From de972b9fb03f004df201cd2d9280c4b5e3672382 Mon Sep 17 00:00:00 2001 From: C4 Patino Date: Wed, 1 Jul 2026 00:24:52 -0500 Subject: [PATCH] feat: fix all initial impermanence perm folder creation --- .../desktop/apps/games/minecraft/default.nix | 7 ++++++- .../desktop/apps/games/terraria/default.nix | 7 ++++++- .../nixos/desktop/apps/teamviewer/default.nix | 11 ++++++++++- modules/nixos/desktop/env/greetd/default.nix | 11 ++++++++++- modules/nixos/hardware/bluetooth/default.nix | 7 ++++++- modules/nixos/hardware/fingerprint/default.nix | 7 ++++++- .../nixos/services/apps/forgejo/default.nix | 4 +++- modules/nixos/services/apps/ignis/default.nix | 11 +++++++++-- modules/nixos/services/apps/immich/default.nix | 6 +++--- modules/nixos/services/apps/miasma/default.nix | 10 +++++----- .../nixos/services/apps/prometheus/default.nix | 11 +++++++++-- .../services/apps/qbittorrent/default.nix | 11 +++++------ .../nixos/services/apps/rustypaste/default.nix | 11 ++++++++++- .../services/apps/servarr/autobrr/default.nix | 12 ++++++------ .../services/apps/servarr/bazarr/default.nix | 12 ++++++------ .../services/apps/servarr/jellyfin/default.nix | 6 +++--- .../services/apps/servarr/lidarr/default.nix | 12 ++++++------ .../services/apps/servarr/ombi/default.nix | 6 +++--- .../services/apps/servarr/prowlarr/default.nix | 12 ++++++------ .../services/apps/servarr/radarr/default.nix | 12 ++++++------ .../services/apps/servarr/seerr/default.nix | 12 ++++++------ .../services/apps/servarr/sonarr/default.nix | 12 ++++++------ modules/nixos/services/apps/slurm/default.nix | 18 +++++++++++++++--- .../services/apps/uptime-kuma/default.nix | 11 ++++++++++- .../services/apps/vaultwarden/default.nix | 11 +++++++++++ .../services/ci/github-runner/default.nix | 11 ++++++++++- .../networking/network-manager/default.nix | 7 ++++++- .../services/networking/tailscale/default.nix | 9 ++++++++- .../nixos/services/security/acme/default.nix | 11 +++++++++-- modules/nixos/services/storage/nfs/default.nix | 12 ++++++++++-- .../services/storage/postgresql/default.nix | 11 +++++++++-- .../services/storage/postgresql/pgbouncer.nix | 11 +++++++++-- .../nixos/services/storage/samba/default.nix | 12 ++++++++++-- .../services/storage/syncthing/default.nix | 14 +++++++++++++- .../nixos/virtualization/docker/default.nix | 7 ++++++- .../nixos/virtualization/podman/default.nix | 7 ++++++- 36 files changed, 268 insertions(+), 94 deletions(-) diff --git a/modules/nixos/desktop/apps/games/minecraft/default.nix b/modules/nixos/desktop/apps/games/minecraft/default.nix index b70a133..68197e5 100644 --- a/modules/nixos/desktop/apps/games/minecraft/default.nix +++ b/modules/nixos/desktop/apps/games/minecraft/default.nix @@ -48,6 +48,11 @@ in { }); }; - ${namespace}.services.storage.impermanence.folders = ["/srv/minecraft"]; + ${namespace}.services.storage.impermanence.folders = [ + { + directory = "/srv/minecraft"; + mode = "700"; + } + ]; }; } diff --git a/modules/nixos/desktop/apps/games/terraria/default.nix b/modules/nixos/desktop/apps/games/terraria/default.nix index ae81a54..cd36dcd 100644 --- a/modules/nixos/desktop/apps/games/terraria/default.nix +++ b/modules/nixos/desktop/apps/games/terraria/default.nix @@ -31,6 +31,11 @@ in { port = cfg.port; }; - ${namespace}.services.storage.impermanence.folders = ["/srv/terraria"]; + ${namespace}.services.storage.impermanence.folders = [ + { + directory = "/srv/terraria"; + mode = "700"; + } + ]; }; } diff --git a/modules/nixos/desktop/apps/teamviewer/default.nix b/modules/nixos/desktop/apps/teamviewer/default.nix index 30a38c4..1c9d2d5 100644 --- a/modules/nixos/desktop/apps/teamviewer/default.nix +++ b/modules/nixos/desktop/apps/teamviewer/default.nix @@ -19,6 +19,15 @@ in { services.teamviewer = enabled; - ${namespace}.services.storage.impermanence.folders = ["/var/lib/teamviewer"]; + ${namespace}.services.storage.impermanence.folders = let + inherit (config.users.users) teamviewer; + in [ + { + directory = "/var/lib/teamviewer"; + user = teamviewer.name; + group = teamviewer.group; + mode = "700"; + } + ]; }; } diff --git a/modules/nixos/desktop/env/greetd/default.nix b/modules/nixos/desktop/env/greetd/default.nix index ad7b226..ea0bba4 100644 --- a/modules/nixos/desktop/env/greetd/default.nix +++ b/modules/nixos/desktop/env/greetd/default.nix @@ -25,6 +25,15 @@ in { ''; }; - ${namespace}.services.storage.impermanence.folders = ["/var/cache/tuigreet"]; + ${namespace}.services.storage.impermanence.folders = let + inherit (config.users.users) greeter; + in [ + { + directory = "/var/cache/tuigreet"; + user = greeter.name; + group = greeter.group; + mode = "700"; + } + ]; }; } diff --git a/modules/nixos/hardware/bluetooth/default.nix b/modules/nixos/hardware/bluetooth/default.nix index 7369aa4..7209eea 100644 --- a/modules/nixos/hardware/bluetooth/default.nix +++ b/modules/nixos/hardware/bluetooth/default.nix @@ -21,6 +21,11 @@ in { powerOnBoot = true; }; - ${namespace}.services.storage.impermanence.folders = ["/var/lib/bluetooth"]; + ${namespace}.services.storage.impermanence.folders = [ + { + directory = "/var/lib/bluetooth"; + mode = "700"; + } + ]; }; } diff --git a/modules/nixos/hardware/fingerprint/default.nix b/modules/nixos/hardware/fingerprint/default.nix index c0ebff8..cda4324 100644 --- a/modules/nixos/hardware/fingerprint/default.nix +++ b/modules/nixos/hardware/fingerprint/default.nix @@ -18,6 +18,11 @@ in { enable = true; }; - ${namespace}.services.storage.impermanence.folders = ["/var/lib/fprint"]; + ${namespace}.services.storage.impermanence.folders = [ + { + directory = "/var/lib/fprint"; + mode = "700"; + } + ]; }; } diff --git a/modules/nixos/services/apps/forgejo/default.nix b/modules/nixos/services/apps/forgejo/default.nix index faa045a..aecbcbb 100644 --- a/modules/nixos/services/apps/forgejo/default.nix +++ b/modules/nixos/services/apps/forgejo/default.nix @@ -105,6 +105,8 @@ in { sops.secrets."forgejo/db" = {}; - ${namespace}.services.storage.impermanence.folders = ["/var/lib/forgejo"]; + ${namespace}.services.storage.impermanence.folders = [ + "/var/lib/forgejo" + ]; }; } diff --git a/modules/nixos/services/apps/ignis/default.nix b/modules/nixos/services/apps/ignis/default.nix index d33be87..a3cc502 100644 --- a/modules/nixos/services/apps/ignis/default.nix +++ b/modules/nixos/services/apps/ignis/default.nix @@ -110,8 +110,15 @@ in { networking.firewall.allowedTCPPorts = [port]; - ${namespace}.services.storage.impermanence.folders = [ - "/var/lib/ignis" + ${namespace}.services.storage.impermanence.folders = let + inherit (config.users.users) ignis; + in [ + { + directory = "/var/lib/ignis"; + user = ignis.name; + group = ignis.group; + mode = "700"; + } ]; }; } diff --git a/modules/nixos/services/apps/immich/default.nix b/modules/nixos/services/apps/immich/default.nix index 825c2c6..dc19e9f 100644 --- a/modules/nixos/services/apps/immich/default.nix +++ b/modules/nixos/services/apps/immich/default.nix @@ -45,12 +45,12 @@ in { sops.secrets."environment-file/immich" = {}; ${namespace}.services.storage.impermanence.folders = let - immichUser = config.users.users.immichUser; + inherit (config.users.users) immich; in [ { directory = "/var/lib/immich"; - user = immichUser.name; - group = immichUser.group; + user = immich.name; + group = immich.group; mode = "700"; } ]; diff --git a/modules/nixos/services/apps/miasma/default.nix b/modules/nixos/services/apps/miasma/default.nix index 3c8a803..343c5ce 100644 --- a/modules/nixos/services/apps/miasma/default.nix +++ b/modules/nixos/services/apps/miasma/default.nix @@ -26,15 +26,15 @@ in { systemd.services.miasma = { description = "Trap AI web scrapers in an endless poison pit"; wantedBy = ["multi-user.target"]; - serviceConfig = let - miasmaUser = config.users.users.miasma; - in { + serviceConfig = let + inherit (config.users.users) miasma; + in { Type = "simple"; Restart = "always"; RestartSec = 1; - User = miasmaUser.name; - Group = miasmaUser.group; + User = miasma.name; + Group = miasma.group; StateDirectory = "miasma"; ReadWritePaths = "/var/lib/miasma"; diff --git a/modules/nixos/services/apps/prometheus/default.nix b/modules/nixos/services/apps/prometheus/default.nix index dc2a196..96a84db 100644 --- a/modules/nixos/services/apps/prometheus/default.nix +++ b/modules/nixos/services/apps/prometheus/default.nix @@ -19,8 +19,15 @@ in { port = port; }; - ${namespace}.services.storage.impermanence.folders = [ - "/var/lib/prometheus2" + ${namespace}.services.storage.impermanence.folders = let + inherit (config.users.users) prometheus; + in [ + { + directory = "/var/lib/prometheus2"; + user = prometheus.name; + group = prometheus.group; + mode = "700"; + } ]; }; } diff --git a/modules/nixos/services/apps/qbittorrent/default.nix b/modules/nixos/services/apps/qbittorrent/default.nix index 9875db8..049f405 100644 --- a/modules/nixos/services/apps/qbittorrent/default.nix +++ b/modules/nixos/services/apps/qbittorrent/default.nix @@ -231,19 +231,18 @@ in { }; ${namespace}.services.storage.impermanence.folders = let - qbittorrentUser = config.users.users.qbittorrent; - quiUser = config.users.users.qui; + inherit (config.users.users) qbittorrent qui; in [ { directory = "/var/lib/qBittorrent"; - user = qbittorrentUser.name; - group = qbittorrentUser.group; + user = qbittorrent.name; + group = qbittorrent.group; mode = "770"; } { directory = "/var/lib/qui"; - user = quiUser.name; - group = quiUser.group; + user = qui.name; + group = qui.group; mode = "700"; } ]; diff --git a/modules/nixos/services/apps/rustypaste/default.nix b/modules/nixos/services/apps/rustypaste/default.nix index b3eb550..15a3326 100644 --- a/modules/nixos/services/apps/rustypaste/default.nix +++ b/modules/nixos/services/apps/rustypaste/default.nix @@ -74,6 +74,15 @@ in { networking.firewall.allowedTCPPorts = [port]; - ${namespace}.services.storage.impermanence.folders = ["/var/lib/rustypaste"]; + ${namespace}.services.storage.impermanence.folders = let + inherit (config.users.users) rustypaste; + in [ + { + directory = "/var/lib/rustypaste"; + user = rustypaste.name; + group = rustypaste.group; + mode = "700"; + } + ]; }; } diff --git a/modules/nixos/services/apps/servarr/autobrr/default.nix b/modules/nixos/services/apps/servarr/autobrr/default.nix index 23f1920..75c007d 100644 --- a/modules/nixos/services/apps/servarr/autobrr/default.nix +++ b/modules/nixos/services/apps/servarr/autobrr/default.nix @@ -45,7 +45,7 @@ in { }; services.autobrr = let - autobrrUser = config.users.users.autobrr; + inherit (config.users.users) autobrr; in mkMerge [ { @@ -54,8 +54,8 @@ in { ]; serviceConfig = { DynamicUser = mkForce false; - User = autobrrUser.name; - Group = autobrrUser.group; + User = autobrr.name; + Group = autobrr.group; UMask = mkForce "0002"; EnvironmentFile = config.sops.secrets."environment-file/autobrr".path; }; @@ -84,12 +84,12 @@ in { }; ${namespace}.services.storage.impermanence.folders = let - autobrrUser = config.users.users.autobrr; + inherit (config.users.users) autobrr; in [ { directory = "/var/lib/autobrr"; - user = autobrrUser.name; - group = autobrrUser.group; + user = autobrr.name; + group = autobrr.group; mode = "700"; } ]; diff --git a/modules/nixos/services/apps/servarr/bazarr/default.nix b/modules/nixos/services/apps/servarr/bazarr/default.nix index 24f14ae..417c0f4 100644 --- a/modules/nixos/services/apps/servarr/bazarr/default.nix +++ b/modules/nixos/services/apps/servarr/bazarr/default.nix @@ -22,7 +22,7 @@ in { }; systemd.services.bazarr = let - bazarrUser = config.users.users.bazarr; + inherit (config.users.users) bazarr; dbIp = resolveDatabaseIP networkCfg.devices pgCfg.databases "bazarr"; in mkMerge [ @@ -37,8 +37,8 @@ in { serviceConfig = { DynamicUser = mkForce false; - User = bazarrUser.name; - Group = bazarrUser.group; + User = bazarr.name; + Group = bazarr.group; UMask = mkForce "0002"; EnvironmentFile = config.sops.secrets."environment-file/bazarr".path; }; @@ -63,12 +63,12 @@ in { sops.secrets."environment-file/bazarr" = {}; ${namespace}.services.storage.impermanence.folders = let - bazarrUser = config.users.users.bazarr; + inherit (config.users.users) bazarr; in [ { directory = "/var/lib/bazarr"; - user = bazarrUser.name; - group = bazarrUser.group; + user = bazarr.name; + group = bazarr.group; mode = "700"; } ]; diff --git a/modules/nixos/services/apps/servarr/jellyfin/default.nix b/modules/nixos/services/apps/servarr/jellyfin/default.nix index 0e97288..3082435 100644 --- a/modules/nixos/services/apps/servarr/jellyfin/default.nix +++ b/modules/nixos/services/apps/servarr/jellyfin/default.nix @@ -51,12 +51,12 @@ in { }; ${namespace}.services.storage.impermanence.folders = let - jellyfinUser = config.users.users.jellyfin; + inherit (config.users.users) jellyfin; in [ { directory = "/var/lib/jellyfin"; - user = jellyfinUser.name; - group = jellyfinUser.group; + user = jellyfin.name; + group = jellyfin.group; mode = "700"; } ]; diff --git a/modules/nixos/services/apps/servarr/lidarr/default.nix b/modules/nixos/services/apps/servarr/lidarr/default.nix index 7f0249b..3a0dd41 100644 --- a/modules/nixos/services/apps/servarr/lidarr/default.nix +++ b/modules/nixos/services/apps/servarr/lidarr/default.nix @@ -36,14 +36,14 @@ in { }; systemd.services.lidarr = let - lidarrUser = config.users.users.lidarr; + inherit (config.users.users) lidarr; in mkMerge [ { serviceConfig = { DynamicUser = mkForce false; - User = lidarrUser.name; - Group = lidarrUser.group; + User = lidarr.name; + Group = lidarr.group; UMask = mkForce "0002"; }; } @@ -67,12 +67,12 @@ in { sops.secrets."environment-file/lidarr" = {}; ${namespace}.services.storage.impermanence.folders = let - lidarrUser = config.users.users.lidarr; + inherit (config.users.users) lidarr; in [ { directory = "/var/lib/lidarr"; - user = lidarrUser.name; - group = lidarrUser.group; + user = lidarr.name; + group = lidarr.group; mode = "700"; } ]; diff --git a/modules/nixos/services/apps/servarr/ombi/default.nix b/modules/nixos/services/apps/servarr/ombi/default.nix index e7972e9..9e50ab1 100644 --- a/modules/nixos/services/apps/servarr/ombi/default.nix +++ b/modules/nixos/services/apps/servarr/ombi/default.nix @@ -30,12 +30,12 @@ in { }; ${namespace}.services.storage.impermanence.folders = let - ombiUser = config.users.users.ombi; + inherit (config.users.users) ombi; in [ { directory = "/var/lib/ombi"; - user = ombiUser.name; - group = ombiUser.group; + user = ombi.name; + group = ombi.group; mode = "700"; } ]; diff --git a/modules/nixos/services/apps/servarr/prowlarr/default.nix b/modules/nixos/services/apps/servarr/prowlarr/default.nix index 81e5821..55890dd 100644 --- a/modules/nixos/services/apps/servarr/prowlarr/default.nix +++ b/modules/nixos/services/apps/servarr/prowlarr/default.nix @@ -36,14 +36,14 @@ in { }; systemd.services.prowlarr = let - prowlarrUser = config.users.users.prowlarr; + inherit (config.users.users) prowlarr; in mkMerge [ { serviceConfig = { DynamicUser = mkForce false; - User = prowlarrUser.name; - Group = prowlarrUser.group; + User = prowlarr.name; + Group = prowlarr.group; UMask = mkForce "0002"; }; } @@ -67,12 +67,12 @@ in { sops.secrets."environment-file/prowlarr" = {}; ${namespace}.services.storage.impermanence.folders = let - prowlarrUser = config.users.users.prowlarr; + inherit (config.users.users) prowlarr; in [ { directory = "/var/lib/prowlarr"; - user = prowlarrUser.name; - group = prowlarrUser.group; + user = prowlarr.name; + group = prowlarr.group; mode = "700"; } ]; diff --git a/modules/nixos/services/apps/servarr/radarr/default.nix b/modules/nixos/services/apps/servarr/radarr/default.nix index 27cb864..2ab953d 100644 --- a/modules/nixos/services/apps/servarr/radarr/default.nix +++ b/modules/nixos/services/apps/servarr/radarr/default.nix @@ -36,14 +36,14 @@ in { }; systemd.services.radarr = let - radarrUser = config.users.users.radarr; + inherit (config.users.users) radarr; in mkMerge [ { serviceConfig = { DynamicUser = mkForce false; - User = radarrUser.name; - Group = radarrUser.group; + User = radarr.name; + Group = radarr.group; UMask = mkForce "0002"; }; } @@ -67,12 +67,12 @@ in { sops.secrets."environment-file/radarr" = {}; ${namespace}.services.storage.impermanence.folders = let - radarrUser = config.users.users.radarr; + inherit (config.users.users) radarr; in [ { directory = "/var/lib/radarr"; - user = radarrUser.name; - group = radarrUser.group; + user = radarr.name; + group = radarr.group; mode = "700"; } ]; diff --git a/modules/nixos/services/apps/servarr/seerr/default.nix b/modules/nixos/services/apps/servarr/seerr/default.nix index d0a2984..28e3b1b 100644 --- a/modules/nixos/services/apps/servarr/seerr/default.nix +++ b/modules/nixos/services/apps/servarr/seerr/default.nix @@ -23,7 +23,7 @@ in { }; systemd.services.seerr = let - seerrUser = config.users.users.seerr; + inherit (config.users.users) seerr; dbIp = resolveDatabaseIP networkCfg.devices pgCfg.databases "seerr"; in mkMerge [ @@ -38,8 +38,8 @@ in { serviceConfig = { DynamicUser = mkForce false; - User = seerrUser.name; - Group = seerrUser.group; + User = seerr.name; + Group = seerr.group; EnvironmentFile = config.sops.secrets."environment-file/seerr".path; }; } @@ -62,12 +62,12 @@ in { sops.secrets."environment-file/seerr" = {}; ${namespace}.services.storage.impermanence.folders = let - seerrUser = config.users.users.seerr; + inherit (config.users.users) seerr; in [ { directory = "/var/lib/seerr"; - user = seerrUser.name; - group = seerrUser.group; + user = seerr.name; + group = seerr.group; mode = "700"; } ]; diff --git a/modules/nixos/services/apps/servarr/sonarr/default.nix b/modules/nixos/services/apps/servarr/sonarr/default.nix index 52c5df6..4fa0a34 100644 --- a/modules/nixos/services/apps/servarr/sonarr/default.nix +++ b/modules/nixos/services/apps/servarr/sonarr/default.nix @@ -36,14 +36,14 @@ in { }; systemd.services.sonarr = let - sonarrUser = config.users.users.sonarr; + inherit (config.users.users) sonarr; in mkMerge [ { serviceConfig = { DynamicUser = mkForce false; - User = sonarrUser.name; - Group = sonarrUser.group; + User = sonarr.name; + Group = sonarr.group; UMask = mkForce "0002"; }; } @@ -67,12 +67,12 @@ in { sops.secrets."environment-file/sonarr" = {}; ${namespace}.services.storage.impermanence.folders = let - sonarrUser = config.users.users.sonarr; + inherit (config.users.users) sonarr; in [ { directory = "/var/lib/sonarr"; - user = sonarrUser.name; - group = sonarrUser.group; + user = sonarr.name; + group = sonarr.group; mode = "700"; } ]; diff --git a/modules/nixos/services/apps/slurm/default.nix b/modules/nixos/services/apps/slurm/default.nix index c816814..7f5291a 100644 --- a/modules/nixos/services/apps/slurm/default.nix +++ b/modules/nixos/services/apps/slurm/default.nix @@ -123,9 +123,21 @@ in { }; }; - ${namespace}.services.storage.impermanence.folders = [ - "/var/spool/slurmctld" - "/var/spool/slurmd" + ${namespace}.services.storage.impermanence.folders = let + inherit (config.users.users) slurm; + in [ + { + directory = "/var/spool/slurmctld"; + user = slurm.name; + group = slurm.group; + mode = "700"; + } + { + directory = "/var/spool/slurmd"; + user = slurm.name; + group = slurm.group; + mode = "700"; + } ]; }; } diff --git a/modules/nixos/services/apps/uptime-kuma/default.nix b/modules/nixos/services/apps/uptime-kuma/default.nix index bfba734..f60b354 100644 --- a/modules/nixos/services/apps/uptime-kuma/default.nix +++ b/modules/nixos/services/apps/uptime-kuma/default.nix @@ -43,6 +43,15 @@ in { networking.firewall.allowedTCPPorts = [port]; - ${namespace}.services.storage.impermanence.folders = ["/var/lib/uptime-kuma"]; + ${namespace}.services.storage.impermanence.folders = let + inherit (config.users.users) uptime-kuma; + in [ + { + directory = "/var/lib/uptime-kuma"; + user = uptime-kuma.name; + group = uptime-kuma.group; + mode = "700"; + } + ]; }; } diff --git a/modules/nixos/services/apps/vaultwarden/default.nix b/modules/nixos/services/apps/vaultwarden/default.nix index e7b28ac..b9b0261 100644 --- a/modules/nixos/services/apps/vaultwarden/default.nix +++ b/modules/nixos/services/apps/vaultwarden/default.nix @@ -64,5 +64,16 @@ in { sops.secrets."vaultwarden" = {}; networking.firewall.allowedTCPPorts = [port]; + + ${namespace}.services.storage.impermanence.folders = let + inherit (config.users.users) vaultwarden; + in [ + { + directory = "/var/lib/vaultwarden"; + user = vaultwarden.name; + group = vaultwarden.group; + mode = "700"; + } + ]; }; } diff --git a/modules/nixos/services/ci/github-runner/default.nix b/modules/nixos/services/ci/github-runner/default.nix index 6de6948..90e8634 100644 --- a/modules/nixos/services/ci/github-runner/default.nix +++ b/modules/nixos/services/ci/github-runner/default.nix @@ -102,6 +102,15 @@ in { sops.secrets."github/runner" = {}; - ${namespace}.services.storage.impermanence.folders = ["/var/lib/github-runner"]; + ${namespace}.services.storage.impermanence.folders = let + inherit (config.users.users) github-runner; + in [ + { + directory = "/var/lib/github-runner"; + user = github-runner.name; + group = github-runner.group; + mode = "700"; + } + ]; }; } diff --git a/modules/nixos/services/networking/network-manager/default.nix b/modules/nixos/services/networking/network-manager/default.nix index a37dcbd..6d720ab 100644 --- a/modules/nixos/services/networking/network-manager/default.nix +++ b/modules/nixos/services/networking/network-manager/default.nix @@ -19,6 +19,11 @@ in { networking.networkmanager.enable = true; - ${namespace}.services.storage.impermanence.folders = ["/etc/NetworkManager/system-connections"]; + ${namespace}.services.storage.impermanence.folders = [ + { + directory = "/etc/NetworkManager/system-connections"; + mode = "700"; + } + ]; }; } diff --git a/modules/nixos/services/networking/tailscale/default.nix b/modules/nixos/services/networking/tailscale/default.nix index 323b04a..e26b1ae 100644 --- a/modules/nixos/services/networking/tailscale/default.nix +++ b/modules/nixos/services/networking/tailscale/default.nix @@ -19,6 +19,13 @@ in { useRoutingFeatures = "server"; }; - ${namespace}.services.storage.impermanence.folders = ["/var/lib/tailscale"]; + ${namespace}.services.storage.impermanence.folders = [ + { + directory = "/var/lib/tailscale"; + user = "tailscale"; + group = "tailscale"; + mode = "700"; + } + ]; }; } diff --git a/modules/nixos/services/security/acme/default.nix b/modules/nixos/services/security/acme/default.nix index 07fdab1..c124b02 100644 --- a/modules/nixos/services/security/acme/default.nix +++ b/modules/nixos/services/security/acme/default.nix @@ -37,8 +37,15 @@ in { "cloudflare/acme-token" = {}; }; - ${namespace}.services.storage.impermanence.folders = [ - "/var/lib/acme" + ${namespace}.services.storage.impermanence.folders = let + inherit (config.users.users) acme; + in [ + { + directory = "/var/lib/acme"; + user = acme.name; + group = acme.group; + mode = "700"; + } ]; }; } diff --git a/modules/nixos/services/storage/nfs/default.nix b/modules/nixos/services/storage/nfs/default.nix index 2697104..886007d 100644 --- a/modules/nixos/services/storage/nfs/default.nix +++ b/modules/nixos/services/storage/nfs/default.nix @@ -51,8 +51,16 @@ in { }; ${namespace}.services.storage.impermanence.folders = mkMerge [ - ["/var/lib/nfs"] - (mkIf (cfg.shares != []) (cfg.shares |> map (s: "/mnt/nfs/${s.name}"))) + [ + { + directory = "/var/lib/nfs"; + mode = "700"; + } + ] + (mkIf (cfg.shares != []) (cfg.shares |> map (s: { + directory = "/mnt/nfs/${s.name}"; + mode = "700"; + }))) ]; networking.firewall.allowedTCPPorts = [2049]; diff --git a/modules/nixos/services/storage/postgresql/default.nix b/modules/nixos/services/storage/postgresql/default.nix index b09c096..bd8b774 100644 --- a/modules/nixos/services/storage/postgresql/default.nix +++ b/modules/nixos/services/storage/postgresql/default.nix @@ -91,8 +91,15 @@ in { }; }; - ${namespace}.services.storage.impermanence.folders = [ - "/var/lib/postgresql" + ${namespace}.services.storage.impermanence.folders = let + inherit (config.users.users) postgres; + in [ + { + directory = "/var/lib/postgresql"; + user = postgres.name; + group = postgres.group; + mode = "700"; + } ]; systemd.services.postgresql-setup.postStart = '' diff --git a/modules/nixos/services/storage/postgresql/pgbouncer.nix b/modules/nixos/services/storage/postgresql/pgbouncer.nix index 8a56a72..ba38802 100644 --- a/modules/nixos/services/storage/postgresql/pgbouncer.nix +++ b/modules/nixos/services/storage/postgresql/pgbouncer.nix @@ -71,8 +71,15 @@ in { }; }; - ${namespace}.services.storage.impermanence.folders = [ - "/var/lib/pgbouncer" + ${namespace}.services.storage.impermanence.folders = let + inherit (config.users.users) pgbouncer; + in [ + { + directory = "/var/lib/pgbouncer"; + user = pgbouncer.name; + group = pgbouncer.group; + mode = "700"; + } ]; }); } diff --git a/modules/nixos/services/storage/samba/default.nix b/modules/nixos/services/storage/samba/default.nix index 6f985db..41864f7 100644 --- a/modules/nixos/services/storage/samba/default.nix +++ b/modules/nixos/services/storage/samba/default.nix @@ -75,8 +75,16 @@ in { }; ${namespace}.services.storage.impermanence.folders = mkMerge [ - ["/var/lib/samba"] - (mkIf (cfg.shares != []) (cfg.shares |> map (s: "/mnt/samba/${s}"))) + [ + { + directory = "/var/lib/samba"; + mode = "700"; + } + ] + (mkIf (cfg.shares != []) (cfg.shares |> map (s: { + directory = "/mnt/samba/${s}"; + mode = "700"; + }))) ]; }; } diff --git a/modules/nixos/services/storage/syncthing/default.nix b/modules/nixos/services/storage/syncthing/default.nix index a91d743..8c50b10 100644 --- a/modules/nixos/services/storage/syncthing/default.nix +++ b/modules/nixos/services/storage/syncthing/default.nix @@ -74,7 +74,19 @@ in { systemd.services.syncthing.environment.STNODEFAULTFOLDER = "true"; ${namespace}.services.storage.impermanence.folders = mkIf cfg.enable ( - ["/mnt/syncthing"] ++ (builtins.attrNames cfg.shares |> map (k: "/mnt/syncthing/${k}")) + [ + { + directory = "/mnt/syncthing"; + user = "c4patino"; + group = "syncthing"; + mode = "700"; + } + ] ++ (builtins.attrNames cfg.shares |> map (k: { + directory = "/mnt/syncthing/${k}"; + user = "c4patino"; + group = "syncthing"; + mode = "700"; + })) ); }; } diff --git a/modules/nixos/virtualization/docker/default.nix b/modules/nixos/virtualization/docker/default.nix index b363855..c17a425 100644 --- a/modules/nixos/virtualization/docker/default.nix +++ b/modules/nixos/virtualization/docker/default.nix @@ -48,6 +48,11 @@ in { networking.firewall.allowedTCPPorts = [2376]; - ${namespace}.services.storage.impermanence.folders = ["/var/lib/docker"]; + ${namespace}.services.storage.impermanence.folders = [ + { + directory = "/var/lib/docker"; + mode = "700"; + } + ]; }; } diff --git a/modules/nixos/virtualization/podman/default.nix b/modules/nixos/virtualization/podman/default.nix index d329731..71528df 100644 --- a/modules/nixos/virtualization/podman/default.nix +++ b/modules/nixos/virtualization/podman/default.nix @@ -30,6 +30,11 @@ in { podman = enabled; }; - ${namespace}.services.storage.impermanence.folders = ["/var/lib/containers"]; + ${namespace}.services.storage.impermanence.folders = [ + { + directory = "/var/lib/containers"; + mode = "700"; + } + ]; }; }