diff --git a/hosts/server/configuration.nix b/hosts/server/configuration.nix index a331fc7..9593963 100644 --- a/hosts/server/configuration.nix +++ b/hosts/server/configuration.nix @@ -15,7 +15,7 @@ ] ++ (util.toImports ../../modules/nixos/features [ # keep-sorted start - "borgmatic" + "borgbackup" "intel-gpu" # keep-sorted end ]) diff --git a/modules/nixos/bundles/server.nix b/modules/nixos/bundles/server.nix index 1aa12e4..7a9f017 100644 --- a/modules/nixos/bundles/server.nix +++ b/modules/nixos/bundles/server.nix @@ -34,5 +34,8 @@ # keep-sorted end ]; - services.borgmatic.settings.source_directories = [ "/srv" ]; + services.borgbackup.jobs = { + onsite.paths = [ "/srv" ]; + offsite.paths = [ "/srv" ]; + }; } diff --git a/modules/nixos/features/borgbackup.nix b/modules/nixos/features/borgbackup.nix new file mode 100644 index 0000000..c30799a --- /dev/null +++ b/modules/nixos/features/borgbackup.nix @@ -0,0 +1,57 @@ +{ + config, + pkgs, + ... +}: +let + jobConfig = { + compression = "auto,zlib"; + doInit = false; + preHook = '' + /run/wrappers/bin/sudo -u postgres ${pkgs.postgresql}/bin/pg_dumpall > /srv/backup/database/postgres/dump.sql + ''; + postHook = '' + rm /srv/backup/database/postgres/dump.sql + ''; + prune.keep = { + daily = 7; + weekly = 4; + monthly = 6; + yearly = 1; + }; + readWritePaths = [ + "/srv/backup" + ]; + startAt = "*-*-* 03:00:00"; + extraCreateArgs = [ "-v" ]; + }; +in +{ + services.borgbackup = { + jobs = { + onsite = { + encryption = { + passCommand = "cat ${config.age.secrets.borgbackup-onsite.path}"; + mode = "repokey-blake2"; + }; + removableDevice = true; + repo = "/mnt/external/backup/take2"; + } + // jobConfig; + offsite = { + encryption = { + passCommand = "cat ${config.age.secrets.borgbackup-offsite.path}"; + mode = "repokey-blake2"; + }; + environment.BORG_RSH = "ssh -i /home/srv/.ssh/id_ed25519"; + repo = "ssh://vuc5c3xq@vuc5c3xq.repo.borgbase.com/./repo"; + } + // jobConfig; + }; + }; + + age.secrets = { + borgbackup-onsite.file = ../../../secrets/borgbackup-onsite.age; + borgbackup-offsite.file = ../../../secrets/borgbackup-offsite.age; + }; +} diff --git a/modules/nixos/features/borgmatic.nix b/modules/nixos/features/borgmatic.nix index 6628f8e..112eeda 100644 --- a/modules/nixos/features/borgmatic.nix +++ b/modules/nixos/features/borgmatic.nix @@ -42,12 +42,10 @@ { path = "/mnt/external/backup/repo"; label = "onsite"; - # encryption = "repokey-blake2"; } { path = "ssh://vuc5c3xq@vuc5c3xq.repo.borgbase.com/./repo"; label = "offsite"; - # encryption = "repokey-blake2"; } ]; retries = 3; @@ -75,8 +73,6 @@ "borgmatic-pg:${config.age.secrets.borgmatic-pg.path}" ]; - # onsite drive - # secrets age.secrets = { "borgmatic".file = ../../../secrets/borgmatic.age; diff --git a/modules/nixos/features/firefly.nix b/modules/nixos/features/firefly.nix index 92ee22d..c32df14 100644 --- a/modules/nixos/features/firefly.nix +++ b/modules/nixos/features/firefly.nix @@ -24,13 +24,6 @@ in }; }; - borgmatic.settings.sqlite_databases = [ - { - name = "firefly"; - path = "/srv/firefly/storage/database/database.sqlite"; - } - ]; - caddy.virtualHosts."firefly.fi33.buzz".extraConfig = '' root * ${config.services.firefly-iii.package}/public php_fastcgi unix//${config.services.phpfpm.pools.firefly-iii.socket} diff --git a/modules/nixos/features/immich.nix b/modules/nixos/features/immich.nix index 0908fd1..ce89f21 100644 --- a/modules/nixos/features/immich.nix +++ b/modules/nixos/features/immich.nix @@ -27,15 +27,6 @@ in } ]; - borgmatic.settings.postgresql_databases = [ - { - name = "immich"; - hostname = "localhost"; - username = "root"; - password = "{credential systemd borgmatic-pg}"; - } - ]; - caddy.virtualHosts.${hostname}.extraConfig = '' reverse_proxy localhost:${toString port} tls ${certloc}/cert.pem ${certloc}/key.pem { diff --git a/modules/nixos/features/mealie.nix b/modules/nixos/features/mealie.nix index 368ee09..324c241 100644 --- a/modules/nixos/features/mealie.nix +++ b/modules/nixos/features/mealie.nix @@ -1,5 +1,5 @@ { - config, + pkgs, ... }: let @@ -34,17 +34,14 @@ in } ]; - # borgmatic.settings = { - # source_directories = [ ]; - # postgresql_databases = [ - # { - # name = "mealie"; - # hostname = "localhost"; - # username = "root"; - # password = "{credential systemd borgmatic-pg}"; - # } - # ]; - # }; + borgbackup.jobs = { + onsite = { + paths = [ "/var/lib/mealie" ]; + }; + offsite = { + paths = [ "/var/lib/mealie" ]; + }; + }; caddy.virtualHosts.${hostname}.extraConfig = '' reverse_proxy localhost:${toString port} diff --git a/modules/nixos/features/miniflux.nix b/modules/nixos/features/miniflux.nix index fcd6526..094bdc2 100644 --- a/modules/nixos/features/miniflux.nix +++ b/modules/nixos/features/miniflux.nix @@ -34,15 +34,6 @@ in } ]; - borgmatic.settings.postgresql_databases = [ - { - name = "miniflux"; - hostname = "localhost"; - username = "root"; - password = "{credential systemd borgmatic-pg}"; - } - ]; - caddy.virtualHosts.${hostname}.extraConfig = '' reverse_proxy localhost:${toString port} tls ${certloc}/cert.pem ${certloc}/key.pem { diff --git a/modules/nixos/features/ntfy-sh.nix b/modules/nixos/features/ntfy-sh.nix index de396ff..0d101eb 100644 --- a/modules/nixos/features/ntfy-sh.nix +++ b/modules/nixos/features/ntfy-sh.nix @@ -20,11 +20,9 @@ in auth-default-access = "deny-all"; auth-users = [ "Debit3885:$2a$12$ZeFimzdifNFSmf0W2oi.vuZfsqae75md9nhC/Q2BcKMyvDO8T.uEK:admin" - "borgmatic:$2a$12$ZeFimzdifNFSmf0W2oi.vuZfsqae75md9nhC/Q2BcKMyvDO8T.uEK:user" "gatus:$2a$12$OswG3sB8oDaB.KpawKM3P.78dID.Tj/0y5qeVD5BE6EH5bpGKe.na:user" ]; auth-access = [ - "borgmatic:backups:wo" "gatus:services:wo" ]; }; @@ -44,10 +42,9 @@ in } ]; - borgmatic.settings = { - source_directories = [ - "/var/lib/ntfy-sh/user.db" - ]; + borgbackup.jobs = { + onsite.paths = [ "/var/lib/ntfy-sh" ]; + offsite.paths = [ "/var/lib/ntfy-sh" ]; }; caddy.virtualHosts.${hostname}.extraConfig = '' diff --git a/modules/nixos/features/paperless.nix b/modules/nixos/features/paperless.nix index 13cdd59..5be0efb 100644 --- a/modules/nixos/features/paperless.nix +++ b/modules/nixos/features/paperless.nix @@ -36,17 +36,6 @@ in } ]; - borgmatic.settings = { - postgresql_databases = [ - { - name = "paperless"; - hostname = "localhost"; - username = "root"; - password = "{credential systemd borgmatic-pg}"; - } - ]; - }; - caddy.virtualHosts.${hostname}.extraConfig = '' reverse_proxy localhost:${toString port} tls ${certloc}/cert.pem ${certloc}/key.pem { diff --git a/modules/nixos/features/prowlarr.nix b/modules/nixos/features/prowlarr.nix index a6126c9..050cc56 100644 --- a/modules/nixos/features/prowlarr.nix +++ b/modules/nixos/features/prowlarr.nix @@ -1,3 +1,7 @@ +{ + pkgs, + ... +}: let port = 5009; certloc = "/var/lib/acme/fi33.buzz"; @@ -28,7 +32,14 @@ in } ]; - borgmatic.settings.source_directories = [ "/var/lib/prowlarr" ]; + borgbackup.jobs = { + onsite = { + paths = [ "/var/lib/prowlarr" ]; + }; + offsite = { + paths = [ "/var/lib/prowlarr" ]; + }; + }; caddy.virtualHosts.${hostname}.extraConfig = '' reverse_proxy localhost:${toString port} diff --git a/modules/nixos/features/syncthing.nix b/modules/nixos/features/syncthing.nix index 07976f2..0f74271 100644 --- a/modules/nixos/features/syncthing.nix +++ b/modules/nixos/features/syncthing.nix @@ -73,12 +73,16 @@ in } ]; - borgmatic.settings = + borgbackup.jobs = if userName == "srv" then { - source_directories = [ + onsite.paths = [ "/home/srv/.config/syncthing" - "/home/srv/Sync" + "/home/srv/Sync/" + ]; + offsite.paths = [ + "/home/srv/.config/syncthing" + "/home/srv/Sync/" ]; } else diff --git a/modules/templates/web-feature.nix b/modules/templates/web-feature.nix index 8e8978c..29f389c 100644 --- a/modules/templates/web-feature.nix +++ b/modules/templates/web-feature.nix @@ -25,17 +25,10 @@ in } ]; - # borgmatic.settings = { - # source_directories = [ ]; - # postgresql_databases = [ - # { - # name = "feature"; - # hostname = "localhost"; - # username = "root"; - # password = "{credential systemd borgmatic-pg}"; - # } - # ]; - # }; + borgbackup.jobs = { + onsite.paths = [ "" ]; + offsite.paths = [ "" ]; + }; caddy.virtualHosts.${hostname}.extraConfig = '' reverse_proxy localhost:${toString port} diff --git a/secrets/borgbackup-offsite.age b/secrets/borgbackup-offsite.age new file mode 100644 index 0000000..e1809a9 --- /dev/null +++ b/secrets/borgbackup-offsite.age @@ -0,0 +1,9 @@ +age-encryption.org/v1 +-> ssh-ed25519 qLT+DQ NuEGxxieL0H7mUFKft+fuH1jd0XFDf3xESLrVcb9GAg +KxJcj9P/+cr63TmqEIPwfykz07luqe9VLRLzs3CWx9Y +-> ssh-ed25519 NanIwQ HRHMV4jFn7vJVHd6gFqcOTA14VI6+QaITXMpZbeGoDg +aANuHXv4O1KKwPCClatphXgWDFnsCy/AoQJT0+D560o +-> ssh-ed25519 LtK9yQ NHLTdStEdoXSGKxoz4/gR+oT9bLq8wwz4XRHS2rd9Xo +lndB74KBkWrfNuZyuQufl35lQIPNqbppLfSZRerIDaA +--- dro8ECdWcFtleQv5nffX/Wh97w/FGXQZwSIjPE9WIX8 +8R#;rpEhȾW8-. `OW']kJdC .T)N_kq_=ϰ \ No newline at end of file diff --git a/secrets/borgbackup-onsite.age b/secrets/borgbackup-onsite.age new file mode 100644 index 0000000..86c240f --- /dev/null +++ b/secrets/borgbackup-onsite.age @@ -0,0 +1,9 @@ +age-encryption.org/v1 +-> ssh-ed25519 qLT+DQ 3UW3CErZDv6UkjXJZldymqYmmJoQcbSjVX4IUX7KRn8 +pnbegKpKiNW8QY9rD7pD1mrhOSdD+cxUxcNKtLM5uOQ +-> ssh-ed25519 NanIwQ qAl2RheS1lTOU60xeodc4/WvyzYRGiWR+55QvsVE5H0 +j/UoLITpRpMF2t0J/Y0zL0kAgz5nJ02I/nwUp+pEowg +-> ssh-ed25519 LtK9yQ sbldK/F2u6MMgIR8F6c5ZFkMesq+GHKRmlqt3n6L2yw +GTSzhGfj+Shg+MQ3hde12pKi6zfeGNw6RXwSAoGyaak +--- 6WmdTjpwgwb6/1o06i5xtvnOQcvNztwpBmvH/9wYbmo +K^ѭUb|:m@*ޱg1>)qs,n{ DdvɜEuH ssh-ed25519 qLT+DQ C3A3TKOyIWzbW8JupvhTmLKetnr+0uzkPq985NA0DCs -ahrHVR7WadjOfOXBWOqBAf9L0UdCNeD0Ynk6sKDF7WM --> ssh-ed25519 7+xRyQ evZ6zSS3olbORnqiCnEAL68D1FNPgg2oBoJSaquLAAA -BYoo9AVOHsRsTbXkRQdS/7WN25vBuJOAb0YfnSY+hGQ --> ssh-ed25519 LtK9yQ jLIdKPvVhPsRIJevWLmads3P2hM29c0B143OWoINzlY -ziCUQ1TtB6BUgbNZ/zFXoaOtpxyrbKobsTvXo/dSpSA ---- Q6JHS+5vuYLIqyIb6x3qCbIJvsjk2++ovL1zkVGs69o -쇽NM1WByM.-|Gl]8Z,(5豲P!pmpEa;(tq!KU4m \ No newline at end of file diff --git a/secrets/borgmatic.age b/secrets/borgmatic.age deleted file mode 100644 index fca1c53..0000000 --- a/secrets/borgmatic.age +++ /dev/null @@ -1,9 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 qLT+DQ zfLZc8A30KjoMrhUSl4OgTp+Yg11fmVjDioxtIYMqDU -URhJwUCElaJcSd+k5wBQAXvdC/68ZcCA5WbHGAJTYfY --> ssh-ed25519 7+xRyQ mrGrjW0fQIRNMDdw4Hoc9N/xAEm1P0IFukShfeVdKE8 -yLUmj7LBfHQ/i4buBB57ktNUOnHpoC8NYTQUnK5e5y4 --> ssh-ed25519 LtK9yQ THjOsSIr/DQTulFlwd4r5DYb73VQ0vWgyDHkfJV3NR0 -Dl8FwK1WciiEMs5MdrFcUIOFGmlbZf3APOWzLN6rkOE ---- 3mjYPT9APy0F5NNbbCIQhzZ0XjKBtB9YGGS3t37eoRU -T^vU{>[dhPC6Z|K|~lݝbDt΄]1P$10 A$ \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index ac60688..2bd9a15 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -15,9 +15,8 @@ let in { # keep-sorted start - "borgmatic-ntfy.age".publicKeys = users; - "borgmatic-pg.age".publicKeys = users; - "borgmatic.age".publicKeys = users; + "borgbackup-offsite.age".publicKeys = users; + "borgbackup-onsite.age".publicKeys = users; "copyparty.age".publicKeys = users; "gatus.age".publicKeys = users; "git_signing_key.age".publicKeys = users;