modules/rsync_backup/default.nix

   1 { lib, pkgs, config, myconfig, ... }:
   2 let
   3   partModule = lib.types.submodule {
   4     options = {
   5       remote_folder = lib.mkOption {
   6         type = lib.types.path;
   7         description = ''
   8           Path to backup
   9           '';
  10       };
  11       exclude_from = lib.mkOption {
  12         type = lib.types.listOf lib.types.path;
  13         default = [];
  14         description = ''
  15           Paths to exclude from the backup
  16           '';
  17       };
  18       files_from = lib.mkOption {
  19         type = lib.types.listOf lib.types.path;
  20         default = [];
  21         description = ''
  22           Paths to take for the backup
  23           (if empty: whole folder minus exclude_from)
  24           '';
  25       };
  26       args = lib.mkOption {
  27         type = lib.types.nullOr lib.types.str;
  28         default = null;
  29         description = ''
  30           additional arguments for rsync
  31           '';
  32       };
  33     };
  34   };
  35   profileModule = lib.types.submodule {
  36     options = {
  37       keep = lib.mkOption {
  38         type = lib.types.int;
  39         default = 7;
  40         description = ''
  41           Number of backups to keep
  42           '';
  43       };
  44       login = lib.mkOption {
  45         type = lib.types.str;
  46         description = ''
  47           login to connect to
  48           '';
  49       };
  50       host = lib.mkOption {
  51         type = lib.types.str;
  52         description = ''
  53           host to connect to
  54           '';
  55       };
  56       port = lib.mkOption {
  57         type = lib.types.str;
  58         default = "22";
  59         description = ''
  60           port to connect to
  61           '';
  62       };
  63       host_key = lib.mkOption {
  64         type = lib.types.str;
  65         description = ''
  66           Host key to use as known host
  67           '';
  68       };
  69       host_key_type = lib.mkOption {
  70         type = lib.types.str;
  71         description = ''
  72           Host key type
  73           '';
  74       };
  75       parts = lib.mkOption {
  76         type = lib.types.attrsOf partModule;
  77         description = ''
  78           folders to backup in the host
  79           '';
  80       };
  81     };
  82   };
  83   cfg = config.services.rsyncBackup;
  84
  85   ssh_key = config.secrets.fullPaths."rsync_backup/identity";
  86
  87   backup_head = mailto: ''
  88     #!${pkgs.stdenv.shell}
  89     EXCL_FROM=`mktemp`
  90     FILES_FROM=`mktemp`
  91     TMP_STDERR=`mktemp`
  92
  93     on_exit() {
  94     ${lib.optionalString (mailto != null) ''
  95       MAILTO="${mailto}"
  96       if [ -s "$TMP_STDERR" ]; then
  97         cat "$TMP_STDERR" | ${pkgs.mailutils}/bin/mail -s "save_distant rsync error" "$MAILTO"
  98       fi
  99     ''}
 100       rm -f $TMP_STDERR $EXCL_FROM $FILES_FROM
 101     }
 102
 103     trap "on_exit" EXIT
 104
 105     exec 2> "$TMP_STDERR"
 106     exec < /dev/null
 107
 108     set -e
 109     '';
 110
 111   backup_profile = name: profile: builtins.concatStringsSep "\n" (
 112     [(backup_profile_head name profile)]
 113     ++ lib.mapAttrsToList (backup_part name) profile.parts
 114     ++ [(backup_profile_tail name profile)]);
 115
 116   backup_profile_head = name: profile: ''
 117       ##### ${name} #####
 118       PORT="${profile.port}"
 119       DEST="${profile.login}@${profile.host}"
 120       BASE="${cfg.mountpoint}/${name}"
 121       OLD_BAK_BASE=$BASE/older/j
 122       BAK_BASE=''${OLD_BAK_BASE}0
 123       RSYNC_OUTPUT=$BASE/rsync_output
 124       NBR=${builtins.toString profile.keep}
 125
 126       if ! ssh \
 127           -o PreferredAuthentications=publickey \
 128           -o StrictHostKeyChecking=yes \
 129           -o ClearAllForwardings=yes \
 130           -p $PORT \
 131           -i ${ssh_key} \
 132           $DEST backup; then
 133         echo "Fichier de verrouillage backup sur $DEST ou impossible de se connecter" >&2
 134         skip=$DEST
 135       fi
 136
 137       rm -rf ''${OLD_BAK_BASE}''${NBR}
 138       for j in `seq -w $(($NBR-1)) -1 0`; do
 139         [ ! -d ''${OLD_BAK_BASE}$j ] && continue
 140         mv ''${OLD_BAK_BASE}$j ''${OLD_BAK_BASE}$(($j+1))
 141       done
 142       mkdir $BAK_BASE
 143       mv $RSYNC_OUTPUT $BAK_BASE
 144       mkdir $RSYNC_OUTPUT
 145
 146       if [ "$skip" != "$DEST" ]; then
 147     '';
 148
 149     backup_profile_tail = name: profile: ''
 150         ssh -i ${ssh_key} -p $PORT $DEST sh -c "date > .cache/last_backup"
 151       fi # [ "$skip" != "$DEST" ]
 152       ##### End ${name} #####
 153     '';
 154
 155     backup_part = profile_name: part_name: part: ''
 156       ### ${profile_name} ${part_name} ###
 157       LOCAL="${part_name}"
 158       REMOTE="${part.remote_folder}"
 159
 160       if [ ! -d "$BASE/$LOCAL" ]; then
 161         mkdir $BASE/$LOCAL
 162       fi
 163       cd $BASE/$LOCAL
 164       cat > $EXCL_FROM <<EOF
 165       ${builtins.concatStringsSep "\n" part.exclude_from}
 166       EOF
 167       cat > $FILES_FROM <<EOF
 168       ${builtins.concatStringsSep "\n" part.files_from}
 169       EOF
 170
 171       OUT=$RSYNC_OUTPUT/$LOCAL
 172       ${pkgs.rsync}/bin/rsync -XAavbrz --fake-super -e "ssh -i ${ssh_key} -p $PORT" --numeric-ids --delete \
 173         --backup-dir=$BAK_BASE/$LOCAL \${
 174         lib.optionalString (part.args != null) "\n  ${part.args} \\"}${
 175         lib.optionalString (builtins.length part.exclude_from > 0) "\n  --exclude-from=$EXCL_FROM \\"}${
 176         lib.optionalString (builtins.length part.files_from > 0) "\n  --files-from=$FILES_FROM \\"}
 177         $DEST:$REMOTE . > $OUT || true
 178       ### End ${profile_name} ${part_name} ###
 179     '';
 180 in
 181 {
 182   options.services.rsyncBackup = {
 183     mountpoint = lib.mkOption {
 184       type = lib.types.path;
 185       description = "Path to the base folder for backups";
 186     };
 187     mailto = lib.mkOption {
 188       type = lib.types.nullOr lib.types.str;
 189       default = null;
 190       description = "E-mail to send the report to";
 191     };
 192     profiles = lib.mkOption {
 193       type = lib.types.attrsOf profileModule;
 194       default = {};
 195       description = ''
 196         Profiles to backup
 197         '';
 198     };
 199     ssh_key_public = lib.mkOption {
 200       type = lib.types.str;
 201       description = "Public key for the backup";
 202     };
 203     ssh_key_private = lib.mkOption {
 204       type = lib.types.str;
 205       description = "Private key for the backup";
 206     };
 207   };
 208
 209   config = lib.mkIf (builtins.length (builtins.attrNames cfg.profiles) > 0) {
 210     # FIXME: monitoring to check that backup is less than 14h old
 211     users.users.backup = {
 212       isSystemUser = true;
 213       uid = config.ids.uids.backup;
 214       group = "backup";
 215       extraGroups = [ "keys" ];
 216     };
 217
 218     users.groups.backup = {
 219       gid = config.ids.gids.backup;
 220     };
 221
 222     services.cron.systemCronJobs = let
 223       backup = pkgs.writeScript "backup.sh" (builtins.concatStringsSep "\n" ([
 224         (backup_head cfg.mailto)
 225       ] ++ lib.mapAttrsToList backup_profile cfg.profiles));
 226     in [
 227       ''
 228         25 3,15 * * * backup ${backup}
 229         ''
 230     ];
 231
 232     programs.ssh.knownHosts = lib.attrsets.mapAttrs' (name: profile: lib.attrsets.nameValuePair name {
 233       hostNames = [ profile.host ];
 234       publicKey = "${profile.host_key_type} ${profile.host_key}";
 235     }) cfg.profiles;
 236
 237     system.activationScripts.rsyncBackup = {
 238       deps = [ "users" ];
 239       text = builtins.concatStringsSep "\n" (map (v: ''
 240         install -m 0700 -o backup -g backup -d ${cfg.mountpoint}/${v} ${cfg.mountpoint}/${v}/older ${cfg.mountpoint}/${v}/rsync_output
 241         '') (builtins.attrNames cfg.profiles)
 242         );
 243     };
 244
 245     secrets.keys = [
 246       {
 247         dest = "rsync_backup/identity";
 248         user = "backup";
 249         group = "backup";
 250         permissions = "0400";
 251         text = cfg.ssh_key_private;
 252       }
 253       {
 254         dest = "rsync_backup/identity.pub";
 255         user = "backup";
 256         group = "backup";
 257         permissions = "0444";
 258         text = cfg.ssh_key_public;
 259       }
 260     ];
 261   };
 262 }