feat(modules/impermanence/nixos): add 'btrfsSnapshots' option

hosts/masterplan/default.nix

@@ -30,6 +30,16 @@
           environment.systemPackages.os.enable = true;
 
           impermanence.nixos = {
+            btrfsSnapshots = {
+              enable = true;
+              filesystemRoot = "/dev/mapper/luks";
+
+              snapshot = {
+                blankRoot = "root-blank";
+                root = "root";
+              };
+            };
+
             enable = true;
             path = "/persistent";
           };

modules/impermanence/nixos/default.nix

@@ -10,6 +10,42 @@
   ];
 
   options.modules.impermanence.nixos = {
+    btrfsSnapshots = {
+      enable = lib.mkEnableOption "Btrfs snapshot darling erasure";
+
+      filesystemRoot = lib.mkOption {
+        description = "Path to the Btrfs root filesystem.";
+        example = "/dev/mapper/luks";
+        type = lib.types.str;
+      };
+
+      mountPoint = lib.mkOption {
+        default = "/mnt";
+
+        description = ''
+          Path to the potentionally temporary mount point for modifying the
+          Btrfs subvolumes.
+        '';
+
+        example = "/tmp/mnt";
+        type = lib.types.str;
+      };
+
+      snapshot = {
+        blankRoot = lib.mkOption {
+          description = "Name of the blank Btrfs root snapshot.";
+          example = "root-blank";
+          type = lib.types.str;
+        };
+
+        root = lib.mkOption {
+          description = "Name of the Btrfs root snapshot.";
+          example = "root";
+          type = lib.types.str;
+        };
+      };
+    };
+
     enable = lib.mkEnableOption "impermanence";
 
     path = lib.mkOption {
@@ -25,6 +61,64 @@
     lib.mkIf cfg.enable {
       modules.agenix.nixosModules.default.enable = true;
 
+      # References:
+      #
+      #
+      # - https://guekka.github.io/nixos-server-1 # TODO: required?
+      # - https://mt-caret.github.io/blog/posts/2020-06-29-optin-state.html
+      boot.initrd =
+        lib.mkIf
+        cfg.btrfsSnapshots.enable {
+          # supportedFilesystems = ["btrfs"]; # TODO: required?
+
+          systemd.services.impermanence = {
+            after = ["[email protected]"];
+            before = ["sysroot.mount"];
+            description = "Erase your Btrfs darlings";
+            # path = [pkgs.btrfs]; TODO: access command names via 'pkgs.pname'.
+
+            script = let
+              blankRoot = "${cfg.btrfsSnapshots.mountPoint}/${cfg.btrfsSnapshots.snapshot.blankRoot}";
+              root = "${cfg.btrfsSnapshots.mountPoint}/${cfg.btrfsSnapshots.snapshot.root}";
+            in ''
+              set -e
+
+              mkdir --parent "${cfg.btrfsSnapshots.mountPoint}"
+
+              mount \
+                --options subvol=/ \
+                "${cfg.btrfsSnapshots.filesystemRoot}" \
+                "${cfg.btrfsSnapshots.mountPoint}"
+
+              trap \
+                '
+                  umount "${cfg.btrfsSnapshots.mountPoint}"
+
+                  rmdir \
+                    --ignore-fail-on-non-empty \
+                    "${cfg.btrfsSnapshots.mountPoint}"
+                ' \
+                EXIT
+
+              btrfs subvolume list -o "${root}" |
+                awk '{ print $NF }' |
+                while read -r subvolume; do
+                  btrfs \
+                    subvolume \
+                    delete \
+                    "${cfg.btrfsSnapshots.mountPoint}/$subvolume"
+                done
+
+              btrfs subvolume delete "${root}"
+              btrfs subvolume snapshot "${blankRoot}" "${root}"
+            '';
+
+            serviceConfig.Type = "oneshot";
+            unitConfig.DefaultDependencies = "no";
+            wantedBy = ["initrd.target"];
+          };
+        };
+
       environment.persistence.${cfg.path}.directories = [
         "/etc/ssh"
         "/var/lib/systemd/timers"