configured backups

hosts/falkenstein-1/default.nix

@@ -5,6 +5,7 @@
     [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
+      ./modules/backup
       ./modules/crowdsec
       ./modules/mail
       ./modules/networks

hosts/falkenstein-1/modules/backup/default.nix

@@ -0,0 +1,32 @@
+{ config, pkgs, ... }:
+{
+  sops.secrets."borg/passphrase" = { };
+  environment.systemPackages = [ pkgs.borgbackup ];
+  services.borgmatic = {
+    enable = true;
+    settings = {
+      location = {
+        source_directories = [
+          "/var/lib"
+          "/var/log"
+          "/etc/crowdsec"
+          "/root"
+        ];
+
+        repositories = [
+          "ssh://root@192.168.10.2/mnt/backup/falkenstein"
+        ];
+      };
+      storage = {
+        encryption_passcommand = "${pkgs.coreutils}/bin/cat ${config.sops.secrets."borg/passphrase".path}";
+        compression = "lz4";
+      };
+      retention = {
+        keep_daily = 7;
+        keep_weekly = 4;
+        keep_monthly = 12;
+        keep_yearly = 3;
+      };
+    };
+  };
+}

hosts/falkenstein-1/modules/mail/default.nix

@@ -3,7 +3,6 @@
 let
   domain = "rfive.de";
   hostname = "falkenstein.vpn.${domain}";
-  rspamd-domain = "rspamd.${domain}";
 in
 {
   networking.firewall.allowedTCPPorts = [

hosts/falkenstein-1/modules/networks/default.nix

@@ -1,5 +1,13 @@
-{ ... }:
+{ config, ... }:
 {
+  sops.secrets = {
+    "wireguard/dorm/private" = {
+      owner = config.users.users.systemd-network.name;
+    };
+    "wireguard/dorm/preshared" = {
+      owner = config.users.users.systemd-network.name;
+    };
+  };
   networking = {
     hostName = "falkenstein-1";
     useNetworkd = true;
@@ -20,5 +28,44 @@
         Gateway = "fe80::1";
       };
     };
+
+    netdevs."30-dorm" = {
+      netdevConfig = {
+        Kind = "wireguard";
+        Name = "dorm";
+        Description = "WireGuard to my Dorm Infra";
+      };
+      wireguardConfig = {
+        PrivateKeyFile = config.sops.secrets."wireguard/dorm/private".path;
+        ListenPort = 51820;
+      };
+      wireguardPeers = [
+        {
+          wireguardPeerConfig = {
+            PublicKey = "vUmworuJFHjB4KUdkucQ+nzqO2ysARLomq4UuK1n430=";
+            PresharedKeyFile = config.sops.secrets."wireguard/dorm/preshared".path;
+            Endpoint = "dorm.vpn.rfive.de:51820";
+            AllowedIPs = "10.10.10.0/24, 192.168.10.0/24";
+          };
+        }
+      ];
+    };
+    networks."30-dorm" = {
+      matchConfig.Name = "dorm";
+      networkConfig = {
+        DNS = "192.168.10.1";
+      };
+      addresses = [
+        {
+          addressConfig = {
+            Address = "10.10.10.4/24";
+            RouteMetric = 30;
+          };
+        }
+      ];
+      routes = [
+        { routeConfig = { Gateway = "0.0.0.0"; Destination = "192.168.10.0/24"; Metric = 30; }; }
+      ];
+    };
   };
 }

hosts/falkenstein-1/modules/nginx/default.nix

@@ -11,6 +11,7 @@
     virtualHosts."rfive.de" = {
       enableACME = true;
       forceSSL = true;
+      root = "/srv/web/rfive.de";
     };
   };
   security.acme = {