move quassel into its own container

home/base/ssh.nix

@@ -1,4 +1,6 @@
-{lib, ...}: {
+{lib, ...}: let
+  container-addresses = import ../../hosts/hetzner-vm/data/container-addresses.nix {};
+in {
   programs.ssh.enable = true;
   programs.ssh.matchBlocks =
     lib.mkMerge
@@ -8,23 +10,15 @@
           hostname = "${hostname}.servers.genderfucked.monster";
         };
       }))
+      ++ (lib.forEach (lib.attrNames container-addresses.containers) (name: {
+        "container-${name}" = {
+          user = "root";
+          hostname = "${container-addresses.containers.${name}}";
+          proxyJump = "hetzner-vm";
+        };
+      }))
       ++ [
         {
-          "container-storage" = {
-            user = "root";
-            hostname = "192.168.100.11";
-            proxyJump = "hetzner-vm";
-          };
-          "container-social" = {
-            user = "root";
-            hostname = "192.168.100.12";
-            proxyJump = "hetzner-vm";
-          };
-          "container-music" = {
-            user = "root";
-            hostname = "192.168.100.13";
-            proxyJump = "hetzner-vm";
-          };
           "blahaj" = {
             user = "chaos";
             hostname = "blahaj.sapphicco.de";

hosts/hetzner-vm/containers/quassel/profiles/quassel.nix

@@ -4,6 +4,7 @@
     interfaces = ["0.0.0.0"];
   };
 
+  services.postgresql.enable = true;
   services.postgresql.ensureDatabases = ["quassel"];
   services.postgresql.ensureUsers = [
     {
@@ -11,6 +12,7 @@
       ensurePermissions."DATABASE quassel" = "ALL PRIVILEGES";
     }
   ];
+
   services.postgresql.authentication = "host quassel quassel localhost trust";
   networking.firewall.allowedTCPPorts = [4242];
 }

hosts/hetzner-vm/containers/quassel/profiles/restic.nix

@@ -0,0 +1,57 @@
+{
+  pkgs,
+  config,
+  lib,
+  host_secrets,
+  ...
+}: let
+  secrets = host_secrets;
+
+  backupPrepareCommand = "${
+    (pkgs.writeShellScriptBin "backupPrepareCommand" ''
+      systemctl start postgresqlBackup-quassel --wait
+    '')
+  }/bin/backupPrepareCommand";
+in {
+  environment.systemPackages = with pkgs; [
+    restic
+    (pkgs.writeShellScriptBin "restic-quassel" ''
+      env \
+        RESTIC_PASSWORD_FILE=${secrets.quassel_restic_password.path} \
+        $(cat ${secrets.quassel_restic_env.path}) \
+      ${pkgs.restic}/bin/restic $@
+    '')
+  ];
+
+  services.restic.backups.quassel = {
+    user = "root";
+    paths = [
+      "/var/backup/postgresql"
+      "/home/quassel/.config/quassel-irc.org"
+    ];
+
+    # repository is overrided in environmentFile to contain auth
+    # make sure to keep up to date when changing repository
+    repository = "rest:https://storage-restic.owo.monster/Quassel";
+    passwordFile = "${secrets.quassel_restic_password.path}";
+    environmentFile = "${secrets.quassel_restic_env.path}";
+
+    pruneOpts = [
+      "--keep-last 5"
+    ];
+
+    timerConfig = {
+      OnBootSec = "1m";
+      OnCalendar = "daily";
+    };
+
+    inherit backupPrepareCommand;
+  };
+
+  services.postgresqlBackup = {
+    enable = true;
+    backupAll = false;
+    databases = ["quassel"];
+    compression = "zstd";
+  };
+}

hosts/hetzner-vm/containers/quassel/quassel.nix

@@ -0,0 +1,90 @@
+{
+  tree,
+  lib,
+  inputs,
+  config,
+  ...
+}: let
+  container-addresses = import ../../data/container-addresses.nix {};
+  hostIP = container-addresses.host;
+  containerIP = container-addresses.containers.quassel;
+
+  # Using secrets from Host
+  secrets = config.services.secrets.secrets;
+  secrets_list = [
+    "quassel_restic_env"
+    "quassel_restic_password"
+  ];
+in {
+  networking.nat.forwardPorts = [
+    {
+      sourcePort = 4242;
+      destination = "${containerIP}\:4242";
+    }
+  ];
+
+  containers.quassel = {
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = hostIP;
+    localAddress = containerIP;
+    bindMounts = lib.mkMerge (lib.forEach secrets_list (secret_name: let
+      path = "${secrets.${secret_name}.path}";
+    in {
+      "${path}" = {
+        hostPath = "${path}";
+      };
+    }));
+
+    config = {
+      config,
+      pkgs,
+      ...
+    }: {
+      _module.args = {
+        inherit inputs;
+        inherit tree;
+        host_secrets = secrets;
+      };
+
+      imports = with tree;
+        [
+          profiles.base
+          inputs.home-manager-unstable.nixosModules.home-manager
+
+          profiles.sshd
+
+          modules.nixos.secrets
+
+          users.root
+        ]
+        ++ (with hosts.hetzner-vm.containers.quassel; [
+          profiles.quassel
+          profiles.restic
+        ]);
+
+      # For Shared Secrets
+      systemd.tmpfiles.rules = [
+        "d ${config.services.secrets.secretsDir} - root root"
+      ];
+
+      networking.firewall = {
+        enable = true;
+        allowedTCPPorts = [22 4242];
+      };
+
+      home-manager.users.root = {
+        imports = with tree; [home.base home.dev.small];
+
+        home.stateVersion = "23.05";
+      };
+
+      # Manually configure nameserver. Using resolved inside the container seems to fail
+      # currently
+      environment.etc."resolv.conf".text = "nameserver 8.8.8.8";
+      system.stateVersion = "23.05";
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [4242];
+}

hosts/hetzner-vm/containers/social/profiles/backups.nix

@@ -35,7 +35,8 @@
     rm /var/lib/gotosocial/gts-export.json
   '')}/bin/backupCleanupCommand";
 in {
-  environment.systemPackages = [
+  environment.systemPackages = with pkgs; [
+    restic
     (pkgs.writeShellScriptBin "restic-social" ''
       env \
         RESTIC_PASSWORD_FILE=${secrets.social_restic_password.path} \

hosts/hetzner-vm/containers/storage/data/ports.nix

@@ -7,6 +7,7 @@
   rclone_serve_restic_music = 4211;
   rclone_serve_restic_vault = 4212;
   rclone_serve_restic_social = 4213;
+  rclone_serve_restic_quassel = 4214;
 
   rclone_serve_http_music = 4220;
   rclone_serve_http_public = 4221;

hosts/hetzner-vm/containers/storage/profiles/rclone-serve.nix

@@ -121,6 +121,17 @@ in {
         ];
         inherit serviceConfig;
       }
+      {
+        user = "storage";
+        remote = "StorageBox:Backups/Restic/Quassel";
+        type = "restic";
+        extraArgs = [
+          "--addr=0.0.0.0:${toString ports.rclone_serve_restic_quassel}"
+          "--htpasswd=${secrets.restic_quassel_htpasswd.path}"
+          "--baseurl=/Quassel/"
+        ];
+        inherit serviceConfig;
+      }
     ];
   };
 }

hosts/hetzner-vm/containers/storage/profiles/secrets.nix

@@ -80,6 +80,15 @@
           htpasswd -bc "$secretFile" "$username" "$password" 2>/dev/null
         '';
       };
+      restic_quassel_htpasswd = {
+        user = "storage";
+        group = "storage";
+        fetchScript = ''
+          username=$(simple_get "/api-keys/storage/restic/Quassel" .username)
+          password=$(simple_get "/api-keys/storage/restic/Quassel" .password)
+          htpasswd -bc "$secretFile" "$username" "$password" 2>/dev/null
+        '';
+      };
 
       webdav_main_htpasswd = {
         user = "storage";

hosts/hetzner-vm/containers/storage/storage.nix

@@ -99,6 +99,7 @@ in {
       "/Music/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_restic_music}";
       "/Vault/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_restic_vault}";
       "/Social/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_restic_social}";
+      "/Quassel/".proxyPass = "http://${containerIP}:${toString ports.rclone_serve_restic_quassel}";
     };
   };
 }

hosts/hetzner-vm/data/container-addresses.nix

@@ -4,5 +4,6 @@
     storage = "192.168.100.11";
     social = "192.168.100.12";
     music = "192.168.100.13";
+    quassel = "192.168.100.14";
   };
-}
+}

hosts/hetzner-vm/hetzner-vm.nix

@@ -19,10 +19,10 @@
     ./containers/storage/storage.nix
     ./containers/social/social.nix
     ./containers/music/music.nix
+    ./containers/quassel/quassel.nix
 
     hosts.hetzner-vm.profiles.restic
     hosts.hetzner-vm.profiles.piped
-    hosts.hetzner-vm.profiles.quassel
     hosts.hetzner-vm.profiles.mailserver
     hosts.hetzner-vm.profiles.gitlab-static-sites
     hosts.hetzner-vm.profiles.wireguard

hosts/hetzner-vm/ports.nix

@@ -1,6 +1,4 @@
 {}: {
-  quassel = 4242; # default
-
   piped-backend = 3012;
   piped-proxy = 3013;
 

hosts/hetzner-vm/secrets.nix

@@ -87,6 +87,20 @@
           echo "RESTIC_REPOSITORY=rest:https://$RESTIC_USERNAME:$RESTIC_PASSWORD@storage-restic.owo.monster/Social" > $secretFile
         '';
       };
+
+      quassel_restic_password = {
+        fetchScript = ''
+          simple_get "/private-public-keys/restic/Quassel" .password > $secretFile
+        '';
+      };
+      quassel_restic_env = {
+        fetchScript = ''
+          RESTIC_USERNAME=$(simple_get "/api-keys/storage/restic/Quassel" .username)
+          RESTIC_PASSWORD=$(simple_get "/api-keys/storage/restic/Quassel" .password)
+          echo "RESTIC_REPOSITORY=rest:https://$RESTIC_USERNAME:$RESTIC_PASSWORD@storage-restic.owo.monster/Quassel" > $secretFile
+        '';
+      };
+
       restic_password = {
         fetchScript = ''
           simple_get "/private-public-keys/restic/HetznerVM" .password > $secretFile

treeConfig.nix

@@ -16,6 +16,7 @@
     "hosts/hetzner-vm/modules/piped".functor.enable = true;
     "hosts/hetzner-vm/containers/storage/profiles".functor.enable = true;
     "hosts/hetzner-vm/containers/social/profiles".functor.enable = true;
+    "hosts/hetzner-vm/containers/irc/profiles".functor.enable = true;
 
     # Profiles
     "profiles/*".functor.enable = true;