blogs: add backup

.sops.yaml

@@ -75,6 +75,7 @@ creation_rules:
     key_groups:
     - pgp: *admins
       age:
+      - *blogs
       - *buzzrelay
       - *drone
       - *gitea

hosts/blogs/default.nix

@@ -6,10 +6,20 @@
 
   networking.hostName = "blogs";
 
-  # See secrets/hosts/blogs for the .env file with all settings
-  services.plume = {
-    enable = true;
-    envFile = config.sops.secrets."plume/env".path;
+  services = {
+    nginx = {
+      enable = true;
+      virtualHosts."blogs.c3d2.de" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/".proxyPass = "http://localhost:7878";
+      };
+    };
+    plume = {
+      enable = true;
+      # See secrets/hosts/blogs for the .env file with all settings
+      envFile = config.sops.secrets."plume/env".path;
+    };
   };
 
   sops = {
@@ -17,15 +27,8 @@
     defaultSopsFile = ./secrets.yaml;
     secrets = {
       "plume/env".owner = config.systemd.services.plume.serviceConfig.User;
-    };
-  };
-
-  services.nginx = {
-    enable = true;
-    virtualHosts."blogs.c3d2.de" = {
-      forceSSL = true;
-      enableACME = true;
-      locations."/".proxyPass = "http://localhost:7878";
+      "restic/password".owner = "root";
+      "restic/repository/server8".owner = "root";
     };
   };
 

hosts/blogs/secrets.yaml

@@ -1,5 +1,9 @@
 plume:
     env: ENC[AES256_GCM,data:V7pEExE5jGT7JSCejzo1m0QlMgpKuaF5CnHvR7LCvTJSgoCeeNW9ImtVk8MtqtoRngH45jgseuC5wZNzXSMG/ltQ4c3ThDcxKP5ngLmEZ3tOqSlIdV/A3S4ww4f/UAx8YpNY4c/LlL9NuCcfpHyC4zwRFrD6odCSk7BUT0BU+zxOBDpQDAHscBz+YYTbb3cJ7iGYg1fXS6wLJHutf0eXYF5VNcc80SISEfbR+bs9t2f7Dg==,iv:3n+EDT9TO5VxCS6rXZiNKpxtCWeCDi6YT3dQsrECNmU=,tag:ysWwxhR1JNJ7WUM28TIQig==,type:str]
+restic:
+    password: ENC[AES256_GCM,data:5SUmmFclsGFskWM1E0qOQN0TDB7sllEBnDFslUHTqZs=,iv:WoWtaR4byoRjnZaakBhZYHfzBFKrJ1g3ylWj6Vkom2Y=,tag:0M+MXU8Xe3Ig50rmaqwzjA==,type:str]
+    repository:
+        server8: ENC[AES256_GCM,data:rhZ8jaqrsZ8caom64m32D8O8qgr4KXJwzm8q8+UlcpXdMfcXVlzNkTW+Lq5D/nXJ6KUoBV4zeYNwzLgbjPd2xTJYAlUbGC039Fd8ZI19v+PZsypMAtbf4PpYQPwy1LtJ,iv:QkX5Iy7iB9yRj9YI6I1YHNXmdhF0FaUYJTOAXgJc8II=,tag:EanCBxAJQ0jH17tMkCo1kA==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -24,8 +28,8 @@ sops:
             andNczl4SzJaeDNpQ1dhNm1PcUc0eTQKR/hEIrWWsixnW5HGb4D0Hg6RTA22NBqq
             2QeYsLP2QALu/+y+ljewr9K2nYOb70NOrx5FKD3cAgtq8871Lf59fQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2021-12-25T00:52:22Z"
-    mac: ENC[AES256_GCM,data:g6rMFoNx35MN495v1jKB13isssJ3GbKqyI7PdA796leFuRVgAlj6aUBI99vX+SpA1LpBYkUOu6OeV1EOHtpKlchbS4/FnO5oM0AOpoNux9yjQbeC3CM6soUzHn2+cJrnGMlgPC0sX0kcHVTFKF1aJsa+uLlkKD+F1SSJboz+P7c=,iv:i5I8FDU+j7l5UxgurA3Me2b/4zE7W1Ck3ckmQPqKWrM=,tag:gZCL8bo1YVoLZlxjyTupzw==,type:str]
+    lastmodified: "2023-06-05T19:00:16Z"
+    mac: ENC[AES256_GCM,data:irZqZZ3wz8N1JUcX7GSM2FTdLlek49fvF2Uh6SJiwkMTizsKBhBF3RzD8nN2eh0fFkMuK5kjc24S1GRQwfPY/mBOEXfKXUn+3RRAE99UgUfgPFc+IEMH70AOl8mrsfOUXzVmkW2gDmxL900eyMIJIjWTgKd1B/jsUDiEwSeSpU4=,iv:eziRYdbRlwD809J22CmHU462es9MD/O1z6rFBB2wNrI=,tag:3+D4ngcpbZcL50Mfq7S8qA==,type:str]
     pgp:
         - created_at: "2022-12-26T19:09:33Z"
           enc: |
@@ -200,4 +204,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C
     unencrypted_suffix: _unencrypted
-    version: 3.7.1
+    version: 3.7.3