configured backups

hosts/falkenstein-1/default.nix

@@ -5,6 +5,7 @@
     [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
+      ./modules/backup
       ./modules/crowdsec
       ./modules/mail
       ./modules/networks

hosts/falkenstein-1/modules/backup/default.nix

@@ -0,0 +1,32 @@
+{ config, pkgs, ... }:
+{
+  sops.secrets."borg/passphrase" = { };
+  environment.systemPackages = [ pkgs.borgbackup ];
+  services.borgmatic = {
+    enable = true;
+    settings = {
+      location = {
+        source_directories = [
+          "/var/lib"
+          "/var/log"
+          "/etc/crowdsec"
+          "/root"
+        ];
+
+        repositories = [
+          "ssh://root@192.168.10.2/mnt/backup/falkenstein"
+        ];
+      };
+      storage = {
+        encryption_passcommand = "${pkgs.coreutils}/bin/cat ${config.sops.secrets."borg/passphrase".path}";
+        compression = "lz4";
+      };
+      retention = {
+        keep_daily = 7;
+        keep_weekly = 4;
+        keep_monthly = 12;
+        keep_yearly = 3;
+      };
+    };
+  };
+}

hosts/falkenstein-1/modules/mail/default.nix

@@ -3,7 +3,6 @@
 let
   domain = "rfive.de";
   hostname = "falkenstein.vpn.${domain}";
-  rspamd-domain = "rspamd.${domain}";
 in
 {
   networking.firewall.allowedTCPPorts = [

hosts/falkenstein-1/modules/networks/default.nix

@@ -1,5 +1,13 @@
-{ ... }:
+{ config, ... }:
 {
+  sops.secrets = {
+    "wireguard/dorm/private" = {
+      owner = config.users.users.systemd-network.name;
+    };
+    "wireguard/dorm/preshared" = {
+      owner = config.users.users.systemd-network.name;
+    };
+  };
   networking = {
     hostName = "falkenstein-1";
     useNetworkd = true;
@@ -20,5 +28,44 @@
         Gateway = "fe80::1";
       };
     };
+
+    netdevs."30-dorm" = {
+      netdevConfig = {
+        Kind = "wireguard";
+        Name = "dorm";
+        Description = "WireGuard to my Dorm Infra";
+      };
+      wireguardConfig = {
+        PrivateKeyFile = config.sops.secrets."wireguard/dorm/private".path;
+        ListenPort = 51820;
+      };
+      wireguardPeers = [
+        {
+          wireguardPeerConfig = {
+            PublicKey = "vUmworuJFHjB4KUdkucQ+nzqO2ysARLomq4UuK1n430=";
+            PresharedKeyFile = config.sops.secrets."wireguard/dorm/preshared".path;
+            Endpoint = "dorm.vpn.rfive.de:51820";
+            AllowedIPs = "10.10.10.0/24, 192.168.10.0/24";
+          };
+        }
+      ];
+    };
+    networks."30-dorm" = {
+      matchConfig.Name = "dorm";
+      networkConfig = {
+        DNS = "192.168.10.1";
+      };
+      addresses = [
+        {
+          addressConfig = {
+            Address = "10.10.10.4/24";
+            RouteMetric = 30;
+          };
+        }
+      ];
+      routes = [
+        { routeConfig = { Gateway = "0.0.0.0"; Destination = "192.168.10.0/24"; Metric = 30; }; }
+      ];
+    };
   };
 }

hosts/falkenstein-1/modules/nginx/default.nix

@@ -11,6 +11,7 @@
     virtualHosts."rfive.de" = {
       enableACME = true;
       forceSSL = true;
+      root = "/srv/web/rfive.de";
     };
   };
   security.acme = {

hosts/nuc/default.nix

@@ -35,6 +35,7 @@
     directories = [
       "/etc/ssh"
       "/root/.local/share/zsh"
+      "/root/.config/borg/security"
     ];
     files = [
       "/etc/machine-id"
@@ -83,6 +84,7 @@
     ../../keys/ssh/rouven-thinkpad
     ../../keys/ssh/root-thinkpad
     ../../keys/ssh/rouven-pixel
+    ../../keys/ssh/root-falkenstein
   ];
 
   system.stateVersion = "22.11";

hosts/nuc/modules/backup/default.nix

@@ -1,37 +1,35 @@
+{ config, pkgs, ... }:
 {
+  sops.secrets."borg/passphrase" = { };
+  environment.systemPackages = [ pkgs.borgbackup ];
   fileSystems."/mnt/backup" =
     {
-      device = "/dev/disk/by-uuid/f6905cdb-c130-465a-90a3-93997023b5d3 ";
-      fsType = "btrfs";
-      options = [ "compress=zstd" "noatime" "nofail" ];
+      device = "dev/disk/by-uuid/74e78699-fe27-4467-a9bb-99fc6e8d52c5";
+      fsType = "ext4";
+      options = [ "nofail" ];
       neededForBoot = false;
     };
+  services.borgmatic = {
+    enable = true;
+    settings = {
+      location.source_directories = [
+        "/var/lib"
+        "/var/log"
+        "/nix/persist"
+      ];
+      location.repositories = [
+        "/mnt/backup/nuc"
+      ];
+      storage = {
+        encryption_passcommand = "${pkgs.coreutils}/bin/cat ${config.sops.secrets."borg/passphrase".path}";
+        compression = "lz4";
+      };
+      retention = {
+        keep_daily = 7;
+        keep_weekly = 4;
+        keep_monthly = 12;
+        keep_yearly = 3;
 
-  fileSystems."/mnt/pool" =
-    {
-      device = "/dev/disk/by-uuid/16b0bd14-1b07-477d-a20d-982f9467f6df";
-      fsType = "btrfs";
-      options = [ "compress=zstd" "noatime" ];
-    };
-
-  services.btrbk = {
-    instances."nuc-to-disk".settings = {
-      snapshot_preserve = "14d";
-      snapshot_preserve_min = "2d";
-      target_preserve = "30d 4w 12m";
-      target_preserve_min = "2d";
-      volume = {
-        "/mnt/pool" = {
-          subvolume = {
-            log = {
-              snapshot_create = "always";
-            };
-            lib = {
-              snapshot_create = "always";
-            };
-          };
-          target = "/mnt/backup/nuc";
-        };
       };
     };
   };

hosts/nuc/modules/nextcloud/default.nix

@@ -11,19 +11,6 @@ in
   };
 
   services = {
-    postgresql = {
-      enable = true;
-      ensureUsers = [
-        {
-          name = "nextcloud";
-          ensurePermissions = {
-            "DATABASE nextcloud" = "ALL PRIVILEGES";
-          };
-        }
-      ];
-      ensureDatabases = [ "nextcloud" ];
-    };
-
     nextcloud = {
       enable = true;
       package = pkgs.nextcloud27; # Use current latest nextcloud package
@@ -56,4 +43,8 @@ in
     requires = [ "postgresql.service" ];
     after = [ "postgresql.service" ];
   };
+  systemd.services."nextcloud-cron" = {
+    requires = [ "postgresql.service" ];
+    after = [ "postgresql.service" ];
+  };
 }

hosts/thinkpad/default.nix

@@ -4,10 +4,10 @@
   imports =
     [
       ./hardware-configuration.nix
+      ./modules/backup
       ./modules/networks
       ./modules/greetd
       ./modules/virtualisation
-      ./modules/snapper
     ];
 
   # Use the systemd-boot EFI boot loader.

hosts/thinkpad/modules/backup/default.nix

@@ -0,0 +1,41 @@
+{ config, pkgs, ... }:
+{
+  sops.secrets."borg/passphrase" = { };
+  environment.systemPackages = [ pkgs.borgbackup ];
+  services.borgmatic = {
+    enable = true;
+    settings = {
+      location = {
+        source_directories = [
+          "/var/lib"
+          "/var/log"
+          "/nix/persist"
+          "/home"
+        ];
+
+        repositories = [
+          "ssh://root@192.168.10.2/mnt/backup/thinkpad"
+        ];
+        exclude_patterns = [
+          "/home/*/.cache"
+          "/home/*/.zcomp*"
+          "/home/*/.zcomp*"
+          "/home/*/.local/share/Steam"
+          "/home/*/.local/share/Trash"
+          "/home/*/.local/share/vifm/Trash"
+          "/home/*/Linux/Isos"
+        ];
+      };
+      storage = {
+        encryption_passcommand = "${pkgs.coreutils}/bin/cat ${config.sops.secrets."borg/passphrase".path}";
+        compression = "lz4";
+      };
+      retention = {
+        keep_daily = 7;
+        keep_weekly = 4;
+        keep_monthly = 12;
+        keep_yearly = 3;
+      };
+    };
+  };
+}

hosts/thinkpad/modules/snapper/default.nix

@@ -1,19 +0,0 @@
-{ ... }:
-{
-  services.snapper = {
-    configs = {
-      home = {
-        SUBVOLUME = "/home";
-        ALLOW_USERS = [ "rouven" ];
-        TIMELINE_CREATE = true;
-        TIMELINE_CLEANUP = true;
-      };
-      lib = {
-        SUBVOLUME = "/var/lib";
-        ALLOW_USERS = [ "rouven" ];
-        TIMELINE_CREATE = true;
-        TIMELINE_CLEANUP = true;
-      };
-    };
-  };
-}

hosts/thinkpad/modules/virtualisation/default.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, pkgs, ... }:
 # Virtualisation with gpu passthrough
 # Following https://astrid.tech/2022/09/22/0/nixos-gpu-vfio/
 # let

hosts/vm/default.nix

@@ -52,6 +52,6 @@
       ../../keys/ssh/rouven-thinkpad
     ];
   };
-  system.stateVersion = "22.11";
+  system.stateVersion = "23.05";
 
 }