feat: add plocate filesystem search and cap podman log size (#333)

hosts/idols-ai/preservation.nix

@@ -49,6 +49,8 @@ in
       "/etc/agenix/"
 
       "/var/log"
+      # system caches (e.g. restic, plocate; slow to rebuild)
+      "/var/cache"
 
       # system-core
       "/var/lib/nixos"

modules/nixos/base/locate.nix

@@ -0,0 +1,13 @@
+{ pkgs, ... }:
+{
+  # Whole-filesystem filename search (`locate`), backed by plocate. It complements
+  # `nix-index`/`nix-locate`, which only index the nix store.
+  #
+  # The database lives at /var/cache/locatedb. Hosts with an ephemeral root must
+  # persist /var/cache as a directory (see hosts/idols-ai/preservation.nix): plocate
+  # replaces the DB via a temp file + rename, which fails on a bind-mounted file.
+  services.locate = {
+    enable = true;
+    package = pkgs.plocate;
+  };
+}

modules/nixos/desktop/containers.nix

@@ -20,5 +20,10 @@
         flags = [ "--all" ];
       };
     };
+
+    # Bound container log growth. Podman uses journald when the journal is
+    # writable, but rootless sessions can fall back to a file driver
+    # (k8s-file / json-file), which otherwise grows without limit.
+    containers.containersConf.settings.containers.log_size_max = 10 * 1024 * 1024;
   };
 }