261 lines
8.9 KiB
Nix
261 lines
8.9 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
cfg = config.services.borg-client-custom;
|
|
sshCommand = "ssh -F /home/yanlin/.ssh/config -o StrictHostKeyChecking=accept-new -o ServerAliveInterval=60 -o ServerAliveCountMax=240";
|
|
# NOTE: Passphrase file: /etc/borg-passphrase
|
|
# Should contain: BORG_PASSPHRASE=your-passphrase
|
|
# Place on host with mode 0600
|
|
passphraseFile = "/etc/borg-passphrase";
|
|
excludePatterns = [
|
|
"*.tmp" "*.temp" "*/.cache/*" "*/.local/share/Trash/*" "*/tmp/*" "*/temp/*"
|
|
"/proc/*" "/sys/*" "/dev/*" "/run/*" "/var/tmp/*" "/var/cache/*" "/var/log/*"
|
|
"*/overlay2/*" "*/containers/storage/overlay/*"
|
|
".DS_Store" "._.DS_Store" ".Spotlight-V100" ".TemporaryItems" ".Trashes" ".fseventsd"
|
|
"node_modules/*" "target/*" "*.o" "*.so" "*.pyc" "__pycache__/*"
|
|
".vscode/*" "*.swp" "*.swo" "*~"
|
|
];
|
|
excludeArgs = concatMapStrings (pattern: " --exclude '${pattern}'") excludePatterns;
|
|
in
|
|
|
|
{
|
|
options.services.borg-client-custom = {
|
|
enable = mkEnableOption "Borg backup service";
|
|
|
|
repositoryUrl = mkOption {
|
|
type = types.str;
|
|
example = "/mnt/backup/borg-repo";
|
|
description = "Borg repository URL (local path or remote SSH URL)";
|
|
};
|
|
|
|
backupPaths = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [ "/home" "/var/lib/containers" ];
|
|
example = [ "/home" "/var/lib/containers" "/etc" ];
|
|
description = "List of directories to backup";
|
|
};
|
|
|
|
backupFrequency = mkOption {
|
|
type = types.str;
|
|
default = "daily";
|
|
example = "hourly";
|
|
description = "Systemd timer frequency (OnCalendar format or shortcuts like daily, hourly)";
|
|
};
|
|
|
|
retention = mkOption {
|
|
type = types.submodule {
|
|
options = {
|
|
keepDaily = mkOption {
|
|
type = types.int;
|
|
default = 7;
|
|
description = "Number of daily backups to keep";
|
|
};
|
|
keepWeekly = mkOption {
|
|
type = types.int;
|
|
default = 4;
|
|
description = "Number of weekly backups to keep";
|
|
};
|
|
keepMonthly = mkOption {
|
|
type = types.int;
|
|
default = 6;
|
|
description = "Number of monthly backups to keep";
|
|
};
|
|
keepYearly = mkOption {
|
|
type = types.int;
|
|
default = 2;
|
|
description = "Number of yearly backups to keep";
|
|
};
|
|
};
|
|
};
|
|
default = {};
|
|
description = "Backup retention policy";
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
environment.systemPackages = [ pkgs.borgbackup ];
|
|
|
|
users.users.borg-backup = {
|
|
isSystemUser = true;
|
|
group = "borg-backup";
|
|
description = "Borg backup user";
|
|
};
|
|
users.groups.borg-backup = {};
|
|
|
|
systemd.services.borg-backup = {
|
|
description = "Borg Backup Service";
|
|
wants = [ "network-online.target" ];
|
|
after = [ "network-online.target" ];
|
|
path = [ pkgs.borgbackup pkgs.openssh pkgs.curl ];
|
|
|
|
unitConfig = {
|
|
ConditionPathExists = "!/run/borg-backup.lock";
|
|
};
|
|
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
User = "root";
|
|
Group = "root";
|
|
ExecStartPre = "${pkgs.coreutils}/bin/touch /run/borg-backup.lock";
|
|
ExecStopPost = "${pkgs.coreutils}/bin/rm -f /run/borg-backup.lock";
|
|
PrivateTmp = true;
|
|
ProtectSystem = "strict";
|
|
ProtectHome = mkIf (!(lib.hasPrefix "ssh://" cfg.repositoryUrl)) "read-only";
|
|
ReadWritePaths = [ "/run" ] ++ (if (lib.hasPrefix "ssh://" cfg.repositoryUrl) then [] else [ cfg.repositoryUrl ]);
|
|
Environment = [
|
|
"BORG_REPO=${cfg.repositoryUrl}"
|
|
"BORG_RELOCATED_REPO_ACCESS_IS_OK=yes"
|
|
"BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK=no"
|
|
];
|
|
EnvironmentFile = passphraseFile;
|
|
};
|
|
|
|
script = let
|
|
backupPathsStr = concatStringsSep " " (map (path: "'${path}'") cfg.backupPaths);
|
|
retentionArgs = with cfg.retention; concatStringsSep " " [
|
|
"--keep-daily ${toString keepDaily}"
|
|
"--keep-weekly ${toString keepWeekly}"
|
|
"--keep-monthly ${toString keepMonthly}"
|
|
"--keep-yearly ${toString keepYearly}"
|
|
];
|
|
in ''
|
|
trap 'echo "ERROR: Critical backup failure with exit code $? at line $LINENO" >&2; exit 1' ERR
|
|
set -e
|
|
|
|
export BORG_RSH="${sshCommand}"
|
|
|
|
if [ -f "${passphraseFile}" ]; then
|
|
source "${passphraseFile}"
|
|
fi
|
|
|
|
if [[ "${cfg.repositoryUrl}" == ssh://* ]]; then
|
|
mkdir -p /root/.ssh
|
|
chmod 700 /root/.ssh
|
|
|
|
if [ -f /home/yanlin/.ssh/config ]; then
|
|
cp /home/yanlin/.ssh/config /root/.ssh/config
|
|
chmod 600 /root/.ssh/config
|
|
fi
|
|
|
|
if [ -d /home/yanlin/Credentials/ssh_keys ]; then
|
|
mkdir -p /root/Credentials
|
|
cp -r /home/yanlin/Credentials/ssh_keys /root/Credentials/
|
|
chmod -R 600 /root/Credentials/ssh_keys
|
|
fi
|
|
|
|
if [ -f /home/yanlin/.ssh/known_hosts ]; then
|
|
cp /home/yanlin/.ssh/known_hosts /root/.ssh/known_hosts
|
|
chmod 600 /root/.ssh/known_hosts
|
|
fi
|
|
fi
|
|
|
|
if ! borg info > /dev/null 2>&1; then
|
|
echo "Initializing Borg repository at ${cfg.repositoryUrl}"
|
|
borg init --encryption=repokey-blake2
|
|
fi
|
|
|
|
ARCHIVE_NAME="backup-$(date +%Y-%m-%d_%H-%M-%S)"
|
|
echo "Creating backup archive: $ARCHIVE_NAME"
|
|
|
|
BACKUP_START=$(date +%s)
|
|
borg create \
|
|
--verbose \
|
|
--stats \
|
|
--progress \
|
|
--compression lz4,6 \
|
|
--exclude-caches \
|
|
${excludeArgs} \
|
|
"::$ARCHIVE_NAME" \
|
|
${backupPathsStr} 2>&1 | tee /tmp/borg-create-output.log
|
|
BACKUP_END=$(date +%s)
|
|
BACKUP_DURATION=$((BACKUP_END - BACKUP_START))
|
|
|
|
set +e
|
|
|
|
echo "Pruning old backups..."
|
|
if ! borg prune \
|
|
--list \
|
|
--prefix 'backup-' \
|
|
--show-rc \
|
|
${retentionArgs}; then
|
|
echo "WARNING: Pruning failed, but backup archive was created successfully" >&2
|
|
fi
|
|
|
|
echo "Compacting repository..."
|
|
if ! borg compact; then
|
|
echo "WARNING: Compacting failed, but backup archive was created successfully" >&2
|
|
fi
|
|
|
|
{
|
|
echo "Extracting backup statistics..."
|
|
BACKUP_STATS="Duration: ''${BACKUP_DURATION}s"
|
|
|
|
if [ -f /tmp/borg-create-output.log ]; then
|
|
ARCHIVE_SIZE=$(grep -E "This archive:" /tmp/borg-create-output.log | awk '{print $3, $4}' 2>/dev/null || echo "")
|
|
if [ -n "''$ARCHIVE_SIZE" ]; then
|
|
BACKUP_STATS="''$BACKUP_STATS, Archive: ''$ARCHIVE_SIZE"
|
|
fi
|
|
|
|
DEDUPE_SIZE=$(grep -E "This archive:.*Deduplicated size" /tmp/borg-create-output.log | awk '{for(i=1;i<=NF;i++) if($i~/[0-9]/) print $(i) " " $(i+1); break}' 2>/dev/null || echo "")
|
|
if [ -z "''$DEDUPE_SIZE" ]; then
|
|
DEDUPE_SIZE=$(grep -A 1 -E "This archive:" /tmp/borg-create-output.log | tail -1 | awk '{print ''$NF-1, ''$NF}' 2>/dev/null || echo "")
|
|
fi
|
|
if [ -n "''$DEDUPE_SIZE" ]; then
|
|
BACKUP_STATS="''$BACKUP_STATS, Deduplicated: ''$DEDUPE_SIZE"
|
|
fi
|
|
|
|
rm -f /tmp/borg-create-output.log 2>/dev/null || true
|
|
fi
|
|
|
|
BACKUP_STATS="Backup completed successfully. ''$BACKUP_STATS"
|
|
echo "Backup statistics: ''$BACKUP_STATS"
|
|
|
|
} || {
|
|
echo "WARNING: Statistics extraction failed, but backup succeeded" >&2
|
|
echo "Backup completed successfully for ${config.networking.hostName}"
|
|
}
|
|
|
|
echo "Backup process completed successfully"
|
|
'';
|
|
};
|
|
|
|
systemd.timers.borg-backup = {
|
|
description = "Borg Backup Timer";
|
|
wantedBy = [ "timers.target" ];
|
|
|
|
timerConfig = {
|
|
OnCalendar = cfg.backupFrequency;
|
|
Persistent = true;
|
|
RandomizedDelaySec = "30min";
|
|
};
|
|
};
|
|
|
|
systemd.targets.multi-user.wants = [ "borg-backup.timer" ];
|
|
|
|
environment.etc."borg-backup-manual" = {
|
|
text = ''
|
|
echo "Starting manual Borg backup..."
|
|
systemctl start borg-backup.service
|
|
|
|
echo "Checking backup status..."
|
|
systemctl status borg-backup.service
|
|
|
|
echo "Recent backup logs:"
|
|
journalctl -u borg-backup.service -n 20
|
|
'';
|
|
mode = "0755";
|
|
};
|
|
|
|
environment.shellAliases = {
|
|
borg-init = "BORG_REPO='${cfg.repositoryUrl}' BORG_RSH='${sshCommand}' borg init --encryption=repokey-blake2";
|
|
borg-status = "systemctl status borg-backup.service borg-backup.timer";
|
|
borg-logs = "journalctl -u borg-backup.service -f";
|
|
borg-backup-now = "sudo systemctl start borg-backup.service";
|
|
borg-list = "BORG_REPO='${cfg.repositoryUrl}' BORG_RSH='${sshCommand}' borg list";
|
|
borg-info = "BORG_REPO='${cfg.repositoryUrl}' BORG_RSH='${sshCommand}' borg info";
|
|
borg-unlock = "sudo rm -f /run/borg-backup.lock && BORG_REPO='${cfg.repositoryUrl}' BORG_RSH='${sshCommand}' borg break-lock";
|
|
};
|
|
};
|
|
}
|