add dynamic system generation (#46)

flake.lock

@@ -59,11 +59,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1706221476,
+        "lastModified": 1706473109,
-        "narHash": "sha256-T4b8YafVjHXvtDY8ARec1WrXO8uyyNZOpNgv9yoQy2M=",
+        "narHash": "sha256-iyuAvpKTsq2u23Cr07RcV5XlfKExrG8gRpF75hf1uVc=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c7ce343d9bf1a329056a4dd5b32ea8cc43b55e15",
+        "rev": "d634c3abafa454551f2083b054cd95c3f287be61",
         "type": "github"
       },
       "original": {
@@ -152,11 +152,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1705314364,
+        "lastModified": 1706608774,
-        "narHash": "sha256-MtYY3Labc/Sc1UtULrum3GKJ1H5ClrY9GyvNeVSxkEA=",
+        "narHash": "sha256-kbMofnGXCRPInXWm7UAfMYcvIAuHIZO0vBytNhWt+nc=",
         "owner": "SuperSandro2000",
         "repo": "nixos-modules",
-        "rev": "03ebaa1bcbac8daa6709beccb43312806e9173fc",
+        "rev": "2dae76c258451a2c98e3dee5d1144f5061878e2a",
         "type": "github"
       },
       "original": {
@@ -167,11 +167,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1705856552,
+        "lastModified": 1706371002,
-        "narHash": "sha256-JXfnuEf5Yd6bhMs/uvM67/joxYKoysyE3M2k6T3eWbg=",
+        "narHash": "sha256-dwuorKimqSYgyu8Cw6ncKhyQjUDOyuXoxDTVmAXq88s=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "612f97239e2cc474c13c9dafa0df378058c5ad8d",
+        "rev": "c002c6aa977ad22c60398daaa9be52f2203d0006",
         "type": "github"
       },
       "original": {
@@ -204,11 +204,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1706130372,
+        "lastModified": 1706410821,
-        "narHash": "sha256-fHZxKH1DhsXPP36a2vJ91Zy6S+q6+QRIFlpLr9fZHU8=",
+        "narHash": "sha256-iCfXspqUOPLwRobqQNAQeKzprEyVowLMn17QaRPQc+M=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "4606d9b1595e42ffd9b75b9e69667708c70b1d68",
+        "rev": "73bf36912e31a6b21af6e0f39218e067283c67ef",
         "type": "github"
       },
       "original": {

flake.nix

@@ -143,47 +143,27 @@
               ++ map (user: { home-manager.users.${user} = import ./users/${user}/home.nix; }) users;
             };
         in
-        {
+        (builtins.listToAttrs (map
-          jeeves-jr = constructSystem {
+          (system: {
-            hostname = "jeeves-jr";
+            name = system;
-            users = [
+            value = constructSystem { hostname = system; } // (import ./systems/${system} { });
-              "alice"
+          })
-              "dennis"
+          (lsdir "systems"))) //
-              "richie"
+        (builtins.listToAttrs (builtins.concatMap
-            ];
-          };
-
-          palatine-hill = constructSystem {
-            hostname = "palatine-hill";
-            users = [
-              "alice"
-              "dennis"
-              "richie"
-            ];
-          };
-
-          photon = constructSystem {
-            hostname = "photon";
-            users = [
-              "alice"
-              "dennis"
-              "richie"
-            ];
-          };
-        } // (builtins.listToAttrs (builtins.concatMap
           (user: map
-            (system: {
+            (system: rec {
               name = "${user}.${system}";
+              cfg = import ./users/${user}/systems/${system} { };
               value = lib.nixosSystem {
-                system = "x86_64-linux";
+                system = cfg.system ? "x86_64-linux";
                 modules = [
                   nixos-modules.nixosModule
-                  home-manager.nixosModules.home-manager
                   sops-nix.nixosModules.sops
                   ./users/${user}/systems/${system}/configuration.nix
                   ./users/${user}/systems/${system}/hardware.nix
                   { config.networking.hostName = "${system}"; }
-                ] ++ fileList "modules";
+                ] ++ fileList "modules"
+                ++ lib.optional (cfg.home-manager ? false) home-manager.nixosModules.home-manager;
               };
             })
             (lsdir "users/${user}/systems"))

modules/backup.nix

@@ -7,6 +7,12 @@ in
   options.services.backup = {
     enable = lib.mkEnableOption "backup";
 
+    offsite = lib.mkOption {
+      type = with lib.types; listOf str;
+      default = [ ];
+      description = "Offsite backup hostnames.";
+    };
+
     paths = lib.mkOption {
       type = with lib.types; listOf str;
       default = [ ];
@@ -18,19 +24,31 @@ in
       default = [ ];
       description = "Extra paths to exclude in backup.";
     };
+
+    backup_at = lib.mkOption {
+      type = lib.types.int;
+      default = 2;
+      description = "Time to run backup.";
+    };
   };
 
   config = {
-    assertions = [{
+    assertions = [
-      assertion = cfg.paths != [ ] -> cfg.enable;
+      {
-      message = "Configuring backup services.backup.paths without enabling services.backup.enable is useless!";
+        assertion = cfg.paths != [ ] -> cfg.enable;
-    }];
+        message = "Configuring backup services.backup.paths without enabling services.backup.enable is useless!";
+      }
+      {
+        assertion = cfg.backup_at < 24;
+        message = "Backup time must be less than 24 hours!";
+      }
+    ];
 
     services = {
       postgresqlBackup = {
         inherit (config.services.postgresql) enable;
         backupAll = true;
-        startAt = "*-*-* 04:00:00";
+        startAt = "*-*-* ${lib.fixedWidthString 2 "0" (toString cfg.backup_at)}:00:00";
       };
 
       restic.backups =
@@ -39,6 +57,7 @@ in
             extraBackupArgs = [
               "--exclude-file=${pkgs.writeText "restic-exclude-file" (lib.concatMapStrings (x: x + "\n") cfg.exclude)}"
             ];
+
             initialize = true;
             passwordFile = config.sops.secrets."restic/password".path;
             paths = [
@@ -46,6 +65,8 @@ in
               "/etc/machine-id"
               "/etc/passwd"
               "/etc/shadow"
+              "/etc/ssh/ssh_host_ecdsa_key"
+              "/etc/ssh/ssh_host_ecdsa_key.pub"
               "/etc/ssh/ssh_host_ed25519_key"
               "/etc/ssh/ssh_host_ed25519_key.pub"
               "/etc/ssh/ssh_host_rsa_key"
@@ -55,53 +76,59 @@ in
               "/var/lib/nixos/"
             ] ++ cfg.paths
             ++ lib.optional config.services.postgresql.enable "/var/backup/postgresql/"
+            ++ lib.optional config.services.mysql.enable "/var/lib/mysql/"
             ++ lib.optional (config.security.acme.certs != { }) "/var/lib/acme/"
-            ++ lib.optional config.security.dhparams.enable "/var/lib/dhparams/";
+            ++ lib.optional config.security.dhparams.enable "/var/lib/dhparams/"
+            ++ lib.optional config.mailserver.enable config.mailserver.mailDirectory;
+
             pruneOpts = [
               "--group-by host"
               "--keep-daily 7"
               "--keep-weekly 4"
               "--keep-monthly 12"
             ];
+
             timerConfig = {
-              OnCalendar = "*-*-* 04:30:00";
+              OnCalendar = "*-*-* ${lib.fixedWidthString 2 "0" (toString cfg.backup_at)}:30:00";
               RandomizedDelaySec = "5m";
             };
           };
         in
         lib.mkIf cfg.enable {
-          server9 = commonOpts // {
+          local = commonOpts // {
-            repositoryFile = config.sops.secrets."restic/repositories/server9".path;
+            repository = "/var/backup";
           };
-          offsite = commonOpts // {
+
+          offsite = lib.mkIf (cfg.offsite != [ ]) commonOpts // {
             repository = "sftp://offsite/${config.networking.hostName}";
           };
         };
     };
 
-    sops.secrets = lib.mkIf cfg.enable {
+    sops.secrets = lib.mkIf (cfg.enable && cfg.offsite != [ ])
-      "restic/offsite/private" = {
+      {
-        owner = "root";
+        "restic/offsite/private" = {
-        path = "/root/.ssh/id_offsite-backup";
+          owner = "root";
-        sopsFile = ./backup.yaml;
+          path = "/root/.ssh/id_offsite-backup";
-      };
+          sopsFile = ./backup.yaml;
-      "restic/offsite/public" = {
+        };
-        owner = "root";
-        path = "/root/.ssh/id_offsite-backup.pub";
-        sopsFile = ./backup.yaml;
-      };
-      "restic/offsite/ssh-config" = {
-        owner = "root";
-        path = "/root/.ssh/config";
-        sopsFile = ./backup.yaml;
-      };
 
-      # relies on defaultSopsFile
+        "restic/offsite/public" = {
+          owner = "root";
+          path = "/root/.ssh/id_offsite-backup.pub";
+          sopsFile = ./backup.yaml;
+        };
+
+        "restic/offsite/ssh-config" = {
+          owner = "root";
+          path = "/root/.ssh/config";
+          sopsFile = ./backup.yaml;
+        };
+      } // lib.mkIf cfg.enable {
       "restic/password".owner = "root";
-      "restic/repositories/server9".owner = "root";
     };
 
-    system.activationScripts.linkResticSSHConfigIntoVirtioFS = lib.mkIf cfg.enable ''
+    system.activationScripts.linkResticSSHConfigIntoVirtioFS = lib.mkIf (cfg.enable && cfg.offsite != [ ]) ''
       echo "Linking restic ssh config..."
       mkdir -m700 -p /home/root/.ssh/
       ln -fs {,/home}/root/.ssh/id_offsite-backup
@@ -111,9 +138,10 @@ in
 
     systemd = lib.mkIf cfg.enable {
       services = {
-        restic-backups-server9.serviceConfig.Environment = "RESTIC_PROGRESS_FPS=0.016666";
+        restic-backups-local.serviceConfig.Environment = "RESTIC_PROGRESS_FPS=0.016666";
-        restic-backups-offsite.serviceConfig.Environment = "RESTIC_PROGRESS_FPS=0.016666";
+        restic-backups-offsite.serviceConfig.Environment = lib.mkIf (cfg.offsite != [ ]) "RESTIC_PROGRESS_FPS=0.016666";
       };
+
       timers = lib.mkIf config.services.postgresqlBackup.enable {
         postgresqlBackup.timerConfig.RandomizedDelaySec = "5m";
       };

systems/jeeves-jr/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  users = [
+    "alice"
+    "dennis"
+    "richie"
+  ];
+}

systems/palatine-hill/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  users = [
+    "alice"
+    "dennis"
+    "richie"
+  ];
+}

systems/programs.nix

@@ -34,6 +34,7 @@
     unzip
     ventoy
     wget
+    zip
     zoxide
     zsh-nix-shell
   ];

users/alice/systems/testtop/default.nix

@@ -0,0 +1,5 @@
+{ ... }:
+{
+  system = "x86_64-linux";
+  home-manager = true;
+}