#!/bin/bash

# Pool and vdev creation only. This is run by hand once per pool.
#
# Datasets and their properties are declared in systems/jeeves/zfs.nix and
# reconciled by the zfs_manager service. Do not add zfs create lines here.

# zpools

# media
sudo zpool create -o ashift=12 -O acltype=posixacl -O atime=off -O dnodesize=auto -O xattr=sa -O compression=zstd -m /zfs/media media mirror
sudo zpool add media -o ashift=12 special mirror

# storage
sudo zpool create -o ashift=12 -O acltype=posixacl -O atime=off -O dnodesize=auto -O xattr=sa -O compression=zstd -m /zfs/storage storage
sudo zpool add storage -o ashift=12 special mirror
sudo zpool add storage -o ashift=12 logs mirror

# scratch
sudo zpool create scratch -o ashift=12 -O acltype=posixacl -O atime=off -O dnodesize=auto -O xattr=sa -O compression=zstd -O encryption=aes-256-gcm -O keyformat=hex -O keylocation=file:///root/zfs.key -m /zfs/scratch

# The two encrypted parent datasets have to exist before zfs_manager can create
# anything under them, since encryption cannot be set after creation.
# These will be removed if/when the media and storage pools are encrypted in the future.
sudo zfs create media/secure -o encryption=aes-256-gcm -o keyformat=hex -o keylocation=file:///root/zfs.key
sudo zfs create storage/secure -o encryption=aes-256-gcm -o keyformat=hex -o keylocation=file:///root/zfs.key