modules/rsync_backup/default.nix

   1 { lib, pkgs, config, ... }:
   2 let
   3   partModule = lib.types.submodule {
   4     options = {
   5       remote_folder = lib.mkOption {
   6         type = lib.types.path;
   7         description = ''
   8           Path to backup
   9           '';
  10       };
  11       exclude_from = lib.mkOption {
  12         type = lib.types.listOf lib.types.path;
  13         default = [];
  14         description = ''
  15           Paths to exclude from the backup
  16           '';
  17       };
  18       files_from = lib.mkOption {
  19         type = lib.types.listOf lib.types.path;
  20         default = [];
  21         description = ''
  22           Paths to take for the backup
  23           (if empty: whole folder minus exclude_from)
  24           '';
  25       };
  26       args = lib.mkOption {
  27         type = lib.types.nullOr lib.types.str;
  28         default = null;
  29         description = ''
  30           additional arguments for rsync
  31           '';
  32       };
  33     };
  34   };
  35   profileModule = lib.types.submodule {
  36     options = {
  37       keep = lib.mkOption {
  38         type = lib.types.int;
  39         default = 7;
  40         description = ''
  41           Number of backups to keep
  42           '';
  43       };
  44       login = lib.mkOption {
  45         type = lib.types.str;
  46         description = ''
  47           login to connect to
  48           '';
  49       };
  50       host = lib.mkOption {
  51         type = lib.types.str;
  52         description = ''
  53           host to connect to
  54           '';
  55       };
  56       port = lib.mkOption {
  57         type = lib.types.str;
  58         default = "22";
  59         description = ''
  60           port to connect to
  61           '';
  62       };
  63       host_key = lib.mkOption {
  64         type = lib.types.str;
  65         description = ''
  66           Host key to use as known host
  67           '';
  68       };
  69       host_key_type = lib.mkOption {
  70         type = lib.types.str;
  71         description = ''
  72           Host key type
  73           '';
  74       };
  75       parts = lib.mkOption {
  76         type = lib.types.attrsOf partModule;
  77         description = ''
  78           folders to backup in the host
  79           '';
  80       };
  81     };
  82   };
  83   cfg = config.services.rsyncBackup;
  84
  85   ssh_key = config.secrets.fullPaths."rsync_backup/identity";
  86
  87   backup_head = ''
  88     #!${pkgs.stdenv.shell}
  89     EXCL_FROM=`mktemp`
  90     FILES_FROM=`mktemp`
  91     TMP_STDERR=`mktemp`
  92
  93     on_exit() {
  94       if [ -s "$TMP_STDERR" ]; then
  95         cat "$TMP_STDERR"
  96       fi
  97       rm -f $TMP_STDERR $EXCL_FROM $FILES_FROM
  98     }
  99
 100     trap "on_exit" EXIT
 101
 102     exec 2> "$TMP_STDERR"
 103     exec < /dev/null
 104
 105     set -e
 106     '';
 107
 108   backup_profile = name: profile: builtins.concatStringsSep "\n" (
 109     [(backup_profile_head name profile)]
 110     ++ lib.mapAttrsToList (backup_part name) profile.parts
 111     ++ [(backup_profile_tail name profile)]);
 112
 113   backup_profile_head = name: profile: ''
 114       ##### ${name} #####
 115       PORT="${profile.port}"
 116       DEST="${profile.login}@${profile.host}"
 117       BASE="${cfg.mountpoint}/${name}"
 118       OLD_BAK_BASE=$BASE/older/j
 119       BAK_BASE=''${OLD_BAK_BASE}0
 120       RSYNC_OUTPUT=$BASE/rsync_output
 121       NBR=${builtins.toString profile.keep}
 122
 123       if ! ssh \
 124           -o PreferredAuthentications=publickey \
 125           -o StrictHostKeyChecking=yes \
 126           -o ClearAllForwardings=yes \
 127           -o UserKnownHostsFile=/dev/null \
 128           -o CheckHostIP=no \
 129           -p $PORT \
 130           -i ${ssh_key} \
 131           $DEST backup; then
 132         echo "Fichier de verrouillage backup sur $DEST ou impossible de se connecter" >&2
 133         skip=$DEST
 134       fi
 135
 136       rm -rf ''${OLD_BAK_BASE}''${NBR}
 137       for j in `seq -w $(($NBR-1)) -1 0`; do
 138         [ ! -d ''${OLD_BAK_BASE}$j ] && continue
 139         mv ''${OLD_BAK_BASE}$j ''${OLD_BAK_BASE}$(($j+1))
 140       done
 141       mkdir $BAK_BASE
 142       mv $RSYNC_OUTPUT $BAK_BASE
 143       mkdir $RSYNC_OUTPUT
 144
 145       if [ "$skip" != "$DEST" ]; then
 146     '';
 147
 148     backup_profile_tail = name: profile: ''
 149         ssh -o UserKnownHostsFile=/dev/null -o CheckHostIP=no -i ${ssh_key} -p $PORT $DEST sh -c "date > .cache/last_backup"
 150       fi # [ "$skip" != "$DEST" ]
 151       ##### End ${name} #####
 152     '';
 153
 154     backup_part = profile_name: part_name: part: ''
 155       ### ${profile_name} ${part_name} ###
 156       LOCAL="${part_name}"
 157       REMOTE="${part.remote_folder}"
 158
 159       if [ ! -d "$BASE/$LOCAL" ]; then
 160         mkdir $BASE/$LOCAL
 161       fi
 162       cd $BASE/$LOCAL
 163       cat > $EXCL_FROM <<EOF
 164       ${builtins.concatStringsSep "\n" part.exclude_from}
 165       EOF
 166       cat > $FILES_FROM <<EOF
 167       ${builtins.concatStringsSep "\n" part.files_from}
 168       EOF
 169
 170       OUT=$RSYNC_OUTPUT/$LOCAL
 171       ${pkgs.rsync}/bin/rsync -XAavbrz --fake-super -e "ssh -o UserKnownHostsFile=/dev/null -o CheckHostIP=no -i ${ssh_key} -p $PORT" --numeric-ids --delete \
 172         --backup-dir=$BAK_BASE/$LOCAL \${
 173         lib.optionalString (part.args != null) "\n  ${part.args} \\"}${
 174         lib.optionalString (builtins.length part.exclude_from > 0) "\n  --exclude-from=$EXCL_FROM \\"}${
 175         lib.optionalString (builtins.length part.files_from > 0) "\n  --files-from=$FILES_FROM \\"}
 176         $DEST:$REMOTE . > $OUT || true
 177       ### End ${profile_name} ${part_name} ###
 178     '';
 179 in
 180 {
 181   options.services.rsyncBackup = {
 182     mountpoint = lib.mkOption {
 183       type = lib.types.path;
 184       description = "Path to the base folder for backups";
 185     };
 186     profiles = lib.mkOption {
 187       type = lib.types.attrsOf profileModule;
 188       default = {};
 189       description = ''
 190         Profiles to backup
 191         '';
 192     };
 193     ssh_key_public = lib.mkOption {
 194       type = lib.types.str;
 195       description = "Public key for the backup";
 196     };
 197     ssh_key_private = lib.mkOption {
 198       type = lib.types.str;
 199       description = "Private key for the backup";
 200     };
 201   };
 202
 203   config = lib.mkIf (builtins.length (builtins.attrNames cfg.profiles) > 0) {
 204     # FIXME: monitoring to check that backup is less than 14h old
 205     users.users.backup = {
 206       isSystemUser = true;
 207       uid = config.ids.uids.backup;
 208       group = "backup";
 209       extraGroups = [ "keys" ];
 210     };
 211
 212     users.groups.backup = {
 213       gid = config.ids.gids.backup;
 214     };
 215
 216     services.cron.systemCronJobs = let
 217       backup = pkgs.writeScript "backup.sh" (builtins.concatStringsSep "\n" ([
 218         backup_head
 219       ] ++ lib.mapAttrsToList backup_profile cfg.profiles));
 220     in [
 221       ''
 222         25 3,15 * * * backup ${backup}
 223         ''
 224     ];
 225
 226     programs.ssh.knownHosts = lib.attrsets.mapAttrs' (name: profile: lib.attrsets.nameValuePair name {
 227       hostNames = [ profile.host ];
 228       publicKey = "${profile.host_key_type} ${profile.host_key}";
 229     }) cfg.profiles;
 230
 231     system.activationScripts.rsyncBackup = {
 232       deps = [ "users" ];
 233       text = builtins.concatStringsSep "\n" (map (v: ''
 234         install -m 0700 -o backup -g backup -d ${cfg.mountpoint}/${v} ${cfg.mountpoint}/${v}/older ${cfg.mountpoint}/${v}/rsync_output
 235         '') (builtins.attrNames cfg.profiles)
 236         );
 237     };
 238
 239     secrets.keys = [
 240       {
 241         dest = "rsync_backup/identity";
 242         user = "backup";
 243         group = "backup";
 244         permissions = "0400";
 245         text = cfg.ssh_key_private;
 246       }
 247       {
 248         dest = "rsync_backup/identity.pub";
 249         user = "backup";
 250         group = "backup";
 251         permissions = "0444";
 252         text = cfg.ssh_key_public;
 253       }
 254     ];
 255   };
 256 }