83 lines
3 KiB
Nix
83 lines
3 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
...
|
|
}:
|
|
with lib; let
|
|
cfg = config.custom.settings.mounts;
|
|
in {
|
|
options.custom.settings.mounts.enable = mkOption {default = false;};
|
|
|
|
config = mkIf cfg.enable {
|
|
# Enforce permissions for mountpoint directory
|
|
systemd.tmpfiles.rules = ["d /mnt/remote 0755 root root"];
|
|
|
|
#!! FUSE does not support remount, sometimes causing activation errors on switch
|
|
# https://github.com/libfuse/libfuse/issues/717
|
|
#?? sudo umount /mnt/remote && sudo mount /mnt/remote
|
|
# https://wiki.nixos.org/wiki/SSHFS
|
|
# https://man.archlinux.org/man/sshfs.1
|
|
fileSystems = let
|
|
#?? "/mnt/PATH" = remote "PATH" UID GID "UMASK"
|
|
remote = path: uid: gid: umask: {
|
|
# https://robot.hetzner.com/storage
|
|
device = "u415778@u415778.your-storagebox.de:/home/${path}";
|
|
fsType = "sshfs";
|
|
|
|
options = [
|
|
"noatime" # Do not modify access time
|
|
"reconnect" # Gracefully handle network issues
|
|
"default_permissions" # Check local permissions
|
|
"allow_other" # Grant other users access
|
|
"umask=${umask}" # Set permissions mask
|
|
"uid=${toString uid}" # Set user id
|
|
"gid=${toString gid}" # Set group id
|
|
"idmap=user" # Map local users to remote
|
|
"transform_symlinks" # Convert absolute symlinks to relative
|
|
"compression=no" # Save CPU cycles at the cost of transfer speed
|
|
"port=23"
|
|
"IdentityFile=/etc/ssh/id_ed25519" # !! SSH key configured imperatively
|
|
"ServerAliveInterval=15" # Prevent application hangs on reconnect
|
|
];
|
|
};
|
|
in {
|
|
# Use umask to set sshfs permissions
|
|
#!! Up to 10 simultaneous connections with Hetzner
|
|
#?? docker compose exec CONTAINER cat /etc/passwd
|
|
"/mnt/remote/conduwuit" = remote "conduwuit" 300 300 "0077"; # conduit:conduit @ 0700
|
|
#// "/mnt/remote/nextcloud" = remote "nextcloud" 33 33 "0007"; # www-data:www-data @ 0700
|
|
"/mnt/remote/syncthing" = remote "syncthing" 237 237 "0077"; # syncthing:syncthing @ 0700
|
|
};
|
|
|
|
# https://wiki.nixos.org/wiki/Rclone
|
|
# https://docs.hetzner.com/robot/storage-box/access/access-ssh-rsync-borg/#rclone
|
|
#!! SSH keys configured imperatively
|
|
#!! rclone attempts to write to immutable config; need to manually merge changes
|
|
# https://github.com/rclone/rclone/issues/3655
|
|
# TODO: Attempt to use rclone after daemon is fixed
|
|
# https://github.com/rclone/rclone/issues/5664
|
|
# environment.etc."rclone.conf".text = ''
|
|
# [remote]
|
|
# type = sftp
|
|
# host = u415778.your-storagebox.de
|
|
# user = u415778
|
|
# port = 23
|
|
# key_file = /etc/ssh/id_ed25519
|
|
# shell_type = unix
|
|
# '';
|
|
|
|
# fileSystems."/mnt/remote" = {
|
|
# device = "remote:/home";
|
|
# fsType = "rclone";
|
|
|
|
# options = [
|
|
# "nodev"
|
|
# "nofail"
|
|
# "reconnect"
|
|
# "args2env" # Pass secrets as environment variables
|
|
# "default_permissions"
|
|
# "config=/etc/rclone.conf"
|
|
# ];
|
|
# };
|
|
};
|
|
}
|