rustic-timers

nixos/configurations/mimas.nix

···
   imports = [
     (import ./mimas/paperless.nix inputs)
     (import ./mimas/restic.nix inputs)
+    (import ./mimas/rustic-timers.nix inputs)
     (import ./mimas/vaultwarden.nix inputs)
     ./mimas/gitea.nix
   ];

nixos/configurations/mimas/rustic-timers.nix

···
+_: {
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  mimas_template =
+    # toml
+    ''
+      [repository]
+      repository = "rest:https://restic.mimas.internal.nobbz.dev/mimas"
+      password-file = "${config.sops.secrets.rustic.path}"
+
+      [copy]
+      targets = ["${lib.removeSuffix ".toml" config.sops.templates."mimas_hetzner.toml".path}"]
+    '';
+  mimas_hetzner_template =
+    # toml
+    ''
+      [repository]
+      repository = "opendal:sftp"
+      password-file = "${config.sops.secrets.rustic.path}"
+
+      [repository.options]
+      endpoint = "ssh://${config.sops.placeholder.rustic-user}.your-storagebox.de:23"
+      user = "${config.sops.placeholder.rustic-user}"
+      key = "/root/.ssh/id_ed25519"
+      root = "/home/mimas"
+    '';
+
+  nobbz_template =
+    # toml
+    ''
+      [repository]
+      repository = "rest:https://restic.mimas.internal.nobbz.dev/nobbz"
+      password-file = "${config.sops.secrets.rustic.path}"
+
+      [copy]
+      targets = ["${lib.removeSuffix ".toml" config.sops.templates."nobbz_hetzner.toml".path}"]
+    '';
+
+  nobbz_hetzner_template =
+    # toml
+    ''
+      [repository]
+      repository = "opendal:sftp"
+      password-file ="${config.sops.secrets.rustic.path}"
+
+      [repository.options]
+      endpoint = "ssh://${config.sops.placeholder.rustic-user}.your-storagebox.de:23"
+      user = "${config.sops.placeholder.rustic-user}"
+      key = "/root/.ssh/id_ed25519"
+      root = "/home/nobbz"
+    '';
+
+  schedule = {
+    rustic-mimas-clean = "*-*-* 01:00:00";
+    rustic-nobbz-clean = "*-*-* 01:30:00";
+    rustic-mimas-hetzner-clean = "*-*-* 02:00:00";
+    rustic-nobbz-hetzner-clean = "*-*-* 03:00:00";
+  };
+
+  mkTimer = name: calendar: {
+    "${name}" = {
+      wantedBy = ["timers.target"];
+      timerConfig.onCalendar = calendar;
+    };
+  };
+in {
+  sops.secrets.rustic = {};
+  sops.secrets.rustic-user = {};
+
+  sops.templates."mimas.toml".content = mimas_template;
+  sops.templates."mimas_hetzner.toml".content = mimas_hetzner_template;
+  sops.templates."nobbz.toml".content = nobbz_template;
+  sops.templates."nobbz_hetzner.toml".content = nobbz_hetzner_template;
+
+  systemd.timers = lib.pipe schedule [
+    (lib.mapAttrsToList mkTimer)
+    lib.mkMerge
+  ];
+
+  systemd.services = {
+    rustic-mimas-clean = {
+      path = [pkgs.rustic pkgs.openssh];
+      serviceConfig.Type = "oneshot";
+      script = ''
+        rustic forget -P ${lib.removeSuffix ".toml" config.sops.templates."mimas.toml".path} \
+          --keep-last 4 \
+          --keep-within-hourly 1d \
+          --keep-within-daily 5d \
+          --keep-within-weekly 35d \
+          --keep-within-monthly 100d \
+          --keep-within-yearly 2y
+
+        rustic prune -P ${lib.removeSuffix ".toml" config.sops.templates."mimas.toml".path} \
+          --max-unused=0B \
+          --keep-delete=12h \
+          --max-repack=50GiB
+
+        rustic copy -P ${lib.removeSuffix ".toml" config.sops.templates."mimas.toml".path}
+      '';
+    };
+
+    rustic-nobbz-clean = {
+      path = [pkgs.rustic pkgs.openssh];
+      serviceConfig.Type = "oneshot";
+      script = ''
+        rustic forget -P ${lib.removeSuffix ".toml" config.sops.templates."nobbz.toml".path} \
+          --filter-tags home \
+          --keep-last 4 \
+          --keep-within-hourly 1d \
+          --keep-within-daily 5d \
+          --keep-within-weekly 35d \
+          --keep-within-monthly 100d \
+          --keep-within-yearly 2y
+
+        rustic prune -P ${lib.removeSuffix ".toml" config.sops.templates."nobbz.toml".path} \
+          --max-unused=0B \
+          --keep-delete=12h \
+          --max-repack=50GiB
+
+        rustic copy -P ${lib.removeSuffix ".toml" config.sops.templates."nobbz.toml".path}
+      '';
+    };
+
+    rustic-nobbz-hetzner-clean = {
+      path = [pkgs.rustic pkgs.openssh];
+      serviceConfig.Type = "oneshot";
+      script = ''
+        rustic forget -P ${lib.removeSuffix ".toml" config.sops.templates."nobbz_hetzner.toml".path} \
+          --keep-last 1 \
+          --keep-within-hourly 2h \
+          --keep-within-daily 10d \
+          --keep-within-weekly 65d \
+          --keep-within-monthly 190d \
+          --keep-within-yearly 5y
+
+        rustic prune -P ${lib.removeSuffix ".toml" config.sops.templates."nobbz_hetzner.toml".path} \
+          --max-unused 0B \
+          --max-repack 50GiB \
+          --keep-delete 11h
+      '';
+    };
+
+    rustic-mimas-hetzner-clean = {
+      path = [pkgs.rustic pkgs.openssh];
+      serviceConfig.Type = "oneshot";
+      script = ''
+        rustic forget -P ${lib.removeSuffix ".toml" config.sops.templates."mimas_hetzner.toml".path} \
+          --keep-last 1 \
+          --keep-within-hourly 2h \
+          --keep-within-daily 10d \
+          --keep-within-weekly 65d \
+          --keep-within-monthly 190d \
+          --keep-within-yearly 5y
+
+        rustic prune -P ${lib.removeSuffix ".toml" config.sops.templates."mimas_hetzner.toml".path} \
+          --max-unused 0B \
+          --max-repack 50GiB \
+          --keep-delete 11h
+      '';
+    };
+  };
+}

secrets/mimas/default.yaml

···
 restic: ENC[AES256_GCM,data:XMkh9jvehbD3Zg==,iv:9NdaTuhLR57mv8OaCSyso9cfr8V1iQNuQuWInKyi3bI=,tag:Kz08EadPaIWcytF6ASJssw==,type:str]
 rustic: ENC[AES256_GCM,data:ETWxyvBz3AlXNp0=,iv:MXlQuvTJa2mZuXeiCX/YYpbqKpT1+RE5TNahBrUMM3Y=,tag:Vl7n0JF5M9Q+xZD32G1njQ==,type:str]
+rustic-user: ENC[AES256_GCM,data:2hwYQS4nAA==,iv:y0pbF5axrPRdYRGAmx+kp7jkmSl77R8LQMUKQaiDWak=,tag:8kgcxNtvjmyT9PPc/WjrOg==,type:str]
 traefik: ENC[AES256_GCM,data:kMnWaxpt0fLxJeX3oYLQrnZPS+pq/xjqVINleaCfaiXeMlJ8qno0eHBkx82gjldeObvTO1ENFz5k5EJ0ICbnS0ny6qHxeBAMaNVF3dZ+XmKx7w==,iv:ZL90s3YuBmwafBz7VEwCTr2flnkguUxJgPp9OrnyfGA=,tag:UeyiUtdQwOlyQoHObL+80w==,type:str]
 warden: ENC[AES256_GCM,data:H3So3oZfZ6MBKsjxJNnxk/6UZi6J5D6H5bCMsb1E7rk/r51qYDe+1z2Gq1o0qqwX0k/O4Dxq7wJPaelLO4kE9bxQHvoT1NJQIZolnYF5G/PMqMKWIE4bxq6uLmxNKBmjOkJLo3hBiOHT8MjD/S6rOkUAB6Mn4YRKqcG+EG1Wz0sw1a+6KcNFMqO9xdcwD44MZYrreexOiwVx6UMPSJc/67fvzJ4ms/E3gQEOq6VvCHpxmk4bujo9ucqajfPGK4ewHqkdn4r0vQvrYxXMBkX7AXcL6CHSZ+ht0Hcw0A+m12GuTSHC0g38Avz5klP3FIruzj7oWcjv6XPBYfk=,iv:OauSp63ywmrkENIqBVGVQ99Ozyom0o+DfSqYaL46Ujg=,tag:ZcYkapCUZZE9DDh0PSfZEg==,type:str]
 sops:
···
             N3ZuTHhVdFo0aGZVMXFlaTdsRi9lRUUK+K5CUVCdjtMVegVydoKRIb6kpPnfBiy1
             FxkXAp3a1qU2WqNvXCSO3gtUwYaMG+MPSCWI1gA3oBjGGtTasHyHsQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-08T10:28:45Z"
-    mac: ENC[AES256_GCM,data:NsNWmXnztQSro351VgDgz9OUisNk1zOwa4DSGhAQOURZBRAhumZARB7pzFZC+IAOQrYmjp4zg4GLwPvRqHcYfIDu3fav6QZjfVEY1/5/CLbf3LuCQQaxmpjPhYs/Mm0n+mP1smERnshPIwS3CiKCS9F1ajF7KYBqmi6oDy3JQ+4=,iv:xC5dRxhq3LZT63LD0A6JnfDqFeEzzQmH16Osd86CCDA=,tag:QP7Dp+sdy9jgzl53qPP2Zg==,type:str]
+    lastmodified: "2025-03-08T10:44:25Z"
+    mac: ENC[AES256_GCM,data:iKKmalnJnmm8EkDupTPKmKJydLLYkbAabLy5KJdQfKGvRj6vbJAQHZ3u0Pu2TI0oi5Xv3dtPh7ww04kT0Whe1E97p4t3RPyNCCGNqA8OqQiCPDUn6uqTQwOo1//3xIGFnnRC0VSYrQT0rjebbL96RnWE9XF67TefycxIMHusUXU=,iv:FU6VTW2zkEIlH5P/rr58gmuMnz16TCLP+UtEVkiLueg=,tag:uf7I1GwWxXOT190y8Hddow==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.4