Run alejandra

This commit is contained in:
ItsDrike 2024-07-27 01:07:07 +02:00
parent 286920def4
commit c00134da1c
Signed by: ItsDrike
GPG key ID: FA2745890B7048C0
152 changed files with 827 additions and 721 deletions

View file

@ -1,8 +1,11 @@
{ config, lib, ... }: let
{
config,
lib,
...
}: let
inherit (lib) mkIf concatStringsSep flatten mapAttrsToList;
cfg = config.myOptions.system.impermanence.autoWipeBtrfs;
in
{
in {
config = mkIf cfg.enable {
boot.initrd.systemd = {
enable = true; # This enables systemd support in stage 1 - required for below setup
@ -10,11 +13,11 @@ in
services.rollback = {
description = "Rollback BTRFS subvolumes to a pristine state";
enable = true;
wantedBy = [ "initrd.target" ];
wantedBy = ["initrd.target"];
# Make sure it's done after decryption (i.e. LUKS/TPM process)
after = [ "systemd-cryptsetup@cryptfs.service" ];
after = ["systemd-cryptsetup@cryptfs.service"];
# mount the root fs before clearing
before = [ "sysroot.mount" ];
before = ["sysroot.mount"];
unitConfig.DefaultDependencies = "no";
serviceConfig.Type = "oneshot";
script = let
@ -31,9 +34,10 @@ in
# Recreate each specified subvolume
${concatStringsSep "\n" (map (subvolume: ''
delete_subvolume_recursively "/mnt/${subvolume}"
btrfs subvolume create "/mnt/${subvolume}"
'') subvolumes)}
delete_subvolume_recursively "/mnt/${subvolume}"
btrfs subvolume create "/mnt/${subvolume}"
'')
subvolumes)}
# Cleanup: unmount the device
echo "Unmounting BTRFS root from ${devicePath}"
@ -62,9 +66,11 @@ in
btrfs subvolume delete "$1"
}
${concatStringsSep "\n" (mapAttrsToList (devicePath: deviceOpts:
wipeScript devicePath deviceOpts.subvolumes
) cfg.devices)}
${concatStringsSep "\n" (mapAttrsToList (
devicePath: deviceOpts:
wipeScript devicePath deviceOpts.subvolumes
)
cfg.devices)}
'';
};
};

View file

@ -1,5 +1,4 @@
{ inputs, ... }:
{
{inputs, ...}: {
imports = [
./root.nix
./autowipe.nix

View file

@ -1,10 +1,13 @@
{ config, lib, ... }: let
{
config,
lib,
...
}: let
inherit (lib) mkIf mkForce;
cfgSystem = config.myOptions.system;
cfg = config.myOptions.system.impermanence.root;
in
{
in {
config = mkIf cfg.enable {
users = {
# This option makes it that users are not mutable outside of our configuration.
@ -28,19 +31,23 @@ in
environment.persistence."${cfg.persistentMountPoint}/system" = {
hideMounts = true;
directories = [
"/etc/nixos" # NixOS configuration source
"/etc/NetworkManager/system-connections" # saved network connections
"/var/db/sudo" # keeps track of who got the sudo lecture already
# "/var/log" # I sometimes use a subvolume for this, added manually if not
"/var/lib/nixos"
"/var/lib/bluetooth"
"/var/lib/systemd/coredump" # captured coredumps
] ++ cfg.extraDirectories;
directories =
[
"/etc/nixos" # NixOS configuration source
"/etc/NetworkManager/system-connections" # saved network connections
"/var/db/sudo" # keeps track of who got the sudo lecture already
# "/var/log" # I sometimes use a subvolume for this, added manually if not
"/var/lib/nixos"
"/var/lib/bluetooth"
"/var/lib/systemd/coredump" # captured coredumps
]
++ cfg.extraDirectories;
files = [
"/etc/machine-id"
] ++ cfg.extraFiles;
files =
[
"/etc/machine-id"
]
++ cfg.extraFiles;
};
# For some reason, NetworkManager needs this instead of the impermanence mode