jasmine/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

refactor(borgbackup): implement shared staging with defense-in-depth

Browse source 
Major improvements to borgbackup configuration for better reliability and
maintainability:

**Shared staging directory:**
- Use single /btrfs-subvolumes directory (was /subvolumes-{onsite,offsite})
- Eliminates redundant path suffixes in archive structure
- Archive paths now semantic: /btrfs-subvolumes/srv-forgejo clearly indicates
  BTRFS subvolume content without redundant backup job metadata

**Defense-in-depth protection:**
- Layer 1: Systemd ordering - offsite waits for onsite completion
- Layer 2: Self-healing preHook - auto-cleanup orphaned snapshots from
  crashes/power loss
- Prevents cascading failures from race conditions or abnormal terminations

**Code quality improvements:**
- Extract subvolume lists to reduce duplication (DRY principle)
- Add /* sh */ syntax hints for proper editor highlighting
- Silent operation for consistency with existing hooks
- Improved readability with clearer comments and formatting
- All lines ≤ 100 characters

**Timing:**
- Offsite: *-*-* 00:15:00 (daily at 12:15 AM, waits for onsite)
- Onsite: hourly (unchanged)
This commit is contained in:
♥ Minnie ♥ 2025-10-08 18:46:50 +08:00
parent 37924375a2
commit 15b4851e8e
Signed by: jasmine
GPG key ID: 8563E358D4E8040E
4 changed files with 134 additions and 74 deletions
Download patch file Download diff file Expand all files Collapse all files

49
nixos/fuchsia/services/borgbackup/offsite.nix
View file

@ -10,35 +10,44 @@
# Create staging directory before borg service starts # Create staging directory before borg service starts
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
"d /subvolumes-offsite 0755 root root -" "d /btrfs-subvolumes 0755 root root -"
]; ];
# Wait for onsite backup to complete before starting offsite
systemd.services."borgbackup-job-offsite" = {
after = ["borgbackup-job-onsite.service"];
};
services.borgbackup.jobs."offsite" = { services.borgbackup.jobs."offsite" = {
# Allow writing to staging directory # Allow writing to staging directory
readWritePaths = [ "/subvolumes-offsite" ]; readWritePaths = [ "/btrfs-subvolumes" ];
# Create staging snapshots before backup (independent from onsite) preHook = /* sh */ ''
preHook = '' # Clean up orphaned snapshots from failed runs (crash/power loss)
# Create read-only staging snapshots for home directory [ -d "/btrfs-subvolumes/hm-sajenim" ] && \
${pkgs.btrfs-progs}/bin/btrfs subvolume delete \
"/btrfs-subvolumes/hm-sajenim" 2>/dev/null || true
# Create read-only BTRFS snapshot for backup
${pkgs.btrfs-progs}/bin/btrfs subvolume snapshot -r \ ${pkgs.btrfs-progs}/bin/btrfs subvolume snapshot -r \
"/home/sajenim" "/subvolumes-offsite/hm-sajenim" "/home/sajenim" "/btrfs-subvolumes/hm-sajenim"
''; '';
# Backup explicit home directories and persistent files # Backup explicit home directories and persistent files
paths = [ paths = [
# Home directories (valuable user data only) # Home directories (valuable user data only)
"/subvolumes-offsite/hm-sajenim/Documents" "/btrfs-subvolumes/hm-sajenim/Documents"
"/subvolumes-offsite/hm-sajenim/Pictures" "/btrfs-subvolumes/hm-sajenim/Pictures"
"/subvolumes-offsite/hm-sajenim/Videos" "/btrfs-subvolumes/hm-sajenim/Videos"
"/subvolumes-offsite/hm-sajenim/Music" "/btrfs-subvolumes/hm-sajenim/Music"
"/subvolumes-offsite/hm-sajenim/Downloads" "/btrfs-subvolumes/hm-sajenim/Downloads"
"/subvolumes-offsite/hm-sajenim/Academics" "/btrfs-subvolumes/hm-sajenim/Academics"
"/subvolumes-offsite/hm-sajenim/Notes" "/btrfs-subvolumes/hm-sajenim/Notes"
"/subvolumes-offsite/hm-sajenim/Library" "/btrfs-subvolumes/hm-sajenim/Library"
# Dotfiles (critical user configuration) # Dotfiles (critical user configuration)
"/subvolumes-offsite/hm-sajenim/.ssh" "/btrfs-subvolumes/hm-sajenim/.ssh"
"/subvolumes-offsite/hm-sajenim/.gnupg" "/btrfs-subvolumes/hm-sajenim/.gnupg"
# Persistent files (actual storage location) # Persistent files (actual storage location)
"/persist/etc/machine-id" "/persist/etc/machine-id"
@ -54,10 +63,10 @@
"/persist/etc/NetworkManager/system-connections" "/persist/etc/NetworkManager/system-connections"
]; ];
# Remove staging snapshots after backup completes postHook = /* sh */ ''
postHook = '' # Clean up snapshots after successful backup
${pkgs.btrfs-progs}/bin/btrfs subvolume delete \ ${pkgs.btrfs-progs}/bin/btrfs subvolume delete \
"/subvolumes-offsite/hm-sajenim" "/btrfs-subvolumes/hm-sajenim"
''; '';
# Remote repository configuration # Remote repository configuration
@ -70,7 +79,7 @@
environment.BORG_RSH = "ssh -i /etc/ssh/ssh_host_ed25519_key"; environment.BORG_RSH = "ssh -i /etc/ssh/ssh_host_ed25519_key";
compression = "zstd,9"; compression = "zstd,9";
startAt = "daily"; startAt = "*-*-* 00:15:00"; # Daily at 12:15 AM
# Ensure backup runs on next boot if system was asleep # Ensure backup runs on next boot if system was asleep
persistentTimer = true; persistentTimer = true;

42
nixos/fuchsia/services/borgbackup/onsite.nix
View file

@ -8,35 +8,39 @@ in {
# Create staging directory before borg service starts # Create staging directory before borg service starts
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
"d /subvolumes-onsite 0755 root root -" "d /btrfs-subvolumes 0755 root root -"
]; ];
services.borgbackup.jobs."onsite" = { services.borgbackup.jobs."onsite" = {
# Allow writing to staging directory # Allow writing to staging directory
readWritePaths = [ "/subvolumes-onsite" ]; readWritePaths = [ "/btrfs-subvolumes" ];
# Create staging snapshots before backup (independent from offsite) preHook = /* sh */ ''
preHook = '' # Clean up orphaned snapshots from failed runs (crash/power loss)
# Create read-only staging snapshots for home directory [ -d "/btrfs-subvolumes/hm-sajenim" ] && \
${pkgs.btrfs-progs}/bin/btrfs subvolume delete \
"/btrfs-subvolumes/hm-sajenim" 2>/dev/null || true
# Create read-only BTRFS snapshot for backup
${pkgs.btrfs-progs}/bin/btrfs subvolume snapshot -r \ ${pkgs.btrfs-progs}/bin/btrfs subvolume snapshot -r \
"/home/sajenim" "/subvolumes-onsite/hm-sajenim" "/home/sajenim" "/btrfs-subvolumes/hm-sajenim"
''; '';
# Backup explicit home directories and persistent files # Backup explicit home directories and persistent files
paths = [ paths = [
# Home directories (valuable user data only) # Home directories (valuable user data only)
"/subvolumes-onsite/hm-sajenim/Documents" "/btrfs-subvolumes/hm-sajenim/Documents"
"/subvolumes-onsite/hm-sajenim/Pictures" "/btrfs-subvolumes/hm-sajenim/Pictures"
"/subvolumes-onsite/hm-sajenim/Videos" "/btrfs-subvolumes/hm-sajenim/Videos"
"/subvolumes-onsite/hm-sajenim/Music" "/btrfs-subvolumes/hm-sajenim/Music"
"/subvolumes-onsite/hm-sajenim/Downloads" "/btrfs-subvolumes/hm-sajenim/Downloads"
"/subvolumes-onsite/hm-sajenim/Academics" "/btrfs-subvolumes/hm-sajenim/Academics"
"/subvolumes-onsite/hm-sajenim/Notes" "/btrfs-subvolumes/hm-sajenim/Notes"
"/subvolumes-onsite/hm-sajenim/Library" "/btrfs-subvolumes/hm-sajenim/Library"
# Dotfiles (critical user configuration) # Dotfiles (critical user configuration)
"/subvolumes-onsite/hm-sajenim/.ssh" "/btrfs-subvolumes/hm-sajenim/.ssh"
"/subvolumes-onsite/hm-sajenim/.gnupg" "/btrfs-subvolumes/hm-sajenim/.gnupg"
# Persistent files (actual storage location) # Persistent files (actual storage location)
"/persist/etc/machine-id" "/persist/etc/machine-id"
@ -52,10 +56,10 @@ in {
"/persist/etc/NetworkManager/system-connections" "/persist/etc/NetworkManager/system-connections"
]; ];
# Remove staging snapshots after backup completes postHook = /* sh */ ''
postHook = '' # Clean up snapshots after successful backup
${pkgs.btrfs-progs}/bin/btrfs subvolume delete \ ${pkgs.btrfs-progs}/bin/btrfs subvolume delete \
"/subvolumes-onsite/hm-sajenim" "/btrfs-subvolumes/hm-sajenim"
''; '';
# Onsite repository configuration (backup to viridian over SSH) # Onsite repository configuration (backup to viridian over SSH)

62
nixos/viridian/services/borgbackup/offsite.nix
View file

@ -10,35 +10,53 @@
# Create staging directory before borg service starts # Create staging directory before borg service starts
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
"d /subvolumes-offsite 0755 root root -" "d /btrfs-subvolumes 0755 root root -"
]; ];
# Wait for onsite backup to complete before starting offsite
systemd.services."borgbackup-job-offsite" = {
after = ["borgbackup-job-onsite.service"];
};
services.borgbackup.jobs."offsite" = { services.borgbackup.jobs."offsite" = {
# Allow writing to staging directory # Allow writing to staging directory
readWritePaths = [ "/subvolumes-offsite" ]; readWritePaths = [ "/btrfs-subvolumes" ];
# Create staging snapshots before backup (independent from onsite) preHook = let
preHook = '' subvolumes = [
# Create read-only staging snapshots for each service "srv-containers"
for subvol in srv-containers srv-forgejo srv-lighttpd srv-minecraft srv-opengist; do "srv-forgejo"
# Map subvolume names to actual paths "srv-lighttpd"
"srv-minecraft"
"srv-opengist"
];
in /* sh */ ''
# Clean up orphaned snapshots from failed runs (crash/power loss)
for subvol in ${toString subvolumes}; do
[ -d "/btrfs-subvolumes/$subvol" ] && \
${pkgs.btrfs-progs}/bin/btrfs subvolume delete \
"/btrfs-subvolumes/$subvol" 2>/dev/null || true
done
# Create read-only BTRFS snapshots for backup
for subvol in ${toString subvolumes}; do
case "$subvol" in case "$subvol" in
srv-containers) src="/srv/multimedia/containers" ;; srv-containers) src="/srv/multimedia/containers" ;;
srv-*) src="/srv/''${subvol#srv-}" ;; srv-*) src="/srv/''${subvol#srv-}" ;;
esac esac
${pkgs.btrfs-progs}/bin/btrfs subvolume snapshot -r \ ${pkgs.btrfs-progs}/bin/btrfs subvolume snapshot -r \
"$src" "/subvolumes-offsite/$subvol" "$src" "/btrfs-subvolumes/$subvol"
done done
''; '';
# Backup staging snapshots and explicit persistent files # Backup staging snapshots and explicit persistent files
paths = [ paths = [
"/subvolumes-offsite/srv-containers" "/btrfs-subvolumes/srv-containers"
"/subvolumes-offsite/srv-forgejo" "/btrfs-subvolumes/srv-forgejo"
"/subvolumes-offsite/srv-lighttpd" "/btrfs-subvolumes/srv-lighttpd"
"/subvolumes-offsite/srv-minecraft" "/btrfs-subvolumes/srv-minecraft"
"/subvolumes-offsite/srv-opengist" "/btrfs-subvolumes/srv-opengist"
# Persistent files (actual storage location) # Persistent files (actual storage location)
"/persist/etc/machine-id" "/persist/etc/machine-id"
@ -54,11 +72,19 @@
"/persist/etc/NetworkManager/system-connections" "/persist/etc/NetworkManager/system-connections"
]; ];
# Remove staging snapshots after backup completes postHook = let
postHook = '' subvolumes = [
for subvol in srv-containers srv-forgejo srv-lighttpd srv-minecraft srv-opengist; do "srv-containers"
"srv-forgejo"
"srv-lighttpd"
"srv-minecraft"
"srv-opengist"
];
in /* sh */ ''
# Clean up snapshots after successful backup
for subvol in ${toString subvolumes}; do
${pkgs.btrfs-progs}/bin/btrfs subvolume delete \ ${pkgs.btrfs-progs}/bin/btrfs subvolume delete \
"/subvolumes-offsite/$subvol" "/btrfs-subvolumes/$subvol"
done done
''; '';
@ -72,7 +98,7 @@
environment.BORG_RSH = "ssh -i /etc/ssh/ssh_host_ed25519_key"; environment.BORG_RSH = "ssh -i /etc/ssh/ssh_host_ed25519_key";
compression = "zstd,9"; compression = "zstd,9";
startAt = "daily"; startAt = "*-*-* 00:15:00"; # Daily at 12:15 AM
# Ensure backup runs on next boot if system was asleep # Ensure backup runs on next boot if system was asleep
persistentTimer = true; persistentTimer = true;

55
nixos/viridian/services/borgbackup/onsite.nix
View file

@ -17,35 +17,48 @@ in {
# Create staging directory before borg service starts # Create staging directory before borg service starts
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
"d /subvolumes-onsite 0755 root root -" "d /btrfs-subvolumes 0755 root root -"
]; ];
services.borgbackup.jobs."onsite" = { services.borgbackup.jobs."onsite" = {
# Allow writing to staging directory # Allow writing to staging directory
readWritePaths = [ "/subvolumes-onsite" ]; readWritePaths = [ "/btrfs-subvolumes" ];
# Create staging snapshots before backup (independent from offsite) preHook = let
preHook = '' subvolumes = [
# Create read-only staging snapshots for each service "srv-containers"
for subvol in srv-containers srv-forgejo srv-lighttpd srv-minecraft srv-opengist; do "srv-forgejo"
# Map subvolume names to actual paths "srv-lighttpd"
"srv-minecraft"
"srv-opengist"
];
in /* sh */ ''
# Clean up orphaned snapshots from failed runs (crash/power loss)
for subvol in ${toString subvolumes}; do
[ -d "/btrfs-subvolumes/$subvol" ] && \
${pkgs.btrfs-progs}/bin/btrfs subvolume delete \
"/btrfs-subvolumes/$subvol" 2>/dev/null || true
done
# Create read-only BTRFS snapshots for backup
for subvol in ${toString subvolumes}; do
case "$subvol" in case "$subvol" in
srv-containers) src="/srv/multimedia/containers" ;; srv-containers) src="/srv/multimedia/containers" ;;
srv-*) src="/srv/''${subvol#srv-}" ;; srv-*) src="/srv/''${subvol#srv-}" ;;
esac esac
${pkgs.btrfs-progs}/bin/btrfs subvolume snapshot -r \ ${pkgs.btrfs-progs}/bin/btrfs subvolume snapshot -r \
"$src" "/subvolumes-onsite/$subvol" "$src" "/btrfs-subvolumes/$subvol"
done done
''; '';
# Backup staging snapshots and explicit persistent files # Backup staging snapshots and explicit persistent files
paths = [ paths = [
"/subvolumes-onsite/srv-containers" "/btrfs-subvolumes/srv-containers"
"/subvolumes-onsite/srv-forgejo" "/btrfs-subvolumes/srv-forgejo"
"/subvolumes-onsite/srv-lighttpd" "/btrfs-subvolumes/srv-lighttpd"
"/subvolumes-onsite/srv-minecraft" "/btrfs-subvolumes/srv-minecraft"
"/subvolumes-onsite/srv-opengist" "/btrfs-subvolumes/srv-opengist"
# Persistent files (actual storage location) # Persistent files (actual storage location)
"/persist/etc/machine-id" "/persist/etc/machine-id"
@ -61,11 +74,19 @@ in {
"/persist/etc/NetworkManager/system-connections" "/persist/etc/NetworkManager/system-connections"
]; ];
# Remove staging snapshots after backup completes postHook = let
postHook = '' subvolumes = [
for subvol in srv-containers srv-forgejo srv-lighttpd srv-minecraft srv-opengist; do "srv-containers"
"srv-forgejo"
"srv-lighttpd"
"srv-minecraft"
"srv-opengist"
];
in /* sh */ ''
# Clean up snapshots after successful backup
for subvol in ${toString subvolumes}; do
${pkgs.btrfs-progs}/bin/btrfs subvolume delete \ ${pkgs.btrfs-progs}/bin/btrfs subvolume delete \
"/subvolumes-onsite/$subvol" "/btrfs-subvolumes/$subvol"
done done
''; '';