diff --git a/hosts/hetzner-arm/containers/storage/data/ports.nix b/hosts/hetzner-arm/containers/storage/data/ports.nix index c025651..b4221b1 100644 --- a/hosts/hetzner-arm/containers/storage/data/ports.nix +++ b/hosts/hetzner-arm/containers/storage/data/ports.nix @@ -21,6 +21,7 @@ in { restic_owncast = restic + 8; restic_jellyfin = restic + 9; restic_grocy = restic + 10; + restic_lappy_t495 = restic + 11; http_music = http + 0; http_public = http + 1; diff --git a/hosts/hetzner-arm/containers/storage/default.nix b/hosts/hetzner-arm/containers/storage/default.nix index c712dc0..0cc3638 100644 --- a/hosts/hetzner-arm/containers/storage/default.nix +++ b/hosts/hetzner-arm/containers/storage/default.nix @@ -125,6 +125,7 @@ in { "/Owncast/".proxyPass = "http://${containerIP}:${toString ports.restic_owncast}"; "/Jellyfin/".proxyPass = "http://${containerIP}:${toString ports.restic_jellyfin}"; "/Grocy/".proxyPass = "http://${containerIP}:${toString ports.restic_grocy}"; + "/Lappy-T495/".proxyPass = "http://${containerIP}:${toString ports.restic_lappy_t495}"; }; extraConfig = '' client_max_body_size ${clientMaxBodySize}; diff --git a/hosts/hetzner-arm/containers/storage/profiles/rcloneServe.nix b/hosts/hetzner-arm/containers/storage/profiles/rcloneServe.nix index 25695d7..95ba82d 100644 --- a/hosts/hetzner-arm/containers/storage/profiles/rcloneServe.nix +++ b/hosts/hetzner-arm/containers/storage/profiles/rcloneServe.nix @@ -233,6 +233,16 @@ in { "--baseurl=/Grocy/" ]; } + { + id = "restic-lappy-t495"; + remote = "StorageBox:Backups/Restic/Lappy-T495"; + type = "restic"; + extraArgs = [ + "--addr=0.0.0.0:${toString ports.restic_lappy_t495}" + "--htpasswd=${secrets.restic_lappy_t495_htpasswd.path}" + "--baseurl=/Lappy-T495/" + ]; + } ]; }; } diff --git a/hosts/hetzner-arm/containers/storage/secrets.nix b/hosts/hetzner-arm/containers/storage/secrets.nix index e9fe691..6c0175a 100644 --- a/hosts/hetzner-arm/containers/storage/secrets.nix +++ b/hosts/hetzner-arm/containers/storage/secrets.nix @@ -36,6 +36,7 @@ "api-keys/data/storage/restic/Owncast" "api-keys/data/storage/restic/Jellyfin" "api-keys/data/storage/restic/Grocy" + "api-keys/data/storage/restic/Lappy-T495" "api-keys/data/storage/webdav/Main" "api-keys/data/storage/webdav/Media" @@ -191,6 +192,14 @@ ''; }; + restic_lappy_t495_htpasswd = { + user = "storage"; + group = "storage"; + fetchScript = '' + simple_get_htpasswd "/api-keys/storage/restic/Lappy-T495" "$secretFile" + ''; + }; + webdav_main_htpasswd = { user = "storage"; group = "storage"; diff --git a/hosts/lappy-t495/lappy-t495.nix b/hosts/lappy-t495/lappy-t495.nix index cf35652..fffb132 100644 --- a/hosts/lappy-t495/lappy-t495.nix +++ b/hosts/lappy-t495/lappy-t495.nix @@ -14,6 +14,8 @@ profiles.gaming.steam + hosts.lappy-t495.profiles.restic + ./secrets.nix ]; diff --git a/hosts/lappy-t495/profiles/restic.nix b/hosts/lappy-t495/profiles/restic.nix new file mode 100644 index 0000000..b93bce8 --- /dev/null +++ b/hosts/lappy-t495/profiles/restic.nix @@ -0,0 +1,28 @@ +{config, ...}: let + secrets = config.services.secrets.secrets; +in { + services.restic.backups.lappy-t495 = { + user = "root"; + createWrapper = true; + + paths = [ + "/etc/NetworkManager/system-connections" + "/home/chaos/Projects" + ]; + extraBackupArgs = [ + "--exclude-caches" + "--exclude=node_modules" + "--exclude=/home/chaos/Projects/*/target" + ]; + + repositoryFile = "${secrets.restic_backups_repository_file.path}"; + passwordFile = "${secrets.restic_backups_password.path}"; + + pruneOpts = ["--keep-within=14d"]; + + timerConfig = { + OnStartupSec = "5m"; + OnUnitActiveSec = "30m"; + }; + }; +} diff --git a/hosts/lappy-t495/secrets.nix b/hosts/lappy-t495/secrets.nix index ea6a013..7652148 100644 --- a/hosts/lappy-t495/secrets.nix +++ b/hosts/lappy-t495/secrets.nix @@ -27,6 +27,20 @@ echo "RESTIC_PASSWORD=''${restic_password}" >> "$secretFile" ''; }; + + restic_backups_password = { + fetchScript = '' + simple_get "/private-public-keys/restic/Lappy-T495" .password >> "$secretFile" + ''; + }; + restic_backups_repository_file = { + fetchScript = '' + api_username=restic + api_password=$(simple_get "/api-keys/storage/restic/Lappy-T495" ".$api_username") + + echo "rest:https://$api_username:$api_password@storage-restic.owo.monster/Lappy-T495" > "$secretFile" + ''; + }; }; }; }