adriangl
c148917278
Uncommented the hand-rolled restic-offsite service and switched to the non-deprecated --from-* flag family (destination = offsite via --repository-file/--password-file, source = local repo via --from-repo/--from-password-file). The timer now references a service that actually exists.
50 lines
1.3 KiB
Nix
50 lines
1.3 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
{
|
|
|
|
sops.secrets."restic/repo_password" = {
|
|
owner = "restic";
|
|
mode = "0400";
|
|
restartUnits = [ "restic-offsite.service" ];
|
|
};
|
|
|
|
sops.secrets."restic/offsite_repository" = {
|
|
owner = "restic";
|
|
mode = "0400";
|
|
restartUnits = [ "restic-offsite.service" ];
|
|
};
|
|
|
|
# destination = offsite repo (primary global opts: --repository-file/--password-file)
|
|
# source = local repo (--from-repo/--from-password-file)
|
|
# the legacy --repo2/--repository-file2/--password-file2 flags are deprecated in restic.
|
|
systemd.services.restic-offsite = {
|
|
description = "Mirror restic snapshots to the offsite repo";
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
User = "restic";
|
|
Group = "restic";
|
|
};
|
|
path = [ pkgs.restic ];
|
|
script = ''
|
|
restic \
|
|
--repository-file ${config.sops.secrets."restic/offsite_repository".path} \
|
|
--password-file ${config.sops.secrets."restic/repo_password".path} \
|
|
--from-repo ${config.services.restic.server.dataDir}/main \
|
|
--from-password-file ${config.sops.secrets."restic/repo_password".path} \
|
|
copy
|
|
'';
|
|
};
|
|
|
|
systemd.timers.restic-offsite = {
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnCalendar = "daily";
|
|
Persistent = true;
|
|
};
|
|
};
|
|
}
|