...

1 files changed, 75 insertions, 17 deletions

diff --git a/hosts/vidhar/borg/default.nix b/hosts/vidhar/borg/default.nix
index 579630a9..650c91ee 100644
--- a/hosts/vidhar/borg/default.nix
+++ b/hosts/vidhar/borg/default.nix
@@ -1,23 +1,28 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, flakeInputs, ... }:
 
 with lib;
 
 let
+  sshConfig = pkgs.writeText "config" ''
+    Include /etc/ssh/ssh_config
+
+    ControlMaster auto
+    ControlPath /var/lib/borg/.borgssh-master-%r@%n:%p
+    ControlPersist yes
+
+    Host yggdrasil.borgbase
+      HostName nx69hpl8.repo.borgbase.com
+      User nx69hpl8
+      IdentityFile ${config.sops.secrets."append.borgbase".path}
+      IdentitiesOnly yes
+
+      BatchMode yes
+      ServerAliveInterval 10
+      ServerAliveCountMax 30
+  '';
+
   copyService = { repo, repoEscaped }: let
     serviceName = "copy-borg@${repoEscaped}";
-    sshConfig = pkgs.writeText "config" ''
-      Include /etc/ssh/ssh_config
-
-      Host yggdrasil.borgbase
-        HostName nx69hpl8.repo.borgbase.com
-        User nx69hpl8
-        IdentityFile ${config.sops.secrets."append.borgbase".path}
-        IdentitiesOnly yes
-
-        BatchMode yes
-        ServerAliveInterval 10
-        ServerAliveCountMax 30
-    '';
   in nameValuePair serviceName {
     serviceConfig = {
       Type = "oneshot";
@@ -72,8 +77,63 @@ let
         --prefix PATH : ${makeBinPath (with pkgs; [utillinux borgbackup])}:${config.security.wrapperDir}
     '';
   });
+
+  borgsnap = flakeInputs.mach-nix.lib.${config.nixpkgs.system}.buildPythonPackage rec {
+    pname = "borgsnap";
+    src = ./borgsnap;
+    version = "0.0.0";
+    ignoreDataOutdated = true;
+
+    requirements = ''
+      atomicwrites
+      pyprctl
+      python-unshare
+      xdg
+      python-dateutil
+    '';
+    postInstall = ''
+      wrapProgram $out/bin/borgsnap \
+        --prefix PATH : ${makeBinPath (with pkgs; [utillinux borgbackup])}:${config.security.wrapperDir}
+    '';
+
+    providers.python-unshare = "nixpkgs";
+    overridesPre = [
+      (self: super: { python-unshare = super.python-unshare.overrideAttrs (oldAttrs: { name = "python-unshare-0.2.1"; version = "0.2.1"; }); })
+    ];
+
+    _.xdg.buildInputs.add = with pkgs."python3Packages"; [ poetry ];
+    _.tomli.buildInputs.add = with pkgs."python3Packages"; [ flit-core ];
+  };
 in {
   config = {
+    services.zfssnap.config.exec = {
+      check = "${borgsnap}/bin/borgsnap -vvv --target yggdrasil.borgbase:repo --archive-prefix yggdrasil.vidhar. check --cache-file /run/zfssnap-prune/archives-cache.json";
+      cmd = "${borgsnap}/bin/borgsnap -vvv --target yggdrasil.borgbase:repo --archive-prefix yggdrasil.vidhar. create --dry-run";
+
+      halfweekly = "8";
+      monthly = "-1";
+    };
+
+    systemd.services = {
+      "zfssnap-prune" = {
+        serviceConfig = {
+          Environment = [
+            "BORG_RSH=\"${pkgs.openssh}/bin/ssh -F ${sshConfig}\""
+            "BORG_BASE_DIR=/var/lib/borg"
+            "BORG_CONFIG_DIR=/var/lib/borg/config"
+            "BORG_CACHE_DIR=/var/lib/borg/cache"
+            "BORG_SECURITY_DIR=/var/lib/borg/security"
+            "BORG_KEYS_DIR=/var/lib/borg/keys"
+            "BORG_KEY_FILE=${config.sops.secrets."yggdrasil.borgkey".path}"
+            "BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK=yes"
+            "BORG_HOSTNAME_IS_UNIQUE=yes"
+          ];
+          RuntimeDirectory = "zfssnap-prune";
+        };
+      };
+    } // listToAttrs (map copyService [{ repo = "/srv/backup/borg/jotnar"; repoEscaped = "srv-backup-borg-jotnar"; }]);
+
+
     services.borgbackup.repos.jotnar = {
       path = "/srv/backup/borg/jotnar";
       authorizedKeysAppendOnly = let
@@ -111,11 +171,9 @@ in {
       mode = "0400";
     };
 
-    systemd.services = listToAttrs (map copyService [{ repo = "/srv/backup/borg/jotnar"; repoEscaped = "srv-backup-borg-jotnar"; }]);
-
     systemd.timers."copy-borg@srv-backup-borg-jotnar" = {
       wantedBy = ["multi-user.target"];
-      
+
       timerConfig = {
         OnCalendar = "*-*-* 00/4:00:00 Europe/Berlin";
       };