diff options
Diffstat (limited to 'modules/private')
-rw-r--r-- | modules/private/system/dilion.nix | 25 | ||||
-rw-r--r-- | modules/private/system/eldiron.nix | 19 |
2 files changed, 43 insertions, 1 deletions
diff --git a/modules/private/system/dilion.nix b/modules/private/system/dilion.nix index 258506b..dbfd38f 100644 --- a/modules/private/system/dilion.nix +++ b/modules/private/system/dilion.nix | |||
@@ -41,6 +41,31 @@ | |||
41 | 41 | ||
42 | programs.zsh.enable = true; | 42 | programs.zsh.enable = true; |
43 | 43 | ||
44 | users.users.backup = { | ||
45 | home = "/var/lib/backup"; | ||
46 | createHome = true; | ||
47 | hashedPassword = "!"; | ||
48 | isSystemUser = true; | ||
49 | shell = pkgs.bashInteractive; | ||
50 | openssh.authorizedKeys.keys = let | ||
51 | in | ||
52 | ["command=\"${pkgs.rrsync_sudo}/bin/rrsync /var/lib/backup/eldiron/\" ${config.myEnv.rsync_backup.ssh_key.public}"]; | ||
53 | }; | ||
54 | security.sudo.extraRules = [ | ||
55 | { | ||
56 | commands = [ | ||
57 | { command = "${pkgs.rsync}/bin/rsync"; options = [ "NOPASSWD" ]; } | ||
58 | ]; | ||
59 | users = [ "backup" ]; | ||
60 | runAs = "root"; | ||
61 | } | ||
62 | ]; | ||
63 | |||
64 | system.activationScripts.backup_home = '' | ||
65 | chown root:root /var/lib/backup | ||
66 | install -m 0750 -o backup -g root -d /var/lib/backup/eldiron | ||
67 | ''; | ||
68 | |||
44 | time.timeZone = "Europe/Paris"; | 69 | time.timeZone = "Europe/Paris"; |
45 | nix = { | 70 | nix = { |
46 | useSandbox = "relaxed"; | 71 | useSandbox = "relaxed"; |
diff --git a/modules/private/system/eldiron.nix b/modules/private/system/eldiron.nix index 5e3d45c..ab48ab4 100644 --- a/modules/private/system/eldiron.nix +++ b/modules/private/system/eldiron.nix | |||
@@ -39,6 +39,23 @@ | |||
39 | services.duplyBackup.enable = true; | 39 | services.duplyBackup.enable = true; |
40 | services.duplyBackup.profiles.oldies.rootDir = "/var/lib/oldies"; | 40 | services.duplyBackup.profiles.oldies.rootDir = "/var/lib/oldies"; |
41 | 41 | ||
42 | secrets.keys = [ | ||
43 | { | ||
44 | dest = "rsync_backup/identity"; | ||
45 | user = "root"; | ||
46 | group = "root"; | ||
47 | permissions = "0400"; | ||
48 | text = config.myEnv.rsync_backup.ssh_key.private; | ||
49 | } | ||
50 | ]; | ||
51 | programs.ssh.knownHosts.dilion = { | ||
52 | hostNames = ["dilion.immae.eu"]; | ||
53 | publicKey = let | ||
54 | profile = config.myEnv.rsync_backup.profiles.dilion; | ||
55 | in | ||
56 | "${profile.host_key_type} ${profile.host_key}"; | ||
57 | }; | ||
58 | |||
42 | deployment = { | 59 | deployment = { |
43 | targetEnv = "hetzner"; | 60 | targetEnv = "hetzner"; |
44 | hetzner = { | 61 | hetzner = { |
@@ -65,7 +82,7 @@ | |||
65 | systemCronJobs = [ | 82 | systemCronJobs = [ |
66 | '' | 83 | '' |
67 | # The star after /var/lib/* avoids deleting all folders in case of problem | 84 | # The star after /var/lib/* avoids deleting all folders in case of problem |
68 | 0 3,9,15,21 * * * root rsync -e "ssh -i /root/.ssh/id_charon_vpn" --new-compress -aAXv --delete --numeric-ids --super --rsync-path="sudo rsync" /var/lib/* immae@immae.eu: > /dev/null | 85 | 0 3,9,15,21 * * * root rsync -e "ssh -i /var/secrets/rsync_backup/identity" --new-compress -aAXv --delete --numeric-ids --super --rsync-path="sudo rsync" /var/lib/* backup@dilion.immae.eu: > /dev/null |
69 | 0 0 * * * root journalctl -q --since="25 hours ago" -u postfix -g "immae.eu.*Recipient address rejected" | 86 | 0 0 * * * root journalctl -q --since="25 hours ago" -u postfix -g "immae.eu.*Recipient address rejected" |
70 | '' | 87 | '' |
71 | ]; | 88 | ]; |