8 files changed, 64 insertions, 1 deletions
diff --git a/system/services/fail2ban/default.nix b/system/services/fail2ban/default.nix
index f1487e4..1c47568 100644
--- a/system/services/fail2ban/default.nix
+++ b/system/services/fail2ban/default.nix
@@ -1,4 +1,13 @@
 {...}: {
+  vhack.persist.directories = [
+    {
+      directory = "/var/lib/fail2ban";
+      user = "fail2ban";
+      group = "fail2ban";
+      mode = "0700";
+    }
+  ];
+
   services.fail2ban = {
     enable = true;
     maxretry = 7; # ban after 7 failures
diff --git a/system/services/mail/default.nix b/system/services/mail/default.nix
index 382a87f..c69e6bd 100644
--- a/system/services/mail/default.nix
+++ b/system/services/mail/default.nix
@@ -6,6 +6,10 @@
   ];
   users = import ./users.nix {};
 in {
+  imports = [
+    ./impermanence.nix
+  ];
+
   mailserver =
     lib.recursiveUpdate {
       enable = true;
diff --git a/system/impermanence/mods/mail.nix b/system/services/mail/impermanence.nix
index a306ccf..22a5318 100644
--- a/system/impermanence/mods/mail.nix
+++ b/system/services/mail/impermanence.nix
@@ -1,5 +1,5 @@
 {...}: {
-  environment.persistence."/srv".directories = [
+  vhack.persist.directories = [
     {
       directory = "/var/lib/mail/backup";
       user = "virtualMail";
diff --git a/system/services/mastodon/default.nix b/system/services/mastodon/default.nix
index f613bf3..15b8609 100644
--- a/system/services/mastodon/default.nix
+++ b/system/services/mastodon/default.nix
@@ -9,6 +9,15 @@
       patches = (attrs.patches or []) ++ [./patches/0001-feat-treewide-Increase-character-limit-to-5000-in-me.patch];
     });
 in {
+  vhack.persist.directories = [
+    {
+      directory = "/var/lib/mastodon";
+      user = "mastodon";
+      group = "mastodon";
+      mode = "0700";
+    }
+  ];
+
   services.mastodon = {
     enable = true;
 
diff --git a/system/services/matrix/default.nix b/system/services/matrix/default.nix
index b75d1f1..043d9c0 100644
--- a/system/services/matrix/default.nix
+++ b/system/services/matrix/default.nix
@@ -14,6 +14,24 @@
 in {
   networking.firewall.allowedTCPPorts = [80 443];
 
+  vhack.persist.directories = [
+    {
+      directory = "/var/lib/matrix";
+      user = "matrix-synapse";
+      group = "matrix-synapse";
+      mode = "0700";
+    }
+    {
+      directory = "/var/lib/mautrix-whatsapp";
+      user = "mautrix-whatsapp";
+      group = "matrix-synapse";
+      mode = "0750";
+    }
+  ];
+  systemd.tmpfiles.rules = [
+    "d /etc/matrix 0755 matrix-synapse matrix-synapse"
+  ];
+
   services = {
     postgresql = {
       enable = true;
diff --git a/system/services/minecraft/default.nix b/system/services/minecraft/default.nix
index e659af0..9bc98b9 100644
--- a/system/services/minecraft/default.nix
+++ b/system/services/minecraft/default.nix
@@ -1,4 +1,13 @@
 {lib, ...}: {
+  vhack.persist.directories = [
+    {
+      directory = "/var/lib/minecraft";
+      user = "minecraft";
+      group = "minecraft";
+      mode = "0700";
+    }
+  ];
+
   nixpkgs.config.allowUnfreePredicate = pkg:
     builtins.elem (lib.getName pkg) [
       "minecraft-server"
diff --git a/system/services/murmur/default.nix b/system/services/murmur/default.nix
index 1dcd781..dec79ba 100644
--- a/system/services/murmur/default.nix
+++ b/system/services/murmur/default.nix
@@ -1,6 +1,15 @@
 {...}: let
   murmurStore = "/var/lib/murmur";
 in {
+  vhack.persist.directories = [
+    {
+      directory = "/var/lib/murmur";
+      user = "murmur";
+      group = "murmur";
+      mode = "0700";
+    }
+  ];
+
   services.murmur = {
     enable = true;
     openFirewall = true;
diff --git a/system/services/taskserver/default.nix b/system/services/taskserver/default.nix
index 2e4370f..04b6a8b 100644
--- a/system/services/taskserver/default.nix
+++ b/system/services/taskserver/default.nix
@@ -4,6 +4,11 @@ in {
   environment.etc = {
     "tmpfiles.d/taskserver.conf".source = config.age.secrets.taskserverSystemdTmpfiles.path;
   };
+
+  vhack.persist.directories = [
+    "/var/lib/taskserver"
+  ];
+
   services.taskserver = {
     enable = true;
     pki.manual = {