profiles/backup: configure the backup server

It creates the user, ensure sftp is configured correctly, and rsync the
backups to rsync.net once a day.

2 files changed, 1 insertions, 31 deletions

diff --git a/hosts/tahoe/default.nix b/hosts/tahoe/default.nix
index 0f5dec0..ae4bef8 100644
--- a/hosts/tahoe/default.nix
+++ b/hosts/tahoe/default.nix
@@ -1,7 +1,4 @@
 { config, pkgs, hostname, self, ... }:
-let
-  sshPub = builtins.fromTOML (builtins.readFile ../../configs/ssh-pubkeys.toml);
-in
 {
   imports = [
     ./boot.nix
@@ -14,23 +11,12 @@ in
     "${self}/profiles/nginx.nix"
     "${self}/profiles/unifi.nix"
     "${self}/profiles/samba.nix"
+    "${self}/profiles/backup.nix"
     "${self}/profiles/git-server.nix"
     "${self}/profiles/music-server.nix"
     "${self}/profiles/hardware/amd.nix"
   ];
 
-  # a user used only for backups
-  users.users.backup = {
-    createHome = false;
-    uid = 991;
-    isSystemUser = true;
-    group = "users";
-    home = "/data/slow/backups/hosts";
-    openssh.authorizedKeys.keys = with sshPub; [
-      restic
-    ];
-  };
-
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
   # on your system were taken. It‘s perfectly fine and recommended to leave
diff --git a/hosts/tahoe/services.nix b/hosts/tahoe/services.nix
index 058d31c..4b29870 100644
--- a/hosts/tahoe/services.nix
+++ b/hosts/tahoe/services.nix
@@ -38,22 +38,6 @@ in
         ];
       exclude = [ ];
     };
-
-    backup.rsync = {
-      enable = true;
-      timerConfig = { OnCalendar = "00:15"; };
-      sourceDir = "/data/slow/backups/";
-      destination = "de2664@de2664.rsync.net:backups/";
-    };
-
     sendsms.enable = true;
   };
-
-  services.openssh.sftpServerExecutable = "internal-sftp";
-  services.openssh.extraConfig = ''
-    Match User backup
-      ChrootDirectory ${config.users.users.backup.home}
-      ForceCommand internal-sftp
-      AllowTcpForwarding no
-  '';
 }