diff --git a/.gitignore b/.gitignore index 666ca4a..45bb3a3 100644 --- a/.gitignore +++ b/.gitignore @@ -8,4 +8,5 @@ /result/ /*.qcow2 /server.md -r2-upload-api.md \ No newline at end of file +r2-upload-api.md +torrent.md \ No newline at end of file diff --git a/flake.nix b/flake.nix index 7afb206..2626b67 100644 --- a/flake.nix +++ b/flake.nix @@ -58,6 +58,7 @@ ./modules/services/jirorian.nix ./modules/services/nip05.nix ./modules/services/torrent-tracker.nix + ./modules/services/backup.nix ./modules/users/tobias.nix ]; }; diff --git a/modules/services/backup.nix b/modules/services/backup.nix new file mode 100644 index 0000000..e715cfb --- /dev/null +++ b/modules/services/backup.nix @@ -0,0 +1,41 @@ +{ config, pkgs, ... }: +let + nostrDb = "/var/lib/nostr-rs-relay/nostr.db"; + jiroriDb = "/var/lib/jirorian/jirorian.db"; + dumpDir = "/var/cache/borg-dumps"; +in +{ + sops.secrets.borg_ssh_key = { mode = "0400"; }; + sops.secrets.borg_passphrase = {}; + + services.borgbackup.jobs.databases = { + repo = "ssh://snh7mkwh@snh7mkwh.repo.borgbase.com/./repo"; + paths = [ dumpDir ]; + + encryption = { + mode = "repokey-blake2"; + passCommand = "cat ${config.sops.secrets.borg_passphrase.path}"; + }; + + environment.BORG_RSH = + "ssh -i ${config.sops.secrets.borg_ssh_key.path} -o StrictHostKeyChecking=accept-new"; + + preHook = '' + mkdir -p ${dumpDir} + ${pkgs.sqlite}/bin/sqlite3 ${nostrDb} ".backup '${dumpDir}/nostr.db'" + ${pkgs.sqlite}/bin/sqlite3 ${jiroriDb} ".backup '${dumpDir}/jirorian.db'" + ''; + + postHook = '' + rm -f ${dumpDir}/nostr.db ${dumpDir}/jirorian.db + ''; + + startAt = "daily"; + + prune.keep = { + daily = 7; + weekly = 4; + monthly = 6; + }; + }; +} diff --git a/secrets/bucur.yaml b/secrets/bucur.yaml index bbc38d6..a1025de 100644 --- a/secrets/bucur.yaml +++ b/secrets/bucur.yaml @@ -7,6 +7,8 @@ jirorian_r2_secret_access_key: ENC[AES256_GCM,data:ix+y6sdDa+Ze40ty1hQufoi6NCmWL jirorian_r2_endpoint: ENC[AES256_GCM,data:9mokSsGMS2dU72sMEpQNbsjysalOlMnHdd/VS2ebaG7ah80e8p7zG9IJxsXx/6jHy9XPPO+1ItsyhyNhyovfGs0=,iv:inCCSHuHI4X/B0jFilT3j/c4CNntOsti4pdsj1Z7xhE=,tag:OJWu/xmT1Y/XxbWG2mqCrA==,type:str] jirorian_app_secrets: ENC[AES256_GCM,data:soUEk9GBrpN03+5rqMd2s9qT6sFGAswZUWjKjAHz0k058AJaNbOVlTW56CUjMG25/noIQzhwgqO7IVOzP1+UcdSOqB/67y7Q2rWG0ua8Nxg+qALV5e4Ub6rKGpgYHUfnwYW2wYi7UyxZQe1/mFaG6zCbahp956q/GHYUbXAPfXJcsFjZb0bkenUbrpxkKGdAadPfjwbdSD8ZXadGdwA=,iv:DXdxNIphpTkfcWLfWQrIG2GPsFp1WDLMp16M1Dbv4T8=,tag:ZuBf0XEPFKYCqvFe5FVvow==,type:str] tracker_secret: ENC[AES256_GCM,data:gtZnzmOcskS7P/dsq38wZ9Qmrvs7ZgwT/lrelfuMP340dJfBs2iox3r+Vkpl2a4HEaZIRM2hOkY/Y211+RxIsw==,iv:/ljreSQUAPH77K+UgCtfh5N19/yBFTFXF8zYK8rTt2c=,tag:PdBEGoEiEPzyy/cDWcSL/w==,type:str] +borg_passphrase: ENC[AES256_GCM,data:3LkFvNMdRKUhcxRizS2GO3PCABelXoTYl4rmtoNjyozbGZczC52BSec6Nw==,iv:OveTurmZag0wZXQnVTUdoN1ReTAqLCxoYn3KVwmPKuk=,tag:btzArAb4aJwGAisUwtbstg==,type:str] +borg_ssh_key: ENC[AES256_GCM,data:TQRdUDeVTZ3/QDC3uyMKKYoN7TMLDunF54tSDSaTR4M2P0BN3kgjpPyAWjnhHTddbIZdAnaUu4y/GWd4xmtT2pcoXLLCm+iV32sRoZsr4ax4cd0hBBfIStf/zwqQ17SHEzNCknUH1aTYdWhX6Uo9j3l5fs7cWgGXEDbjNob3SXnZKuqjhCdZgaoqeHqteKUUnosQbNFDGMN8BUV2qnDhTfp2KDDJkyS3xJnsGGmBJCmJBTh6AGn5y9dgtGwj5LAaRBeG7ZG04AfAxohG6sYU1Jg1Eq8KZFRXJ6IQY7KwImFEtZocpqPeorBVqS1z02HG8Np86SDtcrf+x0p7VCcmXcp3bLuq0DeAoQSX02WIwHtj0rFK2CKYYTu8Q0hTKpe/czEw1puVfYkHIgKomuxED4xoZdNPYuAOD/3EiKNTHe8bqOgLpHQuLtbLaiC4W23nny10Wn+ZzGnXiDnk+iu1wnPp+NOR+vNG9zoXSZMheHIPWTMi42c6hE8EDewef54UmYrkuEcyglWzxU8SZRl/e25u2OEGOy94Nn1C,iv:nSi3hi9g68ZNbzFonhS/OpDTdlj5FKidldS9eYqECXQ=,tag:CObPRrDxrmRy5DYL30nJWA==,type:str] sops: age: - recipient: age1647c5f46njylggj33h26t6twhq57n5qeaza04l845uy0fksv0ucsq82c3d @@ -18,7 +20,7 @@ sops: U0x1ZmtzLytSL1Y3cVo1ZVJ2Ymtob1EKTpgjSymQx14wLSuUhh5Txq++3DrLS4Bs x8vVtQgcXZgv1q0OMGup6DT4bkY6UiNbn9bAt4rHCaRPeb15x4ZKNw== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-06-08T13:00:51Z" - mac: ENC[AES256_GCM,data:Kwy8aZ3zAnmMyWpezwQGfs+5tyJSyeqFYW0UYzz0A9sVB0vxn2LcTEYNc6+D/X75Gsaxwz7wlDTuzzvHZqlMAD/c9bZRcKcSZjeME0NXfaCeB8UyazlxELYcttHEUB3IQaL+MOxzWjqTyYxivhPvFaPRYmv8N1m5GMY7LXB79ls=,iv:IX6pj5Kp8GEQb+QrztXm5MRMDlmvDYGXiH6hmmENH2M=,tag:r740JHuEEcFuvhlvFzqqDg==,type:str] + lastmodified: "2026-06-08T13:49:29Z" + mac: ENC[AES256_GCM,data:VfC6GDzsw86WFY3vmi8oTGSQLqXZzS9QdJn0BGg22kX4KG9PBgcH9aYdDpcnFjjsymkeZ6ar1CTuX8tOmnYHfWyeTbQ1s7tketCzL8EPLAs9IxbpRI2ouTZiKvZLLYYKSGaoRI9IMboBA5Jj9UVswqAmbnWI3EmFYjSV76UhlVs=,iv:n+pnLX2BWN4uApbJd3v2KUjrgQYH1LXHOVzynb++YIw=,tag:ffrd8KbkB24vgrNMAwjb1g==,type:str] unencrypted_suffix: _unencrypted version: 3.11.0