pyrox.dev
1{ config, pkgs, lib, ... }:
2let
3 inherit (lib)
4 concatLists
5 concatMap
6 concatMapStringsSep
7 concatStringsSep
8 filterAttrs
9 isAttrs
10 literalExpression
11 mapAttrs'
12 mapAttrsToList
13 mkIf
14 mkOption
15 optionalString
16 sort
17 types
18 ;
19
20 # The priority of an option or section.
21 # The configurations format are order-sensitive. Pairs are added as children of
22 # the last sections if possible, otherwise, they start a new section.
23 # We sort them in topological order:
24 # 1. Leaf pairs.
25 # 2. Sections that may contain (1).
26 # 3. Sections that may contain (1) or (2).
27 # 4. Etc.
28 prioOf = { name, value }:
29 if !isAttrs value then 0 # Leaf options.
30 else {
31 target = 1; # Contains: options.
32 subvolume = 2; # Contains: options, target.
33 volume = 3; # Contains: options, target, subvolume.
34 }.${name} or (throw "Unknow section '${name}'");
35
36 genConfig' = set: concatStringsSep "\n" (genConfig set);
37 genConfig = set:
38 let
39 pairs = mapAttrsToList (name: value: { inherit name value; }) set;
40 sortedPairs = sort (a: b: prioOf a < prioOf b) pairs;
41 in
42 concatMap genPair sortedPairs;
43 genSection = sec: secName: value:
44 [ "${sec} ${secName}" ] ++ map (x: " " + x) (genConfig value);
45 genPair = { name, value }:
46 if !isAttrs value
47 then [ "${name} ${value}" ]
48 else concatLists (mapAttrsToList (genSection name) value);
49
50 sudo_doas =
51 if config.security.sudo.enable then "sudo"
52 else if config.security.doas.enable then "doas"
53 else throw "The btrbk nixos module needs either sudo or doas enabled in the configuration";
54
55 addDefaults = settings: { backend = "btrfs-progs-${sudo_doas}"; } // settings;
56
57 mkConfigFile = name: settings: pkgs.writeTextFile {
58 name = "btrbk-${name}.conf";
59 text = genConfig' (addDefaults settings);
60 checkPhase = ''
61 set +e
62 ${pkgs.btrbk}/bin/btrbk -c $out dryrun
63 # According to btrbk(1), exit status 2 means parse error
64 # for CLI options or the config file.
65 if [[ $? == 2 ]]; then
66 echo "Btrbk configuration is invalid:"
67 cat $out
68 exit 1
69 fi
70 set -e
71 '';
72 };
73
74 cfg = config.services.btrbk;
75 sshEnabled = cfg.sshAccess != [ ];
76 serviceEnabled = cfg.instances != { };
77in
78{
79 meta.maintainers = with lib.maintainers; [ oxalica ];
80
81 options = {
82 services.btrbk = {
83 extraPackages = mkOption {
84 description = lib.mdDoc "Extra packages for btrbk, like compression utilities for `stream_compress`";
85 type = types.listOf types.package;
86 default = [ ];
87 example = literalExpression "[ pkgs.xz ]";
88 };
89 niceness = mkOption {
90 description = lib.mdDoc "Niceness for local instances of btrbk. Also applies to remote ones connecting via ssh when positive.";
91 type = types.ints.between (-20) 19;
92 default = 10;
93 };
94 ioSchedulingClass = mkOption {
95 description = lib.mdDoc "IO scheduling class for btrbk (see ionice(1) for a quick description). Applies to local instances, and remote ones connecting by ssh if set to idle.";
96 type = types.enum [ "idle" "best-effort" "realtime" ];
97 default = "best-effort";
98 };
99 instances = mkOption {
100 description = lib.mdDoc "Set of btrbk instances. The instance named `btrbk` is the default one.";
101 type = with types;
102 attrsOf (
103 submodule {
104 options = {
105 onCalendar = mkOption {
106 type = types.nullOr types.str;
107 default = "daily";
108 description = lib.mdDoc ''
109 How often this btrbk instance is started. See systemd.time(7) for more information about the format.
110 Setting it to null disables the timer, thus this instance can only be started manually.
111 '';
112 };
113 settings = mkOption {
114 type = let t = types.attrsOf (types.either types.str (t // { description = "instances of this type recursively"; })); in t;
115 default = { };
116 example = {
117 snapshot_preserve_min = "2d";
118 snapshot_preserve = "14d";
119 volume = {
120 "/mnt/btr_pool" = {
121 target = "/mnt/btr_backup/mylaptop";
122 subvolume = {
123 "rootfs" = { };
124 "home" = { snapshot_create = "always"; };
125 };
126 };
127 };
128 };
129 description = lib.mdDoc "configuration options for btrbk. Nested attrsets translate to subsections.";
130 };
131 };
132 }
133 );
134 default = { };
135 };
136 sshAccess = mkOption {
137 description = lib.mdDoc "SSH keys that should be able to make or push snapshots on this system remotely with btrbk";
138 type = with types; listOf (
139 submodule {
140 options = {
141 key = mkOption {
142 type = str;
143 description = lib.mdDoc "SSH public key allowed to login as user `btrbk` to run remote backups.";
144 };
145 roles = mkOption {
146 type = listOf (enum [ "info" "source" "target" "delete" "snapshot" "send" "receive" ]);
147 example = [ "source" "info" "send" ];
148 description = lib.mdDoc "What actions can be performed with this SSH key. See ssh_filter_btrbk(1) for details";
149 };
150 };
151 }
152 );
153 default = [ ];
154 };
155 };
156
157 };
158 config = mkIf (sshEnabled || serviceEnabled) {
159 environment.systemPackages = [ pkgs.btrbk ] ++ cfg.extraPackages;
160 security.sudo = mkIf (sudo_doas == "sudo") {
161 extraRules = [
162 {
163 users = [ "btrbk" ];
164 commands = [
165 { command = "${pkgs.btrfs-progs}/bin/btrfs"; options = [ "NOPASSWD" ]; }
166 { command = "${pkgs.coreutils}/bin/mkdir"; options = [ "NOPASSWD" ]; }
167 { command = "${pkgs.coreutils}/bin/readlink"; options = [ "NOPASSWD" ]; }
168 # for ssh, they are not the same than the one hard coded in ${pkgs.btrbk}
169 { command = "/run/current-system/bin/btrfs"; options = [ "NOPASSWD" ]; }
170 { command = "/run/current-system/sw/bin/mkdir"; options = [ "NOPASSWD" ]; }
171 { command = "/run/current-system/sw/bin/readlink"; options = [ "NOPASSWD" ]; }
172 ];
173 }
174 ];
175 };
176 security.doas = mkIf (sudo_doas == "doas") {
177 extraRules = let
178 doasCmdNoPass = cmd: { users = [ "btrbk" ]; cmd = cmd; noPass = true; };
179 in
180 [
181 (doasCmdNoPass "${pkgs.btrfs-progs}/bin/btrfs")
182 (doasCmdNoPass "${pkgs.coreutils}/bin/mkdir")
183 (doasCmdNoPass "${pkgs.coreutils}/bin/readlink")
184 # for ssh, they are not the same than the one hard coded in ${pkgs.btrbk}
185 (doasCmdNoPass "/run/current-system/bin/btrfs")
186 (doasCmdNoPass "/run/current-system/sw/bin/mkdir")
187 (doasCmdNoPass "/run/current-system/sw/bin/readlink")
188
189 # doas matches command, not binary
190 (doasCmdNoPass "btrfs")
191 (doasCmdNoPass "mkdir")
192 (doasCmdNoPass "readlink")
193 ];
194 };
195 users.users.btrbk = {
196 isSystemUser = true;
197 # ssh needs a home directory
198 home = "/var/lib/btrbk";
199 createHome = true;
200 shell = "${pkgs.bash}/bin/bash";
201 group = "btrbk";
202 openssh.authorizedKeys.keys = map
203 (
204 v:
205 let
206 options = concatMapStringsSep " " (x: "--" + x) v.roles;
207 ioniceClass = {
208 "idle" = 3;
209 "best-effort" = 2;
210 "realtime" = 1;
211 }.${cfg.ioSchedulingClass};
212 sudo_doas_flag = "--${sudo_doas}";
213 in
214 ''command="${pkgs.util-linux}/bin/ionice -t -c ${toString ioniceClass} ${optionalString (cfg.niceness >= 1) "${pkgs.coreutils}/bin/nice -n ${toString cfg.niceness}"} ${pkgs.btrbk}/share/btrbk/scripts/ssh_filter_btrbk.sh ${sudo_doas_flag} ${options}" ${v.key}''
215 )
216 cfg.sshAccess;
217 };
218 users.groups.btrbk = { };
219 systemd.tmpfiles.rules = [
220 "d /var/lib/btrbk 0750 btrbk btrbk"
221 "d /var/lib/btrbk/.ssh 0700 btrbk btrbk"
222 "f /var/lib/btrbk/.ssh/config 0700 btrbk btrbk - StrictHostKeyChecking=accept-new"
223 ];
224 environment.etc = mapAttrs'
225 (
226 name: instance: {
227 name = "btrbk/${name}.conf";
228 value.source = mkConfigFile name instance.settings;
229 }
230 )
231 cfg.instances;
232 systemd.services = mapAttrs'
233 (
234 name: _: {
235 name = "btrbk-${name}";
236 value = {
237 description = "Takes BTRFS snapshots and maintains retention policies.";
238 unitConfig.Documentation = "man:btrbk(1)";
239 path = [ "/run/wrappers" ] ++ cfg.extraPackages;
240 serviceConfig = {
241 User = "btrbk";
242 Group = "btrbk";
243 Type = "oneshot";
244 ExecStart = "${pkgs.btrbk}/bin/btrbk -c /etc/btrbk/${name}.conf run";
245 Nice = cfg.niceness;
246 IOSchedulingClass = cfg.ioSchedulingClass;
247 StateDirectory = "btrbk";
248 };
249 };
250 }
251 )
252 cfg.instances;
253
254 systemd.timers = mapAttrs'
255 (
256 name: instance: {
257 name = "btrbk-${name}";
258 value = {
259 description = "Timer to take BTRFS snapshots and maintain retention policies.";
260 wantedBy = [ "timers.target" ];
261 timerConfig = {
262 OnCalendar = instance.onCalendar;
263 AccuracySec = "10min";
264 Persistent = true;
265 };
266 };
267 }
268 )
269 (filterAttrs (name: instance: instance.onCalendar != null)
270 cfg.instances);
271 };
272
273}