improved backups + local dns instead of cloudflare

modules/services/caddy.nix

@@ -74,7 +74,7 @@
       };
       "jf.nicknase27.com" = {
         extraConfig = ''
-          reverse_proxy 10.0.0.5:8096
+          reverse_proxy storage.local:8096
         '';
         serverAliases = ["watch.nicknase27.com"];
       };
@@ -108,12 +108,12 @@
       };
       "storage.nicknase27.com" = {
         extraConfig = ''
-          reverse_proxy 10.0.0.5:80
+          reverse_proxy storage.local:80
         '';
       };
       "photos.nicknase27.com" = {
         extraConfig = ''
-          reverse_proxy 10.0.0.5:2283
+          reverse_proxy storage.local:2283
         '';
       };
     };

modules/system/backups.nix

@@ -1,20 +1,32 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}: {
+{pkgs, config, ...}: {
+  programs.ssh.extraConfig = ''
+    Host truenas
+      HostName storage.local
+      User restic
+      IdentityFile ${config.age.secrets.truenas-ssh.path}
+      StrictHostKeyChecking no
+      UserKnownHostsFile /dev/null
+  '';
+
   services.restic.backups.hermes = {
     initialize = true;
 
-    repository = "/mnt/backups/";
+    # Set the  repo
+    repositoryFile = config.age.secrets.repo.path;
 
+    # Restic password
     passwordFile = config.age.secrets.restic.path;
 
     paths = [
       "/var/lib"
     ];
 
+    exclude = [
+      "/var/lib/gitea-runner"
+      "/var/lib/containers"
+      "/var/lib/systemd/coredump"
+    ];
+
     timerConfig = {
       OnCalendar = "daily";
       RandomizedDelaySec = "1h";
@@ -27,7 +39,30 @@
     ];
   };
 
-  age.secrets.restic = {
-    file = ../../secrets/restic.age;
+  environment.systemPackages = [
+    (pkgs.writeShellScriptBin "restic-hermes" ''
+      exec ${pkgs.restic}/bin/restic \
+        -r "sftp:restic@storage.local:/mnt/data_pool/infra/backups" \
+        --password-file "${config.age.secrets.restic.path}" \
+        -o "sftp.command=ssh restic@storage.local -i ${config.age.secrets.truenas-ssh.path} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -s sftp" \
+        "$@"
+    '')
+  ];
+
+  # Secrets configuration
+  age.secrets = {
+    restic = {
+      file = ../../secrets/restic.age;
+      owner = "root";
+    };
+    repo = {
+      file = ../../secrets/restic-repo.age;
+      owner = "root";
+    };
+    truenas-ssh = {
+      file = ../../secrets/truenas-ssh.age;
+      owner = "root";
+      mode = "0400";
+    };
   };
 }

modules/system/networking.nix

@@ -1,10 +1,11 @@
 {...}: {
   networking = {
     hostName = "Hermes";
-    nameservers = ["1.1.1.1" "1.0.0.1"];
+    #nameservers = ["1.1.1.1" "1.0.0.1"];
+    nameservers = ["10.0.0.1"];
     firewall = {
       enable = true;
-      trustedInterfaces = [ "podman0" ];
+      trustedInterfaces = ["podman0"];
     };
     nftables = {
       enable = true;

modules/system/packages.nix

@@ -8,5 +8,6 @@
     net-tools
     alejandra
     nixd
+    restic
   ];
 }