update backups

flake.nix

@@ -31,6 +31,14 @@
           home-manager.nixosModules.home-manager
           ./hosts/vps/default.nix
         ];
+     };
+       backup = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        specialArgs = { inherit inputs; };
+        modules = [
+          home-manager.nixosModules.home-manager
+          ./hosts/backup/default.nix
+        ];
       };
     };
 
@@ -65,7 +73,17 @@
           path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.desktop;
         };
       };
-    };
+       backup = {
+        hostname = "10.0.0.4";
+        sshUser = "root";
+        magicRollbackTimeout = 120;
+        profiles.system = {
+          user = "root";
+          remoteBuild = false;
+          path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.backup;
+        };
+      };
+	};
     checks = {
       x86_64-linux = deploy-rs.lib.x86_64-linux.deployChecks self.deploy;
     };

hosts/backup/default.nix

@@ -0,0 +1,109 @@
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [ ./hardware-configuration.nix ../../modules/ssh.nix ];
+
+  networking.hostName = "backup";
+
+  users.users.lilac = {
+    isNormalUser = true;
+	group = "lilac";
+	extraGroups = [ "wheel" ];
+  };
+  users.groups.lilac = {};
+  home-manager = {
+    useGlobalPkgs = true;
+	useUserPackages = true;
+
+	users.lilac = import ../../home/lilac.nix;
+	};
+  programs.zsh.enable = true;
+  users.users.lilac.shell = pkgs.zsh;
+  security.sudo.wheelNeedsPassword = false;
+
+  time.timeZone = "America/Winnipeg";
+
+  systemd.sleep.settings.Sleep = {
+    AllowSuspend = "no";
+    AllowHibernation = "no";
+    AllowHybridSleep = "no";
+    AllowSuspendThenHibernate = "no";
+  };
+
+  i18n.defaultLocale = "en_US.UTF-8";
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "en_US.UTF-8";
+    LC_IDENTIFICATION = "en_US.UTF-8";
+    LC_MEASUREMENT = "en_US.UTF-8";
+    LC_MONETARY = "en_US.UTF-8";
+    LC_NAME = "en_US.UTF-8";
+    LC_NUMERIC = "en_US.UTF-8";
+    LC_PAPER = "en_US.UTF-8";
+    LC_TELEPHONE = "en_US.UTF-8";
+    LC_TIME = "en_US.UTF-8";
+  };
+
+  services.xserver.enable = true;
+  services.displayManager.sddm.enable = true;
+  services.desktopManager.plasma6.enable = true;
+  services.xserver.xkb = {
+    layout = "us";
+    variant = "";
+  };
+
+  services.pulseaudio.enable = false;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+  };
+
+  environment.systemPackages = with pkgs; [
+    whipper
+	flac
+	tor-browser
+  ];
+
+  networking.wireless.enable = true;
+  networking.networkmanager.enable = true;
+
+  services.timesyncd.enable = true;    # optional
+
+networking = {
+    firewall = {
+	  enable = true;
+	  allowedUDPPorts = [ 51820 ];
+	  trustedInterfaces = [ "wg0" ];
+	};
+
+	wireguard.interfaces."wg0" = {
+      ips = [ "10.0.0.4/24" ];
+	  generatePrivateKeyFile = true;
+	  privateKeyFile = "/var/lib/wireguard/wg0.key";
+	  peers = [{
+        publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k=";
+		allowedIPs = [ "10.0.0.0/24" ];
+		endpoint = "216.128.177.13:51820";
+		persistentKeepalive = 25;
+	  }];
+	};
+  };
+
+  nixpkgs.config.allowUnfree = true;
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  system.stateVersion = "26.05";
+
+
+
+  services.restic.server = {
+    enable = true;
+	listenAddress = "10.0.0.4:8000";
+	dataDir = "/var/lib/restic";
+	appendOnly = true;
+	extraFlags = [ "--no-auth" ];
+  };
+
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8000 ];
+}

hosts/backup/hardware-configuration.nix

@@ -0,0 +1,32 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "sdhci_pci" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/61b493e0-8c91-b7d1-4e336da06ff0";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/E157-E223";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/desktop/default.nix

@@ -9,6 +9,7 @@
     ../../modules/site/mail.nix
     ../../modules/site/music.nix
     ../../modules/site/photo.nix
+	../../modules/site/vault.nix
 
 	../../modules/ssh.nix
   ];
@@ -103,6 +104,7 @@
     whipper
 	flac
 	tor-browser
+	restic
   ];
 
   programs.steam.enable = true;
@@ -130,4 +132,13 @@
   nixpkgs.config.allowUnfree = true;
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   system.stateVersion = "26.05";
+
+  services.restic.backups.backup = {
+    repository = "rest:http://10.0.0.4:8000/backup";
+	initialize = true;
+	passwordFile = "/home/lilac/test-password";
+	paths = [ "/var/lib/immich" "/var/lib/music" "/var/lib/gitea" "/var/lib/vault-backup" ];
+	timerConfig.OnCalendar = "03:30";
+	pruneOpts = [ "--keep-daily 7" "--keep-weekly 4" "--keep-monthly 12" ];
+  };
 }

hosts/vps/default.nix

@@ -46,6 +46,10 @@
           allowedIPs = [ "10.0.0.2/32" ];
 		  publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
 		}
+		{
+		  allowedIPs = [ "10.0.0.4/32" ];
+		  publicKey = "XjuV3wzkP03UUjYSJfY3OG3WWLRtoQBN7GokDEWhdhQ=";
+		}
       ];
 	};
 	nftables = {

modules/ripping.nix

@@ -10,8 +10,8 @@
     enable = true;
 
     settings = {
-      directory = "/var/lib/media/music";
+      directory = "/var/lib/music";
-      library = "/var/lib/media/music/library.db";
+      library = "/var/lib/music/library.db";
 
       plugins = [
 	    "musicbrainz"

modules/site/code.nix

@@ -19,6 +19,8 @@
       name = "gitea";
       user = "gitea";
     };
+
+	settings.service.DISABLE_REGISTRATION = true;
   };
 
   services.caddy = {

modules/site/vault.nix

@@ -0,0 +1,21 @@
+{ config, lib, pkgs, ... }:
+
+{
+  services.vaultwarden = {
+    enable = true;
+	backupDir = "/var/lib/vault-backup";
+    config = {
+      DOMAIN = "https://vault.example.com";
+      SIGNUPS_ALLOWED = false;
+      ROCKET_ADDRESS = "127.0.0.1";
+      ROCKET_PORT = 8222;
+    };
+  };
+
+  services.caddy = {
+    enable = true;
+	virtualHosts."vault.grasswren.net".extraConfig = ''
+	  reverse_proxy localhost:8222
+	'';
+  };
+}