From 837dea284c08b9c832844aeadd777c61beee4b05 Mon Sep 17 00:00:00 2001
From: "Timothy J. Aveni" <tja@berkeley.edu>
Date: Tue, 30 Jun 2026 21:43:28 -0700
Subject: [PATCH] Export shared ZFS nix-store module

---
 flake.nix                       |  3 ++
 main.tf                         |  1 +
 nixos/baseline.nix              | 28 ++----------------
 nixos/modules/zfs-nix-store.nix | 50 +++++++++++++++++++++++++++++++++
 user-data.sh.tftpl              | 22 ++++-----------
 variables.tf                    |  6 ++++
 6 files changed, 69 insertions(+), 41 deletions(-)
 create mode 100644 nixos/modules/zfs-nix-store.nix

diff --git a/flake.nix b/flake.nix
index 6256f05..440f956 100644
--- a/flake.nix
+++ b/flake.nix
@@ -14,6 +14,7 @@
         nixpkgs.lib.nixosSystem {
           inherit system;
           modules = [
+            self.nixosModules.zfsNixStore
             ./nixos/baseline.nix
           ];
         };
@@ -111,5 +112,7 @@
           program = "${self.packages.${system}.publish-ami}/bin/publish-ami";
         };
       });
+
+      nixosModules.zfsNixStore = import ./nixos/modules/zfs-nix-store.nix;
     };
 }
diff --git a/main.tf b/main.tf
index ec695bf..8eec704 100644
--- a/main.tf
+++ b/main.tf
@@ -136,6 +136,7 @@ resource "aws_instance" "builder" {
 
   user_data = templatefile("${path.module}/user-data.sh.tftpl", {
     builder_git_rev = var.builder_git_rev
+    builder_repo_url = var.builder_repo_url
     flake_lock_rev  = var.flake_lock_rev
     input_hash      = var.input_hash
     nix_device      = local.nix_device
diff --git a/nixos/baseline.nix b/nixos/baseline.nix
index 61fafcf..024b38f 100644
--- a/nixos/baseline.nix
+++ b/nixos/baseline.nix
@@ -1,8 +1,5 @@
 { config, lib, modulesPath, pkgs, ... }:
 
-let
-  nixPool = "nixos-zfs-nix";
-in
 {
   imports = [
     "${modulesPath}/virtualisation/amazon-image.nix"
@@ -22,28 +19,9 @@ in
   services.amazon-ssm-agent.enable = true;
   services.openssh.enable = lib.mkForce false;
 
-  boot.supportedFilesystems = [ "zfs" ];
-  boot.zfs.extraPools = [ nixPool ];
-  boot.zfs.forceImportRoot = false;
-
-  fileSystems."/nix" = {
-    device = "${nixPool}/nix";
-    fsType = "zfs";
-    neededForBoot = true;
-    options = [
-      "nofail"
-      "x-systemd.device-timeout=30s"
-    ];
-  };
-
-  systemd.sockets.nix-daemon = {
-    after = [ "nix.mount" ];
-    requires = [ "nix.mount" ];
-  };
-
-  systemd.services.nix-daemon = {
-    after = [ "nix.mount" ];
-    requires = [ "nix.mount" ];
+  quixos.modules.zfsNixStore = {
+    enable = true;
+    pool = "nixos-zfs-nix";
   };
 
   system.stateVersion = "25.05";
diff --git a/nixos/modules/zfs-nix-store.nix b/nixos/modules/zfs-nix-store.nix
new file mode 100644
index 0000000..40d49ea
--- /dev/null
+++ b/nixos/modules/zfs-nix-store.nix
@@ -0,0 +1,50 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.quixos.modules.zfsNixStore;
+in
+{
+  # TODO: split this module into a small standalone repo if another AMI family
+  # needs to consume it outside the nixos-zfs-ec2-ami boundary.
+  options.quixos.modules.zfsNixStore = {
+    enable = lib.mkEnableOption "ZFS-backed /nix store mount";
+
+    pool = lib.mkOption {
+      type = lib.types.str;
+      default = "nixos-zfs-nix";
+      description = "ZFS pool containing the /nix dataset.";
+    };
+
+    dataset = lib.mkOption {
+      type = lib.types.str;
+      default = "nix";
+      description = "Dataset within the pool mounted at /nix.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    boot.supportedFilesystems = [ "zfs" ];
+    boot.zfs.extraPools = [ cfg.pool ];
+    boot.zfs.forceImportRoot = false;
+
+    fileSystems."/nix" = {
+      device = "${cfg.pool}/${cfg.dataset}";
+      fsType = "zfs";
+      neededForBoot = true;
+      options = [
+        "nofail"
+        "x-systemd.device-timeout=30s"
+      ];
+    };
+
+    systemd.sockets.nix-daemon = {
+      after = [ "nix.mount" ];
+      requires = [ "nix.mount" ];
+    };
+
+    systemd.services.nix-daemon = {
+      after = [ "nix.mount" ];
+      requires = [ "nix.mount" ];
+    };
+  };
+}
diff --git a/user-data.sh.tftpl b/user-data.sh.tftpl
index 58b9679..5a309d5 100644
--- a/user-data.sh.tftpl
+++ b/user-data.sh.tftpl
@@ -15,9 +15,10 @@ write_config() {
 {
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    amiBuilderModules.url = "git+${builder_repo_url}?rev=${builder_git_rev}";
   };
 
-  outputs = { nixpkgs, ... }:
+  outputs = { nixpkgs, amiBuilderModules, ... }:
     let
       baseModule = { lib, modulesPath, pkgs, ... }: {
           imports = [ "$${modulesPath}/virtualisation/amazon-image.nix" ];
@@ -60,23 +61,11 @@ write_config() {
         };
 
       zfsNixModule = { lib, ... }: {
-          boot.zfs.extraPools = [ "${nix_pool}" ];
           systemd.services.amazon-init.enable = lib.mkForce false;
 
-          fileSystems."/nix" = {
-            device = "${nix_pool}/nix";
-            fsType = "zfs";
-            neededForBoot = true;
-          };
-
-          systemd.sockets.nix-daemon = {
-            after = [ "nix.mount" ];
-            requires = [ "nix.mount" ];
-          };
-
-          systemd.services.nix-daemon = {
-            after = [ "nix.mount" ];
-            requires = [ "nix.mount" ];
+          quixos.modules.zfsNixStore = {
+            enable = true;
+            pool = "${nix_pool}";
           };
         };
 
@@ -137,6 +126,7 @@ RUNNER_EOF
       mkHost = hostName: extraModules: nixpkgs.lib.nixosSystem {
         system = "${system}";
         modules = [
+          amiBuilderModules.nixosModules.zfsNixStore
           baseModule
           ({ ... }: {
             networking.hostName = hostName;
diff --git a/variables.tf b/variables.tf
index b45fddb..89f9c10 100644
--- a/variables.tf
+++ b/variables.tf
@@ -31,6 +31,12 @@ variable "builder_git_rev" {
   description = "Git revision of this AMI builder."
 }
 
+variable "builder_repo_url" {
+  type        = string
+  default     = "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/nixos-zfs-ec2-ami.git"
+  description = "Repository URL containing the AMI builder and shared NixOS modules."
+}
+
 variable "flake_lock_rev" {
   type        = string
   description = "Revision or hash representing flake.lock inputs."