oibot/Tobserver
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Manage restic and backblaze secrets with sops

Browse source
This commit is contained in:
Tobias Ostner 2026-06-16 19:36:51 +02:00
parent fc6d6376cc
commit 7681e2ed28
2 changed files with 25 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

21
modules/nextcloud.nix
View file

@ -16,6 +16,18 @@
mode = "0400";
};
sops.secrets."restic/nextcloud-password" = {
owner = "root";
group = "root";
mode = "0400";
};
sops.secrets."backblaze/nextcloud-env" = {
owner = "root";
group = "root";
mode = "0400";
};
services = {
nextcloud = {
@ -85,21 +97,26 @@
restic.backups.nextcloud = {
initialize = true;
repository = "b2:tobcloud-backup:nextcloud";
passwordFile = "/var/lib/nextcloud/restic-password";
environmentFile = "/var/lib/nextcloud/backblaze-env";
passwordFile = config.sops.secrets."restic/nextcloud-password".path;
environmentFile = config.sops.secrets."backblaze/nextcloud-env".path;
paths = [
"/nextcloud-data"
"/var/backup/nextcloud"
];
backupPrepareCommand = ''
set -euo pipefail
install -d -m 0750 -o root -g root /var/backup/nextcloud
${pkgs.mariadb}/bin/mysqldump --single-transaction --databases nextcloud \
> /var/backup/nextcloud/nextcloud.sql
'';
timerConfig = {
OnCalendar = "daily";
};
pruneOpts = [
"--keep-daily 7"
"--keep-weekly 4"