flakes/rsync_backup/flake.nix

   1 {
   2   description = "Rsync backups";
   3
   4   outputs = { self }: {
   5     nixosModule = { lib, pkgs, config, ... }: {
   6       options.services.rsyncBackup = {
   7         mountpoint = lib.mkOption {
   8           type = lib.types.path;
   9           description = "Path to the base folder for backups";
  10         };
  11         profiles = lib.mkOption {
  12           type = lib.types.attrsOf (lib.types.submodule {
  13             options = {
  14               keep = lib.mkOption {
  15                 type = lib.types.int;
  16                 default = 7;
  17                 description = ''
  18                   Number of backups to keep
  19                   '';
  20               };
  21               check_command = lib.mkOption {
  22                 type = lib.types.str;
  23                 default = "backup";
  24                 description = ''
  25                   command to check if backup needs to be done
  26                 '';
  27               };
  28               login = lib.mkOption {
  29                 type = lib.types.str;
  30                 description = ''
  31                   login to connect to
  32                   '';
  33               };
  34               host = lib.mkOption {
  35                 type = lib.types.str;
  36                 description = ''
  37                   host to connect to
  38                   '';
  39               };
  40               port = lib.mkOption {
  41                 type = lib.types.str;
  42                 default = "22";
  43                 description = ''
  44                   port to connect to
  45                   '';
  46               };
  47               host_key = lib.mkOption {
  48                 type = lib.types.str;
  49                 description = ''
  50                   Host key to use as known host
  51                   '';
  52               };
  53               host_key_type = lib.mkOption {
  54                 type = lib.types.str;
  55                 description = ''
  56                   Host key type
  57                   '';
  58               };
  59               parts = lib.mkOption {
  60                 type = lib.types.attrsOf (lib.types.submodule {
  61                   options = {
  62                     remote_folder = lib.mkOption {
  63                       type = lib.types.path;
  64                       description = ''
  65                         Path to backup
  66                         '';
  67                     };
  68                     exclude_from = lib.mkOption {
  69                       type = lib.types.listOf lib.types.path;
  70                       default = [];
  71                       description = ''
  72                         Paths to exclude from the backup
  73                         '';
  74                     };
  75                     files_from = lib.mkOption {
  76                       type = lib.types.listOf lib.types.path;
  77                       default = [];
  78                       description = ''
  79                         Paths to take for the backup
  80                         (if empty: whole folder minus exclude_from)
  81                         '';
  82                     };
  83                     args = lib.mkOption {
  84                       type = lib.types.nullOr lib.types.str;
  85                       default = null;
  86                       description = ''
  87                         additional arguments for rsync
  88                         '';
  89                     };
  90                   };
  91                 });
  92                 description = ''
  93                   folders to backup in the host
  94                   '';
  95               };
  96             };
  97           });
  98           default = {};
  99           description = ''
 100             Profiles to backup
 101             '';
 102         };
 103         ssh_key_public = lib.mkOption {
 104           type = lib.types.str;
 105           description = "Public key for the backup";
 106         };
 107         ssh_key_private = lib.mkOption {
 108           type = lib.types.str;
 109           description = "Private key for the backup";
 110         };
 111       };
 112
 113       config =
 114         let
 115           cfg = config.services.rsyncBackup;
 116         in
 117           lib.mkIf (builtins.length (builtins.attrNames cfg.profiles) > 0) {
 118             users.users.backup = {
 119               isSystemUser = true;
 120               uid = config.ids.uids.backup;
 121               group = "backup";
 122               extraGroups = [ "keys" ];
 123             };
 124
 125             users.groups.backup = {
 126               gid = config.ids.gids.backup;
 127             };
 128
 129             services.cron.systemCronJobs = let
 130               ssh_key = cfg.ssh_key_private;
 131               backup_head = ''
 132                 #!${pkgs.stdenv.shell}
 133                 EXCL_FROM=`mktemp`
 134                 FILES_FROM=`mktemp`
 135                 TMP_STDERR=`mktemp`
 136
 137                 on_exit() {
 138                   if [ -s "$TMP_STDERR" ]; then
 139                     cat "$TMP_STDERR"
 140                   fi
 141                   rm -f $TMP_STDERR $EXCL_FROM $FILES_FROM
 142                 }
 143
 144                 trap "on_exit" EXIT
 145
 146                 exec 2> "$TMP_STDERR"
 147                 exec < /dev/null
 148
 149                 set -e
 150                 '';
 151               backup_profile_head = name: profile: ''
 152                   ##### ${name} #####
 153                   PORT="${profile.port}"
 154                   DEST="${profile.login}@${profile.host}"
 155                   BASE="${cfg.mountpoint}/${name}"
 156                   OLD_BAK_BASE=$BASE/older/j
 157                   BAK_BASE=''${OLD_BAK_BASE}0
 158                   RSYNC_OUTPUT=$BASE/rsync_output
 159                   NBR=${builtins.toString profile.keep}
 160
 161                   if ! ssh \
 162                       -o PreferredAuthentications=publickey \
 163                       -o StrictHostKeyChecking=yes \
 164                       -o ClearAllForwardings=yes \
 165                       -o UserKnownHostsFile=/dev/null \
 166                       -o CheckHostIP=no \
 167                       -p $PORT \
 168                       -i ${ssh_key} \
 169                       $DEST ${profile.check_command}; then
 170                     echo "Fichier de verrouillage backup sur $DEST ou impossible de se connecter" >&2
 171                     skip=$DEST
 172                   fi
 173
 174                   rm -rf ''${OLD_BAK_BASE}''${NBR}
 175                   for j in `seq -w $(($NBR-1)) -1 0`; do
 176                     [ ! -d ''${OLD_BAK_BASE}$j ] && continue
 177                     mv ''${OLD_BAK_BASE}$j ''${OLD_BAK_BASE}$(($j+1))
 178                   done
 179                   mkdir $BAK_BASE
 180                   mv $RSYNC_OUTPUT $BAK_BASE
 181                   mkdir $RSYNC_OUTPUT
 182
 183                   if [ "$skip" != "$DEST" ]; then
 184                 '';
 185               backup_profile_tail = name: profile: ''
 186                   ssh -o UserKnownHostsFile=/dev/null -o CheckHostIP=no -i ${ssh_key} -p $PORT $DEST sh -c "date > .cache/last_backup"
 187                 fi # [ "$skip" != "$DEST" ]
 188                 ##### End ${name} #####
 189               '';
 190
 191               backup_part = profile_name: part_name: part: ''
 192                 ### ${profile_name} ${part_name} ###
 193                 LOCAL="${part_name}"
 194                 REMOTE="${part.remote_folder}"
 195
 196                 if [ ! -d "$BASE/$LOCAL" ]; then
 197                   mkdir $BASE/$LOCAL
 198                 fi
 199                 cd $BASE/$LOCAL
 200                 cat > $EXCL_FROM <<EOF
 201                 ${builtins.concatStringsSep "\n" part.exclude_from}
 202                 EOF
 203                 cat > $FILES_FROM <<EOF
 204                 ${builtins.concatStringsSep "\n" part.files_from}
 205                 EOF
 206
 207                 OUT=$RSYNC_OUTPUT/$LOCAL
 208                 ${pkgs.rsync}/bin/rsync --new-compress -XAavbr --fake-super -e "ssh -o UserKnownHostsFile=/dev/null -o CheckHostIP=no -i ${ssh_key} -p $PORT" --numeric-ids --delete \
 209                   --backup-dir=$BAK_BASE/$LOCAL \${
 210                   lib.optionalString (part.args != null) "\n  ${part.args} \\"}${
 211                   lib.optionalString (builtins.length part.exclude_from > 0) "\n  --exclude-from=$EXCL_FROM \\"}${
 212                   lib.optionalString (builtins.length part.files_from > 0) "\n  --files-from=$FILES_FROM \\"}
 213                   $DEST:$REMOTE . > $OUT || true
 214                 ### End ${profile_name} ${part_name} ###
 215               '';
 216               backup_profile = name: profile: builtins.concatStringsSep "\n" (
 217                 [(backup_profile_head name profile)]
 218                 ++ lib.mapAttrsToList (backup_part name) profile.parts
 219                 ++ [(backup_profile_tail name profile)]);
 220
 221               backup = pkgs.writeScript "backup.sh" (builtins.concatStringsSep "\n" ([
 222                 backup_head
 223               ] ++ lib.mapAttrsToList backup_profile cfg.profiles));
 224             in [
 225               ''
 226                 25 3,15 * * * backup ${backup}
 227                 ''
 228             ];
 229
 230             programs.ssh.knownHosts = lib.attrsets.mapAttrs' (name: profile: lib.attrsets.nameValuePair name {
 231               hostNames = [ profile.host ];
 232               publicKey = "${profile.host_key_type} ${profile.host_key}";
 233             }) cfg.profiles;
 234
 235             system.activationScripts.rsyncBackup = {
 236               deps = [ "users" ];
 237               text = builtins.concatStringsSep "\n" (map (v: ''
 238                 install -m 0700 -o backup -g backup -d ${cfg.mountpoint}/${v} ${cfg.mountpoint}/${v}/older ${cfg.mountpoint}/${v}/rsync_output
 239                 '') (builtins.attrNames cfg.profiles)
 240                 );
 241             };
 242           };
 243       };
 244   };
 245 }