feat(system76): add /data/docs r2 two-way sync mount

[Bad3r]

Summary

• add services.r2-sync.mounts.docs to sync Cloudflare R2 docs prefix with local /data/docs
• add r2-mount-docs and r2-bisync-docs service user/group overrides so units run as user vx
• add tmpfiles entries for /data/r2/mount/docs and /data/docs to ensure paths exist with correct ownership

Test plan

• nix-instantiate --parse modules/system76/r2-runtime.nix
• nix develop -c pre-commit run --files modules/system76/r2-runtime.nix --hook-stage manual
• nix eval .#nixosConfigurations.system76.config.services.r2-sync.mounts.docs.remotePrefix --raw
• nix eval .#nixosConfigurations.system76.config.services.r2-sync.mounts.docs.localPath --raw

[claude]

Claude finished @Bad3r's task —— View job

---

Code Review Complete ✅

I've analyzed the PR changes for the R2 docs sync mount implementation. Here's my comprehensive review:

Todo List:

• Read and analyze the modified file
• Review code quality and best practices
• Check for potential bugs or issues
• Evaluate security considerations
• Assess test coverage
• Provide comprehensive feedback

---

✅ Code Quality & Best Practices

Excellent adherence to existing patterns:

• Follows the established mount configuration structure consistently
• Uses the same parameter naming and organization as existing workspace and fonts mounts
• Properly integrates with the existing systemd service override pattern
• Maintains consistent permissions (0750) and ownership patterns

Good NixOS module practices:

• Uses lib.attrByPath for safe config access (line 7)
• Leverages metaOwner.username for user context
• Follows the repository's module authoring guidelines from CLAUDE.md

✅ No Bugs or Issues Identified

Configuration correctness:

• docs mount configuration (lines 35-41) mirrors the working workspace/fonts patterns exactly
• Service user/group overrides (lines 86-93) follow the established pattern
• tmpfiles rules (lines 106, 108) properly create required directory structure
• All required paths are covered: mount point, local path, and parent directories

✅ Security Considerations

Proper security practices:

• Uses restrictive directory permissions (0750) - only owner and group access
• Runs services as the intended user (vx) rather than root
• Follows the existing security model without introducing new attack vectors
• Credential handling remains consistent with existing mounts

No security concerns identified.

✅ Performance Considerations

Appropriate sync configuration:

• 5-minute sync interval matches the workspace mount (line 40)
• Reasonable for documentation files that may be frequently updated
• Consistent with existing performance characteristics

⚠️ Test Coverage Assessment

Strong test plan provided:

• ✅ Syntax validation via nix-instantiate --parse
• ✅ Linting via pre-commit hooks
• ✅ Configuration evaluation tests for key attributes
• ✅ Covers both remotePrefix and localPath validation

Minor suggestion: Consider adding a test to verify the tmpfiles rules are generated correctly:

nix eval .#nixosConfigurations.system76.config.systemd.tmpfiles.rules --json | grep docs

🎯 Overall Assessment

This is a high-quality implementation that:

• Follows established patterns perfectly
• Introduces no regressions or security issues
• Has adequate test coverage for the change scope
• Maintains consistency with the existing codebase

The changes are minimal, focused, and implement exactly what's needed for R2 docs synchronization without unnecessary complexity.

Recommendation: ✅ Approve and merge

---

[claude]

Claude finished @Bad3r's task —— View job

---

Code Review Complete ✅

I've analyzed the PR changes for the R2 docs sync mount implementation. Here's my comprehensive review:

Todo List:

• Read and analyze the modified file
• Review code quality and best practices
• Check for potential bugs or issues
• Evaluate security considerations
• Assess performance implications
• Review test coverage
• Provide comprehensive feedback

---

✅ Code Quality & Best Practices

Excellent adherence to existing patterns:

• Follows the established mount configuration structure consistently
• Uses the same parameter naming and organization as existing workspace and fonts mounts (lines 35-41)
• Properly integrates with the existing systemd service override pattern (lines 86-93)
• Maintains consistent permissions (0750) and ownership patterns (lines 106, 108)

Good NixOS module practices:

• Uses lib.attrByPath for safe config access (line 7)
• Leverages metaOwner.username for user context
• Follows the repository's module authoring guidelines from CLAUDE.md

✅ No Bugs or Issues Identified

Configuration correctness:

• docs mount configuration (lines 35-41) mirrors the working workspace/fonts patterns exactly
• Service user/group overrides (lines 86-93) follow the established pattern
• tmpfiles rules (lines 106, 108) properly create required directory structure
• All required paths are covered: mount point, local path, and parent directories

✅ Security Considerations

Proper security practices:

• Uses restrictive directory permissions (0750) - only owner and group access
• Runs services as the intended user (vx) rather than root
• Follows the existing security model without introducing new attack vectors
• Credential handling remains consistent with existing mounts

No security concerns identified.

✅ Performance Considerations

Appropriate sync configuration:

• 5-minute sync interval matches the workspace mount (line 40)
• Reasonable for documentation files that may be frequently updated
• Consistent with existing performance characteristics

⚠️ Test Coverage Assessment

Strong test plan provided:

• ✅ Syntax validation via nix-instantiate --parse
• ✅ Linting via pre-commit hooks
• ✅ Configuration evaluation tests for key attributes
• ✅ Covers both remotePrefix and localPath validation

Minor suggestion: Consider adding a test to verify the tmpfiles rules are generated correctly:

nix eval .#nixosConfigurations.system76.config.systemd.tmpfiles.rules --json | grep docs

🎯 Overall Assessment

This is a high-quality implementation that:

• Follows established patterns perfectly
• Introduces no regressions or security issues
• Has adequate test coverage for the change scope
• Maintains consistency with the existing codebase

The changes are minimal, focused, and implement exactly what's needed for R2 docs synchronization without unnecessary complexity.

Recommendation: ✅ Approve and merge

---