]>
Commit | Line | Data |
---|---|---|
bd5c5d4e IB |
1 | { |
2 | description = "Rsync backups"; | |
3 | ||
4 | outputs = { self }: { | |
5 | nixosModule = { lib, pkgs, config, ... }: { | |
6 | options.services.rsyncBackup = { | |
7 | mountpoint = lib.mkOption { | |
8 | type = lib.types.path; | |
9 | description = "Path to the base folder for backups"; | |
10 | }; | |
11 | profiles = lib.mkOption { | |
12 | type = lib.types.attrsOf (lib.types.submodule { | |
13 | options = { | |
14 | keep = lib.mkOption { | |
15 | type = lib.types.int; | |
16 | default = 7; | |
17 | description = '' | |
18 | Number of backups to keep | |
19 | ''; | |
20 | }; | |
21 | check_command = lib.mkOption { | |
22 | type = lib.types.str; | |
23 | default = "backup"; | |
24 | description = '' | |
25 | command to check if backup needs to be done | |
26 | ''; | |
27 | }; | |
28 | login = lib.mkOption { | |
29 | type = lib.types.str; | |
30 | description = '' | |
31 | login to connect to | |
32 | ''; | |
33 | }; | |
34 | host = lib.mkOption { | |
35 | type = lib.types.str; | |
36 | description = '' | |
37 | host to connect to | |
38 | ''; | |
39 | }; | |
40 | port = lib.mkOption { | |
41 | type = lib.types.str; | |
42 | default = "22"; | |
43 | description = '' | |
44 | port to connect to | |
45 | ''; | |
46 | }; | |
47 | host_key = lib.mkOption { | |
48 | type = lib.types.str; | |
49 | description = '' | |
50 | Host key to use as known host | |
51 | ''; | |
52 | }; | |
53 | host_key_type = lib.mkOption { | |
54 | type = lib.types.str; | |
55 | description = '' | |
56 | Host key type | |
57 | ''; | |
58 | }; | |
59 | parts = lib.mkOption { | |
60 | type = lib.types.attrsOf (lib.types.submodule { | |
61 | options = { | |
62 | remote_folder = lib.mkOption { | |
63 | type = lib.types.path; | |
64 | description = '' | |
65 | Path to backup | |
66 | ''; | |
67 | }; | |
68 | exclude_from = lib.mkOption { | |
69 | type = lib.types.listOf lib.types.path; | |
70 | default = []; | |
71 | description = '' | |
72 | Paths to exclude from the backup | |
73 | ''; | |
74 | }; | |
75 | files_from = lib.mkOption { | |
76 | type = lib.types.listOf lib.types.path; | |
77 | default = []; | |
78 | description = '' | |
79 | Paths to take for the backup | |
80 | (if empty: whole folder minus exclude_from) | |
81 | ''; | |
82 | }; | |
83 | args = lib.mkOption { | |
84 | type = lib.types.nullOr lib.types.str; | |
85 | default = null; | |
86 | description = '' | |
87 | additional arguments for rsync | |
88 | ''; | |
89 | }; | |
90 | }; | |
91 | }); | |
92 | description = '' | |
93 | folders to backup in the host | |
94 | ''; | |
95 | }; | |
96 | }; | |
97 | }); | |
98 | default = {}; | |
99 | description = '' | |
100 | Profiles to backup | |
101 | ''; | |
102 | }; | |
103 | ssh_key_public = lib.mkOption { | |
104 | type = lib.types.str; | |
105 | description = "Public key for the backup"; | |
106 | }; | |
107 | ssh_key_private = lib.mkOption { | |
108 | type = lib.types.str; | |
109 | description = "Private key for the backup"; | |
110 | }; | |
111 | }; | |
112 | ||
113 | config = | |
114 | let | |
115 | cfg = config.services.rsyncBackup; | |
116 | in | |
117 | lib.mkIf (builtins.length (builtins.attrNames cfg.profiles) > 0) { | |
118 | users.users.backup = { | |
119 | isSystemUser = true; | |
120 | uid = config.ids.uids.backup; | |
121 | group = "backup"; | |
122 | extraGroups = [ "keys" ]; | |
123 | }; | |
124 | ||
125 | users.groups.backup = { | |
126 | gid = config.ids.gids.backup; | |
127 | }; | |
128 | ||
129 | services.cron.systemCronJobs = let | |
130 | ssh_key = cfg.ssh_key_private; | |
131 | backup_head = '' | |
132 | #!${pkgs.stdenv.shell} | |
133 | EXCL_FROM=`mktemp` | |
134 | FILES_FROM=`mktemp` | |
135 | TMP_STDERR=`mktemp` | |
136 | ||
137 | on_exit() { | |
138 | if [ -s "$TMP_STDERR" ]; then | |
139 | cat "$TMP_STDERR" | |
140 | fi | |
141 | rm -f $TMP_STDERR $EXCL_FROM $FILES_FROM | |
142 | } | |
143 | ||
144 | trap "on_exit" EXIT | |
145 | ||
146 | exec 2> "$TMP_STDERR" | |
147 | exec < /dev/null | |
148 | ||
149 | set -e | |
150 | ''; | |
151 | backup_profile_head = name: profile: '' | |
152 | ##### ${name} ##### | |
153 | PORT="${profile.port}" | |
154 | DEST="${profile.login}@${profile.host}" | |
155 | BASE="${cfg.mountpoint}/${name}" | |
156 | OLD_BAK_BASE=$BASE/older/j | |
157 | BAK_BASE=''${OLD_BAK_BASE}0 | |
158 | RSYNC_OUTPUT=$BASE/rsync_output | |
159 | NBR=${builtins.toString profile.keep} | |
160 | ||
161 | if ! ssh \ | |
162 | -o PreferredAuthentications=publickey \ | |
163 | -o StrictHostKeyChecking=yes \ | |
164 | -o ClearAllForwardings=yes \ | |
165 | -o UserKnownHostsFile=/dev/null \ | |
166 | -o CheckHostIP=no \ | |
167 | -p $PORT \ | |
168 | -i ${ssh_key} \ | |
169 | $DEST ${profile.check_command}; then | |
170 | echo "Fichier de verrouillage backup sur $DEST ou impossible de se connecter" >&2 | |
171 | skip=$DEST | |
172 | fi | |
173 | ||
174 | rm -rf ''${OLD_BAK_BASE}''${NBR} | |
175 | for j in `seq -w $(($NBR-1)) -1 0`; do | |
176 | [ ! -d ''${OLD_BAK_BASE}$j ] && continue | |
177 | mv ''${OLD_BAK_BASE}$j ''${OLD_BAK_BASE}$(($j+1)) | |
178 | done | |
179 | mkdir $BAK_BASE | |
180 | mv $RSYNC_OUTPUT $BAK_BASE | |
181 | mkdir $RSYNC_OUTPUT | |
182 | ||
183 | if [ "$skip" != "$DEST" ]; then | |
184 | ''; | |
185 | backup_profile_tail = name: profile: '' | |
186 | ssh -o UserKnownHostsFile=/dev/null -o CheckHostIP=no -i ${ssh_key} -p $PORT $DEST sh -c "date > .cache/last_backup" | |
187 | fi # [ "$skip" != "$DEST" ] | |
188 | ##### End ${name} ##### | |
189 | ''; | |
190 | ||
191 | backup_part = profile_name: part_name: part: '' | |
192 | ### ${profile_name} ${part_name} ### | |
193 | LOCAL="${part_name}" | |
194 | REMOTE="${part.remote_folder}" | |
195 | ||
196 | if [ ! -d "$BASE/$LOCAL" ]; then | |
197 | mkdir $BASE/$LOCAL | |
198 | fi | |
199 | cd $BASE/$LOCAL | |
200 | cat > $EXCL_FROM <<EOF | |
201 | ${builtins.concatStringsSep "\n" part.exclude_from} | |
202 | EOF | |
203 | cat > $FILES_FROM <<EOF | |
204 | ${builtins.concatStringsSep "\n" part.files_from} | |
205 | EOF | |
206 | ||
207 | OUT=$RSYNC_OUTPUT/$LOCAL | |
208 | ${pkgs.rsync}/bin/rsync --new-compress -XAavbr --fake-super -e "ssh -o UserKnownHostsFile=/dev/null -o CheckHostIP=no -i ${ssh_key} -p $PORT" --numeric-ids --delete \ | |
209 | --backup-dir=$BAK_BASE/$LOCAL \${ | |
210 | lib.optionalString (part.args != null) "\n ${part.args} \\"}${ | |
211 | lib.optionalString (builtins.length part.exclude_from > 0) "\n --exclude-from=$EXCL_FROM \\"}${ | |
212 | lib.optionalString (builtins.length part.files_from > 0) "\n --files-from=$FILES_FROM \\"} | |
213 | $DEST:$REMOTE . > $OUT || true | |
214 | ### End ${profile_name} ${part_name} ### | |
215 | ''; | |
216 | backup_profile = name: profile: builtins.concatStringsSep "\n" ( | |
217 | [(backup_profile_head name profile)] | |
218 | ++ lib.mapAttrsToList (backup_part name) profile.parts | |
219 | ++ [(backup_profile_tail name profile)]); | |
220 | ||
221 | backup = pkgs.writeScript "backup.sh" (builtins.concatStringsSep "\n" ([ | |
222 | backup_head | |
223 | ] ++ lib.mapAttrsToList backup_profile cfg.profiles)); | |
224 | in [ | |
225 | '' | |
226 | 25 3,15 * * * backup ${backup} | |
227 | '' | |
228 | ]; | |
229 | ||
230 | programs.ssh.knownHosts = lib.attrsets.mapAttrs' (name: profile: lib.attrsets.nameValuePair name { | |
e34b3079 | 231 | extraHostNames = [ profile.host ]; |
bd5c5d4e IB |
232 | publicKey = "${profile.host_key_type} ${profile.host_key}"; |
233 | }) cfg.profiles; | |
234 | ||
235 | system.activationScripts.rsyncBackup = { | |
236 | deps = [ "users" ]; | |
237 | text = builtins.concatStringsSep "\n" (map (v: '' | |
238 | install -m 0700 -o backup -g backup -d ${cfg.mountpoint}/${v} ${cfg.mountpoint}/${v}/older ${cfg.mountpoint}/${v}/rsync_output | |
239 | '') (builtins.attrNames cfg.profiles) | |
240 | ); | |
241 | }; | |
242 | }; | |
243 | }; | |
244 | }; | |
245 | } |