feat(borgbackup): replace borgmatic

hosts/server/configuration.nix

@@ -15,7 +15,7 @@
   ]
   ++ (util.toImports ../../modules/nixos/features [
     # keep-sorted start
-    "borgmatic"
+    "borgbackup"
     "intel-gpu"
     # keep-sorted end
   ])

modules/nixos/bundles/server.nix

@@ -34,5 +34,8 @@
     # keep-sorted end
   ];
 
-  services.borgmatic.settings.source_directories = [ "/srv" ];
+  services.borgbackup.jobs = {
+    onsite.paths = [ "/srv" ];
+    offsite.paths = [ "/srv" ];
+  };
 }

modules/nixos/features/borgbackup.nix

@@ -0,0 +1,57 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+let
+  jobConfig = {
+    compression = "auto,zlib";
+    doInit = false;
+    preHook = ''
+      /run/wrappers/bin/sudo -u postgres ${pkgs.postgresql}/bin/pg_dumpall > /srv/backup/database/postgres/dump.sql
+    '';
+    postHook = ''
+      rm /srv/backup/database/postgres/dump.sql
+    '';
+    prune.keep = {
+      daily = 7;
+      weekly = 4;
+      monthly = 6;
+      yearly = 1;
+    };
+    readWritePaths = [
+      "/srv/backup"
+    ];
+    startAt = "*-*-* 03:00:00";
+    extraCreateArgs = [ "-v" ];
+  };
+in
+{
+  services.borgbackup = {
+    jobs = {
+      onsite = {
+        encryption = {
+          passCommand = "cat ${config.age.secrets.borgbackup-onsite.path}";
+          mode = "repokey-blake2";
+        };
+        removableDevice = true;
+        repo = "/mnt/external/backup/take2";
+      }
+      // jobConfig;
+      offsite = {
+        encryption = {
+          passCommand = "cat ${config.age.secrets.borgbackup-offsite.path}";
+          mode = "repokey-blake2";
+        };
+        environment.BORG_RSH = "ssh -i /home/srv/.ssh/id_ed25519";
+        repo = "ssh://vuc5c3xq@vuc5c3xq.repo.borgbase.com/./repo";
+      }
+      // jobConfig;
+    };
+  };
+
+  age.secrets = {
+    borgbackup-onsite.file = ../../../secrets/borgbackup-onsite.age;
+    borgbackup-offsite.file = ../../../secrets/borgbackup-offsite.age;
+  };
+}

modules/nixos/features/borgmatic.nix

@@ -42,12 +42,10 @@
         {
           path = "/mnt/external/backup/repo";
           label = "onsite";
-          # encryption = "repokey-blake2";
         }
         {
           path = "ssh://vuc5c3xq@vuc5c3xq.repo.borgbase.com/./repo";
           label = "offsite";
-          # encryption = "repokey-blake2";
         }
       ];
       retries = 3;
@@ -75,8 +73,6 @@
     "borgmatic-pg:${config.age.secrets.borgmatic-pg.path}"
   ];
 
-  # onsite drive
-
   # secrets
   age.secrets = {
     "borgmatic".file = ../../../secrets/borgmatic.age;

modules/nixos/features/firefly.nix

@@ -24,13 +24,6 @@ in
       };
     };
 
-    borgmatic.settings.sqlite_databases = [
-      {
-        name = "firefly";
-        path = "/srv/firefly/storage/database/database.sqlite";
-      }
-    ];
-
     caddy.virtualHosts."firefly.fi33.buzz".extraConfig = ''
       root * ${config.services.firefly-iii.package}/public
       php_fastcgi unix//${config.services.phpfpm.pools.firefly-iii.socket}

modules/nixos/features/immich.nix

@@ -27,15 +27,6 @@ in
       }
     ];
 
-    borgmatic.settings.postgresql_databases = [
-      {
-        name = "immich";
-        hostname = "localhost";
-        username = "root";
-        password = "{credential systemd borgmatic-pg}";
-      }
-    ];
-
     caddy.virtualHosts.${hostname}.extraConfig = ''
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {

modules/nixos/features/mealie.nix

@@ -1,5 +1,5 @@
 {
-  config,
+  pkgs,
   ...
 }:
 let
@@ -34,17 +34,14 @@ in
       }
     ];
 
-    # borgmatic.settings = {
+    borgbackup.jobs = {
-    #   source_directories = [ ];
+      onsite = {
-    #   postgresql_databases = [
+        paths = [ "/var/lib/mealie" ];
-    #     {
+      };
-    #       name = "mealie";
+      offsite = {
-    #       hostname = "localhost";
+        paths = [ "/var/lib/mealie" ];
-    #       username = "root";
+      };
-    #       password = "{credential systemd borgmatic-pg}";
+    };
-    #     }
-    #   ];
-    # };
 
     caddy.virtualHosts.${hostname}.extraConfig = ''
       reverse_proxy localhost:${toString port}

modules/nixos/features/miniflux.nix

@@ -34,15 +34,6 @@ in
       }
     ];
 
-    borgmatic.settings.postgresql_databases = [
-      {
-        name = "miniflux";
-        hostname = "localhost";
-        username = "root";
-        password = "{credential systemd borgmatic-pg}";
-      }
-    ];
-
     caddy.virtualHosts.${hostname}.extraConfig = ''
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {

modules/nixos/features/ntfy-sh.nix

@@ -20,11 +20,9 @@ in
         auth-default-access = "deny-all";
         auth-users = [
           "Debit3885:$2a$12$ZeFimzdifNFSmf0W2oi.vuZfsqae75md9nhC/Q2BcKMyvDO8T.uEK:admin"
-          "borgmatic:$2a$12$ZeFimzdifNFSmf0W2oi.vuZfsqae75md9nhC/Q2BcKMyvDO8T.uEK:user"
           "gatus:$2a$12$OswG3sB8oDaB.KpawKM3P.78dID.Tj/0y5qeVD5BE6EH5bpGKe.na:user"
         ];
         auth-access = [
-          "borgmatic:backups:wo"
           "gatus:services:wo"
         ];
       };
@@ -44,10 +42,9 @@ in
       }
     ];
 
-    borgmatic.settings = {
+    borgbackup.jobs = {
-      source_directories = [
+      onsite.paths = [ "/var/lib/ntfy-sh" ];
-        "/var/lib/ntfy-sh/user.db"
+      offsite.paths = [ "/var/lib/ntfy-sh" ];
-      ];
     };
 
     caddy.virtualHosts.${hostname}.extraConfig = ''

modules/nixos/features/paperless.nix

@@ -36,17 +36,6 @@ in
       }
     ];
 
-    borgmatic.settings = {
-      postgresql_databases = [
-        {
-          name = "paperless";
-          hostname = "localhost";
-          username = "root";
-          password = "{credential systemd borgmatic-pg}";
-        }
-      ];
-    };
-
     caddy.virtualHosts.${hostname}.extraConfig = ''
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {

modules/nixos/features/prowlarr.nix

@@ -1,3 +1,7 @@
+{
+  pkgs,
+  ...
+}:
 let
   port = 5009;
   certloc = "/var/lib/acme/fi33.buzz";
@@ -28,7 +32,14 @@ in
       }
     ];
 
-    borgmatic.settings.source_directories = [ "/var/lib/prowlarr" ];
+    borgbackup.jobs = {
+      onsite = {
+        paths = [ "/var/lib/prowlarr" ];
+      };
+      offsite = {
+        paths = [ "/var/lib/prowlarr" ];
+      };
+    };
 
     caddy.virtualHosts.${hostname}.extraConfig = ''
       reverse_proxy localhost:${toString port}

modules/nixos/features/syncthing.nix

@@ -73,12 +73,16 @@ in
       }
     ];
 
-    borgmatic.settings =
+    borgbackup.jobs =
       if userName == "srv" then
         {
-          source_directories = [
+          onsite.paths = [
             "/home/srv/.config/syncthing"
-            "/home/srv/Sync"
+            "/home/srv/Sync/"
+          ];
+          offsite.paths = [
+            "/home/srv/.config/syncthing"
+            "/home/srv/Sync/"
           ];
         }
       else

modules/templates/web-feature.nix

@@ -25,17 +25,10 @@ in
       }
     ];
 
-    # borgmatic.settings = {
+    borgbackup.jobs = {
-    #   source_directories = [ ];
+      onsite.paths = [ "" ];
-    #   postgresql_databases = [
+      offsite.paths = [ "" ];
-    #     {
+    };
-    #       name = "feature";
-    #       hostname = "localhost";
-    #       username = "root";
-    #       password = "{credential systemd borgmatic-pg}";
-    #     }
-    #   ];
-    # };
 
     caddy.virtualHosts.${hostname}.extraConfig = ''
       reverse_proxy localhost:${toString port}

secrets/borgbackup-offsite.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 qLT+DQ NuEGxxieL0H7mUFKft+fuH1jd0XFDf3xESLrVcb9GAg
+KxJcj9P/+cr63TmqEIPwfykz07luqe9VLRLzs3CWx9Y
+-> ssh-ed25519 NanIwQ HRHMV4jFn7vJVHd6gFqcOTA14VI6+QaITXMpZbeGoDg
+aANuHXv4O1KKwPCClatphXgWDFnsCy/AoQJT0+D560o
+-> ssh-ed25519 LtK9yQ NHLTdStEdoXSGKxoz4/gR+oT9bLq8wwz4XRHS2rd9Xo
+lndB74KBkWrfNuZyuQufl35lQIPNqbppLfSZRerIDaA
+--- dro8ECdWcFtleQv5nffX/Wh97w/FGXQZwSIjPE9WIX8
+8‚…ƒÄRé#ÇÉç;ÒrpEÚ÷hȾW8-.ÿ é	`OÎW¸']Úk§JdõC	žÛï.ÿÆßT‘)N
ø_ÅkqüëÕ_=Ï°ç

secrets/borgbackup-onsite.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 qLT+DQ 3UW3CErZDv6UkjXJZldymqYmmJoQcbSjVX4IUX7KRn8
+pnbegKpKiNW8QY9rD7pD1mrhOSdD+cxUxcNKtLM5uOQ
+-> ssh-ed25519 NanIwQ qAl2RheS1lTOU60xeodc4/WvyzYRGiWR+55QvsVE5H0
+j/UoLITpRpMF2t0J/Y0zL0kAgz5nJ02I/nwUp+pEowg
+-> ssh-ed25519 LtK9yQ sbldK/F2u6MMgIR8F6c5ZFkMesq+GHKRmlqt3n6L2yw
+GTSzhGfj+Shg+MQ3hde12pKi6zfeGNw6RXwSAoGyaak
+--- 6WmdTjpwgwb6/1o06i5xtvnOQcvNztwpBmvH/9wYbmo
+K®öò<EFBFBD>°^¼Ñ­þ¢Ubù|œ:m@*Þ±Žö<>ÚЛ¡g1ž>)±–Çã«ÚqëÐs,n{™ DdvÅöÉœÿ‚E‚uH<j4
Ëì

secrets/borgmatic-pg.age

@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 qLT+DQ C3A3TKOyIWzbW8JupvhTmLKetnr+0uzkPq985NA0DCs
-ahrHVR7WadjOfOXBWOqBAf9L0UdCNeD0Ynk6sKDF7WM
--> ssh-ed25519 7+xRyQ evZ6zSS3olbORnqiCnEAL68D1FNPgg2oBoJSaquLAAA
-BYoo9AVOHsRsTbXkRQdS/7WN25vBuJOAb0YfnSY+hGQ
--> ssh-ed25519 LtK9yQ jLIdKPvVhPsRIJevWLmads3P2hM29c0B143OWoINzlY
-ziCUQ1TtB6BUgbNZ/zFXoaOtpxyrbKobsTvXo/dSpSA
---- Q6JHS+5vuYLIqyIb6x3qCbIJvsjk2++ovL1zkVGs69o
-<EFBFBD>ã쇽NM1±WBýy•M.ù²ø-Ø|GlºÈ]¡8Z,(5è±²P¶èè!ÿpmp¡¢°Eaû¤;<3B>Ôâ¿Ä(tq!ÊKÕU4×m

secrets/borgmatic.age

@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 qLT+DQ zfLZc8A30KjoMrhUSl4OgTp+Yg11fmVjDioxtIYMqDU
-URhJwUCElaJcSd+k5wBQAXvdC/68ZcCA5WbHGAJTYfY
--> ssh-ed25519 7+xRyQ mrGrjW0fQIRNMDdw4Hoc9N/xAEm1P0IFukShfeVdKE8
-yLUmj7LBfHQ/i4buBB57ktNUOnHpoC8NYTQUnK5e5y4
--> ssh-ed25519 LtK9yQ THjOsSIr/DQTulFlwd4r5DYb73VQ0vWgyDHkfJV3NR0
-Dl8FwK1WciiEMs5MdrFcUIOFGmlbZf3APOWzLN6rkOE
---- 3mjYPT9APy0F5NNbbCIQhzZ0XjKBtB9YGGS3t37eoRU
-ôT^væ—U‹§òÏ{™>[÷õ¦dhé§PC6þZ|é£ûýK|~lÝ<6C>bŒÀD¢ûÖÙt”΄¨ø]¨’1P$ø10¨¿ïAý±$

secrets/secrets.nix

@@ -15,9 +15,8 @@ let
 in
 {
   # keep-sorted start
-  "borgmatic-ntfy.age".publicKeys = users;
+  "borgbackup-offsite.age".publicKeys = users;
-  "borgmatic-pg.age".publicKeys = users;
+  "borgbackup-onsite.age".publicKeys = users;
-  "borgmatic.age".publicKeys = users;
   "copyparty.age".publicKeys = users;
   "gatus.age".publicKeys = users;
   "git_signing_key.age".publicKeys = users;