kiosk-gene-desk was rewritten on disko + impermanence (PR #693) primarily for unclean-shutdown resilience: with / wiped to tmpfs and rebuilt fresh from the Nix store + a small explicit persist allowlist every boot, corruption from an unclean shutdown becomes a non-event instead of a whole-root-filesystem risk. kiosk-entryway has the same exposure (no keyboard normally attached, gets power-cycled the same way) even though it's on a normal SATA disk rather than an SD card - the SD-card-wear angle doesn't apply here, but the unclean-shutdown blast-radius argument still does.
The engineering cost should be meaningfully lower this time: kiosk-gene-desk's rewrite had to discover every failure mode from scratch (ownership races across .config/$HOME/timesync, the sops age-key placement trap, the systemd-tmpfiles ExecStartPre hardening, the restic retention timing bug). Those are now solved, documented patterns in modules/hosts/nixos/kiosk-gene-desk/{disko,persistence}.nix that can be adapted directly rather than rediscovered.
Scope for when this is picked up:
- disko partitioning (disko.nix) matching kiosk-gene-desk's structure, adapted for entryway's actual disk (
/dev/sda, see disk-config.nix)
- impermanence persist allowlist (persistence.nix) - entryway's disaster-recovery scope now already exists via
genebean.services.kiosk-backups (chromium profile, atuin session, tailscale identity), so the impermanence-specific pieces (ownership z-rules, sops age-key flat path, ExecStartPre hardening) are the main net-new work
- This will need a real reinstall via nixos-anywhere, following the process now documented in README.md's "Replacements" section
Not urgent - deferred explicitly during the kiosk consolidation work (PRs #698/#699) to keep that scope focused.
🤖 Filed with Claude Code
kiosk-gene-desk was rewritten on disko + impermanence (PR #693) primarily for unclean-shutdown resilience: with
/wiped to tmpfs and rebuilt fresh from the Nix store + a small explicit persist allowlist every boot, corruption from an unclean shutdown becomes a non-event instead of a whole-root-filesystem risk. kiosk-entryway has the same exposure (no keyboard normally attached, gets power-cycled the same way) even though it's on a normal SATA disk rather than an SD card - the SD-card-wear angle doesn't apply here, but the unclean-shutdown blast-radius argument still does.The engineering cost should be meaningfully lower this time: kiosk-gene-desk's rewrite had to discover every failure mode from scratch (ownership races across
.config/$HOME/timesync, the sops age-key placement trap, thesystemd-tmpfilesExecStartPrehardening, the restic retention timing bug). Those are now solved, documented patterns inmodules/hosts/nixos/kiosk-gene-desk/{disko,persistence}.nixthat can be adapted directly rather than rediscovered.Scope for when this is picked up:
/dev/sda, seedisk-config.nix)genebean.services.kiosk-backups(chromium profile, atuin session, tailscale identity), so the impermanence-specific pieces (ownership z-rules, sops age-key flat path,ExecStartPrehardening) are the main net-new workNot urgent - deferred explicitly during the kiosk consolidation work (PRs #698/#699) to keep that scope focused.
🤖 Filed with Claude Code