diff --git a/.sops.yaml b/.sops.yaml index b36d340ad..650b52d57 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -73,7 +73,6 @@ creation_rules: path_regex: ^hosts/web01/secrets.yaml$ - key_groups: - age: - - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMm3/o1HguyRL1z/nZxLBY9j/YUNXeNuDoiBLZAyt88Z - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFiozp1A1+SUfJQPa5DZUQcVc6CZK2ZxL6FJtNdh+2TP - age1dzvjjum2p240qtdt2qcxpm7pl2s5w36mh4fs3q9dhhq0uezvdqaq9vrgfy - age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz diff --git a/hosts/build02/nixpkgs-update-backup.nix b/hosts/build02/nixpkgs-update-backup.nix index b36278a58..c4d79d600 100644 --- a/hosts/build02/nixpkgs-update-backup.nix +++ b/hosts/build02/nixpkgs-update-backup.nix @@ -1,17 +1,42 @@ -{ config, inputs, ... }: +{ config, ... }: { # 100GB storagebox is attached to the build02 server - imports = [ - inputs.self.nixosModules.backup - ]; + sops.secrets.build02-borgbackup-ssh = { }; - nixCommunity.backup = [ - { - name = "nixpkgs-update"; - after = [ config.systemd.services.nixpkgs-update-delete-old-logs.name ]; - paths = [ "/var/log/nixpkgs-update" ]; - startAt = "hourly"; - } - ]; + programs.ssh.knownHosts.build02-hetzner-storage-box = { + hostNames = [ "[u416406.your-storagebox.de]:23" ]; + publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs"; + }; + + services.borgbackup.jobs.nixpkgs-update = { + paths = [ "/var/log/nixpkgs-update" ]; + repo = "u416406@u416406.your-storagebox.de:/./build02-nixpkgs-update"; + encryption.mode = "none"; + compression = "auto,zstd"; + startAt = "hourly"; + environment.BORG_RSH = "ssh -oPort=23 -i ${config.sops.secrets.build02-borgbackup-ssh.path}"; + preHook = '' + set -x + ''; + + postHook = '' + cat > /var/log/telegraf/borgbackup-job-nixpkgs-update.service <