refactor(nix): overhaul nixos configurations

flake.nix

@@ -188,25 +188,7 @@
       });
       nixosConfigurations =
         let
-          lib = (import ./lib { lib = nixpkgs.lib; }) // nixpkgs.lib;
-          persist-dir = "/persist";
-          defaults = {
-            config = {
-              environment.etc.machine-id.source = "${persist-dir}/ephemeral/etc/machine-id";
-              environment.persistence.save = {
-                hideMounts = true;
-                persistentStoragePath = "${persist-dir}/save";
-              };
-              environment.persistence.ephemeral = {
-                persistentStoragePath = "${persist-dir}/ephemeral";
-                hideMounts = true;
-                directories = [
-                  "/var/lib"
-                  "/etc/nixos"
-                ];
-              };
-            };
-          };
+          clib = (import ./lib { lib = nixpkgs.lib; });
         in
         {
           orion =
@@ -220,12 +202,9 @@
                 inherit inputs;
                 inherit outputs;
                 inherit hostname;
-                inherit lib;
-                inherit persist-dir;
-                root-disk = "/dev/nvme0n1";
+                inherit clib;
               };
               modules = [
-                defaults
                 ./modules/btrfs-rollback.nix
                 inputs.impermanence.nixosModules.impermanence
                 inputs.agenix.nixosModules.default
@@ -234,7 +213,7 @@
                   config =
                     (import "${self}/secrets" {
                       agenix = false;
-                      inherit lib;
+                      inherit clib;
                     }).${hostname};
                 }
                 ./hosts/${hostname}
@@ -251,13 +230,10 @@
                 inherit inputs;
                 inherit hostname;
                 inherit nixpkgs;
-                inherit lib;
-                inherit persist-dir;
-                root-disk = "/dev/nvme0n1";
-                fqdn = "orion-technologies.io";
+                inherit clib;
               };
               modules = [
-                defaults
+                ./modules/btrfs-rollback.nix
                 inputs.impermanence.nixosModules.impermanence
                 inputs.agenix.nixosModules.default
                 inputs.disko.nixosModules.disko
@@ -267,7 +243,7 @@
                   config =
                     (import "${self}/secrets" {
                       agenix = false;
-                      inherit lib;
+                      inherit clib;
                     }).${hostname};
                 }
                 ./hosts/${hostname}

hosts/luna/default.nix

@@ -1,7 +1,7 @@
-{ lib, ... }:
+{ clib, ... }:
 {
   imports = (
-    lib.recurseFilesInDirs [
+    clib.recurseFilesInDirs [
       ./os
       ./modules
     ] ".nix"

hosts/luna/modules/monitoring/auditd.nix

@@ -1,9 +1,4 @@
-{
-  persist-dir,
-  pkgs,
-  config,
-  ...
-}:
+{ pkgs, config, ... }:
 let
   laurel-user = "_laurel";
 in
@@ -145,7 +140,7 @@ in
     "-a always,exit -F arch=b64 -S open -F dir=/opt -F success=0 -F key=unauthedfileaccess"
     "-a always,exit -F arch=b64 -S open -F dir=/boot -F success=0 -F key=unauthedfileaccess"
     "-a always,exit -F arch=b64 -S open -F dir=/nix -F success=0 -F key=unauthedfileaccess"
-    "-a always,exit -F arch=b64 -S open -F dir=${persist-dir} -F success=0 -F key=unauthedfileaccess"
+    "-a always,exit -F arch=b64 -S open -F dir=/persist -F success=0 -F key=unauthedfileaccess"
 
     # File deletion events by users
     "-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -F key=delete"

hosts/luna/modules/monitoring/grafana.nix

@@ -1,11 +1,6 @@
-{
-  config,
-  pkgs,
-  fqdn,
-  ...
-}:
+{ config, ... }:
 let
-  grafana_host = "grafana.${fqdn}";
+  grafana_host = "grafana.orion-technologies.io";
 in
 {
   services = {

hosts/luna/modules/monitoring/prometheus.nix

@@ -1,11 +1,6 @@
-{
-  config,
-  fqdn,
-  pkgs,
-  ...
-}:
+{ config, pkgs, ... }:
 let
-  prometheus_host = "prometheus.${fqdn}";
+  prometheus_host = "prometheus.orion-technologies.io";
 in
 {
   services = {

hosts/luna/modules/services/gitea.nix

@@ -1,13 +1,12 @@
 {
   config,
-  fqdn,
   inputs,
   pkgs,
   lib,
   ...
 }:
 let
-  gitea_host = "git.${fqdn}";
+  gitea_host = "git.orion-technologies.io";
   # TODO: Move this docker image out to a separate package and NixOS Module
   # Huge thank you to https://icewind.nl/entry/gitea-actions-nix/ -- wouldn't have figured this out
   # without that post 🙂

hosts/luna/modules/services/lakewatch.nix

@@ -1,4 +1,4 @@
-{ config, fqdn, ... }:
+{ config, ... }:
 {
   services.lakewatch-api = {
     enable = true;
@@ -14,7 +14,7 @@
       passwordFile = config.age.secrets.lakewatch-db-pass.path;
     };
   };
-  services.nginx.virtualHosts."lakewatch.${fqdn}" = {
+  services.nginx.virtualHosts."lakewatch.orion-technologies.io" = {
     forceSSL = true;
     enableACME = true;
     locations."/".proxyPass = "http://${config.services.lakewatch-api.host}:${builtins.toString config.services.lakewatch-api.port}";

hosts/luna/modules/services/nginx.nix

@@ -1,9 +1,4 @@
-{
-  inputs,
-  pkgs,
-  fqdn,
-  ...
-}:
+{ inputs, pkgs, ... }:
 {
   services.nginx = {
     enable = true;
@@ -19,7 +14,7 @@
   };
 
   services.nginx.virtualHosts = {
-    "blog.${fqdn}" = {
+    "blog.orion-technologies.io" = {
       forceSSL = true;
       enableACME = true;
       globalRedirect = "price-hiller.com";

hosts/luna/os/boot.nix

@@ -1,8 +1,15 @@
-{ modulesPath, pkgs, ... }:
+{ modulesPath, ... }:
 {
 
   imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
 
+  services.btrfs-rollback = {
+    enable = true;
+    diskLabel = "NixOS-Primary";
+    subvolume = "root";
+    snapshot = "root-base";
+  };
+
   boot = {
     tmp = {
       useTmpfs = true;
@@ -24,58 +31,7 @@
         "sd_mod"
       ];
       kernelModules = [ ];
-      systemd = {
-        enable = true;
-        initrdBin = [
-          pkgs.libuuid
-          pkgs.gawk
-        ];
-        services.rollback = {
-          description = "Rollback btrfs root subvolume";
-          wantedBy = [ "initrd.target" ];
-          before = [ "sysroot.mount" ];
-          after = [ "initrd-root-device.target" ];
-          unitConfig.DefaultDependencies = "no";
-          serviceConfig.Type = "oneshot";
-          script = ''
-            mkdir -p /mnt
-            DISK_LABEL="NixOS-Primary"
-            FOUND_DISK=0
-            ATTEMPTS=50
-            printf "Attempting to find disk with label '%s'\n" "$DISK_LABEL"
-            while ((ATTEMPTS > 0)); do
-              if findfs LABEL="$DISK_LABEL"; then
-                FOUND_DISK=1
-                printf "Found disk!\n"
-                break;
-              fi
-              ((ATTEMPTS--))
-              sleep .1
-              printf "Remaining disk discovery attempts: %s\n" "$ATTEMPTS"
-            done
-            if (( FOUND_DISK == 0 )); then
-              printf "Discovery of disk with label '%s' failed! Cannot rollback!\n" "$DISK_LABEL"
-              exit 1
-            fi
-
-            mount -t btrfs -o subvol=/ $(findfs LABEL="$DISK_LABEL") /mnt
-            btrfs subvolume list -to /mnt/root \
-              | awk 'NR>2 { printf $4"\n" }' \
-              | while read subvol; do
-              printf "Removing Subvolume: %s\n" "$subvol";
-              btrfs subvolume delete "/mnt/$subvol"
-            done
-
-            printf "Removing /root subvolume\n"
-            btrfs subvolume delete /mnt/root
-
-            printf "Restoring base /root subvolume\n"
-            btrfs subvolume snapshot /mnt/root-base /mnt/root
-
-            umount /mnt
-          '';
-        };
-      };
+      systemd.enable = true;
     };
   };
 }

hosts/luna/os/fs.nix

@@ -1,10 +1,22 @@
+{ lib, ... }:
+let
+  root-disk = "/dev/nvme0n1";
+  persist-dir = "/persist";
+in
 {
-  lib,
-  root-disk,
-  persist-dir,
-  ...
-}:
-{
+  environment.etc.machine-id.source = "${persist-dir}/ephemeral/etc/machine-id";
+  environment.persistence.save = {
+    hideMounts = true;
+    persistentStoragePath = "${persist-dir}/save";
+  };
+  environment.persistence.ephemeral = {
+    persistentStoragePath = "${persist-dir}/ephemeral";
+    hideMounts = true;
+    directories = [
+      "/var/lib"
+      "/etc/nixos"
+    ];
+  };
   services = {
     fstrim.enable = true;
     btrfs.autoScrub = {
@@ -12,7 +24,7 @@
       fileSystems = [
         "/"
         "/nix"
-        "/persist"
+        "${persist-dir}"
       ];
     };
     snapper = {

hosts/orion/default.nix

@@ -1,7 +1,7 @@
-{ pkgs, lib, ... }:
+{ pkgs, clib, ... }:
 {
   imports = (
-    lib.recurseFilesInDirs [
+    clib.recurseFilesInDirs [
       ./os
       ./modules
     ] ".nix"

hosts/orion/os/fs.nix

@@ -1,9 +1,8 @@
-{
-  lib,
-  root-disk,
-  persist-dir,
-  ...
-}:
+{ lib, ... }:
+let
+  root-disk = "/dev/nvme0n1";
+  persist-dir = "/persist";
+in
 {
   services = {
     fstrim.enable = true;
@@ -17,6 +16,20 @@
     };
   };
 
+  environment.etc.machine-id.source = "${persist-dir}/ephemeral/etc/machine-id";
+  environment.persistence.save = {
+    hideMounts = true;
+    persistentStoragePath = "${persist-dir}/save";
+  };
+  environment.persistence.ephemeral = {
+    persistentStoragePath = "${persist-dir}/ephemeral";
+    hideMounts = true;
+    directories = [
+      "/var/lib"
+      "/etc/nixos"
+    ];
+  };
+
   fileSystems."${persist-dir}".neededForBoot = true;
 
   disko.devices = {

secrets/default.nix

@@ -1,6 +1,6 @@
 {
   agenix ? false,
-  lib ? import ../lib { },
+  clib ? import ../clib { },
 }:
 let
   masterKeys = [
@@ -54,7 +54,7 @@ if agenix then
 else
   (builtins.mapAttrs (
     host: secrets:
-    (lib.recursiveMerge (
+    (clib.recursiveMerge (
       builtins.map (secretName: { age.secrets.${secretName}.file = ./${secrets.${secretName}}; }) (
         builtins.attrNames hosts.${host}
       )

secrets/hosts/luna/users-price-pw.age

@@ -1,15 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFdvUU04QSBBMUpT
-dHNFbGpKM1NiczNqK0cvZlVsSVZkelhYSFN6VEV4b3FHNU0zUGxVCllhQmlWenZw
-aFJOUlhlZGhhc0dFd0Q4Y29JSldEV3pva1RoRW1LYUQwU1UKLT4gWDI1NTE5IHI4
-M2pYbTFQSnpJdUdGWjZmbmZGM3VRL2YwWkM1clh5d0NRY3Y5Qm8yVmsKYU1QV0Ey
-YU14ZlhpQmNGOEZOazVIaDdsRTQ5QmRBdEI4bHp5RGdmdC8yWQotPiBwaXYtcDI1
-NiBySnMxSEEgQThoMTJnQkRBQWRtZVBqT3pqODdzMkxjUkh2NWFxZnQ4OE9ZdzZi
-VjB0OEIKRUdRdUt0Q0lUYjl6WE1IZGt1MlA1bFlHcTgxNzZzeWxlRXdPeGxPanNG
-ZwotPiBaOChOO3lBLWdyZWFzZSBVcid8SDYgTTQgZgo4YVFMbS9KbFUzTDNCSlNN
-dWdHcVQ3QjRyaEVKCi0tLSBNc3d2ZWtIR3o4R2xab0U1b3YydkhBMVB0RzFmYUd4
-VStQb0hXTTRLeXVBCvsPJI93CZTHTCiNiWbRI4MiEcYm9t2CQ40vWZEtu223/4iQ
-VEYUk58tRs83+ngrAIoVizPwJ2K3dlVZ3DYEy3y8yTM7sV49Fy62SxE4UU6ZQiA8
-f1F3HqFaYPSPzjhxgQi79Go1B4D9f1y1hScggpr4NY2W2rQyg+wWus17SgW/ttAr
-+xbvskRp00E=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFdvUU04QSBKek5B
+RWhneDgyY2MzUVJuYU5CNDdFenY2cTQyNTJ2TDhnN2pidkpNYjBFCkFWV0F3Mmsx
+cGxMOEwxU2RSVlFnRXQvUG5sZDkxdkRMRE5lNUlVdVBJZkkKLT4gWDI1NTE5IHJk
+bFcwSkxGdjBoYUtwWFAvSkVRL0c0eVFtRThoWDNCUlNDMFJHMXBWeTQKZEdIUTlB
+UnhvRGRGY0lJR1hiNUV4b0oxL0RNU3I0VVJkbXhxa0QvUFlrUQotPiBwaXYtcDI1
+NiBySnMxSEEgQXo2azJGUjR5ZUFMVXRmZm12NzhVaGNxb1JCZHdYQm1TTG5QSi93
+WTFJTGEKZW5pdnRUbmFlM1FNV3RtQVJmd3NVSmszT0hCZUc2V285Y0RDRTNGVlNZ
+QQotPiBiYV0sLWdyZWFzZSAycFUxYSBxOF97dCBwKiB2Q1JeCjRKQ3czL1RtUTVZ
+RVBUQTMwVVJtUEJBdUJXVDlZVVVVeENuY0ZhUWRLbXBycTEzSHhWaFltb1pLN3k5
+UQotLS0gWk96N3U1aElBL1NBUzQ2UlFpSmdTWnN2cHpPaWV4aXAyb211dHJRekYw
+awpMQoWOGu/d8JcDYMr5954FuagIGNhNMRb7IBQpXQpDT9fjOCnkngU8p4YxcF5V
+sgReOo63cA0LnbXS+3v2oSDHCyiHKr25sTF4Bxw//jzg49uxT4Wsv9ieBlDTD2zn
+K6E+pph5fIkHAGpL
 -----END AGE ENCRYPTED FILE-----