Address Feedback

.sops.yaml

@@ -1,16 +1,26 @@
 keys:
   - &nerf age1rasjnr2tlv9y70sj0z0hwpgpxdc974wzg5umtx2pnc6z0p05u3js6r8sln
+  - &gonne age1xv5rfxkxg9jyqx5jg2j82cxv7w7ep4a3795p4yl5fuqf38f3m3eqfnefju
 
   - &nyarlathotep age1s99d0vlj5qlm287n98jratql5fypvjrxxal0k5jl2aw9dcc8kyvqw5yyt4
+  - &bragi age1lqvgpmlemyg9095ujck64u59ma29656zs7a4yxgz4s6u5cld2ccss69jwe
 
 creation_rules:
-  - path_regex nixos/machines/nyarlathotep/.*
+  - path_regex: nixos/machines/nyarlathotep/.*
     key_groups:
       - age:
-          *nerf
+        - *nerf
-          *nyarlathotep
+        - *gonne
+        - *nyarlathotep
+  - path_regex: nixos/machines/bragi/.*
+    key_groups:
+      - age:
+        - *nerf
+        - *gonne
+        - *bragi
   # this is the catchall clause if nothing above machtes. Encrypt to users but not
   # to machines
   - key_groups:
       - age:
-          *nerf
+        - *nerf
+        - *gonne

nixos/machines/bragi/configuration.nix

@@ -0,0 +1,15 @@
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../roles
+    ../../roles/hardware.nix
+    ./network.nix
+    ../../modules/borgbackup.nix
+  ];
+
+  services.mathebau-borgbackup.enable = true;
+
+  # System configuration here
+  networking.hostName = "bragi";
+  system.stateVersion = "23.11";
+}

nixos/machines/bragi/hardware-configuration.nix

@@ -0,0 +1,32 @@
+{lib, ...}: {
+  fileSystems."/" = {
+    device = "root";
+    fsType = "tmpfs";
+    options = ["size=2G" "mode=755"];
+  };
+  fileSystems."/persist" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "btrfs";
+    options = ["subvol=persist"];
+    neededForBoot = true;
+  };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/boot";
+    fsType = "ext4";
+  };
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "btrfs";
+    options = ["subvol=nix"];
+  };
+  fileSystems."/var/lib/backups" = {
+    device = "/dev/disk/by-label/backups";
+    fsType = "btrfs";
+  };
+
+  swapDevices = [{device = "/dev/disk/by-label/swap";}];
+
+  boot.loader.grub.device = "/dev/disk/by-id/wwn-0x5000c5003891662c";
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

nixos/machines/bragi/network.nix

@@ -0,0 +1,15 @@
+# We sohuld put that config somewhere in roles and give it a parameter or something,
+# everyone gets the same nameserver and the same prefixLength and address vs defaultGateway alsways
+# depend on the same thing
+{
+  networking = {
+    interfaces.enp0s25.ipv4.addresses = [
+      {
+        address = "192.168.1.11";
+        prefixLength = 24;
+      }
+    ];
+    defaultGateway = "192.168.1.137";
+    nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"];
+  };
+}

nixos/modules/borgbackup.nix

@@ -0,0 +1,153 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  inherit
+    (lib)
+    mkIf
+    mkEnableOption
+    ;
+  cfg = config.services.mathebau-borgbackup;
+in {
+  imports = [];
+
+  options.services.mathebau-borgbackup = {
+    enable = mkEnableOption "mathebau borgbackup service";
+  };
+
+  config = mkIf cfg.enable {
+    services.borgbackup = {
+      # repos are made available at ssh://borg@hostname and served according to the presented ssh-key
+
+      # If you think about adding keys of nix machines:
+      # Congratulations, you are the first person to make backups from a nixos machine.
+      # Your won the task of automatizing this endeavor, so in future we don't need to hand copy any
+      # ssh keys anymore.
+      repos = {
+        aphoom-zhah = {
+          authorizedKeysAppendOnly = [
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA8pI6uinXezAMH4vG2yEbu/yOYU5vXcsZN74tYgV+Wj Aphoom-Zhah Backup"
+          ];
+          path = "/var/lib/backups/aphoom-zhah";
+          # subrepos are allowed because each vm creates at least one repo below this filepath and yibb-tstll even more
+          allowSubRepos = true;
+        };
+        azathoth = {
+          authorizedKeysAppendOnly = [
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGBEwllQ77ktoirXX6dJ6ET8TfK4lzq0aaq+X4rrX2Vk Azathoth Backup"
+          ];
+          path = "/var/lib/backups/azathoth";
+          allowSubRepos = true;
+        };
+        cthulhu = {
+          authorizedKeysAppendOnly = [
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSJl1MvabUADTdOCgufsBzn1tIIpxMq4iDcYZsaW1lV Cthulhu Backup"
+          ];
+          path = "/var/lib/backups/cthulhu";
+          allowSubRepos = true;
+        };
+        dagon = {
+          authorizedKeysAppendOnly = [
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJaTBennwqT9eB43gVD1nM1os3dMPZ8RWwIKPEjqMK5V Dagon Backup"
+          ];
+          path = "/var/lib/backups/dagon";
+          allowSubRepos = true;
+        };
+        eihort = {
+          authorizedKeysAppendOnly = [
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHLoDxtY4Tp6NKxLt9oHmWT6w4UpU6eA1TnPU2Ut83BN Eihort Backup"
+          ];
+          path = "/var/lib/backups/eihort";
+          allowSubRepos = true;
+        };
+        fsaccount = {
+          authorizedKeysAppendOnly = [
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG+Y7fQTYdIWHehrKdk92CaJ0AisEux4OrS4nIyMstU4 FS Account Backup"
+          ];
+          path = "/var/lib/backups/fsaccount";
+          allowSubRepos = true;
+        };
+        hastur = {
+          authorizedKeysAppendOnly = [
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILeDvTyOUdIPARatX0PPhHgrV1gjERWLt2Twa8E2GETb Hastur Backupsystem"
+          ];
+          path = "/var/lib/backups/hastur";
+          allowSubRepos = true;
+        };
+        ithaqua = {
+          authorizedKeysAppendOnly = [
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPJmBf8cz3FTDdeuxWbp1MO2yPT5rvH8ZIGUzfogjpXi Ithaqua Backup"
+          ];
+          path = "/var/lib/backups/ithaqua";
+          allowSubRepos = true;
+        };
+        sanctamariamaterdei = {
+          authorizedKeysAppendOnly = [
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH9Le5OI4ympQ0mQKYHmxgxGF598rzpD5VVpWK1mGfd8 Sanctamariamaterdei Backupsystem"
+          ];
+          path = "/var/lib/backups/sanctamariamaterdei";
+          allowSubRepos = true;
+        };
+        tsathoggua = {
+          authorizedKeysAppendOnly = [
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKS9/1lFOhv+3sNuGcysM3TYh2xRrjMeAZX3K7CBx0QW Tsathoggua Backup"
+          ];
+          path = "/var/lib/backups/tsathoggua";
+          allowSubRepos = true;
+        };
+        uvhash = {
+          authorizedKeysAppendOnly = [
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB8DjIqgFgmYhQnTLpbqL0r7xBPb8TPy6SO5RhQ31OGj Uvhash Backup"
+          ];
+          path = "/var/lib/backups/uvhash";
+          allowSubRepos = true;
+        };
+        yibb-tstll = {
+          authorizedKeysAppendOnly = [
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlnGOV58Ks9lu+WTI4F7QAHtDrJq2jY8ZocITZG8K0+ Yibb-Tstll Backup"
+          ];
+          path = "/var/lib/backups/yibb-tstll";
+          allowSubRepos = true;
+        };
+      };
+      # Configure backup of files on the department's fs account
+      jobs.fsaccount = {
+        preHook = ''
+          mkdir -p /home/fsaccount/sicherung # Create if it does not exist
+          ${pkgs.rsync}/bin/rsync -e 'ssh -i /home/fsaccount/.ssh/fsaccount' -r fachschaft@gw1.mathematik.tu-darmstadt.de:/home/fachschaft/* /home/fsaccount/sicherung
+        '';
+        paths = "/home/fsaccount/sicherung";
+        encryption.mode = "none";
+        environment = {
+          BORG_RSH = "ssh -i /home/fsaccount/.ssh/fsaccount";
+          BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK = "yes";
+        };
+        repo = "borg@localhost:fsaccount";
+        startAt = "daily";
+        user = "fsaccount";
+        group = "users";
+        readWritePaths = ["/home/fsaccount"];
+      };
+    };
+    environment.persistence.${config.impermanence.name} = {
+      users.fsaccount.directories = [
+        {
+          directory = ".ssh"; # SSH Key with access to FS Account and known_hosts
+          mode = "u=rwx,g=,o=";
+        }
+      ];
+    };
+    # Extra user for FS account backup
+    users.users = {
+      fsaccount = {
+        description = "FS Account backup";
+        isSystemUser = true;
+        home = "/home/fsaccount";
+        createHome = true;
+        group = "users";
+      };
+    };
+  };
+}