Add module for backing up volume data to BorgBase
Back up freshrss volume
This commit is contained in:
parent
39125c71e1
commit
67e6ddbf90
5 changed files with 89 additions and 5 deletions
|
@ -5,6 +5,15 @@
|
|||
users.users.root.openssh.authorizedKeys.keys = config.pim.ssh.keys.pim ++ config.pim.ssh.keys.niels;
|
||||
pim.k3s.serverAddr = "https://jefke.dmz:6443";
|
||||
|
||||
pim.backups.borgBackups = {
|
||||
freshrss = {
|
||||
repo = "ssh://ty1l82m0@ty1l82m0.repo.borgbase.com/./repo";
|
||||
paths = ["/mnt/longhorn/persistent/volumes/freshrss"];
|
||||
deploymentName = "server";
|
||||
deploymentNamespace = "freshrss";
|
||||
};
|
||||
};
|
||||
|
||||
deployment = {
|
||||
targetHost = "atlas";
|
||||
targetUser = "root";
|
||||
|
|
69
nixos/backups-ng.nix
Normal file
69
nixos/backups-ng.nix
Normal file
|
@ -0,0 +1,69 @@
|
|||
{
|
||||
lib,
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
borgBackupOpts = {
|
||||
options = {
|
||||
repo = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
};
|
||||
paths = lib.mkOption {
|
||||
type = with lib.types; listOf str;
|
||||
};
|
||||
deploymentName = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
};
|
||||
deploymentNamespace = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
};
|
||||
replicaCount = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 1;
|
||||
};
|
||||
};
|
||||
};
|
||||
in {
|
||||
options.pim.backups = {
|
||||
borgBackups = lib.mkOption {
|
||||
type = with lib.types; attrsOf (submodule borgBackupOpts);
|
||||
default = {};
|
||||
};
|
||||
};
|
||||
|
||||
# TODO: should have some timeout and alerting?
|
||||
config = {
|
||||
services.borgbackup.jobs =
|
||||
lib.mapAttrs (_name: c: {
|
||||
inherit (c) repo paths;
|
||||
startAt = "*-*-* 00:00:00";
|
||||
# TODO: low benefit, but we could set borgbase's host keys here as they are published online.
|
||||
environment.BORG_RSH = "ssh -i ${config.sops.secrets."borg/borgbasePrivateKey".path} -o StrictHostKeychecking=no";
|
||||
postHook = "${pkgs.k3s}/bin/kubectl scale deployment -n ${c.deploymentNamespace} ${c.deploymentName} --replicas=${toString c.replicaCount}";
|
||||
|
||||
prune.keep = {
|
||||
within = "7d";
|
||||
weekly = 4;
|
||||
monthly = 6;
|
||||
};
|
||||
|
||||
preHook = ''
|
||||
${pkgs.k3s}/bin/kubectl scale deployment -n ${c.deploymentNamespace} ${c.deploymentName} --replicas=0
|
||||
|
||||
while [ -n "$(${pkgs.k3s}/bin/kubectl get deployment -n ${c.deploymentNamespace} ${c.deploymentName} -o jsonpath='{.status.replicas}')" ]; do
|
||||
echo "Waiting for replicas to scale down to 0..."
|
||||
sleep 2
|
||||
done
|
||||
'';
|
||||
|
||||
encryption = {
|
||||
passCommand = "cat ${config.sops.secrets."borg/borgPassphrase".path}";
|
||||
mode = "repokey-blake2";
|
||||
};
|
||||
})
|
||||
config.pim.backups.borgBackups;
|
||||
|
||||
systemd.timers = lib.mapAttrs' (name: _c: lib.nameValuePair "borgbackup-job-${name}" {timerConfig.RandomizedDelaySec = "1h";}) config.pim.backups.borgBackups;
|
||||
};
|
||||
}
|
|
@ -26,6 +26,7 @@
|
|||
./kubernetes
|
||||
./data-sharing.nix
|
||||
./backups.nix
|
||||
./backups-ng.nix
|
||||
];
|
||||
|
||||
options = {
|
||||
|
|
|
@ -63,8 +63,10 @@
|
|||
};
|
||||
};
|
||||
|
||||
sops.secrets."tailscale/authKey" = {
|
||||
sopsFile = "${self}/secrets/servers.yaml";
|
||||
sops.secrets = {
|
||||
"tailscale/authKey".sopsFile = "${self}/secrets/servers.yaml";
|
||||
"borg/borgPassphrase".sopsFile = "${self}/secrets/servers.yaml";
|
||||
"borg/borgbasePrivateKey".sopsFile = "${self}/secrets/servers.yaml";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
@ -1,5 +1,8 @@
|
|||
tailscale:
|
||||
authKey: ENC[AES256_GCM,data:3eXxQBY6AVqU4R1NlsyhGCfXW5wL58ODRH/f+zo5YFRad/ys1vB9JeKagq0SJSj/w4zxRAEpCf1o47Ypww==,iv:QklyIFuXlbH6cM/I0gqDH/Xeay9gqxqeyulQ7W/dbig=,tag:E/3UqtsfSVOi6otSlReO0Q==,type:str]
|
||||
borg:
|
||||
borgPassphrase: ENC[AES256_GCM,data:UWA2sBLPi63MRVOPTYPWYLujF2M=,iv:FQq/IsZK7LWo30gZc7oT2E9feCLn7Oeg6wDGuezkhu8=,tag:fWYaZUwJrM8x6cemXzz6xg==,type:str]
|
||||
borgbasePrivateKey: ENC[AES256_GCM,data:O7eIY1yvbnBTS96tt5a8vcOEOzit4tEbIHmxnSbNsowC7YNk2g6MShQ6ll86GDiunLY33/Px0bqq9+4z/dk4N3FWQ1v5KQjr/gh+CS8VpIrv9zLv+Ru9UzeWQusbYxqnCu/IAQ1aB8UGV2LSCesQ0r/B6XEe51Phi65uWkbUYa/8voSiws3T3hnNrUDqiHdzfBgWZIQszz7zD92Q+aXu/kGNSxVKbXjWVfqBiyDEtuLEWoC1eENeEs41Ov5YT0Lm6+CUWadPqEwkDSvZWnBhoPwPLTZ/+ftZ/nizXUujsTdRwjcbOwJER+ObhgWDxbJE2WifxFOmHt3ggfSmAN842u5PjfT5gqpXMlTdCwYAYEJvDMqGsADe4p7+vPWJbetaahFrFGN8uBw7rs7W2wIiUKB5bAbAG0o6hdTpWfysuzMOFK/fROvCJsNhhKbbdiQbI0+SogtCkwv69+3uaRTFi33uqKCO6PQ6rMIahjo1lutm9iWq2nX4oI40W1KPC6EU/wF2,iv:rzkjjSnyrs58ZEO8XLsCSFsPHbtnL39SF6NJ6lUg3Ww=,tag:q0sunVc+9bLFoSdeykuT6g==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
|
@ -69,8 +72,8 @@ sops:
|
|||
Y2cwK05uWXFhbndyRlhrSFNjYUlmZ1UKZ1vFRu1QhGGf7BIP8TxK2BIlMZlP3muA
|
||||
R3qLr1lEQmob4O0ilwn65nSCEd1/9W6dUWqeSlJ6CavjG59AvSHfIA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2024-11-30T18:44:29Z"
|
||||
mac: ENC[AES256_GCM,data:SG6a5pWa3gMaSz9d9fOchUXtXbRTpMOXmbOjZo5Fdx8Es1MEDwezwscQaj9p1dzmGa+7U8UUUzMYxlg2SmGgGdPgCs0a5RQVYvQFNdgpRiuknflFMcdgXLv7XFsTqsqSmbN0O662YDvCcz4DWRKjNCZAimlLym8pwDihj1D8dcU=,iv:JmCbcazDK2KPyYsoVy39sr4IbfiGfmGoopit5ojVADk=,tag:6tKYfMkJBjsThaa4qLqobw==,type:str]
|
||||
lastmodified: "2025-05-25T14:53:30Z"
|
||||
mac: ENC[AES256_GCM,data:jzjF+qjdptTI0Y1wNteZgYBGwF5dFWEBIFY3+k4Ty0YU/WB5AyUL6A8v0+PyoxoJK3pL+NAJEmLmAPFVh3+ExDlU9g3TAgpkOs7EsbJtWcjo8Ah08Hl8zoWqcMFcQhZ+aLnVKAE+tIBT4dWyV0AvOWmU8luvarsCp2tQ2OoBH20=,iv:PmbLg91onGz3kjxXMua/Thb904qDkWjHJcBY2dMAios=,tag:e0+fQqNysdiGvaodcimMVQ==,type:str]
|
||||
pgp: []
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.9.1
|
||||
version: 3.9.4
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue