lass.pds.lassul.us / superconfig
This repository has no description
0
Fork 1

Configure Feed

Select the types of activity you want to include in your feed.

machines: backups for coaxmetal, styx, acheron and yellow

Each machine gets a backup.nix with its storage box sub-account
(coaxmetal sub2, styx sub3, acheron sub4, the yellow container sub5);
what is backed up is declared next to the services:

- coaxmetal: the hermes home without caches, toolchains, git clones,
node_modules and target dirs. Every *.db under .hermes (except cache/),
also in subdirs such as cron/ and the matrix crypto store, is dumped
with sqlite3 .backup into /var/backup/hermes, recreated each run so
removed databases don't linger; the live files are excluded.
- styx: n8n's DynamicUser state (/var/lib/private/n8n), its default
SQLite database dumped.
- acheron: zigbee2mqtt (devices, coordinator backup; database.db is JSON)
and mosquitto's retained messages as plain copies.
- yellow: jellyfin, sonarr, radarr, prowlarr, jellyseerr and sabnzbd
configs with their SQLite databases dumped. Excluded: jellyfin metadata,
logs and transcodes, servarr MediaCover and logs (also logs.db),
jellyseerr cache and logs, sabnzbd's incomplete Downloads and logs.
Media and downloads live in /var/download and are not backed up. A
missing database fails the hook instead of sqlite3 creating an empty one.

Grafana (coaxmetal, styx) is not backed up: datasources and dashboards
are provisioned from the repo, admin password and secret key come from
vars, anonymous users are viewers; both instances only have the four
provisioned dashboards.

author
Hermes committer
lassulus date (Oct 19, 2026, 9:57 AM CEST) commit ce27a31a parent 46f189b9
+130 -1
+13
configs/n8n.nix
··· 1 1 { 2 + pkgs, 2 3 ... 3 4 }: 4 5 { ··· 10 11 11 12 networking.firewall.interfaces.retiolum.allowedTCPPorts = [ 5678 ]; 12 13 networking.firewall.interfaces.wiregrill.allowedTCPPorts = [ 5678 ]; 14 + 15 + # DynamicUser state (config holds the credentials' encryption key); the 16 + # SQLite database is dumped consistently instead of copied. 17 + lass.backup.state.n8n = { 18 + folders = [ "/var/lib/private/n8n" ]; 19 + exclude = [ "/var/lib/private/n8n/.n8n/database.sqlite*" ]; 20 + preBackup = '' 21 + ${pkgs.sqlite}/bin/sqlite3 -cmd ".timeout 60000" /var/lib/private/n8n/.n8n/database.sqlite ".backup /var/backup/n8n.sqlite" 22 + ''; 23 + # WAL-mode SQLite readers need to write the -shm file 24 + readWritePaths = [ "/var/lib/private/n8n/.n8n" ]; 25 + }; 13 26 }
+3
configs/hass/default.nix
··· 51 51 }; 52 52 53 53 environment.systemPackages = [ pkgs.mosquitto ]; 54 + 55 + # retained messages; mosquitto.db is replaced atomically on every save 56 + lass.backup.state.mosquitto.folders = [ config.services.mosquitto.dataDir ]; 54 57 }
+7
configs/hass/zigbee.nix
··· 89 89 }; 90 90 }; 91 91 }; 92 + 93 + # devices, groups and the coordinator backup; database.db is JSON, not 94 + # SQLite, so a plain copy is fine 95 + lass.backup.state.zigbee2mqtt = { 96 + folders = [ "/var/lib/zigbee2mqtt" ]; 97 + exclude = [ "/var/lib/zigbee2mqtt/log" ]; 98 + }; 92 99 }
+1
machines/acheron/backup.nix
··· 1 + { lass.backup.user = "u550643-sub4"; }
+1
machines/acheron/config.nix
··· 7 7 ../../configs/hass 8 8 ../../configs/gg23/audio/hub.nix 9 9 ../../configs/gg23/internet.nix 10 + ./backup.nix 10 11 ]; 11 12 12 13 services.earlyoom.enable = true;
+1
machines/coaxmetal/backup.nix
··· 1 + { lass.backup.user = "u550643-sub2"; }
+1
machines/coaxmetal/config.nix
··· 23 23 ./strom.nix 24 24 ./hermes.nix 25 25 ./hermes-voice.nix 26 + ./backup.nix 26 27 ]; 27 28 28 29 system.stateVersion = "24.05";
+35
machines/coaxmetal/hermes.nix
··· 639 639 EOF 640 640 ''; 641 641 }; 642 + 643 + # The home without caches, toolchains and git clones; the SQLite databases 644 + # under .hermes are dumped consistently instead of copied. 645 + lass.backup.state.hermes = 646 + let 647 + home = config.services.hermes-agent.stateDir; 648 + in 649 + { 650 + folders = [ home ]; 651 + exclude = [ 652 + "${home}/.cache" 653 + "${home}/.cargo" 654 + "${home}/.gradle" 655 + "${home}/go" 656 + "${home}/.hermes/cache" 657 + "${home}/workspace" 658 + "${home}/.local/share/Trash" 659 + "${home}/*/node_modules" 660 + "${home}/*/target" 661 + "${home}/.hermes/*.db" 662 + "${home}/.hermes/*.db-wal" 663 + "${home}/.hermes/*.db-shm" 664 + ]; 665 + preBackup = '' 666 + rm -rf /var/backup/hermes 667 + cd ${home}/.hermes 668 + ${pkgs.findutils}/bin/find . -path ./cache -prune -o -type f -name '*.db' -printf '%P\n' | 669 + while read -r db; do 670 + mkdir -p "/var/backup/hermes/$(dirname "$db")" 671 + ${pkgs.sqlite}/bin/sqlite3 -cmd ".timeout 60000" "$db" ".backup '/var/backup/hermes/$db'" 672 + done 673 + ''; 674 + # WAL-mode SQLite readers need to write the -shm file 675 + readWritePaths = [ "${home}/.hermes" ]; 676 + }; 642 677 }
+1
machines/styx/backup.nix
··· 1 + { lass.backup.user = "u550643-sub3"; }
+1
machines/styx/config.nix
··· 14 14 ../../configs/ppp/umts-stick.nix 15 15 ../../configs/gg23/audio/room.nix 16 16 ../../configs/monitoring/server.nix 17 + ./backup.nix 17 18 ]; 18 19 19 20 environment.systemPackages = with pkgs; [
+1
machines/yellow/backup.nix
··· 1 + { lass.backup.user = "u550643-sub5"; }
+1
machines/yellow/config.nix
··· 16 16 ../../configs/services/flix 17 17 ../../configs/autoupdate.nix 18 18 ../../configs/services/archiver-bot.nix 19 + ./backup.nix 19 20 ]; 20 21 21 22 services.transmission.settings.peer-port = torrentport;
+64 -1
configs/services/flix/default.nix
··· 1 - { config, pkgs, ... }: 1 + { 2 + config, 3 + lib, 4 + pkgs, 5 + ... 6 + }: 2 7 { 3 8 # sabnzbd hard-depends on cheetah3, whose PyPI dist is `ct3` while nixpkgs 4 9 # sets pname="cheetah3". pythonMetadataCheckPhase then looks up metadata for ··· 465 470 systemd.tmpfiles.rules = [ 466 471 "e /var/download/usenet - - - 7d" 467 472 ]; 473 + 474 + # Configs without media, downloads, logs and image caches; the SQLite 475 + # databases are dumped consistently instead of copied. 476 + lass.backup.state.flix = 477 + let 478 + dbs = { 479 + jellyfin = "/var/lib/jellyfin/data/*.db"; 480 + sonarr = "${config.services.sonarr.dataDir}/sonarr.db"; 481 + radarr = "${config.services.radarr.dataDir}/radarr.db"; 482 + prowlarr = "/var/lib/private/prowlarr/prowlarr.db"; 483 + jellyseerr = "/var/lib/private/jellyseerr/config/db/db.sqlite3"; 484 + sabnzbd = "/var/lib/sabnzbd/admin/history1.db"; 485 + }; 486 + dirs = [ 487 + "/var/lib/jellyfin" 488 + config.services.sonarr.dataDir 489 + config.services.radarr.dataDir 490 + "/var/lib/private/prowlarr" 491 + "/var/lib/private/jellyseerr" 492 + "/var/lib/sabnzbd" 493 + ]; 494 + in 495 + { 496 + folders = dirs; 497 + exclude = [ 498 + "/var/lib/jellyfin/metadata" 499 + "/var/lib/jellyfin/log" 500 + "/var/lib/jellyfin/transcodes" 501 + "${config.services.sonarr.dataDir}/MediaCover" 502 + "${config.services.sonarr.dataDir}/logs" 503 + "${config.services.radarr.dataDir}/MediaCover" 504 + "${config.services.radarr.dataDir}/logs" 505 + "/var/lib/private/prowlarr/logs" 506 + "/var/lib/private/jellyseerr/config/cache" 507 + "/var/lib/private/jellyseerr/config/logs" 508 + "/var/lib/private/jellyseerr/config/db/db.sqlite3*" 509 + "/var/lib/sabnzbd/Downloads" 510 + "/var/lib/sabnzbd/logs" 511 + ] 512 + # the live databases, also the unneeded servarr logs.db 513 + ++ map (dir: "${dir}/*.db") dirs 514 + ++ map (dir: "${dir}/*.db-*") dirs; 515 + preBackup = '' 516 + rm -rf /var/backup/flix 517 + ${lib.concatStrings ( 518 + lib.mapAttrsToList (name: glob: '' 519 + mkdir -p /var/backup/flix/${name} 520 + for db in ${glob}; do 521 + # sqlite3 would create a missing database 522 + test -f "$db" 523 + ${pkgs.sqlite}/bin/sqlite3 -cmd ".timeout 60000" "$db" ".backup '/var/backup/flix/${name}/$(basename "$db")'" 524 + done 525 + '') dbs 526 + )} 527 + ''; 528 + # WAL-mode SQLite readers need to write the -shm file 529 + readWritePaths = map dirOf (lib.attrValues dbs); 530 + }; 468 531 }