This repository has no description
neoprism: add borgbackup to hetzner storage box
author
lassulus
date
(Feb 22, 2026, 10:03 PM CET)
commit
fd0ac7c6
fd0ac7c692d2ae232b21c476bad1d53a1729948c
parent
e19cb78a
e19cb78a7eedd4c6723c28610d740271c926e966
+82
+79
machines/neoprism/backup.nix
+79
machines/neoprism/backup.nix
···
1
+
{ config, pkgs, ... }:
2
+
{
3
+
systemd.services.borgbackup-job-hetzner.serviceConfig.ReadWritePaths = [
4
+
"/var/log/telegraf"
5
+
];
6
+
7
+
clan.core.vars.generators.borgbackup = {
8
+
files."borgbackup.ssh.id25519" = { };
9
+
files."borgbackup.ssh.id25519.pub".secret = false;
10
+
runtimeInputs = with pkgs; [
11
+
coreutils
12
+
openssh
13
+
];
14
+
script = ''
15
+
ssh-keygen -t ed25519 -N "" -f $out/borgbackup.ssh.id25519
16
+
'';
17
+
};
18
+
19
+
# Ensure backup directory exists for pg_dump
20
+
systemd.tmpfiles.rules = [
21
+
"d /var/backup 0700 root root -"
22
+
"d /var/backup/postgresql 0700 root root -"
23
+
];
24
+
25
+
services.borgbackup.jobs.hetzner = {
26
+
paths = [
27
+
"/var/backup"
28
+
"/var/lib/bitwarden_rs"
29
+
"/var/lib/matrix-synapse/media_store/local_content"
30
+
"/var/lib/radicale"
31
+
"/home/bot"
32
+
];
33
+
exclude = [
34
+
"*.pyc"
35
+
"/home/bot/.cache"
36
+
"/home/bot/.nix-defexpr"
37
+
"/home/bot/.nix-profile"
38
+
];
39
+
repo = "u550643@u550643.your-storagebox.de:/./neoprism";
40
+
encryption.mode = "none";
41
+
compression = "auto,zstd";
42
+
startAt = "*-*-* 03:00:00";
43
+
environment.BORG_RSH = let
44
+
knownHostsFile = pkgs.writeText "storagebox-known-hosts" ''
45
+
[u550643.your-storagebox.de]:23 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs
46
+
'';
47
+
in "ssh -oPort=23 -oUserKnownHostsFile=${knownHostsFile} -i ${
48
+
config.clan.core.vars.generators.borgbackup.files."borgbackup.ssh.id25519".path
49
+
}";
50
+
51
+
readWritePaths = [
52
+
"/var/backup"
53
+
"/var/lib/hedgedoc"
54
+
];
55
+
56
+
preHook = ''
57
+
set -x
58
+
# Dump matrix-synapse PostgreSQL database (14GB, compresses well)
59
+
${pkgs.sudo}/bin/sudo -u postgres ${config.services.postgresql.package}/bin/pg_dump \
60
+
matrix-synapse | ${pkgs.gzip}/bin/gzip > /var/backup/postgresql/matrix-synapse.sql.gz
61
+
62
+
# Dump hedgedoc SQLite database (172MB) safely
63
+
${pkgs.sqlite}/bin/sqlite3 /var/lib/hedgedoc/db.sqlite ".backup /var/backup/hedgedoc.sqlite"
64
+
'';
65
+
66
+
postHook = ''
67
+
cat > /var/log/telegraf/borgbackup-job-hetzner.service <<EOF
68
+
task,frequency=daily last_run=$(date +%s)i,state="$([[ $exitStatus == 0 ]] && echo ok || echo fail)"
69
+
EOF
70
+
'';
71
+
72
+
prune.keep = {
73
+
within = "1d";
74
+
daily = 7;
75
+
weekly = 4;
76
+
monthly = 0;
77
+
};
78
+
};
79
+
}