Gonne/nixConfig
1
0
Fork 0
forked from Fachschaft/nixConfig
Code Pull requests Activity

Mailman backups

Browse source
This commit is contained in:
Gonne 2024-03-31 20:28:40 +02:00
parent 65b380624d
commit 5250a0fc93
3 changed files with 70 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
nixos/modules/borgbackup.nix
View file

@ -83,6 +83,13 @@ in {
path = "/var/lib/backups/ithaqua";
allowSubRepos = true;
};
lobon = {
authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICEptjf1UWRlo6DG9alAIRwkSDUAVHwDKkHC6/DeYKzi Lobon Backup"
];
path = "/var/lib/backups/lobon";
allowSubRepos = true;
};
sanctamariamaterdei = {
authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH9Le5OI4ympQ0mQKYHmxgxGF598rzpD5VVpWK1mGfd8 Sanctamariamaterdei Backupsystem"

24
nixos/modules/mailman.nix
View file

@ -60,6 +60,7 @@ in {
"/var/lib/mailman"
"/var/lib/mailman-web"
];
files = ["/root/.ssh/known_hosts"]; # for the backup server bragi
};
security.acme.defaults.email = cfg.siteOwner;
@ -101,5 +102,28 @@ in {
group = "mailman";
mode = "0400";
};
# Backups
services.borgbackup.jobs.mailman = {
paths = "/var/lib/mailman/data/mailman.db";
encryption.mode = "none"; # Otherwise the key is next to the backup or we have human interaction.
environment = {
BORG_RSH = "ssh -i /run/secrets/backupKey";
# “Borg ensures that backups are not created on random drives that ‘just happen’ to contain a Borg repository.”
# https://borgbackup.readthedocs.io/en/stable/deployment/automated-local.html
# We don't want this in order to not need to persist borg cache and simplify new deployments.
BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK = "yes";
};
repo = "borg@192.168.1.11:lobon"; # TODO for https://gitea.mathebau.de/Fachschaft/nixConfig/issues/33
startAt = "daily";
user = "root";
group = "root";
};
sops.secrets.backupKey = {
sopsFile = ../machines/lobon/backupKey.yaml;
owner = "root";
group = "root";
mode = "0400";
};
};
}