69 lines
1.5 KiB
Nix
69 lines
1.5 KiB
Nix
{pkgs, config, ...}: {
|
|
programs.ssh.extraConfig = ''
|
|
Host truenas
|
|
HostName storage.local
|
|
User restic
|
|
IdentityFile ${config.age.secrets.truenas-ssh.path}
|
|
StrictHostKeyChecking no
|
|
UserKnownHostsFile /dev/null
|
|
'';
|
|
|
|
services.restic.backups.hermes = {
|
|
initialize = true;
|
|
|
|
# Set the repo
|
|
repositoryFile = config.age.secrets.repo.path;
|
|
|
|
# Restic password
|
|
passwordFile = config.age.secrets.restic.path;
|
|
|
|
paths = [
|
|
"/var/lib"
|
|
];
|
|
|
|
exclude = [
|
|
"/var/lib/gitea-runner"
|
|
"/var/lib/containers"
|
|
"/var/lib/systemd/coredump"
|
|
];
|
|
|
|
timerConfig = {
|
|
OnCalendar = "daily";
|
|
RandomizedDelaySec = "1h";
|
|
};
|
|
|
|
pruneOpts = [
|
|
"--keep-daily=7"
|
|
"--keep-weekly=4"
|
|
"--keep-monthly=12"
|
|
];
|
|
};
|
|
|
|
environment.systemPackages = [
|
|
(pkgs.writeShellScriptBin "restic-hermes" ''
|
|
exec ${pkgs.restic}/bin/restic \
|
|
-r "sftp:restic@storage.local:/mnt/data_pool/infra/backups" \
|
|
--password-file "${config.age.secrets.restic.path}" \
|
|
-o "sftp.command=ssh restic@storage.local -i ${config.age.secrets.truenas-ssh.path} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -s sftp" \
|
|
"$@"
|
|
'')
|
|
];
|
|
|
|
# Secrets configuration
|
|
age.secrets = {
|
|
restic = {
|
|
file = ../../secrets/restic.age;
|
|
owner = "root";
|
|
};
|
|
repo = {
|
|
file = ../../secrets/restic-repo.age;
|
|
owner = "root";
|
|
};
|
|
truenas-ssh = {
|
|
file = ../../secrets/truenas-ssh.age;
|
|
owner = "root";
|
|
mode = "0400";
|
|
};
|
|
};
|
|
}
|