actual: hardcode domain

flake.nix

@@ -114,6 +114,13 @@
             source = "rpool_orm";
             target = "rpool_elucredassa/backup/orm";
           };
+          "kalessin-state" = {
+            dataset = "state";
+            sourceHost = "kalessin";
+            targetHost = "elucredassa";
+            source = "rpool_kalessin";
+            target = "rpool_elucredassa/backup/kalessin";
+          };
         };
       };
 

flake/backup.nix

@@ -1,6 +1,7 @@
 { config, lib, pkgs, ... }:
 let
   cfg = config.fountain.backup;
+  keys = import ../keys.nix;
 
   syncOptions = {
     dataset = lib.mkOption {
@@ -91,34 +92,45 @@ in
   # TODO: add some assertions to verify the options
 
   config.flake.colmena = lib.mkMerge (lib.mapAttrsToList
-    (name: sync: {
+    (name: sync:
-      ${sync.sourceHost} = { pkgs, ... }: {
+      let
-        randomcat.services.zfs.datasets."${sync.source}/${sync.dataset}".zfsPermissions.users.backup = [ "hold" "send" ];
+        inherit (sync) dataset sourceHost targetHost source target;
+        # TODO: don't want to have to dig into the node config for the fqdn
+        sourceFqdn = config.flake.nixosConfigurations.${sourceHost}.config.networking.fqdn;
+      in
+      {
+        ${sourceHost} = { pkgs, ... }: {
+          randomcat.services.zfs.datasets."${source}/${dataset}".zfsPermissions.users.backup = [ "hold" "send" ];
+
           users.users.backup = {
             group = "backup";
             isSystemUser = true;
             useDefaultShell = true;
-          openssh.authorizedKeys.keys = cfg.keys.${sync.targetHost};
+            openssh.authorizedKeys.keys = cfg.keys.${targetHost};
             packages = with pkgs; [ mbuffer lzop ]; # syncoid uses these if available but doesn't pull them in automatically
           };
           users.groups.backup = { };
         };
 
-      ${sync.targetHost} = {
+        ${targetHost} = {
-        randomcat.services.zfs.datasets."${sync.target}".zfsPermissions.users.syncoid = [ "mount" "create" "receive" "recordsize" ];
+          randomcat.services.zfs.datasets.${target}.zfsPermissions.users.syncoid = [ "mount" "create" "receive" "recordsize" ];
+
           services.syncoid = {
             enable = true;
             interval = "*-*-* *:15:00";
             commonArgs = [ "--no-sync-snap" ];
             commands = {
               ${name} = {
-              source = "backup@${config.flake.nixosConfigurations.${sync.sourceHost}.config.networking.fqdn}:${sync.source}/${sync.dataset}";
+                source = "backup@${sourceFqdn}:${source}/${dataset}";
-              target = "${sync.target}/${sync.dataset}";
+                target = "${target}/${dataset}";
                 recursive = true;
                 recvOptions = "ux recordsize o compression=lz4";
               };
             };
           };
+
+          # TODO: this should be handled by a networking module
+          programs.ssh.knownHosts.${sourceFqdn}.publicKey = keys.machines.${sourceHost};
         };
       })
     cfg.sync

hosts/kalessin/default.nix

@@ -26,5 +26,15 @@ in
     authorizedKeys.keys = [ ];
   };
 
+  randomcat.services.zfs.datasets = {
+    "rpool_kalessin/state" = { mountpoint = "none"; };
+  };
+
+  services.sanoid.datasets."rpool_kalessin/state" = {
+    useTemplate = [ "production" ];
+    recursive = "zfs";
+    process_children_only = true;
+  };
+
   system.stateVersion = "23.11";
 }

hosts/orm/default.nix

@@ -30,12 +30,10 @@
   services.sanoid.datasets."rpool_orm/state" = {
     useTemplate = [ "production" ];
     recursive = "zfs";
+    process_children_only = true;
   };
 
-  qenya.services.actual = {
+  qenya.services.actual.enable = true;
-    enable = true;
-    domain = "actual.qenya.tel";
-  };
 
   system.stateVersion = "23.11";
 }

services/actual.nix

@@ -3,20 +3,18 @@
 with lib;
 let
   cfg = config.qenya.services.actual;
+  domain = "actual.qenya.tel";
 in
 {
   options.qenya.services.actual = {
-    enable = mkEnableOption "Actual";
+    enable = mkEnableOption "Actual Budget";
-    domain = mkOption {
-      type = types.str;
-    };
   };
 
   config = mkIf cfg.enable {
     services.nginx = {
       enable = true;
       virtualHosts = {
-        ${cfg.domain} = {
+        ${domain} = {
           forceSSL = true;
           enableACME = true;
           locations."/".proxyPass = "http://127.0.0.1:5006/";