The Crucial P1 was mounted through two hand-written blocks in the host
because moonarch.disk knows only roles that stage 1 waits for, and a disk
that dies every other day must not be one of those. disko has a switch for
exactly this — initrdUnlock = false keeps a container out of the initrd —
so the role fits into the layout after all.
moonarch.disk.storage partitions and formats the disk like the other two,
but its container is opened after stage 1 by a key file on the encrypted
root disk, the filesystem mounts on first access, systemd stops waiting
after five seconds, and an idle timeout unmounts it again. A missing or
dead disk is then a missing directory, not a stalled boot.
The crypttab entry addresses the partition by partlabel, which disko
derives from the names in the layout, so no UUID has to be pasted in and a
replaced disk needs no edit here.
Verified after reboot: container opens as `storage` without a passphrase
prompt, /storage mounts on access, and the initrd holds only `crypted`.
The module wrote the configs and the timers, but nothing creates the
.snapshots subvolumes they need, so snapper-timeline failed every hour
with errno:2 and there was never a single snapshot to roll back to.
Removing it rather than fixing it: rollbacks of / are already covered by
NixOS generations, and snapshots of /home would have shared a disk with
/home. That answers "I deleted the wrong file" but not "the disk is
gone", and the second is the failure that actually occurred here.
The P1 left the layout when /home moved to the XPG. It comes back at
/storage, carrying only data whose loss costs nothing — the Steam library
to begin with.
Every option is chosen so the disk can no longer hold up the boot the way
it used to. The container is opened after stage 1 through a keyfile on the
encrypted system disk instead of in the initrd, the filesystem mounts on
first access only, and device-timeout together with nofail lets systemd
give up after five seconds when the drive is gone. idle-timeout unmounts
it again once nothing uses it, which keeps it cold, and cold is when this
drive works.
Verified on the machine: storage.automount pulls the cryptsetup unit in on
first access through the device dependency, so no explicit ordering is
needed.
The 1T Crucial P1 that carried /home fell off the PCIe bus four times in
four days — controller is down, CSTS=0xffffffff, reset failing with
ENODEV — each time forcing /home read-only mid-session.
Measured on the machine: the controller sits 17 K above the rest of the
drive at idle and reaches 90 C under pure read load while the other
sensors stay at 45-48. Throughput starts at 1.5 GB/s cold and collapses
in a sawtooth as it heats, down to 768 KiB/s over a 15 minute run, with
single reads stalling up to 1.465 s. The XPG under the same fio run
holds ~1 GB/s at 42 C. SMART is otherwise clean (no media errors, no
error log entries, 5% used) and P3CR013 is the final firmware, so there
is nothing left to repair.
/home therefore moves to the system disk, which modules/disk.nix already
does when home.enable is off. The P1 stays in its slot with no
partition, container or mount referencing it.
Steam gets XCURSOR_THEME from the session variables and still drew the
core pointer: parts of it resolve the theme literally named 'default'
instead of reading the variable. Xcursor looks that name up along
XCURSOR_PATH, where ~/.icons comes first, so a link there covers those
lookups as well.
Quickshell has no scope support of its own, so apps started from its
launcher inherited the cgroup of quickshell.service and systemd killed
them along with the unit on every restart — a rebuild that rewrites the
unit was enough, and Librewolf counted each one as a crash until it
refused to restore the session. app2unit is the start prefix the QML now
uses; see moonarch's LauncherPopout.qml.
The unit also gained a start limit. After a rebuild sent niri SIGTERM,
graphical-session.target stayed up while the Wayland socket was gone, so
Restart=on-failure spun 32 times in two minutes against a dead display.
Three tries per 30s ends that; the window slides, so a single crash after
a normal run still gets its restart.
moonarch 7a24cdb puts a suspend step back into the desktop plan; it was lost
when that plan stopped inheriting the ac: blocks. systemctl has to be on the
unit PATH for it, or the step fails silently like swaylock did.
services.fwupd.enable already puts the package in systemPackages, so the
entry only mattered where the daemon is off: on the desktop it left a
working fwupdmgr with no unit to talk to.
Steam is started by the user manager and only inherits XCURSOR_PATH, so
Xcursor falls back to the missing ~/.icons/default and draws the core
theme. The name matches modules/greetd.nix.
The port swapped moonarch's wdisplays-persistent for the nixpkgs wdisplays,
which cannot save -- so the kanshi config stayed empty and its unit was
skipped on every boot. nwg-displays supports niri and writes the layout to
~/.config/niri/monitor.kdl, which niri applies itself.
niri prefers a home config and does not merge, so config.kdl is seeded with
an include of /etc/niri/config.kdl, like moonarch does for stasis.rune.
wlsunset, both cliphist units and kanshi each only need the compositor
socket, so the set from the root oneshots applies. 9.4 UNSAFE to 0.9 SAFE,
verified by starting each one under the full set with `systemd-run --user`.
ProtectHome is out because it hides /run/user too, where the socket lives.
stasis gets five directives at most: swaylock authenticates through the
setuid-root unix_chkpwd, and every directive needing a mount namespace makes
`systemd --user` mount it nosuid, so /etc/shadow becomes unreadable.
Both units read one state file and write a single sysfs attribute, yet ran
as unrestricted root with network access and the full capability set.
systemd-analyze security scored them 7.5 EXPOSED, now 0.9 SAFE.
ProtectKernelTunables and PrivateUsers stay off on purpose; the reasons sit
in the comment, since without them they read as forgotten.
stasis does not run the configured actions through a login shell, so
/etc/profile never applies and nothing resolves via
/run/current-system/sw/bin. The old comment claimed the opposite and listed
only the binaries stasis spawns directly, which left swaylock unreachable:
`niri msg` worked, so the chain looked healthy while the lock step never ran.
The failure is silent. The spawn fails, stasis logs the action as started,
sees the immediate exit, treats the step as finished and stops there -- the
daemon then sits in "waiting for idle" with no lock and no dpms.
Verified: with an absolute path in the config, `stasis trigger lock_screen`
locks; with a bare `swaylock` and the old PATH it exits instantly.
brightnessctl comes along for the laptop's brightness step, which has the
same problem.
niri sets both in its environment block, which only reaches what niri spawns.
Since quickshell became a user service, everything started from its launcher
inherits the user manager's environment instead and comes up unstyled. As
session variables they travel through /etc/profile into niri-session's
import-environment and reach the user manager too.
Brings the logout fix: the power menu quits niri instead of terminating the
login session, which left the compositor running and blocked every later login.
niri-greeter.kdl spawns it by name. The regreet module only ever references the
binary through the default_session command it sets with mkDefault, and that is
overridden here with the niri greeter -- so nothing installed it and the greeter
came up with no UI, quit itself, and started over.
The option defaults to false as soon as a host sets initial_session, on the
grounds that a restart would trigger the autologin again. greetd(5) says it
does not: the initial session runs only on the first launch since boot, marked
by a runfile under /run. Left at the default, greetd exits with the session and
leaves a dead VT that only a power cycle gets out of.
Qt applications are wrapped, so each looks for plugins in its own closure and
never finds a style installed next to it -- VLC ships no Kvantum plugin and so
came up in the stock Qt style however the theme was configured. qt.enable adds
the profile's Qt5 and Qt6 plugin directories, which the wrappers append to.
platformTheme and style stay null: they would only pull in packages already
installed, and niri's environment block sets both variables.
kvantum.kvconfig selects catppuccin-mocha-lavender, but nothing installed it,
so Kvantum fell back to its built-in default and every Qt application went
unthemed. Of the four places it searches (style/Kvantum.cpp) three are under
$HOME and the fourth is a DATADIR compiled into the style plugin, which under
Nix is the plugin's own store path -- so a theme package in systemPackages can
never be found. Seeded like the other home-only configs.
As a spawn-at-startup it inherited niri's environment; the unit got systemd's
minimal one, so every widget that shells out failed to start its process --
niri, nmcli, powerprofilesctl, the moonarch scripts and a dozen more.
- zed asked for Hack Nerd Font, which is not installed; the fonts here are
UbuntuSans and UbuntuSansMono, so it had been rendering in a fallback.
- /etc/mpv/mpv.conf was deployed for a player that is not installed; vlc is.
- The /etc/stasis/stasis.rune entry is unreachable now that the config is
seeded into the home directory, which stasis prefers.
- Comments referring to Arch now name moonarch, the repository they actually
describe.
- The project inputs follow their default branch, not a release tag.
The actions run as `sh -lc`, which sources /etc/profile and therefore resolves
swaylock and brightnessctl on its own; only a shell has to be present. niri,
pactl and notify-send are spawned directly, past the shell, so those stay. bash
resolved to bashInteractive, which pulled readline in for nothing.
The moonarch bump carries the suspend inhibit knobs, without which stasis
discarded the seeded config on every start.
nixpkgs carries stasis 1.5.1, so the pinned input and pkgs/stasis.nix go. It
ships no unit and has no NixOS module, so modules/services.nix keeps declaring
one; its actions run as `sh -lc` and it spawns niri and pactl directly, hence
the unit path.
stasis prefers a user config over /etc and generates its own when none exists,
so moonarch's is seeded into the home directory instead of only reaching /etc.
amd-pstate in active mode reads only the min/max and EPP registers and
ignores the requested performance level, so the governor auto-cpufreq
switches decides nothing. ppd writes those registers and the ACPI
platform_profile; on the testvm, where neither exists, it falls back to
the placeholder driver instead of polling sysfs a virtio guest lacks.
The NixOS module asserts against auto-cpufreq, so the two cannot run at
the same knob. Matches the moonarch tree this flake deploys from.
The module rather than the package: gamemoded needs cap_sys_nice for renice
and a pkexec helper for the governor, which the module provides by wrapping
the binary, creating the gamemode group and enabling the user service.
The module creates that group but adds nobody to it, so the account joins it
in the same host file.
Gaps against moonarch/packages/official.txt: zip, unzip and viewnior were
missing outright, and thunar-archive-plugin was installed without
xarchiver, which left its menu entries inert.
services.auto-cpufreq is the backend of the Quickshell CpuGov widget,
which calls 'auto-cpufreq --get-state' and 'pkexec auto-cpufreq --force';
without it the indicator has no state and the popout cannot switch.
Seeds settings.json into the home directory with a tmpfiles 'C' rule, the
same route swaylock and waypaper take: Zed rewrites the file whenever a
setting is changed from its UI, so a store symlink would break saving.
nix-ld is what makes the language servers Zed downloads run here; the
alternative, zed-editor.fhsWithPackages, would cut them off from
project-level tooling out of a nix-shell.
Steam prints "pactl: command not found" and it means nothing: it probes
wpctl and pactl both and uses whichever is on PATH, which wireplumber
provides. Closed as expected behaviour in nixpkgs#525793.
The RNNoise config was deployed to /etc/xdg/pipewire, which PipeWire
never reads: it resolves $PIPEWIRE_CONFIG_DIR, then the home config, then
its compiled-in /etc/pipewire, and knows nothing of XDG_CONFIG_DIRS. An
installed system therefore had no denoising while carrying the file.
It now goes through services.pipewire.configPackages, with the LADSPA
plugin substituted to its store path since LADSPA_PATH has no /usr here.
Alongside, on the desktop host only: steam via its module (which also
turns on 32-bit graphics), bitwig-studio, and rtkit so a DAW can ask for
realtime scheduling at all.
The package set provided no browser at all. Waterfox, which Arch runs,
is not in nixpkgs; packaging its upstream tarball worked but leaves
version and hash to be bumped by hand, with nothing signalling a missed
release — poor terms for the most exposed program on the machine.
librewolf comes from nixpkgs, so its updates arrive with the flake, and
it is fully substitutable. Its defaults are stricter than Waterfox's.
networking.networkmanager.plugins defaulted to an empty list, so
NetworkManager offered no OpenVPN connection type at all.
Printing is driverless: asked over IPP the Samsung M267x 287x reports
image/urf and application/PCLm, so CUPS builds the queue from the
printer's own capabilities. No PPD, no unfree driver, and no printer
declared here. Avahi provides the discovery and resolves .local.
VLC instead of the mpv the Arch lists carry.
hosts/desktop carried two SET-VIA-disko-install placeholders, so the file
did not say which disks the machine has. The invalid paths only ever
caught a missing --disk flag, never a wrong one, and paid for it by
leaving the hardware undocumented.
The system disk is the 512G XPG, /home goes on the 1T Crucial;
disko-install --disk main|home still overrides both. The 1T currently
holds an ext4 Data partition, which the install erases.
zsh/newuser runs zsh-newuser-install on every interactive login while the
user has none of .zshenv, .zprofile, .zshrc or .zlogin. The whole
configuration lives in /etc/zshrc, which is not a personal file, so the
wizard never stopped coming up.
The seeded file carries comments only: sourcing the shared zshrc from it,
as the Arch counterpart does, would load it a second time.
/etc/zshrc renders promptInit and environment.shellAliases after
interactiveShellInit, so both overrode the shared zshrc: the prompt
became `prompt suse` and ls/ll/l fell back to coreutils. The plugin
sourcing in the zshrc points at the Arch path /usr/share/zsh/plugins
and silently found nothing.
Clear promptInit, drop the three aliases with null, and enable the
syntax-highlighting and autosuggestions modules.
Both were missing against the Arch package set: thunar with volman and the
archive plugin, tumbler and ffmpegthumbnailer (packages/official.txt:79-83),
and defaults/shell/zshrc, which Arch installs as /etc/zsh/zshrc.moonarch.
hosts/installer builds an image (nix build .#installer-iso) carrying this
flake as /etc/moonix, disko and a wrapper. The guest runs
`moonix-install <host>`: disko formats per the host file, nixos-install
installs, and the repository is cloned into the account own ~/flakes/moonix
with /etc/nixos/flake.nix pointing at it.
The image is built from the local tree, so a state does not have to be pushed
to be installable.
disko is patched to re-ask for the LUKS passphrase on a mismatch instead of
killing the script: its `exit 1` sits inside a function called from the until
loop that was meant to repeat the prompt.
Verified against nix eval, upstream sources and a local test:
- testvm accepts SSH password authentication (NixOS default), the README
claimed the opposite
- only /boot goes through by-partlabel; the filesystems inside the container
come up as /dev/mapper/crypted
- kanshi parses an empty config fine; a missing one is the error case, in the
README and in the desktop module comment
- modules/user.nix ABOUTME claimed a login name shared by every host
- the flake imports six modules, not five
Rewrites "Keeping a machine up to date": the checkout is ~/flakes/moonix and
/etc/nixos/flake.nix a symlink to it, which man 8 nixos-rebuild documents.
Drops the git and ssh-keygen basics. Adds an optional LUKS header backup step,
and records the checkout decision in DECISIONS.md.
Adds hosts/desktop: 512G system disk, 1T disk for /home, each in its own
LUKS container. modules/disk.nix gains moonarch.disk.home, which moves the
/home subvolume to the second disk and drops it from the first.
New modules/user.nix declares moonarch.user without a default, so the login
name exists once per host instead of once per reference. Both hosts set an
initialPassword: swaylock authenticates through pam_unix and cannot unlock a
screen for an account without one.
The config source is defaults/etc/swaylock/config now. The tmpfiles seed
stays: nixpkgs leaves meson's sysconfdir at $out/etc, so the
/etc/swaylock/config that Arch owns is never read here.
The power menu is a Quickshell popout in the moonarch config now, and it
was the last caller of moonlock. Inputs, package entries and both build
recipes are gone, together with the generated /etc configs and the
moonlock PAM stack — swaylock's comes from programs.niri.enable.
nevaforget