simplify borg server module
This commit is contained in:
parent
111fc2db57
commit
1132fc230a
1 changed files with 3 additions and 78 deletions
|
|
@ -45,13 +45,10 @@ in
|
||||||
};
|
};
|
||||||
|
|
||||||
config = mkIf cfg.enable {
|
config = mkIf cfg.enable {
|
||||||
# Install required packages
|
|
||||||
environment.systemPackages = [ pkgs.borgbackup pkgs.openssh ];
|
environment.systemPackages = [ pkgs.borgbackup pkgs.openssh ];
|
||||||
|
|
||||||
# Create borg-server group
|
|
||||||
users.groups.borg-server = {};
|
users.groups.borg-server = {};
|
||||||
|
|
||||||
# Create a system user for each borg user
|
|
||||||
users.users = mapAttrs (username: userCfg: {
|
users.users = mapAttrs (username: userCfg: {
|
||||||
isSystemUser = true;
|
isSystemUser = true;
|
||||||
group = "borg-server";
|
group = "borg-server";
|
||||||
|
|
@ -64,24 +61,20 @@ in
|
||||||
) userCfg.publicKeys;
|
) userCfg.publicKeys;
|
||||||
}) cfg.users;
|
}) cfg.users;
|
||||||
|
|
||||||
# Ensure proper permissions on data directory
|
|
||||||
systemd.tmpfiles.rules = [
|
systemd.tmpfiles.rules = [
|
||||||
"d ${cfg.dataDir} 0755 root borg-server -"
|
"d ${cfg.dataDir} 0755 root borg-server -"
|
||||||
] ++ (mapAttrsToList (username: _:
|
] ++ (mapAttrsToList (username: _:
|
||||||
"d ${cfg.dataDir}/${username} 0700 ${username} borg-server -"
|
"d ${cfg.dataDir}/${username} 0700 ${username} borg-server -"
|
||||||
) cfg.users);
|
) cfg.users);
|
||||||
|
|
||||||
# Configure SSH for borg access
|
|
||||||
services.openssh = {
|
services.openssh = {
|
||||||
enable = true;
|
enable = true;
|
||||||
ports = [ cfg.sshPort ];
|
ports = [ cfg.sshPort ];
|
||||||
settings = {
|
settings = {
|
||||||
# Keep connection alive settings
|
|
||||||
ClientAliveInterval = 10;
|
ClientAliveInterval = 10;
|
||||||
ClientAliveCountMax = 30;
|
ClientAliveCountMax = 30;
|
||||||
};
|
};
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
# SSH hardening for borg users
|
|
||||||
Match Group borg-server
|
Match Group borg-server
|
||||||
PasswordAuthentication no
|
PasswordAuthentication no
|
||||||
PubkeyAuthentication yes
|
PubkeyAuthentication yes
|
||||||
|
|
@ -92,81 +85,13 @@ in
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
# Open firewall port
|
|
||||||
networking.firewall.allowedTCPPorts = mkIf (cfg.sshPort != 22) [ cfg.sshPort ];
|
networking.firewall.allowedTCPPorts = mkIf (cfg.sshPort != 22) [ cfg.sshPort ];
|
||||||
|
|
||||||
# Create convenience scripts and aliases
|
|
||||||
environment.shellAliases = {
|
environment.shellAliases = {
|
||||||
borg-server-status = "systemctl status sshd";
|
borg-server-status = "systemctl status sshd";
|
||||||
borg-server-users = "ls -la ${cfg.dataDir}";
|
borg-server-users = "ls -la ${cfg.dataDir}";
|
||||||
borg-server-logs = "journalctl -u sshd -f";
|
borg-server-logs = "journalctl -u sshd -f";
|
||||||
|
borg-server-check = "f() { sudo -u \"$1\" borg info \"${cfg.dataDir}/$1/$2\"; }; f";
|
||||||
};
|
};
|
||||||
|
|
||||||
# Create a helper script for adding new users
|
|
||||||
environment.etc."borg-server/add-user.sh" = {
|
|
||||||
text = ''
|
|
||||||
set -e
|
|
||||||
|
|
||||||
if [ $# -lt 2 ]; then
|
|
||||||
echo "Usage: $0 <username> <ssh-public-key>"
|
|
||||||
echo "Example: $0 alice 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGxyz...'"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
USERNAME="$1"
|
|
||||||
SSH_KEY="$2"
|
|
||||||
USER_DIR="${cfg.dataDir}/$USERNAME"
|
|
||||||
|
|
||||||
echo "To add user '$USERNAME', add the following to your NixOS configuration:"
|
|
||||||
echo ""
|
|
||||||
echo "services.borg-server-custom.users.$USERNAME = {"
|
|
||||||
echo " publicKeys = [ \"$SSH_KEY\" ];"
|
|
||||||
echo "};"
|
|
||||||
echo ""
|
|
||||||
echo "Then rebuild your system with: nixos-rebuild switch"
|
|
||||||
'';
|
|
||||||
mode = "0755";
|
|
||||||
};
|
|
||||||
|
|
||||||
# Create a helper script for checking repository info
|
|
||||||
environment.etc."borg-server/check-repo.sh" = {
|
|
||||||
text = ''
|
|
||||||
set -e
|
|
||||||
|
|
||||||
if [ $# -lt 1 ]; then
|
|
||||||
echo "Usage: $0 <username> [repository]"
|
|
||||||
echo "Example: $0 alice"
|
|
||||||
echo "Example: $0 alice main-repo"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
USERNAME="$1"
|
|
||||||
REPO_NAME="''${2:-}"
|
|
||||||
USER_DIR="${cfg.dataDir}/$USERNAME"
|
|
||||||
|
|
||||||
if [ ! -d "$USER_DIR" ]; then
|
|
||||||
echo "User directory $USER_DIR does not exist"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ -n "$REPO_NAME" ]; then
|
|
||||||
REPO_PATH="$USER_DIR/$REPO_NAME"
|
|
||||||
else
|
|
||||||
echo "Repositories for user $USERNAME:"
|
|
||||||
ls -la "$USER_DIR"
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ -d "$REPO_PATH" ]; then
|
|
||||||
echo "Repository info for $USERNAME/$REPO_NAME:"
|
|
||||||
sudo -u "$USERNAME" borg info "$REPO_PATH"
|
|
||||||
else
|
|
||||||
echo "Repository $REPO_PATH does not exist"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
'';
|
|
||||||
mode = "0755";
|
|
||||||
};
|
|
||||||
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue