From 2a216838ecc562532344884566fdfa33935b2b7d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Leon=20Schwarz=C3=A4ugl?= Date: Sat, 24 May 2025 18:12:11 +0200 Subject: [PATCH] feat: add restic configuration for winters --- SwarselSystems.org | 45 ++++- index.html | 239 +++++++++++++++---------- modules/nixos/server/restic.nix | 42 ++++- profiles/nixos/localserver/default.nix | 1 + scripts/swarsel-install.sh | 1 + scripts/swarsel-rebuild.sh | 1 + secrets/winters/secrets.yaml | 14 +- 7 files changed, 233 insertions(+), 110 deletions(-) diff --git a/SwarselSystems.org b/SwarselSystems.org index 8d23c06..949daef 100644 --- a/SwarselSystems.org +++ b/SwarselSystems.org @@ -2990,6 +2990,7 @@ This program sets up a new NixOS host remotely. It also takes care of secret man rm modules/home/common/git.nix rm modules/home/common/mail.nix rm modules/home/common/yubikey.nix + rm modules/nixos/server/restic.nix rm modules/nixos/common/home-manager-extra.nix nix flake update vbc-nix git add . @@ -3125,6 +3126,7 @@ if [[ $local_keys != *"${pub_arr[1]}"* ]]; then rm modules/home/common/git.nix rm modules/home/common/mail.nix rm modules/home/common/yubikey.nix + rm modules/nixos/server/restic.nix rm modules/nixos/common/home-manager-extra.nix rm -rf modules/nixos/server rm -rf modules/home/server @@ -4029,6 +4031,7 @@ Modules that need to be loaded on the NixOS level. Note that these will not be a nginx = lib.mkDefault true; ssh = lib.mkDefault true; kavita = lib.mkDefault true; + restic = lib.mkDefault true; jellyfin = lib.mkDefault true; navidrome = lib.mkDefault true; spotifyd = lib.mkDefault true; @@ -7736,12 +7739,50 @@ Here we just define some aliases for rebuilding the system, and we allow some in Once this is finished, it will house a restic client that manages automatic backups of my image library. Before I get to this however, I first need to organice my pictures in the first place. #+begin_src nix :tangle modules/nixos/server/restic.nix - { lib, config, ... }: + { lib, config, inputs, ... }: + let + secretsDirectory = builtins.toString inputs.nix-secrets; + resticRepo = lib.swarselsystems.getSecret "${secretsDirectory}/restic/wintersRepo"; + in { options.swarselsystems.modules.server.restic = lib.mkEnableOption "enable restic backups on server"; config = lib.mkIf config.swarselsystems.modules.server.restic { - # TODO + sops = { + secrets = { + resticpw = { }; + resticaccesskey = { }; + resticsecretaccesskey = { }; + }; + templates = { + "restic-env".content = '' + AWS_ACCESS_KEY_ID=${config.sops.placeholder.resticaccesskey} + AWS_SECRET_ACCESS_KEY=${config.sops.placeholder.resicsecretaccesskey} + ''; + }; + }; + + services.restic = { + backups = { + SwarselWinters = { + environmentFile = config.sops.templates."restic-env".path; + passwordFile = config.sops.secrets.resticpw.path; + paths = [ + "/Vault/data/paperless" + "/Vault/Eternor/Paperless" + "/Vault/data/paperless" + "/Vault/Eternor/Bilder" + "/Vault/Eternor/Immich" + ]; + repository = "${resticRepo}"; + initialize = true; + timerConfig = { + OnCalendar = "19:00"; + }; + }; + + }; + }; }; } diff --git a/index.html b/index.html index 96c53b7..2f2272c 100644 --- a/index.html +++ b/index.html @@ -3,7 +3,7 @@ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> - + SwarselSystems: NixOS + Emacs Configuration @@ -263,9 +263,9 @@
  • 3.1.4.3. Home-manager only (default non-NixOS)
  • 3.1.4.4. ChaosTheatre (Demo Physical/VM)
    • @@ -305,7 +305,7 @@
  • 3.2.1.27. fhs
  • 3.2.1.28. swarsel-displaypower
  • 3.2.1.29. swarsel-mgba
    • -
  • 3.2.1.30. sshrm
    • +
  • 3.2.1.30. sshrm
  • 3.2.2. Overlays (additions, overrides, nixpkgs-stable)
    • @@ -313,28 +313,28 @@ @@ -379,7 +379,7 @@
  • 3.3.1.22.3. enable GVfs
  • 3.3.1.22.4. interception-tools: Make CAPS work as ESC/CTRL
  • 3.3.1.22.5. power-profiles-daemon
    • -
  • 3.3.1.22.6. SwayOSD
    • +
  • 3.3.1.22.6. SwayOSD
  • 3.3.1.23. Hardware compatibility settings (Yubikey, Ledger, Keyboards) - udev rules @@ -445,11 +445,11 @@
  • 3.3.4.3. VmWare
  • 3.3.4.4. Auto-login
  • 3.3.4.5. nswitch-rcm
    • -
  • 3.3.4.6. Framework
    • -
  • 3.3.4.7. AMD CPU
    • -
  • 3.3.4.8. AMD GPU
    • -
  • 3.3.4.9. Hibernation
    • -
  • 3.3.4.10. BTRFS
    • +
  • 3.3.4.6. Framework
    • +
  • 3.3.4.7. AMD CPU
    • +
  • 3.3.4.8. AMD GPU
    • +
  • 3.3.4.9. Hibernation
    • +
  • 3.3.4.10. BTRFS
  • 3.3.4.11. work
  • 3.3.4.12. Minimal Install
    • @@ -498,7 +498,7 @@
  • 3.4.1.29.1. gnome-keyring
  • 3.4.1.29.2. KDE Connect
  • 3.4.1.29.3. Mako
    • -
  • 3.4.1.29.4. SwayOSD
    • +
  • 3.4.1.29.4. SwayOSD
  • 3.4.1.29.5. yubikey-touch-detector
    • @@ -523,7 +523,7 @@ @@ -701,7 +701,7 @@ @@ -710,7 +710,7 @@

    -This file has 62553 words spanning 16386 lines and was last revised on 2025-05-24 17:27:46 +0200. +This file has 62656 words spanning 16427 lines and was last revised on 2025-05-24 18:24:21 +0200.

    @@ -763,7 +763,7 @@ This section defines my Emacs configuration. For a while, I considered to use ry

    -My emacs is built using the emacs-overlay nix flake, which builds a bleeding edge emacs on wayland (pgtk) with utilities like treesitter support. By executing the below source block, the current build setting can be updated at any time, and you can see my most up-to-date build options (last updated: 2025-05-24 17:27:46 +0200) +My emacs is built using the emacs-overlay nix flake, which builds a bleeding edge emacs on wayland (pgtk) with utilities like treesitter support. By executing the below source block, the current build setting can be updated at any time, and you can see my most up-to-date build options (last updated: 2025-05-24 18:24:21 +0200)

    @@ -2800,8 +2800,8 @@ This is just a demo host. It applies all the configuration found in the common p I also set the WLR_RENDERER_ALLOW_SOFTWARE=1 to allow this configuration to run in a virtualized environment. I also enable qemuGuest for a smoother experience when testing on QEMU.

    -
    -
    3.1.4.4.1. Main configuration
    +
    +
    3.1.4.4.1. Main configuration
    { self, inputs, config, pkgs, lib, primaryUser, ... }:
@@ -2880,8 +2880,8 @@ in
    -
    -
    3.1.4.4.2. NixOS dummy options configuration
    +
    +
    3.1.4.4.2. NixOS dummy options configuration
    _:
@@ -2891,8 +2891,8 @@ in
    -
    -
    3.1.4.4.3. home-manager dummy options configuration
    +
    +
    3.1.4.4.3. home-manager dummy options configuration
    _:
@@ -4049,6 +4049,7 @@ if [[ $local_keys != *"${pub_arr[1]}"* ]]; then
     rm modules/home/common/git.nix
     rm modules/home/common/mail.nix
     rm modules/home/common/yubikey.nix
+    rm modules/nixos/server/restic.nix
     rm modules/nixos/common/home-manager-extra.nix
     nix flake update vbc-nix
     git add .
@@ -4187,6 +4188,7 @@ if [[ $local_keys != *"${pub_arr[1]}"* ]]; then
     rm modules/home/common/git.nix
     rm modules/home/common/mail.nix
     rm modules/home/common/yubikey.nix
+    rm modules/nixos/server/restic.nix
     rm modules/nixos/common/home-manager-extra.nix
     rm -rf modules/nixos/server
     rm -rf modules/home/server
@@ -4667,8 +4669,8 @@ appimageTools.wrapType2 {
    -
    -
    3.2.1.30. sshrm
    +
    +
    3.2.1.30. sshrm

    This programs simply runs ssh-keygen on the last host that I tried to ssh into. I need this frequently when working with cloud-init usually. @@ -4817,8 +4819,8 @@ in

    -
    -
    3.2.3.1.1. Personal
    +
    +
    3.2.3.1.1. Personal
    { lib, config, ... }:
@@ -4885,8 +4887,8 @@ in
    -
    -
    3.2.3.1.2. Chaostheatre
    +
    +
    3.2.3.1.2. Chaostheatre
    { lib, config, ... }:
@@ -4950,8 +4952,8 @@ in
    -
    -
    3.2.3.1.3. toto
    +
    +
    3.2.3.1.3. toto
    { lib, config, ... }:
@@ -4983,8 +4985,8 @@ in
    -
    -
    3.2.3.1.4. Work
    +
    +
    3.2.3.1.4. Work
    { lib, config, ... }:
@@ -5005,8 +5007,8 @@ in
    -
    -
    3.2.3.1.5. Framework
    +
    +
    3.2.3.1.5. Framework
    { lib, config, ... }:
@@ -5027,8 +5029,8 @@ in
    -
    -
    3.2.3.1.6. AMD CPU
    +
    +
    3.2.3.1.6. AMD CPU
    { lib, config, ... }:
@@ -5049,8 +5051,8 @@ in
    -
    -
    3.2.3.1.7. AMD GPU
    +
    +
    3.2.3.1.7. AMD GPU
    { lib, config, ... }:
@@ -5071,8 +5073,8 @@ in
    -
    -
    3.2.3.1.8. Hibernation
    +
    +
    3.2.3.1.8. Hibernation
    { lib, config, ... }:
@@ -5093,8 +5095,8 @@ in
    -
    -
    3.2.3.1.9. BTRFS
    +
    +
    3.2.3.1.9. BTRFS
    { lib, config, ... }:
@@ -5115,8 +5117,8 @@ in
    -
    -
    3.2.3.1.10. Local Server
    +
    +
    3.2.3.1.10. Local Server
    { lib, config, ... }:
@@ -5142,6 +5144,7 @@ in
           nginx = lib.mkDefault true;
           ssh = lib.mkDefault true;
           kavita = lib.mkDefault true;
+          restic = lib.mkDefault true;
           jellyfin = lib.mkDefault true;
           navidrome = lib.mkDefault true;
           spotifyd = lib.mkDefault true;
@@ -5166,8 +5169,8 @@ in
    -
    -
    3.2.3.1.11. OCI Sync Server
    +
    +
    3.2.3.1.11. OCI Sync Server
    { lib, config, ... }:
@@ -5224,8 +5227,8 @@ in
    -
    -
    3.2.3.2.1. Personal
    +
    +
    3.2.3.2.1. Personal
    { lib, config, ... }:
@@ -5282,8 +5285,8 @@ in
    -
    -
    3.2.3.2.2. Chaostheatre
    +
    +
    3.2.3.2.2. Chaostheatre
    { lib, config, ... }:
@@ -5335,8 +5338,8 @@ in
    -
    -
    3.2.3.2.3. toto
    +
    +
    3.2.3.2.3. toto
    { lib, config, ... }:
@@ -5356,8 +5359,8 @@ in
    -
    -
    3.2.3.2.4. Work
    +
    +
    3.2.3.2.4. Work
    { lib, config, ... }:
@@ -5377,8 +5380,8 @@ in
    -
    -
    3.2.3.2.5. Framework
    +
    +
    3.2.3.2.5. Framework
    { lib, config, ... }:
@@ -5399,8 +5402,8 @@ in
    -
    -
    3.2.3.2.6. Darwin
    +
    +
    3.2.3.2.6. Darwin
    { lib, config, ... }:
@@ -5418,8 +5421,8 @@ in
    -
    -
    3.2.3.2.7. Local Server
    +
    +
    3.2.3.2.7. Local Server
    { lib, config, ... }:
@@ -6952,8 +6955,8 @@ Most of the time I am using power-saver, however, it is good to be
    -
    -
    3.3.1.22.6. SwayOSD
    +
    +
    3.3.1.22.6. SwayOSD
    { lib, pkgs, config, ... }:
@@ -9027,12 +9030,50 @@ Once this is finished, it will house a restic client that manages automatic back
 
    
 
 
    
-
    { lib, config, ... }:
+
    { lib, config, inputs, ... }:
+let
+  secretsDirectory = builtins.toString inputs.nix-secrets;
+  resticRepo = lib.swarselsystems.getSecret "${secretsDirectory}/restic/wintersRepo";
+in
 {
   options.swarselsystems.modules.server.restic = lib.mkEnableOption "enable restic backups on server";
   config = lib.mkIf config.swarselsystems.modules.server.restic {
 
-    # TODO
+    sops = {
+      secrets = {
+        resticpw = { };
+        resticaccesskey = { };
+        resticsecretaccesskey = { };
+      };
+      templates = {
+        "restic-env".content = ''
+          AWS_ACCESS_KEY_ID=${config.sops.placeholder.resticaccesskey}
+          AWS_SECRET_ACCESS_KEY=${config.sops.placeholder.resicsecretaccesskey}
+        '';
+      };
+    };
+
+    services.restic = {
+      backups = {
+        SwarselWinters = {
+          environmentFile = config.sops.templates."restic-env".path;
+          passwordFile = config.sops.secrets.resticpw.path;
+          paths = [
+            "/Vault/data/paperless"
+            "/Vault/Eternor/Paperless"
+            "/Vault/data/paperless"
+            "/Vault/Eternor/Bilder"
+            "/Vault/Eternor/Immich"
+          ];
+          repository = "${resticRepo}";
+          initialize = true;
+          timerConfig = {
+            OnCalendar = "19:00";
+          };
+        };
+
+      };
+    };
 
   };
 }
@@ -9665,8 +9706,8 @@ This smashes Atmosphere 1.3.2 on the switch, which is what I am currenty using.
    -
    -
    3.3.4.6. Framework
    +
    +
    3.3.4.6. Framework

    This holds configuration that is specific to framework laptops. @@ -9704,8 +9745,8 @@ This holds configuration that is specific to framework laptops.

    -
    -
    3.3.4.7. AMD CPU
    +
    +
    3.3.4.7. AMD CPU
    { lib, config, ... }:
@@ -9721,8 +9762,8 @@ This holds configuration that is specific to framework laptops.
    -
    -
    3.3.4.8. AMD GPU
    +
    +
    3.3.4.8. AMD GPU
    { lib, config, ... }:
@@ -9744,8 +9785,8 @@ This holds configuration that is specific to framework laptops.
    -
    -
    3.3.4.9. Hibernation
    +
    +
    3.3.4.9. Hibernation
    { lib, config, ... }:
@@ -9776,8 +9817,8 @@ This holds configuration that is specific to framework laptops.
    -
    -
    3.3.4.10. BTRFS
    +
    +
    3.3.4.10. BTRFS
    { lib, config, ... }:
@@ -12693,8 +12734,8 @@ The `extraConfig` section here CANNOT be reindented. This has something to do wi
    -
    -
    3.4.1.29.4. SwayOSD
    +
    +
    3.4.1.29.4. SwayOSD
    { lib, config, ... }:
@@ -13943,8 +13984,8 @@ in
    -
    -
    3.4.4.3. Framework
    +
    +
    3.4.4.3. Framework

    This holds configuration that is specific to framework laptops. @@ -17784,8 +17825,8 @@ autocmd DocStart vc-impimba-1.m.imp.ac.at/ui/webconsole mode ignore

    -
    -

    6.3. tridactyl theme

    +
    +

    6.3. tridactyl theme

    @@ -18282,7 +18323,7 @@ sync USER HOST:

    Author: Leon Schwarzäugl

    -

    Created: 2025-05-24 Sa 17:27

    +

    Created: 2025-05-24 Sa 18:24

    Validate

    diff --git a/modules/nixos/server/restic.nix b/modules/nixos/server/restic.nix index e5b092c..ce7dfc4 100644 --- a/modules/nixos/server/restic.nix +++ b/modules/nixos/server/restic.nix @@ -1,9 +1,47 @@ -{ lib, config, ... }: +{ lib, config, inputs, ... }: +let + secretsDirectory = builtins.toString inputs.nix-secrets; + resticRepo = lib.swarselsystems.getSecret "${secretsDirectory}/restic/wintersRepo"; +in { options.swarselsystems.modules.server.restic = lib.mkEnableOption "enable restic backups on server"; config = lib.mkIf config.swarselsystems.modules.server.restic { - # TODO + sops = { + secrets = { + resticpw = { }; + resticaccesskey = { }; + resticsecretaccesskey = { }; + }; + templates = { + "restic-env".content = '' + AWS_ACCESS_KEY_ID=${config.sops.placeholder.resticaccesskey} + AWS_SECRET_ACCESS_KEY=${config.sops.placeholder.resicsecretaccesskey} + ''; + }; + }; + + services.restic = { + backups = { + SwarselWinters = { + environmentFile = config.sops.templates."restic-env".path; + passwordFile = config.sops.secrets.resticpw.path; + paths = [ + "/Vault/data/paperless" + "/Vault/Eternor/Paperless" + "/Vault/data/paperless" + "/Vault/Eternor/Bilder" + "/Vault/Eternor/Immich" + ]; + repository = "${resticRepo}"; + initialize = true; + timerConfig = { + OnCalendar = "19:00"; + }; + }; + + }; + }; }; } diff --git a/profiles/nixos/localserver/default.nix b/profiles/nixos/localserver/default.nix index fb1bb29..824367b 100644 --- a/profiles/nixos/localserver/default.nix +++ b/profiles/nixos/localserver/default.nix @@ -21,6 +21,7 @@ nginx = lib.mkDefault true; ssh = lib.mkDefault true; kavita = lib.mkDefault true; + restic = lib.mkDefault true; jellyfin = lib.mkDefault true; navidrome = lib.mkDefault true; spotifyd = lib.mkDefault true; diff --git a/scripts/swarsel-install.sh b/scripts/swarsel-install.sh index 5f105b8..e3258fc 100644 --- a/scripts/swarsel-install.sh +++ b/scripts/swarsel-install.sh @@ -100,6 +100,7 @@ if [[ $local_keys != *"${pub_arr[1]}"* ]]; then rm modules/home/common/git.nix rm modules/home/common/mail.nix rm modules/home/common/yubikey.nix + rm modules/nixos/server/restic.nix rm modules/nixos/common/home-manager-extra.nix rm -rf modules/nixos/server rm -rf modules/home/server diff --git a/scripts/swarsel-rebuild.sh b/scripts/swarsel-rebuild.sh index 0801648..9ce5291 100644 --- a/scripts/swarsel-rebuild.sh +++ b/scripts/swarsel-rebuild.sh @@ -82,6 +82,7 @@ if [[ $local_keys != *"${pub_arr[1]}"* ]]; then rm modules/home/common/git.nix rm modules/home/common/mail.nix rm modules/home/common/yubikey.nix + rm modules/nixos/server/restic.nix rm modules/nixos/common/home-manager-extra.nix nix flake update vbc-nix git add . diff --git a/secrets/winters/secrets.yaml b/secrets/winters/secrets.yaml index 512ef2f..7a55f1a 100644 --- a/secrets/winters/secrets.yaml +++ b/secrets/winters/secrets.yaml @@ -37,11 +37,11 @@ grafanaadminpass: ENC[AES256_GCM,data:TBu0WOdvE+9CAH8EVm8=,iv:/usKOYscSXpo8tiSV/ prometheusadminpass: ENC[AES256_GCM,data:NYUbSnAl0f3FUtvCjvJHFr2wMRsVsbVIeg==,iv:TP4NMwJsft8aEixxJBJCX/0I6BJVBnltFYJDKuXq1hM=,tag:yMY+KZsRjbn8ItgKgjzqSA==,type:str] #ENC[AES256_GCM,data:QnIF/xhWguX5tw==,iv:yTUBtPaZk6BXi+SC1P/OOtnc2x9UZ/jXirD5oaxhyQY=,tag:c33L5r5BaPZN6zkwduBCwQ==,type:comment] fresh: ENC[AES256_GCM,data:aPF8D96BvgDXhcc=,iv:Ubq3/sUmBipRanLgkAXXeAfXAz51AuR+NojMifsy8S0=,tag:mHf0YYYxulLXAIByqmnOsA==,type:str] +#ENC[AES256_GCM,data:Ur0/rfBv5g==,iv:eH+KbbkmtBWbobqAIUFF0jIrGhbHnk9g8hLZoxE3swI=,tag:3dnoA+O5GXW5Dvxcx4jiTw==,type:comment] +resticpw: ENC[AES256_GCM,data:0oHhUFH+2W7FONA=,iv:jT6o3H4pIkGTANriDVCBvnOsc/XITEGCayb6A86NlGg=,tag:qU3tAvIWFSFIf1krWAJ0+Q==,type:str] +resticaccesskey: ENC[AES256_GCM,data:3EshJOZpoHqGrKdERYBtUcQZ6taZEe8PBA==,iv:3np3ASFhJrYT1ig3uSpb48lSdZOFl9kFyLJSkYHBnqo=,tag:TqjgnO1XRPZUGjLI20FqUg==,type:str] +resticsecretaccesskey: ENC[AES256_GCM,data:j57l4p5viLZ2yL/KDrQpq1Dov69kpCRgzS4uEHgh4A==,iv:CYTxd4Vy1V+aW6EdaEOIma5vyDRL/VR6MlHqmAM1JQI=,tag:zLl0UZ50uN8YIrL+nOfurg==,type:str] sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] age: - recipient: age1h72072slm2pthn9m2qwjsyy2dsazc6hz97kpzh4gksvv0r2jqecqul8w63 enc: | @@ -52,8 +52,8 @@ sops: MEZ1UWw3alF1WnJZMFZvMFBpbDFJZlUKGRnoEEgjgJ9SSblmldtY6d8MdAy01yxl qkvEIoXbL+ky2ira7EgjD0legThzCnmlXUlcSn3SpwbkAGgcfd2kWA== -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-12-16T14:43:24Z" - mac: ENC[AES256_GCM,data:vDSegkEgy255XQ3NYqfZXOxV21QYIPeEmM5U5B51PQBcs13CEMwTcKx26wDznsUrqU/N9xnpHaZlYBYjCqul7uhuLG6Le3a30b4la8MNtZRsIoRJqhVlim1II+X/kcrm3RlCJ6r8g8AjAj4SDXdamkXQ02+ckeS8wwNhREBbZsA=,iv:Ik/PE5mJQY+x1xvmJGE3AWK2sVUqYGNcz4zYasxZBaU=,tag:rBrILXohBC9T47PY3sYwYg==,type:str] + lastmodified: "2025-05-24T16:09:43Z" + mac: ENC[AES256_GCM,data:K6x8RdvbXEQMBMnhXL1vnD9urEGgsm+bg5WVIBExvML0ptkIX88AIXF9GPaOFdPJ7idKRrXe1euajGyDJZTZeM95auvEuw8Dyb3xC/2l21X9pAOlWQwhWNlilUu/G/JO56lXTxeIGS7qA1oUYRYGRyZYICbYssymcH/urcKGPZE=,iv:4QCTjTb1vs/7xWyvGC1eARMqaFAgkzKBsnxQIWv06gk=,tag:by8DbsqBHYbe3Xe+EbDIRA==,type:str] pgp: - created_at: "2024-12-17T16:24:32Z" enc: |- @@ -87,4 +87,4 @@ sops: -----END PGP MESSAGE----- fp: 4BE7925262289B476DBBC17B76FD3810215AE097 unencrypted_suffix: _unencrypted - version: 3.9.1 + version: 3.10.2