Export shared ZFS nix-store module

flake.nix

@@ -14,6 +14,7 @@
         nixpkgs.lib.nixosSystem {
           inherit system;
           modules = [
+            self.nixosModules.zfsNixStore
             ./nixos/baseline.nix
           ];
         };
@@ -111,5 +112,7 @@
           program = "${self.packages.${system}.publish-ami}/bin/publish-ami";
         };
       });
+
+      nixosModules.zfsNixStore = import ./nixos/modules/zfs-nix-store.nix;
     };
 }

main.tf

@@ -136,6 +136,7 @@ resource "aws_instance" "builder" {
 
   user_data = templatefile("${path.module}/user-data.sh.tftpl", {
     builder_git_rev = var.builder_git_rev
+    builder_repo_url = var.builder_repo_url
     flake_lock_rev  = var.flake_lock_rev
     input_hash      = var.input_hash
     nix_device      = local.nix_device

nixos/baseline.nix

@@ -1,8 +1,5 @@
 { config, lib, modulesPath, pkgs, ... }:
 
-let
-  nixPool = "nixos-zfs-nix";
-in
 {
   imports = [
     "${modulesPath}/virtualisation/amazon-image.nix"
@@ -22,28 +19,9 @@ in
   services.amazon-ssm-agent.enable = true;
   services.openssh.enable = lib.mkForce false;
 
-  boot.supportedFilesystems = [ "zfs" ];
+  quixos.modules.zfsNixStore = {
-  boot.zfs.extraPools = [ nixPool ];
+    enable = true;
-  boot.zfs.forceImportRoot = false;
+    pool = "nixos-zfs-nix";
-
-  fileSystems."/nix" = {
-    device = "${nixPool}/nix";
-    fsType = "zfs";
-    neededForBoot = true;
-    options = [
-      "nofail"
-      "x-systemd.device-timeout=30s"
-    ];
-  };
-
-  systemd.sockets.nix-daemon = {
-    after = [ "nix.mount" ];
-    requires = [ "nix.mount" ];
-  };
-
-  systemd.services.nix-daemon = {
-    after = [ "nix.mount" ];
-    requires = [ "nix.mount" ];
   };
 
   system.stateVersion = "25.05";

nixos/modules/zfs-nix-store.nix

@@ -0,0 +1,50 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.quixos.modules.zfsNixStore;
+in
+{
+  # TODO: split this module into a small standalone repo if another AMI family
+  # needs to consume it outside the nixos-zfs-ec2-ami boundary.
+  options.quixos.modules.zfsNixStore = {
+    enable = lib.mkEnableOption "ZFS-backed /nix store mount";
+
+    pool = lib.mkOption {
+      type = lib.types.str;
+      default = "nixos-zfs-nix";
+      description = "ZFS pool containing the /nix dataset.";
+    };
+
+    dataset = lib.mkOption {
+      type = lib.types.str;
+      default = "nix";
+      description = "Dataset within the pool mounted at /nix.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    boot.supportedFilesystems = [ "zfs" ];
+    boot.zfs.extraPools = [ cfg.pool ];
+    boot.zfs.forceImportRoot = false;
+
+    fileSystems."/nix" = {
+      device = "${cfg.pool}/${cfg.dataset}";
+      fsType = "zfs";
+      neededForBoot = true;
+      options = [
+        "nofail"
+        "x-systemd.device-timeout=30s"
+      ];
+    };
+
+    systemd.sockets.nix-daemon = {
+      after = [ "nix.mount" ];
+      requires = [ "nix.mount" ];
+    };
+
+    systemd.services.nix-daemon = {
+      after = [ "nix.mount" ];
+      requires = [ "nix.mount" ];
+    };
+  };
+}

user-data.sh.tftpl

@@ -15,9 +15,10 @@ write_config() {
 {
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    amiBuilderModules.url = "git+${builder_repo_url}?rev=${builder_git_rev}";
   };
 
-  outputs = { nixpkgs, ... }:
+  outputs = { nixpkgs, amiBuilderModules, ... }:
     let
       baseModule = { lib, modulesPath, pkgs, ... }: {
           imports = [ "$${modulesPath}/virtualisation/amazon-image.nix" ];
@@ -60,23 +61,11 @@ write_config() {
         };
 
       zfsNixModule = { lib, ... }: {
-          boot.zfs.extraPools = [ "${nix_pool}" ];
           systemd.services.amazon-init.enable = lib.mkForce false;
 
-          fileSystems."/nix" = {
+          quixos.modules.zfsNixStore = {
-            device = "${nix_pool}/nix";
+            enable = true;
-            fsType = "zfs";
+            pool = "${nix_pool}";
-            neededForBoot = true;
-          };
-
-          systemd.sockets.nix-daemon = {
-            after = [ "nix.mount" ];
-            requires = [ "nix.mount" ];
-          };
-
-          systemd.services.nix-daemon = {
-            after = [ "nix.mount" ];
-            requires = [ "nix.mount" ];
           };
         };
 
@@ -137,6 +126,7 @@ RUNNER_EOF
       mkHost = hostName: extraModules: nixpkgs.lib.nixosSystem {
         system = "${system}";
         modules = [
+          amiBuilderModules.nixosModules.zfsNixStore
           baseModule
           ({ ... }: {
             networking.hostName = hostName;

variables.tf

@@ -31,6 +31,12 @@ variable "builder_git_rev" {
   description = "Git revision of this AMI builder."
 }
 
+variable "builder_repo_url" {
+  type        = string
+  default     = "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/nixos-zfs-ec2-ami.git"
+  description = "Repository URL containing the AMI builder and shared NixOS modules."
+}
+
 variable "flake_lock_rev" {
   type        = string
   description = "Revision or hash representing flake.lock inputs."