Reorganize imports

Signed-off-by: Nikolaos Karaolidis <nick@karaolidis.com>

hosts/common/configs/system/impermanence/default.nix

@@ -0,0 +1,45 @@
+{ config, pkgs, ... }:
+{
+  imports = [ ./options.nix ];
+
+  boot.initrd.systemd = {
+    enable = true;
+
+    initrdBin = with pkgs; [
+      coreutils
+      util-linux
+      findutils
+      btrfs-progs
+    ];
+
+    services.impermanence = {
+      description = "Rollback BTRFS subvolumes to a pristine state";
+      wantedBy = [ "initrd.target" ];
+      before = [ "sysroot.mount" ];
+      after = [ "cryptsetup.target" ];
+      unitConfig.DefaultDependencies = false;
+      serviceConfig.Type = "oneshot";
+      environment.DEVICE = config.environment.impermanence.device;
+      script = builtins.readFile ./scripts/wipe.sh;
+    };
+  };
+
+  # uuidgen -r | tr -d -
+  # https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/administration/systemd-state.section.md
+  # https://github.com/NixOS/nixpkgs/pull/286140/files
+  # https://git.eisfunke.com/config/nixos/-/blob/e65e1dc21d06d07b454005762b177ef151f8bfb6/nixos/machine-id.nix
+  sops.secrets."machineId".mode = "0444";
+
+  environment = {
+    etc."machine-id".source = pkgs.runCommandLocal "machine-id-link" { } ''
+      ln -s ${config.sops.secrets."machineId".path} $out
+    '';
+
+    persistence."/persist" = {
+      "/etc/nixos" = { };
+      "/var/lib/nixos" = { };
+      "/var/lib/systemd" = { };
+      "/var/log" = { };
+    };
+  };
+}

hosts/common/configs/system/impermanence/options.nix

@@ -0,0 +1,258 @@
+{
+  config,
+  lib,
+  utils,
+  ...
+}:
+let
+  cfg = config.environment.persistence;
+
+  # ["/home/user/" "/.screenrc"] -> ["home" "user" ".screenrc"]
+  splitPath =
+    paths:
+    (builtins.filter (s: builtins.typeOf s == "string" && s != "") (
+      builtins.concatMap (builtins.split "/") paths
+    ));
+
+  # ["/home/user/" "/.screenrc"] -> "/home/user/.screenrc"
+  mergePaths =
+    paths:
+    let
+      prefix = lib.strings.optionalString (lib.strings.hasPrefix "/" (builtins.head paths)) "/";
+      path = lib.strings.concatStringsSep "/" (splitPath paths);
+    in
+    prefix + path;
+
+  # "/home/user/.screenrc" -> ["/home", "/home/user"]
+  parentsOf =
+    path:
+    let
+      prefix = lib.strings.optionalString (lib.strings.hasPrefix "/" path) "/";
+      split = splitPath [ path ];
+      parents = lib.lists.take ((lib.lists.length split) - 1) split;
+    in
+    lib.lists.foldl' (
+      state: item:
+      state
+      ++ [
+        (mergePaths [
+          (if state != [ ] then lib.lists.last state else prefix)
+          item
+        ])
+      ]
+    ) [ ] parents;
+in
+{
+  options.environment =
+    with lib;
+    with types;
+    {
+      impermanence.device = mkOption {
+        type = str;
+        default = config.disko.devices.disk.main.content.partitions.root.content.name;
+        description = ''
+          LUKS BTRFS partition to wipe on boot.
+        '';
+      };
+
+      persistence =
+        let
+          isPathLike = strings.hasPrefix "/";
+        in
+        mkOption {
+          type = (
+            addCheck (attrsOf (
+              attrsOf (
+                submodule (
+                  { name, config, ... }:
+                  {
+                    options = {
+                      enable = mkOption {
+                        type = bool;
+                        default = true;
+                        description = "Whether to enable the item.";
+                      };
+
+                      service = mkOption {
+                        type = str;
+                        readOnly = true;
+                        description = ''
+                          Systemd service that prepares and syncs the item.
+                          Can be used as a dependency in other units.
+                        '';
+                      };
+
+                      mount = mkOption {
+                        type = str;
+                        readOnly = true;
+                        description = ''
+                          Systemd mount that binds the item.
+                          Can be used as a dependency in other units.
+                        '';
+                      };
+
+                      _path = mkOption {
+                        type = str;
+                        internal = true;
+                        default = name;
+                      };
+
+                      _sourceRoot = mkOption {
+                        type = str;
+                        internal = true;
+                      };
+
+                      _source = mkOption {
+                        type = str;
+                        internal = true;
+                      };
+
+                      _targetRoot = mkOption {
+                        type = str;
+                        internal = true;
+                      };
+
+                      _target = mkOption {
+                        type = str;
+                        internal = true;
+                      };
+                    };
+                  }
+                )
+              )
+            )) (attrs: lists.all isPathLike (builtins.attrNames attrs))
+          );
+          apply =
+            ps:
+            builtins.mapAttrs (
+              persistence: items:
+              builtins.mapAttrs (
+                _: config:
+                let
+                  _path = config._path;
+
+                  _sourceRoot = persistence;
+
+                  _source = mergePaths [
+                    _sourceRoot
+                    _path
+                  ];
+
+                  _targetRoot =
+                    let
+                      parents = lists.reverseList (parentsOf _path);
+                    in
+                    lists.foldl' (
+                      acc: parent:
+                      if acc == "/" then
+                        lists.findFirst (
+                          otherPersistence: lists.any (other: parent == other) (builtins.attrNames ps.${otherPersistence})
+                        ) "/" (builtins.attrNames ps)
+                      else
+                        acc
+                    ) "/" parents;
+
+                  _target = mergePaths [
+                    _targetRoot
+                    _path
+                  ];
+                in
+                config
+                // {
+                  inherit
+                    _sourceRoot
+                    _source
+                    _targetRoot
+                    _target
+                    ;
+                  service = "${utils.escapeSystemdPath _target}.service";
+                  mount = "${utils.escapeSystemdPath _target}.mount";
+                }
+              ) items
+            ) ps;
+          default = { };
+          description = "Persistence config.";
+        };
+    };
+
+  config =
+    let
+      all = lib.lists.flatten (builtins.concatMap builtins.attrValues (builtins.attrValues cfg));
+    in
+    {
+      fileSystems = builtins.mapAttrs (_: _: { neededForBoot = true; }) cfg;
+
+      systemd = {
+        mounts = builtins.map (c: {
+          description = c._path;
+          requiredBy = [ "local-fs.target" ];
+          requires = [ c.service ];
+          bindsTo = [ c.service ];
+          after = [ c.service ];
+          unitConfig.ConditionPathExists = [ (lib.strings.escape [ " " ] c._source) ];
+          what = c._source;
+          where = c._target;
+          options = lib.strings.concatStringsSep "," ([
+            "bind"
+            "X-fstrim.notrim"
+            "x-gvfs-hide"
+          ]);
+        }) all;
+
+        services = builtins.listToAttrs (
+          builtins.map (c: {
+            name = utils.escapeSystemdPath c._target;
+            value = {
+              description = c._path;
+              after = [ "local-fs-pre.target" ];
+              requiredBy = [
+                "local-fs.target"
+                c.mount
+              ];
+              before = [
+                "local-fs.target"
+                c.mount
+                "umount.target"
+              ];
+              conflicts = [ "umount.target" ];
+              unitConfig = {
+                DefaultDependencies = false;
+                RefuseManualStart = true;
+                RefuseManualStop = true;
+              };
+              serviceConfig = {
+                Type = "oneshot";
+                RemainAfterExit = true;
+              };
+              script = ''
+                source=${lib.strings.escapeShellArg c._sourceRoot}
+                target=${lib.strings.escapeShellArg c._targetRoot}
+                path=${lib.strings.escapeShellArg c._path}
+
+                ${builtins.readFile ./scripts/start.sh}
+              '';
+              preStop = ''
+                source=${lib.strings.escapeShellArg c._sourceRoot}
+                target=${lib.strings.escapeShellArg c._targetRoot}
+                path=${lib.strings.escapeShellArg c._path}
+
+                ${builtins.readFile ./scripts/stop.sh}
+              '';
+            };
+          }) all
+        );
+      };
+
+      assertions =
+        let
+          paths = builtins.map (c: c._path) all;
+          duplicates = lib.lists.filter (t: lib.lists.count (o: o == t) paths > 1) (lib.lists.unique paths);
+        in
+        [
+          {
+            assertion = lib.lists.length duplicates == 0;
+            message = "Each target must be defined under a single persistence. Duplicate targets found: ${lib.concatStringsSep ", " duplicates}";
+          }
+        ];
+    };
+}

hosts/common/configs/system/impermanence/scripts/start.sh

@@ -0,0 +1,19 @@
+echo "Starting impermanence mount with source: ${source}, target: ${target}, path: ${path}."
+
+source_current="${source}"
+target_current="${target}"
+
+IFS='/' read -ra path_parts <<< "${path}"
+unset "path_parts[-1]"
+
+for part in "${path_parts[@]}"; do
+  source_current="${source_current}/${part}"
+  target_current="${target_current}/${part}"
+
+  if [[ ! -d "${source_current}" ]]; then
+    break
+  fi
+
+  read -r mode owner group <<< "$(stat -c '%a %u %g' "${source_current}")"
+  install -d -m "${mode}" -o "${owner}" -g "${group}" "${target_current}"
+done

hosts/common/configs/system/impermanence/scripts/stop.sh

@@ -0,0 +1,38 @@
+echo "Stopping impermanence mount with source: ${source}, target: ${target}, path: ${path}."
+
+source_current="${source}"
+target_current="${target}"
+
+IFS='/' read -ra path_parts <<< "${path}"
+unset "path_parts[-1]"
+
+for part in "${path_parts[@]}"; do
+  source_current="${source_current}/${part}"
+  target_current="${target_current}/${part}"
+
+  if [[ ! -d "${target_current}" ]]; then
+    break
+  fi
+
+  if [[ -d "${source_current}" ]]; then
+    continue
+  fi
+
+  read -r mode owner group <<< "$(stat -c '%a %u %g' "${target_current}")"
+  install -d -m "${mode}" -o "${owner}" -g "${group}" "${source_current}"
+done
+
+source=$(realpath -m "${source}/${path}")
+target=$(realpath -m "${target}/${path}")
+
+if [[ ! -e "${target}" ]] || { [[ -d "${target}" ]] && [[ -z "$(ls -A "${target}")" ]]; } || { [[ -f "${target}" ]] && [[ ! -s "${target}" ]]; }; then
+  exit 0
+fi
+
+if [[ -e "${source}" ]]; then
+  >&2 echo "Error: Source ${source} already exists. Cannot move ${target} to ${source}."
+  exit 1
+fi
+
+echo "Moving target ${target} to source ${source}."
+mv "${target}" "${source}"

hosts/common/configs/system/impermanence/scripts/wipe.sh

@@ -0,0 +1,30 @@
+delete_subvolume_recursively() {
+  IFS=$'\n'
+  for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
+    delete_subvolume_recursively "/mnt/btrfs/${i}"
+  done
+  btrfs subvolume delete "$1"
+}
+
+if [[ -z "$DEVICE" ]]; then
+  echo "Error: DEVICE variable is not set."
+  exit 1
+fi
+
+mkdir -p /mnt/btrfs
+mount "/dev/mapper/$DEVICE" /mnt/btrfs
+
+if [[ -e /mnt/btrfs/@ ]]; then
+  mkdir -p /mnt/btrfs/@.bak
+  timestamp=$(date --date="@$(stat -c %Y /mnt/btrfs/@)" "+%Y-%m-%d_%H:%M:%S")
+  mv /mnt/btrfs/@ "/mnt/btrfs/@.bak/${timestamp}"
+fi
+
+find /mnt/btrfs/@.bak/ -maxdepth 1 -mtime +14 | while IFS= read -r i; do
+  delete_subvolume_recursively "${i}"
+done
+
+btrfs subvolume create /mnt/btrfs/@
+
+umount /mnt/btrfs
+rmdir /mnt/btrfs