ahuston-0/nix-dotfiles
1
0
Fork 0
Code Issues Pull Requests 3 Actions 4 Packages Projects Releases Wiki Activity

add dynamic system generation (#46)

Browse Source
This commit is contained in:
Dennis
2024-01-30 18:37:13 +01:00
committed by GitHub
parent 664fa4709b
commit 6d54aec60c
7 changed files with 105 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files

90
modules/backup.nix
View File

@ -7,6 +7,12 @@ in
options.services.backup = {
enable = lib.mkEnableOption "backup";
offsite = lib.mkOption {
type = with lib.types; listOf str;
default = [ ];
description = "Offsite backup hostnames.";
};
paths = lib.mkOption {
type = with lib.types; listOf str;
default = [ ];
@ -18,19 +24,31 @@ in
default = [ ];
description = "Extra paths to exclude in backup.";
};
backup_at = lib.mkOption {
type = lib.types.int;
default = 2;
description = "Time to run backup.";
};
};
config = {
assertions = [{
assertion = cfg.paths != [ ] -> cfg.enable;
message = "Configuring backup services.backup.paths without enabling services.backup.enable is useless!";
}];
assertions = [
{
assertion = cfg.paths != [ ] -> cfg.enable;
message = "Configuring backup services.backup.paths without enabling services.backup.enable is useless!";
}
{
assertion = cfg.backup_at < 24;
message = "Backup time must be less than 24 hours!";
}
];
services = {
postgresqlBackup = {
inherit (config.services.postgresql) enable;
backupAll = true;
startAt = "*-*-* 04:00:00";
startAt = "*-*-* ${lib.fixedWidthString 2 "0" (toString cfg.backup_at)}:00:00";
};
restic.backups =
@ -39,6 +57,7 @@ in
extraBackupArgs = [
"--exclude-file=${pkgs.writeText "restic-exclude-file" (lib.concatMapStrings (x: x + "\n") cfg.exclude)}"
];
initialize = true;
passwordFile = config.sops.secrets."restic/password".path;
paths = [
@ -46,6 +65,8 @@ in
"/etc/machine-id"
"/etc/passwd"
"/etc/shadow"
"/etc/ssh/ssh_host_ecdsa_key"
"/etc/ssh/ssh_host_ecdsa_key.pub"
"/etc/ssh/ssh_host_ed25519_key"
"/etc/ssh/ssh_host_ed25519_key.pub"
"/etc/ssh/ssh_host_rsa_key"
@ -55,53 +76,59 @@ in
"/var/lib/nixos/"
] ++ cfg.paths
++ lib.optional config.services.postgresql.enable "/var/backup/postgresql/"
++ lib.optional config.services.mysql.enable "/var/lib/mysql/"
++ lib.optional (config.security.acme.certs != { }) "/var/lib/acme/"
++ lib.optional config.security.dhparams.enable "/var/lib/dhparams/";
++ lib.optional config.security.dhparams.enable "/var/lib/dhparams/"
++ lib.optional config.mailserver.enable config.mailserver.mailDirectory;
pruneOpts = [
"--group-by host"
"--keep-daily 7"
"--keep-weekly 4"
"--keep-monthly 12"
];
timerConfig = {
OnCalendar = "*-*-* 04:30:00";
OnCalendar = "*-*-* ${lib.fixedWidthString 2 "0" (toString cfg.backup_at)}:30:00";
RandomizedDelaySec = "5m";
};
};
in
lib.mkIf cfg.enable {
server9 = commonOpts // {
repositoryFile = config.sops.secrets."restic/repositories/server9".path;
local = commonOpts // {
repository = "/var/backup";
};
offsite = commonOpts // {
offsite = lib.mkIf (cfg.offsite != [ ]) commonOpts // {
repository = "sftp://offsite/${config.networking.hostName}";
};
};
};
sops.secrets = lib.mkIf cfg.enable {
"restic/offsite/private" = {
owner = "root";
path = "/root/.ssh/id_offsite-backup";
sopsFile = ./backup.yaml;
};
"restic/offsite/public" = {
owner = "root";
path = "/root/.ssh/id_offsite-backup.pub";
sopsFile = ./backup.yaml;
};
"restic/offsite/ssh-config" = {
owner = "root";
path = "/root/.ssh/config";
sopsFile = ./backup.yaml;
};
sops.secrets = lib.mkIf (cfg.enable && cfg.offsite != [ ])
{
"restic/offsite/private" = {
owner = "root";
path = "/root/.ssh/id_offsite-backup";
sopsFile = ./backup.yaml;
};
# relies on defaultSopsFile
"restic/offsite/public" = {
owner = "root";
path = "/root/.ssh/id_offsite-backup.pub";
sopsFile = ./backup.yaml;
};
"restic/offsite/ssh-config" = {
owner = "root";
path = "/root/.ssh/config";
sopsFile = ./backup.yaml;
};
} // lib.mkIf cfg.enable {
"restic/password".owner = "root";
"restic/repositories/server9".owner = "root";
};
system.activationScripts.linkResticSSHConfigIntoVirtioFS = lib.mkIf cfg.enable ''
system.activationScripts.linkResticSSHConfigIntoVirtioFS = lib.mkIf (cfg.enable && cfg.offsite != [ ]) ''
echo "Linking restic ssh config..."
mkdir -m700 -p /home/root/.ssh/
ln -fs {,/home}/root/.ssh/id_offsite-backup
@ -111,9 +138,10 @@ in
systemd = lib.mkIf cfg.enable {
services = {
restic-backups-server9.serviceConfig.Environment = "RESTIC_PROGRESS_FPS=0.016666";
restic-backups-offsite.serviceConfig.Environment = "RESTIC_PROGRESS_FPS=0.016666";
restic-backups-local.serviceConfig.Environment = "RESTIC_PROGRESS_FPS=0.016666";
restic-backups-offsite.serviceConfig.Environment = lib.mkIf (cfg.offsite != [ ]) "RESTIC_PROGRESS_FPS=0.016666";
};
timers = lib.mkIf config.services.postgresqlBackup.enable {
postgresqlBackup.timerConfig.RandomizedDelaySec = "5m";
};