mdebray/tvl-depot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor(ops/restic): Move restic configuration into a new module

Browse source 
Relates to b/147.

First step towards giving depot modules the ability to declare their
own backup directories by moving all restic configuration into a new
module and adding a NixOS option for inclusion/exclusion paths for
backups.

This still keeps all backup paths within the whitby config.

Change-Id: Ia96833668f1a3d02da892261153d8b02156b8ac0
Reviewed-on: https://cl.tvl.fyi/c/depot/+/3565
Tested-by: BuildkiteCI
Reviewed-by: flokli <flokli@flokli.de>
This commit is contained in:
Vincent Ambo 2021-09-16 21:47:25 +03:00 committed by tazjin
parent ec38839c33
commit 387c55582b
2 changed files with 75 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

40
ops/machines/whitby/default.nix
View file

@ -16,6 +16,7 @@ in {
"${depot.path}/ops/modules/owothia.nix"
"${depot.path}/ops/modules/panettone.nix"
"${depot.path}/ops/modules/paroxysm.nix"
"${depot.path}/ops/modules/restic.nix"
"${depot.path}/ops/modules/smtprelay.nix"
"${depot.path}/ops/modules/sourcegraph.nix"
"${depot.path}/ops/modules/tvl-buildkite.nix"
@ -324,6 +325,23 @@ in {
# Run cgit & josh to serve git
git-serving.enable = true;
# Configure backups to Google Cloud Storage
restic = {
enable = true;
paths = [
"/var/backup/postgresql"
"/var/html/deploys.tvl.fyi"
"/var/lib/gerrit"
"/var/lib/grafana"
"/var/lib/josh"
"/var/lib/znc"
];
exclude = [
"/var/lib/gerrit/tmp"
];
};
};
services.postgresql = {
@ -386,28 +404,6 @@ in {
zfstools
];
# Regularly back up whitby to Google Cloud Storage.
systemd.services.restic = {
description = "Backups to Google Cloud Storage";
script = "${pkgs.restic}/bin/restic backup /var/lib/gerrit /var/backup/postgresql /var/lib/grafana /var/lib/znc /var/html/deploys.tvl.fyi /var/lib/josh";
environment = {
GOOGLE_PROJECT_ID = "tazjins-infrastructure";
GOOGLE_APPLICATION_CREDENTIALS = "/var/backup/restic/gcp-key.json";
RESTIC_REPOSITORY = "gs:tvl-fyi-backups:/whitby";
RESTIC_PASSWORD_FILE = "/var/backup/restic/secret";
RESTIC_CACHE_DIR = "/var/backup/restic/cache";
RESTIC_EXCLUDE_FILE = builtins.toFile "exclude-files" ''
/var/lib/gerrit/tmp
'';
};
};
systemd.timers.restic = {
wantedBy = [ "multi-user.target" ];
timerConfig.OnCalendar = "hourly";
};
services.journaldriver = {
enable = true;
googleCloudProject = "tvl-fyi";

57
ops/modules/restic.nix Normal file
View file

@ -0,0 +1,57 @@
# Configure restic backups to Google Cloud Storage.
#
# Conventions: Restic state is kept in /var/backup/restic, with
# secrets in /var/backup/restic/secret.
{ config, lib, pkgs, ... }:
let
cfg = config.services.depot.restic;
description = "Restic backups to GCS";
mkStringOption = default: lib.mkOption {
inherit default;
type = lib.types.string;
};
in {
options.services.depot.restic = {
enable = lib.mkEnableOption description;
project = mkStringOption "tazjins-infrastructure";
credentialPath = mkStringOption "/var/backup/restic/gcp-key.json";
repository = mkStringOption "gs:tvl-fyi-backups:/whitby";
interval = mkStringOption "hourly";
paths = with lib; mkOption {
description = "Directories that should be backed up";
type = types.listOf types.string;
};
exclude = with lib; mkOption {
description = "Files that should be excluded from backups";
type = types.listOf types.string;
};
};
config = lib.mkIf cfg.enable {
# Regularly back up whitby to Google Cloud Storage.
systemd.services.restic = {
description = "Backups to Google Cloud Storage";
script = "${pkgs.restic}/bin/restic backup ${lib.concatStringsSep " " cfg.paths}";
environment = {
GOOGLE_PROJECT_ID = cfg.project;
GOOGLE_APPLICATION_CREDENTIALS = cfg.credentialPath;
RESTIC_REPOSITORY = cfg.repository;
RESTIC_PASSWORD_FILE = "/var/backup/restic/secret";
RESTIC_CACHE_DIR = "/var/backup/restic/cache";
RESTIC_EXCLUDE_FILE =
builtins.toFile "exclude-files" (lib.concatStringsSep "\n" cfg.exclude);
};
};
systemd.timers.restic = {
wantedBy = [ "multi-user.target" ];
timerConfig.OnCalendar = cfg.interval;
};
};
}