SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 23:11:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Integrate suspend-service into restic module

Browse source
This commit is contained in:
SebastianStork 2025-06-07 01:04:01 +02:00
parent cdeabbcc84
commit b5e7d9dce2
5 changed files with 43 additions and 91 deletions
Download patch file Download diff file Expand all files Collapse all files

32
modules/system/services/restic-backups/default.nix
View file

@ -1,5 +1,6 @@
{
config,
pkgs,
lib,
...
}:
@ -20,6 +21,10 @@ in
type = lib.types.str;
default = config.users.users.root.name;
};
suspendService = lib.mkOption {
type = lib.types.nullOr lib.types.nonEmptyStr;
default = null;
};
extraConfig = lib.mkOption {
type = lib.types.attrsOf lib.types.anything;
default = { };
@ -52,6 +57,27 @@ in
"restic/password" = resticPermissions;
};
security.polkit = {
enable = resticBackups |> lib.attrValues |> lib.any (value: value.suspendService != null);
extraConfig =
let
mkAllowRule = service: user: ''
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units" &&
action.lookup("unit") == "${service}" &&
subject.user == "${user}") {
return polkit.Result.YES;
}
});
'';
in
resticBackups
|> lib.attrValues
|> lib.filter (value: value.suspendService != null)
|> lib.map (value: mkAllowRule value.suspendService value.user)
|> lib.concatLines;
};
services.restic.backups =
resticBackups
|> lib.mapAttrs (
@ -63,6 +89,12 @@ in
repository = "s3:https://s3.eu-central-003.backblazeb2.com/stork-atlas/${name}";
environmentFile = config.sops.secrets."restic/environment".path;
passwordFile = config.sops.secrets."restic/password".path;
backupPrepareCommand = lib.mkIf (value.suspendService != null) (
lib.mkBefore "${lib.getExe' pkgs.systemd "systemctl"} stop ${value.suspendService}"
);
backupCleanupCommand = lib.mkIf (value.suspendService != null) (
lib.mkAfter "${lib.getExe' pkgs.systemd "systemctl"} start ${value.suspendService}"
);
pruneOpts = [
"--keep-daily 7"
"--keep-weekly 5"