mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
ryan4yin | 二花
e37042f61c
* feat(hosts): per-host restic backups to the SMB remote Replace the disabled aggregate job (which rsynced every host's /persistent into /tmp - a tmpfs - and silently produced incomplete backups) with one restic repo per host, backing up its own data directly: - shared module lib/genResticBackup.nix: secrets, rclone/SMB target (rclone:smb-downloads:/Downloads/homelab-backup/<host>), retention, and excludes for the regenerable/bulky paths (podman overlay layers, microvm and libvirt disk images, nfs golden images, logs, caches) - youko additionally backs up the service state under /persistent/var/lib and dumps all postgres databases first (a consistent SQL artifact beside the crash-consistent data dir) - shoryu/shushou back up /etc/agenix, /etc/ssh and the k3s token Needs three agenix secrets before it can run: restic-password, ssh-key-for-restic-backup and rclone-conf-for-restic-backup. * refactor(hosts): only restic does off-host; btrbk stays local btrbk works at the subvolume level, so a would ship the whole @persistent - including podman's overlay storage, the microVM/libvirt images and the nfs golden images - which is exactly the regenerable bulk we want out of the backups. So: btrbk keeps making the cheap local CoW snapshots (quick rollbacks), and restic owns the off-host copies with file-level excludes. Back up the whole /persistent minus those excludes, so nothing is missed. Update the btrbk module's comment to say so. * fix(restic): never back up keys; drop the implicit /etc/agenix restic's own password lives in /etc/agenix, so backing that up would store the repository's password inside the repository. Exclude agenix, the ssh host keys and the usual credential dirs (.ssh, .gnupg, .aws, gcloud). * refactor(restic): make the backup a proper module Replace lib/genResticBackup.nix with modules/nixos/base/restic-backup.nix, which declares modules.restic-backup options (enable, repository, paths, exclude, requiresMountsFor, postgresDump) like the btrbk module does. youko just sets the options now. * refactor(restic): exclude the whole podman storage, trim retention Exclude /persistent/var/lib/containers wholesale: the image layers are re-pullable and podman's storage DB is not consistent when copied from a running podman. uptime-kuma's named volume lives there, but its data is not wanted anyway. Retention: daily 3, weekly 2, monthly 2 - no yearly. * refactor(restic): back up a short-lived btrfs snapshot, drop pg_dump A live copy of a running postgres data dir is only crash-consistent. Instead of a daily pg_dumpall (which duplicates the data in the repository and gets slower as the DB grows), take a short-lived read-only btrfs snapshot in backupPrepareCommand, back that up, and delete it right after - a consistency step, not a second backup. The excludes are relative now so they work for both the snapshot and a direct path. * feat(secrets): restic-password for modules.restic-backup With the rekeyed secret in nix-secrets (storage group, alongside hdd-luks-crypt-key), the module's passwordFile resolves. * fix(restic): agenix's secret is under /run/agenix, not /etc/agenix * fix(restic): take the password path from agenix, not a hardcoded one config.age.secrets."restic-password".path follows agenix's secretsDir, so it stays correct if that changes.
NixOS / Nix-Darwin's Submodules
This directory contains modular NixOS and Nix-Darwin configurations organized by platform and functionality.
Current Structure
modules/
├── README.md
├── base/ # Common configuration for all platforms
│ ├── default.nix
│ ├── fonts.nix # System font configuration
│ ├── nix.nix # Nix package manager settings
│ ├── overlays.nix # Package overlays
│ ├── security.nix # Basic security settings
│ ├── system-packages.nix # Essential system packages
│ └── users.nix # User management
├── darwin/ # macOS-specific modules
│ ├── README.md
│ ├── apps.nix # macOS applications
│ ├── broken-packages.nix # Package compatibility fixes
│ ├── default.nix
│ ├── nix-core.nix # Core Nix configuration
│ ├── security.nix # macOS security settings
│ ├── ssh.nix # SSH configuration
│ ├── system.nix # System-level settings
│ └── users.nix # macOS user management
└── nixos/ # NixOS-specific modules
├── base/ # Base NixOS configuration
│ ├── btrbk.nix # Backup configuration
│ ├── core.nix # Core system settings
│ ├── default.nix
│ ├── i18n.nix # Internationalization
│ ├── monitoring.nix # System monitoring
│ ├── networking.nix # Network configuration
│ ├── nix.nix # Nix settings
│ ├── packages.nix # System packages
│ ├── remote-building.nix # Remote build setup
│ ├── ssh.nix # SSH daemon configuration
│ ├── user-group.nix # User and group management
│ └── zram.nix # ZRAM swap configuration
├── desktop.nix # Desktop environment configuration
├── desktop/ # Desktop-specific modules
│ ├── default.nix
│ ├── fhs.nix # FHS environment
│ ├── fonts.nix # Desktop fonts
│ ├── guix.nix # GNU Guix integration
│ ├── misc.nix # Miscellaneous desktop settings
│ ├── networking/ # Network-related desktop configs
│ │ ├── clash-verge.nix
│ │ ├── default.nix
│ │ ├── remote-desktop.nix
│ │ └── tailscale.nix
│ ├── peripherals.nix # Peripheral device configuration
│ ├── security.nix # Desktop security settings
│ ├── virtualisation.nix # Virtualization support
│ └── xdg.nix # XDG base directory settings
└── server/ # Server-specific modules
├── qemu-guest-hardware-configuration.nix
├── server-aarch64.nix
├── server-riscv64.nix
└── server.nix
Module Categories
1. Base Modules (base/)
Common configuration shared between NixOS and macOS:
- System fonts and localization
- Essential packages and tools
- Basic security settings
- User management
- Package overlays
2. macOS Modules (darwin/)
macOS-specific configuration:
- macOS applications and system settings
- Security configurations tailored for macOS
- SSH and system-level settings
- Package compatibility fixes
3. NixOS Modules (nixos/)
Platform-specific NixOS configuration:
- Base: Core system settings and services
- Desktop: Desktop environment and GUI applications
- Server: Server-specific optimizations and services
Usage
Modules are imported based on platform detection:
- NixOS Systems: Import
nixos/modules - macOS Systems: Import
darwin/modules - All Systems: Import
base/modules for shared configuration
Architecture Support
- x86_64-linux: Desktop and server configurations
- aarch64-linux: ARM64 Linux systems
- aarch64-darwin: Apple Silicon macOS systems
- server-riscv64: RISC-V server configurations