sokai/mynixos-config
1
1
Fork 0
forked from mirrors_public/oddlama_nix-config
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: add vaultwarden restic backups

Browse source
This commit is contained in:
oddlama 2024-01-15 03:28:53 +01:00
parent 25eb9e3766
commit b162b20241
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
7 changed files with 200 additions and 102 deletions
Download patch file Download diff file Expand all files Collapse all files

37
hosts/ward/guests/vaultwarden.nix
View file

@ -51,6 +51,10 @@ in {
services.vaultwarden = {
enable = true;
dbBackend = "sqlite";
# WARN: Careful! The backup script does not remove files in the backup location
# if they were removed in the original location! Therefore, we use a directory
# that is not persisted and thus clean on every reboot.
backupDir = "/var/cache/vaultwarden-backup";
config = {
dataFolder = lib.mkForce "/var/lib/vaultwarden";
extendedLogging = true;
@ -80,4 +84,37 @@ in {
StateDirectory = lib.mkForce "vaultwarden";
RestartSec = "600"; # Retry every 10 minutes
};
# Backups
# ========================================================================
age.secrets.restic-encryption-password.generator.script = "alnum";
age.secrets.restic-ssh-privkey.generator.script = "ssh-ed25519";
services.restic.backups.main = {
hetznerStorageBox = let
box = config.repo.secrets.global.hetzner.storageboxes.dusk;
in {
enable = true;
inherit (box) mainUser;
inherit (box.users.vaultwarden) subUid path;
sshAgeSecret = "restic-ssh-privkey";
};
user = "root";
timerConfig = {
OnCalendar = "06:15";
RandomizedDelaySec = "3h";
Persistent = true;
};
initialize = true;
passwordFile = config.age.secrets.restic-encryption-password.path;
paths = [config.services.vaultwarden.backupDir];
pruneOpts = [
"--keep-daily 14"
"--keep-weekly 7"
"--keep-monthly 12"
"--keep-yearly 75"
];
};
}