pyrox.dev
1{ config, pkgs, lib, ... }:
2let
3 inherit (lib)
4 concatLists
5 concatMap
6 concatMapStringsSep
7 concatStringsSep
8 filterAttrs
9 flatten
10 getAttr
11 isAttrs
12 literalExpression
13 mapAttrs'
14 mapAttrsToList
15 mkIf
16 mkOption
17 optional
18 optionalString
19 sortOn
20 types
21 ;
22
23 # The priority of an option or section.
24 # The configurations format are order-sensitive. Pairs are added as children of
25 # the last sections if possible, otherwise, they start a new section.
26 # We sort them in topological order:
27 # 1. Leaf pairs.
28 # 2. Sections that may contain (1).
29 # 3. Sections that may contain (1) or (2).
30 # 4. Etc.
31 prioOf = { name, value }:
32 if !isAttrs value then 0 # Leaf options.
33 else {
34 target = 1; # Contains: options.
35 subvolume = 2; # Contains: options, target.
36 volume = 3; # Contains: options, target, subvolume.
37 }.${name} or (throw "Unknow section '${name}'");
38
39 genConfig' = set: concatStringsSep "\n" (genConfig set);
40 genConfig = set:
41 let
42 pairs = mapAttrsToList (name: value: { inherit name value; }) set;
43 sortedPairs = sortOn prioOf pairs;
44 in
45 concatMap genPair sortedPairs;
46 genSection = sec: secName: value:
47 [ "${sec} ${secName}" ] ++ map (x: " " + x) (genConfig value);
48 genPair = { name, value }:
49 if !isAttrs value
50 then [ "${name} ${value}" ]
51 else concatLists (mapAttrsToList (genSection name) value);
52
53 sudoRule = {
54 users = [ "btrbk" ];
55 commands = [
56 { command = "${pkgs.btrfs-progs}/bin/btrfs"; options = [ "NOPASSWD" ]; }
57 { command = "${pkgs.coreutils}/bin/mkdir"; options = [ "NOPASSWD" ]; }
58 { command = "${pkgs.coreutils}/bin/readlink"; options = [ "NOPASSWD" ]; }
59 # for ssh, they are not the same than the one hard coded in ${pkgs.btrbk}
60 { command = "/run/current-system/sw/bin/btrfs"; options = [ "NOPASSWD" ]; }
61 { command = "/run/current-system/sw/bin/mkdir"; options = [ "NOPASSWD" ]; }
62 { command = "/run/current-system/sw/bin/readlink"; options = [ "NOPASSWD" ]; }
63 ];
64 };
65
66 sudo_doas =
67 if config.security.sudo.enable || config.security.sudo-rs.enable then "sudo"
68 else if config.security.doas.enable then "doas"
69 else throw "The btrbk nixos module needs either sudo or doas enabled in the configuration";
70
71 addDefaults = settings: { backend = "btrfs-progs-${sudo_doas}"; } // settings;
72
73 mkConfigFile = name: settings: pkgs.writeTextFile {
74 name = "btrbk-${name}.conf";
75 text = genConfig' (addDefaults settings);
76 checkPhase = ''
77 set +e
78 ${pkgs.btrbk}/bin/btrbk -c $out dryrun
79 # According to btrbk(1), exit status 2 means parse error
80 # for CLI options or the config file.
81 if [[ $? == 2 ]]; then
82 echo "Btrbk configuration is invalid:"
83 cat $out
84 exit 1
85 fi
86 set -e
87 '';
88 };
89
90 streamCompressMap = {
91 gzip = pkgs.gzip;
92 pigz = pkgs.pigz;
93 bzip2 = pkgs.bzip2;
94 pbzip2 = pkgs.pbzip2;
95 bzip3 = pkgs.bzip3;
96 xz = pkgs.xz;
97 lzo = pkgs.lzo;
98 lz4 = pkgs.lz4;
99 zstd = pkgs.zstd;
100 };
101
102 cfg = config.services.btrbk;
103 sshEnabled = cfg.sshAccess != [ ];
104 serviceEnabled = cfg.instances != { };
105in
106{
107 meta.maintainers = with lib.maintainers; [ oxalica ];
108
109 options = {
110 services.btrbk = {
111 extraPackages = mkOption {
112 description = ''
113 Extra packages for btrbk, like compression utilities for `stream_compress`.
114
115 **Note**: This option will get deprecated in future releases.
116 Required compression programs will get automatically provided to btrbk
117 depending on configured compression method in
118 `services.btrbk.instances.<name>.settings` option.
119 '';
120 type = types.listOf types.package;
121 default = [ ];
122 example = literalExpression "[ pkgs.xz ]";
123 };
124 niceness = mkOption {
125 description = "Niceness for local instances of btrbk. Also applies to remote ones connecting via ssh when positive.";
126 type = types.ints.between (-20) 19;
127 default = 10;
128 };
129 ioSchedulingClass = mkOption {
130 description = "IO scheduling class for btrbk (see ionice(1) for a quick description). Applies to local instances, and remote ones connecting by ssh if set to idle.";
131 type = types.enum [ "idle" "best-effort" "realtime" ];
132 default = "best-effort";
133 };
134 instances = mkOption {
135 description = "Set of btrbk instances. The instance named `btrbk` is the default one.";
136 type = with types;
137 attrsOf (
138 submodule {
139 options = {
140 onCalendar = mkOption {
141 type = types.nullOr types.str;
142 default = "daily";
143 description = ''
144 How often this btrbk instance is started. See systemd.time(7) for more information about the format.
145 Setting it to null disables the timer, thus this instance can only be started manually.
146 '';
147 };
148 settings = mkOption {
149 type = types.submodule {
150 freeformType = let t = types.attrsOf (types.either types.str (t // { description = "instances of this type recursively"; })); in t;
151 options = {
152 stream_compress = mkOption {
153 description = ''
154 Compress the btrfs send stream before transferring it from/to remote locations using a
155 compression command.
156 '';
157 type = types.enum ["gzip" "pigz" "bzip2" "pbzip2" "bzip3" "xz" "lzo" "lz4" "zstd" "no"];
158 default = "no";
159 };
160 };
161 };
162 default = { };
163 example = {
164 snapshot_preserve_min = "2d";
165 snapshot_preserve = "14d";
166 volume = {
167 "/mnt/btr_pool" = {
168 target = "/mnt/btr_backup/mylaptop";
169 subvolume = {
170 "rootfs" = { };
171 "home" = { snapshot_create = "always"; };
172 };
173 };
174 };
175 };
176 description = "configuration options for btrbk. Nested attrsets translate to subsections.";
177 };
178 };
179 }
180 );
181 default = { };
182 };
183 sshAccess = mkOption {
184 description = "SSH keys that should be able to make or push snapshots on this system remotely with btrbk";
185 type = with types; listOf (
186 submodule {
187 options = {
188 key = mkOption {
189 type = str;
190 description = "SSH public key allowed to login as user `btrbk` to run remote backups.";
191 };
192 roles = mkOption {
193 type = listOf (enum [ "info" "source" "target" "delete" "snapshot" "send" "receive" ]);
194 example = [ "source" "info" "send" ];
195 description = "What actions can be performed with this SSH key. See ssh_filter_btrbk(1) for details";
196 };
197 };
198 }
199 );
200 default = [ ];
201 };
202 };
203
204 };
205 config = mkIf (sshEnabled || serviceEnabled) {
206
207 warnings = optional (cfg.extraPackages != []) ''
208 extraPackages option will be deprecated in future releases. Programs required for compression are now automatically selected depending on services.btrbk.instances.<name>.settings.stream_compress option.
209 '';
210
211 environment.systemPackages = [ pkgs.btrbk ] ++ cfg.extraPackages;
212
213 security.sudo.extraRules = mkIf (sudo_doas == "sudo") [ sudoRule ];
214 security.sudo-rs.extraRules = mkIf (sudo_doas == "sudo") [ sudoRule ];
215
216 security.doas = mkIf (sudo_doas == "doas") {
217 extraRules = let
218 doasCmdNoPass = cmd: { users = [ "btrbk" ]; cmd = cmd; noPass = true; };
219 in
220 [
221 (doasCmdNoPass "${pkgs.btrfs-progs}/bin/btrfs")
222 (doasCmdNoPass "${pkgs.coreutils}/bin/mkdir")
223 (doasCmdNoPass "${pkgs.coreutils}/bin/readlink")
224 # for ssh, they are not the same than the one hard coded in ${pkgs.btrbk}
225 (doasCmdNoPass "/run/current-system/sw/bin/btrfs")
226 (doasCmdNoPass "/run/current-system/sw/bin/mkdir")
227 (doasCmdNoPass "/run/current-system/sw/bin/readlink")
228
229 # doas matches command, not binary
230 (doasCmdNoPass "btrfs")
231 (doasCmdNoPass "mkdir")
232 (doasCmdNoPass "readlink")
233 ];
234 };
235 users.users.btrbk = {
236 isSystemUser = true;
237 # ssh needs a home directory
238 home = "/var/lib/btrbk";
239 createHome = true;
240 shell = "${pkgs.bash}/bin/bash";
241 group = "btrbk";
242 openssh.authorizedKeys.keys = map
243 (
244 v:
245 let
246 options = concatMapStringsSep " " (x: "--" + x) v.roles;
247 ioniceClass = {
248 "idle" = 3;
249 "best-effort" = 2;
250 "realtime" = 1;
251 }.${cfg.ioSchedulingClass};
252 sudo_doas_flag = "--${sudo_doas}";
253 in
254 ''command="${pkgs.util-linux}/bin/ionice -t -c ${toString ioniceClass} ${optionalString (cfg.niceness >= 1) "${pkgs.coreutils}/bin/nice -n ${toString cfg.niceness}"} ${pkgs.btrbk}/share/btrbk/scripts/ssh_filter_btrbk.sh ${sudo_doas_flag} ${options}" ${v.key}''
255 )
256 cfg.sshAccess;
257 };
258 users.groups.btrbk = { };
259 systemd.tmpfiles.rules = [
260 "d /var/lib/btrbk 0750 btrbk btrbk"
261 "d /var/lib/btrbk/.ssh 0700 btrbk btrbk"
262 "f /var/lib/btrbk/.ssh/config 0700 btrbk btrbk - StrictHostKeyChecking=accept-new"
263 ];
264 environment.etc = mapAttrs'
265 (
266 name: instance: {
267 name = "btrbk/${name}.conf";
268 value.source = mkConfigFile name instance.settings;
269 }
270 )
271 cfg.instances;
272 systemd.services = mapAttrs'
273 (
274 name: instance: {
275 name = "btrbk-${name}";
276 value = {
277 description = "Takes BTRFS snapshots and maintains retention policies.";
278 unitConfig.Documentation = "man:btrbk(1)";
279 path = [ "/run/wrappers" ]
280 ++ cfg.extraPackages
281 ++ optional (instance.settings.stream_compress != "no")
282 (getAttr instance.settings.stream_compress streamCompressMap);
283 serviceConfig = {
284 User = "btrbk";
285 Group = "btrbk";
286 Type = "oneshot";
287 ExecStart = "${pkgs.btrbk}/bin/btrbk -c /etc/btrbk/${name}.conf run";
288 Nice = cfg.niceness;
289 IOSchedulingClass = cfg.ioSchedulingClass;
290 StateDirectory = "btrbk";
291 };
292 };
293 }
294 )
295 cfg.instances;
296
297 systemd.timers = mapAttrs'
298 (
299 name: instance: {
300 name = "btrbk-${name}";
301 value = {
302 description = "Timer to take BTRFS snapshots and maintain retention policies.";
303 wantedBy = [ "timers.target" ];
304 timerConfig = {
305 OnCalendar = instance.onCalendar;
306 AccuracySec = "10min";
307 Persistent = true;
308 };
309 };
310 }
311 )
312 (filterAttrs (name: instance: instance.onCalendar != null)
313 cfg.instances);
314 };
315
316}