wip rustic backup
This commit is contained in:
parent
d0a245b06b
commit
7aeaf79b1a
39
machines/Home-Hypervisor/backups.nix
Normal file
39
machines/Home-Hypervisor/backups.nix
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
{ config, ... }:
|
||||||
|
let
|
||||||
|
secret-conf = { services = [ "rustic-backups-nas.service" ]; };
|
||||||
|
in {
|
||||||
|
secrets.rustic-gdrive-pass = secret-conf;
|
||||||
|
secrets.rclone-gdrive = secret-conf;
|
||||||
|
services.rustic.backups.nas = {
|
||||||
|
initialize = true;
|
||||||
|
passwordFile = config.secrets.rustic-gdrive-pass.decrypted;
|
||||||
|
repository = "rclone:gdrive:rustic-backup/nas";
|
||||||
|
rcloneConfigFile = config.secrets.rclone-gdrive.decrypted;
|
||||||
|
extraBackupArgs = [ "--ignore-devid" ];
|
||||||
|
paths = [
|
||||||
|
"/media/nas/containers"
|
||||||
|
"/media/nas/media-stack/configs"
|
||||||
|
"/srv"
|
||||||
|
];
|
||||||
|
exclude = [
|
||||||
|
"/media/nas/**/cache"
|
||||||
|
"/media/nas/**/.cache"
|
||||||
|
"/media/nas/**/log"
|
||||||
|
"/media/nas/**/logs"
|
||||||
|
"/media/nas/media-stack/configs/lidarr/config/MediaCover"
|
||||||
|
"/media/nas/media-stack/configs/qbittorrent/downloads"
|
||||||
|
"/media/nas/media-stack/configs/recyclarr/repositories"
|
||||||
|
"/srv/gitea"
|
||||||
|
];
|
||||||
|
timerConfig = {
|
||||||
|
OnCalendar = "daily";
|
||||||
|
Persistent = true;
|
||||||
|
};
|
||||||
|
pruneOpts = [
|
||||||
|
"--keep-daily 7"
|
||||||
|
"--keep-weekly 5"
|
||||||
|
"--keep-monthly 2"
|
||||||
|
"--keep-yearly 0"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
||||||
@ -6,6 +6,7 @@ in {
|
|||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
./virtualisation.nix
|
./virtualisation.nix
|
||||||
./disks.nix
|
./disks.nix
|
||||||
|
# ./backups.nix
|
||||||
customProfiles.hardened
|
customProfiles.hardened
|
||||||
|
|
||||||
customRoles.hypervisor
|
customRoles.hypervisor
|
||||||
@ -188,7 +189,10 @@ in {
|
|||||||
p7zip
|
p7zip
|
||||||
podman-compose
|
podman-compose
|
||||||
pwgen
|
pwgen
|
||||||
|
rclone
|
||||||
repgrep
|
repgrep
|
||||||
|
restic
|
||||||
|
rustic-rs
|
||||||
smartmontools
|
smartmontools
|
||||||
];
|
];
|
||||||
xdg.mime.enable = false;
|
xdg.mime.enable = false;
|
||||||
|
|||||||
389
modules/rustic.nix
Normal file
389
modules/rustic.nix
Normal file
@ -0,0 +1,389 @@
|
|||||||
|
{ config, lib, pkgs, utils, ... }:
|
||||||
|
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
let
|
||||||
|
# Type for a valid systemd unit option. Needed for correctly passing "timerConfig" to "systemd.timers"
|
||||||
|
inherit (utils.systemdUtils.unitOptions) unitOption;
|
||||||
|
in
|
||||||
|
{
|
||||||
|
options.services.rustic.backups = mkOption {
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Periodic backups to create with Rustic.
|
||||||
|
'';
|
||||||
|
type = types.attrsOf (types.submodule ({ config, name, ... }: {
|
||||||
|
options = {
|
||||||
|
passwordFile = mkOption {
|
||||||
|
type = types.str;
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Read the repository password from a file.
|
||||||
|
'';
|
||||||
|
example = "/etc/nixos/rustic-password";
|
||||||
|
};
|
||||||
|
|
||||||
|
environmentFile = mkOption {
|
||||||
|
type = with types; nullOr str;
|
||||||
|
default = null;
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
file containing the credentials to access the repository, in the
|
||||||
|
format of an EnvironmentFile as described by systemd.exec(5)
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
rcloneOptions = mkOption {
|
||||||
|
type = with types; nullOr (attrsOf (oneOf [ str bool ]));
|
||||||
|
default = null;
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Options to pass to rclone to control its behavior.
|
||||||
|
See <https://rclone.org/docs/#options> for
|
||||||
|
available options. When specifying option names, strip the
|
||||||
|
leading `--`. To set a flag such as
|
||||||
|
`--drive-use-trash`, which does not take a value,
|
||||||
|
set the value to the Boolean `true`.
|
||||||
|
'';
|
||||||
|
example = {
|
||||||
|
bwlimit = "10M";
|
||||||
|
drive-use-trash = "true";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
rcloneConfig = mkOption {
|
||||||
|
type = with types; nullOr (attrsOf (oneOf [ str bool ]));
|
||||||
|
default = null;
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Configuration for the rclone remote being used for backup.
|
||||||
|
See the remote's specific options under rclone's docs at
|
||||||
|
<https://rclone.org/docs/>. When specifying
|
||||||
|
option names, use the "config" name specified in the docs.
|
||||||
|
For example, to set `--b2-hard-delete` for a B2
|
||||||
|
remote, use `hard_delete = true` in the
|
||||||
|
attribute set.
|
||||||
|
Warning: Secrets set in here will be world-readable in the Nix
|
||||||
|
store! Consider using the `rcloneConfigFile`
|
||||||
|
option instead to specify secret values separately. Note that
|
||||||
|
options set here will override those set in the config file.
|
||||||
|
'';
|
||||||
|
example = {
|
||||||
|
type = "b2";
|
||||||
|
account = "xxx";
|
||||||
|
key = "xxx";
|
||||||
|
hard_delete = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
rcloneConfigFile = mkOption {
|
||||||
|
type = with types; nullOr path;
|
||||||
|
default = null;
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Path to the file containing rclone configuration. This file
|
||||||
|
must contain configuration for the remote specified in this backup
|
||||||
|
set and also must be readable by root. Options set in
|
||||||
|
`rcloneConfig` will override those set in this
|
||||||
|
file.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
repository = mkOption {
|
||||||
|
type = with types; nullOr str;
|
||||||
|
default = null;
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
repository to backup to.
|
||||||
|
'';
|
||||||
|
example = "sftp:backup@192.168.1.100:/backups/${name}";
|
||||||
|
};
|
||||||
|
|
||||||
|
repositoryFile = mkOption {
|
||||||
|
type = with types; nullOr path;
|
||||||
|
default = null;
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Path to the file containing the repository location to backup to.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
paths = mkOption {
|
||||||
|
# This is nullable for legacy reasons only. We should consider making it a pure listOf
|
||||||
|
# after some time has passed since this comment was added.
|
||||||
|
type = types.nullOr (types.listOf types.str);
|
||||||
|
default = [ ];
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Which paths to backup. If null or an empty array,
|
||||||
|
no backup command will be run.
|
||||||
|
This can be used to create a prune-only job.
|
||||||
|
'';
|
||||||
|
example = [
|
||||||
|
"/var/lib/postgresql"
|
||||||
|
"/home/user/backup"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
exclude = mkOption {
|
||||||
|
type = types.listOf types.str;
|
||||||
|
default = [ ];
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Patterns to exclude when backing up. See
|
||||||
|
https://rustic.readthedocs.io/en/latest/040_backup.html#excluding-files for
|
||||||
|
details on syntax.
|
||||||
|
'';
|
||||||
|
example = [
|
||||||
|
"/var/cache"
|
||||||
|
"/home/*/.cache"
|
||||||
|
".git"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
timerConfig = mkOption {
|
||||||
|
type = types.attrsOf unitOption;
|
||||||
|
default = {
|
||||||
|
OnCalendar = "daily";
|
||||||
|
Persistent = true;
|
||||||
|
};
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
When to run the backup. See {manpage}`systemd.timer(5)` for details.
|
||||||
|
'';
|
||||||
|
example = {
|
||||||
|
OnCalendar = "00:05";
|
||||||
|
RandomizedDelaySec = "5h";
|
||||||
|
Persistent = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
user = mkOption {
|
||||||
|
type = types.str;
|
||||||
|
default = "root";
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
As which user the backup should run.
|
||||||
|
'';
|
||||||
|
example = "postgresql";
|
||||||
|
};
|
||||||
|
|
||||||
|
extraBackupArgs = mkOption {
|
||||||
|
type = types.listOf types.str;
|
||||||
|
default = [ ];
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Extra arguments passed to rustic backup.
|
||||||
|
'';
|
||||||
|
example = [
|
||||||
|
"--exclude-file=/etc/nixos/rustic-ignore"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
extraOptions = mkOption {
|
||||||
|
type = types.listOf types.str;
|
||||||
|
default = [ ];
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Extra extended options to be passed to the rustic --option flag.
|
||||||
|
'';
|
||||||
|
example = [
|
||||||
|
"sftp.command='ssh backup@192.168.1.100 -i /home/user/.ssh/id_rsa -s sftp'"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
initialize = mkOption {
|
||||||
|
type = types.bool;
|
||||||
|
default = false;
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Create the repository if it doesn't exist.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
initializeOpts = mkOption {
|
||||||
|
type = types.listOf types.str;
|
||||||
|
default = [ ];
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
A list of options for 'rustic init'.
|
||||||
|
'';
|
||||||
|
example = [
|
||||||
|
"--set-version 2"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
pruneOpts = mkOption {
|
||||||
|
type = types.listOf types.str;
|
||||||
|
default = [ ];
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
A list of options (--keep-\* et al.) for 'rustic forget
|
||||||
|
--prune', to automatically prune old snapshots. The
|
||||||
|
'forget' command is run *after* the 'backup' command, so
|
||||||
|
keep that in mind when constructing the --keep-\* options.
|
||||||
|
'';
|
||||||
|
example = [
|
||||||
|
"--keep-daily 7"
|
||||||
|
"--keep-weekly 5"
|
||||||
|
"--keep-monthly 12"
|
||||||
|
"--keep-yearly 75"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
checkOpts = mkOption {
|
||||||
|
type = types.listOf types.str;
|
||||||
|
default = [ ];
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
A list of options for 'rustic check', which is run after
|
||||||
|
pruning.
|
||||||
|
'';
|
||||||
|
example = [
|
||||||
|
"--with-cache"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
backupPrepareCommand = mkOption {
|
||||||
|
type = with types; nullOr str;
|
||||||
|
default = null;
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
A script that must run before starting the backup process.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
backupCleanupCommand = mkOption {
|
||||||
|
type = with types; nullOr str;
|
||||||
|
default = null;
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
A script that must run after finishing the backup process.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
package = mkOption {
|
||||||
|
type = types.package;
|
||||||
|
default = pkgs.rustic-rs;
|
||||||
|
defaultText = literalExpression "pkgs.rustic-rs";
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Rustic package to use.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
createWrapper = lib.mkOption {
|
||||||
|
type = lib.types.bool;
|
||||||
|
default = true;
|
||||||
|
description = ''
|
||||||
|
Whether to generate and add a script to the system path, that has the same environment variables set
|
||||||
|
as the systemd service. This can be used to e.g. mount snapshots or perform other opterations, without
|
||||||
|
having to manually specify most options.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}));
|
||||||
|
default = { };
|
||||||
|
example = {
|
||||||
|
localbackup = {
|
||||||
|
paths = [ "/home" ];
|
||||||
|
exclude = [ "/home/*/.cache" ];
|
||||||
|
repository = "/mnt/backup-hdd";
|
||||||
|
passwordFile = "/etc/nixos/secrets/rustic-password";
|
||||||
|
initialize = true;
|
||||||
|
};
|
||||||
|
remotebackup = {
|
||||||
|
paths = [ "/home" ];
|
||||||
|
repository = "sftp:backup@host:/backups/home";
|
||||||
|
passwordFile = "/etc/nixos/secrets/rustic-password";
|
||||||
|
extraOptions = [
|
||||||
|
"sftp.command='ssh backup@host -i /etc/nixos/secrets/backup-private-key -s sftp'"
|
||||||
|
];
|
||||||
|
timerConfig = {
|
||||||
|
OnCalendar = "00:05";
|
||||||
|
RandomizedDelaySec = "5h";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = {
|
||||||
|
# assertions = mapAttrsToList (n: v: {
|
||||||
|
# assertion = (v.repository == null) != (v.repositoryFile == null);
|
||||||
|
# message = "services.rustic.backups.${n}: exactly one of repository or repositoryFile should be set";
|
||||||
|
# }) config.services.rustic.backups;
|
||||||
|
systemd.services =
|
||||||
|
mapAttrs'
|
||||||
|
(name: backup:
|
||||||
|
let
|
||||||
|
extraOptions = concatMapStrings (arg: " -o ${arg}") backup.extraOptions;
|
||||||
|
rusticCmd = "${backup.package}/bin/rustic${extraOptions}";
|
||||||
|
excludeFlags = concatMapStrings (arg: " --glob '!${arg}'") backup.exclude;
|
||||||
|
doBackup = backup.paths != null && backup.paths != [];
|
||||||
|
pruneCmd = optionals (builtins.length backup.pruneOpts > 0) [
|
||||||
|
(rusticCmd + " forget --prune " + (concatStringsSep " " backup.pruneOpts))
|
||||||
|
(rusticCmd + " check " + (concatStringsSep " " backup.checkOpts))
|
||||||
|
];
|
||||||
|
# Helper functions for rclone remotes
|
||||||
|
rcloneRemoteName = builtins.elemAt (splitString ":" backup.repository) 1;
|
||||||
|
rcloneAttrToOpt = v: "RCLONE_" + toUpper (builtins.replaceStrings [ "-" ] [ "_" ] v);
|
||||||
|
rcloneAttrToConf = v: "RCLONE_CONFIG_" + toUpper (rcloneRemoteName + "_" + v);
|
||||||
|
toRcloneVal = v: if lib.isBool v then lib.boolToString v else v;
|
||||||
|
in
|
||||||
|
nameValuePair "rustic-backups-${name}" ({
|
||||||
|
environment = {
|
||||||
|
# not %C, because that wouldn't work in the wrapper script
|
||||||
|
RUSTIC_CACHE_DIR = "/var/cache/rustic-backups-${name}";
|
||||||
|
RUSTIC_PASSWORD_FILE = backup.passwordFile;
|
||||||
|
RUSTIC_REPOSITORY = backup.repository;
|
||||||
|
RUSTIC_REPOSITORY_FILE = backup.repositoryFile;
|
||||||
|
} // optionalAttrs (backup.rcloneOptions != null) (mapAttrs'
|
||||||
|
(name: value:
|
||||||
|
nameValuePair (rcloneAttrToOpt name) (toRcloneVal value)
|
||||||
|
)
|
||||||
|
backup.rcloneOptions) // optionalAttrs (backup.rcloneConfigFile != null) {
|
||||||
|
RCLONE_CONFIG = backup.rcloneConfigFile;
|
||||||
|
} // optionalAttrs (backup.rcloneConfig != null) (mapAttrs'
|
||||||
|
(name: value:
|
||||||
|
nameValuePair (rcloneAttrToConf name) (toRcloneVal value)
|
||||||
|
)
|
||||||
|
backup.rcloneConfig);
|
||||||
|
path = [ config.programs.ssh.package pkgs.rclone ];
|
||||||
|
restartIfChanged = false;
|
||||||
|
wants = [ "network-online.target" ];
|
||||||
|
after = [ "network-online.target" ];
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
ExecStart = (optionals doBackup [ "${rusticCmd} backup ${concatStringsSep " " backup.extraBackupArgs} ${excludeFlags} ${escapeShellArgs backup.paths}" ])
|
||||||
|
++ pruneCmd;
|
||||||
|
User = backup.user;
|
||||||
|
RuntimeDirectory = "rustic-backups-${name}";
|
||||||
|
CacheDirectory = "rustic-backups-${name}";
|
||||||
|
CacheDirectoryMode = "0700";
|
||||||
|
PrivateTmp = true;
|
||||||
|
} // optionalAttrs (backup.environmentFile != null) {
|
||||||
|
EnvironmentFile = backup.environmentFile;
|
||||||
|
};
|
||||||
|
} // optionalAttrs (backup.initialize || backup.backupPrepareCommand != null) {
|
||||||
|
preStart = ''
|
||||||
|
${optionalString (backup.backupPrepareCommand != null) ''
|
||||||
|
${pkgs.writeScript "backupPrepareCommand" backup.backupPrepareCommand}
|
||||||
|
''}
|
||||||
|
${optionalString (backup.initialize) ''
|
||||||
|
${rusticCmd} snapshots || ${rusticCmd} init ${concatStringsSep " " backup.initializeOpts}
|
||||||
|
''}
|
||||||
|
'';
|
||||||
|
} // optionalAttrs (backup.backupCleanupCommand != null) {
|
||||||
|
postStop = ''
|
||||||
|
${optionalString (backup.backupCleanupCommand != null) ''
|
||||||
|
${pkgs.writeScript "backupCleanupCommand" backup.backupCleanupCommand}
|
||||||
|
''}
|
||||||
|
'';
|
||||||
|
})
|
||||||
|
)
|
||||||
|
config.services.rustic.backups;
|
||||||
|
systemd.timers =
|
||||||
|
mapAttrs'
|
||||||
|
(name: backup: nameValuePair "rustic-backups-${name}" {
|
||||||
|
wantedBy = [ "timers.target" ];
|
||||||
|
timerConfig = backup.timerConfig;
|
||||||
|
})
|
||||||
|
config.services.rustic.backups;
|
||||||
|
|
||||||
|
# generate wrapper scripts, as described in the createWrapper option
|
||||||
|
environment.systemPackages = lib.mapAttrsToList (name: backup: let
|
||||||
|
extraOptions = lib.concatMapStrings (arg: " -o ${arg}") backup.extraOptions;
|
||||||
|
rusticCmd = "${backup.package}/bin/rustic${extraOptions}";
|
||||||
|
in pkgs.writeShellScriptBin "rustic-${name}" ''
|
||||||
|
set -a # automatically export variables
|
||||||
|
${lib.optionalString (backup.environmentFile != null) "source ${backup.environmentFile}"}
|
||||||
|
# set same environment variables as the systemd service
|
||||||
|
${lib.pipe config.systemd.services."rustic-backups-${name}".environment [
|
||||||
|
(lib.filterAttrs (_: v: v != null))
|
||||||
|
(lib.mapAttrsToList (n: v: "${n}=${v}"))
|
||||||
|
(lib.concatStringsSep "\n")
|
||||||
|
]}
|
||||||
|
|
||||||
|
exec ${rusticCmd} $@
|
||||||
|
'') (lib.filterAttrs (_: v: v.createWrapper) config.services.rustic.backups);
|
||||||
|
};
|
||||||
|
}
|
||||||
Loading…
x
Reference in New Issue
Block a user