hosts/pumpkin/syncoid.nix

   1 {
   2   pkgs,
   3   lib,
   4   config,
   5   inputs,
   6   hostName,
   7   ...
   8 }:
   9 let
  10   inherit (config.users) users;
  11   pumpkin2off2 =
  12     conf:
  13     lib.mapAttrs (_n: v: lib.recursiveUpdate v conf) {
  14       "pumpkin/root" =
  15         let
  16           targetHost = "aubergine.local";
  17         in
  18         {
  19           target = "backup@${targetHost}:off2/julm/backup/pumpkin";
  20           sendOptions = "raw";
  21           recursive = true;
  22           extraArgs = [
  23             "--create-bookmark"
  24             "--no-sync-snap"
  25             "--no-privilege-elevation"
  26             "--preserve-properties"
  27             "--preserve-recordsize"
  28             "--recursive"
  29             "--sendoptions=w"
  30             "--recvoptions=u"
  31             "--exclude"
  32             "pumpkin/root/nix"
  33             "--exclude"
  34             "pumpkin/root/var/cache"
  35             "--exclude"
  36             "pumpkin/root/var/log"
  37             "--exclude"
  38             "pumpkin/root/home/julm/.cache"
  39             "--exclude"
  40             "pumpkin/root/home/julm/games"
  41             "--sshconfig"
  42             "${pkgs.writeText "ssh-config" ''
  43               Host *
  44                 Ciphers aes128-gcm@openssh.com
  45                 Compression no
  46                 StrictHostKeyChecking yes
  47                 UserKnownHostsFile ${pkgs.writeText "known_hosts" ''
  48                   ${targetHost} ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN/cT/L3dF7uoR3s7NB59NiKjuk35I6x+7MK5zhwOy6k
  49                 ''}
  50             ''}"
  51           ];
  52         };
  53     };
  54 in
  55 {
  56   networking.nftables.ruleset = lib.mkAfter ''
  57     table inet filter {
  58       chain output-net {
  59         skuid @nixos_syncoid_uids \
  60           meta l4proto tcp \
  61           counter accept \
  62           comment "syncoid: SSH"
  63       }
  64     }
  65   '';
  66   systemd.tmpfiles.rules = [
  67     "z /dev/zfs 0660 - ${config.users.groups."disk".name}  -"
  68   ];
  69   # ExplanationNote: give access to /var/run/avahi-daemon/socket
  70   # Using /var/run is not working due to RootDirectoryStartOnly=true
  71   systemd.services.syncoid-pumpkin-root.serviceConfig.BindReadOnlyPaths = [ "/var/run" ];
  72   systemd.services.syncoid-pumpkin-root.serviceConfig.RootDirectoryStartOnly = lib.mkForce false;
  73   systemd.services.syncoid-pumpkin-root.serviceConfig.ExecStartPost =
  74     pkgs.writeShellScript "zfs-fix-bookmarks" ''
  75       set -ux
  76       for s in $(zfs list -Hrpt snapshot -o name pumpkin); do
  77         zfs bookmark "$s" "''${s//@/#}" || true
  78       done
  79     '';
  80   services.syncoid = {
  81     enable = true;
  82     interval = "*-*-* *:05:00";
  83     #interval = "*:0/1";
  84     sshKey = "ssh.key:${syncoid/ssh.key.cred}";
  85     commonArgs = [
  86       #"--debug"
  87       "--no-sync-snap"
  88       "--create-bookmark"
  89       #"--no-privilege-elevation"
  90       #"--no-stream"
  91       #"--preserve-recordsize"
  92       #"--preserve-properties"
  93     ];
  94     service = {
  95       serviceConfig.Group = config.users.groups."disk".name;
  96     };
  97     commands = { } // pumpkin2off2 { };
  98   };
  99 }