1 { lib, pkgs, config, myconfig, ... }:
3 partModule = lib.types.submodule {
5 remote_folder = lib.mkOption {
11 exclude_from = lib.mkOption {
12 type = lib.types.listOf lib.types.path;
15 Paths to exclude from the backup
18 files_from = lib.mkOption {
19 type = lib.types.listOf lib.types.path;
22 Paths to take for the backup
23 (if empty: whole folder minus exclude_from)
27 type = lib.types.nullOr lib.types.str;
30 additional arguments for rsync
35 profileModule = lib.types.submodule {
41 Number of backups to keep
44 login = lib.mkOption {
63 host_key = lib.mkOption {
66 Host key to use as known host
69 host_key_type = lib.mkOption {
75 parts = lib.mkOption {
76 type = lib.types.attrsOf partModule;
78 folders to backup in the host
83 cfg = config.services.rsyncBackup;
85 ssh_key = config.secrets.fullPaths."rsync_backup/identity";
87 backup_head = mailto: ''
88 #!${pkgs.stdenv.shell}
94 ${lib.optionalString (mailto != null) ''
96 if [ -s "$TMP_STDERR" ]; then
97 cat "$TMP_STDERR" | ${pkgs.mailutils}/bin/mail -s "save_distant rsync error" "$MAILTO"
100 rm -f $TMP_STDERR $EXCL_FROM $FILES_FROM
105 exec 2> "$TMP_STDERR"
111 backup_profile = name: profile: builtins.concatStringsSep "\n" (
112 [(backup_profile_head name profile)]
113 ++ lib.mapAttrsToList (backup_part name) profile.parts
114 ++ [(backup_profile_tail name profile)]);
116 backup_profile_head = name: profile: ''
118 PORT="${profile.port}"
119 DEST="${profile.login}@${profile.host}"
120 BASE="${cfg.mountpoint}/${name}"
121 OLD_BAK_BASE=$BASE/older/j
122 BAK_BASE=''${OLD_BAK_BASE}0
123 RSYNC_OUTPUT=$BASE/rsync_output
124 NBR=${builtins.toString profile.keep}
127 -o PreferredAuthentications=publickey \
128 -o StrictHostKeyChecking=yes \
129 -o ClearAllForwardings=yes \
130 -o UserKnownHostsFile=/dev/null \
135 echo "Fichier de verrouillage backup sur $DEST ou impossible de se connecter" >&2
139 rm -rf ''${OLD_BAK_BASE}''${NBR}
140 for j in `seq -w $(($NBR-1)) -1 0`; do
141 [ ! -d ''${OLD_BAK_BASE}$j ] && continue
142 mv ''${OLD_BAK_BASE}$j ''${OLD_BAK_BASE}$(($j+1))
145 mv $RSYNC_OUTPUT $BAK_BASE
148 if [ "$skip" != "$DEST" ]; then
151 backup_profile_tail = name: profile: ''
152 ssh -o UserKnownHostsFile=/dev/null -o CheckHostIP=no -i ${ssh_key} -p $PORT $DEST sh -c "date > .cache/last_backup"
153 fi # [ "$skip" != "$DEST" ]
154 ##### End ${name} #####
157 backup_part = profile_name: part_name: part: ''
158 ### ${profile_name} ${part_name} ###
160 REMOTE="${part.remote_folder}"
162 if [ ! -d "$BASE/$LOCAL" ]; then
166 cat > $EXCL_FROM <<EOF
167 ${builtins.concatStringsSep "\n" part.exclude_from}
169 cat > $FILES_FROM <<EOF
170 ${builtins.concatStringsSep "\n" part.files_from}
173 OUT=$RSYNC_OUTPUT/$LOCAL
174 ${pkgs.rsync}/bin/rsync -XAavbrz --fake-super -e "ssh -o UserKnownHostsFile=/dev/null -o CheckHostIP=no -i ${ssh_key} -p $PORT" --numeric-ids --delete \
175 --backup-dir=$BAK_BASE/$LOCAL \${
176 lib.optionalString (part.args != null) "\n ${part.args} \\"}${
177 lib.optionalString (builtins.length part.exclude_from > 0) "\n --exclude-from=$EXCL_FROM \\"}${
178 lib.optionalString (builtins.length part.files_from > 0) "\n --files-from=$FILES_FROM \\"}
179 $DEST:$REMOTE . > $OUT || true
180 ### End ${profile_name} ${part_name} ###
184 options.services.rsyncBackup = {
185 mountpoint = lib.mkOption {
186 type = lib.types.path;
187 description = "Path to the base folder for backups";
189 mailto = lib.mkOption {
190 type = lib.types.nullOr lib.types.str;
192 description = "E-mail to send the report to";
194 profiles = lib.mkOption {
195 type = lib.types.attrsOf profileModule;
201 ssh_key_public = lib.mkOption {
202 type = lib.types.str;
203 description = "Public key for the backup";
205 ssh_key_private = lib.mkOption {
206 type = lib.types.str;
207 description = "Private key for the backup";
211 config = lib.mkIf (builtins.length (builtins.attrNames cfg.profiles) > 0) {
212 # FIXME: monitoring to check that backup is less than 14h old
213 users.users.backup = {
215 uid = config.ids.uids.backup;
217 extraGroups = [ "keys" ];
220 users.groups.backup = {
221 gid = config.ids.gids.backup;
224 services.cron.systemCronJobs = let
225 backup = pkgs.writeScript "backup.sh" (builtins.concatStringsSep "\n" ([
226 (backup_head cfg.mailto)
227 ] ++ lib.mapAttrsToList backup_profile cfg.profiles));
230 25 3,15 * * * backup ${backup}
234 programs.ssh.knownHosts = lib.attrsets.mapAttrs' (name: profile: lib.attrsets.nameValuePair name {
235 hostNames = [ profile.host ];
236 publicKey = "${profile.host_key_type} ${profile.host_key}";
239 system.activationScripts.rsyncBackup = {
241 text = builtins.concatStringsSep "\n" (map (v: ''
242 install -m 0700 -o backup -g backup -d ${cfg.mountpoint}/${v} ${cfg.mountpoint}/${v}/older ${cfg.mountpoint}/${v}/rsync_output
243 '') (builtins.attrNames cfg.profiles)
249 dest = "rsync_backup/identity";
252 permissions = "0400";
253 text = cfg.ssh_key_private;
256 dest = "rsync_backup/identity.pub";
259 permissions = "0444";
260 text = cfg.ssh_key_public;