attempting impermanence on testbed machine

flakes/common/nix_modules/essentials/default.nix

@@ -5,6 +5,12 @@
 }:
 with lib;
 {
+  security.sudo = {
+    extraConfig = ''
+      Defaults lecture="never"
+    '';
+  };
+
   environment.systemPackages = with pkgs; [
     # Essentials
     vim

utilities/nixos-installers/examples/flake.nix

@@ -0,0 +1,127 @@
+{
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
+    home-manager.url = "github:rycee/home-manager/release-25.05";
+
+    common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/common";
+    ros_neovim.url = "git+https://git.joshuabell.xyz/ringofstorms/nvim";
+    
+    impermanence.url = "github:nix-community/impermanence";
+  };
+
+  outputs =
+    {
+      nixpkgs,
+      home-manager,
+      common,
+      ros_neovim,
+      ...
+    }@inputs:
+    let
+      configurationName = "testbed";
+      system = "x86_64-linux";
+      primaryUser = "luser";
+      configLocation = "/home/${primaryUser}/.config/nixos-config";
+      # configLocation = "/home/${primaryUser}/.config/nixos-config/hosts/${configurationName}";
+      lib = nixpkgs.lib;
+    in
+    {
+      nixosConfigurations = {
+        "${configurationName}" = (
+          lib.nixosSystem {
+            inherit system;
+            specialArgs = {
+              inherit inputs;
+            };
+            modules = [
+              inputs.impermanence.nixosModules.impermanence
+              inputs.home-manager.nixosModules.default
+
+              ros_neovim.nixosModules.default
+              (
+                { ... }:
+                {
+                  ringofstorms-nvim.includeAllRuntimeDependencies = true;
+                }
+              )
+
+              common.nixosModules.essentials
+              common.nixosModules.git
+              common.nixosModules.tmux
+              common.nixosModules.boot_systemd
+              common.nixosModules.hardening
+              common.nixosModules.jetbrains_font
+              common.nixosModules.nix_options
+              common.nixosModules.no_sleep
+              common.nixosModules.timezone_auto
+              common.nixosModules.tty_caps_esc
+              common.nixosModules.zsh
+
+              ./hardware-configuration.nix
+              ./impermanence.nix
+              (
+                {
+                  config,
+                  pkgs,
+                  upkgs,
+                  lib,
+                  ...
+                }:
+                rec {
+ 		              system.stateVersion = "25.05";
+                  services.openssh.settings.PasswordAuthentication = lib.mkForce true;
+
+                  # Home Manager
+                  home-manager = {
+                    useUserPackages = true;
+                    useGlobalPkgs = true;
+                    backupFileExtension = "bak";
+                    # add all normal users to home manager so it applies to them
+                    users = lib.mapAttrs (name: user: {
+                      home.stateVersion = "25.05";
+                      programs.home-manager.enable = true;
+                    }) (lib.filterAttrs (name: user: user.isNormalUser or false) users.users);
+
+                    sharedModules = [
+                      common.homeManagerModules.tmux
+                      common.homeManagerModules.atuin
+                      common.homeManagerModules.direnv
+                      common.homeManagerModules.git
+                      common.homeManagerModules.postgres_cli_options
+                      common.homeManagerModules.starship
+                      common.homeManagerModules.zoxide
+                      common.homeManagerModules.zsh
+                    ];
+
+                    extraSpecialArgs = {
+                      inherit inputs;
+                      inherit upkgs;
+                    };
+                  };
+
+                  # System configuration
+                  networking.hostName = configurationName;
+                  programs.nh.flake = configLocation;
+                  nixpkgs.config.allowUnfree = true;
+                  users.mutableUsers = false;
+                  users.users = {
+                    "${primaryUser}" = {
+                      isNormalUser = true;
+                      hashedPassword = "$y$j9T$v1QhXiZMRY1pFkPmkLkdp0$451GvQt.XFU2qCAi4EQNd1BEqjM/CH6awU8gjcULps6"; # "test" password
+                      extraGroups = [
+                        "wheel"
+                        "networkmanager"
+                      ];
+                      openssh.authorizedKeys.keys = [
+                      ];
+                    };
+                  };
+                }
+              )
+            ];
+          }
+        );
+      };
+    };
+}
+

utilities/nixos-installers/examples/hardware-configuration.nix

@@ -0,0 +1,120 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+let
+  NIXBOOT = "/dev/disk/by-uuid/641A-6BDB";
+  NIXROOT ="/dev/disk/by-uuid/ae94db42-ec46-4e2f-a98a-118359428a68"; 
+  cryptroot = "/dev/disk/by-uuid/49f11bf1-d4b7-4188-9203-4d7a42569afa";
+
+  USB_KEY = "/dev/disk/by-uuid/9985-EBD1";
+in
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sdhci_pci" "ehci_pci" "uas" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/boot" =
+    { device = NIXBOOT;
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  boot.initrd.luks.devices."cryptroot" = {
+    device = NIXROOT;
+
+    # Auto decrypt
+    keyFile = USB_KEY;
+    keyFileSize = 5000;
+    keyFileOffset = 5443;
+
+    tryEmptyPassphrase = true;
+    fallbackToPassword = true;
+    crypttabExtraOpts = [ "tries=2" ];
+  };
+
+  fileSystems."/" =
+    { device = cryptroot;
+      fsType = "btrfs";
+      options = [ "subvol=@root" "compress=zstd" ];
+    };
+
+  fileSystems."/nix" =
+    { device = cryptroot;
+      fsType = "btrfs";
+      options = [ "subvol=@nix" "compress=zstd" "noatime" ];
+    };
+
+  fileSystems."/persist" =
+    { device = cryptroot;
+      neededForBoot = true;
+      fsType = "btrfs";
+      options = [ "subvol=@persist" "compress=zstd" ];
+    };
+
+  fileSystems."/.swap" =
+    { device = cryptroot;
+      fsType = "btrfs";
+      options = [ "subvol=@swap" "noatime" ];
+    };
+
+  fileSystems."/.snapshots" =
+    { device = cryptroot;
+      fsType = "btrfs";
+      options = [ "subvol=@snapshots" "compress=zstd" "noatime"];
+    };
+
+  services.btrfs.autoScrub = {
+    enable = true;
+    # syntax as defined by https://www.freedesktop.org/software/systemd/man/systemd.time.html#Calendar%20Event s
+    interval = "monthly";
+    fileSystems = ["/"];
+  };
+
+  swapDevices = [{
+    device = "/.swap/swapfile"; 
+    size = 8*1024; # Creates an 8GB swap file 
+  }];
+
+  boot.initrd.postResumeCommands = lib.mkAfter ''
+    mkdir /btrfs_tmp
+    mount ${cryptroot} /btrfs_tmp
+    if [[ -e /btrfs_tmp/@root ]]; then
+        mkdir -p /btrfs_tmp/old_roots
+        timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/@root)" "+%Y-%m-%-d_%H:%M:%S")
+        mv /btrfs_tmp/@root "/btrfs_tmp/old_roots/$timestamp"
+    fi
+
+    delete_subvolume_recursively() {
+        IFS=$'\n'
+        for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
+            delete_subvolume_recursively "/btrfs_tmp/$i"
+        done
+        btrfs subvolume delete "$1"
+    }
+
+    for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do
+        delete_subvolume_recursively "$i"
+    done
+
+    btrfs subvolume create /btrfs_tmp/@root
+    umount /btrfs_tmp
+  '';
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp3s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

utilities/nixos-installers/examples/impermanence.nix

@@ -0,0 +1,37 @@
+{ ... }:
+{
+  environment.persistence."/persist" = {
+    enable = true;
+    hideMounts = true;
+    directories = [
+      "/var/log"
+      "/var/lib/nixos"
+      "/var/lib/systemd/coredump"
+      "/var/lib/systemd/timers"
+
+      "/etc/nixos"
+      "/etc/ssh"
+
+      "/etc/NetworkManager/system-connections"
+      "/var/lib/bluetooth"
+
+    ];
+    files = [
+      "/etc/machine-id"
+    ];
+    users.luser = {
+      directories = [
+        "projects"
+        ".config/nixos-config"
+
+        ".config/atuin"
+        ".local/share/atuin"
+
+        ".local/share/zoxide"
+      ];
+      files = [
+
+      ];
+    };
+  };
+}

utilities/nixos-installers/install_notes.md

@@ -69,6 +69,7 @@ nixos-generate-config --root /mnt
 # @swap options + "noatime"
 # @snapshots options + "compress=zstd" "noatime"
 # @persist options + "compress=zstd"
+#   + neededForBoot = true;
 
 # add Swap device
 swapDevices = [{ 
@@ -132,6 +133,36 @@ In hardware-configuration ensure these are all added:
   };
 ```
 
+### Impermanence BTRFS setup (optional)
+
+```hardware-configuration.nix
+boot.initrd.postResumeCommands = lib.mkAfter ''
+    mkdir /btrfs_tmp
+    mount /dev/ROOT_FILESYSTEM /btrfs_tmp
+    if [[ -e /btrfs_tmp/@root ]]; then
+        mkdir -p /btrfs_tmp/old_roots
+        timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/root)" "+%Y-%m-%-d_%H:%M:%S")
+        mv /btrfs_tmp/root "/btrfs_tmp/old_roots/$timestamp"
+    fi
+
+    delete_subvolume_recursively() {
+        IFS=$'\n'
+        for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
+            delete_subvolume_recursively "/btrfs_tmp/$i"
+        done
+        btrfs subvolume delete "$1"
+    }
+
+    for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do
+        delete_subvolume_recursively "$i"
+    done
+
+    btrfs subvolume create /btrfs_tmp/@root
+    umount /btrfs_tmp
+'';
+
+```
+
 ### Install nixos
 
 `sudo nixos-install`

utilities/nixos-installers/new-flake.nix

@@ -5,14 +5,12 @@
 
     common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/common";
     ros_neovim.url = "git+https://git.joshuabell.xyz/ringofstorms/nvim";
+
+    # impermanence.url = "github:nix-community/impermanence";
   };
 
   outputs =
     {
-      nixpkgs,
-      home-manager,
-      common,
-      ros_neovim,
       ...
     }@inputs:
     let
@@ -21,7 +19,7 @@
       primaryUser = "luser";
       configLocation = "/etc/nixos";
       # configLocation = "/home/${primaryUser}/.config/nixos-config/hosts/${configurationName}";
-      lib = nixpkgs.lib;
+      lib = inputs.nixpkgs.lib;
     in
     {
       nixosConfigurations = {
@@ -32,9 +30,10 @@
               inherit inputs;
             };
             modules = [
-              home-manager.nixosModules.default
+              # inputs.impermanence.nixosModules.impermanence
+              inputs.home-manager.nixosModules.default
 
-              ros_neovim.nixosModules.default
+              inputs.ros_neovim.nixosModules.default
               (
                 { ... }:
                 {
@@ -42,18 +41,19 @@
                 }
               )
 
-              common.nixosModules.essentials
+              inputs.common.nixosModules.essentials
-              common.nixosModules.git
+              inputs.common.nixosModules.git
-              common.nixosModules.tmux
+              inputs.common.nixosModules.tmux
-              # common.nixosModules.boot_systemd
+              # TODO PICK ONE
-              # common.nixosModules.boot_grub
+              # inputs.common.nixosModules.boot_systemd
-              common.nixosModules.hardening
+              # inputs.common.nixosModules.boot_grub
-              common.nixosModules.jetbrains_font
+              inputs.common.nixosModules.hardening
-              common.nixosModules.nix_options
+              inputs.common.nixosModules.jetbrains_font
-              common.nixosModules.no_sleep
+              inputs.common.nixosModules.nix_options
-              common.nixosModules.timezone_auto
+              inputs.common.nixosModules.no_sleep
-              common.nixosModules.tty_caps_esc
+              inputs.common.nixosModules.timezone_auto
-              common.nixosModules.zsh
+              inputs.common.nixosModules.tty_caps_esc
+              inputs.common.nixosModules.zsh
 
               ./hardware-configuration.nix
               (
@@ -65,8 +65,9 @@
                   ...
                 }:
                 rec {
+                  # TODO ensure matches configuration.nix, and add anything else from there that is needed
                   system.stateVersion = "25.05";
-                  # No ssh pub keys setup yet, allow password login
+                  # No ssh pub keys setup yet, allow password login, TODO remove
                   services.openssh.settings.PasswordAuthentication = lib.mkForce true;
 
                   # Home Manager
@@ -81,14 +82,14 @@
                     }) (lib.filterAttrs (name: user: user.isNormalUser or false) users.users);
 
                     sharedModules = [
-                      common.homeManagerModules.tmux
+                      inputs.common.homeManagerModules.tmux
-                      common.homeManagerModules.atuin
+                      inputs.common.homeManagerModules.atuin
-                      common.homeManagerModules.direnv
+                      inputs.common.homeManagerModules.direnv
-                      common.homeManagerModules.git
+                      inputs.common.homeManagerModules.git
-                      common.homeManagerModules.postgres_cli_options
+                      inputs.common.homeManagerModules.postgres_cli_options
-                      common.homeManagerModules.starship
+                      inputs.common.homeManagerModules.starship
-                      common.homeManagerModules.zoxide
+                      inputs.common.homeManagerModules.zoxide
-                      common.homeManagerModules.zsh
+                      inputs.common.homeManagerModules.zsh
                     ];
 
                     extraSpecialArgs = {
@@ -101,15 +102,17 @@
                   networking.hostName = configurationName;
                   programs.nh.flake = configLocation;
                   nixpkgs.config.allowUnfree = true;
+                  users.mutableUsers = false;
                   users.users = {
                     "${primaryUser}" = {
                       isNormalUser = true;
-                      initialPassword = "password1";
+                      hashedPassword = "$y$j9T$v1QhXiZMRY1pFkPmkLkdp0$451GvQt.XFU2qCAi4EQNd1BEqjM/CH6awU8gjcULps6"; # "test" password
                       extraGroups = [
                         "wheel"
                         "networkmanager"
                       ];
                       openssh.authorizedKeys.keys = [
+                        # TODO set a public key for access
                       ];
                     };
                   };