🏡 my personal home lab
setup backups
+33
-11
+1
-1
hosts/cm4-node-1.nix
+1
-1
hosts/cm4-node-1.nix
modules/beszel-agent.nix
modules/beszel/agent.nix
modules/beszel-agent.nix
modules/beszel/agent.nix
modules/beszel-hub.nix
modules/beszel/hub.nix
modules/beszel-hub.nix
modules/beszel/hub.nix
+1
-4
modules/caddy.nix
+1
-4
modules/caddy.nix
+4
-1
modules/common.nix
+4
-1
modules/common.nix
+22
-3
modules/restic.nix
+22
-3
modules/restic.nix
···
7
7
homeserver = {
8
8
initialize = true;
9
9
10
-
repository = "sftp:user@synology-ip:/volume1/backups/homeserver";
11
-
12
-
passwordFile = "/etc/restic/password";
10
+
repositoryFile = config.sops.secrets.backup-repository.path;
11
+
passwordFile = config.sops.secrets.restic-password.path;
13
12
14
13
paths = [
15
14
"/home"
···
34
33
"--keep-monthly 6"
35
34
];
36
35
};
36
+
};
37
+
38
+
programs.ssh = {
39
+
extraConfig = ''
40
+
Host u544487.your-storagebox.de
41
+
IdentityFile ${config.sops.secrets.backup-identity.path}
42
+
IdentitiesOnly yes
43
+
'';
44
+
knownHosts = {
45
+
storage-box = {
46
+
hostNames = [ "u544487.your-storagebox.de" ];
47
+
publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA5EB5p/5Hp3hGW1oHok+PIOH9Pbn7cnUiGmUEBrCVjnAw+HrKyN8bYVV0dIGllswYXwkG/+bgiBlE6IVIBAq+JwVWu1Sss3KarHY3OvFJUXZoZyRRg/Gc/+LRCE7lyKpwWQ70dbelGRyyJFH36eNv6ySXoUYtGkwlU5IVaHPApOxe4LHPZa/qhSRbPo2hwoh0orCtgejRebNtW5nlx00DNFgsvn8Svz2cIYLxsPVzKgUxs8Zxsxgn+Q/UvR7uq4AbAhyBMLxv7DjJ1pc7PJocuTno2Rw9uMZi1gkjbnmiOh6TTXIEWbnroyIhwc8555uto9melEUmWNQ+C+PwAK+MPw==";
48
+
};
49
+
};
50
+
};
51
+
52
+
sops.secrets = {
53
+
restic-password = { };
54
+
backup-repository = { };
55
+
backup-identity = { };
37
56
};
38
57
}
+5
-2
secrets/secrets.yaml
+5
-2
secrets/secrets.yaml
···
4
4
beszel-token-cm4-node-2: ENC[AES256_GCM,data:WIbePVWcxufCMUD9MqGbeirML/qHfsJPlxTW7SWXnXWLuQix,iv:qk9I9dEzzUpLcatLRc01RclDaw7zKWlS2NJt6gw3N9Y=,tag:tQlVsE7inbPGN6AGQlDIlA==,type:str]
5
5
beszel-token-rk1-node-1: ENC[AES256_GCM,data:N9Iz7jsvLUGTQekT2cyJPMFgAvo2vBLMr5X7XEkQ+sJbhnug,iv:ZLPftzHbd/WwbwL1C2RYw30wkusngKZOR+bJHcE7868=,tag:8J7fLPKzBJh/p4GV56bWLg==,type:str]
6
6
beszel-token-rk1-node-2: ENC[AES256_GCM,data:tlGM9qUbBgx8/EF+dWIobe8tDCVFIsRR+oBVCXLDMwoNGKXS,iv:GMvHGRxOKmH8wvkvFR+CoF3xa2qYJ0kvpUKPQngxZCE=,tag:76BlIpA7WXL5L7Gjyjh/og==,type:str]
7
+
restic-password: ENC[AES256_GCM,data:JnJpfpHbVVrnwmOcTQAr1JG+l/6IBC5Jpahw0tlK/VKORL2EQzQEYNLURxPbfwReKrUpsZf3x7B9,iv:iidvEALfAQEGwrHlHL4pXP4ICkhM49v1a3vP480RJ+k=,tag:LZOwGksaXS2ok9pZtO+XuA==,type:str]
8
+
backup-repository: ENC[AES256_GCM,data:v6tUjTwVsym8i52jcapjSRXPIjX2xNFY+bZRkHnVsp4AebcksHzHEDX6N4BF3OuQ2KepOfHngMn61Mk=,iv:HPV+8aCPpvFnytja6RUA7hJdtz2BMI1zsH01w1J9r2w=,tag:znMIFmrcsKTIq2TowhAV0w==,type:str]
9
+
backup-identity: ENC[AES256_GCM,data:8TJP7vSWJAj56AcczQhMRoQqahxM4EGzPm+wk1apMD+L3pybXh/4LPp0DNcGugOb3RPTyjki6jZArDgiirS+ltbldaNQPZaZ4cFrtiJVt8D/iQlsgM9tR8oC7bcR4KV+UoVeeXJN0fWqy5U+IzJ87ZRKKyb9i8WKhPuWFIftb4KqZRyada7jhl/SzwuoIcw9BagMJPLv6BaUmNp1j5fOHvo7RseImiIqsbVo37NTqMMQf7PKM5gsMU6bbeAMjtdeC2RNVG21eop8JlO5uYVyjGxyl5wfU+PwMSRc+XNpgeVEv9mjdo6dkG3QC2poHZ77ot4py6HzQPUZjwLyFsr0ccC4e6e0PNOBtTPtku/LnXHsV45LB9Q3X7t9VSYCTtlJul2W8huZuCRnv7crvIUW21ZMTWiwMbqNEqDUJTBcPLDi42Ea4CvA+I6ODJP8n5g7GTHW0ggy6FtjVXH5DzhzJJULQ27kq97EWi43bSRv0N+N5C1viM+j+hs6tM5eQ15niRVB,iv:YpRoGlD8YFxZ+RChb6T4Eh665AMTTeTJXRFR0xa7l3k=,tag:FWOVonF+SYbbgQoopa2lhA==,type:str]
7
10
sops:
8
11
age:
9
12
- recipient: age1ukx4wxssue9d5y72tt7wk0nqg86wjhcnsy80ky0kkwf5m8p72a7su87kf3
···
51
54
cXdka1dhbXUzbDRsTlhUbGRsVXlzNjgK1iD6hVbUpwRonRzgo/eeLECI9SB4mduW
52
55
1RejiCfpGsA55eeiohD9s7fK/5bAb67xDQZRGZqa/H4brNz/v7+yRA==
53
56
-----END AGE ENCRYPTED FILE-----
54
-
lastmodified: "2026-02-12T16:47:28Z"
55
-
mac: ENC[AES256_GCM,data:9K4/sdgPF28KPCe2KOM+9uOJMOh/OV9NXF4DXlKbFI2gLB8hFLLNTByLV02Zb+fIhlcXP3H4841Qn2QF4c3zfVzd7ISIJJaBAqDQGhB8Hh5Jx+kv0CfdWTMx6aFv6TRqpJIXcIOcInj4PxDmtTBL7JN76CYgScj8V1cs1ekGNaI=,iv:oQzKqIaw/heEZ/fOvL4KKno+sK/NiYSd2EeZNyFg+BA=,tag:7ksSyypeZxa4tHLFL8dXgQ==,type:str]
57
+
lastmodified: "2026-02-12T20:45:24Z"
58
+
mac: ENC[AES256_GCM,data:5kd8vlpVj+lULSsqZBQKRATMg5rQr6giRDroPbAgUnlxqhtAXFOkkYaPhRvao0xIx8yWRgyOvbd9krfNO5Oj1G2iz7p8v1H9SJf/J/jwnLh4S+Gg2mPptd056HgHskCzyuMUQ9TsdOt4suRVgRUVRjmThSWSuYxHq5t/NfGek88=,iv:2sCL2BZGk1n9TnzguFyMUseZT+vwEVqHl5OqSzdu+FI=,tag:Ee4ADyRKgjI1n5OgO5EmZw==,type:str]
56
59
unencrypted_suffix: _unencrypted
57
60
version: 3.11.0