From ef3342fcbce180ef5cc61588e2bf1b45052b26bc Mon Sep 17 00:00:00 2001 From: Gonne Date: Mon, 18 Dec 2023 17:55:00 +0100 Subject: [PATCH 1/9] Create backuphost Bragi --- nixos/machines/bragi/configuration.nix | 15 +++ .../machines/bragi/hardware-configuration.nix | 32 ++++++ nixos/machines/bragi/network.nix | 15 +++ nixos/modules/borgbackup.nix | 104 ++++++++++++++++++ 4 files changed, 166 insertions(+) create mode 100644 nixos/machines/bragi/configuration.nix create mode 100644 nixos/machines/bragi/hardware-configuration.nix create mode 100644 nixos/machines/bragi/network.nix create mode 100644 nixos/modules/borgbackup.nix diff --git a/nixos/machines/bragi/configuration.nix b/nixos/machines/bragi/configuration.nix new file mode 100644 index 0000000..f74fbb9 --- /dev/null +++ b/nixos/machines/bragi/configuration.nix @@ -0,0 +1,15 @@ +{ + imports = [ + ./hardware-configuration.nix + ../../roles + ../../roles/hardware.nix + ./network.nix + ../../modules/borgbackup.nix + ]; + + services.mathebau-borgbackup.enable = true; + + # System configuration here + networking.hostName = "bragi"; + system.stateVersion = "23.11"; +} diff --git a/nixos/machines/bragi/hardware-configuration.nix b/nixos/machines/bragi/hardware-configuration.nix new file mode 100644 index 0000000..4bd7168 --- /dev/null +++ b/nixos/machines/bragi/hardware-configuration.nix @@ -0,0 +1,32 @@ +{lib, ...}: { + fileSystems."/" = { + device = "root"; + fsType = "tmpfs"; + options = ["size=2G" "mode=755"]; + }; + fileSystems."/persist" = { + device = "/dev/disk/by-label/nixos"; + fsType = "btrfs"; + options = ["subvol=persist"]; + neededForBoot = true; + }; + fileSystems."/boot" = { + device = "/dev/disk/by-label/boot"; + fsType = "ext4"; + }; + fileSystems."/nix" = { + device = "/dev/disk/by-label/nixos"; + fsType = "btrfs"; + options = ["subvol=nix"]; + }; + fileSystems."/var/lib/backups" = { + device = "/dev/disk/by-label/backups"; + fsType = "btrfs"; + }; + + swapDevices = [{device = "/dev/disk/by-label/swap";}]; + + boot.loader.grub.device = "/dev/disk/by-id/wwn-0x5000c5003891662c"; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} diff --git a/nixos/machines/bragi/network.nix b/nixos/machines/bragi/network.nix new file mode 100644 index 0000000..b113b50 --- /dev/null +++ b/nixos/machines/bragi/network.nix @@ -0,0 +1,15 @@ +# We sohuld put that config somewhere in roles and give it a parameter or something, +# everyone gets the same nameserver and the same prefixLength and address vs defaultGateway alsways +# depend on the same thing +{ + networking = { + interfaces.enp0s25.ipv4.addresses = [ + { + address = "192.168.1.11"; + prefixLength = 24; + } + ]; + defaultGateway = "192.168.1.137"; + nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"]; + }; +} diff --git a/nixos/modules/borgbackup.nix b/nixos/modules/borgbackup.nix new file mode 100644 index 0000000..d019756 --- /dev/null +++ b/nixos/modules/borgbackup.nix @@ -0,0 +1,104 @@ +{ + config, + lib, + ... +}: let + inherit + (lib) + mkIf + mkEnableOption + ; + cfg = config.services.mathebau-borgbackup; +in { + imports = []; + + options.services.mathebau-borgbackup = { + enable = mkEnableOption "mathebau borgbackup service"; + }; + + config = mkIf cfg.enable { + services.borgbackup = { + # repos are made available at ssh://borg@hostname and served according to the presented ssh-key + repos = { + aphoom-zhah = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA8pI6uinXezAMH4vG2yEbu/yOYU5vXcsZN74tYgV+Wj Aphoom-Zhah Backup" + ]; + path = "/var/lib/backups/aphoom-zhah"; + # subrepos are allowed because each vm creates at least one repo below this filepath and yibb-tstll even more + allowSubRepos = true; + }; + azathoth = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGBEwllQ77ktoirXX6dJ6ET8TfK4lzq0aaq+X4rrX2Vk Azathoth Backup" + ]; + path = "/var/lib/backups/azathoth"; + allowSubRepos = true; + }; + cthulhu = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSJl1MvabUADTdOCgufsBzn1tIIpxMq4iDcYZsaW1lV Cthulhu Backup" + ]; + path = "/var/lib/backups/cthulhu"; + allowSubRepos = true; + }; + dagon = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJaTBennwqT9eB43gVD1nM1os3dMPZ8RWwIKPEjqMK5V Dagon Backup" + ]; + path = "/var/lib/backups/dagon"; + allowSubRepos = true; + }; + eihort = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHLoDxtY4Tp6NKxLt9oHmWT6w4UpU6eA1TnPU2Ut83BN Eihort Backup" + ]; + path = "/var/lib/backups/eihort"; + allowSubRepos = true; + }; + hastur = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILeDvTyOUdIPARatX0PPhHgrV1gjERWLt2Twa8E2GETb Hastur Backupsystem" + ]; + path = "/var/lib/backups/hastur"; + allowSubRepos = true; + }; + ithaqua = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPJmBf8cz3FTDdeuxWbp1MO2yPT5rvH8ZIGUzfogjpXi Ithaqua Backup" + ]; + path = "/var/lib/backups/ithaqua"; + allowSubRepos = true; + }; + sanctamariamaterdei = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH9Le5OI4ympQ0mQKYHmxgxGF598rzpD5VVpWK1mGfd8 Sanctamariamaterdei Backupsystem" + ]; + path = "/var/lib/backups/sanctamariamaterdei"; + allowSubRepos = true; + }; + tsathoggua = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKS9/1lFOhv+3sNuGcysM3TYh2xRrjMeAZX3K7CBx0QW Tsathoggua Backup" + ]; + path = "/var/lib/backups/tsathoggua"; + allowSubRepos = true; + }; + uvhash = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB8DjIqgFgmYhQnTLpbqL0r7xBPb8TPy6SO5RhQ31OGj Uvhash Backup" + ]; + path = "/var/lib/backups/uvhash"; + allowSubRepos = true; + }; + yibb-tstll = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlnGOV58Ks9lu+WTI4F7QAHtDrJq2jY8ZocITZG8K0+ Yibb-Tstll Backup" + ]; + path = "/var/lib/backups/yibb-tstll"; + allowSubRepos = true; + }; + }; + }; + }; +} From f07ed2965d6a018b1c0d08cec93cc0ea63d330d1 Mon Sep 17 00:00:00 2001 From: Gonne Date: Wed, 7 Feb 2024 15:21:15 +0100 Subject: [PATCH 2/9] Backup des Fachschaftsaccounts --- nixos/modules/borgbackup.nix | 41 ++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/nixos/modules/borgbackup.nix b/nixos/modules/borgbackup.nix index d019756..6179b1e 100644 --- a/nixos/modules/borgbackup.nix +++ b/nixos/modules/borgbackup.nix @@ -1,6 +1,7 @@ { config, lib, + pkgs, ... }: let inherit @@ -56,6 +57,13 @@ in { path = "/var/lib/backups/eihort"; allowSubRepos = true; }; + fsaccount = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG+Y7fQTYdIWHehrKdk92CaJ0AisEux4OrS4nIyMstU4 FS Account Backup" + ]; + path = "/var/lib/backups/fsaccount"; + allowSubRepos = true; + }; hastur = { authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILeDvTyOUdIPARatX0PPhHgrV1gjERWLt2Twa8E2GETb Hastur Backupsystem" @@ -99,6 +107,39 @@ in { allowSubRepos = true; }; }; + # Configure backup of files on the department's fs account + jobs.fsaccount = { + preHook = '' + mkdir -p /home/fsaccount/sicherung # Create if it does not exist + ${pkgs.rsync}/bin/rsync -e 'ssh -i /home/fsaccount/.ssh/fsaccount' -r fachschaft@gw1.mathematik.tu-darmstadt.de:/home/fachschaft/* /home/fsaccount/sicherung + ''; + paths = "/home/fsaccount/sicherung"; + encryption.mode = "none"; + environment = { + BORG_RSH = "ssh -i /home/fsaccount/.ssh/fsaccount"; + BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK = "yes"; + }; + repo = "borg@localhost:fsaccount"; + startAt = "daily"; + user = "fsaccount"; + group = "users"; + readWritePaths = ["/home/fsaccount"]; + }; + }; + environment.persistence.${config.impermanence.name} = { + users.fsaccount.directories = [ + { + directory = ".ssh"; # SSH Key with access to FS Account and known_hosts + mode = "u=rwx,g=,o="; + } + ]; + }; + # Extra user for FS account backup + users.users = { + fsaccount = { + description = "FS Account backup"; + isNormalUser = true; + }; }; }; } From f95860f00089657d0c805c3e431bdb0f6598ad59 Mon Sep 17 00:00:00 2001 From: Gonne Date: Mon, 4 Mar 2024 09:23:25 +0100 Subject: [PATCH 3/9] Address Feedback --- nixos/modules/borgbackup.nix | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/nixos/modules/borgbackup.nix b/nixos/modules/borgbackup.nix index 6179b1e..54e4595 100644 --- a/nixos/modules/borgbackup.nix +++ b/nixos/modules/borgbackup.nix @@ -20,6 +20,11 @@ in { config = mkIf cfg.enable { services.borgbackup = { # repos are made available at ssh://borg@hostname and served according to the presented ssh-key + + # If you think about adding keys of nix machines: + # Congratulations, you are the first person to make backups from a nixos machine. + # Your won the task of automatizing this endeavor, so in future we don't need to hand copy any + # ssh keys anymore. repos = { aphoom-zhah = { authorizedKeysAppendOnly = [ @@ -138,7 +143,10 @@ in { users.users = { fsaccount = { description = "FS Account backup"; - isNormalUser = true; + isSystemUser = true; + home = "/home/fsaccount"; + createHome = true; + group = "users"; }; }; }; From 05036bdaee2e85e58c5ed3471de5de2f81a66ecb Mon Sep 17 00:00:00 2001 From: Gonne Date: Thu, 21 Mar 2024 17:50:25 +0100 Subject: [PATCH 4/9] Use sops for private key distribution --- .sops.yaml | 2 +- nixos/machines/bragi/backupKey.yaml | 39 +++++++++++++++++++++++++++++ nixos/modules/borgbackup.nix | 20 +++++++++++---- 3 files changed, 55 insertions(+), 6 deletions(-) create mode 100644 nixos/machines/bragi/backupKey.yaml diff --git a/.sops.yaml b/.sops.yaml index 6d555cf..6f01614 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -1,6 +1,6 @@ keys: - &nerf age1rasjnr2tlv9y70sj0z0hwpgpxdc974wzg5umtx2pnc6z0p05u3js6r8sln - - &gonne age1xv5rfxkxg9jyqx5jg2j82cxv7w7ep4a3795p4yl5fuqf38f3m3eqfnefju + - &gonne age1epz92k2rkp43hkrg3u0jgkzhnkwx8y43kag7rvfzwl9wcddelvusyetxl7 - &nyarlathotep age1s99d0vlj5qlm287n98jratql5fypvjrxxal0k5jl2aw9dcc8kyvqw5yyt4 - &bragi age1lqvgpmlemyg9095ujck64u59ma29656zs7a4yxgz4s6u5cld2ccss69jwe diff --git a/nixos/machines/bragi/backupKey.yaml b/nixos/machines/bragi/backupKey.yaml new file mode 100644 index 0000000..e9fdf93 --- /dev/null +++ b/nixos/machines/bragi/backupKey.yaml @@ -0,0 +1,39 @@ +backupKey: ENC[AES256_GCM,data:PBdeV6uQ/Jg9xk7HXylyDKCBdny/XRflF752arUZAnUvmVv4yiSwOY9ua3tH1BDpddiql1aNJqmfatZOB3JKB2mHnyeSt7L0B81zuIFpxJOdsnGACviH6sUfsC5ogkGRhLKynf5Ghz/6xanthyK6euIpAAu05wDWcseg4y8k5rdFhL7rasmOMi0oVLN54Psmyf9vahfX6BNGBHQA1qJyeaI5iDLI+6gh7dtOXjTd4pHX8T9PEYpGnOBMHvaaVA2r7z27iUJSKqzzSB9B/rm01tI6LTG/yfQU+TKlWFU2iIodCG7eJ2qe+exvxOlEj9At/UI/Kd+dNSHcffLDUxVcstthOOP0TUdHkPCTC8BEJtAAexUBqSv+LTOPfJeAbIw3QhEpfeyZOpw2FY1qstQ/G0+1sDF8762uJu9v1amx4+4e8NEiSa/dtdnQAKFiEswk+5nqRSKQJOH3w0tHr9NRhhS775lUtUX4DW0xN42QeABM0xg56qJPxPNif3K2ovPX3BTSSZnQ0EZzuxployu1MyJxpcBT+6qa8l/h,iv:ZdivBorDtIyBOs7XSg/DHjReG+T6/exeS8ziA7ms7FM=,tag:gcIXgpyd2UeQV3APqCCxMg==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1rasjnr2tlv9y70sj0z0hwpgpxdc974wzg5umtx2pnc6z0p05u3js6r8sln + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaR2dRc3NPeUwwaHdCL25V + RHNaWU9xRUw5dDlaOG5hczVlNm5UR01QUEVNClJsVFRBWU85Z0JuV1l3MDdvd1F2 + RS9CcXhuNEJWdEE1cktXYjF3RW9wUDQKLS0tIHk3MURmWlJNanVZaHlUR3R2UEZG + K2JxOHpNY2hsTysrWjNLajFKQkxuNHcKaFMvnDt9a3HsnbP1Q/i4ifRIXFcXYn8z + YyOho0hSmWZNhTbltmuVKjvCNgt9ONVRW93uRDDoju8Odps0qwwvuA== + -----END AGE ENCRYPTED FILE----- + - recipient: age1epz92k2rkp43hkrg3u0jgkzhnkwx8y43kag7rvfzwl9wcddelvusyetxl7 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMM1NCbHdFZDJvYjJjcmZ6 + bUFjSG5OUEdydS9pTkNHRjFKb3gvWll0Q0RVCk56ZnhDa0NGeUNhVVdDZENieDFW + Q0xSNXhYQXZSVnI3WlRzUjhxOXRyM2sKLS0tIGhnVWJaRG4vSGpUcnQ5SFVFT3VQ + YUFzTlNLSE9CbW9oYTFsY0tpTE4vZTQKjurd87tDH8z58pAGJyVXRAu8Q2+k7e4G + zOGZhm5DpSmFv2O2fqXgBg8nT5wrPKQDFvcDh1P+a0753tUTbUttIA== + -----END AGE ENCRYPTED FILE----- + - recipient: age1lqvgpmlemyg9095ujck64u59ma29656zs7a4yxgz4s6u5cld2ccss69jwe + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlWmlwS0E5TytFdEpxN09U + Y3k0SDhnM2h5Rnh1bXQ2czA5bWt1Mkk3aUFFCmtwT2ZmN0IweGdOYURWNDVHcWtH + R3lRaFRkcWYzb2g4NWNFQU5WOXZZaGMKLS0tIHpWNnNvVUNucE5MQ1cxQWl6Qm1x + NUZDVnJORXF1NGlyNUkzOGl2REFHdmsK18k9UfOmtFSep6mZcSp6di7SjvrBXgGp + oWtLehp1UFEHCgaU5YxlYhtkrrOhb8ykFb1on+kmzrloaHqyvks7Aw== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2024-03-21T16:38:08Z" + mac: ENC[AES256_GCM,data:kEVWd988Ia6T8v3w0slQhM0lh78VhnP8qJNa6IZg0NF2B0JQbFRnQNbUfvG9Rf4mkAR/O9PD+r6HR+b3LCwzb/Ok/eD4/M3+oPaEx/JnoHrzF/1N29VEAvBHjQgw6DL05toqu5G03UDcDUFGc111AeRsexhONQRHJx3zqWyWGy4=,iv:T5Pkhl3vhSAIoKkC3r3VQn3tC4t04WxvAZDQ4PMvD84=,tag:h0/aB91SFr5q0Or5daxWUQ==,type:str] + pgp: [] + unencrypted_suffix: _unencrypted + version: 3.8.1 diff --git a/nixos/modules/borgbackup.nix b/nixos/modules/borgbackup.nix index 54e4595..cd5c794 100644 --- a/nixos/modules/borgbackup.nix +++ b/nixos/modules/borgbackup.nix @@ -116,12 +116,12 @@ in { jobs.fsaccount = { preHook = '' mkdir -p /home/fsaccount/sicherung # Create if it does not exist - ${pkgs.rsync}/bin/rsync -e 'ssh -i /home/fsaccount/.ssh/fsaccount' -r fachschaft@gw1.mathematik.tu-darmstadt.de:/home/fachschaft/* /home/fsaccount/sicherung + ${pkgs.rsync}/bin/rsync -e 'ssh -i /run/secrets/backupKey' -r fachschaft@gw1.mathematik.tu-darmstadt.de:/home/fachschaft/* /home/fsaccount/sicherung ''; paths = "/home/fsaccount/sicherung"; encryption.mode = "none"; environment = { - BORG_RSH = "ssh -i /home/fsaccount/.ssh/fsaccount"; + BORG_RSH = "ssh -i /run/secrets/backupKey"; BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK = "yes"; }; repo = "borg@localhost:fsaccount"; @@ -132,13 +132,23 @@ in { }; }; environment.persistence.${config.impermanence.name} = { - users.fsaccount.directories = [ + users.fsaccount.files = [ { - directory = ".ssh"; # SSH Key with access to FS Account and known_hosts - mode = "u=rwx,g=,o="; + file = ".ssh/known_hosts"; + parentDirectory = { + mode = "u=rwx,g=,o="; + user = "fsaccount"; + group = "users"; + }; } ]; }; + sops.secrets.backupKey = { + sopsFile = ../machines/bragi/backupKey.yaml; + owner = config.users.users.fsaccount.name; + inherit (config.users.users.fsaccount) group; + mode = "0400"; + }; # Extra user for FS account backup users.users = { fsaccount = { From 1c827b5ed10e543a0ba984d776268db38b6eff5a Mon Sep 17 00:00:00 2001 From: Gonne Date: Wed, 27 Mar 2024 10:41:40 +0100 Subject: [PATCH 5/9] nix flake update --- flake.lock | 118 +++++++++++++++++++++++------------------------------ 1 file changed, 52 insertions(+), 66 deletions(-) diff --git a/flake.lock b/flake.lock index 2237126..4c3308e 100644 --- a/flake.lock +++ b/flake.lock @@ -21,11 +21,11 @@ "nixpkgs-lib": "nixpkgs-lib" }, "locked": { - "lastModified": 1706830856, - "narHash": "sha256-a0NYyp+h9hlb7ddVz4LUn1vT/PLwqfrWYcHMvFB1xYg=", + "lastModified": 1709336216, + "narHash": "sha256-Dt/wOWeW6Sqm11Yh+2+t0dfEWxoMxGBvv3JpIocFl9E=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "b253292d9c0a5ead9bc98c4e9a26c6312e27d69f", + "rev": "f7b3c975cf067e56e7cda6cb098ebe3fb4d74ca2", "type": "github" }, "original": { @@ -35,14 +35,14 @@ }, "flake-utils": { "inputs": { - "systems": "systems" + "systems": "systems_2" }, "locked": { - "lastModified": 1701680307, - "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=", + "lastModified": 1710146030, + "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=", "owner": "numtide", "repo": "flake-utils", - "rev": "4022d587cbbfd70fe950c1e2083a02621806a725", + "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a", "type": "github" }, "original": { @@ -53,11 +53,11 @@ }, "impermanence": { "locked": { - "lastModified": 1706639736, - "narHash": "sha256-CaG4j9+UwBDfinxxvJMo6yOonSmSo0ZgnbD7aj2Put0=", + "lastModified": 1708968331, + "narHash": "sha256-VUXLaPusCBvwM3zhGbRIJVeYluh2uWuqtj4WirQ1L9Y=", "owner": "nix-community", "repo": "impermanence", - "rev": "cd13c2917eaa68e4c49fea0ff9cada45440d7045", + "rev": "a33ef102a02ce77d3e39c25197664b7a636f9c30", "type": "github" }, "original": { @@ -71,16 +71,14 @@ "blobs": "blobs", "flake-compat": [], "nixpkgs": [], - "nixpkgs-23_05": "nixpkgs-23_05", - "nixpkgs-23_11": "nixpkgs-23_11", "utils": "utils" }, "locked": { - "lastModified": 1706742486, - "narHash": "sha256-sv/MISTeD0rqeVivpZJpynboMWJp6i62OmrZX1rGl38=", + "lastModified": 1710449465, + "narHash": "sha256-2orO8nfplp6uQJBFqKkj1iyNMC6TysmwbWwbb4osTag=", "ref": "refs/heads/master", - "rev": "9e36323ae3dde787f761420465c3ae560f3dbf29", - "revCount": 577, + "rev": "79c8cfcd5873a85559da6201b116fb38b490d030", + "revCount": 582, "type": "git", "url": "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver.git" }, @@ -91,11 +89,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1707092692, - "narHash": "sha256-ZbHsm+mGk/izkWtT4xwwqz38fdlwu7nUUKXTOmm4SyE=", + "lastModified": 1711703276, + "narHash": "sha256-iMUFArF0WCatKK6RzfUJknjem0H9m4KgorO/p3Dopkk=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "faf912b086576fd1a15fca610166c98d47bc667e", + "rev": "d8fe5e6c92d0d190646fb9f1056741a229980089", "type": "github" }, "original": { @@ -105,44 +103,14 @@ "type": "github" } }, - "nixpkgs-23_05": { - "locked": { - "lastModified": 1704290814, - "narHash": "sha256-LWvKHp7kGxk/GEtlrGYV68qIvPHkU9iToomNFGagixU=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "70bdadeb94ffc8806c0570eb5c2695ad29f0e421", - "type": "github" - }, - "original": { - "id": "nixpkgs", - "ref": "nixos-23.05", - "type": "indirect" - } - }, - "nixpkgs-23_11": { - "locked": { - "lastModified": 1706098335, - "narHash": "sha256-r3dWjT8P9/Ah5m5ul4WqIWD8muj5F+/gbCdjiNVBKmU=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "a77ab169a83a4175169d78684ddd2e54486ac651", - "type": "github" - }, - "original": { - "id": "nixpkgs", - "ref": "nixos-23.11", - "type": "indirect" - } - }, "nixpkgs-lib": { "locked": { "dir": "lib", - "lastModified": 1706550542, - "narHash": "sha256-UcsnCG6wx++23yeER4Hg18CXWbgNpqNXcHIo5/1Y+hc=", + "lastModified": 1709237383, + "narHash": "sha256-cy6ArO4k5qTx+l5o+0mL9f5fa86tYUX3ozE1S+Txlds=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "97b17f32362e475016f942bbdfda4a4a72a8a652", + "rev": "1536926ef5621b09bba54035ae2bb6d806d72ac8", "type": "github" }, "original": { @@ -155,16 +123,16 @@ }, "nixpkgs-stable": { "locked": { - "lastModified": 1705957679, - "narHash": "sha256-Q8LJaVZGJ9wo33wBafvZSzapYsjOaNjP/pOnSiKVGHY=", + "lastModified": 1711233294, + "narHash": "sha256-eEu5y4J145BYDw9o/YEmeJyqh8blgnZwuz9k234zuWc=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "9a333eaa80901efe01df07eade2c16d183761fa3", + "rev": "ac6bdf6181666ebb4f90dd20f31e2fa66ede6b68", "type": "github" }, "original": { "owner": "NixOS", - "ref": "release-23.05", + "ref": "release-23.11", "repo": "nixpkgs", "type": "github" } @@ -178,11 +146,11 @@ "nixpkgs-stable": [] }, "locked": { - "lastModified": 1706424699, - "narHash": "sha256-Q3RBuOpZNH2eFA1e+IHgZLAOqDD9SKhJ/sszrL8bQD4=", + "lastModified": 1711760932, + "narHash": "sha256-DqUTQ2iAAqSDwMhKBqvi24v0Oc7pD3LCK/0FCG//TdA=", "owner": "cachix", "repo": "pre-commit-hooks.nix", - "rev": "7c54e08a689b53c8a1e5d70169f2ec9e2a68ffaf", + "rev": "c11e43aed6f17336c25cd120eac886b96c455731", "type": "github" }, "original": { @@ -209,11 +177,11 @@ "nixpkgs-stable": "nixpkgs-stable" }, "locked": { - "lastModified": 1707015547, - "narHash": "sha256-YZr0OrqWPdbwBhxpBu69D32ngJZw8AMgZtJeaJn0e94=", + "lastModified": 1711249319, + "narHash": "sha256-N+Pp3/8H+rd7cO71VNV/ovV/Kwt+XNeUHNhsmyTabdM=", "owner": "Mic92", "repo": "sops-nix", - "rev": "23f61b897c00b66855074db471ba016e0cda20dd", + "rev": "405987a66cce9a4a82f321f11b205982a7127c88", "type": "github" }, "original": { @@ -237,13 +205,31 @@ "type": "github" } }, - "utils": { + "systems_2": { "locked": { - "lastModified": 1605370193, - "narHash": "sha256-YyMTf3URDL/otKdKgtoMChu4vfVL3vCMkRqpGifhUn0=", + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, + "utils": { + "inputs": { + "systems": "systems" + }, + "locked": { + "lastModified": 1709126324, + "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=", "owner": "numtide", "repo": "flake-utils", - "rev": "5021eac20303a61fafe17224c087f5519baed54d", + "rev": "d465f4819400de7c8d874d50b982301f28a84605", "type": "github" }, "original": { From b7b0e07f442021a4d940b9e1cbd499746242161e Mon Sep 17 00:00:00 2001 From: Gonne Date: Mon, 18 Dec 2023 17:55:00 +0100 Subject: [PATCH 6/9] Create backuphost Bragi --- nixos/machines/bragi/configuration.nix | 15 +++ .../machines/bragi/hardware-configuration.nix | 32 ++++++ nixos/machines/bragi/network.nix | 15 +++ nixos/modules/borgbackup.nix | 104 ++++++++++++++++++ 4 files changed, 166 insertions(+) create mode 100644 nixos/machines/bragi/configuration.nix create mode 100644 nixos/machines/bragi/hardware-configuration.nix create mode 100644 nixos/machines/bragi/network.nix create mode 100644 nixos/modules/borgbackup.nix diff --git a/nixos/machines/bragi/configuration.nix b/nixos/machines/bragi/configuration.nix new file mode 100644 index 0000000..f74fbb9 --- /dev/null +++ b/nixos/machines/bragi/configuration.nix @@ -0,0 +1,15 @@ +{ + imports = [ + ./hardware-configuration.nix + ../../roles + ../../roles/hardware.nix + ./network.nix + ../../modules/borgbackup.nix + ]; + + services.mathebau-borgbackup.enable = true; + + # System configuration here + networking.hostName = "bragi"; + system.stateVersion = "23.11"; +} diff --git a/nixos/machines/bragi/hardware-configuration.nix b/nixos/machines/bragi/hardware-configuration.nix new file mode 100644 index 0000000..4bd7168 --- /dev/null +++ b/nixos/machines/bragi/hardware-configuration.nix @@ -0,0 +1,32 @@ +{lib, ...}: { + fileSystems."/" = { + device = "root"; + fsType = "tmpfs"; + options = ["size=2G" "mode=755"]; + }; + fileSystems."/persist" = { + device = "/dev/disk/by-label/nixos"; + fsType = "btrfs"; + options = ["subvol=persist"]; + neededForBoot = true; + }; + fileSystems."/boot" = { + device = "/dev/disk/by-label/boot"; + fsType = "ext4"; + }; + fileSystems."/nix" = { + device = "/dev/disk/by-label/nixos"; + fsType = "btrfs"; + options = ["subvol=nix"]; + }; + fileSystems."/var/lib/backups" = { + device = "/dev/disk/by-label/backups"; + fsType = "btrfs"; + }; + + swapDevices = [{device = "/dev/disk/by-label/swap";}]; + + boot.loader.grub.device = "/dev/disk/by-id/wwn-0x5000c5003891662c"; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} diff --git a/nixos/machines/bragi/network.nix b/nixos/machines/bragi/network.nix new file mode 100644 index 0000000..b113b50 --- /dev/null +++ b/nixos/machines/bragi/network.nix @@ -0,0 +1,15 @@ +# We sohuld put that config somewhere in roles and give it a parameter or something, +# everyone gets the same nameserver and the same prefixLength and address vs defaultGateway alsways +# depend on the same thing +{ + networking = { + interfaces.enp0s25.ipv4.addresses = [ + { + address = "192.168.1.11"; + prefixLength = 24; + } + ]; + defaultGateway = "192.168.1.137"; + nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"]; + }; +} diff --git a/nixos/modules/borgbackup.nix b/nixos/modules/borgbackup.nix new file mode 100644 index 0000000..d019756 --- /dev/null +++ b/nixos/modules/borgbackup.nix @@ -0,0 +1,104 @@ +{ + config, + lib, + ... +}: let + inherit + (lib) + mkIf + mkEnableOption + ; + cfg = config.services.mathebau-borgbackup; +in { + imports = []; + + options.services.mathebau-borgbackup = { + enable = mkEnableOption "mathebau borgbackup service"; + }; + + config = mkIf cfg.enable { + services.borgbackup = { + # repos are made available at ssh://borg@hostname and served according to the presented ssh-key + repos = { + aphoom-zhah = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA8pI6uinXezAMH4vG2yEbu/yOYU5vXcsZN74tYgV+Wj Aphoom-Zhah Backup" + ]; + path = "/var/lib/backups/aphoom-zhah"; + # subrepos are allowed because each vm creates at least one repo below this filepath and yibb-tstll even more + allowSubRepos = true; + }; + azathoth = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGBEwllQ77ktoirXX6dJ6ET8TfK4lzq0aaq+X4rrX2Vk Azathoth Backup" + ]; + path = "/var/lib/backups/azathoth"; + allowSubRepos = true; + }; + cthulhu = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSJl1MvabUADTdOCgufsBzn1tIIpxMq4iDcYZsaW1lV Cthulhu Backup" + ]; + path = "/var/lib/backups/cthulhu"; + allowSubRepos = true; + }; + dagon = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJaTBennwqT9eB43gVD1nM1os3dMPZ8RWwIKPEjqMK5V Dagon Backup" + ]; + path = "/var/lib/backups/dagon"; + allowSubRepos = true; + }; + eihort = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHLoDxtY4Tp6NKxLt9oHmWT6w4UpU6eA1TnPU2Ut83BN Eihort Backup" + ]; + path = "/var/lib/backups/eihort"; + allowSubRepos = true; + }; + hastur = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILeDvTyOUdIPARatX0PPhHgrV1gjERWLt2Twa8E2GETb Hastur Backupsystem" + ]; + path = "/var/lib/backups/hastur"; + allowSubRepos = true; + }; + ithaqua = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPJmBf8cz3FTDdeuxWbp1MO2yPT5rvH8ZIGUzfogjpXi Ithaqua Backup" + ]; + path = "/var/lib/backups/ithaqua"; + allowSubRepos = true; + }; + sanctamariamaterdei = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH9Le5OI4ympQ0mQKYHmxgxGF598rzpD5VVpWK1mGfd8 Sanctamariamaterdei Backupsystem" + ]; + path = "/var/lib/backups/sanctamariamaterdei"; + allowSubRepos = true; + }; + tsathoggua = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKS9/1lFOhv+3sNuGcysM3TYh2xRrjMeAZX3K7CBx0QW Tsathoggua Backup" + ]; + path = "/var/lib/backups/tsathoggua"; + allowSubRepos = true; + }; + uvhash = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB8DjIqgFgmYhQnTLpbqL0r7xBPb8TPy6SO5RhQ31OGj Uvhash Backup" + ]; + path = "/var/lib/backups/uvhash"; + allowSubRepos = true; + }; + yibb-tstll = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlnGOV58Ks9lu+WTI4F7QAHtDrJq2jY8ZocITZG8K0+ Yibb-Tstll Backup" + ]; + path = "/var/lib/backups/yibb-tstll"; + allowSubRepos = true; + }; + }; + }; + }; +} From b0af48a9d0fa3178941172a92b32977a56e31ea5 Mon Sep 17 00:00:00 2001 From: Gonne Date: Wed, 7 Feb 2024 15:21:15 +0100 Subject: [PATCH 7/9] Backup des Fachschaftsaccounts --- nixos/modules/borgbackup.nix | 41 ++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/nixos/modules/borgbackup.nix b/nixos/modules/borgbackup.nix index d019756..6179b1e 100644 --- a/nixos/modules/borgbackup.nix +++ b/nixos/modules/borgbackup.nix @@ -1,6 +1,7 @@ { config, lib, + pkgs, ... }: let inherit @@ -56,6 +57,13 @@ in { path = "/var/lib/backups/eihort"; allowSubRepos = true; }; + fsaccount = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG+Y7fQTYdIWHehrKdk92CaJ0AisEux4OrS4nIyMstU4 FS Account Backup" + ]; + path = "/var/lib/backups/fsaccount"; + allowSubRepos = true; + }; hastur = { authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILeDvTyOUdIPARatX0PPhHgrV1gjERWLt2Twa8E2GETb Hastur Backupsystem" @@ -99,6 +107,39 @@ in { allowSubRepos = true; }; }; + # Configure backup of files on the department's fs account + jobs.fsaccount = { + preHook = '' + mkdir -p /home/fsaccount/sicherung # Create if it does not exist + ${pkgs.rsync}/bin/rsync -e 'ssh -i /home/fsaccount/.ssh/fsaccount' -r fachschaft@gw1.mathematik.tu-darmstadt.de:/home/fachschaft/* /home/fsaccount/sicherung + ''; + paths = "/home/fsaccount/sicherung"; + encryption.mode = "none"; + environment = { + BORG_RSH = "ssh -i /home/fsaccount/.ssh/fsaccount"; + BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK = "yes"; + }; + repo = "borg@localhost:fsaccount"; + startAt = "daily"; + user = "fsaccount"; + group = "users"; + readWritePaths = ["/home/fsaccount"]; + }; + }; + environment.persistence.${config.impermanence.name} = { + users.fsaccount.directories = [ + { + directory = ".ssh"; # SSH Key with access to FS Account and known_hosts + mode = "u=rwx,g=,o="; + } + ]; + }; + # Extra user for FS account backup + users.users = { + fsaccount = { + description = "FS Account backup"; + isNormalUser = true; + }; }; }; } From e340a7eb75febcbcda63cf950cf4e8c9890fc0d0 Mon Sep 17 00:00:00 2001 From: Gonne Date: Mon, 4 Mar 2024 09:23:25 +0100 Subject: [PATCH 8/9] Address Feedback --- nixos/modules/borgbackup.nix | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/nixos/modules/borgbackup.nix b/nixos/modules/borgbackup.nix index 6179b1e..54e4595 100644 --- a/nixos/modules/borgbackup.nix +++ b/nixos/modules/borgbackup.nix @@ -20,6 +20,11 @@ in { config = mkIf cfg.enable { services.borgbackup = { # repos are made available at ssh://borg@hostname and served according to the presented ssh-key + + # If you think about adding keys of nix machines: + # Congratulations, you are the first person to make backups from a nixos machine. + # Your won the task of automatizing this endeavor, so in future we don't need to hand copy any + # ssh keys anymore. repos = { aphoom-zhah = { authorizedKeysAppendOnly = [ @@ -138,7 +143,10 @@ in { users.users = { fsaccount = { description = "FS Account backup"; - isNormalUser = true; + isSystemUser = true; + home = "/home/fsaccount"; + createHome = true; + group = "users"; }; }; }; From 1bf59168fb9f19328d5436ed953ef7c8ae740868 Mon Sep 17 00:00:00 2001 From: Gonne Date: Thu, 21 Mar 2024 17:50:25 +0100 Subject: [PATCH 9/9] Use sops for private key distribution --- .sops.yaml | 2 +- nixos/machines/bragi/backupKey.yaml | 39 +++++++++++++++++++++++++++++ nixos/modules/borgbackup.nix | 20 +++++++++++---- 3 files changed, 55 insertions(+), 6 deletions(-) create mode 100644 nixos/machines/bragi/backupKey.yaml diff --git a/.sops.yaml b/.sops.yaml index 6d555cf..6f01614 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -1,6 +1,6 @@ keys: - &nerf age1rasjnr2tlv9y70sj0z0hwpgpxdc974wzg5umtx2pnc6z0p05u3js6r8sln - - &gonne age1xv5rfxkxg9jyqx5jg2j82cxv7w7ep4a3795p4yl5fuqf38f3m3eqfnefju + - &gonne age1epz92k2rkp43hkrg3u0jgkzhnkwx8y43kag7rvfzwl9wcddelvusyetxl7 - &nyarlathotep age1s99d0vlj5qlm287n98jratql5fypvjrxxal0k5jl2aw9dcc8kyvqw5yyt4 - &bragi age1lqvgpmlemyg9095ujck64u59ma29656zs7a4yxgz4s6u5cld2ccss69jwe diff --git a/nixos/machines/bragi/backupKey.yaml b/nixos/machines/bragi/backupKey.yaml new file mode 100644 index 0000000..e9fdf93 --- /dev/null +++ b/nixos/machines/bragi/backupKey.yaml @@ -0,0 +1,39 @@ +backupKey: ENC[AES256_GCM,data:PBdeV6uQ/Jg9xk7HXylyDKCBdny/XRflF752arUZAnUvmVv4yiSwOY9ua3tH1BDpddiql1aNJqmfatZOB3JKB2mHnyeSt7L0B81zuIFpxJOdsnGACviH6sUfsC5ogkGRhLKynf5Ghz/6xanthyK6euIpAAu05wDWcseg4y8k5rdFhL7rasmOMi0oVLN54Psmyf9vahfX6BNGBHQA1qJyeaI5iDLI+6gh7dtOXjTd4pHX8T9PEYpGnOBMHvaaVA2r7z27iUJSKqzzSB9B/rm01tI6LTG/yfQU+TKlWFU2iIodCG7eJ2qe+exvxOlEj9At/UI/Kd+dNSHcffLDUxVcstthOOP0TUdHkPCTC8BEJtAAexUBqSv+LTOPfJeAbIw3QhEpfeyZOpw2FY1qstQ/G0+1sDF8762uJu9v1amx4+4e8NEiSa/dtdnQAKFiEswk+5nqRSKQJOH3w0tHr9NRhhS775lUtUX4DW0xN42QeABM0xg56qJPxPNif3K2ovPX3BTSSZnQ0EZzuxployu1MyJxpcBT+6qa8l/h,iv:ZdivBorDtIyBOs7XSg/DHjReG+T6/exeS8ziA7ms7FM=,tag:gcIXgpyd2UeQV3APqCCxMg==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1rasjnr2tlv9y70sj0z0hwpgpxdc974wzg5umtx2pnc6z0p05u3js6r8sln + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaR2dRc3NPeUwwaHdCL25V + RHNaWU9xRUw5dDlaOG5hczVlNm5UR01QUEVNClJsVFRBWU85Z0JuV1l3MDdvd1F2 + RS9CcXhuNEJWdEE1cktXYjF3RW9wUDQKLS0tIHk3MURmWlJNanVZaHlUR3R2UEZG + K2JxOHpNY2hsTysrWjNLajFKQkxuNHcKaFMvnDt9a3HsnbP1Q/i4ifRIXFcXYn8z + YyOho0hSmWZNhTbltmuVKjvCNgt9ONVRW93uRDDoju8Odps0qwwvuA== + -----END AGE ENCRYPTED FILE----- + - recipient: age1epz92k2rkp43hkrg3u0jgkzhnkwx8y43kag7rvfzwl9wcddelvusyetxl7 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMM1NCbHdFZDJvYjJjcmZ6 + bUFjSG5OUEdydS9pTkNHRjFKb3gvWll0Q0RVCk56ZnhDa0NGeUNhVVdDZENieDFW + Q0xSNXhYQXZSVnI3WlRzUjhxOXRyM2sKLS0tIGhnVWJaRG4vSGpUcnQ5SFVFT3VQ + YUFzTlNLSE9CbW9oYTFsY0tpTE4vZTQKjurd87tDH8z58pAGJyVXRAu8Q2+k7e4G + zOGZhm5DpSmFv2O2fqXgBg8nT5wrPKQDFvcDh1P+a0753tUTbUttIA== + -----END AGE ENCRYPTED FILE----- + - recipient: age1lqvgpmlemyg9095ujck64u59ma29656zs7a4yxgz4s6u5cld2ccss69jwe + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlWmlwS0E5TytFdEpxN09U + Y3k0SDhnM2h5Rnh1bXQ2czA5bWt1Mkk3aUFFCmtwT2ZmN0IweGdOYURWNDVHcWtH + R3lRaFRkcWYzb2g4NWNFQU5WOXZZaGMKLS0tIHpWNnNvVUNucE5MQ1cxQWl6Qm1x + NUZDVnJORXF1NGlyNUkzOGl2REFHdmsK18k9UfOmtFSep6mZcSp6di7SjvrBXgGp + oWtLehp1UFEHCgaU5YxlYhtkrrOhb8ykFb1on+kmzrloaHqyvks7Aw== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2024-03-21T16:38:08Z" + mac: ENC[AES256_GCM,data:kEVWd988Ia6T8v3w0slQhM0lh78VhnP8qJNa6IZg0NF2B0JQbFRnQNbUfvG9Rf4mkAR/O9PD+r6HR+b3LCwzb/Ok/eD4/M3+oPaEx/JnoHrzF/1N29VEAvBHjQgw6DL05toqu5G03UDcDUFGc111AeRsexhONQRHJx3zqWyWGy4=,iv:T5Pkhl3vhSAIoKkC3r3VQn3tC4t04WxvAZDQ4PMvD84=,tag:h0/aB91SFr5q0Or5daxWUQ==,type:str] + pgp: [] + unencrypted_suffix: _unencrypted + version: 3.8.1 diff --git a/nixos/modules/borgbackup.nix b/nixos/modules/borgbackup.nix index 54e4595..cd5c794 100644 --- a/nixos/modules/borgbackup.nix +++ b/nixos/modules/borgbackup.nix @@ -116,12 +116,12 @@ in { jobs.fsaccount = { preHook = '' mkdir -p /home/fsaccount/sicherung # Create if it does not exist - ${pkgs.rsync}/bin/rsync -e 'ssh -i /home/fsaccount/.ssh/fsaccount' -r fachschaft@gw1.mathematik.tu-darmstadt.de:/home/fachschaft/* /home/fsaccount/sicherung + ${pkgs.rsync}/bin/rsync -e 'ssh -i /run/secrets/backupKey' -r fachschaft@gw1.mathematik.tu-darmstadt.de:/home/fachschaft/* /home/fsaccount/sicherung ''; paths = "/home/fsaccount/sicherung"; encryption.mode = "none"; environment = { - BORG_RSH = "ssh -i /home/fsaccount/.ssh/fsaccount"; + BORG_RSH = "ssh -i /run/secrets/backupKey"; BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK = "yes"; }; repo = "borg@localhost:fsaccount"; @@ -132,13 +132,23 @@ in { }; }; environment.persistence.${config.impermanence.name} = { - users.fsaccount.directories = [ + users.fsaccount.files = [ { - directory = ".ssh"; # SSH Key with access to FS Account and known_hosts - mode = "u=rwx,g=,o="; + file = ".ssh/known_hosts"; + parentDirectory = { + mode = "u=rwx,g=,o="; + user = "fsaccount"; + group = "users"; + }; } ]; }; + sops.secrets.backupKey = { + sopsFile = ../machines/bragi/backupKey.yaml; + owner = config.users.users.fsaccount.name; + inherit (config.users.users.fsaccount) group; + mode = "0400"; + }; # Extra user for FS account backup users.users = { fsaccount = {