add backups for owncast
This commit is contained in:
parent
4e5bec5588
commit
ac2d940df5
|
|
@ -7,14 +7,14 @@
|
|||
config,
|
||||
...
|
||||
}: let
|
||||
containerName = "stream";
|
||||
containerName = "owncast";
|
||||
|
||||
containerAddresses = import "${hostPath}/data/containerAddresses.nix";
|
||||
|
||||
hostIP = containerAddresses.host;
|
||||
containerIP = containerAddresses.containers.${containerName};
|
||||
in {
|
||||
containers.stream = {
|
||||
containers.owncast = {
|
||||
autoStart = true;
|
||||
privateNetwork = true;
|
||||
hostAddress = hostIP;
|
||||
|
|
@ -33,9 +33,11 @@ in {
|
|||
imports = with tree;
|
||||
[
|
||||
presets.nixos.containerBase
|
||||
./secrets.nix
|
||||
]
|
||||
++ (with hosts.hetzner-arm.containers.stream.profiles; [
|
||||
++ (with hosts.hetzner-arm.containers.owncast.profiles; [
|
||||
owncast
|
||||
restic
|
||||
]);
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
39
hosts/hetzner-arm/containers/owncast/profiles/restic.nix
Normal file
39
hosts/hetzner-arm/containers/owncast/profiles/restic.nix
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
{
|
||||
pkgs,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
secrets = config.services.secrets.secrets;
|
||||
in {
|
||||
environment.systemPackages = with pkgs; [
|
||||
restic
|
||||
(pkgs.writeShellScriptBin "restic-owncast" ''
|
||||
env \
|
||||
RESTIC_PASSWORD_FILE=${secrets.restic_password.path} \
|
||||
$(cat ${secrets.restic_env.path}) \
|
||||
${pkgs.restic}/bin/restic $@
|
||||
'')
|
||||
];
|
||||
|
||||
services.restic.backups.owncast = {
|
||||
user = "root";
|
||||
paths = [
|
||||
"/var/lib/owncast"
|
||||
];
|
||||
|
||||
# repository is overrided in environmentFile to contain auth
|
||||
# make sure to keep up to date when changing repository
|
||||
repository = "rest:https://storage-restic.owo.monster/Owncast";
|
||||
passwordFile = "${secrets.restic_password.path}";
|
||||
environmentFile = "${secrets.restic_env.path}";
|
||||
|
||||
pruneOpts = [
|
||||
"--keep-last 5"
|
||||
];
|
||||
|
||||
timerConfig = {
|
||||
OnBootSec = "10m";
|
||||
OnCalendar = "8h";
|
||||
};
|
||||
};
|
||||
}
|
||||
37
hosts/hetzner-arm/containers/owncast/secrets.nix
Normal file
37
hosts/hetzner-arm/containers/owncast/secrets.nix
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
{pkgs, ...}: {
|
||||
services.secrets = {
|
||||
enable = true;
|
||||
|
||||
vaultLogin = {
|
||||
enable = true;
|
||||
loginUsername = "hetzner-arm-container-owncast";
|
||||
};
|
||||
|
||||
autoSecrets = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
requiredVaultPaths = [
|
||||
"api-keys/data/storage/restic/Owncast"
|
||||
"private-public-keys/data/restic/Owncast"
|
||||
];
|
||||
|
||||
secrets = {
|
||||
vault_password = {
|
||||
manual = true;
|
||||
};
|
||||
|
||||
restic_password = {
|
||||
fetchScript = ''
|
||||
simple_get "/private-public-keys/restic/Owncast" .password > "$secretFile"
|
||||
'';
|
||||
};
|
||||
restic_env = {
|
||||
fetchScript = ''
|
||||
RESTIC_PASSWORD=$(simple_get "/api-keys/storage/restic/Owncast" .restic)
|
||||
echo "RESTIC_REPOSITORY=rest:https://restic:$RESTIC_PASSWORD@storage-restic.owo.monster/Owncast" > "$secretFile"
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -17,6 +17,7 @@ in {
|
|||
restic_mail = restic + 5;
|
||||
restic_forgejo = restic + 6;
|
||||
restic_caldav = restic + 7;
|
||||
restic_owncast = restic + 8;
|
||||
|
||||
http_music = http + 0;
|
||||
http_public = http + 1;
|
||||
|
|
|
|||
|
|
@ -98,6 +98,7 @@ in {
|
|||
"/Mail/".proxyPass = "http://${containerIP}:${toString ports.restic_mail}";
|
||||
"/Forgejo/".proxyPass = "http://${containerIP}:${toString ports.restic_forgejo}";
|
||||
"/CalDAV/".proxyPass = "http://${containerIP}:${toString ports.restic_caldav}";
|
||||
"/Owncast/".proxyPass = "http://${containerIP}:${toString ports.restic_owncast}";
|
||||
};
|
||||
extraConfig = ''
|
||||
client_max_body_size ${clientMaxBodySize};
|
||||
|
|
|
|||
|
|
@ -187,6 +187,16 @@ in {
|
|||
"--baseurl=/Forgejo/"
|
||||
];
|
||||
}
|
||||
{
|
||||
id = "restic-owncast";
|
||||
remote = "StorageBox:Backups/Restic/Owncast";
|
||||
type = "restic";
|
||||
extraArgs = [
|
||||
"--addr=0.0.0.0:${toString ports.restic_owncast}"
|
||||
"--htpasswd=${secrets.restic_owncast_htpasswd.path}"
|
||||
"--baseurl=/Owncast/"
|
||||
];
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -31,6 +31,7 @@
|
|||
"api-keys/data/storage/restic/Mail"
|
||||
"api-keys/data/storage/restic/Forgejo"
|
||||
"api-keys/data/storage/restic/CalDAV"
|
||||
"api-keys/data/storage/restic/Owncast"
|
||||
|
||||
"api-keys/data/storage/webdav/Main"
|
||||
"api-keys/data/storage/webdav/Media"
|
||||
|
|
@ -160,6 +161,14 @@
|
|||
'';
|
||||
};
|
||||
|
||||
restic_owncast_htpasswd = {
|
||||
user = "storage";
|
||||
group = "storage";
|
||||
fetchScript = ''
|
||||
simple_get_htpasswd "/api-keys/storage/restic/Owncast" "$secretFile"
|
||||
'';
|
||||
};
|
||||
|
||||
webdav_main_htpasswd = {
|
||||
user = "storage";
|
||||
group = "storage";
|
||||
|
|
|
|||
|
|
@ -9,6 +9,6 @@
|
|||
postgresql = "10.0.1.7";
|
||||
piped-fi = "10.0.1.8";
|
||||
caldav = "10.0.1.9";
|
||||
stream = "10.0.1.10";
|
||||
owncast = "10.0.1.10";
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -29,7 +29,7 @@ in {
|
|||
"mail"
|
||||
"forgejo"
|
||||
"caldav"
|
||||
"stream"
|
||||
"owncast"
|
||||
] (name: ./containers + "/${name}"))
|
||||
++ (with hosts.hetzner-arm.profiles; [
|
||||
staticSites
|
||||
|
|
|
|||
Loading…
Reference in a new issue