refactor(youko): let preservation own the service state dirs (#298)

* refactor(youko): let preservation own the service state dirs The services' data now sits on the SSD, so the hand-written dataDir + systemd.tmpfiles rules are unnecessary: /var/lib is already preserved by preservation, and the upstream modules create and own their default state dirs (StateDirectory). Use the defaults: - gitea /var/lib/gitea, grafana, sftpgo, caddy, victoriametrics, postgresql (/var/lib/postgresql/<version>), uptime-kuma, homepage - drop the per-service tmpfiles rules and victoriametrics' self-bind Data was moved in place with mv (same filesystem): /persistent/apps/<svc> (== /var/lib/<svc> via the preservation bind) so nothing was copied. * refactor(youko): drop caddy's redundant tmpfiles rules The activation script already creates the fileserver tree with mkdir -p and the module creates caddy's dataDir, so the rules - and the unused vms directory they created - are redundant. * refactor(youko): use a podman named volume for uptime-kuma podman creates the volume and takes the ownership from the image, so the kuma user, the tmpfiles rule and the host directory are no longer needed; the volume lives under /var/lib/containers, which preservation keeps.
2026-11-13 12:13:36 +01:00 · 2026-09-21 18:06:40 +08:00
1 parent 9ef7ba7112
commit bb33cca83a
@@ -22,7 +22,6 @@ in
    # Reload Caddy instead of restarting it when configuration file changes.
    enableReload = true;
    user = "caddy"; # User account under which caddy runs.
-    dataDir = "/persistent/apps/caddy";
    logDir = "/var/log/caddy";

    # Additional lines of configuration appended to the global config section of the Caddyfile.
@@ -41,7 +40,7 @@ in

    # https://caddyserver.com/docs/caddyfile/directives/file_server
    virtualHosts."file.writefor.fun".extraConfig = ''
-      root * /persistent/apps/caddy/fileserver/
+      root * /var/lib/caddy/fileserver/
      ${hostCommonConfig}
      file_server browse {
        hide .git
@@ -107,18 +106,10 @@ in
    443
  ];

-  # Create Directories
-  # https://www.freedesktop.org/software/systemd/man/latest/tmpfiles.d.html#Type
-  systemd.tmpfiles.rules = [
-    "d /persistent/apps/caddy/fileserver/ 0755 caddy caddy"
-    # directory for virtual machine's images
-    "d /persistent/apps/caddy/fileserver/vms 0755 caddy caddy"
-  ];
-
-  # Add all my wallpapers into /persistent/apps/caddy/fileserver/wallpapers
-  # Install the homepage-dashboard configuration files
+  # Serve the wallpapers from the file server. `mkdir -p` here covers the
+  # whole fileserver tree; caddy's dataDir itself is created by the module.
  system.activationScripts.installCaddyWallpapers = ''
-    mkdir -p /persistent/apps/caddy/fileserver/wallpapers
-    ${pkgs.rsync}/bin/rsync -avz --chmod=D2755,F644 ${wallpapers}/ /persistent/apps/caddy/fileserver/wallpapers/
+    mkdir -p /var/lib/caddy/fileserver/wallpapers
+    ${pkgs.rsync}/bin/rsync -avz --chmod=D2755,F644 ${wallpapers}/ /var/lib/caddy/fileserver/wallpapers/
  '';
 }
@@ -5,7 +5,6 @@
    enable = true;
    user = "gitea";
    group = "gitea";
-    stateDir = "/persistent/apps/gitea";
    appName = "Ryan Yin's Gitea Service";
    lfs.enable = true;
    # Enable a timer that runs gitea dump to generate backup-files of the current gitea database and repositories.
@@ -13,7 +13,6 @@

  services.grafana = {
    enable = true;
-    dataDir = "/persistent/apps/grafana";
    provision.enable = true;
    settings = {
      server = {
@@ -19,20 +19,19 @@ let
 in
 {
  # Since victoriametrics use DynamicUser, the user & group do not exists before the service starts.
-  # this group is used as a supplementary Unix group for the service to access our data dir(/persistent/apps/xxx)
+  # this group is used as a supplementary Unix group for the service to access our data dir under /var/lib
  users.groups.victoriametrics-data = { };

  # Workaround for victoriametrics to store data in another place
  # https://www.freedesktop.org/software/systemd/man/latest/tmpfiles.d.html#Type
  systemd.tmpfiles.rules = [
-    "d /persistent/apps/victoriametrics 0770 root victoriametrics-data - -"
+    "d /var/lib/victoriametrics 0770 root victoriametrics-data - -"
  ];

  # Symlinks do not work with DynamicUser, so we should use bind mount here.
  # https://github.com/systemd/systemd/issues/25097#issuecomment-1929074961
  systemd.services.victoriametrics.serviceConfig = {
    SupplementaryGroups = [ "victoriametrics-data" ];
-    BindPaths = [ "/persistent/apps/victoriametrics:/var/lib/victoriametrics:rbind" ];
  };

  # https://victoriametrics.io/docs/victoriametrics/latest/configuration/configuration/
@@ -5,7 +5,7 @@
 }:
 let
  user = "homepage";
-  configDir = "/persistent/apps/homepage-dashboard";
+  configDir = "/var/lib/homepage-dashboard";
 in
 {
  users.groups.${user} = { };
@@ -1,37 +1,18 @@
-{ config, ... }:
-let
-  user = "kuma";
-  dataDir = "/persistent/apps/uptime-kuma";
-in
+{ ... }:
 {
-  users.groups.${user} = { };
-  users.users.${user} = {
-    group = user;
-    home = dataDir;
-    isSystemUser = true;
-  };
-
-  # Create Directories
-  # https://www.freedesktop.org/software/systemd/man/latest/tmpfiles.d.html#Type
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 ${user} ${user}"
-  ];
-
  # https://github.com/NixOS/nixpkgs/blob/nixos-26.05/nixos/modules/virtualisation/oci-containers.nix
  virtualisation.oci-containers.containers = {
-    # check its logs via `journalctl -u podman-homepage`
+    # check its logs via `journalctl -u podman-uptime-kuma`
+    #
+    # The data lives in a podman *named volume*: podman creates it and takes
+    # the ownership from the image, so no host directory or tmpfiles rule is
+    # needed (the volume is under /var/lib/containers, which preservation
+    # already keeps).
    uptime-kuma = {
      hostname = "uptime-kuma";
      image = "docker.io/louislam/uptime-kuma:1";
      ports = [ "127.0.0.1:53350:3001" ];
-      # https://github.com/louislam/uptime-kuma/wiki/Environment-Variables
-      environment = {
-        # "PUID" = config.users.users.${user}.uid;
-        # "PGID" = config.users.groups.${user}.gid;
-      };
-      volumes = [
-        "${dataDir}:/app/data"
-      ];
+      volumes = [ "uptime-kuma-data:/app/data" ];
      autoStart = true;
    };
  };
@@ -11,22 +11,14 @@ let

  user = "postgres"; # postgresql's default system user
  package = pkgs.postgresql_16;
-  dataDir = "/persistent/apps/postgresql/${package.psqlSchema}";
 in
 {
-  # Create Directories
-  # https://www.freedesktop.org/software/systemd/man/latest/tmpfiles.d.html#Type
-  systemd.tmpfiles.rules = [
-    "d /persistent/apps/postgresql 0700 ${user} ${user}"
-    "d ${dataDir} 0700 ${user} ${user}"
-  ];
-
  # https://wiki.nixos.org/wiki/PostgreSQL
  # https://search.nixos.org/options?channel=unstable&query=services.postgresql.
  # https://www.postgresql.org/docs/
  services.postgresql = {
    enable = true;
-    inherit package dataDir;
+    inherit package;
    # https://www.postgresql.org/docs/16/jit.html
    # JIT compilation is beneficial primarily for long-running CPU-bound queries.
    # Frequently these will be analytical queries. For short queries the added overhead
@@ -1,7 +1,6 @@
 { config, lib, ... }:
 let
  user = "sftpgo";
-  dataDir = "/persistent/apps/sftpgo";
 in
 {
  # Read SFTPGO_DEFAULT_ADMIN_USERNAME and SFTPGO_DEFAULT_ADMIN_PASSWORD from a file
@@ -13,17 +12,9 @@ in
  # sftpgo can read/write files created by transmission, and vice versa.
  users.users.${user}.extraGroups = [ "fileshare" ];

-  # Create Directories
-  # https://www.freedesktop.org/software/systemd/man/latest/tmpfiles.d.html#Type
-  # Mode 2775: setgid ensures new files/dirs inherit the 'fileshare' group
-  # regardless of the creating process's primary group.
-  systemd.tmpfiles.rules = [
-    "d ${dataDir} 0755 ${user} ${user} -"
-  ];
-
  services.sftpgo = {
    enable = true;
-    inherit user dataDir;
+    inherit user;
    extraReadWriteDirs = [
      "/data/fileshare"
    ];