From 41ac027216aa206f8667f57b31c7c3889e334cd4 Mon Sep 17 00:00:00 2001 From: Henrik Lissner Date: Tue, 26 Jan 2021 20:57:03 -0500 Subject: [PATCH] Add modules/backup.nix A rudimentary backup and restoration system. --- modules/backup.nix | 210 +++++++++++++++++++++++++++++++++ modules/services/bitwarden.nix | 7 ++ modules/services/gitea.nix | 7 ++ 3 files changed, 224 insertions(+) create mode 100644 modules/backup.nix diff --git a/modules/backup.nix b/modules/backup.nix new file mode 100644 index 00000000..b5c65f46 --- /dev/null +++ b/modules/backup.nix @@ -0,0 +1,210 @@ +# modules/backup.nix --- in-house backup/restoration procedures +# +# A simple way to register certain file paths as backup targets. They will be +# incrementally backed up to /run/backups/$NAME/$DATE/. +# /run/backups/{backup,restore}.sh scripts will be available for easy backing up +# or restoration of said data. +# +# Warning: don't use me yet, it's a WIP. + +{ options, config, lib, pkgs, ... }: + +with lib; +with lib.my; +let cfg = config.modules.backup; + + backupType = with types; submodule ({ config, ... }: { + options = { + enable = mkBoolOpt false; + + name = mkOpt' str config._module.args.name "Name of this backup"; + owner = mkOpt str "backup"; + group = mkOpt str users.${config.owner}.group; + mode = mkOpt str "0400"; + + baseDir = mkOpt' (either str path) "" "Base directory for backup targets"; + targets = mkOpt' (listOf (either str path)) [] '' + List of file globs or paths to files/directories that will be backed + up (or restored) for this target. Paths are relative to this target's + baseDir to modules.backup.path. + ''; + + backupScript = mkOpt' lines "" '' + Script to run when backing up this target. The current directory is + this target's baseDir and $outdir contains the backup destination. + ''; + restoreScript = mkOpt' lines "" '' + Script to run when restoring this target's backed up files. The + current directory is this target's latest backup directory and $outdir + contains the restoration destination. + ''; + + suspendServices = mkOpt (listOf str) [] '' + Systemd services to suspend while backing up or restoring this target. + ''; + maxGenerations = mkOpt' int cfg.maxGenerations '' + How many generations of backups to keep in store + ''; + }; + }); + + targetBackupScript = target: writeShellScriptBin "backup.sh" '' + ${optionalString (target.enable != true) '' + echo "Skipping ${target.name} (reason: disabled)" + exit 0 + ''} + set -e + basedir="${cfg.path}/${target.name}" + indir="${target.baseDir}" + outdir="$basedir/$(date +"%Y%m%d-%H%M%S)" + + # Ensure current generation's backup folder exists, and we're in it + rm -rf "$outdir" + mkdir -p "$outdir" && cd "$outdir" + + # Suspend dependent services + ${concatStringSep "\n" (map (s: "systemctl stop ${s}") target.suspendServices)} + + # Backup individual targets + ${concatStringSep "\n" + (mapAttrsToList (n: v: ''cp -RTfpv "$indir/"${v} "$outdir/"'') target.targets)} + + # Launch custom script + ${optionalString (target.backupScript != "") target.backupScript} + + # Clean up excess generations + gens="$(ls -1dtr "$basedir" | head -n -${target.maxGenerations})" + for gen in $gens; do rm -rf $gen; done + ln -sf "$basedir/latest" "$outdir" + + # Resume services + ${concatStringSep "\n" (map (s: "systemctl start ${s}") target.suspendServices)} + ''; + + targetRestoreScript = target: writeShellScriptBin "restore.sh" '' + set -e + indir="${cfg.path}/${target.name}/latest" + outdir="${target.baseDir}" + cd "$indir" + + # Suspend services + ${concatStringSep "\n" + (map (s: "systemctl stop #{s}") target.suspendServices)} + + # Restore individual targets + ${concatStringSep "\n" + (mapAttrsToList (n: v: ''cp -RTfpv "$indir/"${v} "$outdir/"'') target.targets)} + + # Launch custom script + ${optionalString (target.restoreScript != "") target.restoreScript} + + # Resume services + ${concatStringSep "\n" (map (s: "systemctl start ${s}") target.suspendServices)} + ''; + + backupBin = writeShellScriptBin "hey-backup" '' + if [[ $1 ]]; then + if [[ ! -x ${cfg.path}/$1/backup.sh ]]; then + >&2 echo "Could not find backup for #{name}. Aborting..." + exit 1 + fi + echo "Backing up $1" + $i/backup.sh + else + echo "Backing up all targets" + for i in ${cfg.path}/*; do + echo "Backing up: $i" + $i/backup.sh + done + fi + ''; + + restoreBin = writeShellScriptBin "hey-restore" '' + if [[ ! -d ${cfg.path} || -z "$(ls -A ${cfg.path})" ]]; then + >&2 echo "No backups on this system. Aborting..." + exit 1 + fi + if [[ $1 ]]; then + if [[ ! -x ${cfg.path}/$1/restore.sh ]]; then + >&2 echo "Could not find backup for #{name}. Aborting..." + exit 1 + fi + echo "Restoring $1" + ${cfg.path}/$1/restore.sh + else + echo "Restoring all targets from latest backup" + for i in ${cfg.path}/*; do + echo "Restoring backup: $i" + done + fi + ''; +in { + options.modules.backup = with types; { + enable = mkBoolOpt false; + path = mkOpt (either path str) "/run/backups"; + targets = mkOpt (attrsOf backupType) {}; + schedule = mkOpt str ""; # e.g. "02:00" + maxGenerations = mkOpt int 5; + }; + + config = mkIf (cfg.enable && cfg.targets != {}) { + users.users.backup = { + description = "The nixos backup service"; + group = "backup"; + home = cfg.path; + isSystemUser = true; + useDefaultShell = true; + }; + users.groups.backup = {}; + + + system.activationScripts.backupInit = '' + echo "Generating backup files" + BASEDIR="${cfg.path}" + mkdir -p "$BASEDIR" + chown backup:backup "$BASEDIR" + chmod 700 "$BASEDIR" + ${concatStringSep "\n" (mapAttrsToList (n: v: '' + echo "Generating backup dir: $BASEDIR" + TARGETDIR="$BASEDIR/${v.name}" + mkdir -p "$TARGETDIR" + chown ${v.owner}:${v.group} "$TARGETDIR" + chmod ${v.mode} "$TARGETDIR" + cp -f ${targetBackupScript v}/bin/backup.sh "$TARGETDIR/backup.sh" + cp -f ${targetRestoreScript v}/bin/restore.sh "$TARGETDIR/restore.sh" + chmod 700 {backup,restore}.sh + '') cfg.targets)} + echo "Generated backup files!" + ''; + + + systemd.services.hey-backups = { + description = "Backup system"; + environment.TARGET_DIR = cfg.path; + serviceConfig = { + SyslogIdentifier = "hey-backups"; + Type = "oneshot"; + User = mkDefault user; + Group = mkDefault group; + ExecStart = "${pkgs.bash}/bin/bash ${backupBin}/bin/hey-backup"; + }; + wantedBy = [ "multi-user.target" ]; + }; + + systemd.timers.hey-backups = mkIf (cfg.schedule != "") { + description = "Backup dotfile targets on time"; + timerConfig = { + OnCalendar = cfg.schedule; + Persistent = "true"; + Unit = "hey-backups.service"; + }; + wantedBy = [ "multi-user.target" ]; + }; + + # Add 'bin/hey backup' extensions to PATH + environment.systemPackages = [ + backupBin + restoreBin + ]; + }; +} diff --git a/modules/services/bitwarden.nix b/modules/services/bitwarden.nix index 09027592..2ba57d22 100644 --- a/modules/services/bitwarden.nix +++ b/modules/services/bitwarden.nix @@ -18,5 +18,12 @@ in { filter = bitwarden_rs port = 80,443,8002 ''; + + modules.backup.targets.bitwarden = { + baseDir = "/var/lib/bitwarden_rs"; + owner = "bitwarden_rs"; + targets = [ "*" ]; + suspendServices = [ "bitwarden_rs" ]; + }; }; } diff --git a/modules/services/gitea.nix b/modules/services/gitea.nix index 8dc6195d..3eaaabd4 100644 --- a/modules/services/gitea.nix +++ b/modules/services/gitea.nix @@ -39,5 +39,12 @@ in { findtime = 3600 banaction = %(banaction_allports)s ''; + + modules.backup.targets.gitea = { + baseDir = config.users.users.git.home; + owner = "git"; + targets = [ "repositories" "data" ]; + suspendServices = [ "gitea" ]; + }; }; }