1 files changed, 51 insertions, 25 deletions

diff --git a/systems/dilion/base.nix b/systems/dilion/base.nix
index b47d928..05593aa 100644
--- a/systems/dilion/base.nix
+++ b/systems/dilion/base.nix
@@ -230,6 +230,7 @@
 
   systemd.services.zrepl.serviceConfig.User = "backup";
   systemd.services.zrepl.path = [ pkgs.openssh ];
+  systemd.services.zrepl.unitConfig.After = lib.mkForce [ "wg-quick-wg0.service" "zfs.target" ];
   # pour eldiron:
   # zfs allow backup create,mount,receive,destroy,rename,snapshot,hold,bookmark,release zpool/backup
   # pour flony:
@@ -242,44 +243,69 @@
       jobs = [
         {
           type = "sink";
-          # must not change
-          name = "backup-from-eldiron";
+          name = "backup-from-immae-eu";
           root_fs = "zpool/backup";
           serve.type = "tls";
-          serve.listen = ":19000";
-          serve.ca = config.secrets.fullPaths."zrepl/certificates/eldiron.crt";
+          serve.listen = "192.168.1.8:19000";
+          serve.ca = config.secrets.fullPaths."zrepl/certificates/ca.crt";
           serve.cert = config.secrets.fullPaths."zrepl/certificates/dilion.crt";
           serve.key = config.secrets.fullPaths."zrepl/dilion.key";
           serve.client_cns = [ "eldiron" ];
         }
         {
-          type = "source";
+          type = "push";
           # must not change
-          name = "backup-to-wd-zpool";
-          # not encrypted!
-          serve.type = "tls";
-          serve.listen = ":19001";
-          serve.ca = config.secrets.fullPaths."zrepl/certificates/flony.crt";
-          serve.cert = config.secrets.fullPaths."zrepl/certificates/dilion.crt";
-          serve.key = config.secrets.fullPaths."zrepl/dilion.key";
-          serve.client_cns = [ "flony" ];
-          filesystems."zpool/libvirt<" = true;
+          name = "backup-to-raspi-encrypted";
           filesystems."zpool/root<" = true;
-          snapshotting.type = "manual";
+          filesystems."zpool/root/tmp" = false;
+          connect = {
+            address = "192.168.44.101:19025";
+            type = "tls";
+            server_cn = "raspi";
+            ca = config.secrets.fullPaths."zrepl/certificates/ca.crt";
+            cert = config.secrets.fullPaths."zrepl/certificates/dilion.crt";
+            key = config.secrets.fullPaths."zrepl/dilion.key";
+          };
+          send.encrypted = true;
+          snapshotting = {
+            type = "cron";
+            prefix = "raspi_zrepl_";
+            cron = "30 1 * * *"; # Europe/Paris
+          };
+          pruning.keep_sender = [
+            { type = "regex"; negate = true; regex = "^raspi_zrepl_.*"; }
+            { type = "grid"; grid = "3x1d"; regex = "^raspi_zrepl_.*"; }
+          ];
+          pruning.keep_receiver = [
+            { type = "grid"; grid = "3x1d"; regex = "^raspi_zrepl_.*"; }
+          ];
         }
         {
-          type = "source";
+          type = "push";
           # must not change
-          name = "backup-to-wd-zpool-docker";
-          # not encrypted!
-          serve.type = "tls";
-          serve.listen = ":19002";
-          serve.ca = config.secrets.fullPaths."zrepl/certificates/flony.crt";
-          serve.cert = config.secrets.fullPaths."zrepl/certificates/dilion.crt";
-          serve.key = config.secrets.fullPaths."zrepl/dilion.key";
-          serve.client_cns = [ "flony" ];
+          name = "backup-to-raspi-clear";
           filesystems."zpool/docker<" = true;
-          snapshotting.type = "manual";
+          filesystems."zpool/libvirt<" = true;
+          connect = {
+            address = "192.168.44.101:19025";
+            type = "tls";
+            server_cn = "raspi";
+            ca = config.secrets.fullPaths."zrepl/certificates/ca.crt";
+            cert = config.secrets.fullPaths."zrepl/certificates/dilion.crt";
+            key = config.secrets.fullPaths."zrepl/dilion.key";
+          };
+          snapshotting = {
+            type = "cron";
+            prefix = "raspi_zrepl_";
+            cron = "0 1 * * *"; # Europe/Paris
+          };
+          pruning.keep_sender = [
+            { type = "regex"; negate = true; regex = "^raspi_zrepl_.*"; }
+            { type = "grid"; grid = "3x1d"; regex = "^raspi_zrepl_.*"; }
+          ];
+          pruning.keep_receiver = [
+            { type = "grid"; grid = "3x1d"; regex = "^raspi_zrepl_.*"; }
+          ];
         }
       ];
     };