Fix everything.

system/devices/boot/default.nix

@@ -0,0 +1,12 @@
+{ ... }:
+{
+  imports = [
+    ./extlinux
+    ./services
+  ];
+
+  boot.kernel.sysctl = {
+    "vm.max_map_count" = 2147483642;
+    "kernel.sysrq" = 1;
+  };
+}

system/devices/boot/extlinux/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  boot.loader = {
+    grub.enable = false;
+    systemd-boot.enable = false;
+    generic-extlinux-compatible.enable = true;
+  };
+}

system/devices/boot/services/default.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  imports = [ ./root-reset ];
+
+  boot.initrd.systemd.enable = true;
+}

system/devices/boot/services/root-reset/default.nix

@@ -0,0 +1,31 @@
+{ config, ... }:
+{
+  boot.initrd.systemd.services.root-reset = {
+    enable = config.environment.persistence."/persist".enable;
+    description = "Create new and snapshot previous root";
+    wantedBy = [ "initrd.target" ];
+    before = [ "sysroot.mount" ];
+    after = [ "initrd-root-device.target" ];
+    unitConfig.DefaultDependencies = "no";
+    serviceConfig.Type = "oneshot";
+    script = ''
+      mkdir -p /mnt
+      mount -t btrfs /dev/${config.networking.hostName}/root /mnt
+
+      if [[ -e /mnt/prev ]]; then
+        btrfs subvolume delete /mnt/prev
+      fi
+
+      btrfs subvolume snapshot /mnt/root /mnt/prev
+
+      btrfs subvolume list -o /mnt/root | cut -f9 -d' ' | while read subvolume; do
+        btrfs subvolume delete "/mnt/$subvolume"
+      done
+
+      btrfs subvolume delete /mnt/root
+      btrfs subvolume create /mnt/root
+
+      umount /mnt
+    '';
+  };
+}

system/devices/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  imports = [
+    ./boot
+    ./disks
+    ./hardware
+    ./networking
+  ];
+}

system/devices/disks/default.nix

@@ -0,0 +1,10 @@
+{ ... }:
+{
+  imports = [
+    ./disko
+    ./filesystems
+    ./immutable
+    ./impermanence
+    ./snapper
+  ];
+}

system/devices/disks/disko/default.nix

@@ -0,0 +1,94 @@
+{ config, disko, ... }:
+{
+  imports = [ disko.nixosModules.disko ];
+
+  disko.devices = {
+    disk = {
+      "${config.networking.hostName}" = {
+        type = "disk";
+        device = "/dev/mmcblk1";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              priority = 1;
+              size = "2G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            luks = {
+              size = "100%";
+              content = {
+                type = "luks";
+                name = "${config.networking.hostName}-disk";
+                settings.allowDiscards = true;
+                passwordFile = "/tmp/secret.key";
+                content = {
+                  type = "lvm_pv";
+                  vg = "${config.networking.hostName}";
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+
+    lvm_vg = {
+      "${config.networking.hostName}" = {
+        type = "lvm_vg";
+        lvs = {
+          root = {
+            size = "100%";
+            content = {
+              type = "btrfs";
+              extraArgs = [ "-f" ];
+              subvolumes = {
+                "/root" = {
+                  mountpoint = "/";
+                  mountOptions = [ "compress=zstd" "noatime" "ssd" ];
+                };
+                "/prev" = {
+                  mountpoint = "/prev";
+                  mountOptions = [ "compress=zstd" "noatime" "ssd" "noexec" ];
+                };
+                "/nix" = {
+                  mountpoint = "/nix";
+                  mountOptions = [ "compress=zstd" "noatime" "ssd" ];
+                };
+
+                # Impermanence
+                "/persist" = {
+                  mountpoint = "/persist";
+                  mountOptions = [ "compress=zstd" "noatime" "ssd" ];
+                };
+                "/persist/.snapshots" = { };
+
+                "/persist/home/jules" = { };
+                "/persist/home/jules/.snapshots" = { };
+
+                "/persist/home/jimbo" = { };
+                "/persist/home/jimbo/.snapshots" = { };
+              };
+            };
+          };
+          swap = {
+            size = "4G";
+            content = {
+              type = "swap";
+              discardPolicy = "both";
+            };
+          };
+        };
+      };
+    };
+  };
+
+  # Needed for impermanence
+  fileSystems."/persist".neededForBoot = true;
+}

system/devices/disks/filesystems/default.nix

@@ -0,0 +1,13 @@
+{ pkgs, ... }:
+{
+  boot.supportedFilesystems = {
+    btrfs = true;
+    ntfs = true;
+    zfs = true;
+  };
+
+  services = {
+    btrfs.autoScrub.enable = true;
+    fstrim.enable = true;
+  };
+}

system/devices/disks/immutable/default.nix

@@ -0,0 +1,5 @@
+{ ... }:
+{
+  system.etc.overlay.mutable = false;
+  boot.tmp.cleanOnBoot = true;
+}

system/devices/disks/impermanence/default.nix

@@ -0,0 +1,10 @@
+{ impermanence, ... }:
+{
+  imports = [
+    ./jules
+    ./jimbo
+    ./root
+
+    impermanence.nixosModules.impermanence
+  ];
+}

system/devices/disks/impermanence/jimbo/default.nix

@@ -0,0 +1,26 @@
+{ config, ... }:
+{
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    users.jimbo = {
+      directories = [
+        "Keepers"
+        "Documents"
+        "Pictures"
+        "Videos"
+        "Games"
+        "VMs"
+
+        ".snapshots"
+        ".cache/nix-index"
+
+        { directory = ".ssh"; mode = "0700"; }
+        { directory = ".gnupg"; mode = "0700"; }
+      ];
+      files = [
+        ".zsh_history"
+        ".local/state/lazygit/state.yml"
+      ];
+    };
+  };
+}

system/devices/disks/impermanence/jules/default.nix

@@ -0,0 +1,26 @@
+{ config, ... }:
+{
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    users.jules = {
+      directories = [
+        "Keepers"
+        "Documents"
+        "Pictures"
+        "Videos"
+        "Games"
+        "VMs"
+
+        ".snapshots"
+        ".cache/nix-index"
+
+        { directory = ".ssh"; mode = "0700"; }
+        { directory = ".gnupg"; mode = "0700"; }
+      ];
+      files = [
+        ".zsh_history"
+        ".local/state/lazygit/state.yml"
+      ];
+    };
+  };
+}

system/devices/disks/impermanence/root/default.nix

@@ -0,0 +1,15 @@
+{ ... }:
+{
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/etc/nixos"
+      "/etc/secureboot"
+      "/var/lib/nixos"
+    ];
+    files = [
+      "/etc/machine-id"
+      "/root/.gitconfig"
+    ];
+  };
+}

system/devices/disks/snapper/default.nix

@@ -0,0 +1,13 @@
+{ ... }:
+{
+  imports = [
+    ./jules
+    ./jimbo
+    ./root
+  ];
+
+  services.snapper = {
+    snapshotInterval = "0/6:00:00";
+    persistentTimer = true;
+  };
+}

system/devices/disks/snapper/jimbo/default.nix

@@ -0,0 +1,12 @@
+{ config, lib, ... }:
+{
+  services.snapper.configs.jimbo = lib.mkIf config.environment.persistence."/persist".enable {
+    SUBVOLUME = "/persist/home/jimbo";
+    TIMELINE_CREATE = true;
+    TIMELINE_CLEANUP = true;
+    TIMELINE_LIMIT_DAILY = 1;
+    TIMELINE_LIMIT_WEEKLY = 1;
+    TIMELINE_LIMIT_MONTHLY = 0;
+    TIMELINE_LIMIT_YEARLY = 0;
+  };
+}

system/devices/disks/snapper/jules/default.nix

@@ -0,0 +1,12 @@
+{ config, lib, ... }:
+{
+  services.snapper.configs.jules = lib.mkIf config.environment.persistence."/persist".enable {
+    SUBVOLUME = "/persist/home/jules";
+    TIMELINE_CREATE = true;
+    TIMELINE_CLEANUP = true;
+    TIMELINE_LIMIT_DAILY = 1;
+    TIMELINE_LIMIT_WEEKLY = 1;
+    TIMELINE_LIMIT_MONTHLY = 0;
+    TIMELINE_LIMIT_YEARLY = 0;
+  };
+}

system/devices/disks/snapper/root/default.nix

@@ -0,0 +1,12 @@
+{ config, lib, ... }:
+{
+  services.snapper.configs.root = lib.mkIf config.environment.persistence."/persist".enable {
+    SUBVOLUME = "/persist";
+    TIMELINE_CREATE = true;
+    TIMELINE_CLEANUP = true;
+    TIMELINE_LIMIT_DAILY = 1;
+    TIMELINE_LIMIT_WEEKLY = 0;
+    TIMELINE_LIMIT_MONTHLY = 0;
+    TIMELINE_LIMIT_YEARLY = 0;
+  };
+}

system/devices/hardware/default.nix

@@ -0,0 +1,8 @@
+{ config, lib, modulesPath, ... }:
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot.initrd.kernelModules = [ "ahci" "dm-snapshot" "mmc_core" "pcie_rockchip_host" "phy_rockchip_pcie" "rockchip_dfi" "rockchip_thermal" "rtc_rk808" "rockchip_saradc" "uas" "fusb302" ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+}

system/devices/networking/default.nix

@@ -0,0 +1,30 @@
+{ config, ... }:
+{
+  networking = {
+    wireless = {
+      enable = false;
+      iwd.enable = true;
+    };
+    dhcpcd.enable = true;
+    nftables.enable = true;
+    firewall.allowPing = false;
+    useNetworkd = true;
+    nameservers = [
+      "1.1.1.1#one.one.one.one"
+      "1.0.0.1#one.one.one.one"
+    ];
+  };
+
+  services.resolved = {
+    enable = true;
+    dnssec = "true";
+    domains = [ "~." ];
+    fallbackDns = config.networking.nameservers;
+    dnsovertls = "true";
+  };
+
+  environment = {
+    systemPackages = with pkgs; [ impala ];
+    persistence."/persist".directories = [ "/var/lib/iwd/" ];
+  };
+}