nixConfig/nixos/modules/borgbackup.nix

172 lines
6.2 KiB
Nix
Raw Normal View History

2023-12-18 16:55:00 +00:00
{
config,
lib,
2024-02-07 14:21:15 +00:00
pkgs,
2023-12-18 16:55:00 +00:00
...
}: let
inherit
(lib)
mkIf
mkEnableOption
;
cfg = config.services.mathebau-borgbackup;
in {
imports = [];
options.services.mathebau-borgbackup = {
enable = mkEnableOption "mathebau borgbackup service";
};
config = mkIf cfg.enable {
services.borgbackup = {
# repos are made available at ssh://borg@hostname and served according to the presented ssh-key
2024-03-04 08:23:25 +00:00
# If you think about adding keys of nix machines:
# Congratulations, you are the first person to make backups from a nixos machine.
# Your won the task of automatizing this endeavor, so in future we don't need to hand copy any
# ssh keys anymore.
2023-12-18 16:55:00 +00:00
repos = {
aphoom-zhah = {
authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA8pI6uinXezAMH4vG2yEbu/yOYU5vXcsZN74tYgV+Wj Aphoom-Zhah Backup"
];
path = "/var/lib/backups/aphoom-zhah";
# subrepos are allowed because each vm creates at least one repo below this filepath and yibb-tstll even more
allowSubRepos = true;
};
azathoth = {
authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGBEwllQ77ktoirXX6dJ6ET8TfK4lzq0aaq+X4rrX2Vk Azathoth Backup"
];
path = "/var/lib/backups/azathoth";
allowSubRepos = true;
};
cthulhu = {
authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSJl1MvabUADTdOCgufsBzn1tIIpxMq4iDcYZsaW1lV Cthulhu Backup"
];
path = "/var/lib/backups/cthulhu";
allowSubRepos = true;
};
dagon = {
authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJaTBennwqT9eB43gVD1nM1os3dMPZ8RWwIKPEjqMK5V Dagon Backup"
];
path = "/var/lib/backups/dagon";
allowSubRepos = true;
};
eihort = {
authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHLoDxtY4Tp6NKxLt9oHmWT6w4UpU6eA1TnPU2Ut83BN Eihort Backup"
];
path = "/var/lib/backups/eihort";
allowSubRepos = true;
};
2024-02-07 14:21:15 +00:00
fsaccount = {
authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG+Y7fQTYdIWHehrKdk92CaJ0AisEux4OrS4nIyMstU4 FS Account Backup"
];
path = "/var/lib/backups/fsaccount";
allowSubRepos = true;
};
2023-12-18 16:55:00 +00:00
hastur = {
authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILeDvTyOUdIPARatX0PPhHgrV1gjERWLt2Twa8E2GETb Hastur Backupsystem"
];
path = "/var/lib/backups/hastur";
allowSubRepos = true;
};
ithaqua = {
authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPJmBf8cz3FTDdeuxWbp1MO2yPT5rvH8ZIGUzfogjpXi Ithaqua Backup"
];
path = "/var/lib/backups/ithaqua";
allowSubRepos = true;
};
sanctamariamaterdei = {
authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH9Le5OI4ympQ0mQKYHmxgxGF598rzpD5VVpWK1mGfd8 Sanctamariamaterdei Backupsystem"
];
path = "/var/lib/backups/sanctamariamaterdei";
allowSubRepos = true;
};
tsathoggua = {
authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKS9/1lFOhv+3sNuGcysM3TYh2xRrjMeAZX3K7CBx0QW Tsathoggua Backup"
];
path = "/var/lib/backups/tsathoggua";
allowSubRepos = true;
};
uvhash = {
authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB8DjIqgFgmYhQnTLpbqL0r7xBPb8TPy6SO5RhQ31OGj Uvhash Backup"
];
path = "/var/lib/backups/uvhash";
allowSubRepos = true;
};
yibb-tstll = {
authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlnGOV58Ks9lu+WTI4F7QAHtDrJq2jY8ZocITZG8K0+ Yibb-Tstll Backup"
];
path = "/var/lib/backups/yibb-tstll";
allowSubRepos = true;
};
};
2024-03-30 18:52:11 +00:00
# Configure backup of files on the department's fs account:
# This job first copies the files to the local account 'fsaccount' in tmpfs
# and then takes a regular backup of the mirrored folder.
# See also https://borgbackup.readthedocs.io/en/stable/deployment/pull-backup.html
# which does not work due to missing permissions.
2024-02-07 14:21:15 +00:00
jobs.fsaccount = {
preHook = ''
mkdir -p /home/fsaccount/sicherung # Create if it does not exist
2024-03-21 16:50:25 +00:00
${pkgs.rsync}/bin/rsync -e 'ssh -i /run/secrets/backupKey' -r fachschaft@gw1.mathematik.tu-darmstadt.de:/home/fachschaft/* /home/fsaccount/sicherung
2024-02-07 14:21:15 +00:00
'';
paths = "/home/fsaccount/sicherung";
2024-03-30 18:52:11 +00:00
encryption.mode = "none"; # Otherwise the key is next to the backup or we have human interaction.
2024-02-07 14:21:15 +00:00
environment = {
2024-03-21 16:50:25 +00:00
BORG_RSH = "ssh -i /run/secrets/backupKey";
2024-03-30 18:52:11 +00:00
# “Borg ensures that backups are not created on random drives that just happen to contain a Borg repository.”
# https://borgbackup.readthedocs.io/en/stable/deployment/automated-local.html
# We don't want this in order to not need to persist borg cache and simplify new deployments.
2024-02-07 14:21:15 +00:00
BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK = "yes";
};
repo = "borg@localhost:fsaccount";
startAt = "daily";
user = "fsaccount";
group = "users";
readWritePaths = ["/home/fsaccount"];
};
};
2024-03-30 18:52:11 +00:00
# Extra user for FS account backup
users.users = {
fsaccount = {
description = "FS Account backup";
isSystemUser = true;
home = "/home/fsaccount";
createHome = true;
group = "users";
};
};
2024-02-07 14:21:15 +00:00
environment.persistence.${config.impermanence.name} = {
2024-03-21 16:50:25 +00:00
users.fsaccount.files = [
2024-02-07 14:21:15 +00:00
{
2024-03-21 16:50:25 +00:00
file = ".ssh/known_hosts";
parentDirectory = {
mode = "u=rwx,g=,o=";
user = "fsaccount";
group = "users";
};
2024-02-07 14:21:15 +00:00
}
];
};
2024-03-21 16:50:25 +00:00
sops.secrets.backupKey = {
sopsFile = ../machines/bragi/backupKey.yaml;
owner = config.users.users.fsaccount.name;
inherit (config.users.users.fsaccount) group;
mode = "0400";
};
2023-12-18 16:55:00 +00:00
};
}