From ecd7b887cb5d43e9f45bfd647505e115b3797972 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Sun, 25 Aug 2024 02:33:55 +0200
Subject: [PATCH] mediawiki: add backups to garage bucket

Restic backups to garage S3 bucket nachtigall-backups
https://garagehq.deuxfleurs.fr/documentation/connect/backup/#restic
---
 hosts/nachtigall/backups.nix                  |  10 ++++
 modules/mediawiki/default.nix                 |  26 +++++++++++
 secrets/restic-repo-garage-nachtigall-env.age | Bin 0 -> 2582 bytes
 secrets/restic-repo-garage-nachtigall.age     |  43 ++++++++++++++++++
 secrets/secrets.nix                           |   2 +
 5 files changed, 81 insertions(+)
 create mode 100644 secrets/restic-repo-garage-nachtigall-env.age
 create mode 100644 secrets/restic-repo-garage-nachtigall.age

diff --git a/hosts/nachtigall/backups.nix b/hosts/nachtigall/backups.nix
index c5bf79b..fea265c 100644
--- a/hosts/nachtigall/backups.nix
+++ b/hosts/nachtigall/backups.nix
@@ -10,4 +10,14 @@
     mode = "400";
     owner = "root";
   };
+  age.secrets.restic-repo-garage-nachtigall = {
+    file = "${flake.self}/secrets/restic-repo-garage-nachtigall.age";
+    mode = "400";
+    owner = "root";
+  };
+  age.secrets.restic-repo-garage-nachtigall-env = {
+    file = "${flake.self}/secrets/restic-repo-garage-nachtigall-env.age";
+    mode = "400";
+    owner = "root";
+  };
 }
diff --git a/modules/mediawiki/default.nix b/modules/mediawiki/default.nix
index 4512b55..0b7a671 100644
--- a/modules/mediawiki/default.nix
+++ b/modules/mediawiki/default.nix
@@ -232,4 +232,30 @@ in
       };
     };
   };
+
+  services.restic.backups.mediawiki-garage = {
+    paths = [
+      "/var/lib/mediawiki/images"
+      "/var/lib/mediawiki/uploads"
+      "/tmp/mediawiki-backup.sql"
+    ];
+    timerConfig = {
+      OnCalendar = "*-*-* 00:30:00 Etc/UTC";
+    };
+    initialize = true;
+    passwordFile = config.age.secrets."restic-repo-garage-nachtigall".path;
+    environmentFile = config.age.secrets."restic-repo-garage-nachtigall-env".path;
+    repository = "s3:https://buckets.pub.solar/mediawiki-backups";
+    backupPrepareCommand = ''
+      ${pkgs.sudo}/bin/sudo -u postgres ${pkgs.postgresql}/bin/pg_dump -d mediawiki > /tmp/mediawiki-backup.sql
+    '';
+    backupCleanupCommand = ''
+      rm /tmp/mediawiki-backup.sql
+    '';
+    pruneOpts = [
+      "--keep-daily 7"
+      "--keep-weekly 4"
+      "--keep-monthly 3"
+    ];
+  };
 }
diff --git a/secrets/restic-repo-garage-nachtigall-env.age b/secrets/restic-repo-garage-nachtigall-env.age
new file mode 100644
index 0000000000000000000000000000000000000000..fc0c27bf224954b5a815f520dc31661704ade5b0
GIT binary patch
literal 2582
zcmZXV*~|0>8O5cgQgYE!uoo`Ki=u+V_hp+*5{i~&l1yf@O!iDtMKW0@$t06~5rryf
zEm9E$6$PbO#n$Db2$fQ$F1;*56_?A3D59cJ3RSVb2w#!<7o2A~=Xbm~yb%_DJzd&U
zS==n^80=x-#`~|DCb<y?2!_Gr)rk?(A-)=Sns07|nv7Ocn`|bNWA%Emv&WsDlDwXt
z&1M{Y3PrO9s1#h-_1VnWR7kL5X<^P9Ti5&o$1MR{Lv@P^d*SS+c=md=&hZ&}xLR*Z
z(n4x{u@hQhmI&C+F;+kGV%4@NNEFT@j!wub?WrwLMy{dZN1UdZ5k8&wmt!`DFr;!>
zNge0&3X*bcQ<mONaBiv9jdvAc24BWN9hUZf6SlNk+AQSY$z@tCJi83HhXWdG{$|fF
zurZrz9X*OGOPgVbrSy_c$jU|(8v+EO1x;})8_2xK+YYO{SY22J>P4+Q<vq2J)hh5A
z3_mTy{2VNiX=G8E(bm(1$RT_HDm&HtH44_MiAG(s1wDkAFY@9@pnFrYtVwINR9(bf
zzmZlk);g*(Ef*?c@!N2@5paO;1APv5*umZ5?C4+UGcq+eVQ>fz&t`u~b3MUy3CAog
zg-sn!_<6NVMKed`06c6&z$;>~9@NW>#M*M*FmN@)U@6WDGc32HR2qxb?kqI3Y^6}x
zTBbW$7q8AhF(EL4Gch16F>dG16Id~jIqD~eGnS-x0gbRzGSbw@)2eby&YD3QIw6bG
zOb!-ZlT1+J3TK%FfWpwe6F3@Kmnds%3N%orY<ls~aAODdh+@$@itXj8LetfuV$T?F
z>X9OLOn^iOe+T5-m}xiR<kDcRAF9)SmpFMf>vUBZdK18c)YOZi6UC}-u{?6~3um$I
z_1k=O-5$mQ=nAq2^JH;RO9`wp=;DASs#qmIQH%x4qXJ%p89DFmAt44VZ)bex!HIVy
z9U-A=oCdsexL3MK^SX1V4he>t1Pf`EuczB;gxRW-^DsU5Xub$^lGygGcI-C2W2dOU
z%=e2P;E(+TaTphr417_18SPrRS-EaFq16ia&6DKvCCih1Ed8&KGmg<A3J~*j6_DHQ
z)NJOJnum#!NU6fw=E^}lPQ!7c=sfcv#X+uK4-}-r+QD4ZW5+fk8zTVn!KG?iOnhxM
z*vm*1R14a{CYH10avSvmBkglM>q%0d3V6guLZ_Oek&<lPL@U3ofrhQ{qdZIG1~t@c
zthCUEZy`hH5U$e$I^PA_*2^n<vf3u0_rAe_O9vVbUTV)uoR+|H9qtOO()r`I%+9uI
z2sn?NPD19(J{F2oMo$^1g(DI%#e^DbB}9$9s;NNjTQpo;`&c+~D$Y#B&au|Pa-W$5
zCA;ter=SZ&d2Ym3)7iF-iuYV26OQLz7hxz#`n*)jdBT9zI-YUG#(FOyAYbRXrtfN-
z-fyC)ZupA0<n~caxkEKFkrP8*cT~H!w9$i3OptBt0Lkez=#b`<01xMVYQp9zw^&h4
zTt`Rt3XDURFoG1U=%{2bs{V42_Uxo&R5193!HYl>D#BXwYwsY*hhq*UXdJ~}Go^<#
zRL^zk;@zHA261T1b*2|Hi;upPth2+lCF8!wfojU--G=N2Uv&7QaUzUCl{~XAdBc;=
z=A^88&IU1@he)_MgK6m2{l$%sF`v7lbcle<W}6lm1W_B0NVdC15D^ApX;yP8bZzz3
z*%YzGuANWtaV15l?k<ZVjKPJ+5hYg$Cjc+1kZD!aXf15J1+O!&sUf17P*2fTV{o&i
z23;EOv1@i;cg^M0-?$*y>Z;df<r@7|)hMIA>ad)@24-nm_I6nm2${exGYI>-FA&=-
zBSrII9at5H8!e`}IjV}V(h+H?9>62P>+7^3A}b)HF~+MbPdEQ<n%A`Essc~fTH|Hu
zZy|bCSx&T%@G8{8;6MdUUSE5<-^Z*T%(aPIXOadu5)`^=1Y?S0tDPUIRwVBPRL<!T
zIWEI+G24vH`QezxxAJ+bLmf`vH}REEyBB4f5tj^NR@qcy%M__nrfzc456c~uneI3e
zRe<qJz`3k<ybeVgIPPURBp8F^g)#<rzIYhnJ-CGW@GPO5S@=J-6K}0h>Pj@+ik@k<
zwm40-tD)U_MPy<Hy=@%&K<F9gxzb|Mvd93Cp-}akU7(Pe%;20uW22FFaLH4Z6CbS^
zjycRoH%UG$U%%V+PbY)AGAVT8hNZei1yDN5bTqG`LLRhoc{&e;&RZHR>)Dpu7!cqo
z5~Z-`2{!|ob4vzI3~!VO30o8yq@c78SzF&Jjaqt*bhj?KKrJL!uMV=UU%Z_XvT4CU
z6uyDP0H)8?HJn*-D<zN;uIYf#_G}EC!|ljN#Hp=EhX@P??7AdzFDgjk@rYB20ZUGQ
z(1Q750yl2lxMC}tN4QXJHqf9|EH*l0jc$Eay9lQqbzp{ZmukIE<T?Ys`z7Jm-aj6a
zg6eHQ``WwICz^-e@$jea72fjdQ_ucQQk>h~eNWrH^4Iqaes$Yd>~9$NKJda<?LR&A
z_|U!h&h;}N_%MC-xbyg1zwq17Jo3k9KKbw!`scrNPhSW4=O4fMrtBUEeff_0y<c2B
z`}Yri?&<0`AG+-x{>_gKuiW(p=zGt7B>d<7zqsRfTtMwV{pv68eBr+LefeMCZomEq
z@$>i(zH|G1PdxbGzpEEN`}EDb?%#g&N2}+)|J>bA-CRBK((j|U?<e|OKYaPeKMg<j
hz@3kNB6;KU&p-LiyH8IVk3I6}Pi{wl^^)?)e*gd?YOMeO

literal 0
HcmV?d00001

diff --git a/secrets/restic-repo-garage-nachtigall.age b/secrets/restic-repo-garage-nachtigall.age
new file mode 100644
index 0000000..c9cefe5
--- /dev/null
+++ b/secrets/restic-repo-garage-nachtigall.age
@@ -0,0 +1,43 @@
+age-encryption.org/v1
+-> ssh-ed25519 iDKjwg yk6WgkJbk16Yqc/aWojwDePfNZN3XgaiacpZqufw1hc
+qx3x0zCUB6l7qPS9R9xGO41s6ESGsNd/ixglY4gYDtY
+-> ssh-ed25519 uYcDNw nDZXlykiDEZIA+Srg6imZFRLAzhykR3PDVrfWb693Sg
+MBJrrXbtLzBozetgfZaE52o1ixsrPK6Ojdp8sXhI3dc
+-> ssh-rsa f5THog
+WngnjCboeUafoR5NOg/+NFeW/ILxonIrcl7iUQLXoObcFWtmgzEebcogo3kqnkdk
+cj7NnqQ/sFiHdPCBr+VyiWcP4BJHJeWF/w+Ht9SYP5+WlHUkC2IPxlcMzJFyy2ro
+9PDq8FaPX5ZqarOfBW+U1pQsegxG9wkfoSzoF8NVL0jU5mwubPc+1s0ycbjMcGzP
+CSCpWY0OqqRbCXj8gVBNOOoELVhgbNCO0oRWh6Iafqjrx/rO4MNAdZmUF9DiTZML
+8QQjBFR7G8/+4ehGHn/9PF/0yVVsnPaJTEo3juS/By+NVcCihwP3b0SgQkjtp73+
+2QZL4XImwR0bBLDla86IjvZWH7GkLzR8iAw75FZ/FGIxZ/XgwRcUqtcI8m105KAD
+iX1v7ai0LUYko4RPSqdDItEdGjK31Dl4bCdaLakO+aZdtc+60c7hx8uEoTp7JY9W
+Qmyv4rt5bVUUAeH0IyR72vTDpTtXSkbp0vypk6Zq+yhYjbe0wmakAPCF4WbIV9gQ
+YIoSyicQ3NYxfrQGcQvmct2dNXXZcCr8BW704/J5w7ngw44FiZDUIC2y562sHD84
+9rFO0obVGERJa55+MnZB4UYMqU3eWs+mkxHgWotx5yEtO0wMpTP9IFk92scJeV8h
+bdr6fq1p6gtFlSNlA7P8A0go1SWs+qIoO/PEPyznoss
+-> ssh-rsa kFDS0A
+RM1VIV11yDWaG7KDnXbVt+Qo9kIC5kPO1JwpROuxbTH8tDGbu7bC2mJ6qsZo1R5x
+ewtmDVwv+Gogs2drjQeQgdZH3qN0cMt34micbW2lvBW4NmvAGKEQ+dkkUgIWIhy9
+dNuFBCHAGqfw7FDqvX1Mm3e50CsbIVqpurBXe882seMjm/nSVzGgjOOQVaQKmNSg
+04s0gsLzN1f98kQtKuNPlG8Fun9y1bKLzWpBT2iriQInkhcWSwYqg1M0yM7U01j3
+Kcxn4LJmgB9qNkloEKNpHCze5fgIGyOf+MsG4VN90CvwpNxy/EHrEyncXDxSxiCt
+A81PVHCZfC7fQTR+hF2s1xGcW9mmtRpPPSEUrGY84cW2k8m4E5A9J7MJZ7FOKe6C
+OY3LoU5KCV292ujHqYs1c7JSJRqVq4IMCupsNL6afzB/Fe+cV6GX7bXh1ZUl9HT7
+B6j1QH2xA9OGz+6VDrB+B6cdnxp02zRZpuS19uPTJqpIg4Sgc4vvw7YFQfz8AfUD
+/SafkBpVKznEHl1/gO7bOMa1nTkNBicUp6d2Z/zNtJ75NJPb3qYc4aVsaEuyMPts
+ieMR/iieeiDOMPhedtibfCWZ+0YrtyIrkkUsPK5yG76VbJgMjSRyEP+bXTedih/b
+bTkE78BoV5DmNxGEAva2BJpMKtn3Or8dCgSudoSlI14
+-> piv-p256 vRzPNw Al8mhhyZ/0YFf7OSKeGm3LZhowpCdcITOhtjmky7Ygnq
+CxFNUst8+6e6Cra/j7Pa2lZs3lHGLCOWRInb1VZTr2M
+-> piv-p256 zqq/iw A+r/W9OhuPjuGXRuhp1vW45k/QzCFO6VLfp1W6l7RJVU
+GxunFSBPJnzd5t5Ar42vr06tyJkJvZhljlGkHVZOFOQ
+-> ssh-ed25519 YFSOsg e7udSQwtwKETHB0Re59fb1DdiBBPLDbV/JHmUUI4GSU
+054wi1iKJm8lnWDjONCk+h2vea0setKqdCpXHuJaecI
+-> ssh-ed25519 iHV63A S2sle86zYVPjtCozODRjqtTs6a5GksTpJHkmO/WYzHU
+7h5kS8Hc3BiyhiWerEa9xPX6o+D/bxoJLK1fXFq1jWc
+-> ssh-ed25519 BVsyTA 7meQJdKDB4JLKsYmBPgDBUnWhil1fKnoijm+uzHDemY
+1bxklkYv5KYab9fXjMtz/w5QTUYMlZFTQG/khBftlWo
+-> ssh-ed25519 +3V2lQ n1bF6+o/16zx7dEt/Um1gL30mARiuPaE6z3N+qjFZx4
+7ZjmhkuJDYXLcMoUEA0wosWcWZ1T1oR45kVhFyQwN1E
+--- TbpcaLv/1jF23nynpaw1XjSKsO2t9hAxovPQHKhXAoQ
+P‰^¢f«E~¢÷ß6ÿO[Ö-cf]–øÄ9eÓ6Ñû‘4Eÿl2=sÿßW‡…O¿QFCzcõbÖTšÎÉÿ;[a
\ No newline at end of file
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index ab52663..e49ec68 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -54,6 +54,8 @@ in
 
   "restic-repo-droppie.age".publicKeys = nachtigallKeys ++ adminKeys;
   "restic-repo-storagebox.age".publicKeys = nachtigallKeys ++ adminKeys;
+  "restic-repo-garage-nachtigall.age".publicKeys = nachtigallKeys ++ adminKeys;
+  "restic-repo-garage-nachtigall-env.age".publicKeys = nachtigallKeys ++ adminKeys;
 
   "drone-db-secrets.age".publicKeys = flora6Keys ++ adminKeys;
   "drone-secrets.age".publicKeys = flora6Keys ++ adminKeys;