feat: hosts/k8s - replace impermanence with preservation (#199)

2026-05-20 22:57:17 +02:00 · 2025-06-29 14:56:08 +08:00
parent dd008c3363
commit aaabb5ed76
6 changed files with 114 additions and 62 deletions
@@ -0,0 +1,110 @@
+{
+  preservation,
+  pkgs,
+  myvars,
+  ...
+}: let
+  inherit (myvars) username;
+in {
+  imports = [
+    preservation.nixosModules.default
+  ];
+
+  preservation.enable = true;
+  boot.initrd.systemd.enable = true;
+
+  environment.systemPackages = [
+    # `sudo ncdu -x /`
+    pkgs.ncdu
+  ];
+
+  # NOTE: `preservation` only mounts the directory/file list below to /persistent
+  # If the directory/file already exists in the root filesystem you should
+  # move those files/directories to /persistent first!
+  preservation.preserveAt."/persistent" = {
+    directories = [
+      "/etc/NetworkManager/system-connections"
+      "/etc/ssh"
+      "/etc/nix/inputs"
+      "/etc/secureboot" # lanzaboote - secure boot
+      # my secrets
+      "/etc/agenix/"
+
+      "/var/log"
+      "/var/lib"
+
+      # k3s related
+      "/etc/iscsi"
+      "/etc/rancher"
+    ];
+    files = [
+      # auto-generated machine ID
+      {
+        file = "/etc/machine-id";
+        inInitrd = true;
+      }
+    ];
+
+    # the following directories will be passed to /persistent/home/$USER
+    users.${username} = {
+      directories = [
+        "codes"
+        "nix-config"
+        "tmp"
+      ];
+      files = [
+        {
+          file = ".config/nushell/history.txt";
+          how = "symlink";
+          # create parent directory automatically
+          configureParent = true;
+        }
+      ];
+    };
+  };
+
+  # Create some directories with custom permissions.
+  #
+  # In this configuration the path `/home/butz/.local` is not an immediate parent
+  # of any persisted file so it would be created with the systemd-tmpfiles default
+  # ownership `root:root` and mode `0755`. This would mean that the user `butz`
+  # could not create other files or directories inside `/home/butz/.local`.
+  #
+  # Therefore systemd-tmpfiles is used to prepare such directories with
+  # appropriate permissions.
+  #
+  # Note that immediate parent directories of persisted files can also be
+  # configured with ownership and permissions from the `parent` settings if
+  # `configureParent = true` is set for the file.
+  systemd.tmpfiles.settings.preservation = let
+    permission = {
+      user = username;
+      group = "users";
+      mode = "0755";
+    };
+  in {
+    "/home/${username}/.config".d = permission;
+    "/home/${username}/.local".d = permission;
+    "/home/${username}/.local/share".d = permission;
+    "/home/${username}/.local/state".d = permission;
+    "/home/${username}/.terraform.d".d = permission;
+  };
+
+  # systemd-machine-id-commit.service would fail but it is not relevant
+  # in this specific setup for a persistent machine-id so we disable it
+  #
+  # see the firstboot example below for an alternative approach
+  systemd.suppressedSystemUnits = ["systemd-machine-id-commit.service"];
+
+  # let the service commit the transient ID to the persistent volume
+  systemd.services.systemd-machine-id-commit = {
+    unitConfig.ConditionPathIsMountPoint = [
+      ""
+      "/persistent/etc/machine-id"
+    ];
+    serviceConfig.ExecStart = [
+      ""
+      "systemd-machine-id-setup --commit --root /persistent"
+    ];
+  };
+}