143 lines
4.0 KiB
Nix
143 lines
4.0 KiB
Nix
{
|
|
config,
|
|
vaculib,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}:
|
|
let
|
|
inherit (lib) mkOption;
|
|
cfg = config.vacu.liam.backup;
|
|
commonServiceConfig = {
|
|
Type = "oneshot";
|
|
StateDirectory = "auto-borg";
|
|
CacheDirectory = "auto-borg";
|
|
ReadOnlyPaths = cfg.paths ++ [ cfg.keyPath ];
|
|
|
|
User = cfg.user;
|
|
Group = cfg.user;
|
|
|
|
LockPersonality = true;
|
|
MemoryDenyWriteExecute = true;
|
|
PrivateDevices = true;
|
|
# PrivateUsers = true;
|
|
ProcSubset = "pid";
|
|
PrivateTmp = true;
|
|
ProtectClock = true;
|
|
ProtectControlGroups = true;
|
|
ProtectHome = true;
|
|
ProtectHostname = true;
|
|
ProtectKernelLogs = true;
|
|
ProtectKernelModules = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectProc = "invisible";
|
|
ProtectSystem = "strict";
|
|
RestrictAddressFamilies = [
|
|
"AF_INET"
|
|
"AF_INET6"
|
|
];
|
|
RestrictNamespaces = true;
|
|
RestrictRealtime = true;
|
|
RestrictSUIDSGID = true;
|
|
SystemCallArchitectures = "native";
|
|
SystemCallFilter = [
|
|
"@system-service"
|
|
"~@privileged"
|
|
];
|
|
UMask = "0077";
|
|
AmbientCapabilities = [ "CAP_DAC_READ_SEARCH" ];
|
|
CapabilityBoundingSet = [ "CAP_DAC_READ_SEARCH" ];
|
|
};
|
|
in
|
|
{
|
|
options.vacu.liam.backup = {
|
|
user = mkOption { default = "autoborger"; };
|
|
rsyncUser = mkOption { default = "fm2382"; };
|
|
rsyncHost = mkOption { default = "${cfg.rsyncUser}.rsync.net"; };
|
|
repo = mkOption { default = "${cfg.rsyncUser}@${cfg.rsyncHost}:borg-repos/liam-backup"; };
|
|
package = mkOption { default = pkgs.borgbackup; };
|
|
cmd = mkOption { default = lib.getExe cfg.package; };
|
|
paths = mkOption {
|
|
default = [
|
|
"/var/lib/mail"
|
|
"/var/lib/dovecot"
|
|
"/var/log"
|
|
];
|
|
};
|
|
keyPath = mkOption { default = config.sops.secrets.liam-borg-key.path; };
|
|
};
|
|
config = {
|
|
vacu.assertions = lib.singleton {
|
|
assertion =
|
|
(lib.versionAtLeast cfg.package.version "1.4.0")
|
|
&& !(lib.versionAtLeast cfg.package.version "1.5.0");
|
|
message = "Only for version 1.4.x";
|
|
fatal = true;
|
|
};
|
|
|
|
sops.secrets.liam-borg-key = {
|
|
owner = cfg.user;
|
|
};
|
|
|
|
# systemd.tmpfiles.settings."10-auto-borg" = lib.genAttrs cfg.paths (_:
|
|
# {
|
|
# # A+ = append to ACLs recursively
|
|
# "A+" = {
|
|
# argument = "u:${cfg.user}:r-x";
|
|
# };
|
|
# }
|
|
# );
|
|
users.users.${cfg.user} = {
|
|
isSystemUser = true;
|
|
group = cfg.user;
|
|
home = "/var/lib/auto-borg";
|
|
};
|
|
users.groups.${cfg.user} = { };
|
|
systemd.services.auto-borg-gen-key = {
|
|
script = ''
|
|
set -euo pipefail
|
|
${lib.optionalString config.vacu.underTest "${pkgs.openssh}/bin/ssh -oBatchMode=yes -oStrictHostKeyChecking=accept-new ${cfg.rsyncHost} || true"}
|
|
${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f "$STATE_DIRECTORY"/id_ed25519 -N ""
|
|
'';
|
|
serviceConfig = commonServiceConfig;
|
|
};
|
|
systemd.services.auto-borg = {
|
|
script = ''
|
|
set -euo pipefail
|
|
# makes a date like 2025-04-15_21-24-29_UTC
|
|
dashed_date="$(date -u '+%F_%H-%M-%S_%Z')"
|
|
archive_name="liam-auto-backup--$dashed_date"
|
|
export BORG_PASSPHRASE="$(cat ${lib.escapeShellArg cfg.keyPath})"
|
|
export BORG_REMOTE_PATH="borg14"
|
|
export BORG_RSH="ssh -i $STATE_DIRECTORY/id_ed25519"
|
|
export BORG_REPO=${lib.escapeShellArg cfg.repo}
|
|
export BORG_CACHE_DIR="$CACHE_DIRECTORY/borg"
|
|
export BORG_CONFIG_DIR="$STATE_DIRECTORY/borg"
|
|
cmd=(
|
|
${lib.escapeShellArg cfg.cmd}
|
|
create
|
|
--show-rc
|
|
--verbose
|
|
--progress
|
|
--show-version
|
|
--stats
|
|
--atime
|
|
"::$archive_name"
|
|
${lib.escapeShellArgs cfg.paths}
|
|
)
|
|
"''${cmd[@]}"
|
|
'';
|
|
serviceConfig = commonServiceConfig;
|
|
};
|
|
systemd.timers.auto-borg = {
|
|
enable = !config.vacu.underTest;
|
|
wantedBy = [ "timers.target" ];
|
|
# run every day at a random time between 3am and 4am, los angeles time
|
|
timerConfig = {
|
|
OnCalendar = "*-*-* 03:00:00 America/Los_Angeles";
|
|
RandomizedDelaySec = 3600;
|
|
};
|
|
};
|
|
};
|
|
}
|