blob: 7034a91fe0dc4b3d96e49eae5c987e1c91e1fe7f (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
|
{ lib, pkgs, config, name, ... }:
let
cfg = config.myEnv.backup;
varDir = "/var/lib/duply";
duplyProfile = profile: remote: prefix: ''
GPG_PW="${cfg.password}"
TARGET="${cfg.remotes.${remote}.remote profile.bucket}${prefix}"
export AWS_ACCESS_KEY_ID="${cfg.remotes.${remote}.accessKeyId}"
export AWS_SECRET_ACCESS_KEY="${cfg.remotes.${remote}.secretAccessKey}"
SOURCE="${profile.rootDir}"
FILENAME=".duplicity-ignore"
DUPL_PARAMS="$DUPL_PARAMS --exclude-if-present '$FILENAME'"
VERBOSITY=4
ARCH_DIR="${varDir}/caches"
# Do a full backup after 1 month
MAX_FULLBKP_AGE=1M
DUPL_PARAMS="$DUPL_PARAMS --allow-source-mismatch --exclude-other-filesystems --full-if-older-than $MAX_FULLBKP_AGE "
# Backups older than 2months are deleted
MAX_AGE=2M
# Keep 2 full backups
MAX_FULL_BACKUPS=2
MAX_FULLS_WITH_INCRS=2
'';
action = "bkp_purge_purgeFull_purgeIncr";
varName = k: remoteName:
if remoteName == "eriomem" then k else remoteName + "_" + k;
in
{
options = {
services.duplyBackup.enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = ''
Whether to enable remote backups.
'';
};
services.duplyBackup.profiles = lib.mkOption {
type = lib.types.attrsOf (lib.types.submodule {
options = {
rootDir = lib.mkOption {
type = lib.types.path;
description = ''
Path to backup
'';
};
bucket = lib.mkOption {
type = lib.types.str;
default = "immae-${name}";
description = ''
Bucket to use
'';
};
remotes = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = ["eriomem"];
description = ''
Remotes to use for backup
'';
};
excludeFile = lib.mkOption {
type = lib.types.lines;
default = "";
description = ''
Content to put in exclude file
'';
};
};
});
};
};
config = lib.mkIf config.services.duplyBackup.enable {
system.activationScripts.backup = ''
install -m 0700 -o root -g root -d ${varDir} ${varDir}/caches
'';
secrets.keys = lib.flatten (lib.mapAttrsToList (k: v:
map (remote: [
{
permissions = "0400";
dest = "backup/${varName k remote}/conf";
text = duplyProfile v remote "${k}/";
}
{
permissions = "0400";
dest = "backup/${varName k remote}/exclude";
text = v.excludeFile;
}
{
permissions = "0500";
dest = "backup/${varName k remote}";
isDir = true;
}
]) v.remotes) config.services.duplyBackup.profiles);
services.cron = {
enable = true;
systemCronJobs = let
backups = pkgs.writeScript "backups" ''
#!${pkgs.stdenv.shell}
${builtins.concatStringsSep "\n" (lib.flatten (lib.mapAttrsToList (k: v:
map (remote: [
''
touch ${varDir}/${varName k remote}.log
${pkgs.duply}/bin/duply ${config.secrets.fullPaths."backup/${varName k remote}"}/ ${action} --force >> ${varDir}/${varName k remote}.log
[[ $? = 0 ]] || echo -e "Error when doing backup for ${varName k remote}, see above\n---------------------------------------" >&2
''
]) v.remotes
) config.services.duplyBackup.profiles))}
'';
in
[
"0 2 * * * root ${backups}"
];
};
security.pki.certificateFiles = [
(pkgs.fetchurl {
url = "http://downloads.e.eriomem.net/eriomemca.pem";
sha256 = "1ixx4c6j3m26j8dp9a3dkvxc80v1nr5aqgmawwgs06bskasqkvvh";
})
];
};
}
|
