From 8590aa37d6cca261af3d54360c7fbb026f285dbd Mon Sep 17 00:00:00 2001
From: ibizaman <ibizaman@tiserbox.com>
Date: Sat, 14 Mar 2026 00:47:33 +0100
Subject: [PATCH] zfs: add permissions management

---
 modules/blocks/zfs.nix | 49 ++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 47 insertions(+), 2 deletions(-)

diff --git a/modules/blocks/zfs.nix b/modules/blocks/zfs.nix
index 6f4126e..4d9faea 100644
--- a/modules/blocks/zfs.nix
+++ b/modules/blocks/zfs.nix
@@ -43,7 +43,39 @@ in
 
             path = lib.mkOption {
               type = lib.types.str;
-              description = "Path this dataset should be mounted on.";
+              description = "Path this dataset should be mounted on. If the string 'none' is given, the dataset will not be mounted.";
+            };
+
+            mode = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              description = "If non null, unix mode to apply to the dataset root folder.";
+              default = null;
+              example = "ug=rwx,g+s";
+            };
+
+            owner = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              description = "If non null, unix user to apply to the dataset root folder.";
+              default = null;
+              example = "syncthing";
+            };
+
+            group = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              description = "If non null, unix group to apply to the dataset root folder.";
+              default = null;
+              example = "syncthing";
+            };
+
+            defaultACLs = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              description = ''
+                If non null, default ACL to set on the dataset root folder.
+
+                Executes "setfacl -d -m $acl $path"
+              '';
+              default = null;
+              example = "g:syncthing:rwX";
             };
           };
         }
@@ -75,8 +107,21 @@ in
 
           [ "$(${pkgs.zfs}/bin/zfs get -H mountpoint -o value ${dataset})" = ${cfg'.path} ] \
             || ${pkgs.zfs}/bin/zfs set \
-               mountpoint=${cfg'.path} \
+               mountpoint="${cfg'.path}" \
                ${dataset}
+
+        ''
+        + lib.optionalString (cfg'.path != "none" && cfg'.mode != null) ''
+          chmod "${cfg'.mode}" "${cfg'.path}"
+        ''
+        + lib.optionalString (cfg'.path != "none" && cfg'.owner != null) ''
+          chown "${cfg'.owner}" "${cfg'.path}"
+        ''
+        + lib.optionalString (cfg'.path != "none" && cfg'.group != null) ''
+          chown :"${cfg'.group}" "${cfg'.path}"
+        ''
+        + lib.optionalString (cfg'.path != "none" && cfg'.defaultACLs != null) ''
+          ${pkgs.acl}/bin/setfacl -d -m "${cfg'.defaultACLs}" "${cfg'.path}"
         '';
       }
     ) cfg.datasets;