WIP: add notes for missing persistence/backup

TODO:
* Look at for more inspiration https://github.com/nix-community/impermanence/pull/108
* Do home-manager
* Common files https://github.com/nix-community/impermanence/issues/10
* Useful config: f77271b249/system/modules/impermanence.nix

modules/nixos/hardware/networking/default.nix

@@ -22,6 +22,16 @@ in
   config = lib.mkMerge [
     (lib.mkIf cfg.wireless.enable {
       networking.networkmanager.enable = true;
+
+      # Persist NetworkManager files
+      my.system.persist.files = [
+        "/var/lib/NetworkManager/secret_key"
+        "/var/lib/NetworkManager/seen-bssids"
+        "/var/lib/NetworkManager/timestamps"
+      ];
+      my.system.persist.directories = [
+        "/etc/NetworkManager/system-connections"
+      ];
     })
   ];
 }

modules/nixos/services/aria/default.nix

@@ -69,6 +69,8 @@ in
       };
     };
 
+    # FIXME: persistence?
+
     # NOTE: unfortunately aria2 does not log connection failures for fail2ban
   };
 }

modules/nixos/services/audiobookshelf/default.nix

@@ -34,6 +34,8 @@ in
       };
     };
 
+    # FIXME: persistence?
+
     services.fail2ban.jails = {
       audiobookshelf = ''
         enabled = true

modules/nixos/services/blog/default.nix

@@ -41,5 +41,12 @@ in
 
     # Those are all subdomains, no problem
     my.services.nginx.virtualHosts = hostsInfo;
+
+    my.system.persist.directories = [
+      "/var/www/blog"
+      "/var/www/cv"
+      "/var/www/dev"
+      "/var/www/key"
+    ];
   };
 }

modules/nixos/services/calibre-web/default.nix

@@ -53,6 +53,11 @@ in
       ];
     };
 
+    my.system.persist.directories = [
+      "/var/lib/${config.services.calibre-web.dataDir}"
+      cfg.libraryPath
+    ];
+
     services.fail2ban.jails = {
       calibre-web = ''
         enabled = true

modules/nixos/services/drone/runner-docker/default.nix

@@ -39,5 +39,7 @@ in
       extraGroups = [ "docker" ]; # Give access to the daemon
     };
     users.groups.drone-runner-docker = { };
+
+    # FIXME: persistence?
   };
 }

modules/nixos/services/drone/runner-exec/default.nix

@@ -63,5 +63,7 @@ in
       group = "drone-runner-exec";
     };
     users.groups.drone-runner-exec = { };
+
+    # FIXME: persistence?
   };
 }

modules/nixos/services/drone/server/default.nix

@@ -50,5 +50,7 @@ in
         inherit (cfg) port;
       };
     };
+
+    # FIXME: persistence?
   };
 }

modules/nixos/services/fail2ban/default.nix

@@ -33,5 +33,7 @@ in
         bantime = "10m";
       };
     };
+
+    # FIXME: persistence?
   };
 }

modules/nixos/services/flood/default.nix

@@ -28,6 +28,8 @@ in
       };
     };
 
+    # FIXME: persistence?
+
     # NOTE: unfortunately flood does not log connection failures for fail2ban
   };
 }

modules/nixos/services/forgejo/default.nix

@@ -147,6 +147,11 @@ in
       ];
     };
 
+    my.system.persist.directories = [
+      config.services.forgejo.lfs.contentDir
+      config.services.forgejo.repositoryRoot
+    ];
+
     services.fail2ban.jails = {
       forgejo = ''
         enabled = true

modules/nixos/services/gitea/default.nix

@@ -131,6 +131,11 @@ in
       ];
     };
 
+    my.system.persist.directories = [
+      config.services.gitea.lfs.contentDir
+      config.services.gitea.repositoryRoot
+    ];
+
     services.fail2ban.jails = {
       gitea = ''
         enabled = true

modules/nixos/services/grocy/default.nix

@@ -37,6 +37,9 @@ in
       useACMEHost = config.networking.domain;
     };
 
+    # FIXME: backup
+    # FIXME: persistence
+
     # NOTE: unfortunately grocy does not log connection failures for fail2ban
   };
 }

modules/nixos/services/indexers/default.nix

@@ -33,6 +33,10 @@ in
           port = jackettPort;
         };
       };
+
+      my.system.persist.directories = [
+        config.services.jackett.dataDir
+      ];
     })
 
     (lib.mkIf cfg.nzbhydra.enable {
@@ -45,6 +49,10 @@ in
           port = nzbhydraPort;
         };
       };
+
+      my.system.persist.directories = [
+        config.services.nzbhydra2.dataDir
+      ];
     })
 
     (lib.mkIf cfg.prowlarr.enable {
@@ -58,6 +66,10 @@ in
         };
       };
 
+      my.system.persist.directories = [
+        "/var/lib/${config.systemd.services.prowlarr.serviceConfig.StateDirectory}"
+      ];
+
       services.fail2ban.jails = {
         prowlarr = ''
           enabled = true

modules/nixos/services/jellyfin/default.nix

@@ -38,6 +38,10 @@ in
       };
     };
 
+    my.system.persist.directories = [
+      "/var/lib/${config.systemd.services.jellyfin.serviceConfig.StateDirectory}"
+    ];
+
     services.fail2ban.jails = {
       jellyfin = ''
         enabled = true

modules/nixos/services/komga/default.nix

@@ -36,6 +36,8 @@ in
       };
     };
 
+    # FIXME: persistence?
+
     services.fail2ban.jails = {
       komga = ''
         enabled = true

modules/nixos/services/lohr/default.nix

@@ -107,5 +107,9 @@ in
         };
       };
     };
+
+    my.system.persist.directories = [
+      "/var/lib/${config.systemd.services.lohr.serviceConfig.StateDirectory}"
+    ];
   };
 }

modules/nixos/services/matrix/default.nix

@@ -214,5 +214,9 @@ in
         config.services.matrix-synapse.dataDir
       ];
     };
+
+    my.system.persist.directories = [
+      config.services.matrix-synapse.dataDir
+    ];
   };
 }

modules/nixos/services/mealie/default.nix

@@ -72,6 +72,9 @@ in
       };
     };
 
+    # FIXME: backup
+    # FIXME: persistence
+
     services.fail2ban.jails = {
       mealie = ''
         enabled = true

modules/nixos/services/miniflux/default.nix

@@ -49,6 +49,9 @@ in
       };
     };
 
+    # FIXME: backup
+    # FIXME: persistence
+
     services.fail2ban.jails = {
       miniflux = ''
         enabled = true

modules/nixos/services/monitoring/default.nix

@@ -130,5 +130,10 @@ in
         inherit (cfg.grafana) port;
       };
     };
+
+    my.system.persist.directories = [
+      config.services.grafana.dataDir
+      "/var/lib/${config.services.prometheus.stateDir}"
+    ];
   };
 }

modules/nixos/services/navidrome/default.nix

@@ -53,6 +53,10 @@ in
       };
     };
 
+    my.system.persist.directories = [
+      "/var/lib/${config.systemd.services.navidrome.serviceConfig.StateDirectory}"
+    ];
+
     services.fail2ban.jails = {
       navidrome = ''
         enabled = true

modules/nixos/services/nextcloud/collabora.nix

@@ -46,5 +46,7 @@ in
         ];
       };
     };
+
+    # FIXME: persistence?
   };
 }

modules/nixos/services/nextcloud/default.nix

@@ -92,6 +92,11 @@ in
       ];
     };
 
+    my.system.persist.directories = [
+      config.services.nextcloud.home
+      config.services.nextcloud.datadir
+    ];
+
     services.fail2ban.jails = {
       nextcloud = ''
         enabled = true

modules/nixos/services/nginx/default.nix

@@ -486,5 +486,9 @@ in
         }
       ];
     };
+
+    my.system.persist.directories = [
+      config.users.user.acme.home
+    ];
   };
 }

modules/nixos/services/paperless/default.nix

@@ -146,5 +146,10 @@ in
         config.services.paperless.mediaDir
       ];
     };
+
+    my.system.persist.directories = [
+      config.services.paperless-ng.dataDir
+      config.services.paperless-ng.mediaDir
+    ];
   };
 }

modules/nixos/services/pdf-edit/default.nix

@@ -54,6 +54,8 @@ in
       };
     };
 
+    # FIXME: persistence?
+
     services.fail2ban.jails = {
       stirling-pdf = ''
         enabled = true

modules/nixos/services/podgrab/default.nix

@@ -51,5 +51,10 @@ in
         inherit (cfg) port;
       };
     };
+
+    my.system.persist.directories = [
+      config.systemd.services.podgrab.environment.CONFIG
+      config.systemd.services.podgrab.environment.DATA
+    ];
   };
 }

modules/nixos/services/postgresql-backup/default.nix

@@ -24,5 +24,9 @@ in
         (config.services.postgresqlBackup.location + "/*.prev.sql.gz")
       ];
     };
+
+    my.system.persist.directories = [
+      config.services.postgresqlBackup.location
+    ];
   };
 }

modules/nixos/services/postgresql/default.nix

@@ -18,6 +18,13 @@ in
       };
     })
 
+    # Only persist directory if the actual service is enabled
+    (lib.mkIf config.services.postgresql.enable {
+      my.system.persist.directories = [
+        config.services.postgresql.dataDir
+      ];
+    })
+
     # Taken from the manual
     (lib.mkIf cfg.upgradeScript {
       environment.systemPackages =

modules/nixos/services/pyload/default.nix

@@ -53,6 +53,9 @@ in
       };
     };
 
+    # FIXME: backup
+    # FIXME: persistence
+
     services.fail2ban.jails = {
       pyload = ''
         enabled = true

modules/nixos/services/quassel/default.nix

@@ -46,5 +46,9 @@ in
       # Because Quassel does not use the socket, I simply trust its connection
       authentication = "host quassel quassel localhost trust";
     };
+
+    my.system.persist.directories = [
+      config.services.quassel.dataDir
+    ];
   };
 }

modules/nixos/services/rss-bridge/default.nix

@@ -22,5 +22,9 @@ in
       forceSSL = true;
       useACMEHost = config.networking.domain;
     };
+
+    my.system.persist.directories = [
+      config.services.rss-bridge.dataDir
+    ];
   };
 }

modules/nixos/services/sabnzbd/default.nix

@@ -24,6 +24,10 @@ in
       };
     };
 
+    my.system.persist.files = [
+      config.services.sabnzbd.configFile
+    ];
+
     services.fail2ban.jails = {
       sabnzbd = ''
         enabled = true

modules/nixos/services/servarr/default.nix

@@ -19,6 +19,11 @@ let
       enable = true;
       group = "media";
     };
+
+    # Thankfully those old style services all define users with homes
+    my.system.persist.directories = [
+      config.users.user.${service}.home
+    ];
   };
 
   mkRedirection = service: {

modules/nixos/services/ssh-server/default.nix

@@ -20,6 +20,13 @@ in
       };
     };
 
+    # Persist SSH keys
+    my.system.persist.files =
+      let
+        pubAndPrivKey = key: [ key.path "${key.path}.pub" ];
+      in
+      lib.concatMap pubAndPrivKey systemConfig.services.openssh.hostKeys;
+
     # Opens the relevant UDP ports.
     programs.mosh.enable = true;
   };

modules/nixos/services/tandoor-recipes/default.nix

@@ -83,6 +83,9 @@ in
       };
     };
 
+    # FIXME: backup
+    # FIXME: persistence
+
     # NOTE: unfortunately tandoor-recipes does not log connection failures for fail2ban
   };
 }

modules/nixos/services/transmission/default.nix

@@ -91,6 +91,10 @@ in
       allowedUDPPorts = [ cfg.peerPort ];
     };
 
+    my.system.persist.directories = [
+      config.services.transmission.home
+    ];
+
     # NOTE: unfortunately transmission does not log connection failures for fail2ban
   };
 }

modules/nixos/services/vikunja/default.nix

@@ -100,6 +100,8 @@ in
       ];
     };
 
+    # FIXME: persistence
+
     # NOTE: unfortunately vikunja does not log connection failures for fail2ban
   };
 }

modules/nixos/services/woodpecker/agent-docker/default.nix

@@ -38,5 +38,7 @@ in
         ];
       };
     };
+
+    # FIXME: persistence?
   };
 }

modules/nixos/services/woodpecker/agent-exec/default.nix

@@ -62,5 +62,7 @@ in
         ];
       };
     };
+
+    # FIXME: persistence?
   };
 }

modules/nixos/services/woodpecker/server/default.nix

@@ -61,5 +61,7 @@ in
         port = cfg.rpcPort;
       };
     };
+
+    # FIXME: persistence
   };
 }

modules/nixos/system/printing/default.nix

@@ -65,5 +65,7 @@ in
       # Allow resolution of '.local' addresses
       nssmdns4 = true;
     };
+
+    # FIXME: persistence?
   };
 }