initial commit

machines/gerd/disk-zfs.nix

@@ -0,0 +1,81 @@
+{ lib, ... }:
+
+let
+  makeZFSDatasets = datasets: (lib.mapAttrs' (n: v: lib.nameValuePair v.dataset ({
+      type = "zfs_fs";
+      mountpoint = n;
+      options.mountpoint = "legacy";
+  } // (if v ? extra then v.extra else {}))) datasets);
+in {
+  disko.devices = {
+    disk.disk1 = {
+      type = "disk";
+      device = lib.mkDefault "/dev/sda";
+      content = {
+        type = "gpt";
+        partitions = {
+          boot = {
+            name = "boot";
+            size = "1M";
+            type = "EF02";
+          };
+          esp = {
+            name = "ESP";
+            size = "500M";
+            type = "EF00";
+            content = {
+              type = "filesystem";
+              format = "vfat";
+              mountpoint = "/boot";
+            };
+          };
+
+          luks = {
+            size = "100%";
+            content = {
+              type = "luks";
+              name = "cryptroot";
+              settings.allowDiscards = true;
+              # passwordFile = "/tmp/luks.pass";
+
+              content = {
+                type = "zfs";
+                pool = "rpool";
+              };
+            };
+          };
+        };
+      };
+    };
+
+    zpool = {
+      rpool = {
+        type = "zpool";
+        # rootFsOptions.compression = "zstd";
+        rootFsOptions = {
+          compression = "on";
+          atime = "off";
+          acltype = "posixacl";
+          xattr = "sa";
+
+          # test
+          # "com.sun:auto-snapshot" = "false";
+          # "com.klarasystems:vdev_zaps_v2" = "false";
+        };
+
+        datasets = let
+          baseDatasets = {
+            "/" = { dataset = "root"; extra = { postCreateHook = "zfs snapshot rpool/root@blank"; }; };
+            "/nix".dataset = "local/nix";
+            "/state/stash".dataset = "local/stash";
+            "/state/home".dataset = "safe/home";
+            "/state/root".dataset = "safe/persistent";
+
+            # extra datasets
+            "/srv/forgejo" = { dataset = "safe/svcs/forgejo"; extra.options.quota = "5G"; };
+          };
+        in (makeZFSDatasets baseDatasets);
+      };
+    };
+  };
+}

machines/gerd/services/forgejo.nix

@@ -0,0 +1,32 @@
+{ config, ... }:
+
+{
+  # https://wiki.nixos.org/wiki/Forgejo
+  services.forgejo = {
+    enable = true;
+
+    stateDir = config.mine.zfsMounts."rpool/safe/svcs/forgejo";
+
+    settings = {
+      server = {
+        DOMAIN = "git.fricloud.dk";
+        ROOT_URL = "https://git.fricloud.dk";
+        HTTPPORT = 3000;
+      };
+
+      service.DISABLE_REGISTRATION = true;
+    };
+    
+  };
+
+  services.nginx = {
+    virtualHosts."git.fricloud.dk" = {
+      forceSSL = true;
+      enableACME = true;
+      extraConfig = ''
+        client_max_body_size 512M;
+      '';
+      locations."/".proxyPass = "http://localhost:3000";
+    };
+  };
+}

machines/gerd/zrepl.nix

@@ -0,0 +1,35 @@
+{
+  services.zrepl = {
+    enable = true;
+    settings.jobs = [
+      {
+        type = "push";
+        name = "safesnapshots";
+
+        filesystems = [
+          "rpool/safe<"
+        ];
+
+        snapshotting = {
+          type = "periodic";
+          interval = "5m";
+          prefix = "zrepl_";
+        };
+
+        pruning = {
+          keep_sender = [
+            {
+              type = "grid";
+              regex = "^zrepl_.*";
+
+              # 1. keep all snapshots for 30 minutes
+              # 2. keep one every 15 minutes for 2 hours
+              # 3. keep one every hour for 1 day
+              grid = "1x30m(keep=all) | 8x15m | 14x1d";
+            }
+          ];
+        };
+      }
+    ];
+  };
+}