summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--modules/default.nix1
-rw-r--r--modules/rsync_backup/default.nix262
2 files changed, 263 insertions, 0 deletions
diff --git a/modules/default.nix b/modules/default.nix
index 18bee9af..9ff6ea62 100644
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -14,6 +14,7 @@
14 openarc = ./openarc.nix; 14 openarc = ./openarc.nix;
15 15
16 duplyBackup = ./duply_backup; 16 duplyBackup = ./duply_backup;
17 rsyncBackup = ./rsync_backup;
17 naemon = ./naemon; 18 naemon = ./naemon;
18 19
19 php-application = ./websites/php-application.nix; 20 php-application = ./websites/php-application.nix;
diff --git a/modules/rsync_backup/default.nix b/modules/rsync_backup/default.nix
new file mode 100644
index 00000000..2ff47aa4
--- /dev/null
+++ b/modules/rsync_backup/default.nix
@@ -0,0 +1,262 @@
1{ lib, pkgs, config, myconfig, ... }:
2let
3 partModule = lib.types.submodule {
4 options = {
5 remote_folder = lib.mkOption {
6 type = lib.types.path;
7 description = ''
8 Path to backup
9 '';
10 };
11 exclude_from = lib.mkOption {
12 type = lib.types.listOf lib.types.path;
13 default = [];
14 description = ''
15 Paths to exclude from the backup
16 '';
17 };
18 files_from = lib.mkOption {
19 type = lib.types.listOf lib.types.path;
20 default = [];
21 description = ''
22 Paths to take for the backup
23 (if empty: whole folder minus exclude_from)
24 '';
25 };
26 args = lib.mkOption {
27 type = lib.types.nullOr lib.types.str;
28 default = null;
29 description = ''
30 additional arguments for rsync
31 '';
32 };
33 };
34 };
35 profileModule = lib.types.submodule {
36 options = {
37 keep = lib.mkOption {
38 type = lib.types.int;
39 default = 7;
40 description = ''
41 Number of backups to keep
42 '';
43 };
44 login = lib.mkOption {
45 type = lib.types.str;
46 description = ''
47 login to connect to
48 '';
49 };
50 host = lib.mkOption {
51 type = lib.types.str;
52 description = ''
53 host to connect to
54 '';
55 };
56 port = lib.mkOption {
57 type = lib.types.str;
58 default = "22";
59 description = ''
60 port to connect to
61 '';
62 };
63 host_key = lib.mkOption {
64 type = lib.types.str;
65 description = ''
66 Host key to use as known host
67 '';
68 };
69 host_key_type = lib.mkOption {
70 type = lib.types.str;
71 description = ''
72 Host key type
73 '';
74 };
75 parts = lib.mkOption {
76 type = lib.types.attrsOf partModule;
77 description = ''
78 folders to backup in the host
79 '';
80 };
81 };
82 };
83 cfg = config.services.rsyncBackup;
84
85 ssh_key = config.secrets.fullPaths."rsync_backup/identity";
86
87 backup_head = mailto: ''
88 #!${pkgs.stdenv.shell}
89 EXCL_FROM=`mktemp`
90 FILES_FROM=`mktemp`
91 TMP_STDERR=`mktemp`
92
93 on_exit() {
94 ${lib.optionalString (mailto != null) ''
95 MAILTO="${mailto}"
96 if [ -s "$TMP_STDERR" ]; then
97 cat "$TMP_STDERR" | ${pkgs.mailutils}/bin/mail -s "save_distant rsync error" "$MAILTO"
98 fi
99 ''}
100 rm -f $TMP_STDERR $EXCL_FROM $FILES_FROM
101 }
102
103 trap "on_exit" EXIT
104
105 exec 2> "$TMP_STDERR"
106 exec < /dev/null
107
108 set -e
109 '';
110
111 backup_profile = name: profile: builtins.concatStringsSep "\n" (
112 [(backup_profile_head name profile)]
113 ++ lib.mapAttrsToList (backup_part name) profile.parts
114 ++ [(backup_profile_tail name profile)]);
115
116 backup_profile_head = name: profile: ''
117 ##### ${name} #####
118 PORT="${profile.port}"
119 DEST="${profile.login}@${profile.host}"
120 BASE="${cfg.mountpoint}/${name}"
121 OLD_BAK_BASE=$BASE/older/j
122 BAK_BASE=''${OLD_BAK_BASE}0
123 RSYNC_OUTPUT=$BASE/rsync_output
124 NBR=${builtins.toString profile.keep}
125
126 if ! ssh \
127 -o PreferredAuthentications=publickey \
128 -o StrictHostKeyChecking=yes \
129 -o ClearAllForwardings=yes \
130 -p $PORT \
131 -i ${ssh_key} \
132 $DEST backup; then
133 echo "Fichier de verrouillage backup sur $DEST ou impossible de se connecter" >&2
134 skip=$DEST
135 fi
136
137 rm -rf ''${OLD_BAK_BASE}''${NBR}
138 for j in `seq -w $(($NBR-1)) -1 0`; do
139 [ ! -d ''${OLD_BAK_BASE}$j ] && continue
140 mv ''${OLD_BAK_BASE}$j ''${OLD_BAK_BASE}$(($j+1))
141 done
142 mkdir $BAK_BASE
143 mv $RSYNC_OUTPUT $BAK_BASE
144 mkdir $RSYNC_OUTPUT
145
146 if [ "$skip" != "$DEST" ]; then
147 '';
148
149 backup_profile_tail = name: profile: ''
150 ssh -i ${ssh_key} -p $PORT $DEST sh -c "date > .cache/last_backup"
151 fi # [ "$skip" != "$DEST" ]
152 ##### End ${name} #####
153 '';
154
155 backup_part = profile_name: part_name: part: ''
156 ### ${profile_name} ${part_name} ###
157 LOCAL="${part_name}"
158 REMOTE="${part.remote_folder}"
159
160 if [ ! -d "$BASE/$LOCAL" ]; then
161 mkdir $BASE/$LOCAL
162 fi
163 cd $BASE/$LOCAL
164 cat > $EXCL_FROM <<EOF
165 ${builtins.concatStringsSep "\n" part.exclude_from}
166 EOF
167 cat > $FILES_FROM <<EOF
168 ${builtins.concatStringsSep "\n" part.files_from}
169 EOF
170
171 OUT=$RSYNC_OUTPUT/$LOCAL
172 ${pkgs.rsync}/bin/rsync -XAavbrz --fake-super -e "ssh -i ${ssh_key} -p $PORT" --numeric-ids --delete \
173 --backup-dir=$BAK_BASE/$LOCAL \${
174 lib.optionalString (part.args != null) "\n ${part.args} \\"}${
175 lib.optionalString (builtins.length part.exclude_from > 0) "\n --exclude-from=$EXCL_FROM \\"}${
176 lib.optionalString (builtins.length part.files_from > 0) "\n --files-from=$FILES_FROM \\"}
177 $DEST:$REMOTE . > $OUT || true
178 ### End ${profile_name} ${part_name} ###
179 '';
180in
181{
182 options.services.rsyncBackup = {
183 mountpoint = lib.mkOption {
184 type = lib.types.path;
185 description = "Path to the base folder for backups";
186 };
187 mailto = lib.mkOption {
188 type = lib.types.nullOr lib.types.str;
189 default = null;
190 description = "E-mail to send the report to";
191 };
192 profiles = lib.mkOption {
193 type = lib.types.attrsOf profileModule;
194 default = {};
195 description = ''
196 Profiles to backup
197 '';
198 };
199 ssh_key_public = lib.mkOption {
200 type = lib.types.str;
201 description = "Public key for the backup";
202 };
203 ssh_key_private = lib.mkOption {
204 type = lib.types.str;
205 description = "Private key for the backup";
206 };
207 };
208
209 config = lib.mkIf (builtins.length (builtins.attrNames cfg.profiles) > 0) {
210 # FIXME: monitoring to check that backup is less than 14h old
211 users.users.backup = {
212 isSystemUser = true;
213 uid = config.ids.uids.backup;
214 group = "backup";
215 extraGroups = [ "keys" ];
216 };
217
218 users.groups.backup = {
219 gid = config.ids.gids.backup;
220 };
221
222 services.cron.systemCronJobs = let
223 backup = pkgs.writeScript "backup.sh" (builtins.concatStringsSep "\n" ([
224 (backup_head cfg.mailto)
225 ] ++ lib.mapAttrsToList backup_profile cfg.profiles));
226 in [
227 ''
228 25 3,15 * * * backup ${backup}
229 ''
230 ];
231
232 programs.ssh.knownHosts = lib.attrsets.mapAttrs' (name: profile: lib.attrsets.nameValuePair name {
233 hostNames = [ profile.host ];
234 publicKey = "${profile.host_key_type} ${profile.host_key}";
235 }) cfg.profiles;
236
237 system.activationScripts.rsyncBackup = {
238 deps = [ "users" ];
239 text = builtins.concatStringsSep "\n" (map (v: ''
240 install -m 0700 -o backup -g backup -d ${cfg.mountpoint}/${v} ${cfg.mountpoint}/${v}/older ${cfg.mountpoint}/${v}/rsync_output
241 '') (builtins.attrNames cfg.profiles)
242 );
243 };
244
245 secrets.keys = [
246 {
247 dest = "rsync_backup/identity";
248 user = "backup";
249 group = "backup";
250 permissions = "0400";
251 text = cfg.ssh_key_private;
252 }
253 {
254 dest = "rsync_backup/identity.pub";
255 user = "backup";
256 group = "backup";
257 permissions = "0444";
258 text = cfg.ssh_key_public;
259 }
260 ];
261 };
262}