configurations/home-manager/leyla/default.nix

@@ -12,7 +12,7 @@
   ];
 
   config = {
-    impermanence.enable = osConfig.host.impermanence.enable;
+    impermanence.enable = osConfig.storage.impermanence.enable;
 
     # Home Manager needs a bit of information about you and the paths it should
     # manage.

configurations/home-manager/leyla/impermanence.nix

@@ -14,7 +14,6 @@
         ".bash_history" # keep shell history around
         "${config.xdg.dataHome}/recently-used.xbel" # gnome recently viewed files
       ];
-      allowOther = true;
     };
   };
 }

modules/home-manager-modules/impermanence.nix

@@ -18,17 +18,16 @@ in {
     (lib.mkIf config.impermanence.enable {
       assertions = [
         {
-          assertion = osConfig.host.impermanence.enable;
+          assertion = osConfig.storage.impermanence.enable;
           message = "impermanence can not be enabled for a user when it is not enabled for the system";
         }
       ];
     })
     # If impermanence is not enabled for this user but system impermanence is enabled,
     # persist the entire home directory as fallback
-    (lib.mkIf (osConfig.host.impermanence.enable && !cfg.enable && cfg.fallbackPersistence.enable) {
+    (lib.mkIf (osConfig.storage.impermanence.enable && !cfg.enable && cfg.fallbackPersistence.enable) {
       home.persistence."/persist/home/${config.home.username}" = {
         directories = ["."];
-        allowOther = true;
       };
     })
   ];

modules/home-manager-modules/programs/anki.nix

@@ -1,15 +1,13 @@
 {
   lib,
   config,
-  osConfig,
   ...
 }: {
-  config = lib.mkIf (config.programs.anki.enable && osConfig.host.impermanence.enable) {
+  config = lib.mkIf (config.programs.anki.enable && config.impermanence.enable) {
     home.persistence."/persist${config.home.homeDirectory}" = {
       directories = [
         "${config.xdg.dataHome}/Anki2/"
       ];
-      allowOther = true;
     };
   };
 }

modules/home-manager-modules/programs/bitwarden.nix

@@ -20,7 +20,6 @@
           directories = [
             "${config.xdg.configHome}/Bitwarden"
           ];
-          allowOther = true;
         };
       }
     )

modules/home-manager-modules/programs/bruno.nix

@@ -20,7 +20,6 @@
           directories = [
             "${config.xdg.configHome}/bruno/"
           ];
-          allowOther = true;
         };
       }
     )

modules/home-manager-modules/programs/calibre.nix

@@ -20,7 +20,6 @@
           directories = [
             "${config.xdg.configHome}/calibre"
           ];
-          allowOther = true;
         };
       }
     )

modules/home-manager-modules/programs/davinci-resolve.nix

@@ -21,7 +21,6 @@
             "${config.xdg.dataHome}/DaVinciResolve"
             "${config.xdg.configHome}/blackmagic"
           ];
-          allowOther = true;
         };
       }
     )

modules/home-manager-modules/programs/dbeaver.nix

@@ -20,7 +20,6 @@
           directories = [
             "${config.xdg.dataHome}/DBeaverData/"
           ];
-          allowOther = true;
         };
       }
     )

modules/home-manager-modules/programs/discord.nix

@@ -20,7 +20,6 @@
           directories = [
             "${config.xdg.configHome}/discord/"
           ];
-          allowOther = true;
         };
       }
     )

modules/home-manager-modules/programs/firefox.nix

@@ -22,7 +22,6 @@
       # Extension configuration
       ".mozilla/firefox/${profile}/extension-settings.json"
     ];
-    allowOther = true;
   };
 in {
   config = lib.mkIf (config.programs.firefox.enable && config.impermanence.enable) {

modules/home-manager-modules/programs/freecad.nix

@@ -20,7 +20,6 @@
           directories = [
             "${config.xdg.configHome}/FreeCAD"
           ];
-          allowOther = true;
         };
       }
     )

modules/home-manager-modules/programs/gimp.nix

@@ -20,7 +20,6 @@
           directories = [
             "${config.xdg.configHome}/GIMP"
           ];
-          allowOther = true;
         };
       }
     )

modules/home-manager-modules/programs/inkscape.nix

@@ -20,7 +20,6 @@
           directories = [
             "${config.xdg.configHome}/inkscape"
           ];
-          allowOther = true;
         };
       }
     )

modules/home-manager-modules/programs/kdenlive.nix

@@ -28,7 +28,6 @@ in {
             "${config.xdg.configHome}/kdenliverc"
             "${config.xdg.dataHome}/kdenlive"
           ];
-          allowOther = true;
         };
       }
     )

modules/home-manager-modules/programs/krita.nix

@@ -21,7 +21,6 @@
             "${config.xdg.configHome}/kritarc"
             "${config.xdg.dataHome}/krita"
           ];
-          allowOther = true;
         };
       }
     )

modules/home-manager-modules/programs/libreoffice.nix

@@ -20,7 +20,6 @@
           directories = [
             "${config.xdg.configHome}/libreoffice"
           ];
-          allowOther = true;
         };
       }
     )

modules/home-manager-modules/programs/mapillary-uploader.nix

@@ -22,7 +22,6 @@ in {
             "${config.xdg.configHome}/mapillary-uploader"
             "${config.xdg.dataHome}/mapillary-uploader"
           ];
-          allowOther = true;
         };
       }
     )

modules/home-manager-modules/programs/obs.nix

@@ -10,7 +10,6 @@
           directories = [
             "${config.xdg.configHome}/obs-studio"
           ];
-          allowOther = true;
         };
       }
     )

modules/home-manager-modules/programs/olympus.nix

@@ -28,7 +28,6 @@ in {
             "${config.xdg.configHome}/olympus"
             "${config.xdg.dataHome}/olympus"
           ];
-          allowOther = true;
         };
       }
     )

modules/home-manager-modules/programs/openrgb.nix

@@ -20,7 +20,6 @@
           directories = [
             "${config.xdg.configHome}/OpenRGB"
           ];
-          allowOther = true;
         };
       }
     )

modules/home-manager-modules/programs/picard.nix

@@ -20,7 +20,6 @@
           directories = [
             "${config.xdg.configHome}/MusicBrainz"
           ];
-          allowOther = true;
         };
       }
     )

modules/home-manager-modules/programs/qflipper.nix

@@ -20,7 +20,6 @@
           directories = [
             "${config.xdg.configHome}/qFlipper"
           ];
-          allowOther = true;
         };
       }
     )

modules/home-manager-modules/programs/steam.nix

@@ -25,7 +25,6 @@
                 method = "symlink";
               }
             ];
-            allowOther = true;
           };
         }
       )

modules/home-manager-modules/programs/tor-browser.nix

@@ -20,7 +20,6 @@
           directories = [
             "${config.xdg.dataHome}/torbrowser"
           ];
-          allowOther = true;
         };
       }
     )

modules/home-manager-modules/programs/ungoogled-chromium.nix

@@ -20,7 +20,6 @@
           directories = [
             "${config.xdg.configHome}/chromium"
           ];
-          allowOther = true;
         };
       }
     )

modules/home-manager-modules/programs/via.nix

@@ -21,7 +21,6 @@
             "${config.xdg.configHome}/via"
             "${config.xdg.dataHome}/via"
           ];
-          allowOther = true;
         };
       }
     )

modules/home-manager-modules/programs/vmware-workstation.nix

@@ -28,7 +28,6 @@
                 method = "symlink";
               }
             ];
-            allowOther = true;
           };
         }
       )

modules/nixos-modules/users.nix

@@ -400,74 +400,60 @@ in {
       };
     }
     (lib.mkIf config.storage.impermanence.enable (lib.mkMerge [
-      (lib.mkIf config.storage.zfs.enable {
+      (lib.mkIf config.storage.zfs.enable (lib.mkMerge [
-        storage.zfs.datasets."persist/system/sops" = {
+        {
-          type = "zfs_fs";
+          # sops age key needs to be available to pre persist for user generation
-          mount = {
+          storage.zfs.datasets = lib.mkMerge [
-            enable = true;
+            {
-            mountPoint = SOPS_AGE_KEY_DIRECTORY;
+              "local/system/sops" = {
+                type = "zfs_fs";
+                mount = {
+                  enable = true;
+                  mountPoint = SOPS_AGE_KEY_DIRECTORY;
+                };
+                atime = "off";
+                relatime = "off";
+              };
+            }
+            # Create ZFS datasets for each normal user
+            (lib.mkMerge (
+              builtins.map (user: {
+                "local/home/${user.name}" = {
+                  type = "zfs_fs";
+                  mount = {
+                    enable = true;
+                    mountPoint = "/home/${user.name}";
+                  };
+                  snapshot.blankSnapshot = true;
+                };
+                "persist/home/${user.name}" = {
+                  type = "zfs_fs";
+                  mount = {
+                    enable = true;
+                    mountPoint = "/persist/home/${user.name}";
+                  };
+                };
+              })
+              normalUsers
+            ))
+          ];
+
+          # Post resume commands to rollback user home datasets to blank snapshots
+          boot.initrd.postResumeCommands = lib.mkAfter (
+            lib.strings.concatLines (builtins.map (user: "zfs rollback -r rpool/local/home/${user.name}@blank")
+              normalUsers)
+          );
+
+          # Create persist home directories with proper permissions
+          systemd = {
+            tmpfiles.rules =
+              builtins.map (
+                user: "d /persist/home/${user.name} 700 ${user.name} ${user.name} -"
+              )
+              normalUsers;
           };
-          atime = "off";
+        }
-          relatime = "off";
+      ]))
-        };
-      })
     ]))
-    # (lib.mkIf config.host.impermanence.enable {
-    #   boot.initrd.postResumeCommands = lib.mkAfter (
-    #     lib.strings.concatLines (builtins.map (user: "zfs rollback -r rpool/local/home/${user.name}@blank")
-    #       normalUsers)
-    #   );
-
-    #   systemd = {
-    #     tmpfiles.rules =
-    #       builtins.map (
-    #         user: "d /persist/home/${user.name} 700 ${user.name} ${user.name} -"
-    #       )
-    #       normalUsers;
-    #   };
-
-    #   fileSystems = lib.mkMerge [
-    #     (
-    #       builtins.listToAttrs (
-    #         builtins.map (user:
-    #           lib.attrsets.nameValuePair "/persist/home/${user.name}" {
-    #             neededForBoot = true;
-    #           })
-    #         normalUsers
-    #       )
-    #     )
-    #     (
-    #       builtins.listToAttrs (
-    #         builtins.map (user:
-    #           lib.attrsets.nameValuePair "/home/${user.name}" {
-    #             neededForBoot = true;
-    #           })
-    #         normalUsers
-    #       )
-    #     )
-    #   ];
-
-    #   host.storage.pool.extraDatasets = lib.mkMerge (
-    #     (
-    #       builtins.map (user: {
-    #         "local/home/${user.name}" = {
-    #           type = "zfs_fs";
-    #           mountpoint = "/home/${user.name}";
-    #           options = {
-    #             canmount = "on";
-    #           };
-    #           postCreateHook = ''
-    #             zfs snapshot rpool/local/home/${user.name}@blank
-    #           '';
-    #         };
-    #         "persist/home/${user.name}" = {
-    #           type = "zfs_fs";
-    #           mountpoint = "/persist/home/${user.name}";
-    #         };
-    #       })
-    #       normalUsers
-    #     )
-    #   );
-    # })
   ];
 }