From 7b4c51bffd70831857980774b96f8720c337eba1 Mon Sep 17 00:00:00 2001 From: Gonne Date: Mon, 18 Dec 2023 17:55:00 +0100 Subject: [PATCH 1/6] Create backuphost Bragi --- nixos/machines/bragi/configuration.nix | 15 +++ .../machines/bragi/hardware-configuration.nix | 32 ++++++ nixos/machines/bragi/network.nix | 15 +++ nixos/modules/borgbackup.nix | 104 ++++++++++++++++++ 4 files changed, 166 insertions(+) create mode 100644 nixos/machines/bragi/configuration.nix create mode 100644 nixos/machines/bragi/hardware-configuration.nix create mode 100644 nixos/machines/bragi/network.nix create mode 100644 nixos/modules/borgbackup.nix diff --git a/nixos/machines/bragi/configuration.nix b/nixos/machines/bragi/configuration.nix new file mode 100644 index 0000000..f74fbb9 --- /dev/null +++ b/nixos/machines/bragi/configuration.nix @@ -0,0 +1,15 @@ +{ + imports = [ + ./hardware-configuration.nix + ../../roles + ../../roles/hardware.nix + ./network.nix + ../../modules/borgbackup.nix + ]; + + services.mathebau-borgbackup.enable = true; + + # System configuration here + networking.hostName = "bragi"; + system.stateVersion = "23.11"; +} diff --git a/nixos/machines/bragi/hardware-configuration.nix b/nixos/machines/bragi/hardware-configuration.nix new file mode 100644 index 0000000..4bd7168 --- /dev/null +++ b/nixos/machines/bragi/hardware-configuration.nix @@ -0,0 +1,32 @@ +{lib, ...}: { + fileSystems."/" = { + device = "root"; + fsType = "tmpfs"; + options = ["size=2G" "mode=755"]; + }; + fileSystems."/persist" = { + device = "/dev/disk/by-label/nixos"; + fsType = "btrfs"; + options = ["subvol=persist"]; + neededForBoot = true; + }; + fileSystems."/boot" = { + device = "/dev/disk/by-label/boot"; + fsType = "ext4"; + }; + fileSystems."/nix" = { + device = "/dev/disk/by-label/nixos"; + fsType = "btrfs"; + options = ["subvol=nix"]; + }; + fileSystems."/var/lib/backups" = { + device = "/dev/disk/by-label/backups"; + fsType = "btrfs"; + }; + + swapDevices = [{device = "/dev/disk/by-label/swap";}]; + + boot.loader.grub.device = "/dev/disk/by-id/wwn-0x5000c5003891662c"; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} diff --git a/nixos/machines/bragi/network.nix b/nixos/machines/bragi/network.nix new file mode 100644 index 0000000..b113b50 --- /dev/null +++ b/nixos/machines/bragi/network.nix @@ -0,0 +1,15 @@ +# We sohuld put that config somewhere in roles and give it a parameter or something, +# everyone gets the same nameserver and the same prefixLength and address vs defaultGateway alsways +# depend on the same thing +{ + networking = { + interfaces.enp0s25.ipv4.addresses = [ + { + address = "192.168.1.11"; + prefixLength = 24; + } + ]; + defaultGateway = "192.168.1.137"; + nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"]; + }; +} diff --git a/nixos/modules/borgbackup.nix b/nixos/modules/borgbackup.nix new file mode 100644 index 0000000..d019756 --- /dev/null +++ b/nixos/modules/borgbackup.nix @@ -0,0 +1,104 @@ +{ + config, + lib, + ... +}: let + inherit + (lib) + mkIf + mkEnableOption + ; + cfg = config.services.mathebau-borgbackup; +in { + imports = []; + + options.services.mathebau-borgbackup = { + enable = mkEnableOption "mathebau borgbackup service"; + }; + + config = mkIf cfg.enable { + services.borgbackup = { + # repos are made available at ssh://borg@hostname and served according to the presented ssh-key + repos = { + aphoom-zhah = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA8pI6uinXezAMH4vG2yEbu/yOYU5vXcsZN74tYgV+Wj Aphoom-Zhah Backup" + ]; + path = "/var/lib/backups/aphoom-zhah"; + # subrepos are allowed because each vm creates at least one repo below this filepath and yibb-tstll even more + allowSubRepos = true; + }; + azathoth = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGBEwllQ77ktoirXX6dJ6ET8TfK4lzq0aaq+X4rrX2Vk Azathoth Backup" + ]; + path = "/var/lib/backups/azathoth"; + allowSubRepos = true; + }; + cthulhu = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSJl1MvabUADTdOCgufsBzn1tIIpxMq4iDcYZsaW1lV Cthulhu Backup" + ]; + path = "/var/lib/backups/cthulhu"; + allowSubRepos = true; + }; + dagon = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJaTBennwqT9eB43gVD1nM1os3dMPZ8RWwIKPEjqMK5V Dagon Backup" + ]; + path = "/var/lib/backups/dagon"; + allowSubRepos = true; + }; + eihort = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHLoDxtY4Tp6NKxLt9oHmWT6w4UpU6eA1TnPU2Ut83BN Eihort Backup" + ]; + path = "/var/lib/backups/eihort"; + allowSubRepos = true; + }; + hastur = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILeDvTyOUdIPARatX0PPhHgrV1gjERWLt2Twa8E2GETb Hastur Backupsystem" + ]; + path = "/var/lib/backups/hastur"; + allowSubRepos = true; + }; + ithaqua = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPJmBf8cz3FTDdeuxWbp1MO2yPT5rvH8ZIGUzfogjpXi Ithaqua Backup" + ]; + path = "/var/lib/backups/ithaqua"; + allowSubRepos = true; + }; + sanctamariamaterdei = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH9Le5OI4ympQ0mQKYHmxgxGF598rzpD5VVpWK1mGfd8 Sanctamariamaterdei Backupsystem" + ]; + path = "/var/lib/backups/sanctamariamaterdei"; + allowSubRepos = true; + }; + tsathoggua = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKS9/1lFOhv+3sNuGcysM3TYh2xRrjMeAZX3K7CBx0QW Tsathoggua Backup" + ]; + path = "/var/lib/backups/tsathoggua"; + allowSubRepos = true; + }; + uvhash = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB8DjIqgFgmYhQnTLpbqL0r7xBPb8TPy6SO5RhQ31OGj Uvhash Backup" + ]; + path = "/var/lib/backups/uvhash"; + allowSubRepos = true; + }; + yibb-tstll = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlnGOV58Ks9lu+WTI4F7QAHtDrJq2jY8ZocITZG8K0+ Yibb-Tstll Backup" + ]; + path = "/var/lib/backups/yibb-tstll"; + allowSubRepos = true; + }; + }; + }; + }; +} From 6b1038c102952d76693d9a33cac449c50cd4e947 Mon Sep 17 00:00:00 2001 From: Gonne Date: Wed, 7 Feb 2024 15:21:15 +0100 Subject: [PATCH 2/6] Backup des Fachschaftsaccounts --- nixos/modules/borgbackup.nix | 37 ++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/nixos/modules/borgbackup.nix b/nixos/modules/borgbackup.nix index d019756..d41c752 100644 --- a/nixos/modules/borgbackup.nix +++ b/nixos/modules/borgbackup.nix @@ -56,6 +56,13 @@ in { path = "/var/lib/backups/eihort"; allowSubRepos = true; }; + fsaccount = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG+Y7fQTYdIWHehrKdk92CaJ0AisEux4OrS4nIyMstU4 FS Account Backup" + ]; + path = "/var/lib/backups/fsaccount"; + allowSubRepos = true; + }; hastur = { authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILeDvTyOUdIPARatX0PPhHgrV1gjERWLt2Twa8E2GETb Hastur Backupsystem" @@ -99,6 +106,36 @@ in { allowSubRepos = true; }; }; + # Configure backup of files on the department's fs account + jobs.fsaccount = { + preHook = '' + rm -rf /home/fsaccount/sicherung + mkdir /home/fsaccount/sicherung + scp -i /home/fsaccount/.ssh/fsaccount -r fachschaft@gw1.mathematik.tu-darmstadt.de:/home/fachschaft/* sicherung/ + ''; + paths = "/home/fachschaft/sicherung"; + encryption.mode = "none"; + environment.BORG_RSH = "ssh -i /home/fachschaft/.ssh/fsaccount"; + repo = "ssh://borg@localhost:fsaccount"; + startAt = "hourly"; + user = "fsaccount"; + group = "fsaccount"; + readWritePaths = ["/home/fsaccount"]; + }; }; + environment.persistence.${config.impermanence.name} = { + directories = [ + "/home/fachschaft/.ssh" # SSH Key with access to FS Account and Borg repo and known_hosts + ]; + }; + # Extra user for FS account backup + users.users = { + fsaccount = { + description = "FS Account backup"; + group = "fsaccount"; + isNormalUser = true; + }; + }; + users.groups.fsaccount = {}; }; } From d4128640f5745fe48b071fa9bfcb85a53cb8a5ae Mon Sep 17 00:00:00 2001 From: Gonne Date: Wed, 7 Feb 2024 15:28:39 +0100 Subject: [PATCH 3/6] Korrigiere Pfad --- nixos/modules/borgbackup.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/nixos/modules/borgbackup.nix b/nixos/modules/borgbackup.nix index d41c752..6802372 100644 --- a/nixos/modules/borgbackup.nix +++ b/nixos/modules/borgbackup.nix @@ -111,11 +111,11 @@ in { preHook = '' rm -rf /home/fsaccount/sicherung mkdir /home/fsaccount/sicherung - scp -i /home/fsaccount/.ssh/fsaccount -r fachschaft@gw1.mathematik.tu-darmstadt.de:/home/fachschaft/* sicherung/ + scp -i /home/fsaccount/.ssh/fsaccount -r fachschaft@gw1.mathematik.tu-darmstadt.de:/home/fachschaft/* /home/fsaccount/sicherung/ ''; - paths = "/home/fachschaft/sicherung"; + paths = "/home/fsaccount/sicherung"; encryption.mode = "none"; - environment.BORG_RSH = "ssh -i /home/fachschaft/.ssh/fsaccount"; + environment.BORG_RSH = "ssh -i /home/fsaccount/.ssh/fsaccount"; repo = "ssh://borg@localhost:fsaccount"; startAt = "hourly"; user = "fsaccount"; @@ -125,7 +125,7 @@ in { }; environment.persistence.${config.impermanence.name} = { directories = [ - "/home/fachschaft/.ssh" # SSH Key with access to FS Account and Borg repo and known_hosts + "/home/fsaccount/.ssh" # SSH Key with access to FS Account and Borg repo and known_hosts ]; }; # Extra user for FS account backup From b44e2cbbb0d79c24cdff849d465d6bb0846bf12a Mon Sep 17 00:00:00 2001 From: Gonne Date: Wed, 7 Feb 2024 18:48:06 +0100 Subject: [PATCH 4/6] Korrigiere Group --- nixos/modules/borgbackup.nix | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/nixos/modules/borgbackup.nix b/nixos/modules/borgbackup.nix index 6802372..da083cb 100644 --- a/nixos/modules/borgbackup.nix +++ b/nixos/modules/borgbackup.nix @@ -119,7 +119,7 @@ in { repo = "ssh://borg@localhost:fsaccount"; startAt = "hourly"; user = "fsaccount"; - group = "fsaccount"; + group = "users"; readWritePaths = ["/home/fsaccount"]; }; }; @@ -132,10 +132,8 @@ in { users.users = { fsaccount = { description = "FS Account backup"; - group = "fsaccount"; isNormalUser = true; }; }; - users.groups.fsaccount = {}; }; } From 30c2f5ede4bac5009e3e8c59121e5c426f1acd9f Mon Sep 17 00:00:00 2001 From: Gonne Date: Wed, 7 Feb 2024 19:28:16 +0100 Subject: [PATCH 5/6] Korrigiere Dateirechte --- nixos/modules/borgbackup.nix | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/nixos/modules/borgbackup.nix b/nixos/modules/borgbackup.nix index da083cb..e86f06b 100644 --- a/nixos/modules/borgbackup.nix +++ b/nixos/modules/borgbackup.nix @@ -125,7 +125,12 @@ in { }; environment.persistence.${config.impermanence.name} = { directories = [ - "/home/fsaccount/.ssh" # SSH Key with access to FS Account and Borg repo and known_hosts + { + directory = "/home/fsaccount/.ssh"; # SSH Key with access to FS Account and Borg repo and known_hosts + user = "fsaccount"; + group = "users"; + mode = "u=rwx,g=,o="; + } ]; }; # Extra user for FS account backup From 8de0651c36f785798ab60154441b625862f4f271 Mon Sep 17 00:00:00 2001 From: Gonne Date: Wed, 7 Feb 2024 19:32:00 +0100 Subject: [PATCH 6/6] Persiste ganzen Home-Ordner --- nixos/modules/borgbackup.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/borgbackup.nix b/nixos/modules/borgbackup.nix index e86f06b..3596348 100644 --- a/nixos/modules/borgbackup.nix +++ b/nixos/modules/borgbackup.nix @@ -126,7 +126,7 @@ in { environment.persistence.${config.impermanence.name} = { directories = [ { - directory = "/home/fsaccount/.ssh"; # SSH Key with access to FS Account and Borg repo and known_hosts + directory = "/home/fsaccount"; # SSH Key with access to FS Account and Borg repo and known_hosts user = "fsaccount"; group = "users"; mode = "u=rwx,g=,o=";