feat: fixed merge incompatibilities

configurations/nixos/defiant/legacy-impermanence.nix

@@ -1,19 +1,32 @@
 # Legacy impermanence module for defiant
-# This module contains all the impermanence configurations that were previously
-# handled by individual service modules on the main branch. It allows us to
-# merge the storage-refactor branch into main while keeping current functionality,
-# and then migrate services one at a time to the new automated impermanence system.
+# See legacy-storage.nix for the full incremental migration plan.
 #
-# To migrate a service to the new system:
-# 1. Remove the service's configuration from this file
-# 2. Set `impermanence.enable = true` for that service in configuration.nix
-# 3. Remove `impermanence.enable = false` from the service configuration
+# This file is consumed in two phases:
+#
+# Phase 3 (after generateBase is enabled):
+#   Remove the SYSTEM-LEVEL entries marked [PHASE 3] below. These will be
+#   handled automatically by storage.nix, ssh.nix, and the impermanence module:
+#     - var-lib-private-permissions activation script
+#     - /etc/machine-id
+#     - SSH host keys
+#     - /var/lib/nixos
+#     - /var/lib/systemd/coredump
+#     - /persist/system/var/log persistence block
+#
+# Phase 4 (migrate services one at a time, any order):
+#   For each service:
+#     1. Remove the service's section marked [PHASE 4] from this file
+#     2. Remove `impermanence.enable = false` for that service in configuration.nix
+#   For jellyfin/qbittorrent, also remove the separate media persistence blocks.
+#
+# Phase 5: Delete this file once empty.
 {
   config,
   lib,
   ...
 }: {
   config = lib.mkIf config.storage.impermanence.enable {
+    # [PHASE 3] Remove this activation script after enabling generateBase
     system.activationScripts = {
       "var-lib-private-permissions" = {
         deps = ["specialfs"];
@@ -27,8 +40,28 @@
     environment.persistence."/persist/system/root" = {
       enable = true;
       hideMounts = true;
+      # [PHASE 3] Remove this files block after enabling generateBase
+      files = lib.mkMerge [
+        ["/etc/machine-id"]
+        # SSH host keys
+        (lib.mkIf config.services.openssh.enable (
+          lib.lists.flatten (
+            builtins.map (hostKey: [
+              hostKey.path
+              "${hostKey.path}.pub"
+            ])
+            config.services.openssh.hostKeys
+          )
+        ))
+      ];
       directories = lib.mkMerge [
-        # PostgreSQL
+        # [PHASE 3] Remove these system directories after enabling generateBase
+        [
+          "/var/lib/nixos"
+          "/var/lib/systemd/coredump"
+        ]
+
+        # [PHASE 4] PostgreSQL
         (lib.mkIf config.services.postgresql.enable [
           {
             directory = "/var/lib/postgresql/16";
@@ -37,7 +70,7 @@
           }
         ])
 
-        # Reverse Proxy (ACME)
+        # [PHASE 4] Reverse Proxy (ACME)
         (lib.mkIf config.services.reverseProxy.enable [
           {
             directory = "/var/lib/acme";
@@ -46,7 +79,7 @@
           }
         ])
 
-        # Ollama
+        # [PHASE 4] Ollama
         (lib.mkIf config.services.ollama.enable [
           {
             directory = "/var/lib/private/ollama";
@@ -56,7 +89,7 @@
           }
         ])
 
-        # Tailscale
+        # [PHASE 4] Tailscale
         (lib.mkIf config.services.tailscale.enable [
           {
             directory = "/var/lib/tailscale";
@@ -65,7 +98,7 @@
           }
         ])
 
-        # Syncthing
+        # [PHASE 4] Syncthing
         (lib.mkIf config.services.syncthing.enable [
           {
             directory = "/mnt/sync";
@@ -79,7 +112,7 @@
           }
         ])
 
-        # Fail2ban
+        # [PHASE 4] Fail2ban
         (lib.mkIf config.services.fail2ban.enable [
           {
             directory = "/var/lib/fail2ban";
@@ -88,7 +121,7 @@
           }
         ])
 
-        # Jellyfin (data/cache only - media is on separate dataset)
+        # [PHASE 4] Jellyfin (data/cache only - media is on separate dataset)
         (lib.mkIf config.services.jellyfin.enable [
           {
             directory = "/var/lib/jellyfin";
@@ -102,7 +135,7 @@
           }
         ])
 
-        # Immich
+        # [PHASE 4] Immich
         (lib.mkIf config.services.immich.enable [
           {
             directory = "/var/lib/immich";
@@ -111,7 +144,7 @@
           }
         ])
 
-        # Forgejo
+        # [PHASE 4] Forgejo
         (lib.mkIf config.services.forgejo.enable [
           {
             directory = "/var/lib/forgejo";
@@ -120,7 +153,7 @@
           }
         ])
 
-        # Actual
+        # [PHASE 4] Actual
         (lib.mkIf config.services.actual.enable [
           {
             directory = "/var/lib/private/actual";
@@ -129,7 +162,7 @@
           }
         ])
 
-        # Home Assistant
+        # [PHASE 4] Home Assistant
         (lib.mkIf config.services.home-assistant.enable [
           {
             directory = "/var/lib/hass";
@@ -138,7 +171,7 @@
           }
         ])
 
-        # Paperless
+        # [PHASE 4] Paperless
         (lib.mkIf config.services.paperless.enable [
           {
             directory = "/var/lib/paperless";
@@ -147,7 +180,7 @@
           }
         ])
 
-        # Crab-hole
+        # [PHASE 4] Crab-hole
         (lib.mkIf config.services.crab-hole.enable [
           {
             directory = "/var/lib/private/crab-hole";
@@ -156,7 +189,7 @@
           }
         ])
 
-        # qBittorrent (config only - media is on separate dataset)
+        # [PHASE 4] qBittorrent (config only - media is on separate dataset)
         (lib.mkIf config.services.qbittorrent.enable [
           {
             directory = "/var/lib/qBittorrent/";
@@ -165,7 +198,7 @@
           }
         ])
 
-        # Sonarr
+        # [PHASE 4] Sonarr
         (lib.mkIf config.services.sonarr.enable [
           {
             directory = "/var/lib/sonarr/.config/NzbDrone";
@@ -174,7 +207,7 @@
           }
         ])
 
-        # Radarr
+        # [PHASE 4] Radarr
         (lib.mkIf config.services.radarr.enable [
           {
             directory = "/var/lib/radarr/.config/Radarr";
@@ -183,7 +216,7 @@
           }
         ])
 
-        # Bazarr
+        # [PHASE 4] Bazarr
         (lib.mkIf config.services.bazarr.enable [
           {
             directory = "/var/lib/bazarr";
@@ -192,7 +225,7 @@
           }
         ])
 
-        # Lidarr
+        # [PHASE 4] Lidarr
         (lib.mkIf config.services.lidarr.enable [
           {
             directory = "/var/lib/lidarr/.config/Lidarr";
@@ -201,7 +234,7 @@
           }
         ])
 
-        # Jackett
+        # [PHASE 4] Jackett
         (lib.mkIf config.services.jackett.enable [
           {
             directory = "/var/lib/jackett/.config/Jackett";
@@ -210,7 +243,7 @@
           }
         ])
 
-        # FlareSolverr
+        # [PHASE 4] FlareSolverr
         (lib.mkIf config.services.flaresolverr.enable [
           {
             directory = "/var/lib/flaresolverr";
@@ -221,7 +254,8 @@
       ];
     };
 
-    # Jellyfin media on separate dataset (matching main)
+    # [PHASE 4 - LAST] Jellyfin media on separate dataset
+    # Requires Phase 2 media dataset merge before migrating (several days of data copy)
     environment.persistence."/persist/system/jellyfin" = lib.mkIf config.services.jellyfin.enable {
       enable = true;
       hideMounts = true;
@@ -235,7 +269,8 @@
       ];
     };
 
-    # qBittorrent media on separate dataset (matching main)
+    # [PHASE 4 - LAST] qBittorrent media on separate dataset
+    # Requires Phase 2 media dataset merge before migrating (several days of data copy)
     environment.persistence."/persist/system/qbittorrent" = lib.mkIf config.services.qbittorrent.enable {
       enable = true;
       hideMounts = true;
@@ -249,7 +284,7 @@
       ];
     };
 
-    # /var/log persistence (matching main)
+    # [PHASE 3] /var/log persistence - handled by storage.nix after generateBase
     environment.persistence."/persist/system/var/log" = {
       enable = true;
       hideMounts = true;