X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=modules%2Fprivate%2Fsystem%2Feldiron.nix;h=6ccaea5797f19cde9965856219dd2466811ae726;hb=fb7611c1e059b87ba3bdd13229c3f2d96d41a794;hp=5e3d45cce1c59fcd4f8f605113807170539860e7;hpb=ea9c6fe8041faab128391a0c03ec3bde25e29fa3;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/modules/private/system/eldiron.nix b/modules/private/system/eldiron.nix
index 5e3d45c..6ccaea5 100644
--- a/modules/private/system/eldiron.nix
+++ b/modules/private/system/eldiron.nix
@@ -39,6 +39,23 @@
   services.duplyBackup.enable = true;
   services.duplyBackup.profiles.oldies.rootDir = "/var/lib/oldies";
 
+  secrets.keys = [
+    {
+      dest = "rsync_backup/identity";
+      user = "root";
+      group = "root";
+      permissions = "0400";
+      text = config.myEnv.rsync_backup.ssh_key.private;
+    }
+  ];
+  programs.ssh.knownHosts.dilion = {
+    hostNames = ["dilion.immae.eu"];
+    publicKey = let
+      profile = config.myEnv.rsync_backup.profiles.dilion;
+    in
+      "${profile.host_key_type} ${profile.host_key}";
+  };
+
   deployment = {
     targetEnv = "hetzner";
     hetzner = {
@@ -65,8 +82,11 @@
     systemCronJobs = [
       ''
         # The star after /var/lib/* avoids deleting all folders in case of problem
-        0 3,9,15,21 * * * root rsync -e "ssh -i /root/.ssh/id_charon_vpn" --new-compress -aAXv --delete --numeric-ids --super --rsync-path="sudo rsync" /var/lib/* immae@immae.eu: > /dev/null
-        0 0 * * * root journalctl -q --since="25 hours ago" -u postfix -g "immae.eu.*Recipient address rejected"
+        0 3,9,15,21 * * * root rsync -e "ssh -i /var/secrets/rsync_backup/identity" --new-compress -aAXv --delete --numeric-ids --super --rsync-path="sudo rsync" /var/lib/* backup@dilion.immae.eu: > /dev/null
+        0 0 * * * root journalctl -q --since="25 hours ago" -u postfix -t postfix/smtpd -g "immae.eu.*Recipient address rejected"
+        # Need a way to blacklist properly
+        # 0 0 * * * root journalctl -q --since="25 hours ago" -u postfix -t postfix/smtpd -g "NOQUEUE:"
+        0 0 * * * root journalctl -q --since="25 hours ago" -u postfix -t postfix/smtp -g "status=bounced"
       ''
     ];
   };
@@ -76,5 +96,5 @@
   # database servers. You should change this only after NixOS release
   # notes say you should.
   # https://nixos.org/nixos/manual/release-notes.html
-  system.stateVersion = "19.03"; # Did you read the comment?
+  system.stateVersion = "20.03"; # Did you read the comment?
 }