From 66fd70b5c4669a97f8d3cb38986e0633059ab8a3 Mon Sep 17 00:00:00 2001 From: nicknase27 Date: Tue, 28 Jul 2026 14:10:29 +0200 Subject: [PATCH] improved backups + local dns instead of cloudflare --- hosts/hermes/hardware-configuration.nix | 6 --- modules/services/caddy.nix | 6 +-- modules/system/backups.nix | 53 ++++++++++++++++++++---- modules/system/networking.nix | 5 ++- modules/system/packages.nix | 1 + secrets/restic-repo.age | 7 ++++ secrets/secrets.nix | 2 + secrets/truenas-ssh.age | Bin 0 -> 721 bytes 8 files changed, 60 insertions(+), 20 deletions(-) create mode 100644 secrets/restic-repo.age create mode 100644 secrets/truenas-ssh.age diff --git a/hosts/hermes/hardware-configuration.nix b/hosts/hermes/hardware-configuration.nix index 994dbc4..f3adcdd 100644 --- a/hosts/hermes/hardware-configuration.nix +++ b/hosts/hermes/hardware-configuration.nix @@ -55,12 +55,6 @@ options = ["credentials=${config.age.secrets.smb.path}" "x-systemd.automount" "nofail" "noperm" "x-systemd.after=network-online.target" "x-systemd.automount-options=--timeout=30" "_netdev"]; }; - fileSystems."/mnt/backups" = { - device = "//10.0.0.5/infra/backups"; - fsType = "cifs"; - options = ["credentials=${config.age.secrets.smb.path}" "x-systemd.automount" "nofail" "noperm" "x-systemd.after=network-online.target" "x-systemd.automount-options=--timeout=30" "_netdev"]; - }; - swapDevices = [ {device = "/dev/disk/by-uuid/ecbbcef6-c4c2-4cfe-bcd2-5a2e599c3009";} ]; diff --git a/modules/services/caddy.nix b/modules/services/caddy.nix index baef0ee..5fa3677 100644 --- a/modules/services/caddy.nix +++ b/modules/services/caddy.nix @@ -74,7 +74,7 @@ }; "jf.nicknase27.com" = { extraConfig = '' - reverse_proxy 10.0.0.5:8096 + reverse_proxy storage.local:8096 ''; serverAliases = ["watch.nicknase27.com"]; }; @@ -108,12 +108,12 @@ }; "storage.nicknase27.com" = { extraConfig = '' - reverse_proxy 10.0.0.5:80 + reverse_proxy storage.local:80 ''; }; "photos.nicknase27.com" = { extraConfig = '' - reverse_proxy 10.0.0.5:2283 + reverse_proxy storage.local:2283 ''; }; }; diff --git a/modules/system/backups.nix b/modules/system/backups.nix index de4ec98..b7a7d1e 100644 --- a/modules/system/backups.nix +++ b/modules/system/backups.nix @@ -1,20 +1,32 @@ -{ - pkgs, - config, - lib, - ... -}: { +{pkgs, config, ...}: { + programs.ssh.extraConfig = '' + Host truenas + HostName storage.local + User restic + IdentityFile ${config.age.secrets.truenas-ssh.path} + StrictHostKeyChecking no + UserKnownHostsFile /dev/null + ''; + services.restic.backups.hermes = { initialize = true; - repository = "/mnt/backups/"; + # Set the repo + repositoryFile = config.age.secrets.repo.path; + # Restic password passwordFile = config.age.secrets.restic.path; paths = [ "/var/lib" ]; + exclude = [ + "/var/lib/gitea-runner" + "/var/lib/containers" + "/var/lib/systemd/coredump" + ]; + timerConfig = { OnCalendar = "daily"; RandomizedDelaySec = "1h"; @@ -27,7 +39,30 @@ ]; }; - age.secrets.restic = { - file = ../../secrets/restic.age; + environment.systemPackages = [ + (pkgs.writeShellScriptBin "restic-hermes" '' + exec ${pkgs.restic}/bin/restic \ + -r "sftp:restic@storage.local:/mnt/data_pool/infra/backups" \ + --password-file "${config.age.secrets.restic.path}" \ + -o "sftp.command=ssh restic@storage.local -i ${config.age.secrets.truenas-ssh.path} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -s sftp" \ + "$@" + '') + ]; + + # Secrets configuration + age.secrets = { + restic = { + file = ../../secrets/restic.age; + owner = "root"; + }; + repo = { + file = ../../secrets/restic-repo.age; + owner = "root"; + }; + truenas-ssh = { + file = ../../secrets/truenas-ssh.age; + owner = "root"; + mode = "0400"; + }; }; } diff --git a/modules/system/networking.nix b/modules/system/networking.nix index 995ca61..93cbe89 100644 --- a/modules/system/networking.nix +++ b/modules/system/networking.nix @@ -1,10 +1,11 @@ {...}: { networking = { hostName = "Hermes"; - nameservers = ["1.1.1.1" "1.0.0.1"]; + #nameservers = ["1.1.1.1" "1.0.0.1"]; + nameservers = ["10.0.0.1"]; firewall = { enable = true; - trustedInterfaces = [ "podman0" ]; + trustedInterfaces = ["podman0"]; }; nftables = { enable = true; diff --git a/modules/system/packages.nix b/modules/system/packages.nix index da61bd0..29fccc7 100644 --- a/modules/system/packages.nix +++ b/modules/system/packages.nix @@ -8,5 +8,6 @@ net-tools alejandra nixd + restic ]; } diff --git a/secrets/restic-repo.age b/secrets/restic-repo.age new file mode 100644 index 0000000..94bf901 --- /dev/null +++ b/secrets/restic-repo.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 dq4eSg emJhiKH2qrO7Ywuvp4e9woS/+3GhDwrFfifOhYX82jA +MaNzkQYfl530FO/5i7NrIzW2jb59nSL03Hlb5WLmuPk +-> ssh-ed25519 xLUmZQ Jo4rEzaFjEm5mYLd38rYy3c94K3YuwU7UbDe+Q+NO0M +rcMzl4RbvM8pj8Nr52xxLakP/YtqsJUQyCnCleFqHec +--- IEaLKPkqABD5NjZ97+LH1m7idMzBy5rrlUt9tXkTQcU +uxX^[(& &Z"i$Q?{؜z$'j7 N\Eӳ?i!j[ƞv \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 6efcf21..0331715 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -6,9 +6,11 @@ let in { "caddy.age".publicKeys = systems; "restic.age".publicKeys = systems; + "restic-repo.age".publicKeys = systems; "smb.age".publicKeys = systems; "matrix-register.age".publicKeys = systems; "livekit-keys.age".publicKeys = systems; + "truenas-ssh.age".publicKeys = systems; "gitea-db.age".publicKeys = systems; "gitea-runner.age".publicKeys = systems; "navidrome.age".publicKeys = systems; diff --git a/secrets/truenas-ssh.age b/secrets/truenas-ssh.age new file mode 100644 index 0000000000000000000000000000000000000000..ac98b52fc90c4f821ce07fadc40190fb641b5eaa GIT binary patch literal 721 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCSnDKtq9PFF~;Ob&7> zHZac(Ff+6CPWK7+P6;WF^mH$_3^6MxGVo1}(zeVt@iq;Ku;9uwwFpQpHMDeh53bS< zO!N#0&o9mJ(#|gkvy4b94^MUV3O6e%aB|5o3`MuC!Y4F0Do`QOBi+O#H?YJjEx0Nz z(9p{$yD&K_!@MBKq|_`TA|y1;J14}v(l|II%z`Vts5HqVsVX2d+t<{yGCWj2EvMWy z%%#vM$Fd|KC&(+%-^e^Qq{uha)qqP^S63n1C8X3mvmo2Y*tNVg+&?=n!o$-utFo%Z zJlQ`aSUb(%z}(-htjZwL*Mdt&*LLOG*WoVH_xzK)_E3Kw?}S^yQ8F{;efV~aW1S86 zq};8kt(%td$&VDjT@2REDV<-@;jZyu z<)0$A=YNE&-|qI@v%5Pr^6`{K>ieCa_E*d>4{qYV;gRyTrTWJuturcVHnnr3g#S%_ z>QPuXJ9CN9_8+4AFK@e3A!Eic>Al0m4~HLH{i{B-y5&Q4?=!#1#}h8E7rg7qdgqyM zX=A2dg3Hrp9ww0v&|-E&uaPSs`h8{V;Z)d|8~adqSWVul4@cwc* zzK;u=LQ|_(*=?Sl6L;O9%S>Dbq*8Z5Mqz&dqDM8ZSP3qoMnz17GA; KFqvjeR|5ci+BOvc literal 0 HcmV?d00001