steveej/infra
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

run most containers and back them up at home

Browse source 
* switch backup from wasabi-s3 to btrfs via ssh
* add srv0 at home
* run webserver and syncthing at home
This commit is contained in:
steveej 2020-12-30 09:10:30 +01:00
parent 2a2715d447
commit 406ab7be7e
12 changed files with 330 additions and 123 deletions
Download patch file Download diff file Expand all files Collapse all files

146
nix/os/containers/backup.nix
View file

@ -1,70 +1,13 @@
{ config
, hostAddress
, localAddress
, subvolumes
, targetPathSuffix ? ""
}:
let
unstablepkgs = import <channels-nixos-unstable> { config = config.nixpkgs.config; };
passwords = import ../../variables/passwords.crypt.nix;
bucket = "bkp";
subvolumeParentDir = "/var/lib";
subvolumeDir = "/var/lib/container-volumes";
subvolumeSnapshot = "/var/lib/container-volumes.snapshot";
bkpSource = subvolumeSnapshot;
bkpDestination = "/container/backup";
cacheDir = "/var/lib/rclone-cachedir";
wasabiRc = pkgs: pkgs.writeText "rc" ''
[wasabi-${bucket}]
type = s3
provider = Wasabi
env_auth = false
#bkp user
access_key_id = ${passwords.storage.wasabi.bkp.key}
secret_access_key = ${passwords.storage.wasabi.bkp.secret}
region = us-east-1
endpoint = s3.wasabisys.com
location_constraint =
acl =
server_side_encryption =
storage_class =
'';
bkp-mount-rclone-manual = pkgs: {
enable = true;
description = "bkp-mount-rclone-manual service";
path = with pkgs; [ unstablepkgs.rclone utillinux ];
serviceConfig = {
Type = "notify";
};
script = ''
export PATH="$PATH:/run/wrappers/bin"
exec rclone --config ${wasabiRc pkgs} mount wasabi-${bucket}:${bucket} ${bkpDestination} \
--stats=50m --stats-log-level=NOTICE \
--cache-dir=${cacheDir} \
--vfs-cache-mode=full
'';
preStart = ''
mkdir -p ${bkpDestination}
mkdir -p ${cacheDir}
'';
postStop = ''
sync
umount ${bkpDestination} \
|| umount -l ${bkpDestination} \
|| :
rmdir ${bkpDestination}
'';
};
subvolumeParentDir = "/var/lib/container-volumes";
in {
config = { pkgs, ... }: {
@ -74,18 +17,14 @@ in {
environment.systemPackages = with pkgs; [
btrfs-progs
rdup rdedup
iptraf-ng nethogs
rclone
btrbk
];
networking.firewall.enable = true;
systemd.services."bkp-mount-rclone-manual" = bkp-mount-rclone-manual pkgs;
systemd.services."bkp-sync-rclone" = {
systemd.services."bkp-sync" = {
enable = true;
description = "bkp-sync-rclone service";
description = "bkp-sync service";
serviceConfig = {
Type = "oneshot";
@ -99,14 +38,10 @@ in {
"bkp-run.service"
];
path = with pkgs; [ unstablepkgs.rclone utillinux ];
path = with pkgs; [ utillinux ];
script = ''
set -x
echo Starting rclone sync...
rclone --config ${wasabiRc pkgs} sync \
${bkpDestination}/rdedup/ wasabi-${bucket}:${bucket}/rdedup/ \
--stats=50m --stats-log-level=WARNING
echo Finished rclone sync...
true
'';
};
@ -119,41 +54,35 @@ in {
};
partOf = [
"bkp-sync-rclone.service"
"bkp-sync.service"
];
path = with pkgs; [ btrfs-progs rdup rdedup coreutils ];
preStart = ''
echo Creating new btrfs snapshot of ${subvolumeDir} at ${subvolumeSnapshot}
btrfs subvolume snapshot -r ${subvolumeDir} ${subvolumeSnapshot}
path = with pkgs; [ btrfs-progs btrbk coreutils ];
script = let
bktrbkConf = pkgs.writeText "cfg" ''
timestamp_format long
ssh_identity ${passwords.storage.homeChBackup.keyPath}
ssh_user ${passwords.storage.homeChBackup.user}
ssh_compression no
backend_remote btrfs-progs-sudo
compat_remote busybox
btrfs_commit_delete each
snapshot_create onchange
snapshot_preserve_min latest
snapshot_preserve 7d 4w
target_preserve_min no
target_preserve 7d 4w 12m *y
volume ${subvolumeParentDir}
target ${passwords.storage.homeChBackup.target}/container-volumes/${targetPathSuffix}
${builtins.foldl' (sum: elem: sum + " subvolume " + elem + "\n") "" subvolumes}
'';
script = ''
in ''
#! ${pkgs.bash}/bin/bash
set -Eeuxo pipefail
export RUST_BACKTRACE=1
export TIMESTAMP=$(date +"%Y%m%d.%H%M%S")
echo Starting rdup/rdedup backup...
for d in `ls -1 ${bkpSource}`; do
echo Determining backup source size ${bkpSource}/$d...
du -hs ${bkpSource}/$d
rdup -x /dev/null ${bkpSource}/$d | rdedup -v -ttt --dir=${bkpDestination}/rdedup store $d-''${TIMESTAMP}
done
sync
echo Finished rdup/rdedup backup...
echo Removing all previous backups...
rdedup --dir=${bkpDestination}/rdedup list | grep -v ''${TIMESTAMP} | xargs echo rdedup --dir=${bkpDestination}/rdedup remove
echo Running rdedup garbage-collector...
time rdedup -v -ttt --dir=${bkpDestination}/rdedup gc
echo Determining backup destination size ${bkpDestination}/rdedup...
du -hs ${bkpDestination}/rdedup
'';
postStop = ''
btrfs subvolume delete ${subvolumeSnapshot}
btrbk -c ${bktrbkConf} --progress ''${@:-run}
'';
};
@ -164,9 +93,9 @@ in {
timerConfig = {
# Obtained using `systemd-analyze calendar "Wed 23:00"`
# OnCalendar = "Wed *-*-* 23:00:00";
OnStartupSec="2d";
Unit = "bkp-sync-rclone.service";
OnUnitInactiveSec="2d";
OnStartupSec="1m";
Unit = "bkp-sync.service";
OnUnitInactiveSec="2h";
Persistent="true";
};
};
@ -176,10 +105,15 @@ in {
bindMounts = {
"${subvolumeParentDir}" = {
hostPath = "/var/lib/";
hostPath = subvolumeParentDir;
isReadOnly = false;
};
"/etc/secrets/" = {
hostPath = "/var/lib/container-volumes/backup/etc-secrets";
isReadOnly = true;
};
"/dev/fuse" = {
hostPath = "/dev/fuse";
isReadOnly = false;

6
nix/os/containers/syncthing.nix
View file

@ -1,6 +1,7 @@
{ hostAddress
, localAddress
, syncthingPort ? 22000
, syncthingLocalAnnouncePort ? 21027
}:
{
@ -39,6 +40,11 @@
hostPort = syncthingPort;
protocol = "tcp";
}
{
containerPort = 21027;
hostPort = syncthingLocalAnnouncePort;
protocol = "tcp";
}
];
inherit hostAddress localAddress;

8
nix/os/devices/srv0.home-ch.stefanjunker.de/boot.nix Normal file
View file

@ -0,0 +1,8 @@
{ lib
, ...
}:
{
boot.loader.grub.efiSupport = true;
boot.extraModulePackages = [ ];
}

15
nix/os/devices/srv0.home-ch.stefanjunker.de/configuration.nix Normal file
View file

@ -0,0 +1,15 @@
{ ... }:
{
disabledModules = [
];
imports = [
../../profiles/common/configuration.nix
../../modules/opinionatedDisk.nix
./system.nix
./hw.nix
./pkg.nix
./boot.nix
];
}

31
nix/os/devices/srv0.home-ch.stefanjunker.de/hw.nix Normal file
View file

@ -0,0 +1,31 @@
{ ... }:
let
stage1Modules = [
"aesni_intel"
"kvm-intel"
"aes_x86_64"
"virtio_balloon"
"virtio_scsi"
"virtio_net"
"virtio_pci"
"virtio_ring"
"virtio"
"scsi_mod"
];
in
{
# TASK: new device
hardware.opinionatedDisk = {
enable = true;
encrypted = false;
diskId = "ata-Crucial_CT750MX300SSD1_16161311C7A6";
};
boot.initrd.availableKernelModules = stage1Modules;
boot.initrd.kernelModules = stage1Modules;
boot.extraModprobeConfig = ''
'';
}

53
nix/os/devices/srv0.home-ch.stefanjunker.de/pkg.nix Normal file
View file

@ -0,0 +1,53 @@
{ config
, pkgs
, lib
, ...
}:
{
nixpkgs.config.packageOverrides = pkgs: with pkgs; {
nixPath = (import ../../../default.nix { versionsPath = ./versions.nix; }).nixPath;
};
home-manager.users.steveej = import ../../../home-manager/configuration/text-minimal.nix { inherit pkgs; };
nix.buildMachines = [
{ hostName = "localhost";
system = "x86_64-linux";
supportedFeatures = ["kvm" "nixos-test" "big-parallel" "benchmark"];
maxJobs = 4;
}
];
# services.hydra = {
# enable = false;
# hydraURL = "http://localhost:3000"; # externally visible URL
# notificationSender = "hydra@${config.networking.hostName}.stefanjunker.de"; # e-mail of hydra service
# # a standalone hydra will require you to unset the buildMachinesFiles list to avoid using a nonexistant /etc/nix/machines
# buildMachinesFiles = [];
# # you will probably also want, otherwise *everything* will be built from scratch
# useSubstitutes = true;
# };
# services.gitlab-runner = {
# enable = false;
# extraPackages = with pkgs; [
# bash
# gitlab-runner
# nix
# gitFull
# git-crypt
# ];
# concurrent = 2;
# checkInterval = 0;
# services = {
# nixRunner = {
# executor = "shell";
# runUntagged = true;
# registrationConfigFile = "/etc/secrets/gitlab-runner/nix-runner.registration";
# tagList = [ "nix" ];
# };
# };
# };
}

93
nix/os/devices/srv0.home-ch.stefanjunker.de/system.nix Normal file
View file

@ -0,0 +1,93 @@
{ pkgs
, lib
, config
, ... }:
let
keys = import ../../../variables/keys.nix;
in {
# TASK: new device
networking.hostName = "srv0"; # Define your hostname.
# networking.domain = "home-ch.stefanjunker.de";
networking.firewall.enable = true;
networking.firewall.allowedTCPPorts = [
# iperf3
5201
];
networking.firewall.logRefusedConnections = false;
networking.usePredictableInterfaceNames = false;
networking.dhcpcd = {
enable = true;
persistent = true;
};
networking.interfaces.eth0 = {
useDHCP = true;
# ipv6.addresses = [
# { address = "2a02:c207:3003:2387::1"; prefixLength = 64; }
# ];
};
# networking.defaultGateway6 = {
# address = "fe80::1";
# interface = "eth0";
# };
networking.nat = {
enable = true;
internalInterfaces = [ "ve-+" ];
externalInterface = "eth0";
};
# Kubernetes
# services.kubernetes.roles = ["master" "node"];
# virtualization
virtualisation = {
docker.enable = true;
};
nix.gc = {
automatic = true;
};
networking.useHostResolvConf = true;
containers = {
webserver = import ../../containers/webserver.nix {
hostAddress = "192.168.100.12";
localAddress = "192.168.100.13";
httpsPort = 443;
};
syncthing = import ../../containers/syncthing.nix {
hostAddress = "192.168.100.14";
localAddress = "192.168.100.15";
syncthingPort = 22000;
};
backup = import ../../containers/backup.nix {
inherit config;
hostAddress = "192.168.100.16";
localAddress = "192.168.100.17";
subvolumes = [
"webserver"
"backup"
"syncthing"
];
};
};
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "20.03"; # Did you read the comment?
}

37
nix/os/devices/srv0.home-ch.stefanjunker.de/versions.nix Normal file
View file

@ -0,0 +1,37 @@
let
nixpkgs = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-20.09";
rev = "51aaa3fa1b69559456f9bd4968bd5b179a784f67";
};
in
{
inherit nixpkgs;
"channels-nixos-stable" = nixpkgs;
"channels-nixos-20.03" = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-20.03";
rev = "ff6fda61600cc60404bab5cb6b18b8636785b7bc";
};
"channels-nixos-19.09" = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-19.09";
rev = "75f4ba05c63be3f147bcc2f7bd4ba1f029cedcb1";
};
"channels-nixos-unstable" = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-unstable";
rev = "24c9b05ac53e422f1af81a156f1fd58499eb27fb";
};
"nixpkgs-master" = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "master";
rev = "9b3e35d991ea6a43f256069dcb2e006006730d05";
};
"home-manager-module" = {
url = "https://github.com/nix-community/home-manager";
ref = "release-20.09";
rev = "7339784e07217ed0232e08d1ea33b610c94657d8";
};
}

37
nix/os/devices/srv0.home-ch.stefanjunker.de/versions.tmpl.nix Normal file
View file

@ -0,0 +1,37 @@
let
nixpkgs = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-20.09";
rev = "<% git ls-remote https://github.com/nixos/nixpkgs nixos-20.09 | awk '{ print $1 }' | tr -d '\n' -%>";
};
in
{
inherit nixpkgs;
"channels-nixos-stable" = nixpkgs;
"channels-nixos-20.03" = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-20.03";
rev = "<% git ls-remote https://github.com/nixos/nixpkgs nixos-20.03 | awk '{ print $1 }' | tr -d '\n' -%>";
};
"channels-nixos-19.09" = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-19.09";
rev = "<% git ls-remote https://github.com/nixos/nixpkgs nixos-19.09 | awk '{ print $1 }' | tr -d '\n' -%>";
};
"channels-nixos-unstable" = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-unstable";
rev = "<% git ls-remote https://github.com/nixos/nixpkgs nixos-unstable | awk '{ print $1 }' | tr -d '\n' -%>";
};
"nixpkgs-master" = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "master";
rev = "<% git ls-remote https://github.com/NixOS/nixpkgs.git master | head -n1 | awk '{ print $1 }' | tr -d '\n' -%>";
};
"home-manager-module" = {
url = "https://github.com/nix-community/home-manager";
ref = "release-20.09";
rev = "<% git ls-remote https://github.com/nix-community/home-manager.git release-20.09 | awk '{ print $1 }' | tr -d '\n' -%>";
};
}

18
nix/os/devices/vmd32387.contaboserver.net/system.nix
View file

@ -114,24 +114,14 @@ in {
sievePort = 4190;
};
webserver = import ../../containers/webserver.nix {
hostAddress = "192.168.100.12";
localAddress = "192.168.100.13";
httpsPort = 443;
};
syncthing = import ../../containers/syncthing.nix {
hostAddress = "192.168.100.14";
localAddress = "192.168.100.15";
syncthingPort = 22000;
};
backup = import ../../containers/backup.nix {
inherit config;
hostAddress = "192.168.100.16";
localAddress = "192.168.100.17";
subvolumes = [
"mailserver"
"backup"
];
};
};

BIN
nix/variables/passwords.crypt.nix
View file

Binary file not shown.

7
services/home-ch/router-wan.lan/Justfile
View file

@ -3,7 +3,10 @@ _run_ssh_cmd cmd:
post-setup:
just -v _run_ssh_cmd "opkg update"
just -v _run_ssh_cmd "opkg install luci-ssl"
just -v _run_ssh_cmd "opkg install luci-ssl luci-app-ddns"
just -v _run_ssh_cmd "opkg install luci-app-samba samba36-server"
just -v _run_ssh_cmd "opkg install block-mount blockd kmod-fs-vfat kmod-usb-storage usbutils"
just -v _run_ssh_cmd "opkg install block-mount blockd kmod-fs-vfat kmod-usb-storage usbutils kmod-usb-storage-uas kmod-fs-btrfs btrfs-progs"
# multiuser SFTP
just -v _run_ssh_cmd "opkg install openssh-server openssh-sftp-server"
just -v _run_ssh_cmd "opkg install sudo coreutils-readlink"
just -v _run_ssh_cmd "/etc/init.d/uhttpd restart"