feat: offline backups using btrbk

capibara.nix

@@ -4,7 +4,23 @@
 
 { config, pkgs, stablePkgs, impermanence, ... }:
 
-let home = "/home/rilla";
+let
+  home = "/home/rilla";
+  run-offline-backups = pkgs.writeScriptBin "run-offline-backups" ''
+    #!${pkgs.dash}/bin/dash
+
+    set -xe
+
+    for x in 0 1 2; do
+      ${pkgs.systemd}/bin/systemctl start "mnt-backups-''${x}.mount"
+    done && \
+    /run/wrappers/bin/doas -u btrbk \
+      ${pkgs.btrbk}/bin/btrbk \
+        -c /etc/btrbk/offline-backups.conf \
+        --progress \
+        --verbose \
+        run
+  '';
 
 in {
   imports = [ ./nixos/hardware-configuration/capibara.nix ./nixos/common.nix ];
@@ -147,7 +163,7 @@ in {
   # services.thermald.enable = true;
   services.tlp.enable = true;
   services.power-profiles-daemon.enable = false;
-  environment.systemPackages = with pkgs; [ powertop acpi ];
+  environment.systemPackages = with pkgs; [ powertop acpi run-offline-backups ];
 
   #services.beesd.filesystems = {
   #  root = {
@@ -159,7 +175,8 @@ in {
   #};
 
   # todo: target and/or archive
-  services.btrbk.instances.btrbk = {
+  services.btrbk.instances = {
+    btrbk = {
       onCalendar = "*:0/30"; # every 30 minutes
       settings = {
         snapshot_preserve = "2d";
@@ -175,6 +192,58 @@ in {
       };
     };
 
+    # doas -u btrbk btrbk -c /etc/btrbk/offline-backups.conf --dry-run --progress --verbose run
+    offline-backups = {
+      onCalendar = null;
+      settings = {
+        ssh_user = "btrbk";
+        ssh_identity = "/etc/btrbk/id_ed25519";
+        backend_remote = "btrfs-progs-doas";
+        volume = {
+
+          "ssh://narwhal:22/mnt/btr_pool" = {
+            subvolume = {
+              backups = { };
+              books = { };
+              certs = { };
+              data = { };
+              docker_volumes = { };
+              home = { };
+              home-data = { };
+              http = { };
+              music = { };
+              secrets = { };
+              transmission = { };
+              videos = { };
+            };
+            target = {
+              "/mnt/backups/0/btr_backup/narwhal" = { };
+              "/mnt/backups/1/btr_backup/narwhal" = { };
+              "/mnt/backups/2/btr_backup/narwhal" = { };
+            };
+          };
+
+          "ssh://suricata:22/mnt/btr_pool" = {
+            compat_remote = "busybox";
+            subvolume = {
+              home = { };
+              rancher_config = { };
+              backups = { };
+              configs = { };
+
+            };
+            target = {
+              "/mnt/backups/0/btr_backup/suricata" = { };
+              "/mnt/backups/1/btr_backup/suricata" = { };
+              "/mnt/backups/2/btr_backup/suricata" = { };
+            };
+          };
+        };
+
+      };
+    };
+  };
+
   services.xserver.deviceSection = ''
     Option "TearFree" "true"
   '';

nixos/common.nix

@@ -300,7 +300,10 @@
         "/etc/ssh/user_ca.pub"
       ];
     };
-    "/mnt/data" = { directories = [ "/etc/luks-keys" ]; };
+    "/mnt/data" = {
+      directories = [ "/etc/luks-keys" ];
+      files = [ "/etc/btrbk/id_ed25519" ];
+    };
     "/mnt/logs" = { directories = [ "/var/log" ]; };
   };