added disko module, common-config, cleanup, etc.

shared/base/common-config.nix

@@ -0,0 +1,52 @@
+{
+  services = {
+    openssh = {
+      enable = true;
+      openFirewall = true;
+      settings.PasswordAuthentication = false;
+    };
+
+    journald.extraConfig = "SystemMaxUse=100M";
+  };
+
+  nix = {
+    settings.auto-optimise-store = true;
+    gc = {
+      automatic = true;
+      options = "--delete-older-than 7d";
+      dates = "daily";
+    };
+  };
+  
+  # clean on boot
+  boot.tmp.cleanOnBoot = true;
+
+  # enable doas instead of sudo
+  security = {
+    sudo.enable = false;
+
+    doas = {
+      enable = true;
+      extraRules = [{
+        groups = [ "wheel" ];
+        persist = true;
+      }];
+    };
+  };
+
+  # always allow unfree
+  nixpkgs.config.allowUnfree = true;
+  environment.variables = {
+    NIXPKGS_ALLOW_UNFREE = "1";
+  };
+
+  # enable nftables based firewall
+  networking.nftables = {
+    enable = true;
+  };
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPuma8g+U8Wh+4mLvZoV9V+ngPqxjuIG4zhsbaTeXq65 eyjhb@chronos"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGee4uz+HDOj4Y4ANOhWJhoc4mMLP1gz6rpKoMueQF2J rendal@popper"
+  ];
+}

shared/default.nix

@@ -0,0 +1,7 @@
+{
+  imports = [
+    ./base/common-config.nix
+    ./platforms
+    ./modules
+  ];
+}

shared/modules/default.nix

@@ -1,5 +1,6 @@
 {
   imports = [
+    ./disko.nix
     ./state.nix
     ./ssh-luks-zfs-on-boot.nix
     ./easy-zfs-mounts.nix

shared/modules/disko.nix

@@ -0,0 +1,234 @@
+{ config, lib, ... }:
+
+with lib;
+
+# default pool for root device is named rpool, cannot be changed atm.
+
+# IDEA
+# mine.disks.root = "/dev/sda1";
+# mine.disks.pools.rpool.device = "/dev/disk/....";
+# mine.disks.pools.rpool.createDisk = false;
+# mine.disks.pools.rpool.extra = {};
+# mine.disks.pools.rpool.datasets = { "local/nix" = { mountpoint = "/nix/store"; extra = {}; }; };
+
+let
+  cfg = config.mine.disks;
+
+  datasetOpts = { name, config, ... }: {
+    options = {
+      name = lib.mkOption {
+        type = types.str;
+        default = name;
+        description = "The name of the name dataset";
+      };
+
+      mountpoint = lib.mkOption {
+        type = types.nullOr types.str;
+        description = "Where to mount the ZFS dataset";
+      };
+
+      extra = lib.mkOption {
+        type = types.attrsOf types.anything;
+        default = {};
+      };
+    };
+  };
+
+  poolOpts = { name, config, ... }: {
+    options = {
+      name = lib.mkOption {
+        type = types.str;
+        default = name;
+        description = "The name of the zfs pool, defaults to name";
+      };
+
+      diskoDiskName = lib.mkOption {
+        type = types.str;
+        default = "disk-${name}";
+        description = "The name of the disk attribute in disko, defaults to disk-<name>";
+      };
+
+      device = lib.mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = "Device to use for the pool (needed if the pool should be created)";
+      };
+
+      createDisk = lib.mkOption {
+        type = types.bool;
+        default = true;
+        description = "Indicates if the disk should be created (only set to false for the root)";
+      };
+
+      extra = lib.mkOption {
+        type = types.attrsOf types.anything;
+        default = {};
+      };
+
+      datasets = mkOption {
+        type = types.attrsOf (types.submodule datasetOpts);
+        default = {};
+      };
+    };
+  };
+
+  sources = import ./../sources/sources.nix;
+in {
+  imports = [
+    (sources.disko + "/module.nix")
+  ];
+
+  options.mine.disks = {
+    disk = mkOption {
+      type = types.str;
+      default = "/dev/sda";
+    };
+
+    rollbackOnBoot = mkOption {
+      type = types.bool;
+      default = true;
+    };
+
+    pools = mkOption {
+      type = types.attrsOf (types.submodule poolOpts);
+      default = {};
+    };
+  };
+
+  config = {
+    # default rpool (cannot be changed)
+    mine.disks.pools.rpool = {
+      createDisk = false;
+
+      datasets = {
+        "local/nix".mountpoint = "/nix";
+        "root" = { mountpoint = "/"; extra = { postCreateHook = "zfs snapshot rpool/root@blank"; }; };
+        "safe/persistent".mountpoint = "/state/root";
+      };
+    };
+
+    # state things are needed on BOOT!
+    fileSystems."${cfg.pools.rpool.datasets."safe/persistent".mountpoint}".neededForBoot = true;
+
+    # rollback on boot!
+    boot.initrd.postDeviceCommands = lib.mkIf cfg.rollbackOnBoot (lib.mkAfter ''
+      zfs rollback -r rpool/root@blank
+    '');
+    
+    disko.devices = {
+      disk = let
+        diskPoolsToCreate = lib.filterAttrs (_: v: v.createDisk) cfg.pools;
+        extraDisks = lib.mapAttrs' (_: v: lib.nameValuePair v.diskoDiskName (lib.recursiveUpdate {
+          type = "disk";
+          device = v.device;
+          content = {
+            type = "gpt";
+            partitions = {
+              zfs = {
+                size = "100%";
+                content = {
+                  type = "zfs";
+                  pool = v.name;
+                };
+              };
+            };
+          };
+        } v.extra)) diskPoolsToCreate;
+      in {
+        root = {
+          type = "disk";
+          device = cfg.disk;
+          content = {
+            type = "gpt";
+            partitions = {
+              boot = {
+                name = "boot";
+                size = "1M";
+                type = "EF02";
+              };
+              esp = {
+                name = "ESP";
+                size = "500M";
+                type = "EF00";
+                content = {
+                  type = "filesystem";
+                  format = "vfat";
+                  mountpoint = "/boot";
+                };
+              };
+  
+              luks = {
+                size = "100%";
+                content = {
+                  type = "luks";
+                  name = "cryptroot";
+                  settings.allowDiscards = true;
+  
+                  content = {
+                    type = "zfs";
+                    pool = "rpool";
+                  };
+                };
+              };
+            };
+          };
+        };
+      } // extraDisks;
+  
+      zpool = let
+        # helper functions
+        makeZFSDatasets = datasets: (lib.mapAttrs' (n: v: lib.nameValuePair v.name (lib.recursiveUpdate {
+            type = "zfs_fs";
+            mountpoint = v.mountpoint;
+            options.mountpoint = "legacy";
+        } (if v ? extra then v.extra else {}))) datasets);
+
+        mkZFSPool = zfsPool: {
+          type = "zpool";
+          # rootFsOptions.compression = "zstd";
+          rootFsOptions = {
+            compression = "on";
+            atime = "off";
+            acltype = "posixacl";
+            xattr = "sa";
+          };
+
+          datasets = makeZFSDatasets zfsPool.datasets;
+        };
+      in lib.mapAttrs' (n: v: lib.nameValuePair v.name (mkZFSPool v)) cfg.pools;
+      #   {
+      #   rpool = {
+      #     type = "zpool";
+      #     # rootFsOptions.compression = "zstd";
+      #     rootFsOptions = {
+      #       compression = "on";
+      #       atime = "off";
+      #       acltype = "posixacl";
+      #       xattr = "sa";
+  
+      #       # test
+      #       # "com.sun:auto-snapshot" = "false";
+      #       # "com.klarasystems:vdev_zaps_v2" = "false";
+      #     };
+  
+      #     datasets = let
+      #       baseDatasets = {
+      #         "/" = { dataset = "root"; extra = { postCreateHook = "zfs snapshot rpool/root@blank"; }; };
+      #         "/nix".dataset = "local/nix";
+      #         "/state/stash".dataset = "local/stash";
+      #         "/state/home".dataset = "safe/home";
+      #         "/state/root".dataset = "safe/persistent";
+  
+      #         # extra datasets
+      #         "/srv/forgejo" = { dataset = "safe/svcs/forgejo"; extra.options.quota = "5G"; };
+      #       };
+      #     in (makeZFSDatasets baseDatasets);
+      #   };
+      # };
+    };
+  
+    # fileSystems."/state/root".neededForBoot = true;
+    # fileSystems."/state/home".neededForBoot = true;
+    # fileSystems."/state/stash".neededForBoot = true;
+  };
+}

shared/platforms/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./hetzner.nix
+  ];
+}

shared/platforms/hetzner.nix

@@ -10,10 +10,7 @@ let
   ) attrset;
 in {
   options.mine.platforms.hetzner= {
-    enable = mkOption {
-      type = types.bool;
-      default = true;
-    };
+    enable = mkEnableOption "Enable Hetzner platform profile";
     
     network = {
       address = mkOption {