AtaraxiaDev/nixos-config
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

enable restic rest server on hypervisor

Browse Source
This commit is contained in:
Dmitriy Kholkin 2023-06-27 23:08:20 +03:00
parent 58703b9dc8
commit 683b7fb52f
3 changed files with 36 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
machines/Home-Hypervisor/default.nix
View File

@ -39,6 +39,7 @@ in {
nixosProfiles.matrix
nixosProfiles.atticd
nixosProfiles.attic
nixosProfiles.restic-server
(import nixosProfiles.blocky {
inherit config;

1
machines/Home-Hypervisor/dns-mapping.nix
View File

@ -49,6 +49,7 @@
"prowlarr.ataraxiadev.com" = "ataraxiadev.com";
"qbit.ataraxiadev.com" = "ataraxiadev.com";
"radarr.ataraxiadev.com" = "ataraxiadev.com";
"restic.ataraxiadev.com" = "ataraxiadev.com";
"shoko.ataraxiadev.com" = "ataraxiadev.com";
"sonarr.ataraxiadev.com" = "ataraxiadev.com";
"sonarrtv.ataraxiadev.com" = "ataraxiadev.com";

34
profiles/servers/restic-server.nix Normal file
View File

@ -0,0 +1,34 @@
{ config, pkgs, lib, ... }:
let
resticPort = 8010;
fqdn = "restic.ataraxiadev.com";
certFile = "${config.security.acme.certs.${fqdn}.directory}/fullchain.pem";
keyFile = "${config.security.acme.certs.${fqdn}.directory}/key.pem";
in {
secrets.restic-htpasswd = {
services = [ "restic-rest-server.service" ];
owner = "restic:restic";
};
security.acme.certs.${fqdn} = {
webroot = "/var/lib/acme/acme-challenge";
postRun = "systemctl reload restic-rest-server";
group = "restic";
};
networking.firewall.allowedTCPPorts = [ resticPort ];
networking.firewall.allowPing = true;
services.restic.server = {
enable = true;
dataDir = "/media/nas/backups/restic";
listenAddress = ":${toString resticPort}";
# appendOnly = true;
privateRepos = true;
prometheus = true;
extraFlags = [
"--prometheus-no-auth"
"--htpasswd-file=${config.secrets.restic-htpasswd.decrypted}"
"--tls" "--tls-cert=${certFile}" "--tls-key=${keyFile}"
];
};
}