diff --git a/.gitattributes b/.gitattributes index 87c7f63..1033513 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1,3 +1,4 @@ #pattern filter=crypt diff=crypt merge=crypt features/server/services/forgejo-smtp.nix filter=crypt diff=crypt features/server/services/nextcloud-network.nix filter=crypt diff=crypt +features/server/backups-repos.nix filter=crypt diff=crypt diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..fced25e --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +secrets/backup.yaml diff --git a/features/server/backups-repos.nix b/features/server/backups-repos.nix new file mode 100644 index 0000000..282cf6f --- /dev/null +++ b/features/server/backups-repos.nix @@ -0,0 +1,5 @@ +U2FsdGVkX1+pKUtcxhT27nl6afKy5paC7y9iBtZgbq2rnuJebgGFCD0AxE1TOWMV +RaWwqeK7YaU7MnImh+b7JfR3C7b6OgQz3+V+gGhC8f10e23maH/me3m3SNsxLp4w +BS4SQZzrWc5WHS+QHTCH7tfUyFPYBs8xnfMAN+TGqB/ud0l7ZZ7MRvpU2IHpzoi1 +8ek6OT+w/oyXU3o5eVklEuXpTEB2dcGJ41hbXCEDn7ELyfpaF/+Tx5yGGIJ73FvS ++P2s1wpjWnrHPj78aphmdm8Q/PZ81vDU4/e2nyg4OcHyOPXVVnwhRUWl1Y9/a/sK diff --git a/features/server/backups.nix b/features/server/backups.nix index 1fe6221..888e4cc 100644 --- a/features/server/backups.nix +++ b/features/server/backups.nix @@ -1,35 +1,46 @@ { config, ... }: { + imports = [ + + ]; sops.secrets.borgRepoPassword = { }; + sops.secrets.borgRemoteServerPassword = { + sopsFile = ../../secrets/backup.yaml; + }; services.borgbackup.jobs = { - localBackup = { - paths = "/"; - exclude = [ - "/nix" - "/srv/Multimedia" - "/srv/media" - "/srv/backups/serverBackups" - "/srv/backups/localComputerBackups" - "/var/cache" - "/tmp" - "/proc" - "/sys" - ]; - repo = "/srv/backups/serverBackups"; - doInit = true; - encryption = { - mode = "repokey"; - passCommand = "cat /run/secrets/borgRepoPassword"; - }; - compression = "auto,lzma"; - startAt = "weekly"; - }; - /* - serverBackup = { + localBackup = { + paths = "/"; + exclude = [ + "/nix" + "/srv/Multimedia" + "/srv/media" + "/srv/backups/serverBackups" + "/srv/backups/localComputerBackups" + "/var/cache" + "/var/run" + "/tmp" + "/proc" + "/sys" + "/dev" + "/mnt" + "/run" + ]; + repo = "/srv/backups/serverBackups"; + doInit = true; + encryption = { + mode = "repokey"; + passCommand = "cat /run/secrets/borgRepoPassword"; + }; + compression = "auto,lzma"; + startAt = "weekly"; + }; - }; + /* + serverBackup = { + + }; */ }; @@ -41,4 +52,37 @@ path = "/srv/backups/localComputerBackups"; }; }; + + services.borgmatic = { + enable = true; + configurations = { + remoteServer = { + source_directories = [ + "/var" + "/etc" + "/home" + "/srv/freshrss" + "/srv/Minecraft" + ]; + postgres_databases = [ + "forgejo" + "nextcloud" + "matrix-synapse" + ]; + exclude_patterns = [ "/home/*/.cache" ]; + encryption_passcommand = "cat /run/secrets/borgRemoteServerPassword"; + }; + }; + }; + + systemd.timers.borgmatic = { + enable = true; + unit = "borgmatic.service"; + wantedBy = [ "timers.target" ]; + timerConfig = { + OnCalendar = "*-*-* 03:00:00"; + Persistent = true; + WakeSystem = true; + }; + }; }