From 827465ca5926bd163ba35c8bd99a2fcf03837b40 Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Fri, 16 Oct 2026 05:41:33 +0400
Subject: [PATCH] security: keep rootless podman storage on /mnt/data

Container images and build caches (anotherim-js's build images alone
are several GB each) had filled the root filesystem, and a NDK unzip
in an image build failed with the disk full. Point
rootless_storage_path at the data disk. Existing storage was moved
there with its libpod database paths rewritten.

Assisted-by: Claude:opus-5
---
 modules/security.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/security.nix b/modules/security.nix
index 3dfbb25..77a12e8 100644
--- a/modules/security.nix
+++ b/modules/security.nix
@@ -75,6 +75,8 @@
       defaultNetwork.settings.dns_enabled = true;
     };
     oci-containers.backend = "podman";
+    # Rootless images and build caches on the data disk, not the root fs
+    containers.storage.settings.storage.rootless_storage_path = "/mnt/data/containers/$USER";
   };
 
   virtualisation.docker.enable = lib.mkForce false;