85 lines
2.2 KiB
Nix
85 lines
2.2 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
{
|
|
sops.secrets."restic/server_htpasswd" = {
|
|
owner = "restic";
|
|
group = "restic";
|
|
mode = "0400";
|
|
restartUnits = [ "restic-rest-server.service" ];
|
|
};
|
|
|
|
sops.secrets."restic/repo_password" = {
|
|
owner = "restic";
|
|
mode = "0400";
|
|
restartUnits = [
|
|
"restic-backups-prune.service"
|
|
"restic-offsite.service"
|
|
];
|
|
};
|
|
|
|
sops.secrets."restic/offsite_repository" = {
|
|
owner = "restic";
|
|
mode = "0400";
|
|
restartUnits = [ "restic-offsite.service" ];
|
|
};
|
|
|
|
services.restic.server = {
|
|
enable = true;
|
|
listenAddress = "${config.networking.hostName}:8008";
|
|
# mkDefault: set services.restic.server.dataDir in a host config to relocate the repo.
|
|
dataDir = lib.mkDefault "/var/lib/restic";
|
|
htpasswd-file = config.sops.secrets."restic/server_htpasswd".path;
|
|
appendOnly = lib.mkDefault true;
|
|
};
|
|
|
|
services.restic.backups.prune = {
|
|
repository = "${config.services.restic.server.dataDir}/main";
|
|
passwordFile = config.sops.secrets."restic/repo_password".path;
|
|
user = "restic";
|
|
paths = [ ];
|
|
pruneOpts = [
|
|
"--keep-daily 3"
|
|
"--keep-weekly 5"
|
|
"--keep-monthly 6"
|
|
"--keep-yearly 5"
|
|
];
|
|
runCheck = true;
|
|
timerConfig = {
|
|
OnCalendar = "weekly";
|
|
Persistent = true;
|
|
};
|
|
};
|
|
|
|
# # just uncommented until we have this running on elrond as well.
|
|
# systemd.services.restic-offsite = {
|
|
# description = "Mirror restic snapshots to the offsite repo";
|
|
# serviceConfig = {
|
|
# Type = "oneshot";
|
|
# User = "restic";
|
|
# Group = "restic";
|
|
# };
|
|
# path = [ pkgs.restic ];
|
|
# script = ''
|
|
# restic -r ${config.services.restic.server.dataDir}/main \
|
|
# --password-file ${config.sops.secrets."restic/repo_password".path} \
|
|
# copy \
|
|
# --repository-file2 ${config.sops.secrets."restic/offsite_repository".path} \
|
|
# --password-file2 ${config.sops.secrets."restic/repo_password".path}
|
|
# '';
|
|
# };
|
|
|
|
systemd.timers.restic-offsite = {
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnCalendar = "daily";
|
|
Persistent = true;
|
|
};
|
|
};
|
|
|
|
networking.firewall.allowedTCPPorts = [ 8008 ];
|
|
}
|