From bb33cca83acfeb3f163af7be995407d3188b48c4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?ryan4yin=20=7C=20=E4=BA=8C=E8=8A=B1?= Date: Mon, 21 Sep 2026 18:06:40 +0800 Subject: [PATCH] refactor(youko): let preservation own the service state dirs (#298) * refactor(youko): let preservation own the service state dirs The services' data now sits on the SSD, so the hand-written dataDir + systemd.tmpfiles rules are unnecessary: /var/lib is already preserved by preservation, and the upstream modules create and own their default state dirs (StateDirectory). Use the defaults: - gitea /var/lib/gitea, grafana, sftpgo, caddy, victoriametrics, postgresql (/var/lib/postgresql/), uptime-kuma, homepage - drop the per-service tmpfiles rules and victoriametrics' self-bind Data was moved in place with mv (same filesystem): /persistent/apps/ (== /var/lib/ via the preservation bind) so nothing was copied. * refactor(youko): drop caddy's redundant tmpfiles rules The activation script already creates the fileserver tree with mkdir -p and the module creates caddy's dataDir, so the rules - and the unused vms directory they created - are redundant. * refactor(youko): use a podman named volume for uptime-kuma podman creates the volume and takes the ownership from the image, so the kuma user, the tmpfiles rule and the host directory are no longer needed; the volume lives under /var/lib/containers, which preservation keeps. --- .../homelab-services/caddy.nix | 19 +++------- .../homelab-services/gitea.nix | 1 - .../homelab-services/grafana/default.nix | 1 - .../monitoring/victoriametrics.nix | 5 ++- .../oci-containers/homepage/default.nix | 2 +- .../oci-containers/uptime-kuma/default.nix | 35 +++++-------------- .../homelab-services/postgresql.nix | 10 +----- .../homelab-services/sftpgo.nix | 11 +----- 8 files changed, 18 insertions(+), 66 deletions(-) diff --git a/hosts/12kingdoms-youko/homelab-services/caddy.nix b/hosts/12kingdoms-youko/homelab-services/caddy.nix index 1f404ebd..d4f540ee 100644 --- a/hosts/12kingdoms-youko/homelab-services/caddy.nix +++ b/hosts/12kingdoms-youko/homelab-services/caddy.nix @@ -22,7 +22,6 @@ in # Reload Caddy instead of restarting it when configuration file changes. enableReload = true; user = "caddy"; # User account under which caddy runs. - dataDir = "/persistent/apps/caddy"; logDir = "/var/log/caddy"; # Additional lines of configuration appended to the global config section of the Caddyfile. @@ -41,7 +40,7 @@ in # https://caddyserver.com/docs/caddyfile/directives/file_server virtualHosts."file.writefor.fun".extraConfig = '' - root * /persistent/apps/caddy/fileserver/ + root * /var/lib/caddy/fileserver/ ${hostCommonConfig} file_server browse { hide .git @@ -107,18 +106,10 @@ in 443 ]; - # Create Directories - # https://www.freedesktop.org/software/systemd/man/latest/tmpfiles.d.html#Type - systemd.tmpfiles.rules = [ - "d /persistent/apps/caddy/fileserver/ 0755 caddy caddy" - # directory for virtual machine's images - "d /persistent/apps/caddy/fileserver/vms 0755 caddy caddy" - ]; - - # Add all my wallpapers into /persistent/apps/caddy/fileserver/wallpapers - # Install the homepage-dashboard configuration files + # Serve the wallpapers from the file server. `mkdir -p` here covers the + # whole fileserver tree; caddy's dataDir itself is created by the module. system.activationScripts.installCaddyWallpapers = '' - mkdir -p /persistent/apps/caddy/fileserver/wallpapers - ${pkgs.rsync}/bin/rsync -avz --chmod=D2755,F644 ${wallpapers}/ /persistent/apps/caddy/fileserver/wallpapers/ + mkdir -p /var/lib/caddy/fileserver/wallpapers + ${pkgs.rsync}/bin/rsync -avz --chmod=D2755,F644 ${wallpapers}/ /var/lib/caddy/fileserver/wallpapers/ ''; } diff --git a/hosts/12kingdoms-youko/homelab-services/gitea.nix b/hosts/12kingdoms-youko/homelab-services/gitea.nix index a03b1ed2..c65b424a 100644 --- a/hosts/12kingdoms-youko/homelab-services/gitea.nix +++ b/hosts/12kingdoms-youko/homelab-services/gitea.nix @@ -5,7 +5,6 @@ enable = true; user = "gitea"; group = "gitea"; - stateDir = "/persistent/apps/gitea"; appName = "Ryan Yin's Gitea Service"; lfs.enable = true; # Enable a timer that runs gitea dump to generate backup-files of the current gitea database and repositories. diff --git a/hosts/12kingdoms-youko/homelab-services/grafana/default.nix b/hosts/12kingdoms-youko/homelab-services/grafana/default.nix index b6bbda51..5e1c24f0 100644 --- a/hosts/12kingdoms-youko/homelab-services/grafana/default.nix +++ b/hosts/12kingdoms-youko/homelab-services/grafana/default.nix @@ -13,7 +13,6 @@ services.grafana = { enable = true; - dataDir = "/persistent/apps/grafana"; provision.enable = true; settings = { server = { diff --git a/hosts/12kingdoms-youko/homelab-services/monitoring/victoriametrics.nix b/hosts/12kingdoms-youko/homelab-services/monitoring/victoriametrics.nix index a13cb1a7..1201c2d5 100644 --- a/hosts/12kingdoms-youko/homelab-services/monitoring/victoriametrics.nix +++ b/hosts/12kingdoms-youko/homelab-services/monitoring/victoriametrics.nix @@ -19,20 +19,19 @@ let in { # Since victoriametrics use DynamicUser, the user & group do not exists before the service starts. - # this group is used as a supplementary Unix group for the service to access our data dir(/persistent/apps/xxx) + # this group is used as a supplementary Unix group for the service to access our data dir under /var/lib users.groups.victoriametrics-data = { }; # Workaround for victoriametrics to store data in another place # https://www.freedesktop.org/software/systemd/man/latest/tmpfiles.d.html#Type systemd.tmpfiles.rules = [ - "d /persistent/apps/victoriametrics 0770 root victoriametrics-data - -" + "d /var/lib/victoriametrics 0770 root victoriametrics-data - -" ]; # Symlinks do not work with DynamicUser, so we should use bind mount here. # https://github.com/systemd/systemd/issues/25097#issuecomment-1929074961 systemd.services.victoriametrics.serviceConfig = { SupplementaryGroups = [ "victoriametrics-data" ]; - BindPaths = [ "/persistent/apps/victoriametrics:/var/lib/victoriametrics:rbind" ]; }; # https://victoriametrics.io/docs/victoriametrics/latest/configuration/configuration/ diff --git a/hosts/12kingdoms-youko/homelab-services/oci-containers/homepage/default.nix b/hosts/12kingdoms-youko/homelab-services/oci-containers/homepage/default.nix index 38050973..092a9450 100644 --- a/hosts/12kingdoms-youko/homelab-services/oci-containers/homepage/default.nix +++ b/hosts/12kingdoms-youko/homelab-services/oci-containers/homepage/default.nix @@ -5,7 +5,7 @@ }: let user = "homepage"; - configDir = "/persistent/apps/homepage-dashboard"; + configDir = "/var/lib/homepage-dashboard"; in { users.groups.${user} = { }; diff --git a/hosts/12kingdoms-youko/homelab-services/oci-containers/uptime-kuma/default.nix b/hosts/12kingdoms-youko/homelab-services/oci-containers/uptime-kuma/default.nix index 33c8cfa5..02aaa2b2 100644 --- a/hosts/12kingdoms-youko/homelab-services/oci-containers/uptime-kuma/default.nix +++ b/hosts/12kingdoms-youko/homelab-services/oci-containers/uptime-kuma/default.nix @@ -1,37 +1,18 @@ -{ config, ... }: -let - user = "kuma"; - dataDir = "/persistent/apps/uptime-kuma"; -in +{ ... }: { - users.groups.${user} = { }; - users.users.${user} = { - group = user; - home = dataDir; - isSystemUser = true; - }; - - # Create Directories - # https://www.freedesktop.org/software/systemd/man/latest/tmpfiles.d.html#Type - systemd.tmpfiles.rules = [ - "d ${dataDir} 0755 ${user} ${user}" - ]; - # https://github.com/NixOS/nixpkgs/blob/nixos-26.05/nixos/modules/virtualisation/oci-containers.nix virtualisation.oci-containers.containers = { - # check its logs via `journalctl -u podman-homepage` + # check its logs via `journalctl -u podman-uptime-kuma` + # + # The data lives in a podman *named volume*: podman creates it and takes + # the ownership from the image, so no host directory or tmpfiles rule is + # needed (the volume is under /var/lib/containers, which preservation + # already keeps). uptime-kuma = { hostname = "uptime-kuma"; image = "docker.io/louislam/uptime-kuma:1"; ports = [ "127.0.0.1:53350:3001" ]; - # https://github.com/louislam/uptime-kuma/wiki/Environment-Variables - environment = { - # "PUID" = config.users.users.${user}.uid; - # "PGID" = config.users.groups.${user}.gid; - }; - volumes = [ - "${dataDir}:/app/data" - ]; + volumes = [ "uptime-kuma-data:/app/data" ]; autoStart = true; }; }; diff --git a/hosts/12kingdoms-youko/homelab-services/postgresql.nix b/hosts/12kingdoms-youko/homelab-services/postgresql.nix index ef3a1ffb..d3961afc 100644 --- a/hosts/12kingdoms-youko/homelab-services/postgresql.nix +++ b/hosts/12kingdoms-youko/homelab-services/postgresql.nix @@ -11,22 +11,14 @@ let user = "postgres"; # postgresql's default system user package = pkgs.postgresql_16; - dataDir = "/persistent/apps/postgresql/${package.psqlSchema}"; in { - # Create Directories - # https://www.freedesktop.org/software/systemd/man/latest/tmpfiles.d.html#Type - systemd.tmpfiles.rules = [ - "d /persistent/apps/postgresql 0700 ${user} ${user}" - "d ${dataDir} 0700 ${user} ${user}" - ]; - # https://wiki.nixos.org/wiki/PostgreSQL # https://search.nixos.org/options?channel=unstable&query=services.postgresql. # https://www.postgresql.org/docs/ services.postgresql = { enable = true; - inherit package dataDir; + inherit package; # https://www.postgresql.org/docs/16/jit.html # JIT compilation is beneficial primarily for long-running CPU-bound queries. # Frequently these will be analytical queries. For short queries the added overhead diff --git a/hosts/12kingdoms-youko/homelab-services/sftpgo.nix b/hosts/12kingdoms-youko/homelab-services/sftpgo.nix index abe24760..afdaac68 100644 --- a/hosts/12kingdoms-youko/homelab-services/sftpgo.nix +++ b/hosts/12kingdoms-youko/homelab-services/sftpgo.nix @@ -1,7 +1,6 @@ { config, lib, ... }: let user = "sftpgo"; - dataDir = "/persistent/apps/sftpgo"; in { # Read SFTPGO_DEFAULT_ADMIN_USERNAME and SFTPGO_DEFAULT_ADMIN_PASSWORD from a file @@ -13,17 +12,9 @@ in # sftpgo can read/write files created by transmission, and vice versa. users.users.${user}.extraGroups = [ "fileshare" ]; - # Create Directories - # https://www.freedesktop.org/software/systemd/man/latest/tmpfiles.d.html#Type - # Mode 2775: setgid ensures new files/dirs inherit the 'fileshare' group - # regardless of the creating process's primary group. - systemd.tmpfiles.rules = [ - "d ${dataDir} 0755 ${user} ${user} -" - ]; - services.sftpgo = { enable = true; - inherit user dataDir; + inherit user; extraReadWriteDirs = [ "/data/fileshare" ];