1 { lib, pkgs, myconfig, config, ... }:
4 cfg = myconfig.env.backup;
5 varDir = "/var/lib/duply";
6 duplyProfile = profile: prefix: ''
7 GPG_PW="${cfg.password}"
8 TARGET="${cfg.remote}${prefix}"
9 export AWS_ACCESS_KEY_ID="${cfg.accessKeyId}"
10 export AWS_SECRET_ACCESS_KEY="${cfg.secretAccessKey}"
11 SOURCE="${profile.rootDir}"
12 FILENAME=".duplicity-ignore"
13 DUPL_PARAMS="$DUPL_PARAMS --exclude-if-present '$FILENAME'"
15 ARCH_DIR="${varDir}/caches"
17 # Do a full backup after 1 month
19 DUPL_PARAMS="$DUPL_PARAMS --full-if-older-than $MAX_FULLBKP_AGE "
20 # Backups older than 2months are deleted
24 MAX_FULLS_WITH_INCRS=2
26 action = "bkp_purge_purgeFull_purgeIncr";
30 services.duplyBackup.enable = lib.mkOption {
31 type = lib.types.bool;
34 Whether to enable remote backups.
37 services.duplyBackup.profiles = lib.mkOption {
38 type = lib.types.attrsOf (lib.types.submodule {
40 rootDir = lib.mkOption {
41 type = lib.types.path;
46 excludeFile = lib.mkOption {
47 type = lib.types.lines;
50 Content to put in exclude file
58 config = lib.mkIf config.services.duplyBackup.enable {
59 system.activationScripts.backup = ''
60 install -m 0700 -o root -g root -d ${varDir} ${varDir}/caches
62 secrets.keys = lib.flatten (lib.mapAttrsToList (k: v: [
65 dest = "backup/${k}/conf";
66 text = duplyProfile v "${k}/";
70 dest = "backup/${k}/exclude";
73 ]) config.services.duplyBackup.profiles);
78 backups = pkgs.writeScript "backups" ''
79 #!${pkgs.stdenv.shell}
81 ${builtins.concatStringsSep "\n" (lib.mapAttrsToList (k: v:
83 touch ${varDir}/${k}.log
84 ${pkgs.duply}/bin/duply ${config.secrets.location}/backup/${k}/ ${action} --force >> ${varDir}/${k}.log
86 ) config.services.duplyBackup.profiles)}
90 "0 2 * * * root ${backups}"
95 security.pki.certificates = let
96 cert = pkgs.fetchurl {
97 url = "http://downloads.e.eriomem.net/eriomemca.pem";
98 sha256 = "1ixx4c6j3m26j8dp9a3dkvxc80v1nr5aqgmawwgs06bskasqkvvh";
101 (builtins.readFile cert)