SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 17:31:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Integrate suspend-service into restic module

Browse source
This commit is contained in:
SebastianStork 2025-06-07 01:04:01 +02:00
parent cdeabbcc84
commit b5e7d9dce2
5 changed files with 43 additions and 91 deletions
Download patch file Download diff file Expand all files Collapse all files

24
modules/system/services/actualbudget/backups.nix
View file

@ -11,30 +11,10 @@ in
options.custom.services.actualbudget.backups.enable = lib.mkEnableOption "";
config = lib.mkIf config.custom.services.actualbudget.backups.enable {
security.polkit = {
enable = true;
extraConfig =
let
service = "actual.service";
in
''
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units" &&
action.lookup("unit") == "${service}" &&
subject.user == "${user}") {
return polkit.Result.YES;
}
});
'';
};
custom.services.resticBackups.actual = {
inherit user;
extraConfig = {
backupPrepareCommand = "${lib.getExe' pkgs.systemd "systemctl"} stop actual.service";
backupCleanupCommand = "${lib.getExe' pkgs.systemd "systemctl"} start actual.service";
paths = [ config.services.actual.settings.dataDir ];
};
suspendService = "actual.service";
extraConfig.paths = [ config.services.actual.settings.dataDir ];
};
environment.systemPackages = [

24
modules/system/services/forgejo/backups.nix
View file

@ -11,30 +11,10 @@ in
options.custom.services.forgejo.backups.enable = lib.mkEnableOption "";
config = lib.mkIf config.custom.services.forgejo.backups.enable {
security.polkit = {
enable = true;
extraConfig =
let
service = "forgejo.service";
in
''
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units" &&
action.lookup("unit") == "${service}" &&
subject.user == "${user}") {
return polkit.Result.YES;
}
});
'';
};
custom.services.resticBackups.forgejo = {
inherit user;
extraConfig = {
backupPrepareCommand = "${lib.getExe' pkgs.systemd "systemctl"} stop forgejo.service";
backupCleanupCommand = "${lib.getExe' pkgs.systemd "systemctl"} start forgejo.service";
paths = [ config.services.forgejo.stateDir ];
};
suspendService = "forgejo.service";
extraConfig.paths = [ config.services.forgejo.stateDir ];
};
environment.systemPackages = [

24
modules/system/services/hedgedoc/backups.nix
View file

@ -11,34 +11,14 @@ in
options.custom.services.hedgedoc.backups.enable = lib.mkEnableOption "";
config = lib.mkIf config.custom.services.hedgedoc.backups.enable {
security.polkit = {
enable = true;
extraConfig =
let
service = "hedgedoc.service";
in
''
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units" &&
action.lookup("unit") == "${service}" &&
subject.user == "${user}") {
return polkit.Result.YES;
}
});
'';
};
custom.services.resticBackups.hedgedoc = {
inherit user;
extraConfig = {
backupPrepareCommand = "${lib.getExe' pkgs.systemd "systemctl"} stop hedgedoc.service";
backupCleanupCommand = "${lib.getExe' pkgs.systemd "systemctl"} start hedgedoc.service";
paths = with config.services.hedgedoc.settings; [
suspendService = "hedgedoc.service";
extraConfig.paths = with config.services.hedgedoc.settings; [
uploadsPath
db.storage
];
};
};
environment.systemPackages = [
(pkgs.writeShellApplication {

32
modules/system/services/restic-backups/default.nix
View file

@ -1,5 +1,6 @@
{
config,
pkgs,
lib,
...
}:
@ -20,6 +21,10 @@ in
type = lib.types.str;
default = config.users.users.root.name;
};
suspendService = lib.mkOption {
type = lib.types.nullOr lib.types.nonEmptyStr;
default = null;
};
extraConfig = lib.mkOption {
type = lib.types.attrsOf lib.types.anything;
default = { };
@ -52,6 +57,27 @@ in
"restic/password" = resticPermissions;
};
security.polkit = {
enable = resticBackups |> lib.attrValues |> lib.any (value: value.suspendService != null);
extraConfig =
let
mkAllowRule = service: user: ''
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units" &&
action.lookup("unit") == "${service}" &&
subject.user == "${user}") {
return polkit.Result.YES;
}
});
'';
in
resticBackups
|> lib.attrValues
|> lib.filter (value: value.suspendService != null)
|> lib.map (value: mkAllowRule value.suspendService value.user)
|> lib.concatLines;
};
services.restic.backups =
resticBackups
|> lib.mapAttrs (
@ -63,6 +89,12 @@ in
repository = "s3:https://s3.eu-central-003.backblazeb2.com/stork-atlas/${name}";
environmentFile = config.sops.secrets."restic/environment".path;
passwordFile = config.sops.secrets."restic/password".path;
backupPrepareCommand = lib.mkIf (value.suspendService != null) (
lib.mkBefore "${lib.getExe' pkgs.systemd "systemctl"} stop ${value.suspendService}"
);
backupCleanupCommand = lib.mkIf (value.suspendService != null) (
lib.mkAfter "${lib.getExe' pkgs.systemd "systemctl"} start ${value.suspendService}"
);
pruneOpts = [
"--keep-daily 7"
"--keep-weekly 5"

24
modules/system/services/syncthing/backups.nix
View file

@ -20,30 +20,10 @@ in
}
];
security.polkit = {
enable = true;
extraConfig =
let
service = "syncthing.service";
in
''
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units" &&
action.lookup("unit") == "${service}" &&
subject.user == "${user}") {
return polkit.Result.YES;
}
});
'';
};
custom.services.resticBackups.syncthing = {
inherit user;
extraConfig = {
backupPrepareCommand = "${lib.getExe' pkgs.systemd "systemctl"} stop syncthing.service";
backupCleanupCommand = "${lib.getExe' pkgs.systemd "systemctl"} start syncthing.service";
paths = [ config.services.syncthing.dataDir ];
};
suspendService = "syncthing.service";
extraConfig.paths = [ config.services.syncthing.dataDir ];
};
environment.systemPackages = [