flake.lock: Update

Flake lock file updates:

• Updated input 'disko':
    'github:nix-community/disko/786965e1b1ed3fd2018d78399984f461e2a44689' (2024-07-11)
  → 'github:nix-community/disko/bec6e3cde912b8acb915fecdc509eda7c973fb42' (2024-07-19)
• Updated input 'dream2nix':
    'github:nix-community/dream2nix/0c6b5c8ab796f6dfb2aef1133f5b7bb25ce57cb9' (2024-07-10)
  → 'github:nix-community/dream2nix/4e9fd61a1201f4b3800d6946810a6b4c2ecdcde8' (2024-07-18)
• Updated input 'homeManager':
    'github:nix-community/home-manager/c085b984ff2808bf322f375b10fea5a415a9c43d' (2024-07-10)
  → 'github:nix-community/home-manager/635563f245309ef5320f80c7ebcb89b2398d2949' (2024-07-21)
• Updated input 'lix':
    'git+https://git@git.lix.systems/lix-project/lix?ref=refs/heads/main&rev=014410cbf0bda9c0fcdaf5f894120883cdc805ce' (2024-07-10)
  → 'git+https://git@git.lix.systems/lix-project/lix?ref=refs/heads/main&rev=1917e6c765b0b0012ed85a7a927db0bf83fb27ca' (2024-07-20)
• Updated input 'lix-module':
    'git+https://git.lix.systems/lix-project/nixos-module?ref=refs/heads/main&rev=5d9d94089fb1ca96222a34bfe245ef5c5ebefd37' (2024-06-25)
  → 'git+https://git.lix.systems/lix-project/nixos-module?ref=refs/heads/main&rev=d70318fb946a0e720dfdd1fb10b0645c14e2a02a' (2024-07-11)
• Updated input 'mobile-nixos':
    'github:NixOS/mobile-nixos/31704f8a55f5773c9b4e7adb7408a142d142e1f2' (2024-07-11)
  → 'github:NixOS/mobile-nixos/472073a51745cca03257cf625582252cdd04ec21' (2024-07-17)
• Updated input 'nix-on-droid':
    'github:nix-community/nix-on-droid/8bcadcef69dcb5ca177bfb6ea3dc6b092cda2b06' (2024-07-10)
  → 'github:nix-community/nix-on-droid/c00333ee42aa2b4d4825e0388a1049fdeeded6c6' (2024-07-14)
• Updated input 'nix-on-droid/nix-formatter-pack/nmd':
    'gitlab:rycee/nmd/b75d312b4f33bd3294cd8ae5c2ca8c6da2afc169' (2022-10-19)
  → follows 'nix-on-droid/nmd'
• Updated input 'nixDarwin':
    'github:LnL7/nix-darwin/cf297a8d248db6a455b60133f6c0029c04ebe50e' (2024-07-10)
  → 'github:LnL7/nix-darwin/33bf7df5bbfcbbb49e6559b0c96c9e3b26d14e58' (2024-07-21)
• Updated input 'nixd':
    'github:nix-community/nixd/60a925008bc353136ba5babce437f42819c1645c' (2024-06-26)
  → 'github:nix-community/nixd/963dd36863e18f942e90c66b2c76e7c161b61ff9' (2024-07-21)
• Updated input 'nixosHardware':
    'github:NixOS/nixos-hardware/a111ce6b537df12a39874aa9672caa87f8677eda' (2024-07-09)
  → 'github:NixOS/nixos-hardware/ab165a8a6cd12781d76fe9cbccb9e975d0fb634f' (2024-07-19)
• Updated input 'nixpkgsStable':
    'github:NixOS/nixpkgs/7144d6241f02d171d25fba3edeaf15e0f2592105' (2024-07-02)
  → 'github:NixOS/nixpkgs/205fd4226592cc83fd4c0885a3e4c9c400efabb5' (2024-07-09)
• Updated input 'pre-commit-hooks':
    'github:cachix/pre-commit-hooks.nix/8d6a17d0cdf411c55f12602624df6368ad86fac1' (2024-07-09)
  → 'github:cachix/pre-commit-hooks.nix/f451c19376071a90d8c58ab1a953c6e9840527fd' (2024-07-15)
• Updated input 'treefmt-nix':
    'github:numtide/treefmt-nix/750dfb555b5abdab4d3266b3f9a05dec6d205c04' (2024-07-10)
  → 'github:numtide/treefmt-nix/888bfb10a9b091d9ed2f5f8064de8d488f7b7c97' (2024-07-20)

flake.lock

@@ -104,11 +104,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1720661479,
+        "lastModified": 1721417620,
-        "narHash": "sha256-nsGgA14vVn0GGiqEfomtVgviRJCuSR3UEopfP8ixW1I=",
+        "narHash": "sha256-6q9b1h8fI3hXg2DG6/vrKWCeG8c5Wj2Kvv22RCgedzg=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "786965e1b1ed3fd2018d78399984f461e2a44689",
+        "rev": "bec6e3cde912b8acb915fecdc509eda7c973fb42",
         "type": "github"
       },
       "original": {
@@ -124,11 +124,11 @@
         "pyproject-nix": "pyproject-nix"
       },
       "locked": {
-        "lastModified": 1720605900,
+        "lastModified": 1721316623,
-        "narHash": "sha256-/BTAC3gj1Ot7o/PINsHS2EGEtGUadI12WZlhowKn18c=",
+        "narHash": "sha256-WmPX3r0YtUxvcQmTgvNld2xJooWr4f/+5dURiw7/3zc=",
         "owner": "nix-community",
         "repo": "dream2nix",
-        "rev": "0c6b5c8ab796f6dfb2aef1133f5b7bb25ce57cb9",
+        "rev": "4e9fd61a1201f4b3800d6946810a6b4c2ecdcde8",
         "type": "github"
       },
       "original": {
@@ -818,11 +818,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1720646128,
+        "lastModified": 1721534365,
-        "narHash": "sha256-BivO5yIQukDlJL+1875Sqf3GuOPxZDdA48dYDi3PkL8=",
+        "narHash": "sha256-XpZOkaSJKdOsz1wU6JfO59Rx2fqtcarQ0y6ndIOKNpI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c085b984ff2808bf322f375b10fea5a415a9c43d",
+        "rev": "635563f245309ef5320f80c7ebcb89b2398d2949",
         "type": "github"
       },
       "original": {
@@ -852,6 +852,21 @@
         "type": "github"
       }
     },
+    "impermanence": {
+      "locked": {
+        "lastModified": 1719091691,
+        "narHash": "sha256-AxaLX5cBEcGtE02PeGsfscSb/fWMnyS7zMWBXQWDKbE=",
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "rev": "23c1f06316b67cb5dabdfe2973da3785cfe9c34a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "type": "github"
+      }
+    },
     "kernel-src": {
       "flake": false,
       "locked": {
@@ -872,11 +887,11 @@
     "lix": {
       "flake": false,
       "locked": {
-        "lastModified": 1720633647,
+        "lastModified": 1721513673,
-        "narHash": "sha256-CjWvti4wFhRmIHpLduohKAVmU9+wI/PAOhQppCWziK8=",
+        "narHash": "sha256-Tgdh7f1AB4D8aDw4obBwh0VYgZEcFBbjKZmMyolmnhw=",
         "ref": "refs/heads/main",
-        "rev": "014410cbf0bda9c0fcdaf5f894120883cdc805ce",
+        "rev": "1917e6c765b0b0012ed85a7a927db0bf83fb27ca",
-        "revCount": 15944,
+        "revCount": 15996,
         "type": "git",
         "url": "https://git@git.lix.systems/lix-project/lix"
       },
@@ -897,11 +912,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1719353937,
+        "lastModified": 1720695775,
-        "narHash": "sha256-86NBqDxAP20ET/UoKX0WvSItblNQ97czXb2q7lkMrwk=",
+        "narHash": "sha256-8Oqzl9QPjEe/n8y0R2tC6+2v/H6xBgABHXOJwxmnBg0=",
         "ref": "refs/heads/main",
-        "rev": "5d9d94089fb1ca96222a34bfe245ef5c5ebefd37",
+        "rev": "d70318fb946a0e720dfdd1fb10b0645c14e2a02a",
-        "revCount": 92,
+        "revCount": 94,
         "type": "git",
         "url": "https://git.lix.systems/lix-project/nixos-module"
       },
@@ -913,11 +928,11 @@
     "mobile-nixos": {
       "flake": false,
       "locked": {
-        "lastModified": 1720660935,
+        "lastModified": 1721250279,
-        "narHash": "sha256-GnDGoVaObUjnYdCHUSIYVE1anMElis+Pq+RY30LFlIk=",
+        "narHash": "sha256-S47+MFnArDvR7OFCXU0BQoyLCBwSZws+t+bany7Ol6w=",
         "owner": "NixOS",
         "repo": "mobile-nixos",
-        "rev": "31704f8a55f5773c9b4e7adb7408a142d142e1f2",
+        "rev": "472073a51745cca03257cf625582252cdd04ec21",
         "type": "github"
       },
       "original": {
@@ -954,7 +969,10 @@
           "nix-on-droid",
           "nixpkgs"
         ],
-        "nmd": "nmd",
+        "nmd": [
+          "nix-on-droid",
+          "nmd"
+        ],
         "nmt": "nmt"
       },
       "locked": {
@@ -978,14 +996,14 @@
         "nixpkgs": "nixpkgs_8",
         "nixpkgs-docs": "nixpkgs-docs",
         "nixpkgs-for-bootstrap": "nixpkgs-for-bootstrap",
-        "nmd": "nmd_2"
+        "nmd": "nmd"
       },
       "locked": {
-        "lastModified": 1720612508,
+        "lastModified": 1720964831,
-        "narHash": "sha256-WbjV0gmnh6jG1B292K4KIJwtBacn2sTWhiw1ZMeti9s=",
+        "narHash": "sha256-UwVKfjrQ6FWTuqks6lF4+VlzPFDC/GR1Ti/iBKTEQco=",
         "owner": "nix-community",
         "repo": "nix-on-droid",
-        "rev": "8bcadcef69dcb5ca177bfb6ea3dc6b092cda2b06",
+        "rev": "c00333ee42aa2b4d4825e0388a1049fdeeded6c6",
         "type": "github"
       },
       "original": {
@@ -1001,11 +1019,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1720599442,
+        "lastModified": 1721550066,
-        "narHash": "sha256-jdm+sKVbBXoyrxcHbVaV0htlpq2iFR+eJw3Xe/DPcDo=",
+        "narHash": "sha256-wr6sSb+VpXy8HCvBqU6xvhpaARzWUbEK7uN5tLnqYDg=",
         "owner": "LnL7",
         "repo": "nix-darwin",
-        "rev": "cf297a8d248db6a455b60133f6c0029c04ebe50e",
+        "rev": "33bf7df5bbfcbbb49e6559b0c96c9e3b26d14e58",
         "type": "github"
       },
       "original": {
@@ -1045,11 +1063,11 @@
         "nixpkgs": "nixpkgs_10"
       },
       "locked": {
-        "lastModified": 1719387257,
+        "lastModified": 1721541664,
-        "narHash": "sha256-q5nj4TFggEHcyKuETmVEFeGztkAYXl3TDIOfd6swo4U=",
+        "narHash": "sha256-hk9g7kuGqDz8TYAbX9R6IvLUDnE5UpxwLR41MZ5uTDU=",
         "owner": "nix-community",
         "repo": "nixd",
-        "rev": "60a925008bc353136ba5babce437f42819c1645c",
+        "rev": "963dd36863e18f942e90c66b2c76e7c161b61ff9",
         "type": "github"
       },
       "original": {
@@ -1060,11 +1078,11 @@
     },
     "nixosHardware": {
       "locked": {
-        "lastModified": 1720515935,
+        "lastModified": 1721413321,
-        "narHash": "sha256-8b+fzR4W2hI5axwB+4nBwoA15awPKkck4ghhCt8v39M=",
+        "narHash": "sha256-0GdiQScDceUrVGbxYpV819LHesK3szHOhJ09e6sgES4=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "a111ce6b537df12a39874aa9672caa87f8677eda",
+        "rev": "ab165a8a6cd12781d76fe9cbccb9e975d0fb634f",
         "type": "github"
       },
       "original": {
@@ -1245,11 +1263,11 @@
     },
     "nixpkgsStable": {
       "locked": {
-        "lastModified": 1719957072,
+        "lastModified": 1720535198,
-        "narHash": "sha256-gvFhEf5nszouwLAkT9nWsDzocUTqLWHuL++dvNjMp9I=",
+        "narHash": "sha256-zwVvxrdIzralnSbcpghA92tWu2DV2lwv89xZc8MTrbg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7144d6241f02d171d25fba3edeaf15e0f2592105",
+        "rev": "205fd4226592cc83fd4c0885a3e4c9c400efabb5",
         "type": "github"
       },
       "original": {
@@ -1451,22 +1469,6 @@
       }
     },
     "nmd": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1666190571,
-        "narHash": "sha256-Z1hc7M9X6L+H83o9vOprijpzhTfOBjd0KmUTnpHAVjA=",
-        "owner": "rycee",
-        "repo": "nmd",
-        "rev": "b75d312b4f33bd3294cd8ae5c2ca8c6da2afc169",
-        "type": "gitlab"
-      },
-      "original": {
-        "owner": "rycee",
-        "repo": "nmd",
-        "type": "gitlab"
-      }
-    },
-    "nmd_2": {
       "inputs": {
         "nixpkgs": [
           "nix-on-droid",
@@ -1564,11 +1566,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1720524665,
+        "lastModified": 1721042469,
-        "narHash": "sha256-ni/87oHPZm6Gv0ECYxr1f6uxB0UKBWJ6HvS7lwLU6oY=",
+        "narHash": "sha256-6FPUl7HVtvRHCCBQne7Ylp4p+dpP3P/OYuzjztZ4s70=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "8d6a17d0cdf411c55f12602624df6368ad86fac1",
+        "rev": "f451c19376071a90d8c58ab1a953c6e9840527fd",
         "type": "github"
       },
       "original": {
@@ -1653,6 +1655,7 @@
         "hercules-ci-effects": "hercules-ci-effects_3",
         "homeManager": "homeManager",
         "homeManagerGitWorkspace": "homeManagerGitWorkspace",
+        "impermanence": "impermanence",
         "lix": "lix",
         "lix-module": "lix-module",
         "mobile-nixos": "mobile-nixos",
@@ -1820,11 +1823,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1720645794,
+        "lastModified": 1721458737,
-        "narHash": "sha256-vAeYp+WH7i/DlBM5xNt9QeWiOiqzzf5abO8DYGkbUxg=",
+        "narHash": "sha256-wNXLQ/ATs1S4Opg1PmuNoJ+Wamqj93rgZYV3Di7kxkg=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "750dfb555b5abdab4d3266b3f9a05dec6d205c04",
+        "rev": "888bfb10a9b091d9ed2f5f8064de8d488f7b7c97",
         "type": "github"
       },
       "original": {

flake.nix

@@ -68,6 +68,7 @@
       flake = false;
     };
     arion.url = "github:hercules-ci/arion";
+    impermanence.url = "github:nix-community/impermanence";
   };
 
   outputs = inputs @ {flakeParts, ...}:

hosts/default.nix

@@ -160,6 +160,7 @@
         extraModules = with inputs; [
           disko.nixosModules.disko
           arion.nixosModules.arion
+          impermanence.nixosModules.impermanence
           # lix-module.nixosModules.default
           # inputs.hercules-ci-agent.nixosModules.agent-service;
           # rock5b.nixosModules.default
@@ -173,8 +174,8 @@
           "home-planimetry".owner = "hass";
           "cloudflare-dyndns-api-token" = {};
           "restic-hetzner-password" = {};
-          "minio-credentials".owner = "minio";
+          # "minio-credentials".owner = "minio";
-          "aws-credentials".owner = "hercules-ci-agent";
+          # "aws-credentials".owner = "hercules-ci-agent";
           "hass-ssh-key".owner = "hass";
           # "matrix-registration-shared-secret".owner = "matrix-synapse";
           # "matrix-sliding-sync-secret".owner = "matrix-synapse";

hosts/picard/default.nix

@@ -32,7 +32,7 @@
       "restic"
       "binfmt"
       "greetd"
-      "syncthing"
+      # "syncthing"
       "hass-poweroff"
       "forgejo-runners"
       "teamviewer"

hosts/sisko/default.nix

@@ -13,7 +13,7 @@
       "wireguard-server"
       "mediatomb"
       "transmission"
-      "hercules-ci"
+      # "hercules-ci"
       "home-assistant"
       "adguard-home"
       "cloudflare-dyndns"
@@ -21,13 +21,13 @@
       "invidious"
       "searx"
       "rock5b-samba"
-      "paperless"
+      # "paperless"
-      "restic"
+      # "restic"
-      "syncthing"
+      # "syncthing"
-      "minio"
+      # "minio"
-      # "matrix"
+      # # "matrix"
       "forgejo"
-      # "jellyfin"
+      # # "jellyfin"
       # "immich"
     ]
     ++ [
@@ -62,8 +62,6 @@
 
   ccr.enable = true;
 
-  # services.rock5b-fan-control.enable = true;
-
   nixpkgs.hostPlatform = "aarch64-linux";
 
   swapDevices = [];
@@ -84,26 +82,35 @@
     "console=ttyS0,1500000"
   ];
 
-  # fileSystems."/mnt/film" = {
+  environment.persistence."/persist" = {
-  #   device = "//ccr.ydns.eu/film";
+    hideMounts = true;
-  #   fsType = "cifs";
+    directories = [
-  #   options = let
+      "/etc/NetworkManager/system-connections"
-  #     credentials = pkgs.writeText "credentials" ''
+      "/var/db/dhcpcd/"
-  #       username=guest
+      "/var/lib/NetworkManager/"
-  #       password=
+      "/var/lib/nixos"
-  #     '';
+      "/var/lib/systemd"
-  #   in ["credentials=${credentials},x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s"];
+      "/var/lib/systemd/coredump"
-  # };
+      "/var/log"
-  # fileSystems."/mnt/archivio" = {
+      "/var/lib/containers"
-  #   device = "//ccr.ydns.eu/archivio";
+      "/var/lib/postgresql"
-  #   fsType = "cifs";
+    ];
-  #   options = let
+    files = [
-  #     credentials = pkgs.writeText "credentials" ''
+      "/etc/machine-id"
-  #       username=guest
+      "/etc/ssh/ssh_host_ed25519_key"
-  #       password=
+      "/etc/ssh/ssh_host_ed25519_key.pub"
-  #     '';
+      "/etc/ssh/ssh_host_rsa_key"
-  #   in ["credentials=${credentials},x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s"];
+      "/etc/ssh/ssh_host_rsa_key.pub"
-  # };
+    ];
+  };
+
+  age.identityPaths = [
+    "/persist/etc/ssh/ssh_host_ed25519_key"
+    "/persist/etc/ssh/ssh_host_rsa_key"
+  ];
+
+  fileSystems."/persist".neededForBoot = true;
+  boot.tmp.cleanOnBoot = true;
 
   fileSystems."/mnt/hd" = {
     device = "/dev/disk/by-id/ata-WDC_WD10EADS-22M2B0_WD-WCAV52709550-part1";

hosts/sisko/disko.nix

@@ -7,6 +7,10 @@ let
   # old_hd = "/dev/disk/by-id/ata-WDC_WD5000AAKX-08U6AA0_WD-WCC2E5TR40FU";
 in {
   disko.devices = {
+    nodev."/" = {
+      fsType = "tmpfs";
+      mountOptions = ["size=1024M" "defaults" "mode=755"];
+    };
     disk = {
       ssd = {
         device = ssd;
@@ -17,20 +21,35 @@ in {
             ESP = {
               label = "ESP";
               type = "EF00";
-              size = "1G";
+              size = "1024M";
               content = {
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
               };
             };
-            root = {
+            nixroot = {
-              label = "root";
+              size = "100G";
-              size = "100%";
               content = {
                 type = "filesystem";
                 format = "ext4";
-                mountpoint = "/";
+                mountpoint = "/nix";
+              };
+            };
+            persist = {
+              size = "100G";
+              content = {
+                type = "filesystem";
+                format = "ext4";
+                mountpoint = "/persist";
+              };
+            };
+            tmp = {
+              end = "0";
+              content = {
+                type = "filesystem";
+                format = "ext4";
+                mountpoint = "/tmp";
               };
             };
           };

modules/forgejo/default.nix

@@ -29,15 +29,11 @@
         SHOW_FOOTER_VERSION = false;
       };
     };
-    mailerPasswordFile = config.age.secrets.autistici-password.path;
+    secrets.mailer.PASSWD = config.age.secrets.autistici-password.path;
     dump.enable = true;
   };
 
-  systemd.tmpfiles.rules = [
+  environment.persistence."/persist".directories = [
-    "d ${config.services.forgejo.stateDir} 770 forgejo forgejo"
-  ];
-
-  backup.paths = [
     config.services.forgejo.stateDir
   ];
 

modules/home-assistant/default.nix

@@ -210,8 +210,8 @@ in {
     };
   };
 
-  backup.paths = [
+  environment.persistence."/persist".directories = [
-    "/var/lib/hass"
+    config.services.home-assistant.configDir
   ];
 
   # virtualisation.oci-containers = {

modules/nginx-base/default.nix

@@ -16,4 +16,8 @@
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
   };
+
+  environment.persistence."/persist".directories = [
+    "/var/lib/acme"
+  ];
 }