]>
Commit | Line | Data |
---|---|---|
c832532b IB |
1 | { lib, pkgs, config, myconfig, ... }: |
2 | let | |
3 | partModule = lib.types.submodule { | |
4 | options = { | |
5 | remote_folder = lib.mkOption { | |
6 | type = lib.types.path; | |
7 | description = '' | |
8 | Path to backup | |
9 | ''; | |
10 | }; | |
11 | exclude_from = lib.mkOption { | |
12 | type = lib.types.listOf lib.types.path; | |
13 | default = []; | |
14 | description = '' | |
15 | Paths to exclude from the backup | |
16 | ''; | |
17 | }; | |
18 | files_from = lib.mkOption { | |
19 | type = lib.types.listOf lib.types.path; | |
20 | default = []; | |
21 | description = '' | |
22 | Paths to take for the backup | |
23 | (if empty: whole folder minus exclude_from) | |
24 | ''; | |
25 | }; | |
26 | args = lib.mkOption { | |
27 | type = lib.types.nullOr lib.types.str; | |
28 | default = null; | |
29 | description = '' | |
30 | additional arguments for rsync | |
31 | ''; | |
32 | }; | |
33 | }; | |
34 | }; | |
35 | profileModule = lib.types.submodule { | |
36 | options = { | |
37 | keep = lib.mkOption { | |
38 | type = lib.types.int; | |
39 | default = 7; | |
40 | description = '' | |
41 | Number of backups to keep | |
42 | ''; | |
43 | }; | |
44 | login = lib.mkOption { | |
45 | type = lib.types.str; | |
46 | description = '' | |
47 | login to connect to | |
48 | ''; | |
49 | }; | |
50 | host = lib.mkOption { | |
51 | type = lib.types.str; | |
52 | description = '' | |
53 | host to connect to | |
54 | ''; | |
55 | }; | |
56 | port = lib.mkOption { | |
57 | type = lib.types.str; | |
58 | default = "22"; | |
59 | description = '' | |
60 | port to connect to | |
61 | ''; | |
62 | }; | |
63 | host_key = lib.mkOption { | |
64 | type = lib.types.str; | |
65 | description = '' | |
66 | Host key to use as known host | |
67 | ''; | |
68 | }; | |
69 | host_key_type = lib.mkOption { | |
70 | type = lib.types.str; | |
71 | description = '' | |
72 | Host key type | |
73 | ''; | |
74 | }; | |
75 | parts = lib.mkOption { | |
76 | type = lib.types.attrsOf partModule; | |
77 | description = '' | |
78 | folders to backup in the host | |
79 | ''; | |
80 | }; | |
81 | }; | |
82 | }; | |
83 | cfg = config.services.rsyncBackup; | |
84 | ||
85 | ssh_key = config.secrets.fullPaths."rsync_backup/identity"; | |
86 | ||
87 | backup_head = mailto: '' | |
88 | #!${pkgs.stdenv.shell} | |
89 | EXCL_FROM=`mktemp` | |
90 | FILES_FROM=`mktemp` | |
91 | TMP_STDERR=`mktemp` | |
92 | ||
93 | on_exit() { | |
94 | ${lib.optionalString (mailto != null) '' | |
95 | MAILTO="${mailto}" | |
96 | if [ -s "$TMP_STDERR" ]; then | |
97 | cat "$TMP_STDERR" | ${pkgs.mailutils}/bin/mail -s "save_distant rsync error" "$MAILTO" | |
98 | fi | |
99 | ''} | |
100 | rm -f $TMP_STDERR $EXCL_FROM $FILES_FROM | |
101 | } | |
102 | ||
103 | trap "on_exit" EXIT | |
104 | ||
105 | exec 2> "$TMP_STDERR" | |
106 | exec < /dev/null | |
107 | ||
108 | set -e | |
109 | ''; | |
110 | ||
111 | backup_profile = name: profile: builtins.concatStringsSep "\n" ( | |
112 | [(backup_profile_head name profile)] | |
113 | ++ lib.mapAttrsToList (backup_part name) profile.parts | |
114 | ++ [(backup_profile_tail name profile)]); | |
115 | ||
116 | backup_profile_head = name: profile: '' | |
117 | ##### ${name} ##### | |
118 | PORT="${profile.port}" | |
119 | DEST="${profile.login}@${profile.host}" | |
120 | BASE="${cfg.mountpoint}/${name}" | |
121 | OLD_BAK_BASE=$BASE/older/j | |
122 | BAK_BASE=''${OLD_BAK_BASE}0 | |
123 | RSYNC_OUTPUT=$BASE/rsync_output | |
124 | NBR=${builtins.toString profile.keep} | |
125 | ||
126 | if ! ssh \ | |
127 | -o PreferredAuthentications=publickey \ | |
128 | -o StrictHostKeyChecking=yes \ | |
129 | -o ClearAllForwardings=yes \ | |
130 | -p $PORT \ | |
131 | -i ${ssh_key} \ | |
132 | $DEST backup; then | |
133 | echo "Fichier de verrouillage backup sur $DEST ou impossible de se connecter" >&2 | |
134 | skip=$DEST | |
135 | fi | |
136 | ||
137 | rm -rf ''${OLD_BAK_BASE}''${NBR} | |
138 | for j in `seq -w $(($NBR-1)) -1 0`; do | |
139 | [ ! -d ''${OLD_BAK_BASE}$j ] && continue | |
140 | mv ''${OLD_BAK_BASE}$j ''${OLD_BAK_BASE}$(($j+1)) | |
141 | done | |
142 | mkdir $BAK_BASE | |
143 | mv $RSYNC_OUTPUT $BAK_BASE | |
144 | mkdir $RSYNC_OUTPUT | |
145 | ||
146 | if [ "$skip" != "$DEST" ]; then | |
147 | ''; | |
148 | ||
149 | backup_profile_tail = name: profile: '' | |
150 | ssh -i ${ssh_key} -p $PORT $DEST sh -c "date > .cache/last_backup" | |
151 | fi # [ "$skip" != "$DEST" ] | |
152 | ##### End ${name} ##### | |
153 | ''; | |
154 | ||
155 | backup_part = profile_name: part_name: part: '' | |
156 | ### ${profile_name} ${part_name} ### | |
157 | LOCAL="${part_name}" | |
158 | REMOTE="${part.remote_folder}" | |
159 | ||
160 | if [ ! -d "$BASE/$LOCAL" ]; then | |
161 | mkdir $BASE/$LOCAL | |
162 | fi | |
163 | cd $BASE/$LOCAL | |
164 | cat > $EXCL_FROM <<EOF | |
165 | ${builtins.concatStringsSep "\n" part.exclude_from} | |
166 | EOF | |
167 | cat > $FILES_FROM <<EOF | |
168 | ${builtins.concatStringsSep "\n" part.files_from} | |
169 | EOF | |
170 | ||
171 | OUT=$RSYNC_OUTPUT/$LOCAL | |
172 | ${pkgs.rsync}/bin/rsync -XAavbrz --fake-super -e "ssh -i ${ssh_key} -p $PORT" --numeric-ids --delete \ | |
173 | --backup-dir=$BAK_BASE/$LOCAL \${ | |
174 | lib.optionalString (part.args != null) "\n ${part.args} \\"}${ | |
175 | lib.optionalString (builtins.length part.exclude_from > 0) "\n --exclude-from=$EXCL_FROM \\"}${ | |
176 | lib.optionalString (builtins.length part.files_from > 0) "\n --files-from=$FILES_FROM \\"} | |
177 | $DEST:$REMOTE . > $OUT || true | |
178 | ### End ${profile_name} ${part_name} ### | |
179 | ''; | |
180 | in | |
181 | { | |
182 | options.services.rsyncBackup = { | |
183 | mountpoint = lib.mkOption { | |
184 | type = lib.types.path; | |
185 | description = "Path to the base folder for backups"; | |
186 | }; | |
187 | mailto = lib.mkOption { | |
188 | type = lib.types.nullOr lib.types.str; | |
189 | default = null; | |
190 | description = "E-mail to send the report to"; | |
191 | }; | |
192 | profiles = lib.mkOption { | |
193 | type = lib.types.attrsOf profileModule; | |
194 | default = {}; | |
195 | description = '' | |
196 | Profiles to backup | |
197 | ''; | |
198 | }; | |
199 | ssh_key_public = lib.mkOption { | |
200 | type = lib.types.str; | |
201 | description = "Public key for the backup"; | |
202 | }; | |
203 | ssh_key_private = lib.mkOption { | |
204 | type = lib.types.str; | |
205 | description = "Private key for the backup"; | |
206 | }; | |
207 | }; | |
208 | ||
209 | config = lib.mkIf (builtins.length (builtins.attrNames cfg.profiles) > 0) { | |
210 | # FIXME: monitoring to check that backup is less than 14h old | |
211 | users.users.backup = { | |
212 | isSystemUser = true; | |
213 | uid = config.ids.uids.backup; | |
214 | group = "backup"; | |
215 | extraGroups = [ "keys" ]; | |
216 | }; | |
217 | ||
218 | users.groups.backup = { | |
219 | gid = config.ids.gids.backup; | |
220 | }; | |
221 | ||
222 | services.cron.systemCronJobs = let | |
223 | backup = pkgs.writeScript "backup.sh" (builtins.concatStringsSep "\n" ([ | |
224 | (backup_head cfg.mailto) | |
225 | ] ++ lib.mapAttrsToList backup_profile cfg.profiles)); | |
226 | in [ | |
227 | '' | |
228 | 25 3,15 * * * backup ${backup} | |
229 | '' | |
230 | ]; | |
231 | ||
232 | programs.ssh.knownHosts = lib.attrsets.mapAttrs' (name: profile: lib.attrsets.nameValuePair name { | |
233 | hostNames = [ profile.host ]; | |
234 | publicKey = "${profile.host_key_type} ${profile.host_key}"; | |
235 | }) cfg.profiles; | |
236 | ||
237 | system.activationScripts.rsyncBackup = { | |
238 | deps = [ "users" ]; | |
239 | text = builtins.concatStringsSep "\n" (map (v: '' | |
240 | install -m 0700 -o backup -g backup -d ${cfg.mountpoint}/${v} ${cfg.mountpoint}/${v}/older ${cfg.mountpoint}/${v}/rsync_output | |
241 | '') (builtins.attrNames cfg.profiles) | |
242 | ); | |
243 | }; | |
244 | ||
245 | secrets.keys = [ | |
246 | { | |
247 | dest = "rsync_backup/identity"; | |
248 | user = "backup"; | |
249 | group = "backup"; | |
250 | permissions = "0400"; | |
251 | text = cfg.ssh_key_private; | |
252 | } | |
253 | { | |
254 | dest = "rsync_backup/identity.pub"; | |
255 | user = "backup"; | |
256 | group = "backup"; | |
257 | permissions = "0444"; | |
258 | text = cfg.ssh_key_public; | |
259 | } | |
260 | ]; | |
261 | }; | |
262 | } |