feat(infra): Init backups
All checks were successful
lint / check (push) Successful in 25s
build configuration / build_web02 (push) Successful in 1m4s
build configuration / build_vault01 (push) Successful in 1m6s
build configuration / build_storage01 (push) Successful in 1m13s
build configuration / build_compute01 (push) Successful in 1m25s
build configuration / build_web01 (push) Successful in 1m27s
All checks were successful
lint / check (push) Successful in 25s
build configuration / build_web02 (push) Successful in 1m4s
build configuration / build_vault01 (push) Successful in 1m6s
build configuration / build_storage01 (push) Successful in 1m13s
build configuration / build_compute01 (push) Successful in 1m25s
build configuration / build_web01 (push) Successful in 1m27s
This commit is contained in:
parent
13b7b2fab4
commit
6b827e56b1
|
@ -3,6 +3,7 @@
|
||||||
lib.extra.mkConfig {
|
lib.extra.mkConfig {
|
||||||
enabledModules = [
|
enabledModules = [
|
||||||
# List of modules to enable
|
# List of modules to enable
|
||||||
|
"dgn-backups"
|
||||||
"dgn-fail2ban"
|
"dgn-fail2ban"
|
||||||
"dgn-web"
|
"dgn-web"
|
||||||
];
|
];
|
||||||
|
|
|
@ -57,4 +57,6 @@ in
|
||||||
"hedgedoc"
|
"hedgedoc"
|
||||||
"hedgedoc/uploads"
|
"hedgedoc/uploads"
|
||||||
];
|
];
|
||||||
|
|
||||||
|
dgn-backups.jobs.hedgedoc.settings.paths = [ "/var/lib/hedgedoc" ];
|
||||||
}
|
}
|
||||||
|
|
BIN
machines/compute01/secrets/bupstash-put_key
Normal file
BIN
machines/compute01/secrets/bupstash-put_key
Normal file
Binary file not shown.
|
@ -4,6 +4,7 @@ let
|
||||||
in
|
in
|
||||||
|
|
||||||
lib.setDefault { inherit publicKeys; } [
|
lib.setDefault { inherit publicKeys; } [
|
||||||
|
"bupstash-put_key"
|
||||||
"ds-fr-secret_file"
|
"ds-fr-secret_file"
|
||||||
"grafana-smtp_password_file"
|
"grafana-smtp_password_file"
|
||||||
"grafana-oauth_client_secret_file"
|
"grafana-oauth_client_secret_file"
|
||||||
|
|
|
@ -71,4 +71,6 @@ in
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
dgn-backups.jobs.vaultwarden.settings.paths = [ "/var/lib/bitwarden_rs" ];
|
||||||
}
|
}
|
||||||
|
|
|
@ -3,6 +3,7 @@
|
||||||
lib.extra.mkConfig {
|
lib.extra.mkConfig {
|
||||||
enabledModules = [
|
enabledModules = [
|
||||||
# List of modules to enable
|
# List of modules to enable
|
||||||
|
"dgn-backups"
|
||||||
];
|
];
|
||||||
|
|
||||||
enabledServices = [
|
enabledServices = [
|
||||||
|
|
|
@ -3,6 +3,7 @@
|
||||||
lib.extra.mkConfig {
|
lib.extra.mkConfig {
|
||||||
enabledModules = [
|
enabledModules = [
|
||||||
# List of modules to enable
|
# List of modules to enable
|
||||||
|
"dgn-backups"
|
||||||
];
|
];
|
||||||
|
|
||||||
enabledServices = [
|
enabledServices = [
|
||||||
|
|
|
@ -3,6 +3,7 @@
|
||||||
lib.extra.mkConfig {
|
lib.extra.mkConfig {
|
||||||
enabledModules = [
|
enabledModules = [
|
||||||
# List of modules to enable
|
# List of modules to enable
|
||||||
|
"dgn-backups"
|
||||||
"dgn-fail2ban"
|
"dgn-fail2ban"
|
||||||
"dgn-web"
|
"dgn-web"
|
||||||
];
|
];
|
||||||
|
|
|
@ -39,6 +39,7 @@
|
||||||
(lib.extra.mkImports ./. [
|
(lib.extra.mkImports ./. [
|
||||||
"dgn-access-control"
|
"dgn-access-control"
|
||||||
"dgn-acme"
|
"dgn-acme"
|
||||||
|
"dgn-backups"
|
||||||
"dgn-console"
|
"dgn-console"
|
||||||
"dgn-fail2ban"
|
"dgn-fail2ban"
|
||||||
"dgn-hardware"
|
"dgn-hardware"
|
||||||
|
@ -55,5 +56,6 @@
|
||||||
"age-secrets"
|
"age-secrets"
|
||||||
"services/crabfit"
|
"services/crabfit"
|
||||||
"services/forgejo-nix-runners"
|
"services/forgejo-nix-runners"
|
||||||
|
"services/bupstash"
|
||||||
]);
|
]);
|
||||||
}
|
}
|
||||||
|
|
125
modules/dgn-backups/default.nix
Normal file
125
modules/dgn-backups/default.nix
Normal file
|
@ -0,0 +1,125 @@
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
name,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
|
||||||
|
let
|
||||||
|
inherit (lib) mkEnableOption mkOption remove;
|
||||||
|
|
||||||
|
inherit (lib.types)
|
||||||
|
attrs
|
||||||
|
attrsOf
|
||||||
|
listOf
|
||||||
|
str
|
||||||
|
submodule
|
||||||
|
;
|
||||||
|
|
||||||
|
cfg = config.dgn-backups;
|
||||||
|
|
||||||
|
homes = {
|
||||||
|
compute01 = "/data/slow/bupstash";
|
||||||
|
geo01 = "/data/bupstash";
|
||||||
|
geo02 = "/data/bupstash";
|
||||||
|
storage01 = "/data/slow/bupstash";
|
||||||
|
};
|
||||||
|
|
||||||
|
starts = {
|
||||||
|
compute01 = "*-*-* *:28:00";
|
||||||
|
};
|
||||||
|
|
||||||
|
mkJobs = builtins.mapAttrs (
|
||||||
|
_:
|
||||||
|
{ to, settings }:
|
||||||
|
{
|
||||||
|
startAt = starts.${name};
|
||||||
|
key = config.age.secrets."bupstash-put_key".path;
|
||||||
|
repositoryCommands =
|
||||||
|
lib.extra.mapSingleFuse (host: "ssh -i /etc/ssh/ssh_host_ed25519_key bupstash-repo@${host}.dgnum")
|
||||||
|
to;
|
||||||
|
}
|
||||||
|
// settings
|
||||||
|
);
|
||||||
|
|
||||||
|
mkPgJobs = lib.extra.mapFuse (db: { "pg-${db}" = { }; });
|
||||||
|
in
|
||||||
|
|
||||||
|
{
|
||||||
|
options.dgn-backups = {
|
||||||
|
enable = mkEnableOption "DGNum backup service.";
|
||||||
|
|
||||||
|
pgDumps = mkOption {
|
||||||
|
type = listOf str;
|
||||||
|
default = [ ];
|
||||||
|
description = ''
|
||||||
|
List of postgres databases to dump into bupstash.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
jobs = mkOption {
|
||||||
|
type = attrsOf (
|
||||||
|
submodule {
|
||||||
|
options = {
|
||||||
|
to = mkOption {
|
||||||
|
type = listOf str;
|
||||||
|
default = remove name [
|
||||||
|
"compute01"
|
||||||
|
"geo01"
|
||||||
|
"geo02"
|
||||||
|
"storage01"
|
||||||
|
];
|
||||||
|
description = "Hosts to send the backups to.";
|
||||||
|
};
|
||||||
|
|
||||||
|
settings = mkOption {
|
||||||
|
type = attrs;
|
||||||
|
default = { };
|
||||||
|
description = "Base bupstash job config.";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
);
|
||||||
|
default = { };
|
||||||
|
description = "List of bupstash jobs.";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = {
|
||||||
|
services.bupstash = {
|
||||||
|
repositories = {
|
||||||
|
inherit (cfg) enable;
|
||||||
|
|
||||||
|
home = homes.${name};
|
||||||
|
|
||||||
|
access = [
|
||||||
|
{
|
||||||
|
repo = "default";
|
||||||
|
keys = lib.extra.getAllKeys (
|
||||||
|
# Nodes allowed to create backups
|
||||||
|
builtins.map (host: "machines/${host}") [
|
||||||
|
"compute01"
|
||||||
|
"storage01"
|
||||||
|
"vault01"
|
||||||
|
"web01"
|
||||||
|
]
|
||||||
|
);
|
||||||
|
allowed = [ "put" ];
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
jobs = (mkPgJobs cfg.pgDumps) // (mkJobs cfg.jobs);
|
||||||
|
};
|
||||||
|
|
||||||
|
programs.ssh.knownHosts =
|
||||||
|
lib.extra.mapFuse
|
||||||
|
(host: { "${host}.dgnum".publicKey = builtins.head (lib.extra.getKeys "machines/${host}"); })
|
||||||
|
[
|
||||||
|
"compute01"
|
||||||
|
"geo01"
|
||||||
|
"geo02"
|
||||||
|
"storage01"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
Loading…
Reference in a new issue