adriangl
97798d7781
rest-server (append-only, tailnet-only on ${hostname}:8008) with a native prune-only job and an offsite restic copy; shared client module backing all hosts into galadriel's repo. Galadriel runs both modules, dataDir on /lorien/backup/restic, service-only paths. Adds sops secrets.
84 lines
2.1 KiB
Nix
84 lines
2.1 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
{
|
|
sops.secrets."restic/server_htpasswd" = {
|
|
owner = "restic";
|
|
group = "restic";
|
|
mode = "0400";
|
|
restartUnits = [ "restic-rest-server.service" ];
|
|
};
|
|
|
|
sops.secrets."restic/repo_password" = {
|
|
owner = "restic";
|
|
mode = "0400";
|
|
restartUnits = [
|
|
"restic-backups-prune.service"
|
|
"restic-offsite.service"
|
|
];
|
|
};
|
|
|
|
sops.secrets."restic/offsite_repository" = {
|
|
owner = "restic";
|
|
mode = "0400";
|
|
restartUnits = [ "restic-offsite.service" ];
|
|
};
|
|
|
|
services.restic.server = {
|
|
enable = true;
|
|
listenAddress = "${config.networking.hostName}:8008";
|
|
# mkDefault: set services.restic.server.dataDir in a host config to relocate the repo.
|
|
dataDir = lib.mkDefault "/var/lib/restic";
|
|
htpasswd-file = config.sops.secrets."restic/server_htpasswd".path;
|
|
appendOnly = lib.mkDefault true;
|
|
};
|
|
|
|
services.restic.backups.prune = {
|
|
repository = "${config.services.restic.server.dataDir}/main";
|
|
passwordFile = config.sops.secrets."restic/repo_password".path;
|
|
user = "restic";
|
|
paths = [ ];
|
|
pruneOpts = [
|
|
"--keep-daily 3"
|
|
"--keep-weekly 5"
|
|
"--keep-monthly 6"
|
|
"--keep-yearly 5"
|
|
];
|
|
runCheck = true;
|
|
timerConfig = {
|
|
OnCalendar = "weekly";
|
|
Persistent = true;
|
|
};
|
|
};
|
|
|
|
systemd.services.restic-offsite = {
|
|
description = "Mirror restic snapshots to the offsite repo";
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
User = "restic";
|
|
Group = "restic";
|
|
};
|
|
path = [ pkgs.restic ];
|
|
script = ''
|
|
restic -r ${config.services.restic.server.dataDir}/main \
|
|
--password-file ${config.sops.secrets."restic/repo_password".path} \
|
|
copy \
|
|
--repository-file2 ${config.sops.secrets."restic/offsite_repository".path} \
|
|
--password-file2 ${config.sops.secrets."restic/repo_password".path}
|
|
'';
|
|
};
|
|
|
|
systemd.timers.restic-offsite = {
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnCalendar = "daily";
|
|
Persistent = true;
|
|
};
|
|
};
|
|
|
|
networking.firewall.allowedTCPPorts = [ 8008 ];
|
|
}
|