commit 00ae655e639e620ee5dcfd6f1bd9ccb4e337eea1 · pyrox.dev/nixpkgs

+42 -15
nixos/modules/services/backup/btrbk.nix
···

       47
       47
        
           then [ "${name} ${value}" ]

     

       48
       48
        
           else concatLists (mapAttrsToList (genSection name) value);

     

       49
       49
        
       

     

       50
       50
       -
         addDefaults = settings: { backend = "btrfs-progs-sudo"; } // settings;

     

       50
       50
       +
         sudo_doas =

     

       51
       51
       +
           if config.security.sudo.enable then "sudo"

     

       52
       52
       +
           else if config.security.doas.enable then "doas"

     

       53
       53
       +
           else throw "The btrbk nixos module needs either sudo or doas enabled in the configuration";

     

       54
       54
       +
       

     

       55
       55
       +
         addDefaults = settings: { backend = "btrfs-progs-${sudo_doas}"; } // settings;

     

       51
       56
        
       

     

       52
       57
        
         mkConfigFile = name: settings: pkgs.writeTextFile {

     

       53
       58
        
           name = "btrbk-${name}.conf";

     
···

       152
       157
        
         };

     

       153
       158
        
         config = mkIf (sshEnabled || serviceEnabled) {

     

       154
       159
        
           environment.systemPackages = [ pkgs.btrbk ] ++ cfg.extraPackages;

     

       155
       155
       -
           security.sudo.extraRules = [

     

       156
       156
       -
             {

     

       157
       157
       -
               users = [ "btrbk" ];

     

       158
       158
       -
               commands = [

     

       159
       159
       -
                 { command = "${pkgs.btrfs-progs}/bin/btrfs"; options = [ "NOPASSWD" ]; }

     

       160
       160
       -
                 { command = "${pkgs.coreutils}/bin/mkdir"; options = [ "NOPASSWD" ]; }

     

       161
       161
       -
                 { command = "${pkgs.coreutils}/bin/readlink"; options = [ "NOPASSWD" ]; }

     

       162
       162
       -
                 # for ssh, they are not the same than the one hard coded in ${pkgs.btrbk}

     

       163
       163
       -
                 { command = "/run/current-system/bin/btrfs"; options = [ "NOPASSWD" ]; }

     

       164
       164
       -
                 { command = "/run/current-system/sw/bin/mkdir"; options = [ "NOPASSWD" ]; }

     

       165
       165
       -
                 { command = "/run/current-system/sw/bin/readlink"; options = [ "NOPASSWD" ]; }

     

       160
       160
       +
           security.sudo = mkIf (sudo_doas == "sudo") {

     

       161
       161
       +
             extraRules = [

     

       162
       162
       +
               {

     

       163
       163
       +
                   users = [ "btrbk" ];

     

       164
       164
       +
                   commands = [

     

       165
       165
       +
                   { command = "${pkgs.btrfs-progs}/bin/btrfs"; options = [ "NOPASSWD" ]; }

     

       166
       166
       +
                   { command = "${pkgs.coreutils}/bin/mkdir"; options = [ "NOPASSWD" ]; }

     

       167
       167
       +
                   { command = "${pkgs.coreutils}/bin/readlink"; options = [ "NOPASSWD" ]; }

     

       168
       168
       +
                   # for ssh, they are not the same than the one hard coded in ${pkgs.btrbk}

     

       169
       169
       +
                   { command = "/run/current-system/bin/btrfs"; options = [ "NOPASSWD" ]; }

     

       170
       170
       +
                   { command = "/run/current-system/sw/bin/mkdir"; options = [ "NOPASSWD" ]; }

     

       171
       171
       +
                   { command = "/run/current-system/sw/bin/readlink"; options = [ "NOPASSWD" ]; }

     

       172
       172
       +
                   ];

     

       173
       173
       +
               }

     

       174
       174
       +
             ];

     

       175
       175
       +
           };

     

       176
       176
       +
           security.doas = mkIf (sudo_doas == "doas") {

     

       177
       177
       +
             extraRules = let

     

       178
       178
       +
               doasCmdNoPass = cmd: { users = [ "btrbk" ]; cmd = cmd; noPass = true; };

     

       179
       179
       +
             in

     

       180
       180
       +
               [

     

       181
       181
       +
                   (doasCmdNoPass "${pkgs.btrfs-progs}/bin/btrfs")

     

       182
       182
       +
                   (doasCmdNoPass "${pkgs.coreutils}/bin/mkdir")

     

       183
       183
       +
                   (doasCmdNoPass "${pkgs.coreutils}/bin/readlink")

     

       184
       184
       +
                   # for ssh, they are not the same than the one hard coded in ${pkgs.btrbk}

     

       185
       185
       +
                   (doasCmdNoPass "/run/current-system/bin/btrfs")

     

       186
       186
       +
                   (doasCmdNoPass "/run/current-system/sw/bin/mkdir")

     

       187
       187
       +
                   (doasCmdNoPass "/run/current-system/sw/bin/readlink")

     

       188
       188
       +
       

     

       189
       189
       +
                   # doas matches command, not binary

     

       190
       190
       +
                   (doasCmdNoPass "btrfs")

     

       191
       191
       +
                   (doasCmdNoPass "mkdir")

     

       192
       192
       +
                   (doasCmdNoPass "readlink")

     

       166
       193
        
               ];

     

       167
       167
       -
             }

     

       168
       168
       -
           ];

     

       194
       194
       +
           };

     

       169
       195
        
           users.users.btrbk = {

     

       170
       196
        
             isSystemUser = true;

     

       171
       197
        
             # ssh needs a home directory

     
···

       183
       209
        
                     "best-effort" = 2;

     

       184
       210
        
                     "realtime" = 1;

     

       185
       211
        
                   }.${cfg.ioSchedulingClass};

     

       212
       212
       +
                   sudo_doas_flag = "--${sudo_doas}";

     

       186
       213
        
                 in

     

       187
       187
       -
                 ''command="${pkgs.util-linux}/bin/ionice -t -c ${toString ioniceClass} ${optionalString (cfg.niceness >= 1) "${pkgs.coreutils}/bin/nice -n ${toString cfg.niceness}"} ${pkgs.btrbk}/share/btrbk/scripts/ssh_filter_btrbk.sh --sudo ${options}" ${v.key}''

     

       214
       214
       +
                 ''command="${pkgs.util-linux}/bin/ionice -t -c ${toString ioniceClass} ${optionalString (cfg.niceness >= 1) "${pkgs.coreutils}/bin/nice -n ${toString cfg.niceness}"} ${pkgs.btrbk}/share/btrbk/scripts/ssh_filter_btrbk.sh ${sudo_doas_flag} ${options}" ${v.key}''

     

       188
       215
        
               )

     

       189
       216
        
               cfg.sshAccess;

     

       190
       217
        
           };