# TODO: we don't have a static user allocated for navidrome!
|
# TODO: we don't have a static user allocated for navidrome!
|
||||||
# the chown would happen too early for us to set static perms
|
# the chown would happen too early for us to set static perms
|
||||||
"/var/lib/private/navidrome"
|
"/var/lib/private/navidrome"
|
||||||
|
|
|
@ -122,7 +122,7 @@ in
|
||||||
|
|
||||||
users.users.acme.uid = config.sane.allocations.acme-uid;
|
users.users.acme.uid = config.sane.allocations.acme-uid;
|
||||||
users.groups.acme.gid = config.sane.allocations.acme-gid;
|
users.groups.acme.gid = config.sane.allocations.acme-gid;
|
||||||
sane.persist.dirs.sys.plaintext = [
|
sane.persist.sys.plaintext = [
|
||||||
# TODO: mode?
|
# TODO: mode?
|
||||||
{ user = "acme"; group = "acme"; directory = "/var/lib/acme"; }
|
{ user = "acme"; group = "acme"; directory = "/var/lib/acme"; }
|
||||||
{ user = "colin"; group = "users"; directory = "/var/www/sites"; }
|
{ user = "colin"; group = "users"; directory = "/var/www/sites"; }
|
||||||
|
|
|
@ -6,7 +6,7 @@
|
||||||
{ config, pkgs, ... }:
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
sane.persist.dirs.sys.plaintext = [
|
sane.persist.sys.plaintext = [
|
||||||
# TODO: mode? could be more granular
|
# TODO: mode? could be more granular
|
||||||
{ user = "pleroma"; group = "pleroma"; directory = "/var/lib/pleroma"; }
|
{ user = "pleroma"; group = "pleroma"; directory = "/var/lib/pleroma"; }
|
||||||
];
|
];
|
||||||
|
|
|
@ -16,7 +16,7 @@ let
|
||||||
};
|
};
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
sane.persist.dirs.sys.plaintext = [
|
sane.persist.sys.plaintext = [
|
||||||
# TODO: mode? could be more granular
|
# TODO: mode? could be more granular
|
||||||
{ user = "opendkim"; group = "opendkim"; directory = "/var/lib/opendkim"; }
|
{ user = "opendkim"; group = "opendkim"; directory = "/var/lib/opendkim"; }
|
||||||
{ user = "root"; group = "root"; directory = "/var/lib/postfix"; }
|
{ user = "root"; group = "root"; directory = "/var/lib/postfix"; }
|
||||||
|
|
|
@ -1,7 +1,7 @@
|
||||||
{ ... }:
|
{ ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
sane.persist.dirs.sys.plaintext = [
|
sane.persist.sys.plaintext = [
|
||||||
# TODO: mode?
|
# TODO: mode?
|
||||||
{ user = "postgres"; group = "postgres"; directory = "/var/lib/postgresql"; }
|
{ user = "postgres"; group = "postgres"; directory = "/var/lib/postgresql"; }
|
||||||
];
|
];
|
||||||
|
|
|
@ -9,7 +9,7 @@
|
||||||
# nixnet runs ejabberd, so revisiting that.
|
# nixnet runs ejabberd, so revisiting that.
|
||||||
lib.mkIf false
|
lib.mkIf false
|
||||||
{
|
{
|
||||||
sane.persist.dirs.sys.plaintext = [
|
sane.persist.sys.plaintext = [
|
||||||
{ user = "prosody"; group = "prosody"; directory = "/var/lib/prosody"; }
|
{ user = "prosody"; group = "prosody"; directory = "/var/lib/prosody"; }
|
||||||
];
|
];
|
||||||
networking.firewall.allowedTCPPorts = [
|
networking.firewall.allowedTCPPorts = [
|
||||||
|
|
|
@ -1,7 +1,7 @@
|
||||||
{ pkgs, ... }:
|
{ pkgs, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
sane.persist.dirs.sys.plaintext = [
|
sane.persist.sys.plaintext = [
|
||||||
# TODO: mode? we need this specifically for the stats tracking in .config/
|
# TODO: mode? we need this specifically for the stats tracking in .config/
|
||||||
{ user = "transmission"; group = "transmission"; directory = "/var/lib/transmission"; }
|
{ user = "transmission"; group = "transmission"; directory = "/var/lib/transmission"; }
|
||||||
];
|
];
|
||||||
|
|
|
@ -3,7 +3,7 @@
|
||||||
lib.mkIf config.sane.home-manager.enable
|
lib.mkIf config.sane.home-manager.enable
|
||||||
{
|
{
|
||||||
# private because there could be sensitive things in the swap
|
# private because there could be sensitive things in the swap
|
||||||
sane.persist.dirs.home.private = [ ".cache/vim-swap" ];
|
sane.persist.home.private = [ ".cache/vim-swap" ];
|
||||||
|
|
||||||
home-manager.users.colin.programs.neovim = {
|
home-manager.users.colin.programs.neovim = {
|
||||||
# neovim: https://github.com/neovim/neovim
|
# neovim: https://github.com/neovim/neovim
|
||||||
|
|
|
@ -2,7 +2,7 @@
|
||||||
|
|
||||||
lib.mkIf config.sane.home-manager.enable
|
lib.mkIf config.sane.home-manager.enable
|
||||||
{
|
{
|
||||||
sane.persist.dirs.home.plaintext = [
|
sane.persist.home.plaintext = [
|
||||||
# we don't need to full zsh dir -- just the history file --
|
# we don't need to full zsh dir -- just the history file --
|
||||||
# but zsh will sometimes backup the history file and we get fewer errors if we do proper mounts instead of symlinks.
|
# but zsh will sometimes backup the history file and we get fewer errors if we do proper mounts instead of symlinks.
|
||||||
# TODO: should be private?
|
# TODO: should be private?
|
||||||
|
|
|
@ -307,8 +307,8 @@ in
|
||||||
|
|
||||||
config = {
|
config = {
|
||||||
environment.systemPackages = mkIf cfg.enableSystemPkgs systemPkgs;
|
environment.systemPackages = mkIf cfg.enableSystemPkgs systemPkgs;
|
||||||
sane.persist.dirs.home.plaintext = concatLists (map (p: p.dir) cfg.enabledUserPkgs);
|
sane.persist.home.plaintext = concatLists (map (p: p.dir) cfg.enabledUserPkgs);
|
||||||
sane.persist.dirs.home.private = concatLists (map (p: p.private) cfg.enabledUserPkgs);
|
sane.persist.home.private = concatLists (map (p: p.private) cfg.enabledUserPkgs);
|
||||||
# XXX: this might not be necessary. try removing this and cacert.unbundled?
|
# XXX: this might not be necessary. try removing this and cacert.unbundled?
|
||||||
environment.etc."ssl/certs".source = mkIf cfg.enableSystemPkgs "${pkgs.cacert.unbundled}/etc/ssl/certs/*";
|
environment.etc."ssl/certs".source = mkIf cfg.enableSystemPkgs "${pkgs.cacert.unbundled}/etc/ssl/certs/*";
|
||||||
};
|
};
|
||||||
|
|
|
@ -18,5 +18,5 @@ let
|
||||||
builtins.concatLists contextFreeDirSets;
|
builtins.concatLists contextFreeDirSets;
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
sane.persist.all = (mapDirSets "/home/colin" cfg.dirs.home) ++ (mapDirSets "/" cfg.dirs.sys);
|
sane.persist.all = (mapDirSets "/home/colin" cfg.home) ++ (mapDirSets "/" cfg.sys);
|
||||||
}
|
}
|
||||||
|
|
|
@ -87,21 +87,6 @@ let
|
||||||
# <option>.private.".cache/vim" = { mode = "0700"; };
|
# <option>.private.".cache/vim" = { mode = "0700"; };
|
||||||
# to place ".cache/vim" into the private store and create with the appropriate mode
|
# to place ".cache/vim" into the private store and create with the appropriate mode
|
||||||
dirsSubModule = types.attrsOf (types.listOf contextualizedDirOrShorthand);
|
dirsSubModule = types.attrsOf (types.listOf contextualizedDirOrShorthand);
|
||||||
|
|
||||||
dirsModule = types.submodule {
|
|
||||||
options = {
|
|
||||||
home = mkOption {
|
|
||||||
description = "directories to persist to disk, relative to a user's home ~";
|
|
||||||
default = {};
|
|
||||||
type = dirsSubModule;
|
|
||||||
};
|
|
||||||
sys = mkOption {
|
|
||||||
description = "directories to persist to disk, relative to the fs root /";
|
|
||||||
default = {};
|
|
||||||
type = dirsSubModule;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
options = {
|
options = {
|
||||||
|
@ -114,9 +99,15 @@ in
|
||||||
type = types.bool;
|
type = types.bool;
|
||||||
description = "define / fs root to be a tmpfs. make sure to mount some other device to /nix";
|
description = "define / fs root to be a tmpfs. make sure to mount some other device to /nix";
|
||||||
};
|
};
|
||||||
sane.persist.dirs = mkOption {
|
sane.persist.home = mkOption {
|
||||||
type = dirsModule;
|
description = "directories to persist to disk, relative to a user's home ~";
|
||||||
default = {};
|
default = {};
|
||||||
|
type = dirsSubModule;
|
||||||
|
};
|
||||||
|
sane.persist.sys = mkOption {
|
||||||
|
description = "directories to persist to disk, relative to the fs root /";
|
||||||
|
default = {};
|
||||||
|
type = dirsSubModule;
|
||||||
};
|
};
|
||||||
sane.persist.all = mkOption {
|
sane.persist.all = mkOption {
|
||||||
type = types.listOf contextFreeDir;
|
type = types.listOf contextFreeDir;
|
||||||
|
|
|
@ -16,7 +16,7 @@ in
|
||||||
config = mkIf cfg.enable {
|
config = mkIf cfg.enable {
|
||||||
# we need this mostly because of the size of duplicity's cache
|
# we need this mostly because of the size of duplicity's cache
|
||||||
# TODO: move to cryptClearOnBoot and update perms
|
# TODO: move to cryptClearOnBoot and update perms
|
||||||
sane.persist.dirs.sys.plaintext = [ "/var/lib/duplicity" ];
|
sane.persist.sys.plaintext = [ "/var/lib/duplicity" ];
|
||||||
|
|
||||||
services.duplicity.enable = true;
|
services.duplicity.enable = true;
|
||||||
services.duplicity.targetUrl = "$DUPLICITY_URL";
|
services.duplicity.targetUrl = "$DUPLICITY_URL";
|
||||||
|
|
Loading…
Reference in New Issue
Block a user