Make backups more fun with syncthing

hosts/linode/nextcloud.nix

@@ -33,6 +33,6 @@
 	greg.backup.jobs.nextcloud-bkup = {
 		src = "/var/lib/nextcloud";
 		dest = "nextcloud-backup";
-		user = "nextcloud";
+		id = "rbfco-rvmis";
 	};
 }

hosts/linode/postgres.nix

@@ -56,8 +56,8 @@ root root postgres
 	};
 
 	greg.backup.jobs.greg-postgresql-backup = {
-		src = "/var/backup/postgresql";
+		src = config.services.postgresqlBackup.location;
 		dest = "linode-postgres";
-		user = "postgres";
+		id = "9pwvg-s257a";
 	};
 }

modules/nixos/backup.nix

@@ -3,18 +3,25 @@
 let
 	cfg = config.greg.backup;
 
-	makeTimer = name: job: {
+	where = j: "${config.services.syncthing.dataDir}/${j.dest}";
-		timerConfig.OnCalendar = "daily";
+
-		wantedBy = [ "timers.target" ];
+	makeSyncFolders = name: job: {
+		devices = [ "chronicles" ];
+		enable = true;
+		id = job.id;
+		label = job.dest;
+		path = where job;
+		type = "sendonly";
 	};
 
-	makeService = name: job: {
+	makeRestic = name: job: let
-		serviceConfig = {
+		who = "${config.services.syncthing.user}:${config.services.syncthing.group}";
-			User = job.user;
+	in rec {
-			ExecStartPre = lib.optionalString (job.pre != "") job.pre;
+		initialize = true;
-			ExecStart = "${pkgs.rsync}/bin/rsync -avz --delete -e '${pkgs.openssh}/bin/ssh -oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null' ${job.src}/ backup@chronicles.shire-zebra.ts.net:/volume1/NetBackup/${job.dest}";
+		passwordFile = config.age.secrets.restic-pw.path;
-			ExecStartPost = lib.optionalString (job.post != "") job.post;
+		paths = [ job.src ];
-		};
+		repository = where job;
+		backupCleanupCommand = ''${pkgs.coreutils}/bin/chown -R ${who} "${repository}"'';
 	};
 
 in with lib; {
@@ -36,22 +43,9 @@ in with lib; {
 								type = types.str;
 							};
 
-							user = mkOption {
+							id = mkOption {
 								type = types.str;
-								default = "root";
+								description = "The unique folder ID for this";
-								description = "User to run backup as";
-							};
-
-							pre = mkOption {
-								type = types.str;
-								default = "";
-								description = "Commands to run before backup";
-							};
-
-							post = mkOption {
-								type = types.str;
-								default = "";
-								description = "Commands to run after backup";
 							};
 						};
 					}
@@ -62,9 +56,16 @@ in with lib; {
 
 	config = mkIf ( ( attrValues cfg.jobs ) != [] )
 	{
-		systemd = {
+		age.secrets = {
-			timers = mapAttrs makeTimer cfg.jobs;
+			restic-pw.file = ../../secrets/restic-pw.age;
-			services = mapAttrs makeService cfg.jobs;
+			restic-env.file = ../../secrets/restic-env.age;
+		};
+		greg.syncthing = {
+			enable = true;
+		};
+		services = {
+			syncthing.settings.folders = mapAttrs makeSyncFolders cfg.jobs;
+			restic.backups = mapAttrs makeRestic cfg.jobs;
 		};
 	};
 }

modules/nixos/default.nix

@@ -16,6 +16,7 @@
 		./router.nix
 		./rpi4.nix
 		./sway.nix
+		./syncthing.nix
 		./tailscale.nix
 		./vmdev.nix
 	];

modules/nixos/syncthing.nix

@@ -0,0 +1,26 @@
+{ config, lib, pkgs, ... }:
+
+let
+	cfg = config.greg.syncthing;
+in with lib; {
+	options.greg.syncthing = {
+		enable = mkEnableOption "Setup my personal minimal configuration for Syncthing";
+	};
+
+	config = mkIf cfg.enable {
+		services.syncthing = {
+			enable = true;
+			overrideFolders = true;
+			overrideDevices = true;
+			settings = {
+				devices = {
+					chronicles.id = "7FI6Y3M-C7YQEDI-IB345L6-RKLXMB6-AEIV57Y-3J2RCXQ-MK6QRNK-EINPXAE";
+					linode.id = "IJMMXPR-WNALZBD-FMJH5W5-WV7XGJY-HLJTKGT-5TKHJIH-75LT56D-UUZCYQE";
+				};
+				options = {
+					urAccepted = -1;
+				};
+			};
+		};
+	};
+}

secrets/restic-env.age

@@ -0,0 +1,30 @@
+age-encryption.org/v1
+-> ssh-ed25519 oyEmTw +5GE8yJvBQ+4p4vAbN89YCHBjWgn2H/jWDAtIas5pig
++qMZZtLMhVwHpAaJ34lTDjJZi8etcnjebfnWHTcLjlk
+-> ssh-ed25519 mOmPfg GjmciOCIpxZY2o0JmgojwolXZkA3DAnhNkKoPa+/6i0
+I6W8b+iu1IJIfM5eCUxuT+oHO6leCT2ck4+Ltb8fiPY
+-> ssh-ed25519 YJiRbw hKbIcwyh/xp90tbvytCCZfmBwwt+28bY4DJlXvo6dA4
+KaQsKvPAmtZUvi2rxXwR2FcbIdo9SRr1lEyqsMp1G30
+-> ssh-ed25519 aY2AXA aXtJ66mKlSqxJxuQdVPiFSvPNpxfm7yseoMIuu6vYA4
+ZNQ/Zo92gat15/E49fFPNRKZI5jRxnD/zrRfUwNc8GI
+-> ssh-ed25519 xNtnoA 5tK6SvHTxNka0CQDLDtukwKAs8mlrRAALK1AkAY+tyQ
+eF0dQ3SFQKCD0FuVEXwE+CjOUm8vjQSIsCFviqI3pfk
+-> ssh-ed25519 AQhf1g Iei85IkkHUExExezcFG21YG0yeMrI+SmlMmtLoHtT3I
+ZsuWFBoi9DSSgwfIpJlyrXIbgXOH+0gm/yqJaIhga4o
+-> ssh-ed25519 Nl/5yA NPp9yfa0MLHQ5+fkcNEtMvE5JyWG2F53rPZZs0IU6mo
+BNSb4BvGkpEJSPMMRbSbqsXavQ1QcEr3bGEES5cr4hw
+-> ssh-ed25519 GdLgCQ dYWQFiv4dLFM9D22OVcVcJYZwKXHza4EnaEZyp5ixno
+bHN9mf7atf/gJRs+4FCiK30qBmBrORaYzbFDSfPTIpY
+-> ssh-ed25519 tOH/HQ wny8+QHHl3nvsKu8VUrh+Eqr1BmFoxio5DkeVhganj8
+H4AFAM03fjbUAWin/rkKZm7nS91jzTRRR27A8LnK/J0
+-> ssh-ed25519 FpzvfQ WXL1WjxG505w21Hj8su1crkeOinTes71D/REK5NlTkA
+rhDkdNUD453ZyEqTk202HgWCqK3OtHNRZ1xkH3NJfuo
+-> ssh-ed25519 kdPvzQ pEA4KU23MwZC1xVILf2wL/OYfi56aqRL/KqPQBIHIEM
+bOZZYz9H9LAJzvljPgk6tfY/HH0OXrWBbA/nSC2ae+c
+-> ssh-ed25519 onmXpg q8ay0LwB9UON2j2owU2uZYl6lPAM1tF5FZvdW0Ne1Q4
+0O2R3tOYeCZqNBn1BaWMJbaCDo6KpTnzt8h56j7a3gw
+-> ssh-ed25519 CnhD0g dYMvLeb4YTYQbm7eXPfI5J0OI7SISQvD0cVB5d5cSCw
++YlYOF9gUFycpy6PqJeE4qLUBP7PtWfMgRcjsVOSFGo
+--- 8OYRi2tJeg668hNGOqqLOkyHPGmX8jdtQIPfQS8Tf3k
+éÞ"sûƒÎ Á.ž¸»>È'X…ò¦ÿ´1ºR4‡Ûö­‘éE]¤´@ÂC¡ä€µ8ro§J©ñ„±‡_ÇI|ÿÌ��t	�ÛÚÉsªOmá›üç´!.Ó�Ôm¼|-¯$ÇÎë*c@#m–
+òRg£µ„¤¶
¶À7öw\ïµ/Ëù8

secrets/secrets.nix

@@ -46,6 +46,9 @@ in
 	"jude-forgejo-runner.age".publicKeys = everyone;
 	"minio.age".publicKeys = everyone;
 
+	"restic-env.age".publicKeys = everyone;
+	"restic-pw.age".publicKeys = everyone;
+
 
 	"dendrite.age".publicKeys = everyone;
 	"dendrite_key.age".publicKeys = everyone;