treewide: avoid unnecessary permission management with preservation

nixos/profiles/services/btrfs-auto-scrub/default.nix

@@ -16,6 +16,8 @@ in
     {
       directory = "/var/lib/btrfs";
       mode = "0700";
+      user = "root";
+      group = "root";
     }
   ];
 }

nixos/profiles/services/caddy/default.nix

@@ -34,8 +34,18 @@
   '';
 
   preservation.preserveAt."/persist".directories = [
-    config.services.caddy.dataDir
+    {
-    config.services.caddy.logDir
+      directory = config.services.caddy.dataDir;
+      mode = "-";
+      user = "-";
+      group = "-";
+    }
+    {
+      directory = config.services.caddy.logDir;
+      mode = "-";
+      user = "-";
+      group = "-";
+    }
   ];
 
   services.restic.backups.b2.paths = [

nixos/profiles/services/journald/default.nix

@@ -4,5 +4,12 @@
     SystemMaxUse=1G
   '';
 
-  preservation.preserveAt."/persist".directories = [ "/var/log/journal" ];
+  preservation.preserveAt."/persist".directories = [
+    {
+      directory = "/var/log/journal";
+      mode = "-";
+      user = "-";
+      group = "-";
+    }
+  ];
 }

nixos/profiles/services/knot/primary.nix

@@ -173,7 +173,9 @@ in
   preservation.preserveAt."/persist".directories = [
     {
       directory = "/var/lib/knot";
-      mode = "0700";
+      mode = "-";
+      user = "-";
+      group = "-";
     }
   ];
 

nixos/profiles/services/knot/secondary.nix

@@ -67,7 +67,9 @@ in
   preservation.preserveAt."/persist".directories = [
     {
       directory = "/var/lib/knot";
-      mode = "0700";
+      mode = "-";
+      user = "-";
+      group = "-";
     }
   ];
 }

nixos/profiles/services/mail/dovecot.nix

@@ -38,10 +38,6 @@ in
       };
   };
 
-  systemd.tmpfiles.rules = [
-    "d ${maildir} 0700 ${cfg.mailUser} ${cfg.mailGroup} -"
-  ];
-
   services.dovecot2 = {
     enable = true;
     modules = [ pkgs.dovecot_pigeonhole ];
@@ -187,10 +183,17 @@ in
   };
 
   preservation.preserveAt."/persist".directories = [
-    "/var/lib/dovecot"
+    {
+      directory = "/var/lib/dovecot";
+      mode = "-";
+      user = "-";
+      group = "-";
+    }
     {
       directory = maildir;
       mode = "0700";
+      user = config.services.dovecot2.mailUser;
+      group = config.services.dovecot2.mailGroup;
     }
   ];
 

nixos/profiles/services/mail/postfix.nix

@@ -101,5 +101,12 @@
       };
   };
 
-  preservation.preserveAt."/persist".directories = [ "/var/lib/postfix" ];
+  preservation.preserveAt."/persist".directories = [
+    {
+      directory = "/var/lib/postfix";
+      mode = "-";
+      user = "-";
+      group = "-";
+    }
+  ];
 }

nixos/profiles/services/mail/rspamd.nix

@@ -61,11 +61,15 @@
   preservation.preserveAt."/persist".directories = [
     {
       directory = "/var/lib/rspamd";
-      mode = "0700";
+      mode = "-";
+      user = "-";
+      group = "-";
     }
     {
       directory = "/var/lib/redis-rspamd";
-      mode = "0700";
+      mode = "-";
+      user = "-";
+      group = "-";
     }
   ];
 }

nixos/profiles/services/ntfy/default.nix

@@ -53,7 +53,14 @@
       '';
     };
 
-  preservation.preserveAt."/persist".directories = [ "/var/lib/ntfy-sh" ];
+  preservation.preserveAt."/persist".directories = [
+    {
+      directory = "/var/lib/ntfy-sh";
+      mode = "-";
+      user = "-";
+      group = "-";
+    }
+  ];
 
   services.restic.backups.b2.paths = [ "/persist/var/lib/ntfy-sh" ];
 }

nixos/profiles/services/pipewire/default.nix

@@ -13,7 +13,9 @@
   preservation.preserveAt."/persist".directories = [
     {
       directory = "/var/lib/pipewire";
-      mode = "0700";
+      mode = "-";
+      user = "-";
+      group = "-";
     }
   ];
 }

nixos/profiles/services/postgresql/default.nix

@@ -50,10 +50,17 @@ in
   };
 
   preservation.preserveAt."/persist".directories = [
-    "/var/lib/postgresql"
+    {
+      directory = "/var/lib/postgresql";
+      mode = "-";
+      user = "-";
+      group = "-";
+    }
     {
       directory = config.services.postgresqlBackup.location;
       mode = "0700";
+      user = "postgres";
+      group = "postgres";
     }
   ];
 

nixos/profiles/services/prometheus/server.nix

@@ -252,7 +252,17 @@ in
     };
 
   preservation.preserveAt."/persist".directories = [
-    "/var/lib/prometheus2"
+    {
-    "/var/lib/private/alertmanager"
+      directory = "/var/lib/prometheus2";
+      mode = "-";
+      user = "-";
+      group = "-";
+    }
+    {
+      directory = "/var/lib/private/alertmanager";
+      mode = "-";
+      user = "-";
+      group = "-";
+    }
   ];
 }

nixos/profiles/services/restic/default.nix

@@ -55,7 +55,14 @@
     };
   };
 
-  preservation.preserveAt."/persist".directories = [ "/var/cache/restic-backups-b2" ];
+  preservation.preserveAt."/persist".directories = [
+    {
+      directory = "/var/cache/restic-backups-b2";
+      mode = "0755";
+      user = "root";
+      group = "root";
+    }
+  ];
 
   services.restic.backups.b2.paths = [
     "/persist/etc/machine-id"

nixos/profiles/services/vnstat/default.nix

@@ -10,5 +10,12 @@
 
   systemd.services.vnstat.serviceConfig = mylib.misc.serviceHardened;
 
-  preservation.preserveAt."/persist".directories = [ "/var/lib/vnstat" ];
+  preservation.preserveAt."/persist".directories = [
+    {
+      directory = "/var/lib/vnstat";
+      mode = "-";
+      user = "-";
+      group = "-";
+    }
+  ];
 }

nixos/profiles/system/preservation.nix

@@ -26,20 +26,34 @@
           directories = [
             {
               directory = "/var/lib/machines";
-              mode = "0700";
+              mode = "0755";
+              user = "root";
+              group = "root";
             }
             {
               directory = "/var/lib/nixos";
               inInitrd = true;
+              mode = "0755";
+              user = "root";
+              group = "root";
             }
             {
               directory = "/var/lib/portables";
-              mode = "0700";
+              mode = "0755";
+              user = "root";
+              group = "root";
+            }
+            {
+              directory = "/var/lib/systemd";
+              mode = "0755";
+              user = "root";
+              group = "root";
             }
-            "/var/lib/systemd"
             {
               directory = "/var/tmp";
               mode = "1777";
+              user = "root";
+              group = "root";
             }
           ];
           files = [
@@ -47,11 +61,16 @@
               file = config.sops.age.keyFile;
               inInitrd = true;
               mode = "0600";
+              user = "root";
+              group = "root";
             }
             {
               file = "/etc/machine-id";
               inInitrd = true;
               how = "symlink";
+              mode = "-";
+              user = "root";
+              group = "root";
               configureParent = true;
             }
           ];