genebean/dots
1
0
Fork 0
mirror of https://github.com/genebean/dots.git synced 2026-05-31 07:45:20 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Setup remote builds and set Pi mostly readonly

Browse source
This commit is contained in:
Gene Liverman 2026-04-01 17:12:26 -04:00
parent bdc0ca9637
commit 0498ea3e5b
No known key found for this signature in database
4 changed files with 154 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

126
modules/hosts/nixos/kiosk-gene-desk/read-only-root.nix Normal file
View file

@ -0,0 +1,126 @@
{
lib,
pkgs,
username,
...
}:
{
# ------------------------------------------------------------------ #
# Read-only SD card mounts and tmpfs for writable paths
# ------------------------------------------------------------------ #
fileSystems = {
"/" = lib.mkForce {
device = "/dev/disk/by-label/NIXOS_SD";
fsType = "ext4";
options = [
"ro"
"noatime"
"nodiratime"
];
};
"/boot/firmware" = lib.mkForce {
device = "/dev/disk/by-label/FIRMWARE";
fsType = "vfat";
options = [
"ro"
"noatime"
"nofail"
"noauto"
];
};
"/var/log" = {
device = "tmpfs";
fsType = "tmpfs";
options = [
"size=64m"
"mode=0755"
"nosuid"
"nodev"
];
neededForBoot = true;
};
"/var/lib" = {
device = "tmpfs";
fsType = "tmpfs";
options = [
"size=256m"
"mode=0755"
"nosuid"
"nodev"
];
neededForBoot = true;
};
"/home/${username}/.cache" = {
device = "tmpfs";
fsType = "tmpfs";
options = [
"size=256m"
"mode=0700"
"uid=1000"
"nosuid"
"nodev"
];
};
"/home/${username}/.local" = {
device = "tmpfs";
fsType = "tmpfs";
options = [
"size=256m"
"mode=0700"
"uid=1000"
"nosuid"
"nodev"
];
};
"/home/${username}/.config/chromium" = {
device = "tmpfs";
fsType = "tmpfs";
options = [
"size=128m"
"mode=0700"
"uid=1000"
"nosuid"
"nodev"
];
};
};
# ------------------------------------------------------------------ #
# tmpfs for paths that need to be writable at runtime
# ------------------------------------------------------------------ #
# /tmp - NixOS built-in option, cleaner than a manual fileSystems entry
boot.tmp.useTmpfs = true;
boot.tmp.tmpfsSize = "20%";
# ------------------------------------------------------------------ #
# systemd-journal needs its directory to exist after /var/log tmpfs
# is mounted
# ------------------------------------------------------------------ #
systemd.tmpfiles.rules = [
"d /var/log/journal 0755 root systemd-journal -"
# create a writable zsh history file in /tmp for gene
"f /tmp/zsh_history_gene 0600 ${username} users -"
];
# ------------------------------------------------------------------ #
# Helper scripts for doing a nixos-rebuild
# ------------------------------------------------------------------ #
environment.systemPackages = [
(pkgs.writeShellScriptBin "remount-rw" ''
echo "Remounting / read-write..."
sudo mount -o remount,rw /
echo "Starting nix-daemon..."
systemctl start nix-daemon.socket nix-daemon.service
echo "Done. Run 'reboot' when finished."
'')
];
}