Fachschaft/nixConfig
5
2
Fork 2
Code Issues 7 Pull requests 1 Projects 1 Wiki Activity

bragi backup config #28

Merged
Gonne merged 5 commits from Gonne/nixConfig:bragi into main 2024-03-30 19:10:30 +00:00
Conversation 1 Commits 5 Files changed 6 +41
1 changed files with 41 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit b0af48a9d0 - Show all commits

41
nixos/modules/borgbackup.nix
View file

@ -1,6 +1,7 @@
{ {
config, config,
lib, lib,
pkgs,
... ...
}: let }: let
inherit inherit
@ -56,6 +57,13 @@ in {
path = "/var/lib/backups/eihort"; path = "/var/lib/backups/eihort";
allowSubRepos = true; allowSubRepos = true;
}; };
fsaccount = {
authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG+Y7fQTYdIWHehrKdk92CaJ0AisEux4OrS4nIyMstU4 FS Account Backup"
];
path = "/var/lib/backups/fsaccount";
allowSubRepos = true;
};
hastur = { hastur = {
authorizedKeysAppendOnly = [ authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILeDvTyOUdIPARatX0PPhHgrV1gjERWLt2Twa8E2GETb Hastur Backupsystem" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILeDvTyOUdIPARatX0PPhHgrV1gjERWLt2Twa8E2GETb Hastur Backupsystem"
@ -99,6 +107,39 @@ in {
allowSubRepos = true; allowSubRepos = true;
}; };
}; };
# Configure backup of files on the department's fs account
jobs.fsaccount = {
preHook = ''
mkdir -p /home/fsaccount/sicherung # Create if it does not exist
${pkgs.rsync}/bin/rsync -e 'ssh -i /home/fsaccount/.ssh/fsaccount' -r fachschaft@gw1.mathematik.tu-darmstadt.de:/home/fachschaft/* /home/fsaccount/sicherung
'';
paths = "/home/fsaccount/sicherung";
encryption.mode = "none";
environment = {
BORG_RSH = "ssh -i /home/fsaccount/.ssh/fsaccount";
BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK = "yes";
};
repo = "borg@localhost:fsaccount";
Gonne marked this conversation as resolved
nerf commented 2024-03-30 15:29:10 +00:00
Review
Copy link

I would put a small note here, that encryption would mean either putting the key next to the backup or human interaction.

I would put a small note here, that encryption would mean either putting the key next to the backup or human interaction.
startAt = "daily";
user = "fsaccount";
group = "users";
nerf commented 2024-03-30 15:33:13 +00:00
Review
Copy link

Why is this here, what does it do? I also don't really get it from the Borg documentation

BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK=no (or =yes)

For “Warning: Attempting to access a previously unknown unencrypted repository”

Why is this here, what does it do? I also don't really get it from the Borg documentation > BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK=no (or =yes) > > For “Warning: Attempting to access a previously unknown unencrypted repository”
readWritePaths = ["/home/fsaccount"];
};
};
environment.persistence.${config.impermanence.name} = {
users.fsaccount.directories = [
{
directory = ".ssh"; # SSH Key with access to FS Account and known_hosts
mode = "u=rwx,g=,o=";
}
];
};
# Extra user for FS account backup
users.users = {
fsaccount = {
description = "FS Account backup";
isNormalUser = true;
};
}; };
}; };
} }