Fix: Use nix flake check for hooks, simplify module, remove apps

2026-02-05 17:26:54 +01:00
parent 4ac16cedc4
commit e5c8fb3d48
21 changed files with 1538 additions and 101 deletions
--- a/modules/backups/cloud-hosts.nix
+++ b/modules/backups/cloud-hosts.nix
@@ -0,0 +1,105 @@
+{
+  lib,
+  config,
+  ...
+}:
+
+let
+  cfg = config.cloud-host-backup;
+in
+{
+  options = {
+    cloud-host-backup = {
+      enable = lib.mkEnableOption "pull backups from cloud hosts via SFTP";
+
+      hosts = lib.mkOption {
+        type = lib.types.attrsOf (
+          lib.types.submodule {
+            options = {
+              hostname = lib.mkOption {
+                type = lib.types.str;
+                description = "SSH hostname of the cloud host";
+              };
+              username = lib.mkOption {
+                type = lib.types.str;
+                default = config.secrets.username;
+                description = "SSH username for the cloud host";
+              };
+              remotePath = lib.mkOption {
+                type = lib.types.str;
+                default = "/home";
+                description = "Remote path to backup";
+              };
+              excludePatterns = lib.mkOption {
+                type = lib.types.listOf lib.types.str;
+                description = "Exclude patterns for restic";
+                default = [ ];
+              };
+            };
+          }
+        );
+        default = { };
+        example = {
+          andromache = {
+            hostname = "andromache.local";
+          };
+        };
+      };
+
+      b2Bucket = lib.mkOption {
+        type = lib.types.str;
+        description = "B2 bucket name";
+      };
+
+      passwordFile = lib.mkOption {
+        type = lib.types.str;
+        default = config.sops.secrets."restic_password".path;
+      };
+
+      sshKeyFile = lib.mkOption {
+        type = lib.types.str;
+        default = "/home/${config.secrets.username}/.ssh/id_ed25519";
+        description = "SSH private key file for authentication";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    sops.templates = lib.mapAttrs' (
+      hostName: hostCfg:
+      lib.nameValuePair "restic/repo-cloud-${hostName}" {
+        content = "b2:${config.sops.placeholder."b2_bucket_name"}:${hostName}/";
+      }
+    ) cfg.hosts;
+
+    services.restic.backups = lib.mapAttrs' (
+      hostName: hostCfg:
+      lib.nameValuePair "cloud-${hostName}" {
+        repositoryFile = config.sops.templates."restic/repo-cloud-${hostName}".path;
+        passwordFile = cfg.passwordFile;
+        paths = [ "sftp:${hostCfg.username}@${hostCfg.hostname}:${hostCfg.remotePath}" ];
+        timerConfig = {
+          OnCalendar = "daily";
+          Persistent = true;
+        };
+        initialize = true;
+        extraBackupArgs = [
+          "--one-file-system"
+        ]
+        ++ lib.optional (hostCfg.excludePatterns != [ ]) (
+          builtins.concatStringsSep " " (map (p: "--exclude ${p}") hostCfg.excludePatterns)
+        );
+        pruneOpts = [
+          "--keep-daily 7"
+          "--keep-weekly 4"
+          "--keep-monthly 6"
+          "--keep-yearly 1"
+        ];
+        environmentFile = config.sops.templates."restic/b2-env".path;
+        extraOptions = [
+          "sftp.command=ssh -i ${cfg.sshKeyFile} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
+        ];
+      }
+    ) cfg.hosts;
+  };
+}