kfm/niveum
1
0
Fork 0
mirror of https://github.com/kmein/niveum synced 2026-03-21 04:11:07 +01:00
Code Releases Activity

feat(restic): run on makanek, prometheus

Browse Source
This commit is contained in:
Kierán Meinhardt
2022-01-18 23:28:53 +01:00
parent bdc5c147dd
commit 30c2bfe598
5 changed files with 34 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
configs/backup.nix
View File

@@ -1,11 +1,11 @@
{ pkgs, config, ... }: { pkgs, config, ... }:
let let
repository = "rest:http://zaatar.r:3571/"; inherit (import <niveum/lib>) restic;
in in
{ {
services.restic.backups.niveum = { services.restic.backups.niveum = {
initialize = true; initialize = true;
inherit repository; inherit (restic) repository;
timerConfig = { OnCalendar = "00:05"; RandomizedDelaySec = "5h"; }; timerConfig = { OnCalendar = "00:05"; RandomizedDelaySec = "5h"; };
passwordFile = toString <secrets/restic/password>; passwordFile = toString <secrets/restic/password>;
paths = [ paths = [
@@ -15,7 +15,7 @@ in
environment.systemPackages = [ environment.systemPackages = [
(pkgs.writers.writeDashBin "restic-niveum" '' (pkgs.writers.writeDashBin "restic-niveum" ''
${pkgs.restic}/bin/restic -r ${repository} -p ${<secrets/restic/password>} "$@" ${pkgs.restic}/bin/restic -r ${restic.repository} -p ${<secrets/restic/password>} "$@"
'') '')
]; ];
} }

6
lib/default.nix
View File

@@ -1,6 +1,12 @@
rec { rec {
tmpfilesConfig = {type, path, mode ? "-", user ? "-", group ? "-", age ? "-", argument ? "-"}: "${type} '${path}' ${mode} ${user} ${group} ${age} ${argument}"; tmpfilesConfig = {type, path, mode ? "-", user ? "-", group ? "-", age ? "-", argument ? "-"}: "${type} '${path}' ${mode} ${user} ${group} ${age} ${argument}";
restic = rec {
port = 3571;
host = "zaatar.r";
repository = "rest:http://${host}:${toString port}/";
};
firewall = lib: { firewall = lib: {
accept = { source, protocol, dport }: "nixos-fw -s ${lib.escapeShellArg source} -p ${lib.escapeShellArg protocol} --dport ${lib.escapeShellArg (toString dport)} -j nixos-fw-accept"; accept = { source, protocol, dport }: "nixos-fw -s ${lib.escapeShellArg source} -p ${lib.escapeShellArg protocol} --dport ${lib.escapeShellArg (toString dport)} -j nixos-fw-accept";
addRules = lib.concatMapStringsSep "\n" (rule: "iptables -A ${rule}"); addRules = lib.concatMapStringsSep "\n" (rule: "iptables -A ${rule}");

17
systems/makanek/configuration.nix
View File

@@ -1,6 +1,6 @@
{ lib, config, pkgs, ... }: { lib, config, pkgs, ... }:
let let
inherit (import <niveum/lib>) kieran retiolumAddresses; inherit (import <niveum/lib>) kieran retiolumAddresses restic;
in in
{ {
imports = [ imports = [
@@ -27,6 +27,21 @@ in
<niveum/modules/retiolum.nix> <niveum/modules/retiolum.nix>
]; ];
services.restic.backups.niveum = {
initialize = true;
inherit (restic) repository;
timerConfig = { OnCalendar = "00:05"; RandomizedDelaySec = "5h"; };
passwordFile = toString <secrets/restic/password>;
paths = [
"/var/lib/codimd"
"/var/lib/postgresql"
"/var/lib/weechat"
"/var/lib/nextcloud"
"/var/lib/grafana"
"/var/lib/gitea"
];
};
networking = { networking = {
firewall.allowedTCPPorts = [ 80 443 ]; firewall.allowedTCPPorts = [ 80 443 ];
hostName = "makanek"; hostName = "makanek";

6
systems/makanek/monitoring/default.nix
View File

@@ -2,6 +2,7 @@
let let
lokiConfig = import ./loki.nix; lokiConfig = import ./loki.nix;
blackboxConfig = import ./blackbox.nix; blackboxConfig = import ./blackbox.nix;
inherit (import <niveum/lib>) restic;
in in
{ {
services.grafana = { services.grafana = {
@@ -180,7 +181,10 @@ in
} }
{ {
job_name = "zaatar"; job_name = "zaatar";
static_configs = [ { targets = [ "zaatar.r:${toString config.services.prometheus.exporters.node.port}" ]; } ]; static_configs = [ { targets = [
"zaatar.r:${toString config.services.prometheus.exporters.node.port}"
"zaatar.r:${toString restic.port}"
]; } ];
} }
]; ];

9
systems/zaatar/backup.nix
View File

@@ -1,8 +1,7 @@
{ lib, ... }: { lib, ... }:
let let
resticPort = 3571;
niveumLib = import <niveum/lib>; niveumLib = import <niveum/lib>;
inherit (niveumLib) retiolumAddresses; inherit (niveumLib) retiolumAddresses restic;
firewall = niveumLib.firewall lib; firewall = niveumLib.firewall lib;
in in
{ {
@@ -11,13 +10,13 @@ in
appendOnly = true; appendOnly = true;
dataDir = "/backup/restic"; dataDir = "/backup/restic";
prometheus = true; prometheus = true;
extraFlags = [ "--no-auth" "--prometheus-no-auth" ]; # auth is done via firewall extraFlags = [ "--no-auth" ]; # auth is done via firewall
listenAddress = ":${toString resticPort}"; listenAddress = ":${toString restic.port}";
}; };
networking.firewall = networking.firewall =
let let
dport = resticPort; dport = restic.port;
protocol = "tcp"; protocol = "tcp";
rules = [ rules = [
(firewall.accept { inherit dport protocol; source = retiolumAddresses.kabsa.ipv4; }) (firewall.accept { inherit dport protocol; source = retiolumAddresses.kabsa.ipv4; })