]>
Commit | Line | Data |
---|---|---|
1 | { lib, pkgs, config, name, ... }: | |
2 | ||
3 | let | |
4 | cfg = config.myEnv.backup; | |
5 | varDir = "/var/lib/duply"; | |
6 | duplyProfile = profile: remote: prefix: '' | |
7 | GPG_PW="${cfg.password}" | |
8 | TARGET="${cfg.remotes.${remote}.remote profile.bucket}${prefix}" | |
9 | export AWS_ACCESS_KEY_ID="${cfg.remotes.${remote}.accessKeyId}" | |
10 | export AWS_SECRET_ACCESS_KEY="${cfg.remotes.${remote}.secretAccessKey}" | |
11 | SOURCE="${profile.rootDir}" | |
12 | FILENAME=".duplicity-ignore" | |
13 | DUPL_PARAMS="$DUPL_PARAMS --exclude-if-present '$FILENAME'" | |
14 | VERBOSITY=4 | |
15 | ARCH_DIR="${varDir}/caches" | |
16 | ||
17 | # Do a full backup after 1 month | |
18 | MAX_FULLBKP_AGE=1M | |
19 | DUPL_PARAMS="$DUPL_PARAMS --allow-source-mismatch --exclude-other-filesystems --full-if-older-than $MAX_FULLBKP_AGE " | |
20 | # Backups older than 2months are deleted | |
21 | MAX_AGE=2M | |
22 | # Keep 2 full backups | |
23 | MAX_FULL_BACKUPS=2 | |
24 | MAX_FULLS_WITH_INCRS=2 | |
25 | ''; | |
26 | action = "bkp_purge_purgeFull_purgeIncr"; | |
27 | varName = k: remoteName: | |
28 | if remoteName == "eriomem" then k else remoteName + "_" + k; | |
29 | in | |
30 | { | |
31 | options = { | |
32 | services.duplyBackup.enable = lib.mkOption { | |
33 | type = lib.types.bool; | |
34 | default = false; | |
35 | description = '' | |
36 | Whether to enable remote backups. | |
37 | ''; | |
38 | }; | |
39 | services.duplyBackup.profiles = lib.mkOption { | |
40 | type = lib.types.attrsOf (lib.types.submodule { | |
41 | options = { | |
42 | rootDir = lib.mkOption { | |
43 | type = lib.types.path; | |
44 | description = '' | |
45 | Path to backup | |
46 | ''; | |
47 | }; | |
48 | bucket = lib.mkOption { | |
49 | type = lib.types.str; | |
50 | default = "immae-${name}"; | |
51 | description = '' | |
52 | Bucket to use | |
53 | ''; | |
54 | }; | |
55 | remotes = lib.mkOption { | |
56 | type = lib.types.listOf lib.types.str; | |
57 | default = ["eriomem"]; | |
58 | description = '' | |
59 | Remotes to use for backup | |
60 | ''; | |
61 | }; | |
62 | excludeFile = lib.mkOption { | |
63 | type = lib.types.lines; | |
64 | default = ""; | |
65 | description = '' | |
66 | Content to put in exclude file | |
67 | ''; | |
68 | }; | |
69 | }; | |
70 | }); | |
71 | }; | |
72 | }; | |
73 | ||
74 | config = lib.mkIf config.services.duplyBackup.enable { | |
75 | system.activationScripts.backup = '' | |
76 | install -m 0700 -o root -g root -d ${varDir} ${varDir}/caches | |
77 | ''; | |
78 | secrets.keys = lib.listToAttrs (lib.flatten (lib.mapAttrsToList (k: v: | |
79 | map (remote: [ | |
80 | (lib.nameValuePair "backup/${varName k remote}/conf" { | |
81 | permissions = "0400"; | |
82 | text = duplyProfile v remote "${k}/"; | |
83 | }) | |
84 | (lib.nameValuePair "backup/${varName k remote}/exclude" { | |
85 | permissions = "0400"; | |
86 | text = v.excludeFile; | |
87 | }) | |
88 | (lib.nameValuePair "backup/${varName k remote}" { | |
89 | permissions = "0500"; | |
90 | isDir = true; | |
91 | }) | |
92 | ]) v.remotes) config.services.duplyBackup.profiles)); | |
93 | ||
94 | services.cron = { | |
95 | enable = true; | |
96 | systemCronJobs = let | |
97 | backups = pkgs.writeScript "backups" '' | |
98 | #!${pkgs.stdenv.shell} | |
99 | ||
100 | ${builtins.concatStringsSep "\n" (lib.flatten (lib.mapAttrsToList (k: v: | |
101 | map (remote: [ | |
102 | '' | |
103 | touch ${varDir}/${varName k remote}.log | |
104 | ${pkgs.duply}/bin/duply ${config.secrets.fullPaths."backup/${varName k remote}"}/ ${action} --force >> ${varDir}/${varName k remote}.log | |
105 | [[ $? = 0 ]] || echo -e "Error when doing backup for ${varName k remote}, see above\n---------------------------------------" >&2 | |
106 | '' | |
107 | ]) v.remotes | |
108 | ) config.services.duplyBackup.profiles))} | |
109 | ''; | |
110 | in | |
111 | [ | |
112 | "0 2 * * * root ${backups}" | |
113 | ]; | |
114 | ||
115 | }; | |
116 | ||
117 | security.pki.certificateFiles = [ | |
118 | (pkgs.fetchurl { | |
119 | url = "http://downloads.e.eriomem.net/eriomemca.pem"; | |
120 | sha256 = "1ixx4c6j3m26j8dp9a3dkvxc80v1nr5aqgmawwgs06bskasqkvvh"; | |
121 | }) | |
122 | ]; | |
123 | ||
124 | myServices.monitoring.fromMasterActivatedPlugins = [ "eriomem" ]; | |
125 | myServices.monitoring.fromMasterObjects.service = [ | |
126 | { | |
127 | service_description = "eriomem backup is up and not full"; | |
128 | host_name = config.hostEnv.fqdn; | |
129 | use = "external-service"; | |
130 | check_command = "check_backup_eriomem"; | |
131 | ||
132 | check_interval = 120; | |
133 | notification_interval = "1440"; | |
134 | ||
135 | servicegroups = "webstatus-backup"; | |
136 | } | |
137 | ||
138 | { | |
139 | service_description = "ovh backup is up and not full"; | |
140 | host_name = config.hostEnv.fqdn; | |
141 | use = "external-service"; | |
142 | check_command = "check_ok"; | |
143 | ||
144 | check_interval = 120; | |
145 | notification_interval = "1440"; | |
146 | ||
147 | servicegroups = "webstatus-backup"; | |
148 | } | |
149 | ]; | |
150 | }; | |
151 | } |