change script to first import storage before unlocking root

2025-11-15 15:43:34 +01:00
7 changed files with 59 additions and 72 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -67,11 +67,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1763992789,
-        "narHash": "sha256-WHkdBlw6oyxXIra/vQPYLtqY+3G8dUVZM8bEXk0t8x4=",
+        "lastModified": 1748226808,
+        "narHash": "sha256-GaBRgxjWO1bAQa8P2+FDxG4ANBVhjnSjBms096qQdxo=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "44831a7eaba4360fb81f2acc5ea6de5fde90aaa3",
+        "rev": "83665c39fa688bd6a1f7c43cf7997a70f6a109f9",
        "type": "github"
      },
      "original": {
@@ -109,11 +109,11 @@
        "spectrum": "spectrum"
      },
      "locked": {
-        "lastModified": 1764549796,
-        "narHash": "sha256-Mswg665P92EoHkBwCwPr/7bdnj04g2Qfb+t02ZEYTHA=",
+        "lastModified": 1748260747,
+        "narHash": "sha256-V3ONd70wm55JxcUa1rE0JU3zD+Cz7KK/iSVhRD7lq68=",
        "owner": "astro",
        "repo": "microvm.nix",
-        "rev": "030d055e877cc13d7525b39f434150226d5e4482",
+        "rev": "b6c5dfc2a1c7614c94fd2c5d2e8578fd52396f3b",
        "type": "github"
      },
      "original": {
@@ -145,11 +145,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1764234087,
-        "narHash": "sha256-NHF7QWa0ZPT8hsJrvijREW3+nifmF2rTXgS2v0tpcEA=",
+        "lastModified": 1747663185,
+        "narHash": "sha256-Obh50J+O9jhUM/FgXtI3he/QRNiV9+J53+l+RlKSaAk=",
        "owner": "nix-community",
        "repo": "nixos-generators",
-        "rev": "032a1878682fafe829edfcf5fdfad635a2efe748",
+        "rev": "ee07ba0d36c38e9915c55d2ac5a8fb0f05f2afcc",
        "type": "github"
      },
      "original": {
@@ -160,11 +160,11 @@
    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1764440730,
-        "narHash": "sha256-ZlJTNLUKQRANlLDomuRWLBCH5792x+6XUJ4YdFRjtO4=",
+        "lastModified": 1747900541,
+        "narHash": "sha256-dn64Pg9xLETjblwZs9Euu/SsjW80pd6lr5qSiyLY1pg=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "9154f4569b6cdfd3c595851a6ba51bfaa472d9f3",
+        "rev": "11f2d9ea49c3e964315215d6baa73a8d42672f06",
        "type": "github"
      },
      "original": {
@@ -192,11 +192,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1764517877,
-        "narHash": "sha256-pp3uT4hHijIC8JUK5MEqeAWmParJrgBVzHLNfJDZxg4=",
+        "lastModified": 1748190013,
+        "narHash": "sha256-R5HJFflOfsP5FBtk+zE8FpL8uqE7n62jqOsADvVshhE=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "2d293cbfa5a793b4c50d17c05ef9e385b90edf6c",
+        "rev": "62b852f6c6742134ade1abdd2a21685fd617a291",
        "type": "github"
      },
      "original": {
@@ -208,16 +208,16 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1764522689,
-        "narHash": "sha256-SqUuBFjhl/kpDiVaKLQBoD8TLD+/cTUzzgVFoaHrkqY=",
+        "lastModified": 1748162331,
+        "narHash": "sha256-rqc2RKYTxP3tbjA+PB3VMRQNnjesrT0pEofXQTrMsS8=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "8bb5646e0bed5dbd3ab08c7a7cc15b75ab4e1d0f",
+        "rev": "7c43f080a7f28b2774f3b3f43234ca11661bf334",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-25.11",
+        "ref": "nixos-25.05",
        "repo": "nixpkgs",
        "type": "github"
      }
@@ -246,11 +246,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1764483358,
-        "narHash": "sha256-EyyvCzXoHrbL467YSsQBTWWg4sR96MH1sPpKoSOelB4=",
+        "lastModified": 1747603214,
+        "narHash": "sha256-lAblXm0VwifYCJ/ILPXJwlz0qNY07DDYdLD+9H+Wc8o=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "5aca6ff67264321d47856a2ed183729271107c9c",
+        "rev": "8d215e1c981be3aa37e47aeabd4e61bb069548fd",
        "type": "github"
      },
      "original": {
@@ -262,11 +262,11 @@
    "spectrum": {
      "flake": false,
      "locked": {
-        "lastModified": 1759482047,
-        "narHash": "sha256-H1wiXRQHxxPyMMlP39ce3ROKCwI5/tUn36P8x6dFiiQ=",
+        "lastModified": 1746869549,
+        "narHash": "sha256-BKZ/yZO/qeLKh9YqVkKB6wJiDQJAZNN5rk5NsMImsWs=",
        "ref": "refs/heads/main",
-        "rev": "c5d5786d3dc938af0b279c542d1e43bce381b4b9",
-        "revCount": 996,
+        "rev": "d927e78530892ec8ed389e8fae5f38abee00ad87",
+        "revCount": 862,
        "type": "git",
        "url": "https://spectrum-os.org/git/spectrum"
      },
@@ -450,11 +450,11 @@
        "utils": "utils_4"
      },
      "locked": {
-        "lastModified": 1764942243,
-        "narHash": "sha256-P02Zm0VAON9SqRxqe6h5vfxgpCBYeiz5JPWGIn6KFFg=",
+        "lastModified": 1751462005,
+        "narHash": "sha256-vhr2GORiXij3mL+QIfnL0sKSbbBIglw1wnHWNmFejiA=",
        "ref": "refs/heads/master",
-        "rev": "f56b7eb6887b7e0fecae4a1f4c1311392eebad8d",
-        "revCount": 156,
+        "rev": "f505fb17bf1882cc3683e1e252ce44583cbe58ce",
+        "revCount": 155,
        "type": "git",
        "url": "https://git.dynamicdiscord.de/kalipso/zineshop"
      },
--- a/flake.nix
+++ b/flake.nix
@@ -3,7 +3,7 @@

  inputs = {
    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
    sops-nix.url = "github:Mic92/sops-nix";
    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
--- a/machines/bakunin/configuration.nix
+++ b/machines/bakunin/configuration.nix
@@ -48,7 +48,7 @@ in
      firefox
      thunderbird
      telegram-desktop
-      tor-browser
+      tor-browser-bundle-bin
      keepassxc
      libreoffice
      gimp
--- a/machines/fanny/configuration.nix
+++ b/machines/fanny/configuration.nix
@@ -86,15 +86,10 @@ in
    enable = true;
    authorizedKeys = sshKeys.admins;
    ethernetDrivers = ["r8169"];
-    zfsExtraPools = [ "storage" ];
  };

  boot.initrd = {
    availableKernelModules = [ "wireguard" ];
-    # postMountCommands = ''
-    #   ip address flush dev wg-initrd
-    #   ip link set dev wg-initrd down
-    # '';
    systemd = {
      enable = true;
      network = {
@@ -106,15 +101,15 @@ in
          };
          wireguardConfig = { PrivateKeyFile = "/etc/secrets/30-wg-initrd.key"; };
          wireguardPeers = [{
-            AllowedIPs = peers.vpn.allowedIPs;
-            PublicKey = peers.vpn.publicKey;
+            AllowedIPs = peers.fanny-initrd.allowedIPs;
+            PublicKey = peers.fanny-initrd.publicKey;
            Endpoint = "${peers.vpn.publicIp}:${builtins.toString(peers.vpn.listenPort)}";
            PersistentKeepalive = 25;
          }];
        };
        networks."30-wg-initrd" = {
          name = "wg-initrd";
-          addresses = [{ Address = "${peers.fanny-initrd.address}/24"; }];
+          addresses = [{ Address = peers.fanny-initrd.address; }];
        };
      };
    };
--- a/machines/louise/configuration.nix
+++ b/machines/louise/configuration.nix
@@ -31,7 +31,7 @@
      firefox
      thunderbird
      telegram-desktop
-      tor-browser
+      tor-browser-bundle-bin
      keepassxc
      libreoffice
      gimp
--- a/machines/modules/malobeo/initssh.nix
+++ b/machines/modules/malobeo/initssh.nix
@@ -22,11 +22,6 @@ in
      description = "Ethernet drivers to load: run `lspci -k | grep -iA4 ethernet`";
      example = "r8169";
    };
-    zfsExtraPools = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      description = "Name or GUID of extra ZFS pools that you wish to import during boot.";
-    };
  };
  
  config = lib.mkIf (cfg.enable && config.malobeo.disks.encryption) {
@@ -37,41 +32,33 @@ in
      zfs = {
        forceImportAll = true;
        requestEncryptionCredentials = true;
-        extraPools = cfg.zfsExtraPools;
+        
      };
      initrd = {
        availableKernelModules = cfg.ethernetDrivers;
        systemd = {
-          initrdBin = [ pkgs.busybox pkgs.wireguard-tools pkgs.iproute2 ]; 
          enable = true;
          network.enable = true;
-          services."stopInitVpn" = {
-            description = "stop init vpn";
-            wantedBy = [
-              "initrd.target"
-            ];
-            after = [
-              "zfs.target"
-            ];
-            serviceConfig.StandardOutput = "journal+console";
-            script = ''
-              networkctl down wg-initrd
-            '';
-            serviceConfig.Type = "oneshot";
-      };
        };
-        network = {
-          flushBeforeStage2 = true;
-          ssh = {
-            enable = true;
-            port = 222;
-            authorizedKeys = cfg.authorizedKeys;
-            hostKeys = [ "/etc/ssh/initrd" ];
-          };
+        network.ssh = {
+          enable = true;
+          port = 222;
+          authorizedKeys = cfg.authorizedKeys;
+          hostKeys = [ "/etc/ssh/initrd" ];
        };
        secrets = {
          "/etc/ssh/initrd" = "/etc/ssh/initrd";
        };
+        systemd.services.zfs-remote-unlock = {
+          description = "Prepare for ZFS remote unlock";
+          wantedBy = ["initrd.target"];
+          after = ["systemd-networkd.service"];
+          path = with pkgs; [ zfs ];
+          serviceConfig.Type = "oneshot";
+          script = ''
+            echo "zfs load-key -a; killall zfs; systemctl default" >> /var/empty/.profile
+          '';
+        };
      };
      kernelParams = [ "ip=::::${hostName}-initrd::dhcp" ];
    };
--- a/machines/nextcloud/configuration.nix
+++ b/machines/nextcloud/configuration.nix
@@ -33,7 +33,7 @@ with lib;

  services.nextcloud = {
    enable = true;
-    package = pkgs.nextcloud32;
+    package = pkgs.nextcloud31;
    hostName = "cloud.malobeo.org";
    config.adminpassFile = config.sops.secrets.nextcloudAdminPass.path;
    maxUploadSize = "10G";
@@ -48,9 +48,14 @@ with lib;
    extraAppsEnable = true;
    extraApps = {
      inherit (config.services.nextcloud.package.packages.apps) contacts calendar polls registration collectives forms;
+      appointments = pkgs.fetchNextcloudApp {
+        sha256 = "sha256-ls1rLnsX7U9wo2WkEtzhrvliTcWUl6LWXolE/9etJ78=";
+        url = "https://github.com/SergeyMosin/Appointments/raw/refs/tags/v2.4.3/build/artifacts/appstore/appointments.tar.gz";
+        license = "agpl3Plus";
+      };
      deck = pkgs.fetchNextcloudApp {
        sha256 = "sha256-1sqDmJpM9SffMY2aaxwzqntdjdcUaRySyaUDv9VHuiE=";
-        url = "https://link.storjshare.io/raw/jvrl62dakd6htpyxohjkiiqiw5ma/mal/deck32.tar.gz";
+        url = "https://link.storjshare.io/raw/jw7pf6gct34j3pcqvlq6ddasvdwq/mal/deck.tar.gz";
        license = "agpl3Plus";
      };
    };