Merge remote-tracking branch 'origin/nixos' into nixos-work

hosts/nixos-desktop/default.nix

@@ -9,6 +9,7 @@
   imports = [
     # Include the results of the hardware scan.
     ./hardware-configuration.nix
+    ./disko.nix
   ];
 
   my = {
@@ -16,6 +17,7 @@
       desktop.enable = true;
       gaming.enable = true;
       personal.enable = true;
+      impermanence.enable = true;
     };
     programs.hyprland = {
       nvidiaSupport = true;
@@ -24,6 +26,7 @@
       keyboardLayouts = [ "us" "de" ];
     };
     services.wallpaper.enable = true;
+    services.ollama.enable = true;
     programs.ledger.enable = true;
   };
 
@@ -51,18 +54,11 @@
     kernelPackages = pkgs.linuxPackages_latest;
 
     # BOOT
-
-    supportedFilesystems = [ "btrfs" "ntfs" ];
+    supportedFilesystems = [ "zfs" "btrfs" "ntfs" ];
     loader = {
-      grub = {
-        enable = true;
-        device = "nodev";
-        efiSupport = true;
-        useOSProber = true;
-      };
+      systemd-boot.enable = true;
       efi.canTouchEfiVariables = true;
     };
-
     kernelModules = [ "lm92" "drivetemp" ];
   };
 

hosts/nixos-desktop/disko.nix

@@ -0,0 +1,102 @@
+{ lib, ... }:
+
+{
+  # needed for zfs pool
+  networking.hostId = "1f8b8073";
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/disk/by-id/ata-Samsung_SSD_850_EVO_500GB_S2RBNX0J351943M";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            };
+            encryptedSwap = {
+              size = "8G";
+              content = {
+                type = "swap";
+                randomEncryption = true;
+              };
+            };
+            zfs = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          compression = "zstd";
+          "com.sun:auto-snapshot" = "false";
+          "acltype" = "posixacl"; # NOTE: needed for systemd https://github.com/NixOS/nixpkgs/issues/16954
+        };
+        mountpoint = null;
+
+        datasets = {
+          encrypted = {
+            type = "zfs_fs";
+            options = {
+              mountpoint = "none";
+              encryption = "aes-256-gcm";
+              keyformat = "passphrase";
+            };
+            # use this to read the key during boot
+            postCreateHook = ''
+              zfs set keylocation="prompt" "zroot/$name";
+            '';
+          };
+          "encrypted/root" = {
+            type = "zfs_fs";
+            options.mountpoint = "legacy";
+            mountpoint = "/";
+            postCreateHook = "zfs snapshot zroot/encrypted/root@blank";
+          };
+          "encrypted/nix" = {
+            type = "zfs_fs";
+            options.mountpoint = "legacy";
+            mountpoint = "/nix";
+          };
+          "encrypted/persist" = {
+            type = "zfs_fs";
+            options.mountpoint = "legacy";
+            mountpoint = "/persist";
+            options."com.sun:auto-snapshot" = "true";
+          };
+        };
+      };
+    };
+  };
+  # rollback to blank
+  boot.initrd.postDeviceCommands = lib.mkAfter ''
+    zfs rollback -r zroot/encrypted/root@blank && echo "rollback complete"
+  '';
+  fileSystems."/persist".neededForBoot = true;
+  # HACK: to fix issue of agenix running before impermanence
+  age.identityPaths = [
+    "/etc/ssh/ssh_host_ed25519_key"
+    "/etc/ssh/ssh_host_rsa_key"
+    "/persist/etc/ssh/ssh_host_ed25519_key"
+    "/persist/etc/ssh/ssh_host_rsa_key"
+  ];
+  services.zfs = {
+    autoScrub.enable = true;
+    trim.enable = true;
+    autoSnapshot.enable = true;
+  };
+}

hosts/nixos-desktop/hardware-configuration.nix

@@ -11,49 +11,10 @@
     initrd = {
       availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
       kernelModules = [ ];
-      luks.devices."enc".device = "/dev/disk/by-uuid/30025a9f-44cf-4074-8ae2-d4925efd67dd";
     };
     kernelModules = [ "kvm-amd" ];
     extraModulePackages = [ ];
   };
-  fileSystems = {
-    "/" = {
-      device = "/dev/disk/by-uuid/668a49b3-d169-461f-861d-0c3e6a1642d1";
-      fsType = "btrfs";
-      options = [ "subvol=root" "compress=zstd" ];
-    };
-
-    "/home" = {
-      device = "/dev/disk/by-uuid/668a49b3-d169-461f-861d-0c3e6a1642d1";
-      fsType = "btrfs";
-      options = [ "subvol=home" "compress=zstd" ];
-    };
-
-    "/nix" = {
-      device = "/dev/disk/by-uuid/668a49b3-d169-461f-861d-0c3e6a1642d1";
-      fsType = "btrfs";
-      options = [ "subvol=nix" "compress=zstd" ];
-    };
-
-    "/var/log" = {
-      device = "/dev/disk/by-uuid/668a49b3-d169-461f-861d-0c3e6a1642d1";
-      fsType = "btrfs";
-      options = [ "subvol=log" "compress=zstd" ];
-      neededForBoot = true;
-    };
-
-    "/boot" = {
-      device = "/dev/disk/by-uuid/297B-C04C";
-      fsType = "vfat";
-    };
-
-    "/media/games" = {
-      device = "/dev/disk/by-uuid/8f92ff36-a685-4a67-a3d4-55136dc5f286";
-      fsType = "ext4";
-    };
-  };
-
-  swapDevices = [{ device = "/dev/disk/by-uuid/00ad6f74-f23e-4ac0-abfb-89bdfe5ab8ae"; }];
 
   hardware.cpu.amd.updateMicrocode =
     lib.mkDefault config.hardware.enableRedistributableFirmware;

hosts/nixos-laptop/default.nix

@@ -3,14 +3,12 @@
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 { pkgs
 , inputs
-, lib
 , ...
 }: {
   imports = [
     # Include the results of the hardware scan.
     ./hardware-configuration.nix
     ./disko.nix
-    ./impermanence.nix
   ];
 
   my = {
@@ -20,25 +18,10 @@
       desktop.enable = true;
       personal.enable = true;
       webis.enable = true;
+      impermanence.enable = true;
     };
   };
 
-  environment.systemPackages = [
-    (
-      pkgs.writeShellApplication {
-        name = "zfs-diff";
-        runtimeInputs = with pkgs; [ zfs coreutils parallel tree ];
-        text = ''
-          zfs diff -F zroot/encrypted/root@blank | awk '$2 == "F" && system("test -e /persist/"$3) != 0 { print $3 }' 2>/dev/null | tree --fromfile . "$@"
-        '';
-      }
-    )
-  ];
-
-  home-manager.users.moritz.home.packages = with pkgs; [
-    # jetbrains.idea-ultimate
-  ];
-
   # BOOT
   boot = {
     supportedFilesystems = [ "zfs" ];

hosts/nixos-laptop/disko.nix

@@ -12,7 +12,7 @@
           type = "gpt";
           partitions = {
             ESP = {
-              size = "64M";
+              size = "512M";
               type = "EF00";
               content = {
                 type = "filesystem";