impernanence optional

hosts/nanuqsaurus-btrfs.nix

@@ -13,6 +13,8 @@
     ../modules/system/disko-btrfs.nix
   ];
 
+  nanuqsaurus.impermanence.enable = true;
+
   networking.hostName = "nanuqsaurus";
 
   system.stateVersion = "25.11";

impermanence.md

@@ -0,0 +1,20 @@
+“Impermanent” (in NixOS terms) usually means your `/` is treated as disposable: on boot you either mount it as `tmpfs` or roll it back to a clean Btrfs snapshot, and you only keep state in explicitly persistent mounts (commonly `/nix`, `/home`, plus a `/persist`).
+
+**What changes overall**
+- Your system becomes “reprovisioned” from Nix each boot/rebuild: the OS + config is reliable and drift-resistant, but anything that writes state under `/etc` or `/var` will be lost unless you persist it.
+- Declared things (NixOS options, `environment.systemPackages`, enabled services) will come back automatically; undeclared/manual tweaks won’t.
+
+**In your repo, the big practical impacts would be**
+- **Nix store and system packages:** fine as long as `/nix` is persistent (your `modules/system/disko-btrfs.nix` already has a `/nix` subvolume). `environment.systemPackages` (like `git`, `flatpak`, `podman-compose`, etc.) is unaffected.
+- **Flatpak (`modules/system/flatpak.nix`):** the declarative *intent* stays, but the actual installed Flatpaks/remotes live in state dirs (typically system: `/var/lib/flatpak`, user: `~/.local/share/flatpak`). If those aren’t persisted, you’ll re-download/reinstall frequently and offline boots can be annoying.
+- **Secure Boot keys (`modules/system/secure-boot.nix`):** you already point Lanzaboote at `/var/lib/secureboot`. If that path isn’t persisted, you risk regenerating keys and getting into a “firmware enrolled keys vs disk keys” mismatch situation.
+- **SSH (`modules/system/services.nix` enables `openssh`):** host keys are typically under `/etc/ssh`. If they aren’t persisted, the host key changes after resets, which breaks known-hosts trust and can lock you out in headless scenarios.
+- **Libvirt/VMs (`modules/system/virtualization.nix` enables `libvirtd` + virt-manager):** libvirt state and VM images commonly live under `/var/lib/libvirt`. If `/var` is wiped, your VMs disappear unless you store/persist them elsewhere.
+- **Podman/containers:** rootless images/volumes are in your home (fine if `/home` persists); rootful storage is usually under `/var/lib/containers` (lost if not persisted).
+- **Printing (`modules/system/printer.nix`):** CUPS queues/config live under `/etc/cups` and `/var/lib/cups`. With an impermanent root, any printers you add via GUI will vanish unless you persist those paths or configure printers declaratively.
+- **Home Manager bootstrap marker (`modules/users/admin.nix`):** it writes `%h/.config/home-manager/.hm_bootstrap_done`. If `/home` isn’t persistent, that “one-time” bootstrap will run every login.
+
+**Rule of thumb**
+- Make `/nix` persistent (required).
+- Decide whether `/home` is persistent (strongly recommended with your current “HM standalone per-user” setup).
+- Persist selected state from `/etc` and `/var` based on the services you run (at minimum for your config: `/var/lib/secureboot`, `/etc/ssh`, plus whichever of `/var/lib/flatpak`, `/var/lib/libvirt`, `/etc/cups`/`/var/lib/cups` you care about).

modules/system/impermanence.nix

@@ -1,10 +1,13 @@
 { config, lib, ... }:
 
 {
-  config = lib.mkIf (
+  options.nanuqsaurus.impermanence.enable = lib.mkOption {
-    (config.fileSystems ? "/persist")
+    type = lib.types.bool;
-    && (config.fileSystems."/persist".fsType or "" == "btrfs")
+    default = false;
-  ) {
+    description = "Enable impermanence with a /persist Btrfs subvolume.";
+  };
+
+  config = lib.mkIf config.nanuqsaurus.impermanence.enable {
     boot.initrd.supportedFilesystems = [ "btrfs" ];
 
     boot.initrd.postDeviceCommands = lib.mkAfter ''