alexion/dev
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(copyparty): preserve shared volume access #7

Merged
alexion merged 3 commits from copyparty-volume-permissions into main 2026-09-03 18:06:08 -04:00
Conversation 0 Commits 3 Files Changed 5 +20 -5
5 changed files with 20 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
configs/nixos/AGENTS.md
View File

@@ -44,3 +44,5 @@
- `sops.secrets.<name>.owner` must name a user known on the decrypting host. - `sops.secrets.<name>.owner` must name a user known on the decrypting host.
Do not set the owner to a guest-only service user unless the host also declares that user. Do not set the owner to a guest-only service user unless the host also declares that user.
Use a host-visible owner plus a shared group mode when the guest service can read the decrypted secret file through its group. Use a host-visible owner plus a shared group mode when the guest service can read the decrypted secret file through its group.
- Pikachu deploys from the monorepo checkout copied to `~/dev`.
Do not use the old `~/wrk/dotfiles` path for remote rebuild commands.

9
configs/nixos/guests/copyparty.nix
View File

@@ -111,7 +111,14 @@ in
readOnly = true; readOnly = true;
}; };
} }
// lib.mapAttrs' (_urlPath: volume: lib.nameValuePair volume.path { directory = volume.hostPath; }) cfg.volumes; // lib.mapAttrs' (_urlPath: volume:
lib.nameValuePair volume.path {
directory = volume.hostPath;
owner = "root";
group = "storage";
mode = "2770";
}
) cfg.volumes;
limits = { limits = {
memory = lib.mkDefault "2G"; memory = lib.mkDefault "2G";
cpu = lib.mkDefault "200%"; cpu = lib.mkDefault "200%";

8
configs/nixos/modules/services/copyparty.nix
View File

@@ -34,7 +34,13 @@ let
renderAccess = permission: accounts: " ${permission}: ${lib.concatStringsSep ", " accounts}"; renderAccess = permission: accounts: " ${permission}: ${lib.concatStringsSep ", " accounts}";
renderFlags = flags: lib.concatMapStringsSep "\n" (flag: " ${flag}") flags; hasFlag = name: flags: lib.any (flag: lib.hasPrefix "${name}:" flag || lib.hasPrefix "${name}=" flag) flags;
defaultPermissionFlags = flags:
lib.optionals (!(hasFlag "chmod_d" flags)) [ "chmod_d: 2770" ]
++ lib.optionals (!(hasFlag "chmod_f" flags)) [ "chmod_f: 660" ];
renderFlags = flags: lib.concatMapStringsSep "\n" (flag: " ${flag}") (flags ++ defaultPermissionFlags flags);
renderVolume = urlPath: volume: '' renderVolume = urlPath: volume: ''
[${urlPath}] [${urlPath}]

4
configs/nixos/modules/shell/fish/default.nix
View File

@@ -8,8 +8,8 @@
let let
cfg = config.modules.shell.fish; cfg = config.modules.shell.fish;
user = config.user.name; user = config.user.name;
shortcuts = config.registry.shell-shortcut.${config.networking.hostName}; shortcuts = lib.attrByPath [ config.networking.hostName ] { } config.registry.shell-shortcut;
envVars = config.registry.env-var.${config.networking.hostName}; envVars = lib.attrByPath [ config.networking.hostName ] { } config.registry.env-var;
commandsOf = shortcuts: lib.mapAttrs (_name: shortcut: shortcut.command) shortcuts; commandsOf = shortcuts: lib.mapAttrs (_name: shortcut: shortcut.command) shortcuts;
exportEnvVar = name: value: '' exportEnvVar = name: value: ''
set -gx ${name} ${lib.escapeShellArg value} set -gx ${name} ${lib.escapeShellArg value}

2
configs/nixos/modules/shell/fish/functions/deploy-to.fish
View File

@@ -48,6 +48,6 @@ end
set escaped_branch (string escape -- $branch) set escaped_branch (string escape -- $branch)
set escaped_host (string escape -- $host) set escaped_host (string escape -- $host)
set remote_command "cd ~/wrk/dotfiles && git fetch origin && git switch -- $escaped_branch && git reset --hard origin/$escaped_branch && sudo nixos-rebuild switch --flake .#$escaped_host --print-build-logs" set remote_command "cd ~/dev && git fetch origin && git switch -- $escaped_branch && git reset --hard origin/$escaped_branch && sudo nixos-rebuild switch --flake .#$escaped_host --print-build-logs"
ssh -t $host $remote_command ssh -t $host $remote_command