diff --git a/.sops.yaml b/.sops.yaml index ce18d4d..9d200e7 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -14,11 +14,17 @@ creation_rules: - age: - *chunk - *cy + - path_regex: secrets/de3911/titan.yaml + key_groups: + - age: + - *titan + - *cy - path_regex: secrets/services/ntfy.yaml key_groups: - age: - *chunk - *yt + - *titan - *cy - path_regex: secrets/restic/yt.yaml key_groups: @@ -35,6 +41,11 @@ creation_rules: - age: - *chunk - *cy + - path_regex: secrets/borg/titan.yaml + key_groups: + - age: + - *titan + - *cy - path_regex: secrets/wireguard/yt.yaml key_groups: - age: diff --git a/hosts/chunk/default.nix b/hosts/chunk/default.nix index 9d5597b..b828000 100644 --- a/hosts/chunk/default.nix +++ b/hosts/chunk/default.nix @@ -2,7 +2,6 @@ config, lib, pkgs, - inputs, ... }: { @@ -26,10 +25,6 @@ ./conduit.nix ./immich.nix ./element.nix - { - disabledModules = [ "services/backup/borgbackup.nix" ]; - } - (inputs.nixpkgs-borg + "/nixos/modules/services/backup/borgbackup.nix") ]; sops.age.keyFile = "/root/.config/sops/age/keys.txt"; diff --git a/hosts/titan/backup.nix b/hosts/titan/backup.nix new file mode 100644 index 0000000..2ad6665 --- /dev/null +++ b/hosts/titan/backup.nix @@ -0,0 +1,17 @@ +{ + config, + ... +}: +{ + my.backup = { + enable = true; + jobName = "titanRsync"; + exclude = [ + # podman stuff + "/var/lib/containers" + ]; + repo = "titan"; + passFile = config.sops.secrets."borg/rsyncnet".path; + sshKeyFile = config.sops.secrets."rsyncnet/id_ed25519".path; + }; +} diff --git a/hosts/titan/default.nix b/hosts/titan/default.nix index 1ebcfd8..7eb6433 100644 --- a/hosts/titan/default.nix +++ b/hosts/titan/default.nix @@ -15,6 +15,7 @@ ./ghost.nix ./ntfy.nix ./uptime-kuma.nix + ./backup.nix ]; sops.age.keyFile = "/root/.config/sops/age/keys.txt"; @@ -22,6 +23,15 @@ "caddy/env" = { sopsFile = ../../secrets/services/caddy.yaml; }; + "services/ntfy" = { + sopsFile = ../../secrets/services/ntfy.yaml; + }; + "borg/rsyncnet" = { + sopsFile = ../../secrets/borg/titan.yaml; + }; + "rsyncnet/id_ed25519" = { + sopsFile = ../../secrets/de3911/titan.yaml; + }; }; boot = { diff --git a/hosts/titan/uptime-kuma.nix b/hosts/titan/uptime-kuma.nix index 7b204ec..8bc0251 100644 --- a/hosts/titan/uptime-kuma.nix +++ b/hosts/titan/uptime-kuma.nix @@ -1,4 +1,5 @@ -{...}: { +{ ... }: +{ # data stored at /var/lib/uptime-kuma/ but does not expose # an option to change it services.uptime-kuma = { diff --git a/hosts/ytnix/default.nix b/hosts/ytnix/default.nix index e8e2ee9..25bf736 100644 --- a/hosts/ytnix/default.nix +++ b/hosts/ytnix/default.nix @@ -11,11 +11,9 @@ ../yt.nix { disabledModules = [ - "services/backup/borgbackup.nix" "services/backup/btrbk.nix" ]; } - (inputs.nixpkgs-borg + "/nixos/modules/services/backup/borgbackup.nix") (inputs.nixpkgs-btrbk + "/nixos/modules/services/backup/btrbk.nix") ]; @@ -188,7 +186,7 @@ programs.sway.enable = true; - my.backup= { + my.backup = { enable = true; jobName = "ytnixRsync"; exclude = [ diff --git a/secrets/borg/titan.yaml b/secrets/borg/titan.yaml new file mode 100644 index 0000000..1564b5b --- /dev/null +++ b/secrets/borg/titan.yaml @@ -0,0 +1,31 @@ +borg: + rsyncnet: ENC[AES256_GCM,data:HZhY3xqkiq/W7W6mvbqlInvZQfsk+vMPLdcB0gu9bzMuAM7uTCXE5g==,iv:pcvOvIScpPhnPtZr6NlhSAuEUTBBjJ4mFg/FdU8Qto0=,tag:nnY9hSzRrMl6C5GFUOhRVQ==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age12w2xgh4nxhrrggrtcnu75wgukqnayzhfd2azkhukl6u8xqxsqvtsa4lmhl + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJYnRxVGFVSVdGMDZKUWRB + cC9tdDk4bHhVbXdOYi9SeXhySHZNNWZqTVRBCnEzR2x1T2NzcnRPQjJ1V3JzR1RI + RmppZExIUmdaa3hhek5SL2xzTTZwM0EKLS0tIHFPTDRKblhnNjhtQmtSSlVQMitG + NFZnQ1U1SHYxT1Q5SUFmWGJ4NDFNcVEKj1g94nn05yd9gXgYM3kx7SOwt973KOO/ + 2Q+nNiR2DG+H7IqKjPfx45bXe0if+ZAulTVAsjcZK5ZB8TiPVXDrjQ== + -----END AGE ENCRYPTED FILE----- + - recipient: age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXU2hlaTJQYVpNczRROHZt + WCt1T1VaMDJUNVhrNVJ0N0tUTnBvRzBmdVJvCkF4K1hMVnR1NCt5Nmg0QXMvcUdl + NnhqU0p5VitOL0Qvay9TZXZwUVhRTkUKLS0tIElBYnp1UWxLSjhQcTNOZFUyV3Np + djVSenB6d0NmelhmSzJKcllMbG1IUUEKSIyK9pMjvLqTTZS617r3o5CFdGFPz0RJ + 3YCVt+tBFrVGfRaE+Xvkv5gRYp+p36OlrNpxjX+Ay9GHi4q8OlmIJQ== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2024-12-31T04:00:20Z" + mac: ENC[AES256_GCM,data:sDUD9aSp+s70ZgsN8QMsh3sKinrxuBGK48XcNaKzStnIXtVIkO45c3svCCNjFgh687qVdoCUdIttmf8nP+XvEo6BbXpW3VHfcRZgap2KodjhOTRwh8sBEqr9glPQeecQpHJ/D2U1igbZlYpK+2FaECkkg+troyPbvxrPKJ8hWgw=,iv:UBLhUgykn3tBLmdBFVEjsamtb+IsdKG+FxWeEumyap0=,tag:gE/VO+3/Audipume+xcN2g==,type:str] + pgp: [] + unencrypted_suffix: _unencrypted + version: 3.9.2 diff --git a/secrets/de3911/titan.yaml b/secrets/de3911/titan.yaml new file mode 100644 index 0000000..aff856c --- /dev/null +++ b/secrets/de3911/titan.yaml @@ -0,0 +1,31 @@ +rsyncnet: + id_ed25519: ENC[AES256_GCM,data:uqd95tSWgSUwZxQAtMrKE3ISjSsb+4ZAUH7VlP7bGWMjZYPqZG0/cckMEocBaGXpjMrH1o5HjkNNmOsCBl6Lz1Vfk6drPyZbRlw9+G7K6zLeAI92gD3xnpaIkzClxGxO4GvumrcSgi1dtvh+N7X1sf5W+ByHrAtGM32G8IDKZwO1j64xSUMikwXeMV938oFUGYddKR9PcdYOf70XRPq9TZyiuYxgISRUIQFywtzKxPgUljDPUeEbU+VqIArUPBUh3Rfe0yea35ef4MT+y9rYc49OUk+06YdUvFEIClDXW9uahRFAHaLn76tDDrsL0O58LTIeG/bxiXGzmoYCiwpbUbEaYFhpZyKW3Lns7VQHwgkA+Sg71GvgibCbvbUV77Fe7e16pfutXErvIspomLssA57HGSU1MqSzwgYTAs4phvd39lj2JF3b8JdEpgmxjxUmnCkTtXOPa5StmVNfVVoRZPlq5Squtc4h7F2FVYsEWD2ZsC4EuJiLVqx3N2Z1I/AsaN4eBrjkRnVDICqYL5Ve,iv:+CF3+mB3s4TR0vNk/29mHpDSh/dGLgC76/sxBA1sie0=,tag:z4UrxxSkQMx11TeJjhxMgg==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age12w2xgh4nxhrrggrtcnu75wgukqnayzhfd2azkhukl6u8xqxsqvtsa4lmhl + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsV3VmSko4dmtwcDFDaTUx + NWloOVNmQ09vSWhPN096NmpOclg3M3BxcEZJCm85K3dqS0NNdUdmMHpldzN6THRn + REZnSjdYSkNYVHdTandZd3RsdW9SV2MKLS0tIDNPZHdOekFQRXdmT0VDWjFOaDJu + MTdxOTlNR1BrNFlPVlFiaGJPNGhhcUEK1BD5VQ0nDMUhOp1qatZDrkK9rYJ/Y3Xa + KBEKkzm/DfyVbRzAolXKGesTp14Vyofv9PcZeulN7jLDQZByKTjPsQ== + -----END AGE ENCRYPTED FILE----- + - recipient: age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvSk5sN29mS1JEN05pN1pJ + WmNybGEzRkNVRHFDU1p2dWVqbUFoZ1QxRHpvCnN3WnVJeXVpSE1reFNueGNKWVVM + d3hjbXZJL0lBYXUxYldQSk5GckhvRWMKLS0tIHJhUU43MjZHdFVtT2FjOTcrK0xT + RlhIYmhESXc2Y2RzY01IWnRKMG94bHMKTPc6w/7rIBNEHKEZQAXSPXW8cuA5PQhL + CEi7M5W5LGb/z0/Ml2YT8nir2pxDqmzLiiIueh5NkJjOASUMnG+5QQ== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2024-12-31T03:50:19Z" + mac: ENC[AES256_GCM,data:3MQkrPbpOt0hFmDZjuJEYgA30b3tGZsSi1dpKqTFZqjX7N2w+GOJ8ZgE69zUiab3hqzwcVo8heDGl5vHbdKfpOur2vJToVFmwxrKU7Gj8nI+4gPGic8EVTgJ3zh4dEgMZOh9Id27WgcDhr6iwbZFLSttknU6BGXlDwm5Q0VNtLY=,iv:Dsrm1SaE/sHgWwaI9MkLCRUApFRbFQ+0yGkGNrclX+Y=,tag:5Kmh8kwJ2Dvh3tO7ShzCcw==,type:str] + pgp: [] + unencrypted_suffix: _unencrypted + version: 3.9.2 diff --git a/secrets/services/ntfy.yaml b/secrets/services/ntfy.yaml index c2dd19f..6528589 100644 --- a/secrets/services/ntfy.yaml +++ b/secrets/services/ntfy.yaml @@ -9,29 +9,38 @@ sops: - recipient: age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSQmhTWEdOQWV1N1V4bnND - ZFRoQkRtWTE1cm9iZExNdVFBTlArR0l6QlN3CmRsN3hjL3JsT2ZkczFuMTAvaWRZ - dGdwby92aEpDQjVUUmlqWXNWQzFrbTgKLS0tIHZIN1QzcjBFclI2ZUVkUEgrcjlv - WW9rVVQzbEczVk5CV0ZRSm4rVUxiZ2MKUAA1Vqnv0kpOub2D+XAjEV+5ymm32TZM - RpPRF+/e487dyqGscFQUQHhzIZIRPLAawR4hHd/iZC8y/UT86GlpJg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUM2JSNVkwT2ZlY3l6RHZ5 + V1hvUDE4TmR2YjRSU25mSWdzaUNlanZ1SDBzClY2Z0M4ek5reE5yb3VhZUhIdktT + bk00bTM4UXZHeVk3YWpvZEVXbTQrQnMKLS0tIDdWbFlhd3UvVmlZRy9lR1Zpaldl + cm9ZMjd1OCtkVFp6WEVTWkliTzFXNmMKoJr6VPQoQZISQ9XfOq6hPYiDPT969CkV + U/Th9OOlCdA8bduxAmimrnYXhSF7phQHJANIWwyEZ4zDryHJ9lZg8w== -----END AGE ENCRYPTED FILE----- - recipient: age1sy0at69err83qyml2vqu8xvwjccfws447aaadfvacj2qluw3p45s2mtrw8 enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCc1RySDUrc2s5K2svMFk4 - dEtXM1JXbU9oRjVCbmZCT3RBdWVRK1lhNEV3CkVrRmNvRkxQYmZxZ0N6dFpUbjJZ - SDJOUVI1ZFdOdkQ0SGlJMVBqd3ErNnMKLS0tIERqbldPL2ZlaTlZR0FySGExMzQ0 - NERIQ1VUNnMzdVhFMTZEVmdFR2FSMkkKiaFOXw6wXsxwUZRn/zDV2MKelJZUk8Wi - 1iISfgO5FVl3ix1NhTD5awbtHaAZt4cfjStYD6R0sb5JUQW+WsoHiQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoVFp4ZTI2eWU3czVHRWxs + NjNaOGc1alNoOE16WHdvbkhNeFJJUS9rZlE0ClpSUVRuREZiM1llajVPSm8reUh3 + cHdFaDhaL2xpNXFLNnB2MDVJWXp6Z0EKLS0tIDBDdHJUdVRTRVFWazltTmJwT0dr + dXNIRUFPNmFhN1BuMVhJR01CUjhqTTQKrdRUnyrcIB/WTFkIwYaFAKKO3DnqwtTr + 4Mf1t2MKZw8PGWDDPKH6NL6LODcYq8g49cuvhJNKvoUhuujfisO6xg== + -----END AGE ENCRYPTED FILE----- + - recipient: age12w2xgh4nxhrrggrtcnu75wgukqnayzhfd2azkhukl6u8xqxsqvtsa4lmhl + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMeXFrcXZVc21KQWpxSU1v + RkxkdXV2SnV0RTZIQzFEczZkNklTa1NmaUhjCmVqVDJTR2VDcFBSOXV6dUxhUC83 + RDYrejRPYncvWWhLaGdwZU02RmRxTVkKLS0tIDVLWE9WVDBPS0p6STZ6czlDbC91 + Q3JDM2RDczUzdXpPZEhoTW9Jd0JxSG8KQFNZXOgHxDXeNdwArod74Dfc2IXOrz3S + Fiw/HVhQdwvjDSui9hUxpZuF94AKHRmVsKZvO3kvBhI6GWpW8wmk/A== -----END AGE ENCRYPTED FILE----- - recipient: age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBheVZzNEtBUTZkbUZ2eFBF - Wm9Ic3dleW94U0xTRUs5VmtvRjFydVZhOFc0CkgrYWxuTW9obUlwVmhsYWx5dmYy - Z0tLYUlKTDI0UTh5bWtnSU52YlBoTEkKLS0tIGVwTW5ER09OaTRUM2tBT09WcTg0 - NnBSNFQ4ZGRMcHlPdUZzOFJHV3Z4OGcKOiZq+DmEFVyt+9Z7uMJqx8AD8QvOejCb - bFBndq9UffyxLflzuxMRpKiRJ3BSVGu6/YXAdXvfLaXNBcLBQdsR8Q== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqZDZhcVJnVFY2U2NSZlJK + bC8wdTJ2eFlJY1lBRmsxbmgzQkVMZjUwOVJBCm1PdEJiWXJJeXdPbEVOQ0F2cVJL + RGMxOTlLY0pVMWtYTkJBZ1VoOGxrOWsKLS0tIGZ4RnlmV2l4TFBITDY4VWU5TFJ4 + NkU1QWl6R3M3by9jVTBXSm5kd3BEOFkKacXasnAVwlctfPu4j6IVeCW7jCWS124S + kMTxU0BLxQjoh6+Xw/BXQ6nk+cQBEFjN022UpItlC5ty2P5jcjos1g== -----END AGE ENCRYPTED FILE----- lastmodified: "2024-12-17T03:08:24Z" mac: ENC[AES256_GCM,data:K1XW1n6umC/qayF9SFanVVhOfN5AXmzD9FsaXx74IoPiLMz6ZCJ547Je4f5mKdt5Gc5aUjNOALXGxXG/hSB+L8h6S/k/iGbx0zF3iwEFvURa7P/ScTMzvnABdqdjA4mah/QsfsFXnBhhCUzHpvo4kBge30U4V8uLjw6seEZ42Vk=,iv:1AQFbv6bFxIKSrJZr6AqQB58OfGNnFD8RHNZKP2ePwE=,tag:m/lKEBQ7Ij6ieIspVsqE9Q==,type:str]