Changed location of some persistence files

README.md

@@ -2,6 +2,10 @@
 
 My NixOS configuration.
 
-## Usage
+## Installation
 
-Clone the repository to some directory. And build with `sudo nixos-rebuild switch --flake /directory/containing/flake.nix/`.
+For disk configuration we use disko, this means that installing the system from the configuration is just a single command:
+
+```
+sudo nix --experimental-features "nix-command flakes" run "github:nix-community/disko/latest#disko-install" -- --flake git+https://git.bulthuis.dev/Jan/dotfiles#<hostname> --disk main /dev/sda
+```

flake.lock

@@ -1,5 +1,25 @@
 {
   "nodes": {
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1748225455,
+        "narHash": "sha256-AzlJCKaM4wbEyEpV3I/PUq5mHnib2ryEy32c+qfj6xk=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "a894f2811e1ee8d10c50560551e50d6ab3c392ba",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -34,17 +54,6 @@
         "type": "github"
       }
     },
-    "glue": {
-      "locked": {
-        "path": "./glue",
-        "type": "path"
-      },
-      "original": {
-        "path": "./glue",
-        "type": "path"
-      },
-      "parent": []
-    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -65,6 +74,21 @@
         "type": "github"
       }
     },
+    "impermanence": {
+      "locked": {
+        "lastModified": 1737831083,
+        "narHash": "sha256-LJggUHbpyeDvNagTUrdhe/pRVp4pnS6wVKALS782gRI=",
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "rev": "4b3e914cdf97a5b536a889e939fb2fd2b043a170",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "type": "github"
+      }
+    },
     "nix-minecraft": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -125,8 +149,9 @@
     },
     "root": {
       "inputs": {
-        "glue": "glue",
+        "disko": "disko",
         "home-manager": "home-manager",
+        "impermanence": "impermanence",
         "nix-minecraft": "nix-minecraft",
         "nix-modpack": "nix-modpack",
         "nixpkgs": "nixpkgs"

flake.nix

@@ -2,15 +2,20 @@
   description = "System configuration for NixOS";
 
   inputs = {
-    glue.url = "./glue";
+    # General inputs
     nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
     home-manager.url = "github:nix-community/home-manager";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
+    disko.url = "github:nix-community/disko";
+    disko.inputs.nixpkgs.follows = "nixpkgs";
+    impermanence.url = "github:nix-community/impermanence";
+
+    # For Minecraft VM
     nix-minecraft.url = "github:Jan-Bulthuis/nix-minecraft";
     nix-minecraft.inputs.nixpkgs.follows = "nixpkgs";
     nix-modpack.url = "github:Jan-Bulthuis/nix-modpack";
     nix-modpack.inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs = inputs: inputs.glue inputs;
+  outputs = inputs: import ./glue inputs;
 }

glue/default.nix

@@ -0,0 +1,170 @@
+inputs:
+let
+  flake = inputs.self;
+  nixpkgs = inputs.nixpkgs;
+  lib = nixpkgs.lib;
+
+  importDir =
+    path: fn:
+    let
+      entries = builtins.readDir path;
+
+      # Get paths to directories
+      dirs = lib.filterAttrs (_: type: type == "directory") entries;
+      dirPaths = lib.mapAttrs (name: type: {
+        path = "${path}/${name}";
+        type = type;
+      }) dirs;
+
+      # Get paths to nix files
+      nixName = name: builtins.match "(.*)\\.nix" name;
+      files = lib.filterAttrs (name: type: (type != "directory") && ((nixName name) != null)) entries;
+      filePaths = lib.mapAttrs' (name: type: {
+        name = builtins.head (nixName name);
+        value = {
+          path = "${path}/${name}";
+          type = type;
+        };
+      }) files;
+
+      combined = dirPaths // filePaths;
+    in
+    fn (lib.optionalAttrs (builtins.pathExists path) combined);
+
+  # Split out into getNixFiles, getNixFilesRecursive, getDirs
+  importDirRecursive =
+    path: fn:
+    let
+      entries = importDir path lib.id;
+
+      # Dig down recursively
+      dirs = lib.filterAttrs (_: entry: entry.type == "directory") entries;
+      recursedEntries = lib.mapAttrs (name: entry: (importDirRecursive entry.path lib.id)) dirs;
+    in
+    fn (entries // recursedEntries);
+
+  eachSystem = fn: lib.genAttrs lib.systems.flakeExposed fn;
+
+  systemArgs = eachSystem (system: {
+    pkgs = (
+      import inputs.nixpkgs {
+        inherit system;
+      }
+    );
+  });
+
+  allPackages = importDir "${flake}/packages" (
+    attrs:
+    lib.mapAttrs (
+      name: entry: (if entry.type == "directory" then "${entry.path}/default.nix" else entry.path)
+    ) attrs
+  );
+
+  packages =
+    let
+      # TODO: Filter out packages that are not supported on the platform?
+      mkPackages =
+        system:
+        let
+          args = systemArgs."${system}";
+          pkgs = args.pkgs;
+        in
+        lib.mapAttrs (name: package: pkgs.callPackage package { }) allPackages;
+    in
+    eachSystem mkPackages;
+
+  overlay = final: prev: (lib.mapAttrs (name: package: prev.callPackage package { }) allPackages);
+
+  collectEntries =
+    attrs:
+    lib.attrsets.collect (
+      entry: (lib.isAttrs entry) && (lib.hasAttr "path" entry) && (lib.hasAttr "type" entry)
+    ) attrs;
+
+  collectModules =
+    path:
+    importDirRecursive path (
+      attrs:
+      map (entry: if entry.type == "directory" then entry.path + "/default.nix" else entry.path) (
+        collectEntries attrs
+      )
+    );
+
+  nixosModules = collectModules "${flake}/modules/nixos";
+  nixosProfiles = collectModules "${flake}/profiles/nixos";
+  inputNixosModules = lib.map (flake: flake.outputs.nixosModules.default) (
+    lib.filter (flake: lib.hasAttrByPath [ "outputs" "nixosModules" "default" ] flake) (
+      lib.attrValues inputs
+    )
+  );
+
+  homeModules = collectModules "${flake}/modules/home";
+  homeProfiles = collectModules "${flake}/profiles/home";
+  inputHomeModules = lib.map (flake: flake.outputs.homeManagerModules.default) (
+    lib.filter (flake: lib.hasAttrByPath [ "outputs" "homeManagerModules" "default" ] flake) (
+      lib.attrValues inputs
+    )
+  );
+
+  inputOverlays = lib.map (flake: flake.outputs.overlays.default) (
+    lib.filter (flake: lib.hasAttrByPath [ "outputs" "overlays" "default" ] flake) (
+      lib.attrValues inputs
+    )
+  );
+
+  overlayModule =
+    { ... }:
+    {
+      nixpkgs.overlays = [ overlay ] ++ inputOverlays;
+    };
+
+  nixosConfigurations = importDir "${flake}/hosts" (
+    attrs:
+    lib.mapAttrs (
+      name: entry:
+      lib.nixosSystem {
+        specialArgs = {
+          inherit inputs;
+        };
+        modules =
+          let
+            systemPath = "${entry.path}/configuration.nix";
+
+            userEntries = importDir "${entry.path}/users" lib.id;
+
+            usersConfiguration = lib.mapAttrs (name: entry: {
+              isNormalUser = true;
+              group = name;
+            }) userEntries;
+            groupsConfiguration = lib.mapAttrs (name: entry: {
+            }) userEntries;
+            homesConfiguration = lib.mapAttrs (name: entry: entry.path) userEntries;
+
+            usersModule =
+              { ... }:
+              {
+                home-manager.sharedModules = homeModules ++ homeProfiles ++ inputHomeModules;
+                home-manager.useUserPackages = false; # TODO: See if this should be changed to true?
+                home-manager.useGlobalPkgs = true;
+                home-manager.users = homesConfiguration;
+                users.users = usersConfiguration;
+                users.groups = groupsConfiguration;
+              };
+          in
+          [
+            systemPath
+            overlayModule
+            usersModule
+          ]
+          ++ nixosModules
+          ++ nixosProfiles
+          ++ inputNixosModules;
+      }
+    ) (lib.attrsets.filterAttrs (name: entry: entry.type == "directory") attrs)
+  );
+
+in
+{
+  inherit packages nixosConfigurations overlay;
+  overlays.default = overlay;
+}

glue/flake.nix

@@ -1,14 +0,0 @@
-{
-  description = "Some glue";
-
-  inputs = { };
-
-  outputs =
-    inputs:
-    let
-      glue = import ./lib { inherit inputs; };
-    in
-    {
-      __functor = _: glue;
-    };
-}

glue/lib/default.nix

@@ -1,173 +0,0 @@
-{ ... }:
-
-let
-  mkGlue =
-    inputs:
-    let
-      flake = inputs.self;
-      nixpkgs = inputs.nixpkgs;
-      lib = nixpkgs.lib;
-
-      importDir =
-        path: fn:
-        let
-          entries = builtins.readDir path;
-
-          # Get paths to directories
-          dirs = lib.filterAttrs (_: type: type == "directory") entries;
-          dirPaths = lib.mapAttrs (name: type: {
-            path = "${path}/${name}";
-            type = type;
-          }) dirs;
-
-          # Get paths to nix files
-          nixName = name: builtins.match "(.*)\\.nix" name;
-          files = lib.filterAttrs (name: type: (type != "directory") && ((nixName name) != null)) entries;
-          filePaths = lib.mapAttrs' (name: type: {
-            name = builtins.head (nixName name);
-            value = {
-              path = "${path}/${name}";
-              type = type;
-            };
-          }) files;
-
-          combined = dirPaths // filePaths;
-        in
-        fn (lib.optionalAttrs (builtins.pathExists path) combined);
-
-      # Split out into getNixFiles, getNixFilesRecursive, getDirs
-      importDirRecursive =
-        path: fn:
-        let
-          entries = importDir path lib.id;
-
-          # Dig down recursively
-          dirs = lib.filterAttrs (_: entry: entry.type == "directory") entries;
-          recursedEntries = lib.mapAttrs (name: entry: (importDirRecursive entry.path lib.id)) dirs;
-        in
-        fn (entries // recursedEntries);
-
-      eachSystem = fn: lib.genAttrs lib.systems.flakeExposed fn;
-
-      systemArgs = eachSystem (system: {
-        pkgs = (
-          import inputs.nixpkgs {
-            inherit system;
-          }
-        );
-      });
-
-      allPackages = importDir "${flake}/packages" (
-        attrs:
-        lib.mapAttrs (
-          name: entry: (if entry.type == "directory" then "${entry.path}/default.nix" else entry.path)
-        ) attrs
-      );
-
-      packages =
-        let
-          # TODO: Filter out packages that are not supported on the platform?
-          mkPackages =
-            system:
-            let
-              args = systemArgs."${system}";
-              pkgs = args.pkgs;
-            in
-            lib.mapAttrs (name: package: pkgs.callPackage package { }) allPackages;
-        in
-        eachSystem mkPackages;
-
-      overlay = final: prev: (lib.mapAttrs (name: package: prev.callPackage package { }) allPackages);
-
-      collectEntries =
-        attrs:
-        lib.attrsets.collect (
-          entry: (lib.isAttrs entry) && (lib.hasAttr "path" entry) && (lib.hasAttr "type" entry)
-        ) attrs;
-
-      collectModules =
-        path:
-        importDirRecursive path (
-          attrs:
-          map (entry: if entry.type == "directory" then entry.path + "/default.nix" else entry.path) (
-            collectEntries attrs
-          )
-        );
-
-      nixosModules = collectModules "${flake}/modules/nixos";
-      inputNixosModules = lib.map (flake: flake.outputs.nixosModules.default) (
-        lib.filter (flake: lib.hasAttrByPath [ "outputs" "nixosModules" "default" ] flake) (
-          lib.attrValues inputs
-        )
-      );
-
-      homeModules = collectModules "${flake}/modules/home";
-      inputHomeModules = lib.map (flake: flake.outputs.homeManagerModules.default) (
-        lib.filter (flake: lib.hasAttrByPath [ "outputs" "homeManagerModules" "default" ] flake) (
-          lib.attrValues inputs
-        )
-      );
-
-      inputOverlays = lib.map (flake: flake.outputs.overlays.default) (
-        lib.filter (flake: lib.hasAttrByPath [ "outputs" "overlays" "default" ] flake) (
-          lib.attrValues inputs
-        )
-      );
-
-      overlayModule =
-        { ... }:
-        {
-          nixpkgs.overlays = [ overlay ] ++ inputOverlays;
-        };
-
-      nixosConfigurations = importDir "${flake}/hosts" (
-        attrs:
-        lib.mapAttrs (
-          name: entry:
-          lib.nixosSystem {
-            specialArgs = {
-              inherit inputs;
-            };
-            modules =
-              let
-                systemPath = "${entry.path}/configuration.nix";
-
-                userEntries = importDir "${entry.path}/users" lib.id;
-
-                usersConfiguration = lib.mapAttrs (name: entry: {
-                  isNormalUser = true;
-                  group = name;
-                }) userEntries;
-                groupsConfiguration = lib.mapAttrs (name: entry: {
-                }) userEntries;
-                homesConfiguration = lib.mapAttrs (name: entry: entry.path) userEntries;
-
-                usersModule =
-                  { ... }:
-                  {
-                    home-manager.sharedModules = homeModules ++ inputHomeModules;
-                    home-manager.useUserPackages = false; # TODO: See if this should be changed to true?
-                    home-manager.useGlobalPkgs = true;
-                    home-manager.users = homesConfiguration;
-                    users.users = usersConfiguration;
-                    users.groups = groupsConfiguration;
-                  };
-              in
-              [
-                systemPath
-                overlayModule
-                usersModule
-              ]
-              ++ nixosModules
-              ++ inputNixosModules;
-          }
-        ) (lib.attrsets.filterAttrs (name: entry: entry.type == "directory") attrs)
-      );
-
-    in
-    {
-      inherit packages nixosConfigurations;
-      overlays.default = overlay;
-    };
-in
-mkGlue

hosts/20212060/configuration.nix

@@ -8,11 +8,21 @@
   networking.hostName = "20212060";
 
   # Admin users
-  users.users.jan.extraGroups = [ "wheel" ];
+  users.users.jan.extraGroups = [
+    "wheel"
+    "wireshark"
+  ];
 
   # Enable virtualisation for VMs
   virtualisation.libvirtd.enable = true;
 
+  # Enable wireshark
+  programs.wireshark = {
+    enable = true;
+    dumpcap.enable = true;
+    usbmon.enable = true;
+  };
+
   # Set up wstunnel client
   services.wstunnel = {
     enable = true;

hosts/vm-minecraft/configuration.nix

@@ -0,0 +1,45 @@
+{
+  lib,
+  pkgs,
+  config,
+  inputs,
+  ...
+}:
+
+{
+  # State version
+  system.stateVersion = "24.11";
+
+  # Import the nix-minecraft modules
+  imports = [
+    inputs.nix-minecraft.nixosModules.minecraft-servers
+  ];
+
+  # Machine hostname
+  networking.hostName = "vm-minecraft";
+
+  # Enabled modules
+  modules = {
+    profiles.vm.enable = true;
+  };
+
+  # Set up minecraft servers
+  users.users.local.extraGroups = [ "minecraft" ];
+  services.minecraft-servers = {
+    enable = true;
+    eula = true;
+    openFirewall = true;
+    servers = {
+      modpack = {
+        enable = true;
+        autoStart = true;
+        serverProperties = { };
+        package = inputs.nix-modpack.packages.${pkgs.system}.mkModpackServer {
+          packUrl = "https://raw.githubusercontent.com/Jan-Bulthuis/Modpack/refs/heads/master/pack.toml";
+          server = inputs.nix-minecraft.legacyPackages.${pkgs.system}.neoForgeServers.neoforge-20_1_106;
+        };
+        jvmOpts = "-Xms6144M -Xmx8192M";
+      };
+    };
+  };
+}

hosts/vm-minecraft/users/local.nix

@@ -0,0 +1,7 @@
+{ ... }:
+
+{
+  home.stateVersion = "24.11";
+
+  modules.profiles.base.enable = true;
+}

hosts/vm-vpn/configuration.nix

@@ -21,7 +21,7 @@
   services.wstunnel = {
     enable = true;
     servers.wg-tunnel = {
-      enableHTTPS = true;
+      enableHTTPS = false;
       listen = {
         host = "0.0.0.0";
         port = 8080;
@@ -32,8 +32,6 @@
           port = 51820;
         }
       ];
-      tlsCertificate = "/var/lib/secrets/fullchain.pem";
-      tlsKey = "/var/lib/secrets/key.pem";
     };
   };
   networking.firewall = {

modules/home/utilities/impermanence.nix

@@ -0,0 +1,35 @@
+{ lib, config, ... }:
+
+with lib;
+let
+  cfg = config.modules.impermanence;
+in
+{
+  options.modules.impermanence = {
+    enable = mkEnableOption "Impermanence";
+    directories = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = ''
+        Directories that should be stored in persistent storage.
+      '';
+    };
+    files = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = ''
+        Files that should be stored in persistent storage.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    home.persistence."/persist/home/${config.home.username}" = {
+      enable = true;
+      hideMounts = true;
+      allowOther = true;
+      directories = cfg.directories;
+      files = cfg.files;
+    };
+  };
+}

modules/nixos/disko.nix

@@ -0,0 +1,24 @@
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.disko;
+  profile = import "${inputs.self}/profiles/disko/${cfg.profile}.nix";
+in
+{
+  options.modules.disko = {
+    enable = mkEnableOption "Disko module";
+    profile = mkOption {
+      type = types.str;
+      default = null;
+      description = "The profile to use for the disko module.";
+    };
+  };
+
+  config = mkIf cfg.enable { disko.devices = profile.disko.devices; };
+}

modules/nixos/impermanence.nix

@@ -0,0 +1,46 @@
+{ lib, config, ... }:
+
+with lib;
+let
+  cfg = config.modules.impermanence;
+in
+{
+  options.modules.impermanence = {
+    enable = mkEnableOption "Impermanence";
+    directories = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = ''
+        Directories that should be stored in persistent storage.
+      '';
+    };
+    files = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = ''
+        Files that should be stored in persistent storage.
+      '';
+    };
+    resetScript = mkOption {
+      type = types.lines;
+      description = ''
+        Script to run on boot that resets the root partition.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    fileSystems."/persist".neededForBoot = true;
+    boot.initrd.postResumeCommands = mkAfter cfg.resetScript;
+
+    # For home-manager persistence
+    programs.fuse.userAllowOther = true;
+
+    environment.persistence."/persist/system" = {
+      enable = true;
+      hideMounts = true;
+      directories = cfg.directories;
+      files = cfg.files;
+    };
+  };
+}

profiles/disko/vm.nix

@@ -0,0 +1,56 @@
+{
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        content = {
+          type = "gpt";
+          partitions = {
+            boot = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            zfs = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "tank";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      tank = {
+        type = "zpool";
+        rootFsOptions = {
+          compression = "zstd";
+        };
+        mountpoint = null;
+        postCreateHook = "zfs snapshot -r tank@blank && zfs hold -r blank tank@blank";
+
+        datasets = {
+          root = {
+            type = "zfs_fs";
+            mountpoint = "/";
+          };
+          nix = {
+            type = "zfs_fs";
+            mountpoint = "/nix";
+          };
+          persist = {
+            type = "zfs_fs";
+            mountpoint = "/persist";
+          };
+        };
+      };
+    };
+  };
+}

profiles/home/jan.nix

@@ -38,6 +38,7 @@ in
       bottles
       prismlauncher
       foliate
+      wireshark
     ];
 
     modules = {

profiles/nixos/base.nix

@@ -19,6 +19,14 @@ in
     modules = {
       bootloader.enable = mkDefault true;
       ssh.enable = mkDefault true;
+
+      # Setup sensible default persistent data
+      impermanence.directories = [
+        "/var/lib/nixos"
+      ];
+      impermanence.files = [
+        "/etc/shadow"
+      ];
     };
 
     # Localization
@@ -56,6 +64,7 @@ in
       pciutils
       zip
       unzip
+      tmux
     ];
   };
 }

profiles/nixos/vm.nix

@@ -19,15 +19,38 @@ in
     # Enabled modules
     modules = {
       profiles.base.enable = true;
+      disko = {
+        enable = true;
+        profile = "vm";
+      };
+      impermanence = {
+        enable = true;
+        resetScript = ''
+          # Revert to the blank state for the root directory
+          zfs rollback -r tank/root@blank
+        '';
+      };
       ssh.enable = true;
     };
 
+    # Admin users
+    users.users.local = {
+      initialPassword = "local";
+      extraGroups = [ "wheel" ];
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519  jan@bulthuis.dev"
+      ];
+    };
+
     # Enable qemu guest agent
     services.qemuGuest.enable = true;
 
     # Machine platform
     nixpkgs.hostPlatform = "x86_64-linux";
 
+    # Set hostid for ZFS
+    networking.hostId = "deadbeef";
+
     # Hardware configuration
     hardware.enableRedistributableFirmware = true;
     boot.initrd.availableKernelModules = [
@@ -43,21 +66,6 @@ in
     boot.extraModulePackages = [ ];
     hardware.cpu.intel.updateMicrocode = true;
 
-    # Filesystems
-    fileSystems."/" = {
-      device = "/dev/disk/by-partlabel/root";
-      fsType = "ext4";
-    };
-
-    fileSystems."/boot" = {
-      device = "/dev/disk/by-partlabel/EFI";
-      fsType = "vfat";
-      options = [
-        "fmask=0077"
-        "dmask=0077"
-      ];
-    };
-
     # Swapfile
     swapDevices = [
       {