Merge pull request 'Switch to btrfs for vanadium' (#11) from vanadium-btrfs into mistress

Reviewed-on: https://codeberg.org/leana8959/.files/pulls/11

.stow-local-ignore

@@ -12,6 +12,8 @@
 result
 default.nix
 nix
+shell.nix
+\.envrc
 
 # repo related
 ^/README.*

nix/configurations/vanadium.nix

@@ -71,7 +71,7 @@ in
       # Extern modules
       #
       (sources.disko + "/module.nix")
-      ../disko/vanadium
+      ../disko/vanadium/btrfs.nix
 
       (sources.agenix + "/modules/age.nix")
 

nix/configurations/vanadium/nixos/fs.nix

@@ -3,6 +3,15 @@
   pkgs,
   ...
 }: {
+  services.btrfs.autoScrub = {
+    enable = true;
+    fileSystems = [
+      "/"
+      "/home"
+      "/nix"
+    ];
+  };
+
   systemd.tmpfiles.rules = [
     # tmux-sessionizer directories
     "d /home/leana/r  0700 leana leana -  -"

nix/configurations/vanadium/nixos/misc.nix

@@ -1,5 +1,5 @@
 {pkgs, ...}: {
-  system.stateVersion = "24.05";
+  system.stateVersion = "24.11";
 
   boot.loader = {
     systemd-boot = {

nix/disko/vanadium/btrfs.nix

@@ -0,0 +1,102 @@
+{
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/nvme0n1";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "500M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = ["umask=0077"];
+              };
+            };
+
+            # Use LUKS for disk encryption
+            luks = {
+              size = "100%";
+              content = {
+                type = "luks";
+                name = "crypted";
+                extraOpenArgs = [];
+                settings.allowDiscards = true;
+                content = {
+                  type = "lvm_pv";
+                  vg = "pool";
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+
+    # Use LVM to create a partition for swap
+    lvm_vg = {
+      pool = {
+        type = "lvm_vg";
+        lvs = {
+          # Set swap device as resume device
+          swap = {
+            size = "48G"; # > 32G for hibernation
+            content = {
+              type = "swap";
+              discardPolicy = "both";
+              resumeDevice = true;
+            };
+          };
+
+          # Use btrfs over ext4 for:
+          # - compression
+          #   nix store can be shrinked using this feature
+          # - more transparent partitions (subvolumes)
+          #   no more "I need more space here and not there"
+          btrfs = {
+            size = "100%";
+            content = {
+              type = "btrfs";
+
+              mountpoint = "/btrfs-root";
+
+              # # DANGER:
+              # # Override existing partition at partition creation
+              # extraArgs = ["-f"];
+
+              subvolumes = {
+                "/root" = {
+                  mountpoint = "/";
+                };
+
+                "/home" = {
+                  mountOptions = ["compress=zstd"];
+                  mountpoint = "/home";
+                };
+
+                "/nix" = {
+                  mountOptions = ["compress=zstd" "noatime"];
+                  mountpoint = "/nix";
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+
+    # It's nice to have a scratch space
+    nodev = {
+      "/tmp" = {
+        fsType = "tmpfs";
+        mountOptions = [
+          "size=4G"
+        ];
+      };
+    };
+  };
+}

nix/secrets/restic_backblaze_env.age

@@ -1,11 +1,12 @@
 age-encryption.org/v1
--> ssh-ed25519 7owkuQ IQwjCUcoeJdCB0t+PbROjKlSUovxzZ588AnUDbLKfXg
+-> ssh-ed25519 7owkuQ rd3EZwldcI+U4OPT3dTL9TsWFI+2azh66HRL79O8WRQ
-RIapw6fvGvXDS1YAyYQzlhR7elOunHcJNotyl9KJ9AI
+nh8jLSZfuqOO2inU4kIyh5HrfEPqWrbGb82EulWn3dI
--> ssh-ed25519 5dpZEQ 6YlJfVW/DnjTcf0DT84y9riUKNaQA4QEFRNxXYE5f14
+-> ssh-ed25519 Y8XJnA oZOhDFlwaydJhii01vwBGJwjnj+Wz8VWqvHn5cyFFUI
-71LcqS1H/RlvCVpEy1pn946SP7TXdT0lKoQmrcf0YKk
+9vyNd1BtTFqBdnGqFV8Ehsp9FRQefxyLin7us5YEASI
--> ssh-ed25519 gFLKzg LdRsm6mEv30HPBUNx/o4mgT4jaYPedj9n3Iy5o8ed2I
+-> ssh-ed25519 gFLKzg bdSTF8mPe1xiZZf53Lic7FmIociuRKvVpwCYldAoJks
-1AenWvRflROQ2UF/6l+SXYboLBxmgEG8fpXRk+ZJybU
++uque6eV5koi5mq8gCSaTS+RkgElT3Jprjebe0GtfOI
--> ssh-ed25519 zp0Cfw 3lyhwlG2hLc/PSaqLZy4ItDOvpWJDRtDrnLid2P/xjI
+-> ssh-ed25519 zp0Cfw mZVEFkbCviPQo8x/JW5M6rodOkrAngzc6OhrDkofZ3g
-ZWunvQLIgYrvVV5Tcs2lFljsemvHip62E32sVGE8xAc
+3MiXHLbTGlpT+cOhfYa0jkfkR5kzfrciFlv7c83cQv8
---- 4c2hqCUsLHpDs0LqVfQGOxvWtahtoFilWmNJC4BvNSU
+--- cc6CWPYifqAdBFZ86OkrSlmG6KewW6nXUP+jd4mJ4Dc
-Tc‰Œ¾ï²²9³é¥kùíÈÛûÚ\¥šUW>Ë5ÐœðíÜ%÷!f!9¾:¤ÝoßYZȶ¶’êÈ)j¶ütŸ×µžë>3÷¨’ha»/6v‡òbƒÀ<19>þî•”ž$²û¥û÷½I=	¥Ø¤ñ¸ï<C2B8>’%÷ùg×Ü&‰•ª

+%`¡„F!†ÙU:‚±ðF…£Þ a
+Ôî<>ud;aíšD‹
6H Òß¿3Y—ozI¹<49>‡‚©ã¦ô5î<35>·ÊW.•b”%&dØSÛUyŠû=<1F>0Ù›Û0Iýë_™ñœ«##>­'±;Þ6H5~¬P@ ³½žÜo•G±èS…*ðîåÝ

nix/secrets/restic_backblaze_repo.age

@@ -1,11 +1,11 @@
 age-encryption.org/v1
--> ssh-ed25519 7owkuQ 7xYeY51Eo1FMmanLvwDhbLRLHfFCfu6T37VaAwAMcCA
+-> ssh-ed25519 7owkuQ 7+8t2oE+AIjwRfvoFjwYm7z3jSQuxZogXuu4cFlILXs
-idjwxWgm3MVon2XUwKhC1ZS9k2sCaEk5/Syisy5A9Kg
+ibdkl1XX0+JJswbHqlTVvbXCRrVZMr9zuz2K+EylhuE
--> ssh-ed25519 5dpZEQ Df3kq0CxZoZCfeP5P0kJiv/t18toHjevPUxDpKG1GyQ
+-> ssh-ed25519 Y8XJnA w794CRnrScQIDv7Ho38H7iGnRLVgk4/Bta5T0Qio8Fk
-aUXrq0vHSXPOx3k1vZR7SyJELNEsKNa3fugMVG5n2Bk
+wx9D9yanhiNR3qb0Eq4B3CfbU2E+B12hwpeZiYSOZO8
--> ssh-ed25519 gFLKzg eAcqNJUr7RpzPJmKzNSgrvaYEusjbbT5gqJUYgURUE4
+-> ssh-ed25519 gFLKzg wdMao+vR53TyeMQBIgnK/JivunNKfee8Egw38Nzq6zw
-JKJ0zoRbNzh2cGxgynEb6cRJTQ9DELIX12oNcBqJIGU
+CVcxP0Xr7vSnGaMkJqoCTgB39Fm2iKLUNul4U4iUUx0
--> ssh-ed25519 zp0Cfw KIQuFRbsQ51xyNmeiKnJsDQerNl1G+QsGH8XGOkbuXE
+-> ssh-ed25519 zp0Cfw TQ91UMluVhlWI4XbWL+SVu4iZLL1/ZSrMNXQ4Q8f20c
-tMFsLXcNv8QEwrbEBMwc+fU4FNlsqDZPm+g8XsmRwzc
+qFtcXOBzXMSfwxXjeTyqoQTmXNYWBFPJoQgeU4jZYfo
---- 132mcjb5oUsywuv9jJuH5BdTFuMsJGdV1/IztoyV/r4
+--- ZcVSHz1RoF0+A/3uvj6CbZvqBdFK+y8ml0e4D51ZzEs
-<EFBFBD>C­Ã“×À?íŽÛ<C5BD>	!&Zá£|W×D‘eÁXÏNßÔY/O‚A)	{àšp?<#Ö(%;+_W!-5$)þ&T -‰FÞÚ¸D7²oŽXå<0C>‡/²k£aï!<21>Êþr9Ê
+MPO1Aê/2®²ì…;°<>¨g
]¼
ü†<C3BC>÷}Ñ嘾<CB9C>-.q;ç”8¿ÂuïTwåÍ„)Vl"hñ·d<08>€7¿?wîç&RŠƒgGaâ¹²žs<C5BE>Itè

nix/secrets/restic_four_pwd.age

@@ -1,11 +1,11 @@
 age-encryption.org/v1
--> ssh-ed25519 7owkuQ JmcIImKWc73PYFj3mtckN6YE/ZGqmWw3/pfGJnL2hmk
+-> ssh-ed25519 7owkuQ oHuCDN+x3LKlhtRn46El75a2uiyvwg7/HuutemsR7nY
-uLkl4Hma4mFHMeGldD1AKZPUz9OaAMaEF1icFtzzLpU
+xYat3RqB63D/M4hWmxplZVTNlsl3ukjVFrAzYJeVNCA
--> ssh-ed25519 5dpZEQ 8cUoY+KBb08rv85d/PaGAA3RcT/PijGWoLWj53JJESM
+-> ssh-ed25519 Y8XJnA wvlzQ4eRMybsrT7ansGe9CEn2RnkadhcfKqJQYpObTk
-/jS5n0CZ2KKp9d97Ety9nmWuBp2155tfA0fw9FH4s6k
+rWrEoVtu3XOGE9FOukb+LY3IyF4iut++58VxhUbD4/U
--> ssh-ed25519 gFLKzg SoABIosMZTVfJDc/UX/BrTwOR2auXEfMdR+GlVpbWHE
+-> ssh-ed25519 gFLKzg KP6yyqb6zDtgLlFyClaHKXj8+wJwnY1Fmak1YyLqalA
-7OxRs7recbO/SS3MMa9ZQM5TK0NoI7piQ6ErxZPRWqc
+tv9BAGmuXHzkCrhGUk+lM0pYEyPs+whH/ydmPAF394E
--> ssh-ed25519 zp0Cfw xLL6WiM0KeYWV5eCkQ5dAQxty0O2Jv+37/8ovgb3DFA
+-> ssh-ed25519 zp0Cfw WidN1frzMJzoBo70xejM6Qk2uKXu2vgJmVggjtY2vwM
-Es02nivP5uRm1/UiVBPZjHegmPcYTKnmWL/2dbIV81g
+FqXvxEW7hASb5toMjDe+/Zlxt4YkkXq40h26EmZEZrc
---- q/0wLvbKVsCKDI7FlP2u6LA11SzX6ViDCDQFxbcXpaA
+--- vY9Qle8UDnQJGX5vnk4XzwsMDb+dzfw4eZUMEfn0898
-+‡âU…¢<E280A6>ŽøFÈWs/
ëô“5_`oE7&>M…¡|Ùõ¶Xdözcñ'¯iGàqr.ç
+½7
ô·§•ëM鉌æA
<01>d&?Dñ´w<1C>ŒŸþÁù.Xâô³ÇÇÆ{|iæ&SXt

nix/secrets/restic_sgbk_pwd.age

@@ -1,12 +1,11 @@
 age-encryption.org/v1
--> ssh-ed25519 7owkuQ EfQT1yelq5hGWJZPfTnPe37XkHK3QWQGbgikAWgHfzA
+-> ssh-ed25519 7owkuQ 0Kpa/boD7cPyMSeFvq0watODH9Ub/Bthzdprn3BLuUE
-EL5PU9cOtM5k/qqlSX3qvRiXePQaK1LPMWpdLJjRrtE
+4i1Td337iBbT4dwA+A/IAoUd2cyFicSMP2u3YfIpatY
--> ssh-ed25519 5dpZEQ vp12U8UgGlg5tPaGTOX7iV/b8RlDm+xghtKPRLL7O0U
+-> ssh-ed25519 Y8XJnA 7sansKcB94DS6lefScrQzCq5SrlOq5x142/kljXAWW0
-CtwTletRUklN5uFmP8Tbj2jh6n2MqMRRn7fAzLbwQxk
+D4bp9mRyzFGETN36FfhPJapCpBFc6rwUTEdHhonaY5E
--> ssh-ed25519 gFLKzg ovHOZXxgPZbNjlNLE/AbMKZ83p/sUuTbNUm1tnmelTk
+-> ssh-ed25519 gFLKzg hgR6j4PwYHrHijt+J8GaIDSaoVwMbfmBq10Bz4nkRVE
-bBVUeW2TvLT9/qu9h+TiPIgh/YOFMGDmY7QVFgwAeXg
+gN94qAKFpb4yh87ieO8Var63f3+17RDmGsXCjWqoOYw
--> ssh-ed25519 zp0Cfw ZWtsg42NwwuoAblnNBAwFdfSxnh8+RQGs9LdlphY5k4
+-> ssh-ed25519 zp0Cfw 1LY3vkQZKNbl3WKUdLIMOMD519p306bEl5JCs3BMQVU
-87WANVnbHAobOx8fMKyoufxwJZwbNvVkjLqt6mFpYPU
+2xG8ToIemouKxwPPJ22v4ZND9YMNjx0aP5xBkNKoJ3c
---- 0z1pPXT+1ToLe4BfKCTGMycPKVJRZ13DMpHJb7gM0O8
+--- oSsulGEG+f+okkusI0I5Skhz84160FMhUuBsVtMXjow
-Uj*†s'M„PÊ#h‚tt‹ûˆÎwŠ
rÆc¦Jpg¾ÌÄ
+ž<>ÐYFù}JC+¸sáª¡îh÷'8…©¯æ5Ãæ»YîDÿ;Pàåb@°’jjé°B÷Û
-'8ðìé1"J*H•

nix/secrets/secrets.nix

@@ -1,7 +1,7 @@
 let
   vanadium = [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGPq2o9pbmLRGrOpAP76eYCAscmfakDC7wPm9fmsCCQM leana@vanadium"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF52lTIu9kT4gb6RnAefriQkeTKs/hKG6kI/M8zTDWyo root@vanadium"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAodIJHcxZM8lPdd7tGJloVqgP2AlkYn+kfMDYNA5gSZ root@vanadium"
   ];
 
   tungsten = [

nix/secrets/sgbk_pwd.age

@@ -1,11 +1,11 @@
 age-encryption.org/v1
--> ssh-ed25519 7owkuQ MVzZvxcL29ripa3xJN1i+99KfR1Y+eME5Ec0XssG0mU
+-> ssh-ed25519 7owkuQ 1s6xTdS3y6Rty9oH8kd9C38MbVkdUFhxfkpwBGBdSWc
-HYaaqHne8D46RPz46Y4BP7clSea/i0cwRNqEDM5nf38
+OdhHkx6oNSlob3FmSGl5OX+PmHV2jdoPYH4W597o1jU
--> ssh-ed25519 5dpZEQ WEQ9Eln/C/n1FX7dzwzLEU9STcTxfFJ4SjQbJevH5i4
+-> ssh-ed25519 Y8XJnA 1Lbr5YCq66VDLXSaLWUMyfjPVs+i1+DemLWKHFRssmA
-tOJ0vc9yEJfmrSrI/wKryzLWQmeyTJcs7N4vwHg58DY
+aKyXk3P8yJGYUuEGRabrMyFzMR/6t3RAIv/iiW3wiR8
--> ssh-ed25519 gFLKzg FFemREWoTrmz4q2ikdv6ncsqGdQE6Xgm8J4JyzxtK0c
+-> ssh-ed25519 gFLKzg XVJZTEc9wzxF+EnFjsASn1ugGAZuTYIbqLnVKhrsV04
-aJsOa2Fhoo8JEuP2oOQ5MOKIigDDXzpFK6WpDhz/yLw
+KlSI6k71bjn00lljWPu2YtuSCik33Idv0ChmBKmeWdY
--> ssh-ed25519 zp0Cfw 8/FOJ3lzjbUxM+wWjvuJoaPy7bTbX+jh2CnW2VxG2Uw
+-> ssh-ed25519 zp0Cfw 1kJqBAn2C5VM6p/tr5PlPFWZdN3SfHtixHJAk2Ct7jE
-+DbH6UQzQ87cwnQPpYZ+jg5tIAF1e6Sdo+zERbJPb9U
+aD8f6snqi92xwjy2B6vyNZjQTJslHf5iOqakUoqnra8
---- UylIHe7jjfuTbrTFl7gA3NTryboK4MDEbeMjIy03UmQ
+--- sRJtqap+h8ndESvcKwA8UyXQEwxGBdxDiPJKFGWmlas
-<EFBFBD>\<5C>B'G‘|`{×›>§ºÈëÛ ÔSC¼¢,­š4Iû¶£7w6GËÂ\-ñgËFÓÒ:
+[ﾃ揀ﾂHc|bﾝnﾅ｡yﾆル､ﾇｷﾙ憫H;ｲ<>ﾘ_7:1ﾛ94r<34><72>ﾕb靄ｭr<EFBDAD>

nix/secrets/wpa_password.age

@@ -1,11 +1,12 @@
 age-encryption.org/v1
--> ssh-ed25519 7owkuQ BzumCTV2qAMv8WuCZOEsV/LoDHkai/3qUlgAcCyo8DY
+-> ssh-ed25519 7owkuQ eEeU1XSeT9WNVIFTXB2tXVmFMACL8oKuwdZi+pnYoFE
-KP1mwaAEDkAZmsR0bsrHZEqm1VodUWw+RvGSsYNF4lc
+Iy/f58v4Fr9+9XcCsbuccQruHU8tYmEQez8anKm92rU
--> ssh-ed25519 5dpZEQ Nl0g/lcPFg+yr2glYmi+LAP2usLHNtCz+kJkUB8f8Sg
+-> ssh-ed25519 Y8XJnA ZZI+GUlc0FwH/yrLjeQoufbf1EmrVOHFOxR1alUb+zg
-BM19SfXeagbsVZtyfCWKisMp/wV0XvihjAimbrhkkaU
+nR1OGprP75LGX5+xBV9Qz1gBRYVQS0WT0kAktqWVtiw
--> ssh-ed25519 gFLKzg 6Dhz8r2OWsFv3PHCXCInu6+FiJCo4epC1bEZX3HpRV0
+-> ssh-ed25519 gFLKzg Lk2F9/yE7C7wuCIVmWxZ7nrDoS+C3KL7MhHUwXU+2k4
-0NhLjYJuJ+iG41HdriSUI+lTGk4jpi+VyojjVQtoPk8
+1VhVbgmA/xv8+KMD1gbWlDGMYCPbqpkQVWdo1LsdJUA
--> ssh-ed25519 zp0Cfw pZKYOx2n6K6MnSZ5jNAWff8tssUejUAsGW3JMXD64kg
+-> ssh-ed25519 zp0Cfw hkx5UUywMK5cIP0oyPTiexJcpbwZf7a8zx1IDtKxnk8
-eZgZaXqkFCIqUnBgWCj+aHiUSykKg+XrzUXXq+fGWvE
+GHeoYwUxnzbBupROmi/O7st2hDyjJfrEbWhKyVH7T6Q
---- 7l6Pr9G+Ke+ic5l1T3nmNufFaL1opY9BAMf73B4DEYw
+--- TOvv7vml1HhP9TJL8YFoVZSKTmh8GG3pZFIgeT/m0tI
-!Í‹ÿ<E280B9>Ñ
˜³Ü<C2B3>\žq¿b˜ý’³îµ“2>luÏ£ÛÛØÔáà*¹šÅÇž óþ3P$ÖŽ$xéùl¢þVVº[»Å/À«-©ŒÓ2жDJ(ùyºÔ¸çßÖaP¬ýïF
E6§ïÏÏ{³é™™ Ó\ë:5Þ
L<>³¯Ÿ1r
“
+–ýÖ·³ç<11>úGF1Ü`=6Æ3ꜻ}Æ.)o‚=3'OÙ¬K›4wxâåøVw'OØ¡ä¨,·s^ónݽ³
9¤ÁÕÅ|†ÍQucß“`ð—ƒÙJ£
+Ni’0µ<K½ïŸk*ˆ.N¨Œx·ÁÂVïcà<63>ò å<C2A0>ÓèAŸ