From 49bc50ae3992ea0b15be7ddfed7b8157751deb29 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Fri, 19 Jun 2026 09:54:05 +1000 Subject: [PATCH 1/9] alyssum/restic: init --- hosts/alyssum/default.nix | 3 ++- hosts/alyssum/restic.nix | 30 ++++++++++++++++++++++++++++++ secrets.nix | 4 ++++ secrets/restic_env.age | 10 ++++++++++ secrets/restic_pass.age | Bin 0 -> 497 bytes secrets/restic_url.age | 9 +++++++++ 6 files changed, 55 insertions(+), 1 deletion(-) create mode 100644 hosts/alyssum/restic.nix create mode 100644 secrets/restic_env.age create mode 100644 secrets/restic_pass.age create mode 100644 secrets/restic_url.age diff --git a/hosts/alyssum/default.nix b/hosts/alyssum/default.nix index 06c415f..255380a 100644 --- a/hosts/alyssum/default.nix +++ b/hosts/alyssum/default.nix @@ -33,8 +33,9 @@ ./filesystem.nix ./kernel.nix - ./networking.nix ./home.syncthing.nix + ./networking.nix + ./restic.nix ./samba.nix ../../users/hana diff --git a/hosts/alyssum/restic.nix b/hosts/alyssum/restic.nix new file mode 100644 index 0000000..081bf72 --- /dev/null +++ b/hosts/alyssum/restic.nix @@ -0,0 +1,30 @@ +{ config, ... }: { + age.secrets.restic_env.file = ../../secrets/restic_env.age; + age.secrets.restic_pass.file = ../../secrets/restic_pass.age; + age.secrets.restic_url.file = ../../secrets/restic_url.age; + + services.restic.backups."flower" = { + initialize = true; + createWrapper = true; + progressFps = "0.016666"; + + environmentFile = config.age.secrets.restic_env.path; + passwordFile = config.age.secrets.restic_pass.path; + repositoryFile = config.age.secrets.restic_url.path; + + paths = ["/flower"]; + timerConfig = { + # every 30mns + OnCalendar = "*-*-* *:00,30:00"; + Persistent = true; + }; + bleh = [ + "--keep-last 24" + "--keep-hourly 24" + "--keep-daily 7" + "--keep-weekly 5" + "--keep-monthly 12" + "--keep-yearly 75" + ]; + }; +} diff --git a/secrets.nix b/secrets.nix index b1f55e5..d7ac2cc 100644 --- a/secrets.nix +++ b/secrets.nix @@ -12,6 +12,10 @@ in { "secrets/passwd_smbkujira.age".publicKeys = [ alyssum rin ]; "secrets/wpa_conf.age".publicKeys = [ alyssum blossom rin ]; + "secrets/restic_env.age".publicKeys = [ alyssum dandelion rin ]; + "secrets/restic_pass.age".publicKeys = [ alyssum dandelion rin ]; + "secrets/restic_url.age".publicKeys = [ alyssum dandelion rin ]; + "secrets/acme_dns.age".publicKeys = [ alyssum dandelion hazel rin ]; "secrets/navidrome_env.age".publicKeys = [ alyssum dandelion rin ]; "secrets/slskd_env.age".publicKeys = [ anemone dandelion rin ]; diff --git a/secrets/restic_env.age b/secrets/restic_env.age new file mode 100644 index 0000000..1917eef --- /dev/null +++ b/secrets/restic_env.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> ssh-ed25519 kOMSPw CYNG6K56RVMY5KP3vTczaCG9DVL3Ryv7QtqRzrdONh4 +VKH43RjHzP2TcyK8bEO8pZzZZeXqNXEDNq4JCkhMXlQ +-> ssh-ed25519 bRFqeQ AmuEljYrO5qqhaJQONYxQZTlaid2qNt+kktiMRDSKl4 +u+KzYFuEx+UCBfdcpup0fbEp1vGMP24nE3MwvcjhTSc +-> ssh-ed25519 U9FXlg IKN6gdqtD0FDOBk5vXuLD7AYuRtCGsIe5CYMJwyvcG4 +f5lkALvyjz1X94JmnG4u9kZ0S1TgZeBv+uxumFPChzQ +--- 3LBfI6E7NfSK1F42/cQkUzrpry6OWCeW/67YOpZe00k +8ĝg9(<9OT.L_C2XT 1L=3WCoze?4sU.<zIy,bP?(b?7dՃU*-<줯aD֐^,?3 Ebb +vH \ No newline at end of file diff --git a/secrets/restic_pass.age b/secrets/restic_pass.age new file mode 100644 index 0000000000000000000000000000000000000000..d9a68892045a9c441c4e19722d877707602d15e1 GIT binary patch literal 497 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCU7_V*1AC|58|DonJj zbPG(&OU|><&q_>o3rg|y%+vSGF>?2|^hj}wEU66g2sKO(_2tUVC<)JZ_eu3n%c%;~ zFHSY^FfjMhcMVF@_78EZFxS@hu&Bx|Do8BNaYeT+DafrbHBdp{)6gW}+&41K%OIr4 zx60WxH^oceBex(iw4f}*D9yt!B_OrH#7y7c$b`$!uO!#4BsnC?v7$W1FF(8>GATK+ zBCE_PB`VBOKQhhKurMRbFVQ&D%mCfCP)oOnoOFfK!eZl+tlV_hoCsIn@(edK1GixF z0>>(&{4{sp ssh-ed25519 kOMSPw l9/BY4rhuzGl/MRKjJ6Hyz2AGpsIZlDojQhSzJ8IxzY +tEGqxZOEWHZvTazrDoC4uTOyuT7fgRKXxumxpjdE89o +-> ssh-ed25519 bRFqeQ XQ1wRRwOP1bIiEX/Dh4tkHB3vF1OdZcLNTtVVM1oWgU +S6qXQsPNY0bGaUz+iLoJ0GBL26FtM4h/sgxqvIwOS3g +-> ssh-ed25519 U9FXlg pmY+R/M38tLi1dq2ll9FDv6uaGv8XlkE99NoAemtlGY +FGZodar5ESxmOZYDZ0F8P1FXNzkEpqT6jyJgzY5wLc0 +--- ig7eZey8XraBclyUEJRv1lJUyiOjqsfGc8Q+jjbAuvQ +eĶ@zYtV4%s29>閇(y8% j|PѨ::-YI)C̹I%yٸ:LCfq_ \ No newline at end of file From 9724f1d7317d4b06f731a00ca53853b593c9ed97 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Fri, 19 Jun 2026 09:55:28 +1000 Subject: [PATCH 2/9] user/git: enable push.autoSetupRemote --- modules/user/git.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/user/git.nix b/modules/user/git.nix index ca2762e..77f6b72 100644 --- a/modules/user/git.nix +++ b/modules/user/git.nix @@ -11,6 +11,7 @@ core.abbrev = 11; safe.directory = "/home/rin/Projects/flakes"; init.defaultBranch = "master"; + push.autoSetupRemote = true; }; }; } From e8b675e60656935839a4c901254a286494dea81d Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Fri, 19 Jun 2026 09:59:22 +1000 Subject: [PATCH 3/9] alyssum/restic: use correct opt name oopsie woopsie --- hosts/alyssum/restic.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hosts/alyssum/restic.nix b/hosts/alyssum/restic.nix index 081bf72..2ef946d 100644 --- a/hosts/alyssum/restic.nix +++ b/hosts/alyssum/restic.nix @@ -18,7 +18,7 @@ OnCalendar = "*-*-* *:00,30:00"; Persistent = true; }; - bleh = [ + pruneOpts = [ "--keep-last 24" "--keep-hourly 24" "--keep-daily 7" From 3f175d1b96d4ddabc11353640f605d1941e0cab8 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Fri, 19 Jun 2026 09:59:59 +1000 Subject: [PATCH 4/9] alyssum/restic: use float for progressfps --- hosts/alyssum/restic.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hosts/alyssum/restic.nix b/hosts/alyssum/restic.nix index 2ef946d..cfbea11 100644 --- a/hosts/alyssum/restic.nix +++ b/hosts/alyssum/restic.nix @@ -6,7 +6,7 @@ services.restic.backups."flower" = { initialize = true; createWrapper = true; - progressFps = "0.016666"; + progressFps = 0.016666; environmentFile = config.age.secrets.restic_env.path; passwordFile = config.age.secrets.restic_pass.path; From d64c23ce975d341c07f80c39398a349ebb798956 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Fri, 19 Jun 2026 10:20:00 +1000 Subject: [PATCH 5/9] alyssum/restic: backup less frequently --- hosts/alyssum/restic.nix | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/hosts/alyssum/restic.nix b/hosts/alyssum/restic.nix index cfbea11..b355589 100644 --- a/hosts/alyssum/restic.nix +++ b/hosts/alyssum/restic.nix @@ -14,13 +14,12 @@ paths = ["/flower"]; timerConfig = { - # every 30mns - OnCalendar = "*-*-* *:00,30:00"; + # every 6 hours + OnCalendar = "*-*-* 00,06,12,18:00:00"; Persistent = true; }; pruneOpts = [ - "--keep-last 24" - "--keep-hourly 24" + "--keep-last 8" "--keep-daily 7" "--keep-weekly 5" "--keep-monthly 12" From 985b617be1dd0e61882d884ba56034594c8748df Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Fri, 19 Jun 2026 10:26:14 +1000 Subject: [PATCH 6/9] system/tailscale: filter out derp warning spam --- modules/system/tailscale.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/modules/system/tailscale.nix b/modules/system/tailscale.nix index 5e3e044..16205f9 100644 --- a/modules/system/tailscale.nix +++ b/modules/system/tailscale.nix @@ -10,4 +10,7 @@ openFirewall = true; useRoutingFeatures = if config.me.environment == "headless" then "both" else "client"; }; + systemd.services.tailscaled.serviceConfig.LogFilterPatterns = [ + "~magicsock.*does not know about peer.*removing route" + ]; } From ac2690c9738a51f0e7dc5b85d9ad4e8731120f5b Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Fri, 19 Jun 2026 10:37:25 +1000 Subject: [PATCH 7/9] alyssum/snapper: init --- hosts/alyssum/default.nix | 1 + hosts/alyssum/restic.nix | 1 + hosts/alyssum/snapper.nix | 19 +++++++++++++++++++ 3 files changed, 21 insertions(+) create mode 100644 hosts/alyssum/snapper.nix diff --git a/hosts/alyssum/default.nix b/hosts/alyssum/default.nix index 255380a..870915a 100644 --- a/hosts/alyssum/default.nix +++ b/hosts/alyssum/default.nix @@ -37,6 +37,7 @@ ./networking.nix ./restic.nix ./samba.nix + ./snapper.nix ../../users/hana ]; diff --git a/hosts/alyssum/restic.nix b/hosts/alyssum/restic.nix index b355589..f5268b7 100644 --- a/hosts/alyssum/restic.nix +++ b/hosts/alyssum/restic.nix @@ -13,6 +13,7 @@ repositoryFile = config.age.secrets.restic_url.path; paths = ["/flower"]; + exclude = ["/.snapshots"]; timerConfig = { # every 6 hours OnCalendar = "*-*-* 00,06,12,18:00:00"; diff --git a/hosts/alyssum/snapper.nix b/hosts/alyssum/snapper.nix new file mode 100644 index 0000000..0196fe6 --- /dev/null +++ b/hosts/alyssum/snapper.nix @@ -0,0 +1,19 @@ +{ ... }: { + services.snapper = { + cleanupInterval = "1h"; + persistentTimer = true; + snapshotInterval = "*-*-* *:00,30:00"; + configs.home = { + FSTYPE = "btrfs"; + SUBVOLUME = "/flower"; + TIMELINE_CLEANUP = true; + TIMELINE_CREATE = true; + TIMELINE_MIN_AGE = "86400"; + TIMELINE_LIMIT_HOURLY = "24"; + TIMELINE_LIMIT_DAILY = "7"; + TIMELINE_LIMIT_WEEKLY = "5"; + TIMELINE_LIMIT_MONTHLY = "3"; + TIMELINE_LIMIT_YEARLY = "0"; + }; + }; +} From 4b2270e57aac31a021d644f55a64087f82485e96 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Fri, 19 Jun 2026 10:46:10 +1000 Subject: [PATCH 8/9] alyssum/restic: ignore snapshots correctly --- hosts/alyssum/restic.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hosts/alyssum/restic.nix b/hosts/alyssum/restic.nix index f5268b7..d84489c 100644 --- a/hosts/alyssum/restic.nix +++ b/hosts/alyssum/restic.nix @@ -13,7 +13,7 @@ repositoryFile = config.age.secrets.restic_url.path; paths = ["/flower"]; - exclude = ["/.snapshots"]; + exclude = ["/flower/.snapshots"]; timerConfig = { # every 6 hours OnCalendar = "*-*-* 00,06,12,18:00:00"; From d2fbc73636788a4f4629177c4cde90928ba18754 Mon Sep 17 00:00:00 2001 From: Cilly Leang Date: Sat, 20 Jun 2026 18:03:00 +1000 Subject: [PATCH 9/9] alyssum/restic: ignore all bind mounts --- hosts/alyssum/restic.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/hosts/alyssum/restic.nix b/hosts/alyssum/restic.nix index d84489c..eec0979 100644 --- a/hosts/alyssum/restic.nix +++ b/hosts/alyssum/restic.nix @@ -1,4 +1,4 @@ -{ config, ... }: { +{ config, lib, ... }: { age.secrets.restic_env.file = ../../secrets/restic_env.age; age.secrets.restic_pass.file = ../../secrets/restic_pass.age; age.secrets.restic_url.file = ../../secrets/restic_url.age; @@ -13,7 +13,8 @@ repositoryFile = config.age.secrets.restic_url.path; paths = ["/flower"]; - exclude = ["/flower/.snapshots"]; + exclude = ["/flower/.snapshots"] + ++ builtins.filter (x: lib.strings.hasPrefix "/flower" x) (builtins.attrNames config.me.binds); timerConfig = { # every 6 hours OnCalendar = "*-*-* 00,06,12,18:00:00";