Add jq to the base role.

nix/configuration/hosts/odo/default.nix

@@ -32,6 +32,11 @@
     boot.loader.generic-extlinux-compatible.enable = true;
     boot.loader.systemd-boot.enable = lib.mkForce false;
 
+    me.rollback.dataset = [
+      "zroot/linux/nix/root@blank"
+      "zroot/linux/nix/home@blank"
+    ];
+
     me.optimizations = {
       enable = true;
       arch = "znver4";

nix/configuration/hosts/odowork/default.nix

@@ -13,6 +13,7 @@
     ./screen_brightness.nix
     ./wifi.nix
     ./framework_module.nix
+    ./ssh_config.nix
   ];
 
   config = {
@@ -32,6 +33,11 @@
     boot.loader.generic-extlinux-compatible.enable = true;
     boot.loader.systemd-boot.enable = lib.mkForce false;
 
+    me.rollback.dataset = [
+      "zroot/linux/nixwork/root@blank"
+      "zroot/linux/nixwork/home@blank"
+    ];
+
     me.optimizations = {
       enable = true;
       arch = "znver4";
@@ -120,7 +126,10 @@
     me.wireguard.activated = [
       "wgh"
     ];
-    me.wireguard.deactivated = [ "wgf" ];
+    me.wireguard.deactivated = [
+      "wgf"
+      "colo"
+    ];
     me.yubikey.enable = true;
     me.zfs.enable = true;
     me.zrepl.enable = true;

nix/configuration/hosts/odowork/ssh_config.nix

@@ -0,0 +1,15 @@
+{
+  lib,
+  ...
+}:
+{
+  imports = [ ];
+
+  config = {
+    me.install.user.talexander.file = {
+      ".ssh/config" = {
+        source = lib.mkForce "/persist/manual/ssh/talexander/config";
+      };
+    };
+  };
+}

nix/configuration/hosts/quark/default.nix

@@ -30,6 +30,11 @@
     boot.loader.generic-extlinux-compatible.enable = true;
     boot.loader.systemd-boot.enable = lib.mkForce false;
 
+    me.rollback.dataset = [
+      "zroot/linux/nix/root@blank"
+      "zroot/linux/nix/home@blank"
+    ];
+
     me.optimizations = {
       enable = true;
       arch = "znver4";

nix/configuration/roles/base/default.nix

@@ -59,6 +59,7 @@ in
       nix-output-monitor # For better view into nixos-rebuild
       nix-serve-ng # Serve nix store over http
       cleanup_temporary_files
+      jq
     ];
   };
 }

nix/configuration/roles/boot/default.nix

@@ -23,6 +23,27 @@
       example = true;
       description = "Enable to use secure boot.";
     };
+
+    rollback.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      example = true;
+      description = "Whether we want to enable rolling back during boot.";
+    };
+
+    rollback.dataset = lib.mkOption {
+      default = { };
+      example = lib.literalExpression ''
+        {
+          "zroot/linux/nix/root@blank" = true;
+          "zroot/linux/nix/home@blank" = lib.mkForce false;
+        }
+      '';
+      type = lib.types.coercedTo (lib.types.listOf lib.types.str) (
+        enabled: lib.listToAttrs (map (fs: lib.nameValuePair fs true) enabled)
+      ) (lib.types.attrsOf lib.types.bool);
+      description = "List of ZFS datasets to rollback to during boot.";
+    };
   };
 
   config = lib.mkIf config.me.boot.enable (
@@ -51,7 +72,7 @@
 
         # Check what will be lost with `zfs diff zroot/linux/root@blank`
         boot.initrd.systemd.enable = lib.mkDefault true;
-        boot.initrd.systemd.services.zfs-rollback = {
+        boot.initrd.systemd.services.zfs-rollback = lib.mkIf config.me.rollback.enable {
           description = "Rollback ZFS root dataset to blank snapshot";
           wantedBy = [
             "initrd.target"
@@ -64,11 +85,12 @@
           ];
           unitConfig.DefaultDependencies = "no";
           serviceConfig.Type = "oneshot";
-          script = ''
-            ${config.boot.zfs.package}/sbin/zfs rollback -r zroot/linux/nix/root@blank
-            ${config.boot.zfs.package}/sbin/zfs rollback -r zroot/linux/nix/home@blank
-            echo "rollback complete"
-          '';
+          script = lib.concatStringsSep "\n" (
+            (builtins.map (ds: "${config.boot.zfs.package}/sbin/zfs rollback -r '${ds}'") (
+              builtins.attrNames config.me.rollback.dataset
+            ))
+            ++ [ ''echo "rollback complete"'' ]
+          );
         };
 
         # boot.loader.systemd-boot.extraEntries = {