bernardo/Nomarchy
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(impermanence): rollback as systemd initrd service, not postDeviceCommands

Browse Source 
themes/engine/plymouth.nix enables systemd stage-1 initrd
(boot.initrd.systemd.enable) distro-wide, and Plymouth is imported
unconditionally from core/system/default.nix. systemd stage 1 hard-rejects
boot.initrd.postDeviceCommands with a failed assertion, so every config
with nomarchy.system.impermanence.enable = true — including installs that
chose impermanence at the installer prompt — failed to evaluate.

Convert the Erase-Your-Darlings rollback to a boot.initrd.systemd.services
oneshot unit ordered after the LUKS mapping opens and before sysroot.mount,
and add boot.initrd.systemd.initrdBin for btrfs-progs/coreutils/util-linux/
findutils (the systemd initrd doesn't ship them by default). Script body is
unchanged. Verified eval via extendModules on nixosConfigurations.default;
boot-time wipe semantics still need a real wipe-boot cycle (Pillar 8).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Bernardo Magri
2026-05-29 18:24:01 +01:00
parent 905ed4f6d8
commit 38c70e4aaf
3 changed files with 47 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

67
core/system/impermanence.nix
View File

@@ -39,32 +39,53 @@ in
};
config = lib.mkIf cfg.enable {
# 1. The Rollback Script: Runs in initrd before filesystems are mounted
boot.initrd.postDeviceCommands = lib.mkAfter ''
mkdir -p /btrfs_tmp
mount -o subvol=/ /dev/mapper/${cfg.mainLuksName} /btrfs_tmp
if [[ -e /btrfs_tmp/@ ]]; then
mkdir -p /btrfs_tmp/old_roots
timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/@)" "+%Y-%m-%-d_%H:%M:%S")
mv /btrfs_tmp/@ "/btrfs_tmp/old_roots/$timestamp"
fi
# 1. The Rollback Service: wipes the @ root subvolume back to a blank
# snapshot before the real root is mounted. Plymouth enables systemd
# stage-1 initrd distro-wide (themes/engine/plymouth.nix), and systemd
# stage 1 rejects boot.initrd.postDeviceCommands — so this runs as a
# systemd initrd unit ordered after the LUKS mapping opens and before
# sysroot is mounted. initrdBin pulls in the binaries the script calls
# (the systemd initrd doesn't ship coreutils/findutils/btrfs by default).
boot.initrd.systemd.initrdBin = [
pkgs.btrfs-progs
pkgs.coreutils
pkgs.util-linux
pkgs.findutils
];
delete_subvolume_recursively() {
IFS=$'\n'
for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
delete_subvolume_recursively "/btrfs_tmp/$i"
done
btrfs subvolume delete "$1"
}
boot.initrd.systemd.services.nomarchy-rollback = {
description = "Erase Your Darlings: roll the BTRFS root subvolume back to a blank snapshot";
wantedBy = [ "initrd.target" ];
after = [ "systemd-cryptsetup@${cfg.mainLuksName}.service" ];
before = [ "sysroot.mount" ];
unitConfig.DefaultDependencies = "no";
serviceConfig.Type = "oneshot";
script = ''
mkdir -p /btrfs_tmp
mount -o subvol=/ /dev/mapper/${cfg.mainLuksName} /btrfs_tmp
for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do
delete_subvolume_recursively "$i"
done
if [[ -e /btrfs_tmp/@ ]]; then
mkdir -p /btrfs_tmp/old_roots
timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/@)" "+%Y-%m-%-d_%H:%M:%S")
mv /btrfs_tmp/@ "/btrfs_tmp/old_roots/$timestamp"
fi
btrfs subvolume snapshot /btrfs_tmp/root-blank /btrfs_tmp/@
umount /btrfs_tmp
'';
delete_subvolume_recursively() {
IFS=$'\n'
for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
delete_subvolume_recursively "/btrfs_tmp/$i"
done
btrfs subvolume delete "$1"
}
for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do
delete_subvolume_recursively "$i"
done
btrfs subvolume snapshot /btrfs_tmp/root-blank /btrfs_tmp/@
umount /btrfs_tmp
'';
};
# 2. Persistence Configuration: What survives the wipe
environment.persistence."/persist" = {