commit f98312fcb5882e67b7c92d636e0ce7182255dc63 · pyrox.dev/nixpkgs

+48 -4

nixos/modules/services/backup/syncoid.nix

···

       4
        
       

     

       5
        
       let

     

       6
        
         cfg = config.services.syncoid;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       7
        
       in {

     

       8
        
       

     

       9
        
           # Interface

     
···

       26
        
       

     

       27
        
             user = mkOption {

     

       28
        
               type = types.str;

     

       29
       -
               default = "root";

     

       30
        
               example = "backup";

     

       31
        
               description = ''

     

       32
       -
                 The user for the service. Sudo or ZFS privilege delegation must be

     

       33
       -
                 configured to use a user other than root.

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       34
        
               '';

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       35
        
             };

     

       36
        
       

     

       37
        
             sshKey = mkOption {

     
···

       150
        
           # Implementation

     

       151
        
       

     

       152
        
           config = mkIf cfg.enable {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       153
        
             systemd.services.syncoid = {

     

       154
        
               description = "Syncoid ZFS synchronization service";

     

       155
        
               script = concatMapStringsSep "\n" (c: lib.escapeShellArgs

     
···

       160
        
                   ++ c.extraArgs

     

       161
        
                   ++ [ "--sendoptions" c.sendOptions

     

       162
        
                        "--recvoptions" c.recvOptions

     

       0
        
       
     

       163
        
                        c.source c.target

     

       164
        
                      ])) (attrValues cfg.commands);

     

       165
        
               after = [ "zfs.target" ];

     

       166
       -
               serviceConfig.User = cfg.user;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       167
        
               startAt = cfg.interval;

     

       168
        
             };

     

       169
        
           };

···

       4
        
       

     

       5
        
       let

     

       6
        
         cfg = config.services.syncoid;

     

       7
       +
       

     

       8
       +
         # Extract pool names of local datasets (ones that don't contain "@") that

     

       9
       +
         # have the specified type (either "source" or "target")

     

       10
       +
         getPools = type: unique (map (d: head (builtins.match "([^/]+).*" d)) (

     

       11
       +
           # Filter local datasets

     

       12
       +
           filter (d: !hasInfix "@" d)

     

       13
       +
           # Get datasets of the specified type

     

       14
       +
           (catAttrs type (attrValues cfg.commands))

     

       15
       +
         ));

     

       16
        
       in {

     

       17
        
       

     

       18
        
           # Interface

     
···

       35
        
       

     

       36
        
             user = mkOption {

     

       37
        
               type = types.str;

     

       38
       +
               default = "syncoid";

     

       39
        
               example = "backup";

     

       40
        
               description = ''

     

       41
       +
                 The user for the service. ZFS privilege delegation will be

     

       42
       +
                 automatically configured for any local pools used by syncoid if this

     

       43
       +
                 option is set to a user other than root. The user will be given the

     

       44
       +
                 "hold" and "send" privileges on any pool that has datasets being sent

     

       45
       +
                 and the "create", "mount", "receive", and "rollback" privileges on

     

       46
       +
                 any pool that has datasets being received.

     

       47
        
               '';

     

       48
       +
             };

     

       49
       +
       

     

       50
       +
             group = mkOption {

     

       51
       +
               type = types.str;

     

       52
       +
               default = "syncoid";

     

       53
       +
               example = "backup";

     

       54
       +
               description = "The group for the service.";

     

       55
        
             };

     

       56
        
       

     

       57
        
             sshKey = mkOption {

     
···

       170
        
           # Implementation

     

       171
        
       

     

       172
        
           config = mkIf cfg.enable {

     

       173
       +
             users =  {

     

       174
       +
               users = mkIf (cfg.user == "syncoid") {

     

       175
       +
                 syncoid = {

     

       176
       +
                   group = cfg.group;

     

       177
       +
                   isSystemUser = true;

     

       178
       +
                 };

     

       179
       +
               };

     

       180
       +
               groups = mkIf (cfg.group == "syncoid") {

     

       181
       +
                 syncoid = {};

     

       182
       +
               };

     

       183
       +
             };

     

       184
       +
       

     

       185
        
             systemd.services.syncoid = {

     

       186
        
               description = "Syncoid ZFS synchronization service";

     

       187
        
               script = concatMapStringsSep "\n" (c: lib.escapeShellArgs

     
···

       192
        
                   ++ c.extraArgs

     

       193
        
                   ++ [ "--sendoptions" c.sendOptions

     

       194
        
                        "--recvoptions" c.recvOptions

     

       195
       +
                        "--no-privilege-elevation"

     

       196
        
                        c.source c.target

     

       197
        
                      ])) (attrValues cfg.commands);

     

       198
        
               after = [ "zfs.target" ];

     

       199
       +
               serviceConfig = {

     

       200
       +
                 ExecStartPre = (map (pool: lib.escapeShellArgs [

     

       201
       +
                   "+/run/booted-system/sw/bin/zfs" "allow"

     

       202
       +
                   cfg.user "hold,send" pool

     

       203
       +
                 ]) (getPools "source")) ++

     

       204
       +
                 (map (pool: lib.escapeShellArgs [

     

       205
       +
                   "+/run/booted-system/sw/bin/zfs" "allow"

     

       206
       +
                   cfg.user "create,mount,receive,rollback" pool

     

       207
       +
                 ]) (getPools "target"));

     

       208
       +
                 User = cfg.user;

     

       209
       +
                 Group = cfg.group;

     

       210
       +
               };

     

       211
        
               startAt = cfg.interval;

     

       212
        
             };

     

       213
        
           };

+5 -4

nixos/tests/sanoid.nix

···

       38
        
       

     

       39
        
             services.syncoid = {

     

       40
        
               enable = true;

     

       41
       -
               sshKey = "/root/.ssh/id_ecdsa";

     

       42
        
               commonArgs = [ "--no-sync-snap" ];

     

       43
        
               commands."pool/test".target = "root@target:pool/test";

     

       44
        
             };

     
···

       69
        
               "udevadm settle",

     

       70
        
           )

     

       71
        
       

     

       72
       -
           source.succeed("mkdir -m 700 /root/.ssh")

     

       73
        
           source.succeed(

     

       74
       -
               "cat '${snakeOilPrivateKey}' > /root/.ssh/id_ecdsa"

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       75
        
           )

     

       76
       -
           source.succeed("chmod 600 /root/.ssh/id_ecdsa")

     

       77
        
       

     

       78
        
           source.succeed("touch /tmp/mnt/test.txt")

     

       79
        
           source.systemctl("start --wait sanoid.service")

···

       38
        
       

     

       39
        
             services.syncoid = {

     

       40
        
               enable = true;

     

       41
       +
               sshKey = "/var/lib/syncoid/id_ecdsa";

     

       42
        
               commonArgs = [ "--no-sync-snap" ];

     

       43
        
               commands."pool/test".target = "root@target:pool/test";

     

       44
        
             };

     
···

       69
        
               "udevadm settle",

     

       70
        
           )

     

       71
        
       

     

       0
        
       
     

       72
        
           source.succeed(

     

       73
       +
               "mkdir -m 700 -p /var/lib/syncoid",

     

       74
       +
               "cat '${snakeOilPrivateKey}' > /var/lib/syncoid/id_ecdsa",

     

       75
       +
               "chmod 600 /var/lib/syncoid/id_ecdsa",

     

       76
       +
               "chown -R syncoid:syncoid /var/lib/syncoid/",

     

       77
        
           )

     

       0
        
       
     

       78
        
       

     

       79
        
           source.succeed("touch /tmp/mnt/test.txt")

     

       80
        
           source.systemctl("start --wait sanoid.service")