mdebray/tvl-depot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(ops/restic): Move whitby's backup to GleSYS object storage

Browse source 
Since GCP nuked us, the backups are now moving to GleSYS'
S3-compatible object storage.

This refactors the restic module to support S3-compatible storage
instead of GCP, and switches to the appropriate new secret paths.

The secrets were placed on whitby manually and I verified that the
backups work.

This fixes b/157

Change-Id: I6a9d2b0581967605ce736605a3befb44cdeae7e1
Reviewed-on: https://cl.tvl.fyi/c/depot/+/3883
Tested-by: BuildkiteCI
Reviewed-by: grfn <grfn@gws.fyi>
This commit is contained in:
Vincent Ambo 2021-11-20 19:32:11 +03:00 committed by tazjin
parent 21c218542c
commit 15cb37f877
2 changed files with 17 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
ops/machines/whitby/default.nix
View file

@ -328,7 +328,7 @@ in {
# Run cgit & josh to serve git # Run cgit & josh to serve git
git-serving.enable = true; git-serving.enable = true;
# Configure backups to Google Cloud Storage # Configure backups to GleSYS
restic = { restic = {
enable = true; enable = true;
paths = [ paths = [

28
ops/modules/restic.nix
View file

@ -1,12 +1,15 @@
# Configure restic backups to Google Cloud Storage. # Configure restic backups to S3-compatible storage, in our case
# GleSYS object storage.
# #
# Conventions: Restic state is kept in /var/backup/restic, with # Conventions:
# secrets in /var/backup/restic/secret. # - restic's cache lives in /var/backup/restic/cache
# - repository password lives in /var/backup/restic/secret
# - object storage credentials in /var/backup/restic/glesys-key
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
let let
cfg = config.services.depot.restic; cfg = config.services.depot.restic;
description = "Restic backups to GCS"; description = "Restic backups to GleSYS";
mkStringOption = default: lib.mkOption { mkStringOption = default: lib.mkOption {
inherit default; inherit default;
type = lib.types.str; type = lib.types.str;
@ -14,9 +17,10 @@ let
in { in {
options.services.depot.restic = { options.services.depot.restic = {
enable = lib.mkEnableOption description; enable = lib.mkEnableOption description;
project = mkStringOption "tazjins-infrastructure"; bucketEndpoint = mkStringOption "objects.dc-sto1.glesys.net";
credentialPath = mkStringOption "/var/backup/restic/gcp-key.json"; bucketName = mkStringOption "aged-resonance";
repository = mkStringOption "gs:tvl-fyi-backups:/whitby"; bucketCredentials = mkStringOption "/var/backup/restic/glesys-key";
repository = mkStringOption config.networking.hostName;
interval = mkStringOption "hourly"; interval = mkStringOption "hourly";
paths = with lib; mkOption { paths = with lib; mkOption {
@ -31,16 +35,14 @@ in {
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# Regularly back up whitby to Google Cloud Storage.
systemd.services.restic = { systemd.services.restic = {
description = "Backups to Google Cloud Storage"; description = "Backups to GleSYS";
script = "${pkgs.restic}/bin/restic backup ${lib.concatStringsSep " " cfg.paths}"; script = "${pkgs.restic}/bin/restic backup ${lib.concatStringsSep " " cfg.paths}";
environment = { environment = {
GOOGLE_PROJECT_ID = cfg.project; RESTIC_REPOSITORY = "s3:${cfg.bucketEndpoint}/${cfg.bucketName}/${cfg.repository}";
GOOGLE_APPLICATION_CREDENTIALS = cfg.credentialPath; AWS_SHARED_CREDENTIALS_FILE = cfg.bucketCredentials;
RESTIC_REPOSITORY = cfg.repository;
RESTIC_PASSWORD_FILE = "/var/backup/restic/secret"; RESTIC_PASSWORD_FILE = "/var/backup/restic/secret";
RESTIC_CACHE_DIR = "/var/backup/restic/cache"; RESTIC_CACHE_DIR = "/var/backup/restic/cache";
@ -53,5 +55,7 @@ in {
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
timerConfig.OnCalendar = cfg.interval; timerConfig.OnCalendar = cfg.interval;
}; };
environment.systemPackages = [ pkgs.restic ];
}; };
} }