improved backups + local dns instead of cloudflare

hosts/hermes/hardware-configuration.nix

@@ -55,12 +55,6 @@
     options = ["credentials=${config.age.secrets.smb.path}" "x-systemd.automount" "nofail" "noperm" "x-systemd.after=network-online.target" "x-systemd.automount-options=--timeout=30" "_netdev"];
   };
 
-  fileSystems."/mnt/backups" = {
-    device = "//10.0.0.5/infra/backups";
-    fsType = "cifs";
-    options = ["credentials=${config.age.secrets.smb.path}" "x-systemd.automount" "nofail" "noperm" "x-systemd.after=network-online.target" "x-systemd.automount-options=--timeout=30" "_netdev"];
-  };
-
   swapDevices = [
     {device = "/dev/disk/by-uuid/ecbbcef6-c4c2-4cfe-bcd2-5a2e599c3009";}
   ];

modules/services/caddy.nix

@@ -74,7 +74,7 @@
       };
       "jf.nicknase27.com" = {
         extraConfig = ''
-          reverse_proxy 10.0.0.5:8096
+          reverse_proxy storage.local:8096
         '';
         serverAliases = ["watch.nicknase27.com"];
       };
@@ -108,12 +108,12 @@
       };
       "storage.nicknase27.com" = {
         extraConfig = ''
-          reverse_proxy 10.0.0.5:80
+          reverse_proxy storage.local:80
         '';
       };
       "photos.nicknase27.com" = {
         extraConfig = ''
-          reverse_proxy 10.0.0.5:2283
+          reverse_proxy storage.local:2283
         '';
       };
     };

modules/system/backups.nix

@@ -1,20 +1,32 @@
-{
+{pkgs, config, ...}: {
-  pkgs,
+  programs.ssh.extraConfig = ''
-  config,
+    Host truenas
-  lib,
+      HostName storage.local
-  ...
+      User restic
-}: {
+      IdentityFile ${config.age.secrets.truenas-ssh.path}
+      StrictHostKeyChecking no
+      UserKnownHostsFile /dev/null
+  '';
+
   services.restic.backups.hermes = {
     initialize = true;
 
-    repository = "/mnt/backups/";
+    # Set the  repo
+    repositoryFile = config.age.secrets.repo.path;
 
+    # Restic password
     passwordFile = config.age.secrets.restic.path;
 
     paths = [
       "/var/lib"
     ];
 
+    exclude = [
+      "/var/lib/gitea-runner"
+      "/var/lib/containers"
+      "/var/lib/systemd/coredump"
+    ];
+
     timerConfig = {
       OnCalendar = "daily";
       RandomizedDelaySec = "1h";
@@ -27,7 +39,30 @@
     ];
   };
 
-  age.secrets.restic = {
+  environment.systemPackages = [
-    file = ../../secrets/restic.age;
+    (pkgs.writeShellScriptBin "restic-hermes" ''
+      exec ${pkgs.restic}/bin/restic \
+        -r "sftp:restic@storage.local:/mnt/data_pool/infra/backups" \
+        --password-file "${config.age.secrets.restic.path}" \
+        -o "sftp.command=ssh restic@storage.local -i ${config.age.secrets.truenas-ssh.path} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -s sftp" \
+        "$@"
+    '')
+  ];
+
+  # Secrets configuration
+  age.secrets = {
+    restic = {
+      file = ../../secrets/restic.age;
+      owner = "root";
+    };
+    repo = {
+      file = ../../secrets/restic-repo.age;
+      owner = "root";
+    };
+    truenas-ssh = {
+      file = ../../secrets/truenas-ssh.age;
+      owner = "root";
+      mode = "0400";
+    };
   };
 }

modules/system/networking.nix

@@ -1,10 +1,11 @@
 {...}: {
   networking = {
     hostName = "Hermes";
-    nameservers = ["1.1.1.1" "1.0.0.1"];
+    #nameservers = ["1.1.1.1" "1.0.0.1"];
+    nameservers = ["10.0.0.1"];
     firewall = {
       enable = true;
-      trustedInterfaces = [ "podman0" ];
+      trustedInterfaces = ["podman0"];
     };
     nftables = {
       enable = true;

modules/system/packages.nix

@@ -8,5 +8,6 @@
     net-tools
     alejandra
     nixd
+    restic
   ];
 }

secrets/restic-repo.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 dq4eSg emJhiKH2qrO7Ywuvp4e9woS/+3GhDwrFfifOhYX82jA
+MaNzkQYfl530FO/5i7NrIzW2jb59nSL03Hlb5WLmuPk
+-> ssh-ed25519 xLUmZQ Jo4rEzaFjEm5mYLd38rYy3c94K3YuwU7UbDe+Q+NO0M
+rcMzl4RbvM8pj8Nr52xxLakP/YtqsJUQyCnCleFqHec
+--- IEaLKPkqABD5NjZ97+LH1m7idMzBy5rrlUt9tXkTQcU
+u�Ïx™X^†[(&‘
ø�&ZßèêܾÐ"êiˆ$ÃðŽñìQ?¾´{˜…Øœ»z¢™$'j7ôNÙ\¨EÓ³?i!øjª[Æžˆòƒv«

secrets/secrets.nix

@@ -6,9 +6,11 @@ let
 in {
   "caddy.age".publicKeys = systems;
   "restic.age".publicKeys = systems;
+  "restic-repo.age".publicKeys = systems;
   "smb.age".publicKeys = systems;
   "matrix-register.age".publicKeys = systems;
   "livekit-keys.age".publicKeys = systems;
+  "truenas-ssh.age".publicKeys = systems;
   "gitea-db.age".publicKeys = systems;
   "gitea-runner.age".publicKeys = systems;
   "navidrome.age".publicKeys = systems;