284 lines
8.3 KiB
Nix
284 lines
8.3 KiB
Nix
{
|
|
config,
|
|
utils,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}:
|
|
let
|
|
USB_KEY = "/dev/disk/by-uuid/63a7bd87-d644-43ea-83ba-547c03012fb6";
|
|
|
|
BOOT = "/dev/disk/by-uuid/ABDB-2A38";
|
|
PRIMARY_UUID = "08610781-26d3-456f-9026-35dd4a40846f";
|
|
PRIMARY = "/dev/disk/by-uuid/${PRIMARY_UUID}";
|
|
|
|
inherit (utils) escapeSystemdPath;
|
|
|
|
primaryDeviceUnit = "${escapeSystemdPath PRIMARY}.device";
|
|
in
|
|
lib.mkMerge [
|
|
# Main filesystems
|
|
{
|
|
# BOOT
|
|
fileSystems."/boot" = {
|
|
device = BOOT;
|
|
fsType = "vfat";
|
|
options = [
|
|
"fmask=0022"
|
|
"dmask=0022"
|
|
];
|
|
};
|
|
|
|
# PRIMARY
|
|
fileSystems."/" = {
|
|
device = PRIMARY;
|
|
fsType = "bcachefs";
|
|
options = [
|
|
"X-mount.subdir=@root"
|
|
];
|
|
};
|
|
fileSystems."/.old_roots" = {
|
|
device = PRIMARY;
|
|
fsType = "bcachefs";
|
|
options = [
|
|
"nofail" # this may not exist yet just skip it
|
|
"X-mount.mkdir"
|
|
"X-mount.subdir=@old_roots"
|
|
];
|
|
};
|
|
fileSystems."/nix" = {
|
|
device = PRIMARY;
|
|
fsType = "bcachefs";
|
|
options = [
|
|
"X-mount.mkdir"
|
|
"X-mount.subdir=@nix"
|
|
"relatime"
|
|
];
|
|
};
|
|
fileSystems."/.snapshots" = {
|
|
device = PRIMARY;
|
|
fsType = "bcachefs";
|
|
options = [
|
|
"X-mount.mkdir"
|
|
"X-mount.subdir=@root"
|
|
"relatime"
|
|
];
|
|
};
|
|
# (optional) for preservation/impermanence
|
|
fileSystems."/persist" = {
|
|
device = PRIMARY;
|
|
fsType = "bcachefs";
|
|
options = [
|
|
"X-mount.mkdir"
|
|
"X-mount.subdir=@persist"
|
|
];
|
|
};
|
|
}
|
|
# SWAP
|
|
{
|
|
swapDevices = [
|
|
# {
|
|
# device = "/.swap/swapfile";
|
|
# size = 8 * 1024; # Creates an 8GB swap file
|
|
# }
|
|
];
|
|
}
|
|
# Disable bcachefs built in password prompts for all mounts (which asks for every single subdir mount above
|
|
(
|
|
let
|
|
disableFs = fs: {
|
|
name = "unlock-bcachefs-${utils.escapeSystemdPath fs.mountPoint}";
|
|
value = {
|
|
enable = false;
|
|
};
|
|
};
|
|
in
|
|
{
|
|
boot.initrd.systemd.enable = true;
|
|
|
|
# https://github.com/NixOS/nixpkgs/blob/6cdf2f456a57164282ede1c97fc5532d9dba1ee0/nixos/modules/tasks/filesystems/bcachefs.nix#L254-L259
|
|
systemd.services =
|
|
let
|
|
isSystemdNonBootBcache = fs: (fs.fsType == "bcachefs") && (!utils.fsNeededForBoot fs);
|
|
bcacheNonBoots = lib.filterAttrs (k: fs: isSystemdNonBootBcache fs) config.fileSystems;
|
|
in
|
|
(lib.mapAttrs' (k: disableFs) bcacheNonBoots);
|
|
# The above auto generates these...
|
|
# {
|
|
# "unlock-bcachefs-${escapeSystemdPath "/.old_roots"}".enable = false;
|
|
# "unlock-bcachefs-${escapeSystemdPath "/.snapshots"}".enable = false;
|
|
# "unlock-bcachefs-${escapeSystemdPath "/.swap"}".enable = false;
|
|
# "unlock-bcachefs-${escapeSystemdPath "/persist"}".enable = false;
|
|
# };
|
|
|
|
# https://github.com/NixOS/nixpkgs/blob/6cdf2f456a57164282ede1c97fc5532d9dba1ee0/nixos/modules/tasks/filesystems/bcachefs.nix#L291
|
|
boot.initrd.systemd.services =
|
|
let
|
|
isSystemdBootBcache = fs: (fs.fsType == "bcachefs") && (utils.fsNeededForBoot fs);
|
|
bcacheBoots = lib.filterAttrs (k: fs: isSystemdBootBcache fs) config.fileSystems;
|
|
in
|
|
(lib.mapAttrs' (k: disableFs) bcacheBoots);
|
|
# same with that above
|
|
# {
|
|
# "unlock-bcachefs-${escapeSystemdPath "/sysroot"}".enable = false;
|
|
# "unlock-bcachefs-${escapeSystemdPath "/"}".enable = false;
|
|
# "unlock-bcachefs-${escapeSystemdPath "/nix"}".enable = false;
|
|
# };
|
|
}
|
|
)
|
|
# Bcachefs auto decryption
|
|
{
|
|
boot.supportedFilesystems = [
|
|
"bcachefs"
|
|
];
|
|
|
|
boot.initrd.systemd.mounts = [
|
|
{
|
|
what = USB_KEY;
|
|
type = "bcachefs";
|
|
where = "/usb_key";
|
|
options = "ro";
|
|
description = "key";
|
|
wantedBy = [
|
|
"initrd.target"
|
|
"initrd-root-fs.target"
|
|
];
|
|
}
|
|
];
|
|
boot.initrd.systemd.services."sysroot.mount" = {
|
|
unitConfig = {
|
|
Requires = [ "unlock-bcachefs-custom.service" ];
|
|
After = [ "unlock-bcachefs-custom.service" ];
|
|
};
|
|
};
|
|
boot.initrd.systemd.services.unlock-bcachefs-custom = {
|
|
description = "Custom single bcachefs unlock for all subvolumes";
|
|
|
|
# Make this part of the root-fs chain, not just initrd.target
|
|
wantedBy = [
|
|
# "initrd.target"
|
|
"sysroot.mount"
|
|
"initrd-root-fs.target"
|
|
];
|
|
# Stronger than wantedBy if you want it absolutely required:
|
|
requiredBy = [
|
|
"sysroot.mount"
|
|
"initrd-root-fs.target"
|
|
];
|
|
|
|
before = [
|
|
"sysroot.mount"
|
|
"initrd-root-fs.target"
|
|
];
|
|
requires = [
|
|
"usb_key.mount"
|
|
primaryDeviceUnit
|
|
];
|
|
after = [
|
|
"usb_key.mount"
|
|
primaryDeviceUnit
|
|
"initrd-root-device.target"
|
|
];
|
|
|
|
# script = ''
|
|
# echo "Using test password..."
|
|
#
|
|
# mkdir -p /usb_key
|
|
# # Wait for USB device (optional, to handle slow init)
|
|
# for i in $(seq 1 50); do
|
|
# if [ -b "${USB_KEY}" ]; then
|
|
# break
|
|
# fi
|
|
# echo "Waiting for USB key ${USB_KEY}..."
|
|
# sleep 0.2
|
|
# done
|
|
#
|
|
# if [ ! -b "${USB_KEY}" ]; then
|
|
# echo "USB key device ${USB_KEY} not present in initrd"
|
|
# exit 1
|
|
# fi
|
|
#
|
|
# # Mount the key
|
|
# mount -t bcachefs -o ro "${USB_KEY}" /usb_key
|
|
#
|
|
# echo "test" | ${pkgs.bcachefs-tools}/bin/bcachefs unlock "${PRIMARY}"
|
|
# echo "bcachefs unlock successful for ${PRIMARY}"
|
|
# '';
|
|
|
|
script = ''
|
|
echo "Using test password..."
|
|
echo "test" | ${pkgs.bcachefs-tools}/bin/bcachefs unlock "${PRIMARY}"
|
|
echo "bcachefs unlock successful for ${PRIMARY}"
|
|
'';
|
|
|
|
# script = ''
|
|
# echo "Using USB key for bcachefs unlock: ${USB_KEY}"
|
|
#
|
|
# echo "test" | ${pkgs.bcachefs-tools}/bin/bcachefs unlock "${PRIMARY}"
|
|
# echo "done...."
|
|
# exit 0
|
|
#
|
|
# # only try mount if the node exists
|
|
# if [ ! -e "${USB_KEY}" ]; then
|
|
# echo "USB key device ${USB_KEY} not present in initrd"
|
|
# exit 1
|
|
# fi
|
|
# ${pkgs.bcachefs-tools}/bin/bcachefs unlock -f /usb_key/key "${PRIMARY}"
|
|
# echo "bcachefs unlock successful for ${PRIMARY}"
|
|
# '';
|
|
};
|
|
|
|
# TODO rotate root
|
|
}
|
|
# Reset root for erase your darlings/impermanence/preservation
|
|
{
|
|
# boot.initrd.systemd.services.bcachefs-reset-root = {
|
|
# description = "Reset bcachefs root subvolume before pivot";
|
|
# wantedBy = [ "initrd.target" ];
|
|
#
|
|
# after = [
|
|
# "initrd-root-device.target"
|
|
# "cryptsetup.target"
|
|
# "unlock-bcachefs-custom"
|
|
# ];
|
|
# requires = [ primaryDeviceUnit ];
|
|
#
|
|
# serviceConfig = {
|
|
# Type = "oneshot";
|
|
# # initrd has a minimal PATH; set one explicitly
|
|
# Environment = "PATH=/bin:/sbin:/usr/bin:/usr/sbin";
|
|
# # If tools are in /usr, this helps ensure it's in the initrd
|
|
# # (you may also need environment.systemPackages + boot.initrd.includeDefaultModules)
|
|
# ExecStart = pkgs.writeShellScript "bcachefs-reset-root" ''
|
|
# set -euo pipefail
|
|
#
|
|
# PRIMARY=${PRIMARY}
|
|
#
|
|
# echo "Unlocking bcachefs volume ${PRIMARY}..."
|
|
# echo "test" | bcachefs unlock "''${PRIMARY}"
|
|
#
|
|
# mkdir -p /primary_tmp
|
|
# mount "''${PRIMARY}" /primary_tmp
|
|
#
|
|
# if [[ -e /primary_tmp/@root ]]; then
|
|
# mkdir -p /primary_tmp/@old_roots
|
|
# bcachefs set-file-option /primary_tmp/@old_roots --compression=zstd
|
|
#
|
|
# timestamp=$(date --date="@$(stat -c %Y /primary_tmp/@root)" "+%Y-%m-%-d_%H:%M:%S")
|
|
# bcachefs subvolume snapshot /primary_tmp/@root "/primary_tmp/@old_roots/$timestamp"
|
|
# bcachefs subvolume delete /primary_tmp/@root
|
|
#
|
|
# # Cleanup old snapshots (>30 days)
|
|
# # Note: path was /primary_tmp/old_roots in your snippet; using @old_roots for consistency
|
|
# for i in $(find /primary_tmp/@old_roots/ -maxdepth 1 -mtime +30); do
|
|
# bcachefs subvolume delete "$i"
|
|
# done
|
|
# fi
|
|
#
|
|
# bcachefs subvolume create /primary_tmp/@root
|
|
# umount /primary_tmp
|
|
# '';
|
|
# };
|
|
# };
|
|
}
|
|
]
|