diff --git a/hosts/Infini-FRAMEWORK/default.nix b/hosts/Infini-FRAMEWORK/default.nix index 186a524..6f0723d 100644 --- a/hosts/Infini-FRAMEWORK/default.nix +++ b/hosts/Infini-FRAMEWORK/default.nix @@ -16,6 +16,7 @@ "/root/.local/share/nix" "/root/.ssh" + "/root/.cache/borg" # /var directories "/var/log" diff --git a/modules/modules/backup.nix b/modules/modules/backup.nix new file mode 100644 index 0000000..3858908 --- /dev/null +++ b/modules/modules/backup.nix @@ -0,0 +1,57 @@ +{ config, lib, pkgs, ... }: +# Borg Backup public key: +# ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINhldH579ixPRSBtTjnzWoDCNyUxUSl1BjogWN3keYBR borg@universe +# This is used to connect to my rsync.net +with lib; +with lib.our; +let + excludes = { + "/home/infinidoge" = [ + ".cache" + "*/cache2" + "*/Cache" + ]; + }; + + append = root: path: (root + "/" + path); + + excludes' = concatLists + (mapAttrsToList + (root: map (append root)) + excludes + ); + + commonArgs = { + environment = { + BORG_RSH = "ssh -i ${config.secrets.borg-ssh-key}"; + BORG_REMOTE_PATH = "/usr/local/bin/borg1/borg1"; + }; + extraCreateArgs = "--verbose --stats --checkpoint-interval 600"; + compression = "auto,zstd,3"; + doInit = true; + persistentTimer = true; + inhibitsSleep = true; + encryption = { + mode = "repokey-blake2"; + passCommand = "cat ${config.secrets.borg-password}"; + }; + }; +in +{ + environment.systemPackages = with pkgs; [ + borgbackup + ]; + + services.borgbackup.jobs."persist" = commonArgs // rec { + paths = "/persist"; + repo = "rsync.net:backups/hosts/${config.networking.hostName}"; + exclude = map (append paths) excludes'; + startAt = "daily"; + prune.keep = { + within = "1d"; # Keep all archives from the last day + daily = 7; + weekly = 4; + monthly = -1; # Keep at least one archive for each month + }; + }; +} diff --git a/secrets/borg-password.age b/secrets/borg-password.age new file mode 100644 index 0000000..21f5774 --- /dev/null +++ b/secrets/borg-password.age @@ -0,0 +1,42 @@ +age-encryption.org/v1 +-> ssh-ed25519 sQ/0YA vEN+BMRPchZwrRdyFXH7QoGPh/Tm5q/EacbiXuG5DWg +rDfRa1mxaBnKVSj18ZYXt8yMH3+O0WPMclPnlavrwZ4 +-> ssh-ed25519 i9xGKA IJ75ewNj5XJ8vKFM1/JmO9P6pmGNt5y6kDVxcKs5V1g +7dBv9XQ/SYEo+bshkK8T3OnZzEvpQqkRVijCfXbVuEQ +-> ssh-ed25519 ydxrGg cnuYTVsJpXEIf03AgcBzyWx1II4r9QUtg9xoReKSKxQ +ZG7/TVbj8bcG9VyynEIacOrOSY7OcHInaoZBDZlTnWU +-> ssh-ed25519 gIJNbA pLS1v5wRbdeKhR72BL0w/ECMGyCMtjX1YtlWCOrBtCM +bFwVPBDOxzGqb2EiEjoqZbr0jU69SbLLLEFXfIDmPnc +-> ssh-ed25519 hjL/yw 8RRwUHtlry/t5OEnZN7HDyofM4faT7Iw8g7MmTEAwQ4 +9jqrjniU1uszbS0uhXaPaQJMFyV4ZmdMDyb/yVdHlSE +-> ssh-ed25519 fUfJ3w +Ja+Je3CaeFroLEYDDRJu6nm+9SCKx82YAtroSS7TSA +dE4DYVp78JRDj1Stb1+4YfymxTipeEe4FgkccX1nJdo +-> ssh-ed25519 GT2Stg zEDrlMqcqD9KdtHoaBViey2l2lbs9cH5VX3J1RnihQU +5b0/v3rYX2fPyioWtd3Oi50nX4GM6sU078tRJOLfTTg +-> ssh-ed25519 oAMyvg rhvhLh3Pf4/mj6cbNWSpIXZQk2PJVqOIGubEkdInjyA +zkvNtEDDTJJDvV9Tlep2CZzgfW9zlQ7JxM8mDSUDZJU +-> ssh-ed25519 VIHjXg P6JZwZkvb+iShQtGofEyfqu0w/3QV87xe5DAf7Cr8HI +YP10nToTMABzNEfNNBgCBlHCMvgCQ46OTJ9bughlnZ0 +-> ssh-ed25519 VEv3zg w6+3N5AMMegHa4Va5FIk5x0n+p/46dxZoYYNd/TkEQQ +2UfXTdvlxFCAdU3J1Bonta+LFoD4LigdYpReOmsGr7I +-> ssh-ed25519 6ZS9Zw GwKe67+p2Qt7SejW6Hpk/9CU8IjiaaryzEzzQxVPwAM +FTJj3S6bQOpFpO2FtKU0zkR8+echpCSsCs8oTzWmcHM +-> ssh-ed25519 2S7Wcg T2w4Uw4vAG3Xm9unACHe7lPc7RsR3KC5CuaYDwPPpHI +YxG9bGHp4WNWT54SH4htNjQH0wNlKQfX4UBABaGnQrM +-> ssh-ed25519 izZ3FQ h/t2iCvh8t+gRF1m9o/AmXS+rw6lIQlXu9PZYOWenkM +u44lK20BAQ9nYMGu+YwyPJKAZg9R69MVux6TKVTi6k4 +-> ssh-ed25519 GB2MZQ dcKjCJdJihMiR5ssu+vN+lAPkVj+KAn8Po6okV77Fn4 +Ib4w6SD2a+OXHHv1BkAzAz+xqLDFPRxTgGY+51ifK9c +-> ssh-ed25519 FelIjw qi943Hn5IEpOM1fX/kyq7Wiw5aYslTinr1s7MwBqRTE +ZKf2JsQLlZNMxZug/FFePJRiIPf9fpXFjLsx44V2dfY +-> ssh-ed25519 TRpHkw vMpE75X0vcnkODqKISFWqXepKRyg7s9iMEPb6z/RoBs +FetHhD4aUIX1rCwoPSielTL2xqnuRJsU628+Wzwpy4A +-> ssh-ed25519 rKpRzQ H4xItyf8cPzrHxjQ6lHMInsS55bwSVd4/Fb6ZZ6KOVk +KCdINvwKbaxdw/3thjUUleE0Gwm2+1hGVW7atsBkgBk +-> ssh-ed25519 8/Dzqw ezT+IuHyuy++fOTEScnMLOSOGgObpX4Jf61iW0gaF1M +FOnAgqcAhTOp8FdnTV7N45GpLN8FI+CzFGuH1P5kd0w +-> ssh-ed25519 tJyugw xyH1MTAGdu34NE3aJx3K2o5/4M1h1G6ruluDkJL/h28 +y/RtyjlJok18Sq8st02JurI4AsaJtehGAUbyL4Hy/T0 +--- DPD9D24RzAUIpjnJm/NHViwZ9OMO56AYLP9jJ0m/Pz0 +JH^=G1 +a/1Nha!|Dz^J85N,)I 1?̞5]ܢnf\cE&fIoL=BVH˕5z6OnFH \ No newline at end of file diff --git a/secrets/borg-ssh-key.age b/secrets/borg-ssh-key.age new file mode 100644 index 0000000..6e23fe7 --- /dev/null +++ b/secrets/borg-ssh-key.age @@ -0,0 +1,41 @@ +age-encryption.org/v1 +-> ssh-ed25519 sQ/0YA JcSjc2p12HX1FA81tEECAO0vxmZVosDbfsYi7r8G9wU +SxOTJU6JY79Yv9+luW3wbDivmeredpz6ZLWcT+ItLhg +-> ssh-ed25519 i9xGKA 53KHr2nLjNbCkyLmhbE0Hd4Ze/Iu8pIM9JQ2+rdO3XM +/4+JGP73MX22xP3FPzxBCdYxbPFa0H2Yjb34Y6u1Zag +-> ssh-ed25519 ydxrGg QdYiyReOuCBFKnae5nxI+jchD5pGM/VOSV8tHPq/pi8 +by7kXtwaG540H6twHMzInOKwj+Ep13E/8bvJ/HG0Vko +-> ssh-ed25519 gIJNbA LFx4nIiFJyi127ebic1+aP+Fp8rHcuL7KZNtPF/Ntmc +swK+OJK68B+ipMHWyekuxaKdPaL5Y2/tG+Xk9HX5jqM +-> ssh-ed25519 hjL/yw /e2TpBpanzsfIuWf3Cxgh6pSGIwHusVrMlZpreENR2I +Kxc91rDUjZd/bPrTstP+G7YhxhB7G9ShcN4P2ZoYpqM +-> ssh-ed25519 fUfJ3w Fhw35LzqOaVxt/owj0wXMoI6TZVHyYXKK+9zB2QuMxo +WEX9xMADRNxNmEaNOKOFLEf+cFiRmEFfGVxJPCDlyZk +-> ssh-ed25519 GT2Stg y4fzQBn0oL3HEinhXaelVkq78kT2EBO+6W4ImiXLZEY +QCUKm+J9V9zV/Di1NLzlsfyc6QgZmQYQ+PpmWcuRrow +-> ssh-ed25519 oAMyvg DaFyFCZ4ntCnLHu0xiNGwF7LgMwONuymm8I0+lZqPlg +nvbIbnwdEIkZVqX+/IERIAYQR0qfo//X+Ed3GJVvaQs +-> ssh-ed25519 VIHjXg MGeEvCck1ARo/TxlmAHWJRCNRCH1iutPVxBDgbxHWys +tqoVcSnV8QFmK8Hzbjxq5CZMPfNxe7ufdlIYJ1+zgBs +-> ssh-ed25519 VEv3zg R1kJsG36cnUDcqutbSKus+B9av9OXrMbSFG9pGTCbn8 +m1z30NY9Cv1YBLXtAWmu2wSLtynmOtHBOlMk17Yhjq4 +-> ssh-ed25519 6ZS9Zw ek5y0vR9OREgHjVqDP/eH1qkvs80dbxzUI/C1DlGSm0 +w0AI+4iERqCUtDjMp2URrot8bg8SENnvt0wXokc34Rc +-> ssh-ed25519 2S7Wcg NOBRnVfemlLQk81kpmrbljNHt8D2dpJV/WHYQiWsODA +wtOhDcrMZZ9zNCMOLimdkSKuPndn780c7RbwI+96wv8 +-> ssh-ed25519 izZ3FQ ZqEqpLJ4tDzuz0b1ZePz3MnNzHspRs/gKtWeXIODXmM +Nk4+AZaIbUvLhKQb7bJymd7xRTIzEE1RRN/kgIYPZXA +-> ssh-ed25519 GB2MZQ 3UM+galNT5hacleHUJvKOAzYLkTKE8uhOchjq959DRI +JynRC7EGLA1bxcrHxxDQ7Vr1qU0zl0lqtgB+MwDQMnw +-> ssh-ed25519 FelIjw XByQp/HBvifrSC5bmKuj/hNPee5IQgTO1pQAv/NYdQ4 +2BrnkmPghL89NemCDt5W9SbfcXXgHmdmFPnLyXi0Lic +-> ssh-ed25519 TRpHkw niq2BD1m6SjSEVh+kM+j/Y+iGVczgnRDT5Tni8Rk7Ww +s0G79z6I51eugspxNN4wpFalqOHzFyVHx+wMpndLDks +-> ssh-ed25519 rKpRzQ d/sjeF8OMHELj6wtLgdFSgh2liSgE3ddc0Sp380oRBU +Bk83LEgAN0FEoEV9240hQ0JunLxX8TF4kid3cyL4/JI +-> ssh-ed25519 8/Dzqw VasILrgf+tE7pS6dWc1xA1HqUFNtPHWEmj9zqwKxcis +dCgl16Zf/n7xaXteMdRPLrzQ+1k49bFqR4Bu3j/kZvU +-> ssh-ed25519 tJyugw oRsXuD1GNQiUYC/tN+WsOPwAu6YOByV8IC0P9mNnBTQ +TB+K5hXBUl5yDVNSEA71XOdU0U/sf8UCD+2Jmht068I +--- Yxo+i/KPUk9V+Ggv1J4d22mCm5IrEeuiZUgFOorZd+M +iCWM [{A 8WqѼxQҩ|RZW={m~mn_P]R \ No newline at end of file diff --git a/secrets/default.nix b/secrets/default.nix index 5f808f1..9c3feb3 100644 --- a/secrets/default.nix +++ b/secrets/default.nix @@ -25,6 +25,8 @@ in "infinidoge-password" "root-password" "binary-cache-private-key" + "borg-password" + "borg-ssh-key" ; } (mkIf config.services.nginx.enable { diff --git a/secrets/secrets.nix b/secrets/secrets.nix index bd3b6a7..34c8636 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -31,4 +31,6 @@ in "inx.moe.key.age".publicKeys = allKeys; "vaultwarden.age".publicKeys = allKeys; "freshrss.age".publicKeys = allKeys; + "borg-password.age".publicKeys = allKeys; + "borg-ssh-key.age".publicKeys = allKeys; }