@cryptotaxi247 / infra / commits / 21a99a8f

Set up backups for umbriel

This does not actually back up any files/folders yet, it just sets up the infrastructure for doing so. This is necessary because umbriel is now stateful (now that we use it for freescout).

Jeremy Fleischman committed Sep 18, 2025 at 14:02 UTC 21a99a8ffb6c548faad4f18341399fa8e1bc189c
3 files changed +113 -1
non-critical-infra/hosts/umbriel/default.nix
+51 -1
@@ -1,4 +1,9 @@
1 -{ inputs, lib, ... }:
1 +{
2 + config,
3 + inputs,
4 + lib,
5 + ...
6 +}:
7
8 {
9 imports = [
@@ -6,6 +11,7 @@
11 inputs.srvos.nixosModules.server
12 inputs.srvos.nixosModules.hardware-hetzner-cloud-arm
13 ../../modules/common.nix
14 + ../../modules/backup.nix
15 ../../modules/prometheus/node-exporter.nix
16 ../../modules/mailserver
17 ];
@@ -44,5 +50,49 @@
50 linkConfig.RequiredForOnline = "routable";
51 };
52
53 + # How to generate:
54 + #
55 + # $ cd non-critical-infra
56 + # $ SECRET_PATH=secrets/storagebox-ssh-key.umbriel
57 + # $ ssh-keygen -t ed25519 -f "$SECRET_PATH" -P "" -C root@umbriel
58 + # $ sops encrypt --in-place "$SECRET_PATH"
59 + # $ rm "$SECRET_PATH".pub
60 + #
61 + # Next, deploy this secret, ssh to the machine and install the secret on the storagebox:
62 + #
63 + # $ ssh-keygen -f /var/keys/storagebox-ssh-key -y | ssh -o "UserKnownHostsFile=/dev/null" -p23 u391032-sub4@u391032-sub4.your-storagebox.de install-ssh-key
64 + sops.secrets.storagebox-ssh-key = {
65 + sopsFile = ../../secrets/storagebox-ssh-key.umbriel;
66 + format = "binary";
67 + path = "/var/keys/storagebox-ssh-key";
68 + mode = "0600";
69 + owner = "root";
70 + group = "root";
71 + };
72 +
73 + # How to generate:
74 + #
75 + # $ cd non-critical-infra
76 + # $ SECRET_PATH=secrets/backup-secret.umbriel
77 + # $ pwgen -s 64 1 > "$SECRET_PATH"
78 + # $ sops encrypt --in-place "$SECRET_PATH"
79 + sops.secrets.backup-secret = {
80 + sopsFile = ../../secrets/backup-secret.umbriel;
81 + format = "binary";
82 + path = "/var/keys/borg-secret";
83 + mode = "0600";
84 + owner = "root";
85 + group = "root";
86 + };
87 +
88 + services.backup = {
89 + user = "u391032-sub4";
90 + host = "u391032-sub4.your-storagebox.de";
91 + hostPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs";
92 + port = 23;
93 + sshKey = config.sops.secrets.storagebox-ssh-key.path;
94 + secretPath = config.sops.secrets.backup-secret.path;
95 + };
96 +
97 system.stateVersion = "23.05";
98 }
non-critical-infra/secrets/backup-secret.umbriel new
+31
@@ -0,0 +1,31 @@
1 +{
2 + "data": "ENC[AES256_GCM,data:ceXkGoUn9mid9uVMyxnNonGfkqodqPQ6iPShWT1qjwqq47sXpE5GP6UurneL1blzo1MooaeAOsI9zsxFDyXLfU0=,iv:QXPiFRM/MNcAD+i7mIRjZ7Zqym7aoO/2ZNzbSdayPj8=,tag:JBnSAvFJOG2kBzEw2Arjvg==,type:str]",
3 + "sops": {
4 + "age": [
5 + {
6 + "recipient": "age15vcp7875xwtf64j4yshyld0a3hpgzv6n2kxky493s3q0swr9hdaqxugpv6",
7 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzd1poSURwWFFUcWlqZEdz\nTSttUjFzZHRJemJHZys4cWpES0IxL0lhQkJrCmpvYXl2UGhwbnorbDJ0UktJYnh0\nSWdvYnNRQTVSRElMcVpReXdpZEVWTWMKLS0tIG9tQWtBODhUWVBFc1VzTmJ2dml2\nOCs3QXNJQngyODVORGVUelBPeHJHbXMKqPYMtVEfxGupyajiFv+yTDLL5r5O/gx/\n/631GB9yCv6idwRcoUAV99dj0Gsr1IQwbBJTWb6d2o/ik0JkkeNJfw==\n-----END AGE ENCRYPTED FILE-----\n"
8 + },
9 + {
10 + "recipient": "age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x",
11 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoY1JvTkZEZlp4a3Fwcnph\nU1hrUXpPd0FRQmtwN3VMdldYUmh6SmtzMlc4Cjc4ZU14WVJaYVFabVhhR05DVHov\nMEVmV245RlM5ODFMQUJoQXNrd0VrZDQKLS0tIEdCTlh6SVNyUWhQbytKenROMVRp\nUjZteHF3Nlg2T0gyZTY2VU5GR0pSbXMK5uUemFhCQNv6YmcWVC0CZ+WDWWDkKuYd\nTDHuT3ltMEn376yKTnHxqoi1fMh1rM/nSVtYiPqDdKJSiuH/HoBd+w==\n-----END AGE ENCRYPTED FILE-----\n"
12 + },
13 + {
14 + "recipient": "age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h",
15 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMUTdUZ09jenBJUHprb3ZB\ndThWY2NtZDZTTzdRd21Hd3ZVY3JxdGY1WlhnCnlSWVFUSk4wQVhRUHQ1QmhxV1F0\nanpXS2crWG5UVGtRcXJsWkZhV2E0RlUKLS0tIHNzTWRnS2VyUERGY0pmZ2FDdGZL\nbkRWc2lKV2NRMHlYM0tISEcvY0VWeTQKR7m9WyBPE+9mgBGMItrbbH9ii2Y9zAI2\njJ52i2UvTbDxg64rXOc5nkYgM9rIiResRW/xK/uZHbLY7nFiOdZTTw==\n-----END AGE ENCRYPTED FILE-----\n"
16 + },
17 + {
18 + "recipient": "age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz",
19 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkVkN0YXRySHhOTmpTTHdV\nMm8zRzFDYXVRLy9qZlR4Y1NlZ3NHOHprL3ljCm1lbEFNdkxKODBKUEkrSFN1STdG\naTVGNTdFc0ZzSUg2MkFmYVNnYVJKdHMKLS0tIDRES1BuYkFJNWJuQ1p0UjFoTkY0\nSXU5dTlYbEtYOVdhMmFGL0tJTVR2OU0K59/Y4gYtO8k0W9tHG7N3bJE/xFEszfER\nDSyE1qkLxNDsVpzuBEbS3SDqBS1sPMLSXoi0DMv+SCtDJXWemEzhJA==\n-----END AGE ENCRYPTED FILE-----\n"
20 + },
21 + {
22 + "recipient": "age1nnm255ah9wa4gpsaq0v023a75lnmlcxszt9lc6az3mtwzxgrucfq45rp7h",
23 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYbEJuTURFRllSLytQZVly\nZE1lUEdPMVd3cFhKbEowcEVwSjdkbkFKWUEwCmVmM0dXTE5adkZWLzRNUmFOWnRv\nZ1lSSHRaMExQYVhydXBZSW1DYVlKZEEKLS0tIE56dEloWk5WQ05vVVZQTUIvYUxi\nR25Wa2l6ZjFaUW5aN2R1YmY0N05zd0EK+ogRcMHGDI5I13c/DkeHOVmG2w1dFIrm\nDPjHWLAaK45VLdD1qCyXKze3zm3pYdMcox0ss9tIwiZY+eqg0zlPHQ==\n-----END AGE ENCRYPTED FILE-----\n"
24 + }
25 + ],
26 + "lastmodified": "2025-09-22T21:03:07Z",
27 + "mac": "ENC[AES256_GCM,data:PrInJ5kvru2aeoSxipXjRdOppUNe+SFVNaDlAnSlyxHrKWDIztMs5S68AL1sAI9Sx/UMlIvcn8AUPCiMRIPrSQODAkr3OsUOz9poGMJiH4lVg0e+S+UgpH2+WLtE+F6xnCAI2i0Oc1ug67/JlHpKaKTYwalUFpIIekdtFoiOavo=,iv:cWh0NBE49n9RtXcMqlIUXFEeI8mAksNKpXpDxub4DlA=,tag:LBqRYbpoWTo1Uc6ekeCpNQ==,type:str]",
28 + "unencrypted_suffix": "_unencrypted",
29 + "version": "3.10.2"
30 + }
31 +}
non-critical-infra/secrets/storagebox-ssh-key.umbriel new
+31
@@ -0,0 +1,31 @@
1 +{
2 + "data": "ENC[AES256_GCM,data:ck7zFaw/7DdelananEIJkocwS3r9k8OiI8jRUPChCdTzLW+5MJcxfCmx3nT++y/Av1S5bf+nMNKJ77Q0XtegQ1eESKoIrf0EPb4Cbvg4/zVxkqcRptaXmCSuDgLq0bj7rtREvmmJ4ZhOaLTDf4mxgHof/11iOL4SvrjEbVuNvpF0k+F7wZyF5sOmsMxFzC3rGsKhwQ2VOffxmrwYqhQAi97/Crmq8pDexjNPBc+ilJws5IRZqZPucQF95EdwUhsZvd5jY+9ls7otYvjqCpkHLzMrIU08Ur4jq2VFXvffbbMtfumDk29lOomFFMj40gpIliMtc1Z9RQDRXHHDhKoHU1Ui5Z/5iobftyiBytAYNgxbJpD7F2xMeYl+DlmEK9kaSKIjyiuBQVgKbDdn7fDIVGMNbLbsDU9+WhAptO+qUkHxfHX4rJn+t1imxcMp+vilxcexbmAJ6FjwMe5qhLb+bAhhH+hxHQNLLVfR+C6rqH7ni4k2DeUislGEndhmA2j1eZDnebyV3asRkmZFr7o3,iv:jfFUCPTgzdTGV0AmPAqLMtGpGXG2fnfWNadWw9h/ELk=,tag:tNEdNvxOY3JGq158TFj+og==,type:str]",
3 + "sops": {
4 + "age": [
5 + {
6 + "recipient": "age15vcp7875xwtf64j4yshyld0a3hpgzv6n2kxky493s3q0swr9hdaqxugpv6",
7 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRazJhYjZlT3ExTGhSTWJM\nUlA0dW8zcjg4QXMwTEtKa3BOS1RTdE02R1ZFCjg2dEk2SFJhd3liV0tIYWRZREFH\nZmd1T2Y5UVpzc1JrNUt4ZFpROE00OG8KLS0tIEdBamllNkIrUm0ybzh3djZWL1NI\nZGRvWmNsQW02dENmMmVKVzVQNTl3bzQK4x7OmWlU4jYYEwaERYZm/D9WXYo7BfJi\nKxXPOYiMnU+OVD8Vc1jyR/E1GYmudJIZGnuvhS9SgzeNHcsaRaW4Pg==\n-----END AGE ENCRYPTED FILE-----\n"
8 + },
9 + {
10 + "recipient": "age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x",
11 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvMldDTnI2QTZ4YWs1dlY0\nMTJnSlBjUGNIMllzelhkZmlMZnc1V1k3N3k4Cm5qeUExdFQ5WDFYYVBRY3ZwcjBi\nV3JwT0Z3SjVheDFicWk5VXpmV0F2bGsKLS0tIHRxSndYZ0YxWDdGczBwKzMzQ1pU\nWWxYZDNwQ0ZNZ0hRa1FWY21LdWxuejAKXrmbpP+Kkud7QH/tre7909mtAkI1hR/b\nzdHIim18Qx3eETs2rk3qic0p9jPTWW9XWaN623NBjpwezpXOFK1B2A==\n-----END AGE ENCRYPTED FILE-----\n"
12 + },
13 + {
14 + "recipient": "age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h",
15 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvTXQ3N0hPWE1BckdVWmN0\nd3V0a2JBZTdCMXdwbDlYZnc1OVZ2c1VkeUZJCjVrVU5kWUEvU3FWQ0hjMThQVTM3\nVE15Q0FPdWhhSUVVa3MxU05OTFlaZm8KLS0tIENnekZKSm0weEhqK01IQ2dRY2Vm\nNXFLbUxrREs1WGZ0L3VSSnExNEh5aFkKQLhS7k/3LoJhcUucaVwrn4lhTYKcRdM2\nw1nQOvn7YhLY1km2ycazgQVWMq2+/fz4YQJmSKmiUuRblIv7f/w6Nw==\n-----END AGE ENCRYPTED FILE-----\n"
16 + },
17 + {
18 + "recipient": "age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz",
19 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHUTA2ZjNXK2RacTU3d05Q\nb1NuRXNWMTBZd3FaWUlHNTE1d1Y4YzJnS2hJCjQ1K0ZMTVhoYVFlYU12YVliTG0w\ncXdzM3lVWklSZlp2RStIZU10SUJsbHcKLS0tIFZaSHFHc1FBanlKa3FvbTk3cFNN\nVTMzYlpsR2l1YTB6QThuaFZFUFVPMDgKvVHujnT/NnkHd81DRP7ZQjFpsvZPtDUm\nI2xzyRM8WleLIE7prYvRSo2+KKepep3GS4UnIQD5mEeX+scPCZW6Xw==\n-----END AGE ENCRYPTED FILE-----\n"
20 + },
21 + {
22 + "recipient": "age1nnm255ah9wa4gpsaq0v023a75lnmlcxszt9lc6az3mtwzxgrucfq45rp7h",
23 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoZmtldmJwZDVjVEdkOWdq\nTUFaKzBDR0lURnM1am5qMDFnYXNoU2FLYTBBCk90aUlPem9Ra2VYWVVUelQ5THd0\nWjRKUzQ2NXpmMng1Sm92YzlQVzV0bjgKLS0tIHZrRVZROFltVEVjVWJHT2M4S2p5\nYnVBbGM3OS81U1o2UnN1MmxaRzFaSE0KAljGmWJR/KG4HcDSMmtEWEUpebvC0+vI\nk288ScTJ/zZqZ3IztpInPmHYdzqVJxnp9OnHxvb/ShCvVgRKOUoXkA==\n-----END AGE ENCRYPTED FILE-----\n"
24 + }
25 + ],
26 + "lastmodified": "2025-09-18T18:58:36Z",
27 + "mac": "ENC[AES256_GCM,data:M9jAOuPxEL3X+WIUeZoXuDXIFF+ftkNg6FN2u+HhEV+dbOVR1WFsYe7zxIvjvPq2GwGpzj1lKwZ6pJjmafta9dIMemHhkDdUqHZSexpUqx0p6ML9XUJEzcC8euu88wGlq2gxfj24QXAkhd+mHBRqJxdJKIRYDZCSll0DtrvDSSM=,iv:DbhKGx5MU3R7SmIrGEo+/fg8F2sjWI+kk0bShsyH2TQ=,tag:2VQA7/OddGGRcROXDGzenQ==,type:str]",
28 + "unencrypted_suffix": "_unencrypted",
29 + "version": "3.10.2"
30 + }
31 +}