feat: mirror cld var backups to prm

2026-06-20 09:10:48 +02:00
parent a8ef749312
commit fdb79b8763
7 changed files with 120 additions and 0 deletions
@@ -0,0 +1,79 @@
+{
+  config,
+  pkgs,
+  ...
+}: let
+  serviceName = "cld-var-backup-sync";
+  sourceDir = "/var/backup/";
+  targetHost = "100.91.49.26";
+  targetPort = "2022";
+  targetUser = "backup-ingest";
+  targetDir = "/srv/veeam-ingest/AZ-CLD-1/var-backup/";
+  sshKey = config.age.secrets.cld-var-backup-sync-ssh-key.path;
+in {
+  environment.systemPackages = with pkgs; [
+    rsync
+    openssh
+  ];
+
+  systemd.tmpfiles.rules = [
+    "d /var/lib/${serviceName} 0700 root root - -"
+  ];
+
+  systemd.services.${serviceName} = {
+    description = "Mirror /var/backup from AZ-CLD-1 to AZ-PRM-1 for VEEAM";
+    after = ["network-online.target" "netbird.service"];
+    wants = ["network-online.target" "netbird.service"];
+
+    path = with pkgs; [
+      coreutils
+      openssh
+      rsync
+      util-linux
+    ];
+
+    serviceConfig = {
+      Type = "oneshot";
+      User = "root";
+      Group = "root";
+      RuntimeDirectory = serviceName;
+      RuntimeDirectoryMode = "0700";
+      LockPersonality = true;
+      NoNewPrivileges = true;
+      PrivateTmp = true;
+    };
+
+    script = ''
+      set -euo pipefail
+
+      lock_file="/run/${serviceName}/${serviceName}.lock"
+
+      flock -n "$lock_file" \
+        rsync \
+          -aH \
+          --no-owner \
+          --no-group \
+          --no-devices \
+          --no-specials \
+          --numeric-ids \
+          --delete \
+          --partial \
+          --delay-updates \
+          --human-readable \
+          --stats \
+          -e "ssh -i ${sshKey} -p ${targetPort} -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/var/lib/${serviceName}/known_hosts" \
+          ${sourceDir} \
+          ${targetUser}@${targetHost}:${targetDir}
+    '';
+  };
+
+  systemd.timers.${serviceName} = {
+    wantedBy = ["timers.target"];
+    timerConfig = {
+      OnCalendar = "*-*-* 05:00:00";
+      Persistent = true;
+      RandomizedDelaySec = "10m";
+      Unit = "${serviceName}.service";
+    };
+  };
+}