Merge branch 'tmp/caramel' into staging/20221003

flake.nix

@@ -52,13 +52,13 @@
 
       mkSystem =
         if !(self ? rev) then throw "Dirty git tree detected." else
-        nixpkgs: name: arch: enableGUI: nixpkgs.lib.nixosSystem {
+        nixpkgs: name: arch: enableGUI: extraModules: nixpkgs.lib.nixosSystem {
           system = arch;
           modules = [
             { nixpkgs.overlays = overlays; }
             agenix.nixosModules.age
             (./hosts + "/${name}")
-          ];
+          ] ++ extraModules;
           specialArgs = {
             inherit inputs enableGUI;
             modules = import ./modules { lib = nixpkgs.lib; };
@@ -66,10 +66,16 @@
         };
     in
     {
-      nixosConfigurations."blossom" = mkSystem nixpkgs "blossom" "x86_64-linux" true;
+      nixosConfigurations."blossom" = mkSystem nixpkgs "blossom" "x86_64-linux" true [];
 
-      nixosConfigurations."caramel" = mkSystem nixpkgs-porcupine "caramel" "aarch64-linux" false;
+      nixosConfigurations."caramel" = mkSystem nixpkgs-porcupine "caramel" "aarch64-linux" false [{
-      nixosConfigurations."sugarcane" = mkSystem nixpkgs-porcupine "sugarcane" "x86_64-linux" false;
+        nixpkgs.overlays = [
+          (self: super: {
+            makeModulesClosure = x: super.makeModulesClosure (x // { allowMissing = true; });
+          })
+        ];
+      }];
+      nixosConfigurations."sugarcane" = mkSystem nixpkgs-porcupine "sugarcane" "x86_64-linux" false [];
 
       packages."x86_64-linux" =
         let
@@ -92,18 +98,7 @@
         {
           inherit (pkgs) nixUnstable;
 
-          caramel-iso = nixos-generators.nixosGenerate {
+          caramel-img = self.nixosConfigurations."caramel".config.system.build.sdImage;
-            inherit pkgs;
-            format = "sd-aarch64";
-            modules = [
-              agenix.nixosModules.age
-              ./hosts/caramel
-            ];
-            specialArgs = {
-              inherit inputs;
-              modules = import ./modules { lib = nixpkgs-porcupine.lib; };
-            };
-          };
         };
 
       # TODO: currently broken

hosts/caramel/default.nix

@@ -1,4 +1,4 @@
-{ config, inputs, modules, overlays, pkgs, ... }: {
+{ config, inputs, modules, modulesPath, overlays, pkgs, ... }: {
   networking.hostName = "caramel";
   system.stateVersion = "21.11";
   time.timeZone = "Asia/Phnom_Penh";
@@ -12,6 +12,7 @@
   };
   imports =
     (with modules.system; [
+      "${builtins.toString modulesPath}/installer/sd-card/sd-image-aarch64.nix"
       inputs.home-manager-porcupine.nixosModule
 
       base
@@ -19,19 +20,23 @@
       input
       nix-porcupine
       security
+      transmission
       wireguard
 
       ./filesystem.nix
       ./kernel.nix
+      ./image.nix
       ./networking.nix
       ./packages.nix
 
       ../../users/hana
     ]) ++
     (with modules.services; [
-      nginx
+#       nginx
-      postgres
+#       postgres
-      synapse
+#       synapse
+      jellyfin
+      sonarr
       tmptsync
       unbound
       vaultwarden

hosts/caramel/filesystem.nix

@@ -1,4 +1,4 @@
-{ config, ... }:
+{ config, lib, ... }:
 let
   bind = src: {
     depends = [ "/persist" ];
@@ -9,16 +9,31 @@ let
   };
 in {
   fileSystems = {
-    "/" = {
+    "/" = lib.mkForce {
       device = "rootfs";
       fsType = "tmpfs";
-      options = [ "defaults" "size=2G" "mode=755" ];
+      options = [ "defaults" "size=1G" "mode=755" ];
     };
 
-    "/nix" = {
+    # "/nix" = {
+    #   device = "overlayfs";
+    #   fsType = "overlay";
+    #   options = [
+    #     "lowerdir=/mnt/image/nix"
+    #     "upperdir=/persist/nix-overlay"
+    #     "workdir=/persist/.overlaytmp"
+    #   ];
+    #   noCheck = true;
+    #   depends = [ "/mnt/image" "/persist" ];
+    # };
+
+    "/nix" = (bind "/mnt/image/nix") // { depends = [ "/mnt/image" ]; };
+
+    "/mnt/image" = {
       device = "/dev/disk/by-label/NIXOS_SD";
       fsType = "ext4";
       options = [ "defaults" "noatime" ];
+      neededForBoot = true;
     };
 
     "/persist" = {
@@ -28,9 +43,8 @@ in {
       neededForBoot = true;
     };
 
-    "/var/persist" = bind "/persist";
     "/var/lib/acme" = bind "/persist/acme";
     "/var/log/journal" = bind "/persist/journal";
-    "/boot" = (bind "/nix/persist/boot") // { depends = [ "/nix" ]; };
+    "/boot" = (bind "/mnt/image/boot") // { depends = [ "/mnt/image" ]; };
   };
 }

hosts/caramel/image.nix

@@ -0,0 +1,29 @@
+{ config, lib, pkgs, ... }: {
+  sdImage.expandOnBoot = false;
+  boot.postBootCommands = ''
+    # On the first boot do some maintenance tasks
+    if [ -f /mnt/image/nix-path-registration ]; then
+      set -euo pipefail
+      set -x
+      # Figure out device names for the boot device and root filesystem.
+      rootPart=$(${pkgs.util-linux}/bin/findmnt -n -o SOURCE /mnt/image)
+      bootDevice=$(lsblk -npo PKNAME $rootPart)
+      partNum=$(lsblk -npo MAJ:MIN $rootPart | ${pkgs.gawk}/bin/awk -F: '{print $2}')
+
+      # Resize the root partition and the filesystem to fit the disk
+      echo ",+," | sfdisk -N$partNum --no-reread $bootDevice
+      ${pkgs.parted}/bin/partprobe
+      ${pkgs.e2fsprogs}/bin/resize2fs $rootPart
+
+      # Register the contents of the initial Nix store
+      ${config.nix.package.out}/bin/nix-store --load-db < /mnt/image/nix-path-registration
+
+      # nixos-rebuild also requires a "system" profile and an /etc/NIXOS tag.
+      touch /etc/NIXOS
+      ${config.nix.package.out}/bin/nix-env -p /nix/var/nix/profiles/system --set /run/current-system
+
+      # Prevents this from running on later boots.
+      rm -f /mnt/image/nix-path-registration
+    fi
+  '';
+}

hosts/caramel/kernel.nix

@@ -1,11 +1,15 @@
-{ config, inputs, pkgs, ... }: {
+{ config, inputs, lib, pkgs, ... }: {
   imports = [
     inputs.nixos-hardware.nixosModules.raspberry-pi-4
   ];
   hardware.raspberry-pi."4".fkms-3d.enable = true;
 
-  boot.kernel.sysctl = {
+  boot = {
-    "kernel.core_pattern" = "|/bin/false";
+    initrd.kernelModules = [ "overlay" ];
-    "kernel.sysrq" = 1;
+    supportedFilesystems = lib.mkForce [ "btrfs" "vfat" ];
+    kernel.sysctl = {
+      "kernel.core_pattern" = "|/bin/false";
+      "kernel.sysrq" = 1;
+    };
   };
 }

hosts/sugarcane/filesystem.nix

@@ -22,7 +22,7 @@ in {
       neededForBoot = true;
     };
 
-    "/var/persist" = bind "/nix/persist";
+    "/persist" = bind "/nix/persist";
     "/var/log/journal" = bind "/nix/persist/journal";
     "/boot" = bind "/nix/persist/boot";
   };

modules/default.nix

@@ -15,8 +15,10 @@ let
   );
 in {
   services = mkAttrsFromPaths [
+    ./services/jellyfin.nix
     ./services/nginx.nix
     ./services/postgres.nix
+    ./services/sonarr.nix
     ./services/synapse.nix
     ./services/tmptsync.nix
     ./services/unbound.nix

modules/services/jellyfin.nix

@@ -0,0 +1,28 @@
+{ ... }:
+let
+  dir = "/persist/jellyfin";
+in
+{
+  fileSystems."/var/lib/jellyfin" = {
+    depends = [ "/persist" ];
+    device = dir;
+    fsType = "none";
+    options = [ "bind" ];
+  };
+  system.activationScripts."jellyfin-create-bind-mount" = {
+    deps = [ "users" "groups" ];
+    text = ''
+      mkdir -p ${dir}
+      chown jellyfin:jellyfin ${dir}
+      chmod 700 ${dir}
+    '';
+  };
+  systemd.tmpfiles.rules = [
+    "d /tmp/jelly-transcodes 700 jellyfin jellyfin"
+    "L+ /var/lib/jellyfin/transcodes - - - - /tmp/jelly-transcodes"
+  ];
+  services.jellyfin = {
+    enable = true;
+    openFirewall = true;
+  };
+}

modules/services/sonarr.nix

@@ -0,0 +1,11 @@
+{ ... }:
+let
+  dir = "/persist/sonarr";
+in
+{
+  services.sonarr = {
+    enable = true;
+    dataDir = dir;
+    openFirewall = true;
+  };
+}

modules/system/base.nix

@@ -1,10 +1,10 @@
 { config, enableGUI, inputs, modules, overlays, ... }: {
   environment.etc = {
-    "machine-id".source = "/var/persist/machine-id";
+    "machine-id".source = "/persist/machine-id";
-    "ssh/ssh_host_rsa_key".source = "/var/persist/ssh_host_rsa_key";
+    "ssh/ssh_host_rsa_key".source = "/persist/ssh_host_rsa_key";
-    "ssh/ssh_host_rsa_key.pub".source = "/var/persist/ssh_host_rsa_key.pub";
+    "ssh/ssh_host_rsa_key.pub".source = "/persist/ssh_host_rsa_key.pub";
-    "ssh/ssh_host_ed25519_key".source = "/var/persist/ssh_host_ed25519_key";
+    "ssh/ssh_host_ed25519_key".source = "/persist/ssh_host_ed25519_key";
-    "ssh/ssh_host_ed25519_key.pub".source = "/var/persist/ssh_host_ed25519_key.pub";
+    "ssh/ssh_host_ed25519_key.pub".source = "/persist/ssh_host_ed25519_key.pub";
   };
   environment.pathsToLink = [ "/share/zsh" ];
 

modules/system/security.nix

@@ -15,12 +15,12 @@
     hostKeys = [
       {
         bits = 4096;
-        path = "/var/persist/ssh_host_rsa_key";
+        path = "/persist/ssh_host_rsa_key";
         rounds = 100;
         type = "rsa";
       }
       {
-        path = "/var/persist/ssh_host_ed25519_key";
+        path = "/persist/ssh_host_ed25519_key";
         rounds = 100;
         type = "ed25519";
       }

modules/system/transmission.nix

@@ -12,6 +12,8 @@
       alt-speed-time-enabled = true;
       alt-speed-time-end = 1380;
       alt-speed-up = 256;
+      download-dir = "/persist/transmission/Downloads";
+      incomplete-dir = "/persist/transmission/.incomplete";
       ratio-limit-enabled = true;
       rpc-bind-address = "0.0.0.0";
       rpc-enabled = true;

res/authorized_keys

@@ -0,0 +1,2 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPru5eTBvHJ4ZmrrzPRHCGM09wQP/ZHSaKYalDuBVO15 rin@blossom
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ5l9t8dc6mPsKKYqZlPKvhOdyqz+DS5UOcvHuh3uVGt @strawberry

users/hana/default.nix

@@ -24,8 +24,8 @@
     ];
 
     programs.git.signing.signByDefault = lib.mkForce false;
-    programs.zsh.history.path = lib.mkForce "/nix/persist/hana/zsh_history";
+    programs.zsh.history.path = lib.mkForce "/persist/hana/zsh_history";
 
-    home.file.".ssh/authorized_keys".source = config.lib.file.mkOutOfStoreSymlink "/nix/persist/hana/authorized_keys";
+    home.file.".ssh/authorized_keys".source = ../../res/authorized_keys;
   };
 }