jory
e0453b0123
- caddy: security headers (X-Content-Type-Options/X-XSS-Protection/ X-Frame-Options) on all vhosts + baseline CSP; strip SnappyMail upstream copies via header_down on mail.severijnse.eu - tlsa-updater: compute TLSA 3 1 1 from cert SPKI (SHA-256), sync _25/_465/_993, fail-safe placeholders; coredns zone updated - pre-commit: wire cachix/git-hooks.nix (alejandra, statix, actionlint, ...); CI pre-commit job over x86_64 + aarch64 matrix - gitea: enable Gitea Actions + self-hosted runner (native:host, aarch64 via binfmt); add .gitea/workflows/ci.yml and local hook - fix statix warnings (merge repeated systemd/database/configFile keys, inherit, bool-compare guards); add missing trailing newlines
42 lines
1.2 KiB
Nix
42 lines
1.2 KiB
Nix
{pkgs, ...}: let
|
|
backupScript = pkgs.writeShellScript "weekly-backup" ''
|
|
BACKUP_DIR="/home/admin/backups"
|
|
SRC="/home/admin"
|
|
DATE=$(date +%Y-%m-%dT%H-%M-%S)
|
|
FILENAME="weekly-backup-$DATE.tar.gz"
|
|
|
|
mkdir -p "$BACKUP_DIR"
|
|
# Backup everything under /home/admin EXCEPT:
|
|
# - The backups dir itself (infinite loop)
|
|
# - DMS mail data (GBs of email, backed up separately)
|
|
# - NixOS-managed service data (at their own paths below)
|
|
tar czf "$BACKUP_DIR/$FILENAME" \
|
|
--exclude="$BACKUP_DIR" \
|
|
--exclude="/home/admin/backups" \
|
|
--exclude="/home/admin/dms/mail-data" \
|
|
--exclude="/home/admin/dms/mail-state" \
|
|
"$SRC"
|
|
|
|
# Prune backups older than 14 days
|
|
find "$BACKUP_DIR" -name "weekly-backup-*" -mtime +14 -delete
|
|
'';
|
|
in {
|
|
systemd.services.weekly-backup = {
|
|
description = "Weekly backup of home directory";
|
|
path = with pkgs; [coreutils gnutar findutils];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
ExecStart = "${backupScript}";
|
|
User = "root";
|
|
};
|
|
};
|
|
|
|
systemd.timers.weekly-backup = {
|
|
wantedBy = ["timers.target"];
|
|
timerConfig = {
|
|
OnCalendar = "Mon *-*-* 03:00:00";
|
|
Persistent = true;
|
|
};
|
|
};
|
|
}
|