superconfig/modules/ at ce27a31a5841dc8bffc2b304aaeecdb9a80a9992 · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / modules

1 folder 7 files

at ce27a31a5841dc8bffc2b304aaeecdb9a80a9992

Hermes modules.backup: encrypted repos in per-machine storage box sub-accounts 3d ago

modules.zitadel: refreshTokens option for OIDC apps

4 days ago

modules.backup: encrypted repos in per-machine storage box sub-accounts Every machine now backs up into its own Hetzner storage box sub-account (isolation: one machine's ssh key can't read or delete another's archives), into ./borg in the sub-account's home. lass.backup.user replaces lass.backup.repo and enables the job; host, port 23 and the box's host key are module defaults, so a machine's backup.nix is only the sub-account. Repos are always encrypted (repokey-blake2). The passphrase comes from a per-machine clan vars generator borgbackup-repokey; it lives in the password store, so passphrase + repo are enough to restore. The borgbackup ssh key generator is unchanged. neoprism moves to a new repo on u550643-sub1 (doInit creates it); the old unencrypted repo u550643@...:/./neoprism is no longer referenced and is removed by hand. Its paths, excludes and hooks are unchanged. The job stays `hetzner`: with fresh repos nothing gains from a rename, and the unit name is used for the postBackup hooks. The timers get a fixed random delay of up to 1h after 03:00, so the machines sharing the box don't all start at once.

3 days ago

modules.backup: per-service backup state, move neoprism paths into their services lass.backup.state.<name> lets every service declare its folders, excludes, pre/post backup hooks and the paths its pre hook writes to next to its definition. The borg job (still `hetzner`, so archive names and pruning continue) and the borgbackup ssh key generator exist only on machines that set lass.backup.repo; neoprism's backup.nix now only points to the storage box. Pre hooks run inside the borg unit as before; each runs on its own with pipefail, all of them run and the job fails if any did (a failing pg_dump used to go unnoticed behind the gzip pipe). Post hooks run in ExecStopPost as root, also after a failed backup. The four bridge dumps are split from the old loop into the bridges' files. The dump subdirs are created by the hooks instead of tmpfiles. hedgedoc's uploads directory is backed up now. The imgur items (hedgedoc image uploads) are backed up now too.

3 days ago

fetchWallpaper.nix

modules: rename from 3modules

2 weeks ago

modules.backup: per-service backup state, move neoprism paths into their services lass.backup.state.<name> lets every service declare its folders, excludes, pre/post backup hooks and the paths its pre hook writes to next to its definition. The borg job (still `hetzner`, so archive names and pruning continue) and the borgbackup ssh key generator exist only on machines that set lass.backup.repo; neoprism's backup.nix now only points to the storage box. Pre hooks run inside the borg unit as before; each runs on its own with pipefail, all of them run and the job fails if any did (a failing pg_dump used to go unnoticed behind the gzip pipe). Post hooks run in ExecStopPost as root, also after a failed backup. The four bridge dumps are split from the old loop into the bridges' files. The dump subdirs are created by the hooks instead of tmpfiles. hedgedoc's uploads directory is backed up now. The imgur items (hedgedoc image uploads) are backed up now too.

3 days ago

configs: allocate uids dynamically, drop stockholm.lib pairprogramming, radio, realwallpaper and the htgen users no longer get their ids from stockholm's genid. NixOS keeps the ids existing users already have in /etc/passwd and /etc/group, so nothing changes on deployed machines; fresh installs allocate them. The copied htgen, reaktor2 and realwallpaper modules use nixpkgs option types instead of stockholm's, htgen's user is a small name/home submodule (home still defaults to /home/<name>), and reaktor2 carries its own stripAttr.

2 weeks ago

modules: rename from 3modules

2 weeks ago

sync-containers3.nix

modules.sync-containers3: move options to lass.sync-containers3

2 weeks ago