From de4843c5002f3f58f8bc69dd57d368324b67f4ce Mon Sep 17 00:00:00 2001
From: Martin Fischer <martin@push-f.com>
Date: Sat, 13 Dec 2025 15:08:25 +0100
Subject: feat: automatic backups

---
 nixos/hosts/tente/default.nix           | 19 +++++++++++++++++++
 nixos/hosts/tente/exporters.nix         |  1 +
 nixos/hosts/tente/git.nix               | 22 ++++++++++++++++++++--
 nixos/hosts/tente/secrets/restic-db.age |  7 +++++++
 4 files changed, 47 insertions(+), 2 deletions(-)
 create mode 100644 nixos/hosts/tente/secrets/restic-db.age

(limited to 'nixos/hosts/tente')

diff --git a/nixos/hosts/tente/default.nix b/nixos/hosts/tente/default.nix
index a54de6c..f0aa773 100644
--- a/nixos/hosts/tente/default.nix
+++ b/nixos/hosts/tente/default.nix
@@ -7,6 +7,7 @@
 let
   baseDomain = "push-f.com";
   acmeEmail = "martin@push-f.com";
+  backupHost = "u518695-sub1@u518695-sub1.your-storagebox.de";
   ports = import ./ports.nix;
   sources = import <top/npins>;
   helpers = import <top/helpers.nix> { inherit config lib pkgs; };
@@ -20,6 +21,7 @@ in
     <top/shared/postgresql.nix>
     <top/shared/tailscale.nix>
     <top/shared/monitoring.nix>
+    <top/shared/restic-database-backups.nix>
     ./web-personal.nix
     ./git.nix
     ./headscale.nix
@@ -129,6 +131,23 @@ in
   headscale.port = ports.headscale;
   matrix.port = ports.matrix;
 
+  # Backups
+  git.backupRsyncDest = "${backupHost}:repos";
+  git.backupOnCalendar = "00:00";
+
+  age.secrets.restic-db.file = ./secrets/restic-db.age;
+
+  restic-database-backups = {
+    repository = "sftp://${backupHost}:23" + "/db";
+    passwordFile = config.age.secrets.restic-db.path;
+    postgresDatabases = [];
+    sqliteDatabases = {
+      grafana = "/var/lib/grafana/data/grafana.db";
+    };
+    timerConfig = { OnCalendar = "00:10"; };
+    pruneOpts = ["--keep-daily 30" "--keep-weekly 8" "--keep-monthly 12"];
+  };
+
   # Use the GRUB 2 boot loader.
   boot.loader.grub.enable = true;
   # boot.loader.grub.efiSupport = true;
diff --git a/nixos/hosts/tente/exporters.nix b/nixos/hosts/tente/exporters.nix
index 1c03c35..a2e799e 100644
--- a/nixos/hosts/tente/exporters.nix
+++ b/nixos/hosts/tente/exporters.nix
@@ -37,6 +37,7 @@ in
           targets = [ "localhost:${toString cfg.sqlExporterPort}" ];
         }];
       }
+      # TODO: add exporter for storagebox
     ];
   };
 }
diff --git a/nixos/hosts/tente/git.nix b/nixos/hosts/tente/git.nix
index 467ba30..01fa3f4 100644
--- a/nixos/hosts/tente/git.nix
+++ b/nixos/hosts/tente/git.nix
@@ -9,9 +9,19 @@ in
     webUiDomain = lib.mkOption {
       type = lib.types.str;
     };
+
+    backupRsyncDest = lib.mkOption {
+      type = lib.types.str;
+    };
+
+    backupOnCalendar = lib.mkOption {
+      type = lib.types.str;
+    };
   };
 
-  config = {
+  config = let
+    reposPath = "${config.services.gitolite.dataDir}/repositories";
+  in {
     services = {
       gitolite = {
         enable = true;
@@ -49,7 +59,7 @@ in
         user = config.services.gitolite.user;
         group = config.services.gitolite.group;
         nginx.virtualHost = cfg.webUiDomain;
-        scanPath = "${config.services.gitolite.dataDir}/repositories";
+        scanPath = reposPath;
         settings = {
           remove-suffix = 1;
           enable-git-config = 1;
@@ -74,5 +84,13 @@ in
         };
       };
     };
+
+    systemd.services.backup-repos = {
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${pkgs.rsync}/bin/rsync -a --delete ${reposPath}/ ${cfg.backupRsyncDest} -e '${pkgs.openssh}/bin/ssh -p23'";
+      };
+      startAt = cfg.backupOnCalendar;
+    };
   };
 }
diff --git a/nixos/hosts/tente/secrets/restic-db.age b/nixos/hosts/tente/secrets/restic-db.age
new file mode 100644
index 0000000..f5b5312
--- /dev/null
+++ b/nixos/hosts/tente/secrets/restic-db.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 aqtcmw oIqAvifgxLP5LINVJ5s9qHjM5bSCpcCcJRtLfXDvTG8
+vX5EWOPifb8hgpJiox4Vlk3aw41bBtDoxx9mB9YI8JU
+-> ssh-ed25519 PMTW+A oeJuzrKccPTwrHtOBrwowsV669McJs3voo7Gw/RQ1UQ
+ajo7AmdJlaQ4hnOCoCmhqqkiER4tXJUv+OogO68V/fc
+--- H9+ZM0qj8sqcv46czovIyta763wGodK/zjAsRD4Aors
+�A�܉Az׃`Ǎ�ߋ�g�� _8�'��&L�v��0�ܽX�V��#��\_��
\ No newline at end of file
-- 
cgit v1.3.1