124 lines
3.8 KiB
Nix
124 lines
3.8 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
let
|
|
cfg = config.modules.system.backups;
|
|
borg = "${pkgs.borgbackup}/bin/borg";
|
|
backup_paths = lib.unique config.modules.system.backups.paths;
|
|
passwd_file = config.sops.secrets."borg_passwd".path;
|
|
jobs = config.modules.system.backups.jobs;
|
|
in
|
|
{
|
|
options.modules.system.backups = {
|
|
enable = lib.mkEnableOption "enables backups with borg";
|
|
paths = lib.mkOption {
|
|
type = lib.types.listOf lib.types.path;
|
|
default = [];
|
|
description = "list of directories to back up";
|
|
};
|
|
jobs = lib.mkOption {
|
|
type = lib.types.nullOr (
|
|
lib.types.attrsOf ( # the set up backup jobs
|
|
lib.types.attrsOf ( # the set of paths
|
|
lib.types.listOf lib.types.path # the paths
|
|
)
|
|
)
|
|
);
|
|
default = null;
|
|
description = "Borg backup jobs; each job has a list of paths.";
|
|
};
|
|
repo = lib.mkOption {
|
|
type = lib.types.path;
|
|
default = "/holocron/borg";
|
|
description = "borg repository path";
|
|
};
|
|
passphraseFile = lib.mkOption {
|
|
type = lib.types.path;
|
|
default = passwd_file;
|
|
description = "borg repository passphrase file";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf (cfg.enable && backup_paths != []) {
|
|
|
|
cfg.jobs = {
|
|
sungger = { paths = [ "/var/lib/radarr" "/var/lib/sonarr" ]; };
|
|
hoass = { paths = [ "/var/lib/zigbee2mqtt" "/var/lib/hass" "/var/lib/mosquitto" ]; };
|
|
huh = { paths = [ "/home/blake/.nix" ]; };
|
|
};
|
|
|
|
systemd.services.backups = {
|
|
description = "backup service with borg!";
|
|
path = [ pkgs.borgbackup ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
# the actual script borg is using
|
|
ExecStart = pkgs.writeShellScript "borg-backup" ''
|
|
set -euo pipefail
|
|
export BORG_PASSPHRASE="$(cat ${passwd_file})"
|
|
export BORG_REPO="${cfg.repo}"
|
|
timestamp="$(date +'%Y-%m-%dT%H:%M:%S')"
|
|
|
|
# Initialize repo if it doesn't exist
|
|
if ! borg info "$BORG_REPO" >/dev/null 2>&1; then
|
|
echo "Initializing Borg repo at $BORG_REPO"
|
|
borg init --encryption=repokey "$BORG_REPO"
|
|
fi
|
|
|
|
echo "starting backup run at $timestamp"
|
|
|
|
# Loop over all jobs (attribute set keys)
|
|
${lib.concatStringsSep "\n\n" (lib.mapAttrsToList (bak_name: bak_paths:
|
|
''
|
|
echo "------------- Backing up ${bak_name} -------------"
|
|
archive="${bak_name}-$timestamp"
|
|
echo "backing up paths: ${lib.concatStringsSep " " bak_paths.paths} → $archive"
|
|
borg create \
|
|
--verbose \
|
|
--filter AME \
|
|
--list \
|
|
--stats \
|
|
--show-rc \
|
|
--compression lzma,9 \
|
|
"$BORG_REPO::$archive" \
|
|
${lib.concatStringsSep " " bak_paths.paths}
|
|
|
|
echo "pruning old backups for ${bak_name}..."
|
|
borg prune -v --list "$BORG_REPO" \
|
|
--prefix "${bak_name}-" \
|
|
--keep-daily=7 \
|
|
--keep-weekly=52 \
|
|
--keep-monthly=-1
|
|
''
|
|
) jobs)}
|
|
|
|
echo "finshed backup at \"$BORG_REPO::$archive\"
|
|
'';
|
|
};
|
|
};
|
|
|
|
# create timer to run backups daily
|
|
systemd.timers.backups = {
|
|
description = "daily borg backup timer";
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnCalendar = "daily";
|
|
Persistent = true;
|
|
};
|
|
};
|
|
|
|
# install borg binary
|
|
environment.systemPackages = [ pkgs.borgbackup ];
|
|
|
|
# declare secret for repo password
|
|
sops.secrets = {
|
|
"borg_passwd" = {
|
|
owner = "root";
|
|
group = "root";
|
|
};
|
|
};
|
|
};
|
|
}
|
|
|
|
# add to modules
|
|
# modules.system.backups.paths = lib.mkIf cfg.backups [ <path> ];
|