1 files changed, 49 insertions, 0 deletions

diff --git a/systems/zoldene/base.nix b/systems/zoldene/base.nix
index d580f99..7fc59e8 100644
--- a/systems/zoldene/base.nix
+++ b/systems/zoldene/base.nix
@@ -17,6 +17,55 @@ in
     ./database.nix
   ];
 
+  secrets.keys = {
+    "zrepl/${name}.key" = {
+      permissions = "0400";
+      text = config.myEnv.zrepl_backup.certs."${name}".key;
+      user = "root";
+      group = "root";
+    };
+  } // builtins.listToAttrs (map (x: lib.attrsets.nameValuePair "zrepl/certificates/${x}.crt" {
+    permissions = "0400";
+    text = config.myEnv.zrepl_backup.certs."${x}".certificate;
+    user = "root";
+    group = "root";
+  }) (builtins.attrNames config.myEnv.zrepl_backup.certs));
+
+  services.zrepl = {
+    enable = true;
+    settings = {
+      jobs = [
+        {
+          type = "push";
+          # must not change
+          name = "backup-to-raspi";
+          filesystems."zfast/root/persist<" = true;
+          filesystems."zpool/root/persist<" = true;
+          connect = {
+            address = "192.168.44.101:19025";
+            type = "tls";
+            server_cn = "raspi";
+            ca = config.secrets.fullPaths."zrepl/certificates/ca.crt";
+            cert = config.secrets.fullPaths."zrepl/certificates/zoldene.crt";
+            key = config.secrets.fullPaths."zrepl/zoldene.key";
+          };
+          snapshotting = {
+            type = "cron";
+            prefix = "raspi_zrepl_";
+            cron = "35 23 * * *";
+          };
+          pruning.keep_sender = [
+            { type = "regex"; negate = true; regex = "^raspi_zrepl_.*"; }
+            { type = "grid"; grid = "3x1d"; regex = "^raspi_zrepl_.*"; }
+          ];
+          pruning.keep_receiver = [
+            { type = "grid"; grid = "3x1d"; regex = "^raspi_zrepl_.*"; }
+          ];
+        }
+      ];
+    };
+  };
+
   services.borgBackup.enable = true;
   services.borgBackup.cronSpec = "0 20 * * *";
   disko.devices.zpool.zfast.datasets."root/persist/var/lib/borgbackup" =