SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 18:41:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix restic backups

Browse source
This commit is contained in:
SebastianStork 2024-09-23 22:41:05 +02:00
parent 527b21ba3e
commit 3b79475d21
2 changed files with 15 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

6
hosts/stratus/containers/nspawn/default.nix
View file

@ -48,9 +48,9 @@ in
bindMounts = {
"/run/secrets/container/tailscale-auth-key" = { };
"/run/secrets/container/${name}" = { };
"/run/secrets/restic" = { };
"/run/secrets/healthchecks-ping-key" = { };
"/run/secrets/container/${name}".isReadOnly = false;
"/run/secrets/restic".isReadOnly = false;
"/run/secrets/healthchecks-ping-key".isReadOnly = false;
${dataDirOf name}.isReadOnly = false;
"/var/lib/tailscale" = {

16
modules/system/restic-backup.nix
View file

@ -31,11 +31,19 @@ in
};
config = lib.mkIf (cfg != { }) {
systemd.tmpfiles.rules = lib.mapAttrsToList (
name: value: "d /var/cache/restic-backups-${name} 700 ${value.user} ${value.user} -"
) cfg;
systemd.tmpfiles.rules =
(lib.optionals (!config.myConfig.sops.enable) [
"z /run/secrets/restic/environment 440 root ${config.users.groups.backup.name} -"
"z /run/secrets/restic/password 440 root ${config.users.groups.backup.name} -"
"z /run/secrets/healthchecks-ping-key 440 root ${config.users.groups.backup.name} -"
])
++ lib.mapAttrsToList (
name: value: "d /var/cache/restic-backups-${name} 700 ${value.user} ${value.user} -"
) cfg;
users.groups.backup.members = lib.mapAttrsToList (_: value: value.user) cfg;
users.groups.backup.members = builtins.filter (user: user != config.users.users.root.name) (
lib.mapAttrsToList (_: value: value.user) cfg
);
sops.secrets = lib.optionalAttrs config.myConfig.sops.enable (
let