diff --git a/nixos/modules/borgbackup.nix b/nixos/modules/borgbackup.nix index d019756..6179b1e 100644 --- a/nixos/modules/borgbackup.nix +++ b/nixos/modules/borgbackup.nix @@ -1,6 +1,7 @@ { config, lib, + pkgs, ... }: let inherit @@ -56,6 +57,13 @@ in { path = "/var/lib/backups/eihort"; allowSubRepos = true; }; + fsaccount = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG+Y7fQTYdIWHehrKdk92CaJ0AisEux4OrS4nIyMstU4 FS Account Backup" + ]; + path = "/var/lib/backups/fsaccount"; + allowSubRepos = true; + }; hastur = { authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILeDvTyOUdIPARatX0PPhHgrV1gjERWLt2Twa8E2GETb Hastur Backupsystem" @@ -99,6 +107,39 @@ in { allowSubRepos = true; }; }; + # Configure backup of files on the department's fs account + jobs.fsaccount = { + preHook = '' + mkdir -p /home/fsaccount/sicherung # Create if it does not exist + ${pkgs.rsync}/bin/rsync -e 'ssh -i /home/fsaccount/.ssh/fsaccount' -r fachschaft@gw1.mathematik.tu-darmstadt.de:/home/fachschaft/* /home/fsaccount/sicherung + ''; + paths = "/home/fsaccount/sicherung"; + encryption.mode = "none"; + environment = { + BORG_RSH = "ssh -i /home/fsaccount/.ssh/fsaccount"; + BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK = "yes"; + }; + repo = "borg@localhost:fsaccount"; + startAt = "daily"; + user = "fsaccount"; + group = "users"; + readWritePaths = ["/home/fsaccount"]; + }; + }; + environment.persistence.${config.impermanence.name} = { + users.fsaccount.directories = [ + { + directory = ".ssh"; # SSH Key with access to FS Account and known_hosts + mode = "u=rwx,g=,o="; + } + ]; + }; + # Extra user for FS account backup + users.users = { + fsaccount = { + description = "FS Account backup"; + isNormalUser = true; + }; }; }; }