42 lines
1.0 KiB
Nix
42 lines
1.0 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
...
|
|
}:
|
|
{
|
|
sops.secrets."restic/repo_password" = {
|
|
owner = "restic";
|
|
mode = "0400";
|
|
restartUnits = [ "restic-backups-prune.service" ];
|
|
};
|
|
|
|
services.restic.server = {
|
|
enable = true;
|
|
listenAddress = "0.0.0.0:8008";
|
|
# mkDefault: set services.restic.server.dataDir in a host config to relocate the repo.
|
|
dataDir = lib.mkDefault "/var/lib/restic";
|
|
appendOnly = lib.mkDefault true;
|
|
extraFlags = lib.mkDefault [ "--no-auth" ]; #lets just ignore the auth parts, keep it on internal network.
|
|
};
|
|
|
|
services.restic.backups.prune = {
|
|
repository = "${config.services.restic.server.dataDir}/main";
|
|
passwordFile = config.sops.secrets."restic/repo_password".path;
|
|
user = "restic";
|
|
paths = [ ];
|
|
pruneOpts = [
|
|
"--keep-daily 3"
|
|
"--keep-weekly 5"
|
|
"--keep-monthly 6"
|
|
"--keep-yearly 5"
|
|
];
|
|
runCheck = true;
|
|
timerConfig = {
|
|
OnCalendar = "weekly";
|
|
Persistent = true;
|
|
};
|
|
};
|
|
|
|
networking.firewall.allowedTCPPorts = [ 8008 ];
|
|
}
|