feat(infra): Init backups
All checks were successful
lint / check (push) Successful in 25s
build configuration / build_web02 (push) Successful in 1m4s
build configuration / build_vault01 (push) Successful in 1m6s
build configuration / build_storage01 (push) Successful in 1m13s
build configuration / build_compute01 (push) Successful in 1m25s
build configuration / build_web01 (push) Successful in 1m27s

This commit is contained in:
Tom Hubrecht 2024-02-21 17:18:14 +01:00
parent 13b7b2fab4
commit 6b827e56b1
10 changed files with 136 additions and 0 deletions

View file

@ -3,6 +3,7 @@
lib.extra.mkConfig { lib.extra.mkConfig {
enabledModules = [ enabledModules = [
# List of modules to enable # List of modules to enable
"dgn-backups"
"dgn-fail2ban" "dgn-fail2ban"
"dgn-web" "dgn-web"
]; ];

View file

@ -57,4 +57,6 @@ in
"hedgedoc" "hedgedoc"
"hedgedoc/uploads" "hedgedoc/uploads"
]; ];
dgn-backups.jobs.hedgedoc.settings.paths = [ "/var/lib/hedgedoc" ];
} }

Binary file not shown.

View file

@ -4,6 +4,7 @@ let
in in
lib.setDefault { inherit publicKeys; } [ lib.setDefault { inherit publicKeys; } [
"bupstash-put_key"
"ds-fr-secret_file" "ds-fr-secret_file"
"grafana-smtp_password_file" "grafana-smtp_password_file"
"grafana-oauth_client_secret_file" "grafana-oauth_client_secret_file"

View file

@ -71,4 +71,6 @@ in
]; ];
}; };
}; };
dgn-backups.jobs.vaultwarden.settings.paths = [ "/var/lib/bitwarden_rs" ];
} }

View file

@ -3,6 +3,7 @@
lib.extra.mkConfig { lib.extra.mkConfig {
enabledModules = [ enabledModules = [
# List of modules to enable # List of modules to enable
"dgn-backups"
]; ];
enabledServices = [ enabledServices = [

View file

@ -3,6 +3,7 @@
lib.extra.mkConfig { lib.extra.mkConfig {
enabledModules = [ enabledModules = [
# List of modules to enable # List of modules to enable
"dgn-backups"
]; ];
enabledServices = [ enabledServices = [

View file

@ -3,6 +3,7 @@
lib.extra.mkConfig { lib.extra.mkConfig {
enabledModules = [ enabledModules = [
# List of modules to enable # List of modules to enable
"dgn-backups"
"dgn-fail2ban" "dgn-fail2ban"
"dgn-web" "dgn-web"
]; ];

View file

@ -39,6 +39,7 @@
(lib.extra.mkImports ./. [ (lib.extra.mkImports ./. [
"dgn-access-control" "dgn-access-control"
"dgn-acme" "dgn-acme"
"dgn-backups"
"dgn-console" "dgn-console"
"dgn-fail2ban" "dgn-fail2ban"
"dgn-hardware" "dgn-hardware"
@ -55,5 +56,6 @@
"age-secrets" "age-secrets"
"services/crabfit" "services/crabfit"
"services/forgejo-nix-runners" "services/forgejo-nix-runners"
"services/bupstash"
]); ]);
} }

View file

@ -0,0 +1,125 @@
{
config,
lib,
name,
...
}:
let
inherit (lib) mkEnableOption mkOption remove;
inherit (lib.types)
attrs
attrsOf
listOf
str
submodule
;
cfg = config.dgn-backups;
homes = {
compute01 = "/data/slow/bupstash";
geo01 = "/data/bupstash";
geo02 = "/data/bupstash";
storage01 = "/data/slow/bupstash";
};
starts = {
compute01 = "*-*-* *:28:00";
};
mkJobs = builtins.mapAttrs (
_:
{ to, settings }:
{
startAt = starts.${name};
key = config.age.secrets."bupstash-put_key".path;
repositoryCommands =
lib.extra.mapSingleFuse (host: "ssh -i /etc/ssh/ssh_host_ed25519_key bupstash-repo@${host}.dgnum")
to;
}
// settings
);
mkPgJobs = lib.extra.mapFuse (db: { "pg-${db}" = { }; });
in
{
options.dgn-backups = {
enable = mkEnableOption "DGNum backup service.";
pgDumps = mkOption {
type = listOf str;
default = [ ];
description = ''
List of postgres databases to dump into bupstash.
'';
};
jobs = mkOption {
type = attrsOf (
submodule {
options = {
to = mkOption {
type = listOf str;
default = remove name [
"compute01"
"geo01"
"geo02"
"storage01"
];
description = "Hosts to send the backups to.";
};
settings = mkOption {
type = attrs;
default = { };
description = "Base bupstash job config.";
};
};
}
);
default = { };
description = "List of bupstash jobs.";
};
};
config = {
services.bupstash = {
repositories = {
inherit (cfg) enable;
home = homes.${name};
access = [
{
repo = "default";
keys = lib.extra.getAllKeys (
# Nodes allowed to create backups
builtins.map (host: "machines/${host}") [
"compute01"
"storage01"
"vault01"
"web01"
]
);
allowed = [ "put" ];
}
];
};
jobs = (mkPgJobs cfg.pgDumps) // (mkJobs cfg.jobs);
};
programs.ssh.knownHosts =
lib.extra.mapFuse
(host: { "${host}.dgnum".publicKey = builtins.head (lib.extra.getKeys "machines/${host}"); })
[
"compute01"
"geo01"
"geo02"
"storage01"
];
};
}