update persist and secrets modules

modules/persist.nix

@@ -6,7 +6,7 @@ let
 
   persists = with cfg; [ state derivative cache ];
 
-  absoluteHomeFiles = map (x: "${cfg.homeDir}/${x}");
+  absoluteHomePath = map (x: "${cfg.homeDir}/${x}");
 
   allFiles = takeAll "files" persists;
 
@@ -25,38 +25,110 @@ in {
   options = let
     inherit (lib) mkOption mkEnableOption;
     inherit (lib.types) listOf path str either submodule enum;
+
+    # defaultPerms = {
+    #   mode = "0755";
+    #   user = "root";
+    #   group = "root";
+    # };
+    # dirPermsOpts = { user, group, mode }: {
+    #   user = mkOption {
+    #     type = str;
+    #     default = user;
+    #   };
+    #   group = mkOption {
+    #     type = str;
+    #     default = group;
+    #   };
+    #   mode = mkOption {
+    #     type = str;
+    #     default = mode;
+    #   };
+    # };
+    # fileOpts = perms: {
+    #   options = {
+    #     file = mkOption {
+    #       type = str;
+    #     };
+    #     parentDirectory = dirPermsOpts perms;
+    #   };
+    # };
+    # dirOpts = perms: {
+    #   options = {
+    #     directory = mkOption {
+    #       type = str;
+    #     };
+    #   } // (dirPermsOpts perms);
+    # };
+    # userDefaultPerms = {
+    #   inherit (defaultPerms) mode;
+    #   user = config.mainuser;
+    #   group = config.users.${userDefaultPerms.user}.group;
+    # };
+    # rootFile = submodule [
+    #   (fileOpts defaultPerms)
+    # ];
+    # rootDir = submodule [
+    #   (dirOpts defaultPerms)
+    # ];
+    # userFile = submodule [
+    #   (fileOpts userDefaultPerms)
+    # ];
+    # userDir = submodule [
+    #   (dirOpts userDefaultPerms)
+    # ];
+
     common = {
       directories = mkOption {
-        type = listOf path;
+        # type = listOf (either str (submodule {
-        default = [ ];
+        #   options = {
-      };
+        #     directory = mkOption {
-      files = mkOption {
+        #       type = str;
+        #       default = null;
+        #     };
+        #     user = mkOption {
+        #       type = str;
+        #       default = "root";
+        #     };
+        #     group = mkOption {
+        #       type = str;
+        #       default = "root";
+        #     };
+        #     mode = mkOption {
+        #       type = str;
+        #       default = "0755";
+        #     };
+        #   };
+        # }));
+        # type = listOf (either str rootDir);
+        type = listOf str;
+        default = [ ];
+      };
+      files = mkOption {
+        # type = listOf (either str rootFile);
         type = listOf str;
         default = [ ];
       };
-      # homeDirectories = mkOption {
-      #   type = listOf str;
-      #   default = [ ];
-      # };
       homeFiles = mkOption {
+        # type = listOf (either str userFile);
         type = listOf str;
         default = [ ];
       };
       homeDirectories = mkOption {
-        type = listOf (either str (submodule {
+        # type = listOf (either str (submodule {
-          options = {
+        #   options = {
-            directory = mkOption {
+        #     directory = mkOption {
-              type = str;
+        #       type = str;
-              default = null;
+        #       default = null;
-              description = "The directory path to be linked.";
+        #     };
-            };
+        #     method = mkOption {
-            method = mkOption {
+        #       type = enum [ "bindfs" "symlink" ];
-              type = enum [ "bindfs" "symlink" ];
+        #       default = "bindfs";
-              default = "bindfs";
+        #     };
-              description = "The linking method that should be used for this directory.";
+        #   };
-            };
+        # }));
-          };
+        # type = listOf (either str userDir);
-        }));
+        type = listOf str;
         default = [ ];
       };
     };
@@ -104,23 +176,14 @@ in {
   imports = [ inputs.impermanence.nixosModules.impermanence ];
 
   config = mkIf cfg.enable {
-    # FIXME: use symlink instead of bind mounts?
-    # programs.fuse.userAllowOther = true;
-
     environment.persistence.${cfg.persistRoot} = {
+      hideMounts = true;
       directories = allDirectories;
       files = allFiles;
-    };
+      users.${config.mainuser} = {
-
+        home = "/home/${config.mainuser}";
-    home-manager.users.${config.mainuser} = {
-      imports = [ inputs.impermanence.nixosModules.home-manager.impermanence ];
-      home.persistence."${cfg.persistRoot}${homeDirectory}" = {
         directories = allHomeDirectories;
         files = allHomeFiles;
-        # FIXME: use symlink instead of bind mounts?
-        # allowOther = true;
-        allowOther = false;
-        removePrefixDirectory = false;
       };
     };
 
@@ -141,25 +204,27 @@ in {
         '';
     };
 
-    # Euuuugh
     systemd.services.persist-cache-cleanup = lib.mkIf cfg.cache.clean.enable {
       description = "Cleaning up cache files and directories";
       script = ''
         ${builtins.concatStringsSep "\n" (map (x: "rm ${lib.escapeShellArg x}")
           (cfg.cache.files
-            ++ absoluteHomeFiles cfg.cache.homeFiles))}
+            ++ absoluteHomePath cfg.cache.homeFiles))}
 
         ${builtins.concatStringsSep "\n" (map (x: "rm -rf ${lib.escapeShellArg x}")
-          (cfg.cache.directories ++ cfg.cache.homeDirectories))}
+          (cfg.cache.directories ++ absoluteHomePath cfg.cache.homeDirectories))}
       '';
       startAt = cfg.cache.clean.dates;
     };
 
-    # system.activationScripts = {
+    system.activationScripts = {
-    #   homedir.text = builtins.concatStringsSep "\n" (map (dir: ''
+      homedir.text = builtins.concatStringsSep "\n" (map (dir: ''
-    #     mkdir -p ${cfg.persistRoot}${dir}
+        mkdir -p ${cfg.persistRoot}${dir}
-    #     chown ${config.mainuser}:users ${cfg.persistRoot}${dir}
+        chown ${config.mainuser}:users ${cfg.persistRoot}${dir}
-    #   '') (builtins.filter (lib.hasPrefix homeDirectory) allDirectories));
+      '') (
-    # };
+        (builtins.filter (lib.hasPrefix cfg.homeDir) allDirectories)
+          ++ absoluteHomePath allHomeDirectories
+      ));
+    };
   };
 }

modules/secrets.nix

@@ -65,20 +65,21 @@ let
   '';
 
   decrypt = name: cfg:
-    with cfg; {
+    with cfg; let
+      doas-user = "/run/wrappers/bin/doas -u ${user}";
+    in {
       "${name}-secrets" = rec {
-
         wantedBy = [ "multi-user.target" ];
         requires = [ "user@1000.service" ];
         after = requires;
 
         preStart = ''
-          stat '${encrypted}'
+          ${doas-user} stat '${encrypted}'
           mkdir -p '${builtins.dirOf decrypted}'
         '';
 
         script = ''
-          if cat '${encrypted}' | /run/wrappers/bin/doas -u ${user} ${cfg.decrypt} > '${decrypted}.tmp'; then
+          if ${doas-user} cat '${encrypted}' | ${doas-user} ${cfg.decrypt} > '${decrypted}.tmp'; then
             mv -f '${decrypted}.tmp' '${decrypted}'
             chown '${owner}' '${decrypted}'
             chmod '${permissions}' '${decrypted}'
@@ -200,10 +201,12 @@ in {
   }];
 
   config.persist.derivative.directories = [ "/var/secrets" ];
-  config.persist.derivative.homeDirectories = [{
+  # config.persist.derivative.homeDirectories = [ password-store-relative ];
-    directory = password-store-relative;
+  config.persist.derivative.homeDirectories = [ ".local/share/password-store" ];
-    method = "symlink";
+  # config.persist.derivative.homeDirectories = [{
-  }];
+  #   directory = password-store-relative;
+  #   method = "symlink";
+  # }];
 
   config.home-manager.users.${config.mainuser} = {
     systemd.user.services.activate-secrets = let

profiles/servers/vscode-server.nix

@@ -3,20 +3,18 @@
     inputs.vscode-server-fixup.nixosModules.home-manager.nixos-vscode-server
   ];
 
-  home-manager.users.${config.mainuser} = {
+  home-manager.users.${config.mainuser} = let
+    extensions = builtins.tryEval config.home-manager.users.${config.mainuser}.programs.vscode.extensions;
+  in {
     services.vscode-server = {
       enable = true;
-      extensions =
+      extensions = if extensions.success then extensions.value
-        with inputs.nix-vscode-marketplace.packages.${pkgs.system}.vscode;
+      else with inputs.nix-vscode-marketplace.packages.${pkgs.system}.vscode; [
-        # [ jnoortheen.nix-ide ];
+        bbenoist.nix
-        [ bbenoist.nix ];
+      ];
       immutableExtensionsDir = true;
-      # settings = {
-      #  "nix.enableLanguageServer" = true;
-      #  "nix.serverPath" = "${inputs.rnix-lsp.defaultPackage.${pkgs.system}}/bin/rnix-lsp";
-      # };
     };
   };
 
-  # persist.state.homeDirectories = [ ".vscode-server" ];
+  persist.state.homeDirectories = [ ".vscode-server" ];
 }

profiles/workspace/gpg.nix

@@ -25,6 +25,5 @@ with config.deviceSpecific; {
       };
     };
   };
-
   persist.state.homeDirectories = [ ".local/share/gnupg" ];
 }

profiles/workspace/misc.nix

@@ -52,13 +52,16 @@
     "/var/lib/systemd"
   ] ++ lib.optionals config.services.postgresql.enable [
     config.services.postgresql.dataDir
+  ] ++ lib.optionals config.services.mysql.enable [
+    config.services.mysql.dataDir
   ];
   persist.state.homeDirectories = [
     "projects"
-    {
+    "nixos-config"
-      directory = "nixos-config";
+    # {
-      method = "symlink";
+    #   directory = "nixos-config";
-    }
+    #   method = "symlink";
+    # }
   ] ++ lib.optionals (!config.deviceSpecific.isServer) [
     "games"
     # "persist"

profiles/workspace/zsh/default.nix

@@ -110,5 +110,5 @@
     };
   };
 
-  persist.state.homeFiles = [ ".local/share/zsh/history" ];
+  persist.state.homeDirectories = [ ".local/share/zsh" ];
 }