add backups for forgejo

hosts/hetzner-arm/containers/forgejo/default.nix

@@ -37,9 +37,11 @@ in {
           presets.nixos.containerBase
           profiles.sshd
           profiles.firewallAllow.ssh
+          ./secrets.nix
         ]
-        ++ (with hosts.hetzner-arm.containers.forgejo; [
+        ++ (with hosts.hetzner-arm.containers.forgejo.profiles; [
-          profiles.forgejo
+          forgejo
+          restic
         ]);
 
       networking.firewall.allowedTCPPorts = [2222];

hosts/hetzner-arm/containers/forgejo/profiles/forgejo.nix

@@ -53,13 +53,6 @@
         ENABLE = false;
       };
     };
-
-    dump = {
-      enable = true;
-      interval = "hourly";
-      file = "forgejo-dump";
-      type = "tar.zst";
-    };
   };
 
   environment.systemPackages = [

hosts/hetzner-arm/containers/forgejo/profiles/restic.nix

@@ -0,0 +1,39 @@
+{
+  pkgs,
+  config,
+  ...
+}: let
+  secrets = config.services.secrets.secrets;
+in {
+  environment.systemPackages = with pkgs; [
+    restic
+    (pkgs.writeShellScriptBin "restic-forgejo" ''
+      env \
+        RESTIC_PASSWORD_FILE=${secrets.restic_password.path} \
+        $(cat ${secrets.restic_env.path}) \
+      ${pkgs.restic}/bin/restic $@
+    '')
+  ];
+
+  services.restic.backups.forgejo = {
+    user = "root";
+    paths = [
+      "/var/lib/forgejo"
+    ];
+
+    # repository is overrided in environmentFile to contain auth
+    # make sure to keep up to date when changing repository
+    repository = "rest:https://storage-restic.owo.monster/Forgejo";
+    passwordFile = "${secrets.restic_password.path}";
+    environmentFile = "${secrets.restic_env.path}";
+
+    pruneOpts = [
+      "--keep-last 50"
+    ];
+
+    timerConfig = {
+      OnBootSec = "1m";
+      OnCalendar = "4h";
+    };
+  };
+}

hosts/hetzner-arm/containers/forgejo/secrets.nix

@@ -0,0 +1,42 @@
+{pkgs, ...}: {
+  services.secrets = {
+    enable = true;
+
+    vaultLogin = {
+      enable = true;
+      loginUsername = "hetzner-arm-container-forgejo";
+    };
+
+    autoSecrets = {
+      enable = true;
+    };
+
+    requiredVaultPaths = [
+      "api-keys/data/storage/restic/Forgejo"
+      "private-public-keys/data/restic/Forgejo"
+    ];
+
+    packages = with pkgs; [
+      apacheHttpd
+    ];
+
+    secrets = {
+      vault_password = {
+        manual = true;
+      };
+
+      restic_password = {
+        fetchScript = ''
+          simple_get "/private-public-keys/restic/Forgejo" .password > "$secretFile"
+        '';
+      };
+      restic_env = {
+        fetchScript = ''
+          RESTIC_USERNAME=$(simple_get "/api-keys/storage/restic/Forgejo" .username)
+          RESTIC_PASSWORD=$(simple_get "/api-keys/storage/restic/Forgejo" .password)
+          echo "RESTIC_REPOSITORY=rest:https://$RESTIC_USERNAME:$RESTIC_PASSWORD@storage-restic.owo.monster/Forgejo" > "$secretFile"
+        '';
+      };
+    };
+  };
+}

hosts/hetzner-arm/containers/mail/profiles/restic.nix

@@ -41,12 +41,12 @@ in {
     environmentFile = "${secrets.restic_env.path}";
 
     pruneOpts = [
-      "--keep-last 5"
+      "--keep-last 100"
     ];
 
     timerConfig = {
       OnBootSec = "1m";
-      OnCalendar = "daily";
+      OnCalendar = "8h";
     };
 
     inherit backupPrepareCommand;

hosts/hetzner-arm/containers/music/default.nix

@@ -51,10 +51,10 @@ in {
 
           ./secrets.nix
         ]
-        ++ (with hosts.hetzner-arm.containers.music; [
+        ++ (with hosts.hetzner-arm.containers.music.profiles; [
-          profiles.mpd
+          mpd
-          profiles.musicSync
+          musicSync
-          profiles.soulseek
+          soulseek
         ]);
 
       networking.firewall.allowedTCPPorts = with ports; [

hosts/hetzner-arm/containers/storage/data/ports.nix

@@ -9,6 +9,7 @@
   rclone_serve_restic_quassel = 4213;
   rclone_serve_restic_piped = 4214;
   rclone_serve_restic_mail = 4215;
+  rclone_serve_restic_forgejo = 4216;
 
   rclone_serve_http_music = 4220;
   rclone_serve_http_public = 4221;

hosts/hetzner-arm/containers/storage/default.nix

@@ -97,6 +97,7 @@ in {
       "/Quassel/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_restic_quassel}";
       "/Piped/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_restic_piped}";
       "/Mail/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_restic_mail}";
+      "/Forgejo/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_restic_forgejo}";
     };
     extraConfig = ''
       client_max_body_size ${clientMaxBodySize};

hosts/hetzner-arm/containers/storage/profiles/rcloneServe.nix

@@ -136,6 +136,16 @@ in {
           "--baseurl=/Mail/"
         ];
       }
+      {
+        id = "restic-forgejo";
+        remote = "StorageBox:Backups/Restic/Forgejo";
+        type = "restic";
+        extraArgs = [
+          "--addr=0.0.0.0:${toString ports.rclone_serve_restic_forgejo}"
+          "--htpasswd=${secrets.restic_forgejo_htpasswd.path}"
+          "--baseurl=/Forgejo/"
+        ];
+      }
     ];
   };
 }

hosts/hetzner-arm/containers/storage/rclone_config.template

@@ -20,7 +20,7 @@ sha1sum_command = sha1 -r
 # after deploy or redeploying with different alias if storagebox breaks
 [StorageBox-Remote]
 type = alias
-remote = StorageBox-Remote-SFTP:
+remote = StorageBox-Remote-WebDAV:
 
 [StorageBox-Hasher]
 type = hasher

hosts/hetzner-arm/containers/storage/secrets.nix

@@ -30,6 +30,7 @@
       "api-keys/data/storage/restic/Quassel"
       "api-keys/data/storage/restic/Piped"
       "api-keys/data/storage/restic/Mail"
+      "api-keys/data/storage/restic/Forgejo"
 
       "api-keys/data/storage/webdav/main"
       "api-keys/data/storage/webdav/media"
@@ -137,6 +138,16 @@
         '';
       };
 
+      restic_forgejo_htpasswd = {
+        user = "storage";
+        group = "storage";
+        fetchScript = ''
+          username=$(simple_get "/api-keys/storage/restic/Forgejo" .username)
+          password=$(simple_get "/api-keys/storage/restic/Forgejo" .password)
+          htpasswd -bc "$secretFile" "$username" "$password" 2>/dev/null
+        '';
+      };
+
       webdav_main_htpasswd = {
         user = "storage";
         group = "storage";

hosts/vault/profiles/restic.nix

@@ -7,10 +7,10 @@
 in {
   services.restic.backups.vault = {
     user = "root";
-    paths = ["/var/lib/vault" "/var/lib/acme"];
+    paths = ["/var/lib/vault"];
     timerConfig = {
       OnBootSec = "1m";
-      OnCalendar = "daily";
+      OnCalendar = "6h";
     };
     # env contains fixed repository with auth
     repository = "rest:https://storage-restic.owo.monster/Vault";

outputs.nix

@@ -140,7 +140,7 @@ in
           # All machines/containers with secrets.nix
           machines = rec {
             "hetzner-arm" = {
-              containers = ["storage" "music" "quassel" "social" "mail" "piped-db" "piped-fi"];
+              containers = ["storage" "music" "quassel" "social" "mail" "piped-db" "piped-fi" "forgejo"];
               sshAddress = "hetzner-arm.servers.genderfucked.monster";
             };
             "vault" = {