This repository has no description
3.7 kB
112 lines
1{ config, pkgs, ... }:
2{
3 systemd.services.borgbackup-job-hetzner.serviceConfig.ReadWritePaths = [
4 "/var/log/telegraf"
5 ];
6
7 clan.core.vars.generators.borgbackup = {
8 files."borgbackup.ssh.id25519" = { };
9 files."borgbackup.ssh.id25519.pub".secret = false;
10 runtimeInputs = with pkgs; [
11 coreutils
12 openssh
13 ];
14 script = ''
15 ssh-keygen -t ed25519 -N "" -f $out/borgbackup.ssh.id25519
16 '';
17 };
18
19 # Ensure backup directory exists for pg_dump
20 systemd.tmpfiles.rules = [
21 "d /var/backup 0700 root root -"
22 "d /var/backup/postgresql 0700 root root -"
23 "d /var/backup/parley 0700 root root -"
24 ];
25
26 services.borgbackup.jobs.hetzner = {
27 paths = [
28 "/var/backup"
29 "/var/lib/bitwarden_rs"
30 "/var/lib/htgen-cyberlocker"
31 "/var/lib/htgen-paste"
32 "/var/lib/matrix-synapse/media_store/local_content"
33 "/var/lib/radicale"
34 "/home/bot"
35 "/var/lib/kannix"
36 "/var/vmail"
37 "/var/dkim"
38 "/var/sieve"
39 "/var/lib/heisenbridge"
40 # identity.key also lives in clan vars; the SQLite databases are
41 # dumped consistently to /var/backup/parley by the preHook.
42 "/var/lib/parley"
43 ];
44 exclude = [
45 "*.pyc"
46 "/home/bot/.cache"
47 "/home/bot/.nix-defexpr"
48 "/home/bot/.nix-profile"
49 "/var/lib/kannix/.cache"
50 "/var/lib/parley/*.db*"
51 ];
52 repo = "u550643@u550643.your-storagebox.de:/./neoprism";
53 encryption.mode = "none";
54 compression = "auto,zstd";
55 startAt = "*-*-* 03:00:00";
56 environment.BORG_RSH =
57 let
58 knownHostsFile = pkgs.writeText "storagebox-known-hosts" ''
59 [u550643.your-storagebox.de]:23 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs
60 '';
61 in
62 "ssh -oPort=23 -oUserKnownHostsFile=${knownHostsFile} -i ${
63 config.clan.core.vars.generators.borgbackup.files."borgbackup.ssh.id25519".path
64 }";
65
66 readWritePaths = [
67 "/var/backup"
68 "/var/lib/hedgedoc"
69 # WAL-mode SQLite readers need to write the -shm file
70 "/var/lib/parley"
71 ];
72
73 preHook = ''
74 set -x
75 # Dump matrix-synapse PostgreSQL database (14GB, compresses well)
76 ${pkgs.sudo}/bin/sudo -u postgres ${config.services.postgresql.package}/bin/pg_dump \
77 matrix-synapse | ${pkgs.gzip}/bin/gzip > /var/backup/postgresql/matrix-synapse.sql.gz
78
79 # Dump bridge PostgreSQL databases — portal mappings, sessions, tokens.
80 # Losing these = relogin everywhere + every existing Matrix room orphaned.
81 for db in mautrix-whatsapp mautrix-signal mautrix-telegram mautrix-discord; do
82 ${pkgs.sudo}/bin/sudo -u postgres ${config.services.postgresql.package}/bin/pg_dump \
83 "$db" | ${pkgs.gzip}/bin/gzip > "/var/backup/postgresql/$db.sql.gz"
84 done
85
86 # Dump hedgedoc SQLite database (172MB) safely
87 ${pkgs.sqlite}/bin/sqlite3 /var/lib/hedgedoc/db.sqlite ".backup /var/backup/hedgedoc.sqlite"
88
89 # Dump parley accounts + history SQLite databases safely
90 for db in parley history; do
91 ${pkgs.sqlite}/bin/sqlite3 "/var/lib/parley/$db.db" ".backup /var/backup/parley/$db.db"
92 done
93
94 # Dump timeful polls (when.lassul.us) from MongoDB
95 ${pkgs.mongodb-tools}/bin/mongodump --uri=mongodb://127.0.0.1:27017 \
96 --db=schej-it --gzip --archive=/var/backup/timeful.archive.gz
97 '';
98
99 postHook = ''
100 cat > /var/log/telegraf/borgbackup-job-hetzner.service <<EOF
101 task,frequency=daily last_run=$(date +%s)i,state="$([[ $exitStatus == 0 ]] && echo ok || echo fail)"
102 EOF
103 '';
104
105 prune.keep = {
106 within = "1d";
107 daily = 7;
108 weekly = 4;
109 monthly = 0;
110 };
111 };
112}