oibot/Tobserver
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Manage restic and backblaze secrets with sops

Browse source
This commit is contained in:
Tobias Ostner 2026-06-16 19:36:51 +02:00
parent fc6d6376cc
commit 7681e2ed28
2 changed files with 25 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

21
modules/nextcloud.nix
View file

@ -16,6 +16,18 @@
mode = "0400";
};
sops.secrets."restic/nextcloud-password" = {
owner = "root";
group = "root";
mode = "0400";
};
sops.secrets."backblaze/nextcloud-env" = {
owner = "root";
group = "root";
mode = "0400";
};
services = {
nextcloud = {
@ -85,21 +97,26 @@
restic.backups.nextcloud = {
initialize = true;
repository = "b2:tobcloud-backup:nextcloud";
passwordFile = "/var/lib/nextcloud/restic-password";
environmentFile = "/var/lib/nextcloud/backblaze-env";
passwordFile = config.sops.secrets."restic/nextcloud-password".path;
environmentFile = config.sops.secrets."backblaze/nextcloud-env".path;
paths = [
"/nextcloud-data"
"/var/backup/nextcloud"
];
backupPrepareCommand = ''
set -euo pipefail
install -d -m 0750 -o root -g root /var/backup/nextcloud
${pkgs.mariadb}/bin/mysqldump --single-transaction --databases nextcloud \
> /var/backup/nextcloud/nextcloud.sql
'';
timerConfig = {
OnCalendar = "daily";
};
pruneOpts = [
"--keep-daily 7"
"--keep-weekly 4"

8
secrets/tobserver.yaml
View file

@ -3,6 +3,10 @@ mempool:
mariadb-root-password: ENC[AES256_GCM,data:CjXQWw==,iv:3amyq9/3Nq7pz8s7wk4UORI1gSgURufGh1u/cITQf/I=,tag:4ulBVRDh0Ws04IqHT5P6tg==,type:str]
nextcloud:
admin-pass: ENC[AES256_GCM,data:3xufFHvcm5g5+jn+B4qxRljuWDqDXo1mLu4IlSuax7Cz+3ZoOuNXoCXoiaY=,iv:WaWeu/a45Vuz+HvO7m0dUlCGCexk4IX/ijURmb/7jPU=,tag:ytRjS89AmHiGOhKymViTrg==,type:str]
restic:
nextcloud-password: ENC[AES256_GCM,data:fbH++0KWr9V4QR90t4kmBdhwyF+dbtBdf9RFarv2E9MyrH7QMO4yxdppaeE=,iv:VnS2936xTO2sTl51lqXl8/3MBeGldARc4/ZFZYL/hG4=,tag:QGp6OFqEmt6iP11lG6GwmA==,type:str]
backblaze:
nextcloud-env: ENC[AES256_GCM,data:fZsW4+R0nDTqhx6pKQCOKULrheseS1j6JOBvHVCuOPaVqkkZv8/TsgtDJdWnKXTNS9/RBTqhLFPIaUSUrfH/bh6rIc4iDe0BehPzHCxh/0CBwirmu2iS,iv:6ggfA8R+zpj+kxcfaWlG4OH1Iteex6zGIin8+TUemGw=,tag:VQW3hbrbgNBQXzmeSrMaAw==,type:str]
checker:
env: ENC[AES256_GCM,data:TkeIRm8CXS9AiFpOrMD04dX5L/kL1XAYwOavDwtAuaCsg8bhAsmI6L9rdHsVuMnL46EaUwG4mAgn6EK6kfiSzkzgZ63MKrhcwhD3B4ybMMjj1opIWvifKBY2+wJ9bLI1ygZtQToOgti5oWLtcCt7zlDx8RqXKbAYNq9j0SBDhZBiZK/m+YJPPHclxr8cn9TlKfEhW78sZ2fyH8V65vT1Rz8gVDARdaz3G12CO5jLVY0q5ucqXrS8YRsuYczMSI3aUcBwRyf2UESsjDBXqfg7OKsgabGqvEwIK+rlbvo1ylIWFJZGC80FEcn/dAIsxC8ew8vhHwDch+dlbgrdyUxktb0qNBJU+7HdyP9QZ+mfU2Y/FIvRbicZXFIVdTnwls9tt2p+uxJQkLCp7OTyZgDHTECDQBRmg5hAdrvyyJUZAUvbcFVYkK984kSNyELbGsZBz+SGnxbQLuQDYi98T6HbIk448pDaWy43QGiEZERcFfLAVHnhK8wYsw6ta4BJSf95t+Ka9zMDhR/j0v3mkTrvXpprnTTp727jUY8AM+dUfavETfi9VtrD9P73UZWkL/Wy4PezBGGhm/8l6PU8C+6cfKfKswLGkKW8tDzxVKgvAHiWcK3adyW1/wLdTOHP5XMgDxWEGc3EZRJ4hrw1cQRrVqkxHI9q8a2pmQZxi7l1u61V/EXBKQSSHGDX8pg1HFwGSkj4a39llz5auFk3QsWIntDFYIYpQKDXns2pH+A+PbTJEv+UfMvDQnMKMG99njn2r8KKXf88VWs64tCq/uylaslx3f/1CnVwTlr3REI=,iv:5nbRJpjNReztdAaTlHHjh7MH0PAN9eSSEEhE1Z8ynA4=,tag:9gYKrH/0g0bca/Q67LchFA==,type:str]
hermes-env: ENC[AES256_GCM,data:WcN3pP4BIrMoKfehixAHZFTI2rk0js2mwi0m4+NsfgqamDH8IqHpbMJGhIg4zUmJBUlyz+4ZhjtNmvlxtj/i7UxIkPNq4qg95eK59gEM3npW9euRoX+BziKvsM6fFMRbWt60GaKigiI05z83M9I9/A8qbZC/PEWPfj6a5wlqHSVSe2qJjg5tGpthVhApaJ9ZmuTzhyHjs9zRvlkC9SFp9WsdyWWxNfChIKj8MySeAGs1YlDAGFVzsjX3+JlPVlCwPw==,iv:euK36Gk50/NQfjkspCP7tv3/a/gknzrDM21GUqVhEBY=,tag:jPF67Qa6e1VrY7byXKQw0w==,type:str]
@ -30,7 +34,7 @@ sops:
cVE5VG56cFAzT1dsRFN4cCtnVEJJdU0KSBWm4blGhnVlOJ3k7lh8aJVOEH8NfFOh
EwU/4Up6zWYBoe2+GKiQf8imnVLSSxMR7dlNd06ttuFD4B5baqFRcA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-06-09T08:33:08Z"
mac: ENC[AES256_GCM,data:/pSGLgzeZ0Qpk7xC0NOSMgh0s3J3YCxLIY9S555bFg7jwR+Bx9MykAtbHcGr4ehiQIXwSF9M0QoNyGVooBGyivVopoyWnqhKEJJ+lyi4/vEC9K0m4caXrqxuw8Fed6SZRda4XzzfT9dq2ApJ/udxuOGz0SXcMxQmSOYtthvOrW8=,iv:kvUiIyG7fIyc7ofUMbDEOApc1C19tEZuKuQdq2Sv2rY=,tag:rjFDgH+9/5S+PlhY7TN/ZA==,type:str]
lastmodified: "2026-06-16T17:25:58Z"
mac: ENC[AES256_GCM,data:fQNxcm5uOIMGreLwi5gZTQafDQO+4R9m+mU5rg/Wq/FROtfNLwcrf45jDUxqYk82Bad+QgZMWnwe+PjzW9y/bf/Q8h8rvTXGqKe0UdyLstif3Umm2wt1ou/WUWjLLqtSBHWMl3Z0/BOdufDshUansQR1FlNrsyJCQ1iWDUQEO8g=,iv:jD6xoGyfDKGzACKtczArS/+8FrfS+mW6ll3MQmXPXwU=,tag:HQJbJjfHODYH37zni8yYrA==,type:str]
unencrypted_suffix: _unencrypted
version: 3.12.1