From 0b4eaa6156f03814a1bf204a62f17d66a96e07b2 Mon Sep 17 00:00:00 2001
From: Benedikt Peetz <benedikt.peetz@b-peetz.de>
Date: Wed, 15 Jul 2026 21:59:24 +0200
Subject: hosts/tiamat: Vendor the legacy disk module

Otherwise, I would need to also re-deploy tiamat, which seems not like a
useful approach.
---
 hosts/by-name/tiamat/legacy-disk-module/fstrim.nix | 51 ++++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 hosts/by-name/tiamat/legacy-disk-module/fstrim.nix

(limited to 'hosts/by-name/tiamat/legacy-disk-module/fstrim.nix')

diff --git a/hosts/by-name/tiamat/legacy-disk-module/fstrim.nix b/hosts/by-name/tiamat/legacy-disk-module/fstrim.nix
new file mode 100644
index 00000000..0fbb6c83
--- /dev/null
+++ b/hosts/by-name/tiamat/legacy-disk-module/fstrim.nix
@@ -0,0 +1,51 @@
+# nixos-config - My current NixOS configuration
+#
+# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# This file is part of my nixos-config.
+#
+# You should have received a copy of the License along with this program.
+# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
+{
+  pkgs,
+  lib,
+  cfg,
+}: {
+  timers.fstrim = lib.mkIf cfg.ssd {
+    wantedBy = ["timers.target"];
+    wants = ["fstrim.service"];
+    unitConfig = {
+      Description = "Discard unused blocks once a week";
+      Documentation = "man:fstrim";
+      ConditionVirtualization = "!container";
+      ConditionPathExists = "!/etc/initrd-release";
+    };
+    timerConfig = {
+      OnCalendar = "weekly";
+      AccuracySec = "1h";
+      Persistent = "true";
+      RandomizedDelaySec = "6000";
+    };
+  };
+  services.fstrim = lib.mkIf cfg.ssd {
+    wantedBy = lib.mkForce [];
+    unitConfig = {
+      Description = "Discard unused blocks on filesystems from /etc/fstab";
+      Documentation = "man:fstrim(8)";
+      ConditionVirtualization = "!container";
+    };
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.util-linux}/bin/fstrim --listed-in /etc/fstab:/proc/self/mountinfo --verbose --quiet-unsupported";
+      PrivateDevices = "no";
+      PrivateNetwork = "yes";
+      PrivateUsers = "no";
+      ProtectKernelTunables = "yes";
+      ProtectKernelModules = "yes";
+      ProtectControlGroups = "yes";
+      MemoryDenyWriteExecute = "yes";
+      SystemCallFilter = "@default @file-system @basic-io @system-service";
+    };
+  };
+}
-- 
cgit v1.3.1