sokai/mynixos-config
1
1
Fork 0
forked from mirrors_public/oddlama_nix-config
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: restic backups should run as root

Browse source
This commit is contained in:
oddlama 2024-01-20 03:23:37 +01:00
parent 78ecdd2780
commit 38a89b05a3
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
5 changed files with 7 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

1
hosts/sire/guests/paperless.nix
View file

@ -116,7 +116,6 @@ in {
backups.storageBoxes.dusk = { backups.storageBoxes.dusk = {
subuser = "paperless"; subuser = "paperless";
user = "paperless";
paths = [paperlessBackupDir]; paths = [paperlessBackupDir];
}; };
} }

1
hosts/sire/guests/samba.nix
View file

@ -349,7 +349,6 @@ in {
backups.storageBoxes.dusk = { backups.storageBoxes.dusk = {
subuser = "samba"; subuser = "samba";
user = "root";
paths = ["/bunker"]; paths = ["/bunker"];
}; };
} }

1
hosts/ward/guests/radicale.nix
View file

@ -85,7 +85,6 @@ in {
backups.storageBoxes.dusk = { backups.storageBoxes.dusk = {
subuser = "radicale"; subuser = "radicale";
user = "radicale";
paths = ["/var/lib/radicale"]; paths = ["/var/lib/radicale"];
}; };
} }

1
hosts/ward/guests/vaultwarden.nix
View file

@ -86,7 +86,6 @@ in {
backups.storageBoxes.dusk = { backups.storageBoxes.dusk = {
subuser = "vaultwarden"; subuser = "vaultwarden";
user = "vaultwarden";
paths = [config.services.vaultwarden.backupDir]; paths = [config.services.vaultwarden.backupDir];
}; };
} }

14
modules/backups.nix
View file

@ -29,11 +29,6 @@ in {
type = types.str; type = types.str;
}; };
user = mkOption {
description = "The user as which restic should run.";
type = types.str;
};
paths = mkOption { paths = mkOption {
description = "The paths to backup."; description = "The paths to backup.";
type = types.listOf types.path; type = types.listOf types.path;
@ -58,8 +53,13 @@ in {
sshAgeSecret = "restic-ssh-privkey"; sshAgeSecret = "restic-ssh-privkey";
}; };
# We need to backup stuff from other users, so run as root. # A) We need to backup stuff from other users, so run as root.
inherit (boxCfg) user paths; # B) We also need to be root because the ssh key will only
# be accessible to root so whatever service is running cannot
# just access our backup server.
user = "root";
inherit (boxCfg) paths;
timerConfig = { timerConfig = {
OnCalendar = "06:15"; OnCalendar = "06:15";
RandomizedDelaySec = "3h"; RandomizedDelaySec = "3h";