m3tam3re
94 lines
2.3 KiB
Nix
94 lines
2.3 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
...
|
|
}: let
|
|
serviceName = "cld-var-backup-sync";
|
|
sourceDir = "/var/backup/";
|
|
targetHost = "100.91.49.26";
|
|
targetPort = "2022";
|
|
targetUser = "backup-ingest";
|
|
targetDir = "/srv/veeam-ingest/AZ-CLD-1/var-backup/";
|
|
sshKey = config.age.secrets.cld-var-backup-sync-ssh-key.path;
|
|
in {
|
|
environment.systemPackages = with pkgs; [
|
|
rsync
|
|
openssh
|
|
];
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /var/lib/${serviceName} 0700 root root - -"
|
|
];
|
|
|
|
systemd.services.${serviceName} = {
|
|
description = "Mirror /var/backup from AZ-CLD-1 to AZ-PRM-1 for VEEAM";
|
|
after = ["network-online.target" "netbird.service"];
|
|
wants = ["network-online.target" "netbird.service"];
|
|
|
|
path = with pkgs; [
|
|
coreutils
|
|
findutils
|
|
openssh
|
|
rsync
|
|
util-linux
|
|
];
|
|
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
User = "root";
|
|
Group = "root";
|
|
RuntimeDirectory = serviceName;
|
|
RuntimeDirectoryMode = "0700";
|
|
LockPersonality = true;
|
|
NoNewPrivileges = true;
|
|
PrivateTmp = true;
|
|
};
|
|
|
|
script = ''
|
|
set -euo pipefail
|
|
|
|
lock_file="/run/${serviceName}/${serviceName}.lock"
|
|
|
|
if ! ssh-keygen -y -f ${sshKey} >/dev/null; then
|
|
echo "Invalid SSH private key secret at ${sshKey}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
(
|
|
flock -n 9
|
|
|
|
rsync \
|
|
-aH \
|
|
--no-owner \
|
|
--no-group \
|
|
--no-devices \
|
|
--no-specials \
|
|
--numeric-ids \
|
|
--delete \
|
|
--partial \
|
|
--delay-updates \
|
|
--human-readable \
|
|
--stats \
|
|
-e "ssh -i ${sshKey} -p ${targetPort} -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/var/lib/${serviceName}/known_hosts" \
|
|
${sourceDir} \
|
|
${targetUser}@${targetHost}:${targetDir}
|
|
|
|
echo "Removing /var/backup files older than 7 days"
|
|
find ${sourceDir} -type f -mtime +7 -print -delete
|
|
|
|
echo "Removing empty directories under /var/backup"
|
|
find ${sourceDir} -mindepth 1 -depth -type d -empty -print -delete
|
|
) 9>"$lock_file"
|
|
'';
|
|
};
|
|
|
|
systemd.timers.${serviceName} = {
|
|
wantedBy = ["timers.target"];
|
|
timerConfig = {
|
|
OnCalendar = "*-*-* 05:00:00";
|
|
Persistent = true;
|
|
Unit = "${serviceName}.service";
|
|
};
|
|
};
|
|
}
|