pub-solar/infra
6
1
Fork 3
Code Issues 24 Pull requests 10 Actions Packages Projects 1 Releases Wiki Activity

WIP: feat/automated-account-deletion #174

Draft
b12f wants to merge 23 commits from feat/automated-account-deletion into main
pull from: feat/automated-account-deletion
merge into: pub-solar:main
Conversation 0 Commits 23 Files changed 31 +256 -234
5 changed files with 256 additions and 234 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit 38a34f4345 - Show all commits

14
.forgejo/workflows/check.yml
View file

@ -18,14 +18,20 @@ jobs:
# Prevent cache garbage collection by creating GC roots # Prevent cache garbage collection by creating GC roots
mkdir -p /var/lib/gitea-runner/tankstelle/.local/state/nix/results mkdir -p /var/lib/gitea-runner/tankstelle/.local/state/nix/results
for target in $(nix flake show --json --all-systems | jq ' for target in $(nix flake show --json --all-systems | jq --raw-output '
.["nixosConfigurations"] | .["nixosConfigurations"] |
to_entries[] | to_entries[] |
.key .key'
' | tr -d '"'
); do ); do
nix --print-build-logs --verbose --accept-flake-config --access-tokens '' \ nix --print-build-logs --verbose --accept-flake-config --access-tokens '' \
build --out-link /var/lib/gitea-runner/tankstelle/.local/state/nix/results/"$target" ".#nixosConfigurations.${target}.config.system.build.toplevel" build --out-link /var/lib/gitea-runner/tankstelle/.local/state/nix/results/"$target" ".#nixosConfigurations.${target}.config.system.build.toplevel"
done done
nix --print-build-logs --verbose --accept-flake-config --access-tokens '' flake check for check in $(nix flake show --json --all-systems | jq --raw-output '
.checks."x86_64-linux" |
to_entries[] |
.key'
); do
nix --print-build-logs --verbose --accept-flake-config --access-tokens '' \
build --out-link /var/lib/gitea-runner/tankstelle/.local/state/nix/results/"$check" ".#checks.x86_64-linux.${check}"
done

2
flake.nix
View file

@ -82,7 +82,7 @@
master = import inputs.master { inherit system; }; master = import inputs.master { inherit system; };
}; };
packages = import ./tests ({ inherit inputs self; } // args); checks = import ./tests ({ inherit inputs self; } // args);
devShells.default = pkgs.mkShell { devShells.default = pkgs.mkShell {
buildInputs = with pkgs; [ buildInputs = with pkgs; [

7
hosts/nachtigall/configuration.nix
View file

@ -59,11 +59,16 @@
database-password-file = config.age.secrets.keycloak-database-password.path; database-password-file = config.age.secrets.keycloak-database-password.path;
}; };
pub-solar-os.backups.stores.storagebox = { pub-solar-os.backups.repos.storagebox = {
passwordFile = config.age.secrets."restic-repo-storagebox".path; passwordFile = config.age.secrets."restic-repo-storagebox".path;
repository = "sftp:u377325@u377325.your-storagebox.de:/backups"; repository = "sftp:u377325@u377325.your-storagebox.de:/backups";
}; };
systemd.services.postgresql = {
after = [ "var-lib-postgresql.mount" ];
requisite = [ "var-lib-postgresql.mount" ];
};
# This value determines the NixOS release with which your system is to be # This value determines the NixOS release with which your system is to be
# compatible, in order to avoid breaking some software such as database # compatible, in order to avoid breaking some software such as database
# servers. You should change this only after NixOS release notes say you # servers. You should change this only after NixOS release notes say you

458
modules/backups/default.nix
View file

@ -13,257 +13,259 @@ let
}; };
# Type for a valid systemd unit option. Needed for correctly passing "timerConfig" to "systemd.timers" # Type for a valid systemd unit option. Needed for correctly passing "timerConfig" to "systemd.timers"
inherit (utils.systemdUtils.unitOptions) unitOption; inherit (utils.systemdUtils.unitOptions) unitOption;
inherit (lib)
literalExpression
mkOption
mkPackageOption
types
;
in in
{ {
options.pub-solar-os.backups = { options.pub-solar-os.backups = {
stores = repos = mkOption {
with lib; description = ''
mkOption { Configuration of Restic repositories.
description = '' '';
Periodic backups to create with Restic. type = types.attrsOf (
''; types.submodule (
type = types.attrsOf ( { name, ... }:
types.submodule ( {
{ name, ... }: options = {
{ passwordFile = mkOption {
options = { type = types.str;
passwordFile = mkOption { description = ''
type = types.str; Read the repository password from a file.
description = '' '';
Read the repository password from a file. example = "/etc/nixos/restic-password";
'';
example = "/etc/nixos/restic-password";
};
repository = mkOption {
type = with types; nullOr str;
default = null;
description = ''
repository to backup to.
'';
example = "sftp:backup@192.168.1.100:/backups/${name}";
};
}; };
}
)
);
default = { }; repository = mkOption {
example = { type = with types; nullOr str;
remotebackup = { default = null;
repository = "sftp:backup@host:/backups/home"; description = ''
passwordFile = "/etc/nixos/secrets/restic-password"; repository to backup to.
}; '';
}; example = "sftp:backup@192.168.1.100:/backups/${name}";
};
backups =
with lib;
mkOption {
description = ''
Periodic backups to create with Restic.
'';
type = types.attrsOf (
types.submodule (
{ name, ... }:
{
options = {
paths = mkOption {
# This is nullable for legacy reasons only. We should consider making it a pure listOf
# after some time has passed since this comment was added.
type = types.nullOr (types.listOf types.str);
default = [ ];
description = ''
Which paths to backup, in addition to ones specified via
`dynamicFilesFrom`. If null or an empty array and
`dynamicFilesFrom` is also null, no backup command will be run.
This can be used to create a prune-only job.
'';
example = [
"/var/lib/postgresql"
"/home/user/backup"
];
};
exclude = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
Patterns to exclude when backing up. See
https://restic.readthedocs.io/en/latest/040_backup.html#excluding-files for
details on syntax.
'';
example = [
"/var/cache"
"/home/*/.cache"
".git"
];
};
timerConfig = mkOption {
type = types.nullOr (types.attrsOf unitOption);
default = {
OnCalendar = "daily";
Persistent = true;
};
description = ''
When to run the backup. See {manpage}`systemd.timer(5)` for
details. If null no timer is created and the backup will only
run when explicitly started.
'';
example = {
OnCalendar = "00:05";
RandomizedDelaySec = "5h";
Persistent = true;
};
};
user = mkOption {
type = types.str;
default = "root";
description = ''
As which user the backup should run.
'';
example = "postgresql";
};
extraBackupArgs = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
Extra arguments passed to restic backup.
'';
example = [ "--exclude-file=/etc/nixos/restic-ignore" ];
};
extraOptions = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
Extra extended options to be passed to the restic --option flag.
'';
example = [ "sftp.command='ssh backup@192.168.1.100 -i /home/user/.ssh/id_rsa -s sftp'" ];
};
initialize = mkOption {
type = types.bool;
default = false;
description = ''
Create the repository if it doesn't exist.
'';
};
pruneOpts = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
A list of options (--keep-\* et al.) for 'restic forget
--prune', to automatically prune old snapshots. The
'forget' command is run *after* the 'backup' command, so
keep that in mind when constructing the --keep-\* options.
'';
example = [
"--keep-daily 7"
"--keep-weekly 5"
"--keep-monthly 12"
"--keep-yearly 75"
];
};
runCheck = mkOption {
type = types.bool;
default = (builtins.length config.pub-solar-os.backups.backups.${name}.checkOpts > 0);
defaultText = literalExpression ''builtins.length config.services.backups.${name}.checkOpts > 0'';
description = "Whether to run the `check` command with the provided `checkOpts` options.";
example = true;
};
checkOpts = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
A list of options for 'restic check'.
'';
example = [ "--with-cache" ];
};
dynamicFilesFrom = mkOption {
type = with types; nullOr str;
default = null;
description = ''
A script that produces a list of files to back up. The
results of this command are given to the '--files-from'
option. The result is merged with paths specified via `paths`.
'';
example = "find /home/matt/git -type d -name .git";
};
backupPrepareCommand = mkOption {
type = with types; nullOr str;
default = null;
description = ''
A script that must run before starting the backup process.
'';
};
backupCleanupCommand = mkOption {
type = with types; nullOr str;
default = null;
description = ''
A script that must run after finishing the backup process.
'';
};
package = mkPackageOption pkgs "restic" { };
createWrapper = lib.mkOption {
type = lib.types.bool;
default = true;
description = ''
Whether to generate and add a script to the system path, that has the same environment variables set
as the systemd service. This can be used to e.g. mount snapshots or perform other opterations, without
having to manually specify most options.
'';
};
}; };
}
)
);
default = { };
example = {
localbackup = {
paths = [ "/home" ];
exclude = [ "/home/*/.cache" ];
initialize = true;
};
remotebackup = {
paths = [ "/home" ];
extraOptions = [
"sftp.command='ssh backup@host -i /etc/nixos/secrets/backup-private-key -s sftp'"
];
timerConfig = {
OnCalendar = "00:05";
RandomizedDelaySec = "5h";
}; };
}
)
);
default = { };
example = {
remotebackup = {
repository = "sftp:backup@host:/backups/home";
passwordFile = "/etc/nixos/secrets/restic-password";
};
};
};
backups = mkOption {
description = ''
Periodic backups to create with Restic.
'';
type = types.attrsOf (
types.submodule (
{ name, ... }:
{
options = {
paths = mkOption {
# This is nullable for legacy reasons only. We should consider making it a pure listOf
# after some time has passed since this comment was added.
type = types.nullOr (types.listOf types.str);
default = [ ];
description = ''
Which paths to backup, in addition to ones specified via
`dynamicFilesFrom`. If null or an empty array and
`dynamicFilesFrom` is also null, no backup command will be run.
This can be used to create a prune-only job.
'';
example = [
"/var/lib/postgresql"
"/home/user/backup"
];
};
exclude = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
Patterns to exclude when backing up. See
https://restic.readthedocs.io/en/latest/040_backup.html#excluding-files for
details on syntax.
'';
example = [
"/var/cache"
"/home/*/.cache"
".git"
];
};
timerConfig = mkOption {
type = types.nullOr (types.attrsOf unitOption);
default = {
OnCalendar = "daily";
Persistent = true;
};
description = ''
When to run the backup. See {manpage}`systemd.timer(5)` for
details. If null no timer is created and the backup will only
run when explicitly started.
'';
example = {
OnCalendar = "00:05";
RandomizedDelaySec = "5h";
Persistent = true;
};
};
user = mkOption {
type = types.str;
default = "root";
description = ''
As which user the backup should run.
'';
example = "postgresql";
};
extraBackupArgs = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
Extra arguments passed to restic backup.
'';
example = [ "--exclude-file=/etc/nixos/restic-ignore" ];
};
extraOptions = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
Extra extended options to be passed to the restic --option flag.
'';
example = [ "sftp.command='ssh backup@192.168.1.100 -i /home/user/.ssh/id_rsa -s sftp'" ];
};
initialize = mkOption {
type = types.bool;
default = false;
description = ''
Create the repository if it doesn't exist.
'';
};
pruneOpts = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
A list of options (--keep-\* et al.) for 'restic forget
--prune', to automatically prune old snapshots. The
'forget' command is run *after* the 'backup' command, so
keep that in mind when constructing the --keep-\* options.
'';
example = [
"--keep-daily 7"
"--keep-weekly 5"
"--keep-monthly 12"
"--keep-yearly 75"
];
};
runCheck = mkOption {
type = types.bool;
default = (builtins.length config.pub-solar-os.backups.backups.${name}.checkOpts > 0);
defaultText = literalExpression ''builtins.length config.services.backups.${name}.checkOpts > 0'';
description = "Whether to run the `check` command with the provided `checkOpts` options.";
example = true;
};
checkOpts = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
A list of options for 'restic check'.
'';
example = [ "--with-cache" ];
};
dynamicFilesFrom = mkOption {
type = with types; nullOr str;
default = null;
description = ''
A script that produces a list of files to back up. The
results of this command are given to the '--files-from'
option. The result is merged with paths specified via `paths`.
'';
example = "find /home/matt/git -type d -name .git";
};
backupPrepareCommand = mkOption {
type = with types; nullOr str;
default = null;
description = ''
A script that must run before starting the backup process.
'';
};
backupCleanupCommand = mkOption {
type = with types; nullOr str;
default = null;
description = ''
A script that must run after finishing the backup process.
'';
};
package = mkPackageOption pkgs "restic" { };
createWrapper = lib.mkOption {
type = lib.types.bool;
default = true;
description = ''
Whether to generate and add a script to the system path, that has the same environment variables set
as the systemd service. This can be used to e.g. mount snapshots or perform other opterations, without
having to manually specify most options.
'';
};
};
}
)
);
default = { };
example = {
localbackup = {
paths = [ "/home" ];
exclude = [ "/home/*/.cache" ];
initialize = true;
};
remotebackup = {
paths = [ "/home" ];
extraOptions = [
"sftp.command='ssh backup@host -i /etc/nixos/secrets/backup-private-key -s sftp'"
];
timerConfig = {
OnCalendar = "00:05";
RandomizedDelaySec = "5h";
}; };
}; };
}; };
};
}; };
config = { config = {
services.restic.backups = services.restic.backups =
let let
stores = config.pub-solar-os.backups.stores; repos = config.pub-solar-os.backups.repos;
backups = config.pub-solar-os.backups.backups; backups = config.pub-solar-os.backups.backups;
storeNames = builtins.attrNames stores; storeNames = builtins.attrNames repos;
backupNames = builtins.attrNames backups; backupNames = builtins.attrNames backups;
createBackups = createBackups =
backupName: backupName:
map (storeName: { map (storeName: {
name = "${backupName}-${storeName}"; name = "${backupName}-${storeName}";
value = stores."${storeName}" // backups."${backupName}"; value = repos."${storeName}" // backups."${backupName}";
}) storeNames; }) storeNames;
in in

9
tests/keycloak.nix
View file

@ -83,9 +83,12 @@ in
wmClass = su "${gdbus} ${gseval} global.display.focus_window.wm_class"; wmClass = su "${gdbus} ${gseval} global.display.focus_window.wm_class";
in in
'' ''
<<<<<<< HEAD
def puppeteer_run(cmd): def puppeteer_run(cmd):
client.succeed(f'puppeteer-run \'{cmd}\' ') client.succeed(f'puppeteer-run \'{cmd}\' ')
=======
>>>>>>> main
start_all() start_all()
nachtigall.wait_for_unit("system.slice") nachtigall.wait_for_unit("system.slice")
@ -96,6 +99,7 @@ in
nachtigall.wait_until_succeeds("curl https://auth.test.pub.solar/") nachtigall.wait_until_succeeds("curl https://auth.test.pub.solar/")
client.wait_for_unit("system.slice") client.wait_for_unit("system.slice")
<<<<<<< HEAD
client.wait_for_file("/tmp/puppeteer.sock") client.wait_for_file("/tmp/puppeteer.sock")
puppeteer_run('page.goto("https://auth.test.pub.solar")') puppeteer_run('page.goto("https://auth.test.pub.solar")')
puppeteer_run('page.waitForNetworkIdle()') puppeteer_run('page.waitForNetworkIdle()')
@ -114,5 +118,10 @@ in
puppeteer_run('page.locator("button::-p-text(Register)").click()') puppeteer_run('page.locator("button::-p-text(Register)").click()')
puppeteer_run('page.waitForNetworkIdle()') puppeteer_run('page.waitForNetworkIdle()')
client.screenshot("after-register") client.screenshot("after-register")
=======
client.sleep(30)
# client.wait_until_succeeds("${wmClass} | grep -q 'firefox'")
client.screenshot("screen")
>>>>>>> main
''; '';
} }