Personal-use NixOS configuration
Set up Restic cloud backups
+128
+126
hosts/index/config/restic.nix
+126
hosts/index/config/restic.nix
···
1
+
{ pkgs, lib, ... }:
2
+
3
+
let
4
+
appPath = "/mnt/apps";
5
+
dataPath = "/mnt/data";
6
+
7
+
resticWrapper = pkgs.writeShellScriptBin "restic" ''
8
+
exec /run/wrappers/bin/restic "$@"
9
+
'';
10
+
11
+
mkRepositories = repositories:
12
+
builtins.mapAttrs (key: config:
13
+
let
14
+
appPaths = map (path: "${appPath}/${path}") config.apps or [];
15
+
dataPaths = map (path: "${dataPath}/${path}") config.data or [];
16
+
17
+
paths = appPaths ++ dataPaths;
18
+
in
19
+
{
20
+
inherit paths;
21
+
22
+
pruneOpts = config.prune ++ [
23
+
"--group-by tags"
24
+
];
25
+
26
+
extraBackupArgs = [ "--tag ${key}" ];
27
+
28
+
timerConfig = {
29
+
OnCalendar = "05:00";
30
+
Persistent = true;
31
+
};
32
+
33
+
user = "restic";
34
+
package = resticWrapper;
35
+
36
+
initialize = true;
37
+
environmentFile = "/mnt/apps/restic/.env";
38
+
}
39
+
) repositories;
40
+
in
41
+
{
42
+
services.restic.backups = mkRepositories {
43
+
databases = {
44
+
apps = [
45
+
"mariadb"
46
+
"postgres"
47
+
];
48
+
49
+
prune = [
50
+
"--keep-daily 31"
51
+
"--keep-monthly 12"
52
+
];
53
+
};
54
+
55
+
app-storage = {
56
+
apps = [
57
+
"bluesky-pds"
58
+
"navidrome"
59
+
"pyido"
60
+
"tangled"
61
+
"vaultwarden"
62
+
"zipline"
63
+
];
64
+
65
+
prune = [
66
+
"--keep-daily 14"
67
+
"--keep-monthly 12"
68
+
];
69
+
};
70
+
71
+
app-config = {
72
+
apps = [
73
+
"emby"
74
+
"immich"
75
+
"languagetool"
76
+
"maddy"
77
+
"miniflux"
78
+
"network-optimizer"
79
+
"rtorrent"
80
+
"soulseek"
81
+
];
82
+
83
+
prune = [
84
+
"--keep-weekly 4"
85
+
"--keep-monthly 12"
86
+
];
87
+
};
88
+
89
+
data-storage = {
90
+
data = [
91
+
"immich"
92
+
"linkwarden"
93
+
"pydio"
94
+
"tangled"
95
+
"vaultwarden"
96
+
"zipline"
97
+
];
98
+
99
+
prune = [
100
+
"--keep-daily 14"
101
+
"--keep-monthly 12"
102
+
];
103
+
};
104
+
};
105
+
106
+
users = {
107
+
users.restic = {
108
+
group = "restic";
109
+
110
+
isSystemUser = true;
111
+
};
112
+
113
+
groups.restic = {};
114
+
};
115
+
116
+
security.wrappers.restic = {
117
+
source = lib.getExe pkgs.restic;
118
+
119
+
owner = "restic";
120
+
group = "restic";
121
+
122
+
permissions = "500";
123
+
capabilities = "cap_dac_read_search+ep";
124
+
};
125
+
}
126
+