wip: attic

hosts/deertopia/configuration.nix

@@ -49,6 +49,7 @@
 
     deertopia = {
       authelia.enable = true;
+      atticd.enable = true;
       gitea.enable = true;
       quiver.enable = true;
       www.enable = true;

modules/nixos/deertopia/atticd.nix

@@ -0,0 +1,40 @@
+{ config, lib, pkgs, ... }:
+
+let cfg = config.sydnix.deertopia.atticd;
+in {
+  options.sydnix.deertopia.atticd = {
+    enable = lib.mkEnableOption "Atticd";
+    port = lib.mkOption {
+      default = 8012;
+      type = lib.types.port;
+    };
+  };
+
+  # sudo atticd-atticadm make-token --sub msyds --validity '1 year' --pull 'msyds-*' --push 'msyds-*' --create-cache 'msyds-*' --configure-cache 'msyds-*'
+  config = lib.mkIf cfg.enable {
+    sydnix.sops.secrets.atticd-environment-file = {
+      # owner = config.services.atticd.user;
+      # group = config.services.atticd.group;
+    };
+
+    services.atticd = {
+      enable = true;
+      environmentFile =
+	config.sops.secrets.atticd-environment-file.path;
+      settings = {
+	api-endpoint = "https://attic.deertopia.net/";
+	listen = "[::]:${toString cfg.port}";
+	garbage-collection = {
+	  default-retention-period = "3 months";
+	};
+      };
+    };
+
+    sydnix.deertopia.nginx.vhosts."attic".vhost = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/".proxyPass =
+        "http://127.0.0.1:${toString cfg.port}";
+    };
+  };
+}

modules/nixos/impermanence.nix

@@ -70,6 +70,10 @@ in {
     };
 
     # O_O what the fuck did i write this for.... CONCERNING.
+    #
+    # oh because of these types of errors:
+    #   Directory "/var/lib/private" already exists, but has mode 0755
+    #   that is too permissive (0700 was requested), refusing.
     systemd.tmpfiles.settings."10-varlibprivate" = {
       "/var/lib/private" = {
         z.group = "root";
@@ -78,6 +82,13 @@ in {
       };
     };
 
+    # Workaround for https://github.com/nix-community/impermanence/issues/254.
+    systemd.services."systemd-tmpfiles-resetup" = {
+      serviceConfig = {
+        RemainAfterExit = lib.mkForce false;
+      };
+    };
+
     # Permit members of `cfg.persistGroupName` to read, write, and execute
     # /persist.
     systemd.tmpfiles.settings."10-persist" = {