5 files changed, 840 insertions, 0 deletions
diff --git a/systems/backup-2/databases/mariadb_replication.nix b/systems/backup-2/databases/mariadb_replication.nix
new file mode 100644
index 0000000..8d2b457
--- /dev/null
+++ b/systems/backup-2/databases/mariadb_replication.nix
@@ -0,0 +1,271 @@
+{ pkgs, config, lib, ... }:
+let
+  cfg = config.myServices.databasesReplication.mariadb;
+in
+{
+  options.myServices.databasesReplication.mariadb = {
+    enable = lib.mkEnableOption "Enable mariadb replication";
+    base = lib.mkOption {
+      type = lib.types.path;
+      description = ''
+        Base path to put the replications
+        '';
+    };
+    hosts = lib.mkOption {
+      default = {};
+      description = ''
+        Hosts to backup
+        '';
+      type = lib.types.attrsOf (lib.types.submodule {
+        options = {
+          package = lib.mkOption {
+            type = lib.types.package;
+            default = pkgs.mariadb;
+            description = ''
+              Mariadb package for this host
+            '';
+          };
+          serverId = lib.mkOption {
+            type = lib.types.int;
+            description = ''
+              Server id to use for replication cluster (must be unique among the cluster!)
+            '';
+          };
+          host = lib.mkOption {
+            type = lib.types.str;
+            description = ''
+              Host to connect to
+              '';
+          };
+          port = lib.mkOption {
+            type = lib.types.int;
+            description = ''
+              Port to connect to
+              '';
+          };
+          user = lib.mkOption {
+            type = lib.types.str;
+            description = ''
+              User to connect as
+              '';
+          };
+          password = lib.mkOption {
+            type = lib.types.str;
+            description = ''
+              Password to use
+              '';
+          };
+          dumpUser = lib.mkOption {
+            type = lib.types.str;
+            description = ''
+              User who can do a dump
+              '';
+          };
+          dumpPassword = lib.mkOption {
+            type = lib.types.str;
+            description = ''
+              Password for the dump user
+              '';
+          };
+        };
+      });
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    myServices.chatonsProperties.hostings.mysql-replication = {
+      file.datetime = "2022-08-27T15:00:00";
+      hosting = {
+        name = "Mysql replication";
+        description = "Replication of mysql database";
+        website = "db-1.immae.eu";
+        status.level = "OK";
+        status.description = "OK";
+        registration.load = "OPEN";
+        install.type = "PACKAGE";
+      };
+      software = {
+        name = "MariaDB";
+        website = "https://mariadb.org/";
+        license.url = "https://github.com/MariaDB/server/blob/10.11/COPYING";
+        license.name = "GNU General Public License v2.0";
+        version = pkgs.mariadb.version;
+        source.url = "https://github.com/MariaDB/server";
+      };
+    };
+    users.users.mysql = {
+      description = "MySQL server user";
+      group = "mysql";
+      uid = config.ids.uids.mysql;
+      extraGroups = [ "keys" ];
+    };
+    users.groups.mysql.gid = config.ids.gids.mysql;
+    secrets.keys = lib.listToAttrs (lib.flatten (lib.mapAttrsToList (name: hcfg: [
+      (lib.nameValuePair "mysql_replication/${name}/slave_init_commands" {
+        user = "mysql";
+        group = "mysql";
+        permissions = "0400";
+        text = ''
+          CHANGE MASTER TO master_host="${hcfg.host}", master_port=${builtins.toString hcfg.port}, master_user="${hcfg.user}", master_password="${hcfg.password}", master_ssl=1, master_use_gtid=slave_pos;
+          START SLAVE;
+          '';
+      })
+      (lib.nameValuePair "mysql_replication/${name}/mysqldump_remote" {
+        permissions = "0400";
+        user = "root";
+        group = "root";
+        text = ''
+          [mysqldump]
+          user = ${hcfg.user}
+          password = ${hcfg.password}
+        '';
+      })
+      (lib.nameValuePair "mysql_replication/${name}/mysqldump" {
+        permissions = "0400";
+        user = "root";
+        group = "root";
+        text = ''
+          [mysqldump]
+          user = ${hcfg.dumpUser}
+          password = ${hcfg.dumpPassword}
+        '';
+      })
+      (lib.nameValuePair "mysql_replication/${name}/client" {
+        permissions = "0400";
+        user = "mysql";
+        group = "mysql";
+        text = ''
+          [client]
+          user = ${hcfg.dumpUser}
+          password = ${hcfg.dumpPassword}
+        '';
+      })
+    ]) cfg.hosts));
+    services.cron = {
+      enable = true;
+      systemCronJobs = lib.flatten (lib.mapAttrsToList (name: hcfg:
+        let
+          dataDir = "${cfg.base}/${name}/mysql";
+          backupDir = "${cfg.base}/${name}/mysql_backup";
+          backup_script = pkgs.writeScript "backup_mysql_${name}" ''
+              #!${pkgs.stdenv.shell}
+              set -euo pipefail
+              filename=${backupDir}/$(${pkgs.coreutils}/bin/date -Iminutes).sql
+              ${hcfg.package}/bin/mysqldump \
+                --defaults-file=${config.secrets.fullPaths."mysql_replication/${name}/mysqldump"} \
+                -S /run/mysqld_${name}/mysqld.sock \
+                --gtid \
+                --master-data \
+                --flush-privileges \
+                --ignore-database=netdata \
+                --all-databases > $filename
+              ${pkgs.gzip}/bin/gzip $filename
+            '';
+          u = pkgs.callPackage ./utils.nix {};
+          cleanup_script = pkgs.writeScript "cleanup_mysql_${name}" (u.exponentialDumps "sql.gz" backupDir);
+        in [
+          "0 22,4,10,16 * * * root ${backup_script}"
+          "0 3 * * * root ${cleanup_script}"
+        ]) cfg.hosts);
+    };
+    system.activationScripts = lib.attrsets.mapAttrs' (name: hcfg:
+      lib.attrsets.nameValuePair "mysql_replication_${name}" {
+        deps = [ "users" "groups" ];
+        text = ''
+          install -m 0700 -o mysql -g mysql -d ${cfg.base}/${name}/mysql
+          install -m 0700 -o mysql -g mysql -d ${cfg.base}/${name}/mysql_backup
+          '';
+      }) cfg.hosts;
+    environment.etc = lib.attrsets.mapAttrs' (name: hcfg:
+      lib.attrsets.nameValuePair "mysql/${name}_my.cnf" {
+        text = ''
+          [mysqld]
+          skip-networking
+          socket = /run/mysqld_${name}/mysqld.sock
+          datadir = ${cfg.base}/${name}/mysql/
+          log-bin = mariadb-bin
+          server-id = ${builtins.toString hcfg.serverId}
+          '';
+      }
+    ) cfg.hosts;
+    systemd.services = lib.attrsets.mapAttrs' (name: hcfg:
+      let
+        dataDir = "${cfg.base}/${name}/mysql";
+      in
+      lib.attrsets.nameValuePair "mysql_backup_${name}" {
+        description = "Mysql replication for ${name}";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        restartTriggers = [ config.environment.etc."mysql/${name}_my.cnf".source ];
+        unitConfig.RequiresMountsFor = dataDir;
+        preStart = ''
+          if ! test -e ${dataDir}/mysql; then
+            if ! test -e ${dataDir}/initial.sql; then
+              ${hcfg.package}/bin/mysqldump \
+                --defaults-file=${config.secrets.fullPaths."mysql_replication/${name}/mysqldump_remote"} \
+                -h ${hcfg.host} \
+                -P ${builtins.toString hcfg.port} \
+                --ssl \
+                --gtid \
+                --flush-privileges \
+                --master-data \
+                --all-databases > ${dataDir}/initial.sql
+            fi
+            ${hcfg.package}/bin/mysql_install_db \
+              --defaults-file=/etc/mysql/${name}_my.cnf \
+              --user=mysql \
+              --datadir=${dataDir} \
+              --basedir=${hcfg.package}
+          fi
+          '';
+        serviceConfig = {
+          User = "mysql";
+          Group = "mysql";
+          RuntimeDirectory = "mysqld_${name}";
+          RuntimeDirectoryMode = "0755";
+          SupplementaryGroups = "keys";
+          PermissionsStartOnly = true;
+          Type = "notify";
+          ExecStart = "${hcfg.package}/bin/mysqld --defaults-file=/etc/mysql/${name}_my.cnf --user=mysql --datadir=${dataDir} --basedir=${hcfg.package}";
+          ExecStartPost =
+            let
+              sql_before = pkgs.writeText "mysql-initial-before" ''
+                DROP DATABASE test;
+                INSTALL SONAME 'auth_pam';
+                '';
+              setupScript = pkgs.writeScript "mysql-setup" ''
+                #!${pkgs.runtimeShell} -e
+                if test -e ${dataDir}/initial.sql; then
+                  cat \
+                    ${sql_before} \
+                    ${dataDir}/initial.sql \
+                    ${config.secrets.fullPaths."mysql_replication/${name}/slave_init_commands"} \
+                    | ${hcfg.package}/bin/mysql \
+                    --defaults-file=/etc/mysql/${name}_my.cnf \
+                    -S /run/mysqld_${name}/mysqld.sock \
+                    --user=root
+                  rm -f ${dataDir}/initial.sql
+                fi
+                '';
+            in
+              "+${setupScript}";
+          # initial dump can take a long time
+          TimeoutStartSec="infinity";
+          TimeoutStopSec = 120;
+        };
+    }) cfg.hosts;
+  };
+}
diff --git a/systems/backup-2/databases/openldap_replication.nix b/systems/backup-2/databases/openldap_replication.nix
new file mode 100644
index 0000000..b962224
--- /dev/null
+++ b/systems/backup-2/databases/openldap_replication.nix
@@ -0,0 +1,165 @@
+{ pkgs, config, lib, openldap, ... }:
+let
+  cfg = config.myServices.databasesReplication.openldap;
+  ldapConfig = hcfg: name: pkgs.writeText "slapd.conf" ''
+    include ${pkgs.openldap}/etc/schema/core.schema
+    include ${pkgs.openldap}/etc/schema/cosine.schema
+    include ${pkgs.openldap}/etc/schema/inetorgperson.schema
+    include ${pkgs.openldap}/etc/schema/nis.schema
+    include ${openldap.immae-schema}
+    pidfile   /run/slapd_${name}/slapd.pid
+    argsfile  /run/slapd_${name}/slapd.args
+    moduleload  back_mdb
+    backend     mdb
+    database    mdb
+    suffix    "${hcfg.base}"
+    rootdn    "cn=root,${hcfg.base}"
+    directory ${cfg.base}/${name}/openldap
+    index   objectClass       eq
+    index   uid               pres,eq
+    index   entryUUID         eq
+    include ${config.secrets.fullPaths."openldap_replication/${name}/replication_config"}
+    '';
+in
+{
+  options.myServices.databasesReplication.openldap = {
+    enable = lib.mkEnableOption "Enable openldap replication";
+    base = lib.mkOption {
+      type = lib.types.path;
+      description = ''
+        Base path to put the replications
+        '';
+    };
+    hosts = lib.mkOption {
+      default = {};
+      description = ''
+        Hosts to backup
+        '';
+      type = lib.types.attrsOf (lib.types.submodule {
+        options = {
+          package = lib.mkOption {
+            type = lib.types.package;
+            default = pkgs.openldap;
+            description = ''
+              Openldap package for this host
+            '';
+          };
+          url = lib.mkOption {
+            type = lib.types.str;
+            description = ''
+              Host to connect to
+              '';
+          };
+          base = lib.mkOption {
+            type = lib.types.str;
+            description = ''
+              Base DN to replicate
+              '';
+          };
+          dn = lib.mkOption {
+            type = lib.types.str;
+            description = ''
+              DN to use
+              '';
+          };
+          password = lib.mkOption {
+            type = lib.types.str;
+            description = ''
+              Password to use
+              '';
+          };
+        };
+      });
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    users.users.openldap = {
+      description = "Openldap database user";
+      group = "openldap";
+      uid = config.ids.uids.openldap;
+      extraGroups = [ "keys" ];
+    };
+    users.groups.openldap.gid = config.ids.gids.openldap;
+    secrets.keys = lib.listToAttrs (lib.flatten (lib.mapAttrsToList (name: hcfg: [
+      (lib.nameValuePair "openldap_replication/${name}/replication_config" {
+        user = "openldap";
+        group = "openldap";
+        permissions = "0400";
+        text = ''
+          syncrepl rid=000
+                  provider=${hcfg.url}
+                  type=refreshAndPersist
+                  searchbase="${hcfg.base}"
+                  retry="5 10 300 +"
+                  attrs="*,+"
+                  schemachecking=off
+                  bindmethod=simple
+                  binddn="${hcfg.dn}"
+                  credentials="${hcfg.password}"
+          '';
+      })
+      (lib.nameValuePair "openldap_replication/${name}/replication_password" {
+        user = "openldap";
+        group = "openldap";
+        permissions = "0400";
+        text = hcfg.password;
+      })
+    ]) cfg.hosts));
+    services.cron = {
+      enable = true;
+      systemCronJobs = lib.flatten (lib.mapAttrsToList (name: hcfg:
+        let
+          dataDir = "${cfg.base}/${name}/openldap";
+          backupDir = "${cfg.base}/${name}/openldap_backup";
+          backup_script = pkgs.writeScript "backup_openldap_${name}" ''
+              #!${pkgs.stdenv.shell}
+              ${hcfg.package}/bin/slapcat -b "${hcfg.base}" -f ${ldapConfig hcfg name} -l ${backupDir}/$(${pkgs.coreutils}/bin/date -Iminutes).ldif
+            '';
+          u = pkgs.callPackage ./utils.nix {};
+          cleanup_script = pkgs.writeScript "cleanup_openldap_${name}" (u.exponentialDumps "ldif" backupDir);
+        in [
+          "0 22,4,10,16 * * * root ${backup_script}"
+          "0 3 * * * root ${cleanup_script}"
+        ]) cfg.hosts);
+    };
+    system.activationScripts = lib.attrsets.mapAttrs' (name: hcfg:
+      lib.attrsets.nameValuePair "openldap_replication_${name}" {
+        deps = [ "users" "groups" ];
+        text = ''
+          install -m 0700 -o openldap -g openldap -d ${cfg.base}/${name}/openldap
+          install -m 0700 -o openldap -g openldap -d ${cfg.base}/${name}/openldap_backup
+          '';
+      }) cfg.hosts;
+    systemd.services = lib.attrsets.mapAttrs' (name: hcfg:
+      let
+        dataDir = "${cfg.base}/${name}/openldap";
+      in
+      lib.attrsets.nameValuePair "openldap_backup_${name}" {
+        description = "Openldap replication for ${name}";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        unitConfig.RequiresMountsFor = dataDir;
+        preStart = ''
+          mkdir -p /run/slapd_${name}
+          chown -R "openldap:openldap" /run/slapd_${name}
+        '';
+        serviceConfig = {
+          ExecStart = "${hcfg.package}/libexec/slapd -d 0 -u openldap -g openldap -f ${ldapConfig hcfg name}";
+        };
+    }) cfg.hosts;
+  };
+}
diff --git a/systems/backup-2/databases/postgresql_replication.nix b/systems/backup-2/databases/postgresql_replication.nix
new file mode 100644
index 0000000..5351a4f
--- /dev/null
+++ b/systems/backup-2/databases/postgresql_replication.nix
@@ -0,0 +1,203 @@
+{ pkgs, config, lib, ... }:
+let
+  cfg = config.myServices.databasesReplication.postgresql;
+in
+{
+  options.myServices.databasesReplication.postgresql = {
+    enable = lib.mkEnableOption "Enable postgresql replication";
+    base = lib.mkOption {
+      type = lib.types.path;
+      description = ''
+        Base path to put the replications
+        '';
+    };
+    mainPackage = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.postgresql;
+      description = ''
+        Postgresql package available in shell
+      '';
+    };
+    hosts = lib.mkOption {
+      default = {};
+      description = ''
+        Hosts to backup
+        '';
+      type = lib.types.attrsOf (lib.types.submodule {
+        options = {
+          package = lib.mkOption {
+            type = lib.types.package;
+            default = pkgs.postgresql;
+            description = ''
+              Postgresql package for this host
+            '';
+          };
+          slot = lib.mkOption {
+            type = lib.types.str;
+            description = ''
+              Slot to use for replication
+            '';
+          };
+          connection = lib.mkOption {
+            type = lib.types.str;
+            description = ''
+              Connection string to access the psql master
+            '';
+          };
+        };
+      });
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    myServices.chatonsProperties.hostings.postgresql-replication = {
+      file.datetime = "2022-08-27T15:00:00";
+      hosting = {
+        name = "PostgreSQL replication";
+        description = "Replication of PostgreSQL database";
+        website = "db-1.immae.eu";
+        status.level = "OK";
+        status.description = "OK";
+        registration.load = "OPEN";
+        install.type = "PACKAGE";
+      };
+      software = {
+        name = "PostgreSQL";
+        website = "https://www.postgresql.org/";
+        license.url = "https://www.postgresql.org/about/licence/";
+        license.name = "The PostgreSQL Licence";
+        version = pkgs.postgresql.version;
+        source.url = "https://git.postgresql.org/gitweb/?p=postgresql.git;a=summary";
+      };
+    };
+    users.users.postgres = {
+      name = "postgres";
+      uid = config.ids.uids.postgres;
+      group = "postgres";
+      description = "PostgreSQL server user";
+      home = "/var/lib/postgresql";
+      useDefaultShell = true;
+      extraGroups = [ "keys" ];
+    };
+    users.groups.postgres.gid = config.ids.gids.postgres;
+    environment.systemPackages = [ cfg.mainPackage ];
+    secrets.keys = lib.listToAttrs (lib.flatten (lib.mapAttrsToList (name: hcfg: [
+      (lib.nameValuePair "postgresql_replication/${name}/recovery.conf" {
+        user = "postgres";
+        group = "postgres";
+        permissions = "0400";
+        text = ''
+          standby_mode = on
+          primary_conninfo = '${hcfg.connection}?sslmode=require'
+          primary_slot_name = '${hcfg.slot}'
+          '';
+      })
+      (lib.nameValuePair "postgresql_replication/${name}/connection_string" {
+        user = "postgres";
+        group = "postgres";
+        permissions = "0400";
+        text = hcfg.connection;
+      })
+      (lib.nameValuePair "postgresql_replication/${name}/postgresql.conf" {
+        user = "postgres";
+        group = "postgres";
+        permissions = "0400";
+        text = let
+          dataDir = "${cfg.base}/${name}/postgresql";
+        in ''
+          listen_addresses = '''
+          unix_socket_directories = '${dataDir}'
+          data_directory = '${dataDir}'
+          wal_level = logical
+          max_connections = 300
+          '';
+      })
+    ]) cfg.hosts));
+    services.cron = {
+      enable = true;
+      systemCronJobs = lib.flatten (lib.mapAttrsToList (name: hcfg:
+        let
+          dataDir = "${cfg.base}/${name}/postgresql";
+          backupDir = "${cfg.base}/${name}/postgresql_backup";
+          backup_script = pkgs.writeScript "backup_psql_${name}" ''
+              #!${pkgs.stdenv.shell}
+              set -euo pipefail
+              resume_replication() {
+                ${hcfg.package}/bin/psql -h ${dataDir} -c "SELECT pg_wal_replay_resume();" >/dev/null || echo "impossible to resume replication"
+              }
+              trap resume_replication EXIT
+              ${hcfg.package}/bin/psql -h ${dataDir} -c "SELECT pg_wal_replay_pause();" >/dev/null || (echo "impossible to pause replication" && false)
+              ${hcfg.package}/bin/pg_dumpall -h ${dataDir} -f ${backupDir}/$(${pkgs.coreutils}/bin/date -Iminutes).sql
+            '';
+          u = pkgs.callPackage ./utils.nix {};
+          cleanup_script = pkgs.writeScript "cleanup_postgresql_${name}" (u.keepLastNDumps "sql" backupDir 6);
+        in [
+          "0 22,4,10,16 * * * postgres ${backup_script}"
+          "0 3 * * * postgres ${cleanup_script}"
+        ]) cfg.hosts);
+    };
+    system.activationScripts = lib.attrsets.mapAttrs' (name: hcfg:
+      lib.attrsets.nameValuePair "psql_replication_${name}" {
+        deps = [ "users" ];
+        text = ''
+          install -m 0700 -o postgres -g postgres -d ${cfg.base}/${name}/postgresql
+          install -m 0700 -o postgres -g postgres -d ${cfg.base}/${name}/postgresql_backup
+          '';
+      }) cfg.hosts;
+    systemd.services = lib.attrsets.mapAttrs' (name: hcfg:
+      let
+        dataDir = "${cfg.base}/${name}/postgresql";
+      in
+      lib.attrsets.nameValuePair "postgresql_backup_${name}" {
+        description = "Postgresql replication for ${name}";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        environment.PGDATA = dataDir;
+        path = [ hcfg.package ];
+        preStart = ''
+          if ! test -e ${dataDir}/PG_VERSION; then
+            mkdir -m 0700 -p ${dataDir}
+            chown -R postgres:postgres ${dataDir}
+          fi
+          '';
+        script = let
+          fp = n: config.secrets.fullPaths."postgresql_replication/${name}/${n}";
+        in ''
+          if ! test -e ${dataDir}/PG_VERSION; then
+            pg_basebackup -d $(cat ${fp "connection_string"}) -D ${dataDir} -S ${hcfg.slot}
+          fi
+          ln -sfn ${fp "recovery.conf"} ${dataDir}/recovery.conf
+          ln -sfn ${fp "postgresql.conf"} ${dataDir}/postgresql.conf
+          exec postgres
+          '';
+        serviceConfig = {
+          ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+          User = "postgres";
+          Group = "postgres";
+          PermissionsStartOnly = true;
+          RuntimeDirectory = "postgresql";
+          Type = "notify";
+          KillSignal = "SIGINT";
+          KillMode = "mixed";
+          # basebackup can take a long time
+          TimeoutStartSec="infinity";
+          TimeoutStopSec = 120;
+        };
+        unitConfig.RequiresMountsFor = dataDir;
+    }) cfg.hosts;
+  };
+}
diff --git a/systems/backup-2/databases/redis_replication.nix b/systems/backup-2/databases/redis_replication.nix
new file mode 100644
index 0000000..53fa904
--- /dev/null
+++ b/systems/backup-2/databases/redis_replication.nix
@@ -0,0 +1,171 @@
+{ pkgs, config, lib, ... }:
+let
+  cfg = config.myServices.databasesReplication.redis;
+in
+{
+  options.myServices.databasesReplication.redis = {
+    enable = lib.mkEnableOption "Enable redis replication";
+    base = lib.mkOption {
+      type = lib.types.path;
+      description = ''
+        Base path to put the replications
+        '';
+    };
+    hosts = lib.mkOption {
+      default = {};
+      description = ''
+        Hosts to backup
+        '';
+      type = lib.types.attrsOf (lib.types.submodule {
+        options = {
+          package = lib.mkOption {
+            type = lib.types.package;
+            default = pkgs.redis;
+            description = ''
+              Redis package for this host
+            '';
+          };
+          host = lib.mkOption {
+            type = lib.types.str;
+            description = ''
+              Host to connect to
+              '';
+          };
+          port = lib.mkOption {
+            type = lib.types.str;
+            description = ''
+              Port to connect to
+              '';
+          };
+          password = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              Password to use
+              '';
+          };
+        };
+      });
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    users.users.redis = {
+      description = "Redis database user";
+      group = "redis";
+      uid = config.ids.uids.redis;
+      extraGroups = [ "keys" ];
+    };
+    users.groups.redis.gid = config.ids.gids.redis;
+    services.spiped = { # sync from eldiron
+      enable = true;
+      config.redis = {
+        encrypt = true;
+        source = "127.0.0.1:16379";
+        target = "${lib.head config.myEnv.servers.eldiron.ips.main.ip4}:16379";
+        keyfile = config.secrets.fullPaths."redis/spiped_eldiron_keyfile";
+      };
+    };
+    secrets.keys = lib.mapAttrs' (name: hcfg:
+      lib.nameValuePair "redis_replication/${name}/config" {
+        user = "redis";
+        group = "redis";
+        permissions = "0400";
+        text = ''
+          pidfile ${cfg.base}/${name}/redis/redis.pid
+          port 0
+          unixsocket /run/redis_${name}/redis.sock
+          loglevel notice
+          logfile /dev/null
+          syslog-enabled yes
+          databases 16
+          save 900 1
+          save 300 10
+          save 60 10000
+          dbfilename dump.rdb
+          dir ${cfg.base}/${name}/redis/
+          slaveof ${hcfg.host} ${hcfg.port}
+          ${if hcfg.password != null then "masterauth ${hcfg.password}" else ""}
+          appendOnly no
+          appendfsync everysec
+          slowlog-log-slower-than 10000
+          slowlog-max-len 128
+          unixsocketperm 777
+          maxclients 1024
+          '';
+      }
+    ) cfg.hosts // {
+      "redis/spiped_eldiron_keyfile" = { # For eldiron only
+        user = "spiped";
+        group = "spiped";
+        permissions = "0400";
+        text = config.myEnv.databases.redis.spiped_key;
+      };
+    };
+    services.cron = {
+      enable = true;
+      systemCronJobs = lib.flatten (lib.mapAttrsToList (name: hcfg:
+        let
+          dataDir = "${cfg.base}/${name}/redis";
+          backupDir = "${cfg.base}/${name}/redis_backup";
+          backup_script = pkgs.writeScript "backup_redis_${name}" ''
+              #!${pkgs.stdenv.shell}
+              ${pkgs.coreutils}/bin/cp ${cfg.base}/${name}/redis/dump.rdb \
+                ${backupDir}/$(${pkgs.coreutils}/bin/date -Iminutes).rdb
+            '';
+          u = pkgs.callPackage ./utils.nix {};
+          cleanup_script = pkgs.writeScript "cleanup_redis_${name}" (u.exponentialDumps "rdb" backupDir);
+        in [
+          "0 22,4,10,16 * * * root ${backup_script}"
+          "0 3 * * * root ${cleanup_script}"
+        ]) cfg.hosts);
+    };
+    system.activationScripts = lib.attrsets.mapAttrs' (name: hcfg:
+      lib.attrsets.nameValuePair "redis_replication_${name}" {
+        deps = [ "users" "groups" ];
+        text = ''
+          install -m 0700 -o redis -g redis -d ${cfg.base}/${name}/redis
+          install -m 0700 -o redis -g redis -d ${cfg.base}/${name}/redis_backup
+          '';
+      }) cfg.hosts;
+    systemd.services = {
+      spiped_redis = { # For eldiron
+        description = "Secure pipe 'redis'";
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          Restart   = "always";
+          User      = "spiped";
+          PermissionsStartOnly = true;
+          SupplementaryGroups = "keys";
+        };
+        script = "exec ${pkgs.spiped}/bin/spiped -F `cat /etc/spiped/redis.spec`";
+      };
+    } // lib.attrsets.mapAttrs' (name: hcfg:
+      let
+        dataDir = "${cfg.base}/${name}/redis";
+      in
+      lib.attrsets.nameValuePair "redis_backup_${name}" {
+        description = "Redis replication for ${name}";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        unitConfig.RequiresMountsFor = dataDir;
+        serviceConfig = {
+          ExecStart = "${hcfg.package}/bin/redis-server ${config.secrets.fullPaths."redis_replication/${name}/config"}";
+          User = "redis";
+          RuntimeDirectory = "redis_${name}";
+        };
+    }) cfg.hosts;
+  };
+}
diff --git a/systems/backup-2/databases/utils.nix b/systems/backup-2/databases/utils.nix
new file mode 100644
index 0000000..1b3190f
--- /dev/null
+++ b/systems/backup-2/databases/utils.nix
@@ -0,0 +1,30 @@
+{ pkgs }:
+{
+  keepLastNDumps = ext: backupDir: n: ''
+    #!${pkgs.stdenv.shell}
+    cd ${backupDir}
+    ${pkgs.coreutils}/bin/rm -f \
+      $(${pkgs.coreutils}/bin/ls -1 *.${ext} \
+        | ${pkgs.coreutils}/bin/sort -r \
+        | ${pkgs.gnused}/bin/sed -e '1,${builtins.toString n}d')
+    '';
+  exponentialDumps = ext: backupDir: let
+    log2rotateSrc = builtins.fetchGit {
+      url = "https://github.com/avian2/pylog2rotate";
+      ref = "master";
+      rev = "061f0564757289d3bea553b16f8fd5c4a0319c5e";
+    };
+    log2rotate = pkgs.writeScript "log2rotate" ''
+      #!${pkgs.python38}/bin/python
+      ${builtins.readFile "${log2rotateSrc}/log2rotate.py"}
+    '';
+  in ''
+    #!${pkgs.stdenv.shell}
+    cd ${backupDir}
+    ${pkgs.coreutils}/bin/rm -f $(ls -1 *.${ext} | grep -v 'T22:' | sort -r | sed -e '1,12d')
+    ${pkgs.coreutils}/bin/rm -f $(ls -1 *T22*.${ext} | ${log2rotate} --skip 7 --fuzz 7 --delete --format='%Y-%m-%dT%H:%M+00:00.${ext}')
+    '';
+}