bragi backup config #28
No reviewers
Labels
No labels
Kind/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
Fachschaft/nixConfig!28
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "Gonne/nixConfig:bragi"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This config is currently running on the backup host.
@ -0,0 +5,4 @@options = ["size=2G" "mode=755"];};fileSystems."/persist" = {device = "/dev/disk/by-label/nixos";Is addressing by label actually nicer than by uuid? It seems to work at least.
@ -0,0 +19,4 @@config = mkIf cfg.enable {services.borgbackup = {# repos are made available at ssh://borg@hostname and served according to the presented ssh-keyrepos = {Perhaps we want to create these repos by a function that only takes the name and the ssh-key. Not sure if that is worth it.
79ba6d9e63tod2ff7b50c9d2ff7b50c9to7b4c51bffd2c5cb23ef4tod4128640f5529f12c052tob44e2cbbb085111743d8tob44e2cbbb08de0651c36to3b51a70e703b51a70e70to01246a78a801246a78a8tob6c2893a3eb6c2893a3eto001f4f49a7001f4f49a7toc9232fb823c9232fb823to1f590c6c9d1f590c6c9dto03cc2ec27f03cc2ec27fto371b1d3221371b1d3221to52100f3e3b52100f3e3bto2992edffb02992edffb0to3b286fa05bWIP: bragi backup configto bragi backup config@ -0,0 +123,4 @@startAt = "daily";user = "fsaccount";group = "users";readWritePaths = ["/home/fsaccount"];By creating the folder
sicherungvia systemd-tmpfiles we could restrict this to/home/fsaccount/sicherung.I don't know if this restriction is worth the increased complexity.
@ -0,0 +138,4 @@users.users = {fsaccount = {description = "FS Account backup";isNormalUser = true;Why is this a normal user, do we plan to log in as this one, or is it just there to pull the fs account?
Login is not necessary, so we can transform it to a system user.
@ -0,0 +20,4 @@config = mkIf cfg.enable {services.borgbackup = {# repos are made available at ssh://borg@hostname and served according to the presented ssh-keyrepos = {where exactly do these keys come from? Can we automatize this? so we either just need to name the machine here, or completely automatically by virtue of beeing a machine?
Of course we need a a mechanism like this for legacy non nix machines
See also https://gitea.mathebau.de/Fachschaft/nixConfig/pulls/28#issuecomment-565
This can probably be automated (?) but currently no Nix machine needs backups.
Thus I would like to postpone it.
Can we then put a comment like:
„Congratulations, you are the first person to make backups from a nixos machine.
Your won the task of automatizing this endeavor, so in future we don't need to hand copy any
ssh keys anymore“
Btw. I don't think this is too trivial, as the public keys are needed while config build time, but the secret keys should probably never leave the machines.
One way would be pre-generated key-pairs that are deployed through sops.
(But then we should make sure to use dedicated keys for this task.)
d06350b450tof95860f0006746f0c047tob03039f47bb03039f47bto224530117e224530117eto39a9213e3039a9213e30toc5bf5f8e79c5bf5f8e79to95509a447c95509a447cto9027b418ae9027b418aeto80594d679f80594d679fto28f02d854328f02d8543to690c56491d690c56491dto3a8fd7ee403a8fd7ee40to6625e82d12I've moved the ssh key to sops. Ready for review again.
6625e82d12to05036bdaee05036bdaeeto1bf59168fb@ -0,0 +113,4 @@};};# Configure backup of files on the department's fs accountjobs.fsaccount = {Did I get something wrong?
It seams the fsaccount backups are under
/home/fsaccountowned by
fsaccount:usersWhile all the machines ones are under
/var/lib/backupsprobably ownedby some backup system user. Why is this set up this way, or am I reading this wrong?
@ -0,0 +119,4 @@${pkgs.rsync}/bin/rsync -e 'ssh -i /run/secrets/backupKey' -r fachschaft@gw1.mathematik.tu-darmstadt.de:/home/fachschaft/* /home/fsaccount/sicherung'';paths = "/home/fsaccount/sicherung";encryption.mode = "none";I would put a small note here, that encryption would mean either putting the key next to the backup or human interaction.
@ -0,0 +122,4 @@encryption.mode = "none";environment = {BORG_RSH = "ssh -i /run/secrets/backupKey";BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK = "yes";Why is this here, what does it do? I also don't really get it from the Borg documentation