From a1a579662ec0d6a8987a421d6e2af4dde9170542 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 7 Feb 2026 21:49:49 +0100 Subject: [PATCH 01/25] Update the database configuration to the current architecture. --- .sops.yaml | 7 +- .../configuration.nix | 1 + .../modules/desktop-manager/gnome.nix | 44 +++++++- ...sops-nix.nix => sops-composesongsheet.nix} | 0 .../modules/secrets-config/sops-database.nix | 28 +++++ .../modules/system/compose-songsheet.nix | 2 +- .../modules/system/database.nix | 100 ++++++++++++++++++ .../secrets/database/gcloud_bucket.json | 29 +++++ 8 files changed, 208 insertions(+), 3 deletions(-) rename nix-system-configs/{database => database-deprecated}/configuration.nix (99%) rename nix-system-configs/modules/secrets-config/{sops-nix.nix => sops-composesongsheet.nix} (100%) create mode 100644 nix-system-configs/modules/secrets-config/sops-database.nix create mode 100644 nix-system-configs/modules/system/database.nix create mode 100644 nix-system-configs/secrets/database/gcloud_bucket.json diff --git a/.sops.yaml b/.sops.yaml index 6c76b15..daa279c 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -12,4 +12,9 @@ creation_rules: key_groups: - age: - *admin_christine - - *server_traefik \ No newline at end of file + - *server_traefik + - path_regex: nix-system-configs/secrets/database/[^/]+\.(yaml|json|env|ini)$ + key_groups: + - age: + - *admin_christine + - *server_traefik diff --git a/nix-system-configs/database/configuration.nix b/nix-system-configs/database-deprecated/configuration.nix similarity index 99% rename from nix-system-configs/database/configuration.nix rename to nix-system-configs/database-deprecated/configuration.nix index 2332e32..63c377a 100644 --- a/nix-system-configs/database/configuration.nix +++ b/nix-system-configs/database-deprecated/configuration.nix @@ -120,6 +120,7 @@ fastfetch hyfetch pgadmin4 + google-cloud-sdk ]; # Some programs need SUID wrappers, can be configured further or are diff --git a/nix-system-configs/modules/desktop-manager/gnome.nix b/nix-system-configs/modules/desktop-manager/gnome.nix index eb95e04..2995aa5 100644 --- a/nix-system-configs/modules/desktop-manager/gnome.nix +++ b/nix-system-configs/modules/desktop-manager/gnome.nix @@ -4,7 +4,49 @@ lib, ... }: { + # Enable the X11 windowing system. services.xserver.enable = true; + + # Enable the GNOME Desktop Environment. services.xserver.displayManager.gdm.enable = true; - services.xserver.desktopManager.gnome3.enable = true; + services.xserver.desktopManager.gnome.enable = true; + + # Configure keymap in X11 + services.xserver.xkb = { + layout = "us"; + variant = ""; + }; + + # Enable CUPS to print documents. + services.printing.enable = true; + + # Enable sound with pipewire. + services.pulseaudio.enable = false; + security.rtkit.enable = true; + services.pipewire = { + enable = true; + alsa.enable = true; + alsa.support32Bit = true; + pulse.enable = true; + # If you want to use JACK applications, uncomment this + #jack.enable = true; + + # use the example session manager (no others are packaged yet so this is enabled by default, + # no need to redefine it in your config for now) + #media-session.enable = true; + }; + + # Install firefox. + programs.firefox.enable = true; + + # Allow unfree packages + nixpkgs.config.allowUnfree = true; + + # Some programs need SUID wrappers, can be configured further or are + # started in user sessions. + programs.mtr.enable = true; + programs.gnupg.agent = { + enable = true; + enableSSHSupport = true; + }; } diff --git a/nix-system-configs/modules/secrets-config/sops-nix.nix b/nix-system-configs/modules/secrets-config/sops-composesongsheet.nix similarity index 100% rename from nix-system-configs/modules/secrets-config/sops-nix.nix rename to nix-system-configs/modules/secrets-config/sops-composesongsheet.nix diff --git a/nix-system-configs/modules/secrets-config/sops-database.nix b/nix-system-configs/modules/secrets-config/sops-database.nix new file mode 100644 index 0000000..2d1b4b3 --- /dev/null +++ b/nix-system-configs/modules/secrets-config/sops-database.nix @@ -0,0 +1,28 @@ +{ + config, + pkgs, + lib, + ... +}: { + imports = let + # replace this with an actual commit id or tag + commit = "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c"; + in [ + "${builtins.fetchTarball { + url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz"; + # replace this with an actual hash + sha256 = "ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY="; + }}/modules/sops" + ]; + + # This will add secrets.yml to the nix store + # You can avoid this by adding a string to the full path instead, i.e. + # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml"; + sops.defaultSopsFile = ../../secrets/songsheet/secrets.yaml; + # This will automatically import SSH keys as age keys + sops.age.sshKeyPaths = ["/home/songsheetprg/.ssh/id_ed25519.pub"]; + # This is using an age key that is expected to already be in the filesystem + sops.age.keyFile = "/var/lib/sops-nix/key.txt"; + # This will generate a new key if the key specified above does not exist + sops.age.generateKey = true; +} diff --git a/nix-system-configs/modules/system/compose-songsheet.nix b/nix-system-configs/modules/system/compose-songsheet.nix index 928ecff..2a83324 100644 --- a/nix-system-configs/modules/system/compose-songsheet.nix +++ b/nix-system-configs/modules/system/compose-songsheet.nix @@ -38,7 +38,7 @@ # ## Compose modules for Portainer service ./modules/songsheet/wavelog/docker-compose.nix - ./modules/secrets-config/sops-nix.nix + ./modules/secrets-config/sops-composesongsheet.nix ]; config = { diff --git a/nix-system-configs/modules/system/database.nix b/nix-system-configs/modules/system/database.nix new file mode 100644 index 0000000..2041188 --- /dev/null +++ b/nix-system-configs/modules/system/database.nix @@ -0,0 +1,100 @@ +{ + config, + pkgs, + lib, + ... +}: { + options.local = { + hostname = lib.mkOption { + type = lib.types.str; + default = "nixos-default"; + description = "System hostname"; + }; + username = lib.mkOption { + type = lib.types.str; + default = "user"; + description = "Primary user username"; + }; + userDescription = lib.mkOption { + type = lib.types.str; + default = "NixOS User"; + description = "Primary user description"; + }; + address = lib.mkOption { + type = lib.types.str; + default = "10.1.1.100"; + description = "Static IP address"; + }; + }; + + imports = [ + ./modules/desktop-manager/gnome.nix + ./modules/local/hostname_username.nix + ./modules/local/networking_local.nix + ./modules/lix-default.nix + ./modules/secrets-config/sops-database.nix + ./hardware-configuration.nix + ]; + + # Bootloader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + config = { + local.hostname = "nixosdd"; + local.username = "nixosdd"; + local.userDescription = "NixOS Dedicated Database"; + local.address = "10.1.1.251"; + + networking.firewall.allowedTCPPorts = [ + 5432 # PostgreSQL + 3306 # MariaDB/MySQL + ]; + networking.firewall.allowedUDPPorts = [ + 5432 # PostgreSQL + 3306 # MariaDB/MySQL + ]; + + # List services that you want to enable: + + # Enable PostgreSQL + services.postgresql = { + enable = true; + enableTCPIP = true; + ensureDatabases = ["forgejo" "part_db_database"]; + settings = { + listen_addresses = "*"; + }; + authentication = pkgs.lib.mkOverride 10 '' + local all all trust + host all all 10.1.1.4/32 scram-sha-256 + host all all 10.1.1.249/32 scram-sha-256 + host all all 127.0.0.1/32 trust + host all all ::1/128 trust + ''; + }; + + # Enable MariaDB + services.mysql = { + enable = true; + package = pkgs.mariadb; + }; + + # Enable Tailscale + services.tailscale.enable = true; + + # List packages installed in system profile. To search, run: + # $ nix search wget + environment.systemPackages = with pkgs; [ + # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default. + wget + helix + fastfetch + hyfetch + pgadmin4 + google-cloud-sdk + ]; + + system.stateVersion = "25.11"; + }; +} diff --git a/nix-system-configs/secrets/database/gcloud_bucket.json b/nix-system-configs/secrets/database/gcloud_bucket.json new file mode 100644 index 0000000..4ce4f60 --- /dev/null +++ b/nix-system-configs/secrets/database/gcloud_bucket.json @@ -0,0 +1,29 @@ +{ + "type": "ENC[AES256_GCM,data:bl74l+sY5V4qeLYBANRU,iv:uKOGWFTF6ltq3mQ4ojd1/bZgofPi1J4Gtz3/PUCfLLs=,tag:TxGwCf5qCDPVfIMzFgB01w==,type:str]", + "project_id": "ENC[AES256_GCM,data:6cW8StwOvkdGXIjuI5Jj8DuCoE/9z0ky7tEWMIbg,iv:bAyX1+phAdiMRVZNRwDGE+QkbFo71u+Gut+z+yPQjg8=,tag:9JuGbq13tBUJUb/tUWolbQ==,type:str]", + "private_key_id": "ENC[AES256_GCM,data:j9xf5MtzNTn7OV2PNWXPPSqSLU4elVLjF1MB6xmlFXSy6XXJEbz/uA==,iv:iVCTbjtVHGEsvKtBHnrwiI3MPgGKGQlyEv9zAMcQ7sE=,tag:VzsIQHMjBvrIl9X5Ul2j+Q==,type:str]", + "private_key": "ENC[AES256_GCM,data:X5HOWhmdI/J9TqQ9bVcplgeFXtZSk3m4+9duXzc38IZ+e8E2gBISq/bfQ8HGzK7r54c85aCNFiYYbzkNHRh+newlNSBCHhmfHc0Ko7OLQS3+wcEX6Z+D2llMJxKAFAXGh63L6gWdYCAgTgpL8OlKv4sW1V4yH2N+Ei+iiYcHfc6g/xDRky3PxBNQcoA2qTzfBpZ8lDRMFLQQDeKeGmiC8m5o0RPdiSdA9oDc4IMkWPPEidCTu4hUn4YLr3Yz5NMEFqMqaiVq4G9FsS3fVZdk4HSdFHNlse6apkIQDTUWkQhjSwktl4ul2jimgKBxa2aNcHmKZcxnoSgF1wg37P6b+RNAsUx5OgpqLmXoaSC9+5PHMkvUrnwp0kwMLqmtXhUDtJcA1zRGaWgI7jXXcHlvXMxtod+GdGygMsNNMPoNqAacT7OZ3Fc3TqoBERd2yvORbKQmKuXSOslFsWa17toqo42tUEZReXbnQkvHe9ZQKUAaPvjVX9pQzraR8tj2ReLsO/8L9gluRv5j9NSt1DnzBZyggRUj5trE81fJ6joiNCHQmcJyagInDeDXGZVmzPtXofOwjR8U8+fVbnxpp7ji7HLjFVtecxF2DteihTJ8SqsjQMpWwV5E241AK0N4gnnGi2QmvWpq+x83Xceu6zwNgTVnnyR7mWgOuYKnzeez9a9ozRPDkf2EvCxaTzyAzzXLem+Ui9m6hJ0IO3bZERvLZzCP0yykE7BhbF9LDwVfc6TSr2bCgdIy07DCI5ccNm8nqdtE1m/xqQRQ3uNrRkLzJOFUUXSfDwmE+dFPxbL1x5Bmqac+jvH8Coj10l1rdAExyOLNyIFJG4ZmmxVIsf0CnYc87ezZmF8nLcL/rLjg6lngAlqQo2KE8H2omAfFNDCAiqQGqLuqi6DBQS12K08Aqk9tN7zrmB5sRCzVDpo0SmCSS5VvPduaSk1TWAIH5Z1gHMU1cdz++3hyMZvvG9b7hiRFQoFBPHZnDyKta427X7ccsLM2OCIEI7Tb3T0zO6IK8/WrZolAqwxzJv4kJJUQan0lhASFC7koUEJ+1W6yycaLXeibNlzllP6Rc5ovp8QOuOgUNdR5dvEeVkAXqII49qvP/zr9N6aMGgFXNCZNKJq/nUSFAlOoawoJwWKowgDy2nmA/a9jamDT4cSxguOKa6JIBfT3aqZw7hVvMoqVzp47HI6FimEPxKPSJHbM3skEYEi3aLoDGPoG/NlT+uZ1ojqV0P0w0ESxb69RCnF8alvIIVZSMyC3YTbEfjdaOSl+UYvgkeWttujJ0z/utDOG2xe7fIkyI264tE91iebh2shHXri2I0vofL60DJBttYZ97cM26DzJTtOo6P30ilG5K0HRHc8K1O/yLZJroSjQXZM8O1Mk3b8cSYvjcbboOKCxPIxdqQpI3+AYHUvge4jqZHot+wOjIo+GKFDhxcTopkwJbKfayNAzQkac5DIBDmZWK5baNG9tG03NZGaRvP31mlmfBElr2s3EGbj3j4V7++rv+4mzleCH/oSGBob+crFbrq/QVU9zPtOKzKz5tQvb2BRlRE30hOkmq2cQfT3M2kS0fVjxBgCeFFPzMnXBs9kbg73zJZXLO3f7EhrmT9CbZjcW18D4ptqD6MZeojGn6+7D/JnccsVB4dYJg8MWDEDnHmCnL12gGQEWPwkZEchENginl28P3ZPTQwnFje+hnKWwCMa4TdqgD89bKksEuOP9PPe+3yGgjXWDj7E862bvCXVi1sHrHexkrcC1B+kdcnFGbsra/2K48+aWUED0405V7OqCYOygFLg7e1/oMN39PfDuX51A39Fi+/4sX6JCMRjG1/2EbKowcbNYnNjC7SWjYNWc062jA0PMYlhE4Tf8+1cdliAmuD+A6JyhcNZj2ulyBSqkR3tTV6UrnrWkaT+25ywWSkBiBkPWFt8sB0VOqZN4F6aBVrsjIFjZrx/GWDNXPpMiaEIokzlPLCvJ9XeKq6cWB/W3tAqog6GWorJcjsLi+glVjUvskDlLslj3Vd4eqnAjbktBIknzEv23557ghQMYpxIBFw3dqewz+Z6p+XoVsY73t84llbtT+PhhL/FdZJIlQ8iPnEdZTKfeTCcOQsbn1KXmEF1L9sdibCxi4qWdBkclnuH8VUpQto+2TDyQ2whJPASiiqNSV5W/QPDUjcR9AtEpRYXKmuXMts0M4X9sg6yLVq4QOe6rOPCPelxOC52I+FuVCOsoRQ8FGjFmhNQX2TN4UzJU9O0docpO0ubWuUCcoKr2,iv:KMBWDjUNBEGOEadSCzajAhaRgZy0x6ZJ53dQV4WsxuI=,tag:cqPBsxqiNlOWE5sv3gS2Qw==,type:str]", + "client_email": "ENC[AES256_GCM,data:5GS7lQmxfEhIiqLEOZQElCyL7mnrCPpWhBC5b9GsefHRu8MIZdiU/J5Kl2tAK7iGKlPVcoblYuwjg9jAxwq2Mwp6GBiVJ8pC80xwiC4g7w==,iv:bE4BhJTvprgW5NOJMspvEY43w0DB3B59dPP/iI7+9U8=,tag:tDEQXWClCHrE9zUbXbWVMA==,type:str]", + "client_id": "ENC[AES256_GCM,data:smvsjKHs4FZ545bbNnsKLyxklwJG,iv:UdbOhgdUkwLUF9BXpVZhs6bshCT/w2GsUBx8TA6IJYA=,tag:UgvsYx4bVUiLX/ivSn4V/g==,type:str]", + "auth_uri": "ENC[AES256_GCM,data:MoSyAWIMF31wGC1Th9lBVdxNUcKI9ChFQQ/9NcOpawZBKCWRpvUPPRk=,iv:0M/ckQguvifJswhl6fRZoLFDLotL4pqVWtgCJnneuvg=,tag:jg9yVdYsa3SzU15QodJSCg==,type:str]", + "token_uri": "ENC[AES256_GCM,data:VU6Jz5gmDMkRk8xVXz/GmBKqAU8LXWDWDd8wDG2LAgvYCf8=,iv:PsKBpoHzDJsrQgagYgSmDGfy/hi68PiDO5Cp1840gIE=,tag:4PnonD0ZhEb0ubshGY8wgQ==,type:str]", + "auth_provider_x509_cert_url": "ENC[AES256_GCM,data:DUe6H/PflOHgZ8V25EzCqtpIHiMHCI6xmfEmOQOOJTxBgKYm+PRDxIDD,iv:hNAgapcSmqKuGYNS0Ru/OAVR7DIGV73TOdGZVwBgF1w=,tag:texXV9bYMsev8oZT/Zs0LQ==,type:str]", + "client_x509_cert_url": "ENC[AES256_GCM,data:8Herex6V+OajFPQHlSlEFWyY9UHZ1O59Uk6DhU/YN99Uapo2D0WkE9OBDRwI/CFbPWEg6i7yUHVTTCw132kC7tB+QeqX1GHLYedV3AE4QyRzHlQPSsLkxMFr/q283IAu5Evm4WtQdZYQcqF8+olqd9veQuxMpnfWzz9hD4PpV6djur8=,iv:wloNQK6DSXCk4x5p6Clyi90GXYBHkhgTcJ2HJdz5b48=,tag:coYQsiCRE2IakoWz4P5dOw==,type:str]", + "universe_domain": "ENC[AES256_GCM,data:Juy31OVAEIAvPDV1fow=,iv:GKLpORARKRm7Hm14/H44RdAcnQYIyqi6e+UWaG9KjlI=,tag:saBZsuMBlTSEcVoFbnoLNQ==,type:str]", + "sops": { + "age": [ + { + "recipient": "age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIeTFMQlBOS1kyNjJkYito\nZG9XQ3NJSmJxNk1pZDF2T3FoOUU5SEhqYmw0CmN4VnE5cWR3Tm1kdkZnWEZJcHha\nejBNODZkOXFnckRFdTVwdFJwTUVWaDgKLS0tIGRCY2VaS2RMcjQ4clZRbG52ZGdI\nQXdZZ3hBcktmMUlhNDV4TGVaT2c0UEkKH9e+rTKrRt9JqYG+RkFrlcaNXd8zn+0/\no65SOKlwMC0VAAb7rDDU0xGmahW2/bWErW2qJ/88dvDuqdX2sD28Pg==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1rdcs8y4fjfyagwt2q9599ax329thceersh6dg2f0p6nsghm5xufq00qu0p", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5ZTI4dUQxdExvTjA1UDJj\nMUtFZ1F4SzZzVGhXTjJQYkRQaVlyUEZsaTFVCjdtc01Ydk9lMWd2cnVrbTAzeERN\nbG1XcTYzU1RPRXRYcFlzK3RJQzJUV2MKLS0tIEJETzZKaHZENTdrbUVTYWIxNmhB\ndWhvNEJpNVQvcG9lam1lbkV1dGxpMDAK9OspZrLOshe7JLROJvJ9dkzejkSRixyJ\nzD0IbFv3N+HIC3DeStDzCUnRdLmrM/q4HOYCPNCmAtT9jvOrD96ejw==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2026-02-07T20:01:07Z", + "mac": "ENC[AES256_GCM,data:fjKrLuYFXZhHa2KwyWTmDiEyZInyJluI4QjevW2liWKyv7rtJbwzxlzUEb4hUG3pwFFOWeeNwAvIg+la+0Y+sERIEM5P5j60buia2cQZFTK6WvNwLsNN+/sDptznGfrUsI3GJOBtIQgdCCBrrDwj7YARP+T6kk0wh7iw6LgfuWY=,iv:Psy2bv2w9J4OXNH8MESCZD1zSCWDRKlmaOijgyKyorc=,tag:QpiPUT9WMzQQLUVTwtfWjw==,type:str]", + "unencrypted_suffix": "_unencrypted", + "version": "3.11.0" + } +} From 458d0d865a3dd6f97a7479ce594c88e924c17125 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 7 Feb 2026 21:51:29 +0100 Subject: [PATCH 02/25] Copy paste typo --- nix-system-configs/modules/system/database.nix | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/nix-system-configs/modules/system/database.nix b/nix-system-configs/modules/system/database.nix index 2041188..c328c8a 100644 --- a/nix-system-configs/modules/system/database.nix +++ b/nix-system-configs/modules/system/database.nix @@ -36,10 +36,6 @@ ./hardware-configuration.nix ]; - # Bootloader. - boot.loader.systemd-boot.enable = true; - boot.loader.efi.canTouchEfiVariables = true; - config = { local.hostname = "nixosdd"; local.username = "nixosdd"; @@ -55,7 +51,9 @@ 3306 # MariaDB/MySQL ]; - # List services that you want to enable: + # Bootloader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; # Enable PostgreSQL services.postgresql = { From 20e27f799c4d202c43f7359f2fcaa003e3cdea2b Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 7 Feb 2026 22:56:51 +0100 Subject: [PATCH 03/25] Implented Google Cloud Backups of the databases, and also encrypying them before being pushed to cloud. Let us hope that I didn't heck it up. --- .sops.yaml | 5 +- .../modules/secrets-config/sops-database.nix | 15 +++ .../modules/system/database.nix | 1 + .../modules/system_scripts/backup_mariadb.zsh | 23 ++++ .../system_scripts/backup_postgresql.zsh | 24 ++++ .../modules/system_scripts/gcloud_backup.nix | 122 ++++++++++++++++++ .../secrets/database/gcloud_bucket.json | 10 +- 7 files changed, 193 insertions(+), 7 deletions(-) create mode 100644 nix-system-configs/modules/system_scripts/backup_mariadb.zsh create mode 100644 nix-system-configs/modules/system_scripts/backup_postgresql.zsh create mode 100644 nix-system-configs/modules/system_scripts/gcloud_backup.nix diff --git a/.sops.yaml b/.sops.yaml index daa279c..7733a9d 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -2,6 +2,7 @@ keys: - &admin_christine age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m - &server_songsheet age1la8yjuc2ws9pyx70rc83jd2084v5e08v8fvh6muvfzrl2ulp8fms6frs86 - &server_traefik age1rdcs8y4fjfyagwt2q9599ax329thceersh6dg2f0p6nsghm5xufq00qu0p + - &server_database age1k9ddvzypz986a7dt403ja6evql2agz0gehll79mx64zceteya38smxph8m creation_rules: - path_regex: nix-system-configs/secrets/songsheet/[^/]+\.(yaml|json|env|ini)$ key_groups: @@ -16,5 +17,5 @@ creation_rules: - path_regex: nix-system-configs/secrets/database/[^/]+\.(yaml|json|env|ini)$ key_groups: - age: - - *admin_christine - - *server_traefik + - *admin_christine + - *server_database diff --git a/nix-system-configs/modules/secrets-config/sops-database.nix b/nix-system-configs/modules/secrets-config/sops-database.nix index 2d1b4b3..1a1da83 100644 --- a/nix-system-configs/modules/secrets-config/sops-database.nix +++ b/nix-system-configs/modules/secrets-config/sops-database.nix @@ -25,4 +25,19 @@ sops.age.keyFile = "/var/lib/sops-nix/key.txt"; # This will generate a new key if the key specified above does not exist sops.age.generateKey = true; + # Secrets key stuff + sops.secrets."backup_gpg_key" = { + format = "yaml"; + sopsFile = ../../secrets/database/secrets.yaml; + owner = "root"; + mode = "0400"; + }; + + # Declare the GCS service account secret + sops.secrets."gcloud_bucket" = { + format = "json"; + sopsFile = ../../secrets/database/gcloud_bucket.json; + owner = "root"; + mode = "0400"; + }; } diff --git a/nix-system-configs/modules/system/database.nix b/nix-system-configs/modules/system/database.nix index c328c8a..ce65c9d 100644 --- a/nix-system-configs/modules/system/database.nix +++ b/nix-system-configs/modules/system/database.nix @@ -33,6 +33,7 @@ ./modules/local/networking_local.nix ./modules/lix-default.nix ./modules/secrets-config/sops-database.nix + ./modules/database/gcs-backups.nix ./hardware-configuration.nix ]; diff --git a/nix-system-configs/modules/system_scripts/backup_mariadb.zsh b/nix-system-configs/modules/system_scripts/backup_mariadb.zsh new file mode 100644 index 0000000..1d500f5 --- /dev/null +++ b/nix-system-configs/modules/system_scripts/backup_mariadb.zsh @@ -0,0 +1,23 @@ +#!/usr/bin/env bash +set -euo pipefail + +TIMESTAMP=$(date +%Y%m%d%H%M%S) +BACKUP_DIR=$(mktemp -d) +trap 'rm -rf "$BACKUP_DIR"' EXIT + +gpg --batch --import "${GPG_KEY_FILE}" + +DATABASES=$(mysql -u root -e "SHOW DATABASES;" | grep -Ev "^(Database|information_schema|performance_schema|mysql|sys)$") + +for DB in $DATABASES; do + echo "Backing up MariaDB database: $DB" + + FILENAME="mariadb_${DB}_${TIMESTAMP}.sql.gz.gpg" + if mysqldump -u root "$DB" | gzip | gpg --batch --encrypt --recipient "${GPG_RECIPIENT}" > "$BACKUP_DIR/$FILENAME"; then + gsutil cp "$BACKUP_DIR/$FILENAME" "gs://${GCS_BUCKET}/mariadb/$FILENAME" + echo "Successfully uploaded encrypted $FILENAME" + else + echo "Failed to backup $DB" >&2 + exit 1 + fi +done diff --git a/nix-system-configs/modules/system_scripts/backup_postgresql.zsh b/nix-system-configs/modules/system_scripts/backup_postgresql.zsh new file mode 100644 index 0000000..53e4e68 --- /dev/null +++ b/nix-system-configs/modules/system_scripts/backup_postgresql.zsh @@ -0,0 +1,24 @@ +#!/usr/bin/env bash +set -euo pipefail + +TIMESTAMP=$(date +%Y%m%d%H%M%S) +BACKUP_DIR=$(mktemp -d) +trap 'rm -rf "$BACKUP_DIR"' EXIT + +# Import GPG key for encryption +gpg --batch --import "${GPG_KEY_FILE}" + +DATABASES=$(psql -U postgres -t -c "SELECT datname FROM pg_database WHERE datistemplate = false AND datname != 'postgres';" | grep -v '^$') + +for DB in $DATABASES; do + DB=$(echo "$DB" | xargs) + echo "Backing up PostgreSQL database: $DB" + FILENAME="pgsql_${DB}_${TIMESTAMP}.sql.gz.gpg" + if pg_dump -U postgres -d "$DB" | gzip | gpg --batch --encrypt --recipient "${GPG_RECIPIENT}" > "$BACKUP_DIR/$FILENAME"; then + gsutil cp "$BACKUP_DIR/$FILENAME" "gs://${GCS_BUCKET}/postgresql/$FILENAME" + echo "Successfully uploaded encrypted $FILENAME" + else + echo "Failed to backup $DB" >&2 + exit 1 + fi +done diff --git a/nix-system-configs/modules/system_scripts/gcloud_backup.nix b/nix-system-configs/modules/system_scripts/gcloud_backup.nix new file mode 100644 index 0000000..dde338e --- /dev/null +++ b/nix-system-configs/modules/system_scripts/gcloud_backup.nix @@ -0,0 +1,122 @@ +{ + config, + pkgs, + lib, + ... +}: let + gcsBucket = "polyteknisk-db-backups-bucket"; + gpgRecipient = "dtu.prg@dtu.dk"; + + # Embed the public key directly (not sensitive) + gpgPublicKey = pkgs.writeText "backup-public-key.asc" '' + -----BEGIN PGP PUBLIC KEY BLOCK----- + + mQINBGmHsFcBEADuiQeZSU2KMBT3+PAECEi4qW87WbMpeMIJlN7b5dNvSIVgaOie + n/KNDcZiKL5WkxIoxcEy1k64EQ8oY+xdAgUItZAL4zoB2bBY2rHmbhaRx36rYOdZ + ECI1VAe+yQ6gMSCZ26HxTSQebwocXC7LYj2qkn32TwQfNwl/93/ZSb64Np+qt8zL + ym0yl6ruz+du2qd9eAOJSVKAiRsvvW6LxC/+jBqdgBpYXhvjtqC8wtS6hW26jing + BauktYy3hjWy14JPCjSMIclIx7zqkW3+gu7lvGu9osKXwdjMWC1R+j1UvGufNczK + O05RR9EVrfbrv2P0+JoxQhRhEN3TXjRmx98YwPOHzD6rG2u2mIM666Huxrl8xKhn + cxs/p0lcbUhrmiwr3rn33r0v91s5KFhBxSNQs3FnDfET9zGx+YPwoVDpR61EelfD + lCowWHmsjXXjcvOBGwA5quYaep7idgM9gcmMVh6OKgHo6NlgBAeQQOSsF9u832OH + TjttMUFw0+NeaVO1hWFQgQvBNIk1b7qp77sFwRrrXsE1orC0ii4yODQ+OV7C2A8G + 2Non0yHWST4scd8WbiEOv3SLxyGlV+hER/HtHeQ7Ke8vvMUW5ZObv4qy17RHNJZS + lQY4/cBODV04sLz2GGEChpeZ8w2ebTHxp2LhhedPgYLyi5Fr6OMcJe3WvwARAQAB + tGtQUkcgQmFja3VwIChUaGlzIGlzIGEgR1BHIEtleSB0byBjbG91ZCBiYWNrdXAg + ZGF0YWJhc2VzIGJlZm9yZSBiZWluZyBwdXNoZWQgdG8gdGhlIGNsb3VkLikgPGR0 + dS5wcmdAZHR1LmRrPokCUQQTAQgAOxYhBI+Qr5IHE1lTHC/nNY/ZDvQidP7iBQJp + h7BXAhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEI/ZDvQidP7izk0Q + AK6m5jkKU8sGsKdTqmE8cd6cLtFsbTnk6abi6iv0ZZ1wsWNie/fdy8RGuaQJOvpm + FDxGaMaSYoMsdG/ONNRH/kBWybHba51c19Rr5ePKoL0aHHMnYuzT1xzPyQ/a/Ckh + 8WyIYflHRO0DU8sonnKlDZiwaq/bfu3FL03IsnPVbQOpZ0o8c9HIxDG0efgvO5li + v+ajiDMld5iwvSBz9+9yDDiSNYPRipNlhaFDaoT9pM6s7ETmRCYQ75T7z0FMaugt + iTJRz0emyj/canJ2/JrkVBGNw8Kb9JG8Nd6ix2oZagcv96niRKQoqzWyiWizNWnq + /wQ7QHqMxXGymNseF8Ig/a/0oJs+mRYYCBNj2hkF2COQdHqSr+NduSJfaZGCdHOe + kTeWtit9iWzeXnA6FjQX3SXynL89Nv9uJlfYZQX5Kai1DIxvPGvIpI3M1vVjGRfG + 0/WNwoCOmLRhGndaW9iqk7Xk7+k43q4CAsEsKhNQnAH7TzHOuOUmM7pSi3mK4Eby + 6tmiz0nJRdXwh0Fgl3VUZfU6aQqD5cdPDP4EAJpUuR1LCHMQLkDEL61gibBvuPkv + nsuqKuG2avFU87CCxZjusWtvp11Pv3JA2gmVPETWp3Gw0Yi+sIgLFKI4HOyb2UdB + STooGKvwHVfGm+AKovitDFT0eHlcUCkJFP6U+TRCYKNMuQINBGmHsFcBEACkbyGK + 9T3+FJydvYAdCkkdohTy4yyOuOC+9P3Fv3LN2jM+CqdW8LPKZKgU4upemae3hANQ + 345fTebYqvrCyaHbdSV64q9leV0M/NwAiDOpWYHUVuM2vKciBTalx+d9TgnW5gLk + QuG+G+gD43GLr9wj/Ewuyj0bGx16jzFk0iD9ZcCEvBjE3Fymd3UFQmFMpsMPZ+CB + KgnwksD0SmUFA1budhB+okFGfcHympMwebKCR30Kb1/MV9Y3GgPwjzOeL3vckhuo + 0bYKh6FLHv83DRnVDTBA2LgT9AprjHIZAOgpVyWWFz6WU5oSIGnHCrf9RSLor1BR + QwRQsoqWgea4qSDfnyCzZcmYf4H8aV/QOl5GDSSQ4XWFBRGZ/gke3AiRKTRCFvgg + 0iDL2m4oNuHlnM/J2sg25mBMItutPPK+UFQWDVvaVXe64/yDaKOLFN+9k5GGneIG + rh0ucCY3OOUZPotC94YbTWSZGmxwouFVvfHkuxN9DtL2w9au/60i+Z0/cbMfUgqc + URsgxnGTb7OncCWj3WNqLVoxF4l8lFEKQXx/EJblasx68vV318q7AsTCWOK+c3m6 + K50yXfagyqLbcXKwmSpYz/NJ6ozyVmd1LEULNpP2TPrCE5n/iCG284IRkESRVkgC + JdXOL8jdTcUHUAvZ0MRonXydRhWOvJlljoxlgQARAQABiQI2BBgBCAAgFiEEj5Cv + kgcTWVMcL+c1j9kO9CJ0/uIFAmmHsFcCGwwACgkQj9kO9CJ0/uLQzg/9F1FekOup + NOSwqfCWWZCURe0onigkGlRmVzxbefkiFWyBPoVIpyPWEOfKBDlSSeg7caeYyXK0 + 3s9uLFJ/qiusIFhgts/Y4nmbW3E6CfuOUhwukKJqWbv2HTBDzypUgiNiyYWSitU0 + Xt1I3P3M8rAp1X/WJ/jZ5pTGqc9Rh+zvQIuYU3+MWOVds6nfPpUFv5EDsa88puLS + ti5O7/dqV6TEp9qpDofKkIiUlWbDZQ1te2DmasgskGwVMLNZ5rxwzSxrZKwHAhQ4 + 7FuvISIK5QOy2dEjVdjgB9eD+RBvDbsxB/i5bIn5l2TPIaKq0SzcG3N2msfUUGuF + BGeRgAnlPgLH+2rOZh6KH8FlRUHH9pxkiSo87qXmgxkA1XNeZp0wV8yOFWiPvW22 + kgTmmOIftXIfMWFlM6+fp+WDO3Fhh3XvSvjeBHJRaSp3e9dRqm5U8qtoGfqgJklE + 6TJBj6xOqh+i3CC/4EymjvO5+1X9CUsR+TsKvT0t7c0DW78S+Ly+gKAUPgNv0ifs + 3GU403nHnHD/Esl9r+xLdMPdU4x37uL48dByxHZ1ThR11u5QZBSVSToRQFca4/nL + swC2tsvzP503rVKFehdavT7wxYER03Gz6/y5JueHuBN5RgP6H6PLBu32FjDQPLK2 + DFYqkeE28Uzz52DpHGvbw4cT08w17WWrf6A= + =jpAS + -----END PGP PUBLIC KEY BLOCK----- + ''; + + postgresBackupScript = pkgs.writeShellScript "backup-postgresql-wrapper" '' + export GOOGLE_APPLICATION_CREDENTIALS="${config.sops.secrets.gcloud_bucket.path}" + export GCS_BUCKET="${gcsBucket}" + export GPG_RECIPIENT="${gpgRecipient}" + export GPG_PUBLIC_KEY="${gpgPublicKey}" + export PATH="${lib.makeBinPath [pkgs.postgresql pkgs.gzip pkgs.google-cloud-sdk pkgs.gnupg]}:$PATH" + + exec ${./backup_postgresql.sh} + ''; + + mariadbBackupScript = pkgs.writeShellScript "backup-mariadb-wrapper" '' + export GOOGLE_APPLICATION_CREDENTIALS="${config.sops.secrets.gcloud_bucket.path}" + export GCS_BUCKET="${gcsBucket}" + export GPG_RECIPIENT="${gpgRecipient}" + export GPG_PUBLIC_KEY="${gpgPublicKey}" + export PATH="${lib.makeBinPath [pkgs.mariadb pkgs.gzip pkgs.google-cloud-sdk pkgs.gnupg]}:$PATH" + + exec ${./backup_mariadb.sh} + ''; +in { + systemd.services.backup-postgresql = { + description = "Backup PostgresSQL databases to GCS"; + serviceConfig = { + Type = "oneshot"; + User = "postgres"; + ExecStart = "${postgresBackupScript}"; + }; + }; + + systemd.timers.backup-postgresql = { + description = "Timer for PostgresSQL backups"; + wantedBy = ["timers.target"]; + timerConfig = { + OnCalendar = "Mon,Thu,Sun 03:00"; + Persistent = true; + }; + }; + + systemd.services.backup-mariadb = { + description = "Backup MariaDB databases to GCS"; + serviceConfig = { + Type = "oneshot"; + User = "root"; + ExecStart = "${mariadbBackupScript}"; + }; + }; + + systemd.timers.backup-mariadb = { + description = "Timer for MariaDB backups"; + wantedBy = ["timers.target"]; + timerConfig = { + OnCalendar = "Mon,Thu,Sun 04:00"; + Persistent = true; + }; + }; +} diff --git a/nix-system-configs/secrets/database/gcloud_bucket.json b/nix-system-configs/secrets/database/gcloud_bucket.json index 4ce4f60..ab4b0d8 100644 --- a/nix-system-configs/secrets/database/gcloud_bucket.json +++ b/nix-system-configs/secrets/database/gcloud_bucket.json @@ -14,15 +14,15 @@ "age": [ { "recipient": "age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m", - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIeTFMQlBOS1kyNjJkYito\nZG9XQ3NJSmJxNk1pZDF2T3FoOUU5SEhqYmw0CmN4VnE5cWR3Tm1kdkZnWEZJcHha\nejBNODZkOXFnckRFdTVwdFJwTUVWaDgKLS0tIGRCY2VaS2RMcjQ4clZRbG52ZGdI\nQXdZZ3hBcktmMUlhNDV4TGVaT2c0UEkKH9e+rTKrRt9JqYG+RkFrlcaNXd8zn+0/\no65SOKlwMC0VAAb7rDDU0xGmahW2/bWErW2qJ/88dvDuqdX2sD28Pg==\n-----END AGE ENCRYPTED FILE-----\n" + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvZFJFQW90YkhvN3BjSWdW\nUTB2a1pmSWFNZEthRTlJYTFkZDZ2c1VvZG1FCmxYcEZiZ2dpMjdzRVhxMDhhZ2Mz\nSEYwOXlMOTh0U2REdmZKQ0pxU3NNRHcKLS0tIHFlQXErSk9UOXRHdjgvLzFvOHRh\nZ1AwV3dCd1JFRkxSQ0RjS2E0aHUwZlEKcFgfkNX5ieo+1ao1F+bi8KiwdvvvIKC7\nVddjbENyi4XAtor0JLTeUJEwMMIu/fYEbDsejpSkkR1/Yx5AUAjpcA==\n-----END AGE ENCRYPTED FILE-----\n" }, { - "recipient": "age1rdcs8y4fjfyagwt2q9599ax329thceersh6dg2f0p6nsghm5xufq00qu0p", - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5ZTI4dUQxdExvTjA1UDJj\nMUtFZ1F4SzZzVGhXTjJQYkRQaVlyUEZsaTFVCjdtc01Ydk9lMWd2cnVrbTAzeERN\nbG1XcTYzU1RPRXRYcFlzK3RJQzJUV2MKLS0tIEJETzZKaHZENTdrbUVTYWIxNmhB\ndWhvNEJpNVQvcG9lam1lbkV1dGxpMDAK9OspZrLOshe7JLROJvJ9dkzejkSRixyJ\nzD0IbFv3N+HIC3DeStDzCUnRdLmrM/q4HOYCPNCmAtT9jvOrD96ejw==\n-----END AGE ENCRYPTED FILE-----\n" + "recipient": "age1k9ddvzypz986a7dt403ja6evql2agz0gehll79mx64zceteya38smxph8m", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhM1dsczdSTVQ0b1FPampW\neTJwZDBkQTNiZk9TNFJuaC9uTFkrSk5YTEhZCnRQbWtab0oxb1Jtay9CeDlHOWlQ\naWVsZ1JEMHluQmxETUpzQkJ6RG4yYXMKLS0tIG04M3NwUVN0MmE3RUxXMWtGTC9H\nRG1naXF1bjlHeUlLRG5ibVhuWWk2MTgKFlN/qZhfDln5fLdsrbODDfZWZEM1bLkd\nDgWwNwl6VElnLBvLcRq7vMovOBrlboGgdOt1L75himEcE1xaG07I4A==\n-----END AGE ENCRYPTED FILE-----\n" } ], - "lastmodified": "2026-02-07T20:01:07Z", - "mac": "ENC[AES256_GCM,data:fjKrLuYFXZhHa2KwyWTmDiEyZInyJluI4QjevW2liWKyv7rtJbwzxlzUEb4hUG3pwFFOWeeNwAvIg+la+0Y+sERIEM5P5j60buia2cQZFTK6WvNwLsNN+/sDptznGfrUsI3GJOBtIQgdCCBrrDwj7YARP+T6kk0wh7iw6LgfuWY=,iv:Psy2bv2w9J4OXNH8MESCZD1zSCWDRKlmaOijgyKyorc=,tag:QpiPUT9WMzQQLUVTwtfWjw==,type:str]", + "lastmodified": "2026-02-07T21:00:49Z", + "mac": "ENC[AES256_GCM,data:9pZ6xXwUkOhNrfwz06+xJDWa7WT45p8tUERvfU3xIgKsgrGiyJRHZ2sewDE2kujrDz6qTwNL1Jo8d+sY3cmXJfSitxvwzLP9zKrV3cnpd1p/M7+RxZuz97k7XHTk97II/mlctYFg0X4oi9frbM4NFOaRsHfabfvAxOV4AMUo5Uk=,iv:HWxmk9Xda32/T6e+yECv+N6dGg/XGOKogDoW0cETId4=,tag:vkYFqE/tywo+Qv7sVe0AEg==,type:str]", "unencrypted_suffix": "_unencrypted", "version": "3.11.0" } From 92ab262d7026bb856f882170710924061d8bfddb Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 7 Feb 2026 22:59:59 +0100 Subject: [PATCH 04/25] Typo --- nix-system-configs/modules/system/database.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nix-system-configs/modules/system/database.nix b/nix-system-configs/modules/system/database.nix index ce65c9d..6740562 100644 --- a/nix-system-configs/modules/system/database.nix +++ b/nix-system-configs/modules/system/database.nix @@ -33,7 +33,7 @@ ./modules/local/networking_local.nix ./modules/lix-default.nix ./modules/secrets-config/sops-database.nix - ./modules/database/gcs-backups.nix + ./modules/database/gcs-backup.nix ./hardware-configuration.nix ]; From ce519b33439f0aa3481437dc71f6bde7be559d75 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 7 Feb 2026 23:03:54 +0100 Subject: [PATCH 05/25] Update the pulling so it can copy system scripts --- nix-system-configs/modules/scripts/pull.zsh | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/nix-system-configs/modules/scripts/pull.zsh b/nix-system-configs/modules/scripts/pull.zsh index 3b0883e..f31829b 100644 --- a/nix-system-configs/modules/scripts/pull.zsh +++ b/nix-system-configs/modules/scripts/pull.zsh @@ -117,6 +117,8 @@ else exit 1 fi +## Todo System Conditional pulling of directories (only if it exists) + # Step 2.1: Sync secrets directory # nix-system-configs/modules/scripts /pull.zsh # nix-system-configs/secrets/songsheet/secrets.yaml @@ -135,6 +137,22 @@ else print_warn "Secrets directory not found: ${SECRETS_DIR}" fi +# Step 2.2: Sync system_scripts directory +SYSTEM_SCRIPT_DIR="${SCRIPT_DIR}/../../system_scripts" +SYSTEM_SCRIPT_TARGET="/etc/nixos/system_scripts" + +if [[ -d "$SECRETS_DIR" ]]; then + print_info "Syncing system scripts to ${BOLD}${SYSTEM_SCRIPT_TARGET}${RESET}..." + if sudo rsync -av --delete "${SYSTEM_SCRIPT_DIR}/" "${SYSTEM_SCRIPT_TARGET}/"; then + print_success "System scripts synced" + else + print_error "Failed to sync system scripts" + exit 1 + fi +else + print_warn "System scripts directory not found: ${SYSTEM_SCRIPT_DIR}" +fi + # Step 3: Copy configuration source_file="${SYSTEM_DIR}/${selected_system}.nix" From 408745c511967627781fe9895096998bdc8f86c1 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 7 Feb 2026 23:04:46 +0100 Subject: [PATCH 06/25] Typo during copying. --- nix-system-configs/modules/scripts/pull.zsh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nix-system-configs/modules/scripts/pull.zsh b/nix-system-configs/modules/scripts/pull.zsh index f31829b..234e66e 100644 --- a/nix-system-configs/modules/scripts/pull.zsh +++ b/nix-system-configs/modules/scripts/pull.zsh @@ -138,7 +138,7 @@ else fi # Step 2.2: Sync system_scripts directory -SYSTEM_SCRIPT_DIR="${SCRIPT_DIR}/../../system_scripts" +SYSTEM_SCRIPT_DIR="${SCRIPT_DIR}/../system_scripts" SYSTEM_SCRIPT_TARGET="/etc/nixos/system_scripts" if [[ -d "$SECRETS_DIR" ]]; then From 3ac671279a21642f7f1c5d5cb29fba35dbbd1f46 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 7 Feb 2026 23:05:54 +0100 Subject: [PATCH 07/25] Another typo being fixed. --- nix-system-configs/modules/system/database.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nix-system-configs/modules/system/database.nix b/nix-system-configs/modules/system/database.nix index 6740562..dace198 100644 --- a/nix-system-configs/modules/system/database.nix +++ b/nix-system-configs/modules/system/database.nix @@ -33,7 +33,7 @@ ./modules/local/networking_local.nix ./modules/lix-default.nix ./modules/secrets-config/sops-database.nix - ./modules/database/gcs-backup.nix + ./modules/system_scripts/gcs-backup.nix ./hardware-configuration.nix ]; From c5a33e537ef371532a0d0b32ce8500f8e6c8b21f Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 7 Feb 2026 23:07:01 +0100 Subject: [PATCH 08/25] Another another typo... --- nix-system-configs/modules/system/database.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nix-system-configs/modules/system/database.nix b/nix-system-configs/modules/system/database.nix index dace198..095c7c9 100644 --- a/nix-system-configs/modules/system/database.nix +++ b/nix-system-configs/modules/system/database.nix @@ -33,7 +33,7 @@ ./modules/local/networking_local.nix ./modules/lix-default.nix ./modules/secrets-config/sops-database.nix - ./modules/system_scripts/gcs-backup.nix + ./modules/system_scripts/gcloud_backup.nix ./hardware-configuration.nix ]; From aa38152c1c00d3d4cd86d36fcc2a9b386a5743da Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 7 Feb 2026 23:08:11 +0100 Subject: [PATCH 09/25] Another another typo... forgor z in .zsh --- nix-system-configs/modules/system_scripts/gcloud_backup.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nix-system-configs/modules/system_scripts/gcloud_backup.nix b/nix-system-configs/modules/system_scripts/gcloud_backup.nix index dde338e..90e6dca 100644 --- a/nix-system-configs/modules/system_scripts/gcloud_backup.nix +++ b/nix-system-configs/modules/system_scripts/gcloud_backup.nix @@ -71,7 +71,7 @@ export GPG_PUBLIC_KEY="${gpgPublicKey}" export PATH="${lib.makeBinPath [pkgs.postgresql pkgs.gzip pkgs.google-cloud-sdk pkgs.gnupg]}:$PATH" - exec ${./backup_postgresql.sh} + exec ${./backup_postgresql.zsh} ''; mariadbBackupScript = pkgs.writeShellScript "backup-mariadb-wrapper" '' @@ -81,7 +81,7 @@ export GPG_PUBLIC_KEY="${gpgPublicKey}" export PATH="${lib.makeBinPath [pkgs.mariadb pkgs.gzip pkgs.google-cloud-sdk pkgs.gnupg]}:$PATH" - exec ${./backup_mariadb.sh} + exec ${./backup_mariadb.zsh} ''; in { systemd.services.backup-postgresql = { From aee7f79c019ee9ee9aba2be3c8bc00f3c508a683 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 7 Feb 2026 23:10:54 +0100 Subject: [PATCH 10/25] FOrgor push secrets. --- .../secrets/database/secrets.yaml | 25 +++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 nix-system-configs/secrets/database/secrets.yaml diff --git a/nix-system-configs/secrets/database/secrets.yaml b/nix-system-configs/secrets/database/secrets.yaml new file mode 100644 index 0000000..2dab0f4 --- /dev/null +++ b/nix-system-configs/secrets/database/secrets.yaml @@ -0,0 +1,25 @@ +backup_gpg_key: ENC[AES256_GCM,data:3eIbk/QjaebPIoxPmeVgcs4+U1vGyBvPLOZ9wt3CYlC+418Wn7c+cqNGQSV8AGgl0qetv1rH7R5AeocicK/US/77UsXrRF7/BjqCvgLm3QONqBhDItzIxI2z0HPqvcDUBBWrgaqNwxIx0mKThYEfRGwSZezUjxs6vbezi2TpJOHdjJXzKmYwSLJjp2+7yXVfVOcC6SUjkHdyjEBPdDDsCas8jN7pk9THHtgcyUQkS5NtcIjMw+balZo8fFTaSY9uV3/ZQJl4N0b/+LPoLjzcF8ZudLu369f+NyFQsKYiBsduq879kiLA1YK326ynWaLgR3yd0VvbuCRma/cvncBMl5lC1IXf1w7kOo4HH8jTGXhaNVv6I857QSLIBmzcCSdR7bvvIAxbMwE6Uik7pdTnySq372Ibil66tec23WZNtk0wy/Rysuo2lt9WgYXA9O3kCM73cS/+Kiu7PiCfEOL+1e2xRoe/JBFfdfqLcIqZsazrkksnT9UiD9Q2XaR8lIpFFdsl0BQ7A9LstGRizrZx6makRBpTgmZPq7SeNpIfjW6eFMWfEjk3fMK9k/Y3Tnr/Q+aq3CSiIeka500bAIIdML8ikxugPG7T9foOnJZTRuopR+rwlJEubTEDZW6b1d4sbCWXoOvcRVDkr4PyyRFJxRj/B6iRM0lLgAjIKEyhSujC5ZpIro8+24bbAbFZ6qYs8QiMH2I43qwnX1tti+nbNZM44knuIw6aoeG7Wu3tTwn0EuASLvxoE2ii9zMRTJwaNjEmQlGCQ6XXatN4naabHN4sMGSYilBgB/p1LHt7M9uf0YdKHunGxk/kvmKlhHOFrVrDKv2SsRb+MyU/nm+py5iZ5a/lnsHo39Dj8icD66oahej5FrtVsc+p1HIkViZZeEEwmjUicVkUjzWSqj/i2jkUNgCrCclDwFBnf7bws6tl7CJZiMgtXzwzjmRc34JElAGq5xOiCQLG2nO6zbXIfE6u7Y7m2Wnb0uxXTE52w/FUU4T48cQdeRVDcvOvJ6JlU0dAVxGGMy0KA0dyP+aAe05n7j/E++Lu8h71FpWPaxt/NI7H1yRdz3ZuruN4c2wzmqC+r0o1zGQW8Zl58JAwDWvB4lit6UUiGCqZIyeENTf82y/zbdQLtekwT22gNh281/EwJcU8CaE+zwRgSlI0H4mao8gv8Ev9Gxy6bmoxwMXD2tjns7MfQxc4gw7XyX19lPLtoniQ+4P4ZuH2GAs90p25lEZRSzQL9GokRO4+xPOaG5vT+w5dRdiTgyexzl5WaLmZHGjIHFR9D6Dta1yWQyNZYLzWFehbIH0hRl/amrft8cHpLiDgX9cKI1sqehaNlSaijtst8aXHQ7LESMoByJHTLPsB+K81/l3NGO6Rm4WtTZwFwuZ3lb53DxsDMRmX48xTTMcnFK2m/3++Sa8IWaxGiULIyL/XlIdKTqdsvzzFxWQGf+xWe47xY/M1Ae+qAcwGKqfSqXnuQJB1PcRIDI4hFjNuVDpuseMCKrwCOZHMXh6hFBDpD6wOzISvKpaOrBJi6Zs0c5Mm8JV/W+EHgYdrww6aoolZ0LQk/Q2mftWbekpGwY5j9gEnVGUT1c3I0QZfIljYqJ6dQ+8sGnpG7ehNgCm/y2Pbv5sHw6sdMOzvzcUU40+cNM2vqGkgQU/UaE10d+PrnOPYivzuMCtSDmOf37q1lgOhKcUxPIqvHqOL4Qx4XAui/qoVGNKLPUzGI2uh54Tnhv4/W3MTAmQ2ShsHYjwx8YK5x4dscqy7IlGN1/4BIkMlq+eAMFWK1khnaUu2l76UbU+3N2sR/29NxcEWXK3QiTuduHObUygVYB662hespfUJWf5JDFnNOFOauCIeb9e7dO/WFl2+We/pLn5sK0CaVwh3WqoKLNmsgPyZuq+6DVrdEx7dZaQP/MflKgQOwPE4/ycRlAskVwaxj2T4+XxdmK1dgQtTMfusFbfhmTbOPH3DXJFjAA9TN4fatOZkDr6F9WLLrNkVrKNlJE/3jzKrH3HvpQ8FWE77a8/zEJ8zK979WBNIt7TcdKcYG2SuPeW+pJTCKdfwjxypSTqiA5l8igfmTLihWljEre1onsqjObtvFQ94IXz0SUQRsHTh3DC9zu0tUcn5giE2Jy0OXWDFRjuuiw3JVnt7rEBqdotHryTJpvITo62mh3jGgQ+uSz4pyJGGQc7gDhiCNFtmZKmTUhnq6XEOywoK2nLswJYazCJ4ddt5sfDICdlUTsyQUdAOIfl57WBTMKKxLNUBXQwj6YtlQQSH+9uuEV6KIHHvxXNgLJWzAq7erO5y4j8gQUbWHlwfDeqArQ+ewSy0DuxhBjQtMYk6LCggU1kMee6kKeKJ2z5sFBMjGF1ibW/alXgAVSnQ1F8uEXIjeLet3i4CiR7KSnbMYXw8v19Ze+GjOE+4S4EAwZ9vEdh5RmawIyAntP7DlBXBLr21oc0j0wlOTNaYPDkgvXujFANu3JgN4aQLJUBcWkAGegivL7MOxO4ScvfMmSwgczBktSLqwhSZ7ZlXTtJjfaeSwN0zkfTJCNmCA1DX9GiOy9xEFiE9KnPz0aDcS3OxtY+LSh+AnBG6wWlrDvm/DIZOaY2qmwkB3N6+YLhdCK+luizNYZKboVrgzrZgSxrKzWituMOVx8K806TAFK1Y3LjJY/EuD7X14bjEqWqM5t41iczEdLh8nDSEKkhQlft2yD7AEnbL5x5TI15xPsmFKJsOWKEPk+ICoFrnIABvR2GVHp/qa5u6RmIVLzHoZv1isy8ZX2ZglHTRmiRfkjqi1ZLojua9VqgpmNtnrMhyIWNHU+rOpMw68qvkyF6UW2V8OTPpNPMWK1RvCbJmUQpv7F71kxllDdIEvGLtltZnyRK97MwgcCRNi63QhlUYdJLdAsrnXw+HLhqveDZM/g6NMVhS5bKJ87/x4Il8OT/6jvjmtYZ9RlnYB1edVp72ONRk+5dc8+bpmg8cqtD567K2N8dCb29JOYa00um7qEGKWu2e4QaEy8jfYiOGSDJPxY28gHJ4M/tfsi/tj0iXMCSuDJk7aJ6TneB8Kgx8zmerIYLutfChCmmEeKiO/4K6EFFoQn8yzxJ8dr9uYittDNrIfgQ52WCuuS/KRsXCoK2CnxGH5rHM1BbEtRDigSj9R5Og+fo6WNV+HVaoPWrSy1rtgzYkgVIRY5IUk/c/mq6uf8wqUuSvY6LNKm8IRbE6ybCIKohN+HmlASUMBaxsiZLL3oJ0pcFxeJ5BZPXXukmBW5I4NKT1XipgeJ94BF+BJZ/qEPWQSrnuaK9aMI+S004oQ2WmLisgmw5iknXrhHOCwyEkccGhcd6VEy2oRbbf1Hg455q94yTWumPJPDEjeWo7drw58MTR5lT2kDMAagKlJRXsKmMD2zY8c4gEJtau5mnsxUz0bICRy+rs88DjGEJhE6fhMdpiZOcEvUX0PJx4ajSJh7HX3FsG4Q8cLwzqNLDb2k+/0C0MUeJeIrvko89nF05gyp5dSQG/7OaXb78UKXG5actO4eHXdCJPthsC6BpNl4Gj79B87n+vDfRSxS+tvmcqW66yBvPziXbC9HvCL5+sXl7suFVpRew9wPIORU9c8fjRc78+7yvMOQGoKbFKmxEomjfftHj7Y0wdoLpfO0SuLAjJaze0w4cmeXHyaqaXr/Jq3QnaHQ9hziDEl2fZLC8B+TVFMRReGbnM3DOdseARQjNkFQemVjh7OhT5CpSnaIGkPsk7LzRu0Y2Ue3sxYA+WLTr2CsK2itcV/gsppmiWoP5ctSnCAxLs4+CUMVbaOl81xULn18cDc1FOsuHaOKOrCgIQFjwKWQ6LjBABglFD/B6CKV6bmmsLKZ3FK7oN8naqRMp/xOqgfnVoFpJI7o4+XzY/M5iljq9mE64QD5IOSsSUP16Y5982czXMTF7qM48+bnJWh1afhLxBWFRcA+SZ2xfoGlpuV6+8zQ3gvrFPjzDnoRn+RNy+DPXUUAkP1bsz6J+6UYaTWswFl9jVE1L+GhiFGmAFJUgLL2BITCSTz19NFV64rcyD/ULn6TEwLh8URRjqSShOAedJsAXnS14OS7E5FbSlDh7E+OiYjV4G3sQv9bo9BHV430zfjt9Zar6Ze54+tPz66M5iIxvLk53xnvF9JiKs8xqxJTyImmN+/VVxyHi6lVSw/d+hIblZqurm0qZ/Wf6189lRAVp8WGdzNnPjNX5UjoYF8xUk3oiGOLSPDK17vjzesqrbEh4Xf68/gIa322oJOHZukDN20G0re5tf+3xPxls7Ymuhx7VqkZf/lrxo4WkN+lhqR/8pzXb40DamimPnYDKU67KwEfZwlg1jz+IqpVdwct9H/LKUT6Kiepinztz4Zu1mKbS8pz1txFIXgLtrpPfh2kkr/K2/i9vDul34PN3nwJPe2CZPHWKTL1ee75unjZ1sJerVA625sZ3s65zM+9/P+bxNe0S40HHGy5R1/YNQbO79R1CIYiejpCGpNozBzddcrDEjuIuNmzjtj3HCNOslyx5IUn+PyHEJgMzqd+QPY4EvYeAvuz7JR69TjAKvya88X2a7VaquZaz8vs+V0btcB2oT2bgM/iHEmefRMxlHQosoxWLmgseEclxMK21gTSEXb3S5A/DGJsBHoDzbbfBtAmCvMwxwhPpv4mENcYLhVV+IER5CVEnZwC8G3HlqGhO18LKTWD3JEys9BeK4HX5+yShvvAcb95ai00yK1O0/pR6NeMZNS0QyrNY5spTdXCqZMsEK2KuaBHGDbxo1D0BtkI5FNcTIe28yhjF0BpadVKv8woAEN/S2LFgyrXDjIDC2glY5ArKoUYXlvlX04OW9n3VO79KOQogEK/QNhzdNQgE9K7YU3g58hcxmOP+waUEpsgUx6dTt3O5P3VxyCauhr6Wh1BNyWTjzGaNIKKKN4Swr4ZYWy5LTwpLr+6BXhcdjwtiAvmpPpBydRs8r+YA8orDztLMxBtdN+vnDMUGmuQlOrdeTPmoF47s0WJpzuHHb6NW5CGYd/D03M4fx5sV4HZ6qVol7787SNFg4uJSLc8EuCmUEYdFceWwJqQ5Y0IrgY3+loOpXbdLqTdG5miNHg/uwhyKo8glolxbxKSWDF6X+JDCE/JwwKKedUb7vgtRAbo/8CTpc1r6euNkWaG4C/yvsFN00euYdtTpid/As7Ep5YE9aY8YHsnTOq/hfTTH6VMNZweOsJjq0b0JOsuXZz2yVt5S7wnm1vBEel2CsEdrpJi6HOiWA6TOs2OU5BJ32sqy7iVXJaeWvEaANkeh7x2RpGpBFWkUX4813qJvhaWU5y5d707yrorOVAiDKpkCTvw1O9MqsW16C3wxzVDIe8JAK7O9Vb7wkYiWMT+97uzxembsApRqLwZj4M2AEkRa7zFsnCUL9ztf/66ZFq969jZa8LZd5QkaIuYm5To/tSUFEmqprIy0+do+Obeb0LnNVRDepDRcXGksa1YYSSoeHa9XYPepBJgvqKSJ93fbbz9yUDQzJ3l/OEOvZ7zlei7iScYDSmwfNC1KcF75iwYmb1ZpgsF6nlCiHvAgNp+5W7RvX2YqPZ/D1/ZFMhcBZ5UezcgZrcrkk5z8hZ/hmQM1pXBpT5qFn3SQx8VlIVLJsP7SWv0oKNECsRq6AGuocl8vPcF8bdKC6jTupPoqCybJzFgXxIiK62fckdV7f36KIyUwPtX140YPQbUfWXxSBKhJZv7cQO1nnP9e9fK8IXZG8301FIdDVdzvw+16tJ2SPKAfGDAUFzWTkI9+5Z3LZM8maFj9aSIHk11cIF/oNfyOTHYRFI3yCo/Zvk493wbcv1t0g5rhun7TBgBXK55a9IpxSXDKyhpN4J8u5PV6DCnO8rj01UWeNH0mQP98vP8aUbpQuDdHK0IJkFyiyAcUpai1MsE8dW2q5vyEzm9i26D+JDeB8Dly2C08AUKUp4PJgw6+oDKM2zrWU6WNH5f92QeoaDfWj2M3IdoWToX+Q6EwnJoKUrDs7C6gR9yZcLQvzyoJkDu8AqOLwTBYPi5ybpz++8pFBGJHa1uzfWwHilIinzLYA6yEbAuI5nXE0BDUGLa0sxo28dZODnYTpCB3as0/2RztDNeA/MoKptgAkGJQgkP/DTWJo3VtIz/laIaW4eWMqoxtt1gohttPIicIKSMxgpJnMAVHqqw3/UWmQkXuu61hRlDhY19M0RMmroHnAVblTfJp/99GE5dETjikWIgkEOjko+2YjhbzbpOhq6IiGr7Y7NkrGKAMtTuxGw0RPbKuKIqsg1/iQwiNbI4M687WjtEnKrdkimu7rm2X8YITurnx7alI8XtH52BP88zYOZgMOkzyB+q6XZlKZYra5ZwK4P5M0W2CwHo6hzcWXlfswj5ajTzq35rPA3bm0jxLduozZp+Ln60UhogaB3ro1jMNZlGES0fE5PthYc32JOlfGJWplrRyt6rD9YZgxyRsDxm/n6UxURkfpIPc71qXW3em4KlUqjgdbnXq+1NXxE/xYHL/dkszx+fOEE7H+77HEKwDGZII2CZ4VNnu+nUa4O9Sd2//62MkZSJtUR0u9O/xgyvabpRhj5UJvIcQKBr+Wfub0gaOesxQHoGcJCFBJUl3fiYXonuPatdv5tVokyj0Urc8loouK92wLUpKIhmCEb9Dbd6Xrjk/0cwdRhZLd6VR36vHjm2neYnyOGqQK8gpKjQeuwUhKJ9UMWbvE13WkVOsUe7p8fu1dfrMRv2Vdo2Q8UWRNQymuQh7jHCoYltrvxmPHA1SH6ms3LgO/cAC5ylDRK0s9z/7mBnMgLYWVE9sH4JF05T5mumyWjZEwqUTZKOyQmdlgjVLeoWECiV4/3Pv/qor9Iab6V0LeEH7yDClxqHhsK7pZnSjq+aE0lNMouIVanRvgQacOItP0OIr++zd0vR/QYuEjoE17PYwN65fk4PUnGreJ0oDuRSxRAqMXnztaeJzywVKDeuUzDohosd9BSsCz2fWD0FN8SlIQosdZLhBDPMNSYcOVRb2EjuSBXqHLEJCFQ1cMGDN9BIth+m+GzEwnObB2y2KBWvmjEd0e50yjqlRHdmpsK94ira4/iq3DKb+HCVTR7rrQEJqkdM42N0CdNCeEz8eR4gdz4PVYe06F9W5vgmpK5XOXbgmv4h/XOIh08TtDTRSALvrLQNyajFMu77Uq/1Rqqlu2mT75jP9K3Pnve4BExfqrNX6A2ZlS2gpvI0gSuhrVDcrhMK0AoXUJiiIxEseg+WVTMVo/dw/lK6g9FFG8S4O8FEI9YL6rgnuVDTFb2BMAw5RjbeftA85+lHzvJuEVQ0tqfJZIJD6jUXzFRS6SQlQSYKZlKihTyIKBSek3EPISfVd6ojesGTN0A+zjX61FN4zFqRHsVy0R/xBtjBTuelN7G9+u1w2ZcCASte7/2BZp/yfZ/xG3iCaK6WYUKOePFyPQelbxoyyhFp7wNDXjLCU7v8GSM0rPvtYre/hYEMT1r60/pt3v2ApCGfaopUoid9Z92hUdQN7EVTu+k1fa6CgTmjxNfe6Xp0rIirY5YX1vkhpwo+cdNIY1jfyr9Lf89G33/WelERBDJbU1WblSa22LeArl3EoJ+nQwkViAuOLo0p/KuOHioKs0VYMReI8XR2AZQymz4PkZ2ysd9UJlz6duc60ECYi/wIjlwCbSOFTPivan3zpWkbno9Vl6h3bynMgzxPe0Qc6SzaBWDN4eGOFRAvbb6vWAgRLO3W7e9RugdPhYPngxIpEKL2O1DpUgephs2+ne9Do/XRK7PntOFh0gDpgrQF7TmoiJC3ka/3AqHfSJ/X/n6NiiVy4I0h/pfVfME18q0N94tJaZF7G01ZJgRBdNCNPvi7joGkDLF1sTDEaPXaPTOBBBrLE2O7CIsXXJPKYDN+3B96zb8ebwkT0c0aiAoJSZcnFJvHY1fYjneTrP05Ik1xJeXKKMxXz9hNCjLycOdhchbT4MTluTlZpdq5f5lGyB39Cg5Gyz75ztMAJDRTyoflAxKKxj0HVgJQ/6UeT99ghxCKtvboMW6bhTXupUcBAAfFLVh/Klu83FYwuXMC065jaVcNb44U69tyvl426HDwU5s73SRFHuYztAoOGhU5IZAP4tijwXWGwuZpkl7q8bfc+gGV+N7NOwtJtae9JBy38X8bfASADfJidUYy0DdAH23jtGpXmzd/nRTjg8dPUmhTRgFwwYP4bs8I+VZ4VOkX4sa1ZrcKeFs1vbENzF4ovr6vi5gTDjFtE4wmhpSOFec0etNEUO9UFN7V2P/EEF96vG1C2BYqzOvjF6qwztzwkHo8K7OB0y9D6xdSEJ9yn/56XO3jr/6ZnhbZwYyJG8qBq+GyJVuTvVwiiDQE1l+oWXXT/TWUzD25+oEKlG2NENFH0gBq3DfRVFp1Qp958tMnfnKKKru+DebbOHd8yoXat4GRxXiNSCWHZa8DbE/zTzCsqQtfOSijVE9ujm4jvJSLhcW0WN+lb671qm2HEafde4tig8a3KPEVMTE8l0HGtTgSOIfx3UxFyvBFc6zhezgdxri4eeVwBD1cZKJPbUnMtoteFJ6XscQn5tjexlke16HGZpuTNzzQhMeGVc6a5ASKLkRU17L0gtPbaD1tPimJKE96vIc98iygtlQhFXUEydOrLL0KRvkJyv/vVu+PnMqfE7ttNoR0yA230wlYtW2f2y9n59r9aJ3jeUto/64b1WUmcuGxZ+TCt4uEUlaN9W2EFaOqcck6JZcpqquoAl5EgKU0vOFtqkJroUfbSftTfqWDIkIdpKzeXOz0hVxJeCCBXt8SvA+K7exEsWevCGQpD5gRmO/+IG5SqlYeO6C72msFHXq4OrAtB6UPv4uginHyad7DBEKbExXCpslRCzbZGBNLfUPZnMT34W97ddh6CPtbjQaTRZBdfO9BliaJch/lqBkkwanDSEqGVZqZQ6lFVQttZPikunFO1yaz2v5GR89JQAPcFa8XQyfX91s1UpcXQAKBktrQ==,iv:3hPb3uuPrzr9iHhqTPZ55N/kgDXyOXvm1wz9t69YkZk=,tag:MigO99l0m9NebJztH6OgDQ==,type:str] +sops: + age: + - recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHNjJhRzlsTkQxMFZ5RlJX + QnZZY1IwUk1UZVg3ajh1TzlCTzAyMi80WUNJCmNjQ0FGNjJrQUx4amMyalNDTDJk + MERjWlNBRTR6NTI0RHo5K3ZjMmVsQ2sKLS0tIEtnWnIxOXdOZkJqelFQRHUzcmdn + ckJ4a1RmNFBsdGJxaUYrT2JTUlN2dlEKkllv1AweBfnCurkmJNciP+apZ5624kUI + 6BceqL9IG2bFUWpAcEr4pAgya7rj5tNbSWCEQXBechyIZfEwko8XYg== + -----END AGE ENCRYPTED FILE----- + - recipient: age1k9ddvzypz986a7dt403ja6evql2agz0gehll79mx64zceteya38smxph8m + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwSU0rSlpHR2pLcHhCM0RP + MlFTbWRiTjdvNlh1SlY2dlZsbkhld0g2b1ZVCjdzTzBwOE51RTdWUGNMK010ZmxP + Z2pYdUZDeUJKbWpzcE1lc25XVWFSQVUKLS0tIENuZStycWdhT0VpYnZhaDBjY21E + Rmt5N2VURXkrd0ZYN0cvV2hwSnJVV2cKO9tI6BpaVocyRAS1IYCc5SNLWwWvxugC + rEKMFcjatokT6fh6jkTaG3QH05h6naxzvOr0CTZQOGTYrXM8mT72EA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-02-07T21:41:01Z" + mac: ENC[AES256_GCM,data:14M401FBb+uPLRCCNyrxm7qkeil1z2O8Fs15nY9qIkMoLxw7f4qb9318sJEX1miYylNRFSK8kZdFYFcr3GNJmKplEOsqnip3aLbEEusrcOFo7SInuIYBRKox0FNLOHUXywlhRkktvwjAzhFeM3JtAMBJG7UByXDYk6JK20Zv0o4=,iv:o2/AK6Xr313wQJxAfRBxr+XmUDvXZDHmN9tsmltuSN4=,tag:17CEzO1Zt/oEY8ejVhTQDA==,type:str] + unencrypted_suffix: _unencrypted + version: 3.11.0 From b5af91bde00e26583e0f8d89a84d971bfc91cfef Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 7 Feb 2026 23:16:21 +0100 Subject: [PATCH 11/25] Update GCS service account secret format to binary --- nix-system-configs/modules/secrets-config/sops-database.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nix-system-configs/modules/secrets-config/sops-database.nix b/nix-system-configs/modules/secrets-config/sops-database.nix index 1a1da83..30a56db 100644 --- a/nix-system-configs/modules/secrets-config/sops-database.nix +++ b/nix-system-configs/modules/secrets-config/sops-database.nix @@ -35,7 +35,7 @@ # Declare the GCS service account secret sops.secrets."gcloud_bucket" = { - format = "json"; + format = "binary"; # Apparently this can make it behave as is. sopsFile = ../../secrets/database/gcloud_bucket.json; owner = "root"; mode = "0400"; From 3e129f880e2ede70cd1870f417cb1280bc8801fb Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 7 Feb 2026 23:29:06 +0100 Subject: [PATCH 12/25] Fix sshpath and try to figure out how to use sops like this... --- .../modules/secrets-config/sops-database.nix | 2 +- .../secrets/database/gcloud_bucket.json | 23 ++++--------------- 2 files changed, 5 insertions(+), 20 deletions(-) diff --git a/nix-system-configs/modules/secrets-config/sops-database.nix b/nix-system-configs/modules/secrets-config/sops-database.nix index 30a56db..543e0dd 100644 --- a/nix-system-configs/modules/secrets-config/sops-database.nix +++ b/nix-system-configs/modules/secrets-config/sops-database.nix @@ -20,7 +20,7 @@ # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml"; sops.defaultSopsFile = ../../secrets/songsheet/secrets.yaml; # This will automatically import SSH keys as age keys - sops.age.sshKeyPaths = ["/home/songsheetprg/.ssh/id_ed25519.pub"]; + sops.age.sshKeyPaths = ["/home/database/.ssh/id_ed25519.pub"]; # This is using an age key that is expected to already be in the filesystem sops.age.keyFile = "/var/lib/sops-nix/key.txt"; # This will generate a new key if the key specified above does not exist diff --git a/nix-system-configs/secrets/database/gcloud_bucket.json b/nix-system-configs/secrets/database/gcloud_bucket.json index ab4b0d8..de631df 100644 --- a/nix-system-configs/secrets/database/gcloud_bucket.json +++ b/nix-system-configs/secrets/database/gcloud_bucket.json @@ -1,29 +1,14 @@ { - "type": "ENC[AES256_GCM,data:bl74l+sY5V4qeLYBANRU,iv:uKOGWFTF6ltq3mQ4ojd1/bZgofPi1J4Gtz3/PUCfLLs=,tag:TxGwCf5qCDPVfIMzFgB01w==,type:str]", - "project_id": "ENC[AES256_GCM,data:6cW8StwOvkdGXIjuI5Jj8DuCoE/9z0ky7tEWMIbg,iv:bAyX1+phAdiMRVZNRwDGE+QkbFo71u+Gut+z+yPQjg8=,tag:9JuGbq13tBUJUb/tUWolbQ==,type:str]", - "private_key_id": "ENC[AES256_GCM,data:j9xf5MtzNTn7OV2PNWXPPSqSLU4elVLjF1MB6xmlFXSy6XXJEbz/uA==,iv:iVCTbjtVHGEsvKtBHnrwiI3MPgGKGQlyEv9zAMcQ7sE=,tag:VzsIQHMjBvrIl9X5Ul2j+Q==,type:str]", - "private_key": "ENC[AES256_GCM,data:X5HOWhmdI/J9TqQ9bVcplgeFXtZSk3m4+9duXzc38IZ+e8E2gBISq/bfQ8HGzK7r54c85aCNFiYYbzkNHRh+newlNSBCHhmfHc0Ko7OLQS3+wcEX6Z+D2llMJxKAFAXGh63L6gWdYCAgTgpL8OlKv4sW1V4yH2N+Ei+iiYcHfc6g/xDRky3PxBNQcoA2qTzfBpZ8lDRMFLQQDeKeGmiC8m5o0RPdiSdA9oDc4IMkWPPEidCTu4hUn4YLr3Yz5NMEFqMqaiVq4G9FsS3fVZdk4HSdFHNlse6apkIQDTUWkQhjSwktl4ul2jimgKBxa2aNcHmKZcxnoSgF1wg37P6b+RNAsUx5OgpqLmXoaSC9+5PHMkvUrnwp0kwMLqmtXhUDtJcA1zRGaWgI7jXXcHlvXMxtod+GdGygMsNNMPoNqAacT7OZ3Fc3TqoBERd2yvORbKQmKuXSOslFsWa17toqo42tUEZReXbnQkvHe9ZQKUAaPvjVX9pQzraR8tj2ReLsO/8L9gluRv5j9NSt1DnzBZyggRUj5trE81fJ6joiNCHQmcJyagInDeDXGZVmzPtXofOwjR8U8+fVbnxpp7ji7HLjFVtecxF2DteihTJ8SqsjQMpWwV5E241AK0N4gnnGi2QmvWpq+x83Xceu6zwNgTVnnyR7mWgOuYKnzeez9a9ozRPDkf2EvCxaTzyAzzXLem+Ui9m6hJ0IO3bZERvLZzCP0yykE7BhbF9LDwVfc6TSr2bCgdIy07DCI5ccNm8nqdtE1m/xqQRQ3uNrRkLzJOFUUXSfDwmE+dFPxbL1x5Bmqac+jvH8Coj10l1rdAExyOLNyIFJG4ZmmxVIsf0CnYc87ezZmF8nLcL/rLjg6lngAlqQo2KE8H2omAfFNDCAiqQGqLuqi6DBQS12K08Aqk9tN7zrmB5sRCzVDpo0SmCSS5VvPduaSk1TWAIH5Z1gHMU1cdz++3hyMZvvG9b7hiRFQoFBPHZnDyKta427X7ccsLM2OCIEI7Tb3T0zO6IK8/WrZolAqwxzJv4kJJUQan0lhASFC7koUEJ+1W6yycaLXeibNlzllP6Rc5ovp8QOuOgUNdR5dvEeVkAXqII49qvP/zr9N6aMGgFXNCZNKJq/nUSFAlOoawoJwWKowgDy2nmA/a9jamDT4cSxguOKa6JIBfT3aqZw7hVvMoqVzp47HI6FimEPxKPSJHbM3skEYEi3aLoDGPoG/NlT+uZ1ojqV0P0w0ESxb69RCnF8alvIIVZSMyC3YTbEfjdaOSl+UYvgkeWttujJ0z/utDOG2xe7fIkyI264tE91iebh2shHXri2I0vofL60DJBttYZ97cM26DzJTtOo6P30ilG5K0HRHc8K1O/yLZJroSjQXZM8O1Mk3b8cSYvjcbboOKCxPIxdqQpI3+AYHUvge4jqZHot+wOjIo+GKFDhxcTopkwJbKfayNAzQkac5DIBDmZWK5baNG9tG03NZGaRvP31mlmfBElr2s3EGbj3j4V7++rv+4mzleCH/oSGBob+crFbrq/QVU9zPtOKzKz5tQvb2BRlRE30hOkmq2cQfT3M2kS0fVjxBgCeFFPzMnXBs9kbg73zJZXLO3f7EhrmT9CbZjcW18D4ptqD6MZeojGn6+7D/JnccsVB4dYJg8MWDEDnHmCnL12gGQEWPwkZEchENginl28P3ZPTQwnFje+hnKWwCMa4TdqgD89bKksEuOP9PPe+3yGgjXWDj7E862bvCXVi1sHrHexkrcC1B+kdcnFGbsra/2K48+aWUED0405V7OqCYOygFLg7e1/oMN39PfDuX51A39Fi+/4sX6JCMRjG1/2EbKowcbNYnNjC7SWjYNWc062jA0PMYlhE4Tf8+1cdliAmuD+A6JyhcNZj2ulyBSqkR3tTV6UrnrWkaT+25ywWSkBiBkPWFt8sB0VOqZN4F6aBVrsjIFjZrx/GWDNXPpMiaEIokzlPLCvJ9XeKq6cWB/W3tAqog6GWorJcjsLi+glVjUvskDlLslj3Vd4eqnAjbktBIknzEv23557ghQMYpxIBFw3dqewz+Z6p+XoVsY73t84llbtT+PhhL/FdZJIlQ8iPnEdZTKfeTCcOQsbn1KXmEF1L9sdibCxi4qWdBkclnuH8VUpQto+2TDyQ2whJPASiiqNSV5W/QPDUjcR9AtEpRYXKmuXMts0M4X9sg6yLVq4QOe6rOPCPelxOC52I+FuVCOsoRQ8FGjFmhNQX2TN4UzJU9O0docpO0ubWuUCcoKr2,iv:KMBWDjUNBEGOEadSCzajAhaRgZy0x6ZJ53dQV4WsxuI=,tag:cqPBsxqiNlOWE5sv3gS2Qw==,type:str]", - "client_email": "ENC[AES256_GCM,data:5GS7lQmxfEhIiqLEOZQElCyL7mnrCPpWhBC5b9GsefHRu8MIZdiU/J5Kl2tAK7iGKlPVcoblYuwjg9jAxwq2Mwp6GBiVJ8pC80xwiC4g7w==,iv:bE4BhJTvprgW5NOJMspvEY43w0DB3B59dPP/iI7+9U8=,tag:tDEQXWClCHrE9zUbXbWVMA==,type:str]", - "client_id": "ENC[AES256_GCM,data:smvsjKHs4FZ545bbNnsKLyxklwJG,iv:UdbOhgdUkwLUF9BXpVZhs6bshCT/w2GsUBx8TA6IJYA=,tag:UgvsYx4bVUiLX/ivSn4V/g==,type:str]", - "auth_uri": "ENC[AES256_GCM,data:MoSyAWIMF31wGC1Th9lBVdxNUcKI9ChFQQ/9NcOpawZBKCWRpvUPPRk=,iv:0M/ckQguvifJswhl6fRZoLFDLotL4pqVWtgCJnneuvg=,tag:jg9yVdYsa3SzU15QodJSCg==,type:str]", - "token_uri": "ENC[AES256_GCM,data:VU6Jz5gmDMkRk8xVXz/GmBKqAU8LXWDWDd8wDG2LAgvYCf8=,iv:PsKBpoHzDJsrQgagYgSmDGfy/hi68PiDO5Cp1840gIE=,tag:4PnonD0ZhEb0ubshGY8wgQ==,type:str]", - "auth_provider_x509_cert_url": "ENC[AES256_GCM,data:DUe6H/PflOHgZ8V25EzCqtpIHiMHCI6xmfEmOQOOJTxBgKYm+PRDxIDD,iv:hNAgapcSmqKuGYNS0Ru/OAVR7DIGV73TOdGZVwBgF1w=,tag:texXV9bYMsev8oZT/Zs0LQ==,type:str]", - "client_x509_cert_url": "ENC[AES256_GCM,data:8Herex6V+OajFPQHlSlEFWyY9UHZ1O59Uk6DhU/YN99Uapo2D0WkE9OBDRwI/CFbPWEg6i7yUHVTTCw132kC7tB+QeqX1GHLYedV3AE4QyRzHlQPSsLkxMFr/q283IAu5Evm4WtQdZYQcqF8+olqd9veQuxMpnfWzz9hD4PpV6djur8=,iv:wloNQK6DSXCk4x5p6Clyi90GXYBHkhgTcJ2HJdz5b48=,tag:coYQsiCRE2IakoWz4P5dOw==,type:str]", - "universe_domain": "ENC[AES256_GCM,data:Juy31OVAEIAvPDV1fow=,iv:GKLpORARKRm7Hm14/H44RdAcnQYIyqi6e+UWaG9KjlI=,tag:saBZsuMBlTSEcVoFbnoLNQ==,type:str]", + "data": "ENC[AES256_GCM,data:bIh3mtzZL5Sj/jmZXg7iLnkmgngk3+1i9ZGlrc1fhilf5Dno8opjovIEof5DwzA9Pyk4KQijb4yiP/cNMSc6cBLE9X2n6ZLZb065sN9h+h2n6kItVapxwScMi4W7srpFctTs98fj95wp/MH2R43MS7QY9sIzlE5ZifEo8G4xuDmQdBHONIVhYu36A3JEOjuW80SzdIfgTqvZyLfa+NtlrqqI/Ofm63H0SOf6wzCm6dMPZQyD9KIP/adT35U45EZx0lEnaDSmvqLqkGoNAw6uDbdtQ3fd/qfs0UrGkVVi/n+uxuY355eY9Qb9PQBdz5K6gkW7d+zOmFyVKPEJ1p0AeYuIOSY8x8tOlT+97tI/6SBnMa43FBPuOMFEeujTuiUdVlI5bAkxRPk4qTCntUIzKBkZ4YBDRolHQkk38SQWCA5DIeZ6ehu1tbvVjtx0FFNqNOAGjXrmL0Jggp2cDsrHOHHPOtb+CVUcjmdmgAhhF1QIYK0tZPFNrBlOY3/OoLaXuQWIaHNKHNfoGvSPcoRRnovSgguYYBb9wLJ4r00usVLW9A5m3I464N/WHv7crsWjLrXBk7Yai1Jd8GI0K/4ICy4n6nCuwujdeMGbT/syd2RLXYYwBOs48qZHy/qzZOwHxn8lXyApNG3w5t+xqpDOa99/6IaB6G+sDOX8oadb+YfZFvhyBdsAKoDE3s+tfB8aGRClteS3bDbFjnqA/NlUVQ93Wcf070W0T8e9+E89zyWriJIdpNrN8n1MHOLp/vFi/VAIejhQ9aFcOQT51ZBULZYV/iNjZ+Ucy5y7NdTwBI2jCU6ihRn8FJMM/d0R5i+PVxOAJIKTTUqTvMs5cPTLwk0s2Ns+BWl1i934gzk8qK3QNh/Dd9QSxKSZdXEOa25J+uUZ7RpRv0YzAyehvXeioPyIRrPoAq/uk+MRKV7QVBXfNFXVyc3fWg2sObUIR/53iURpFMJjlkf/UO6zV/D1U+2d6TwSMpvtyjtB5jgnWMtIOiYOEDDUx6+xaWi2YnC3bqXd0mrWBSfx+FQjSeV32yeRCWj6kAwJHE4UqOqwi+R7YGsff2Ww0tAuX/rFWdRUZeaC2wu8Onyi/BUjfG/M9Q1p/YzVeylQZe+o4tvPN41hPvrBwNBnXLKS1GZziK+dWDlV2Xvcj6f2Ur2qwnmbOAph/L31qMEYA8doUkkDHBhgxf+OwKR+wVbsPtooidDmVLoYEB/6W8wXAUHPq4MsnS7GTTjpEgEdfn3+/9PdP94ED8Ch+Bn8weh784SknaWytG4gGJy7UJK7Jc0/7JwQO/IreZxiCVVdL/ib6PCYUoumArFtNlLxQOansZvnD4ATf4DMLjtQmAaZb6/PbBozL+fmXq4V9WrB2P1JEkdnfJu5n6rfhG+7dBLxHsjWT5w4ZHPP66WvaWN92JhzkysmrlGl3YRVDUuOyoUiqRmvyFVuRupHVnupURqpI56g7+3N9tEduZhesJ9MN7qDuFpSv3QPgyRARMRQemYhQEvKJNaFie9e81qsacYCq73V3glXY0cdPMZb4HP6Ir1Vr6dtZyFnAX8XsSTZo5RFQmLq7OmIXXE7Y3QRZRcSG+x+Qtk6GK2+nLG+FUALHWnp1YHRwGGUW9dAShGA1ZFlRpEUtpzQxBwc2OkoWKpYG2kbsMdyLmpwUA8m41JPKUI4vblJ4Xx9TP+t4b9jKFGbxeTFyHIcY5nO3hRExPhPYjwoSDFjRI5lzj6xUeQ1DYJVosYB3T03fDSIUjMqm2xLdMLUFiwLv3iNbhyyxJe1KdGwCi/oo8nInjaIu76ONy//KTTrI4qf7k4B2AuYz5gEaBOhIzR/+RmUnHR9QDQkD/rwglIXNCIgct7BqYHrTbWWggL1JUG5RZuJQvrTMH2nL5TbxWONt1/s4RcxR8ZBs+rD82q3KtIIfOHlowje9HJrAfYefMUTZP1ZjST+XmRgLpdjLzefTxrAcfy0MhBsknDICSHeiiPny8jPLZMmFDhahCmc/36lXFExTdNYxXvo8px/4ZIwYaNTrryO5PYVbBiRjIirZf6P5K0EZNbd2YAkX3YdPVEPXS7eaNG/mPUMeWFCQeXVFXkoGs8foLdPH8eBby7wjocq/xumt4Pa06rqazAj0LpdDcstvYcLcXDT+56kS6KahDuoZNB7ujaDXDLSm5HpAAlNnxKGzjPGBP38+IzXI9ggA3hoatLCU6cuTTeJxkDOraszLxENmB8qD/MFg5JIHcpGbeALEib0w3c5ZghuaDDD/r0dj6MBmYd/o2Hz0eY8LKUbD8A+i5y97qpBrHbgwKSX5XSuqhBA+SeC/UfVdDXQ9RnTGbK6ZgpY45kjkFzj/cdU4T1W5xVmm+D14MlBUrDRW/9+bAemqSxvJWiXZ+RvSxRmcnD8TwkbYrFDdidRPljQHFbbtIf/PJrV63ZKT97xawBMwgcszdm7+putFgQMgR2Vyh2cQZNJU7dtWxdji0R4x6O0HYM8bTnkSUzMyLwWGEOB0M+s8QYeMqHY5ESFCwqKeDtB8F6cQHs1nRNSjSzQ6yWnylWAGwXzT5xWBQM+qf/XJUidXxItxuf8UiBR7ffk8AmFRiCNFCEJzIvz4CE/j50GWXG5ecf+33qcCuz2Dqu/u9wjp2qWawTe/Mcrs0SiYn4y6CgJaFhaHKk1T2VHxlSqGLalJLeL/Fil9kIIWLUythh09Yy1/8e2YML8CpR9RLk7f4epv51crCpjP0Ih9ckRTWqqrKLKOSpNHezTWPlx4MrQwWr+AneG/4G5k1i8x2fLRowcW0uTKFK8cEZmgo7s7C54UMktDaPyORu39U7Vw9B29y0WAmVcYC2OA55p7D1Bj66bp2rm3auXmO8q9wBqlC+0/i6NA0+rqUgHlWxCm7tEZkbNRR4RBARskmOBqWdDJX6kJkNFIbA5JAJujX+YKLonB+K7qJcAgay9yidet/e0pfD1/vmz0cb6HpMmbbU8wTksqDTtqWaMx8l23J6f8WSiUJaA8X/PKeF7MY2h7ag/y041s4Q13Lo6KXK19lql9VwwNdaAN/nysWWYF72sbWIKTKBXRYAWH9+ZsV4+NvEmr4BZvzvhLMLOXFqCA3/ykQ4nmJPgZazUYOYWRr+6Pq+7LPEF/A9uKJNZcjHMVLiWhQw0m3IUsig4AwYeOMFLr/9juqNku5WiPpOyH5WCdHqbiAXHjD0CZDMJKWjtrlRaLaMnLkJmBDShieKgjdC/aEI+bVKx4IM=,iv:NJE8hUES+ayjQrXb4/vpp6qey6Rts2FoGwu2/H4BPsw=,tag:P+V61A1LVE45oTrteOBWiQ==,type:str]", "sops": { "age": [ { "recipient": "age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m", - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvZFJFQW90YkhvN3BjSWdW\nUTB2a1pmSWFNZEthRTlJYTFkZDZ2c1VvZG1FCmxYcEZiZ2dpMjdzRVhxMDhhZ2Mz\nSEYwOXlMOTh0U2REdmZKQ0pxU3NNRHcKLS0tIHFlQXErSk9UOXRHdjgvLzFvOHRh\nZ1AwV3dCd1JFRkxSQ0RjS2E0aHUwZlEKcFgfkNX5ieo+1ao1F+bi8KiwdvvvIKC7\nVddjbENyi4XAtor0JLTeUJEwMMIu/fYEbDsejpSkkR1/Yx5AUAjpcA==\n-----END AGE ENCRYPTED FILE-----\n" - }, - { - "recipient": "age1k9ddvzypz986a7dt403ja6evql2agz0gehll79mx64zceteya38smxph8m", - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhM1dsczdSTVQ0b1FPampW\neTJwZDBkQTNiZk9TNFJuaC9uTFkrSk5YTEhZCnRQbWtab0oxb1Jtay9CeDlHOWlQ\naWVsZ1JEMHluQmxETUpzQkJ6RG4yYXMKLS0tIG04M3NwUVN0MmE3RUxXMWtGTC9H\nRG1naXF1bjlHeUlLRG5ibVhuWWk2MTgKFlN/qZhfDln5fLdsrbODDfZWZEM1bLkd\nDgWwNwl6VElnLBvLcRq7vMovOBrlboGgdOt1L75himEcE1xaG07I4A==\n-----END AGE ENCRYPTED FILE-----\n" + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0ZHlvRko1ZGQyZmFscnlP\nNHZHYUREa3hBMUN5dTRYamZpdWdvZXo4ZUJrCmtzdnpPTXc1QnArVkxrV1hGd29Z\nckdrL1ZMVDA4TlJ5eGdJbk01KzJmMk0KLS0tIHZjbFgxbHpVYXhkL0F6cHVnQmZG\nckpBVm02WXRsYlNKaWkzSkV5NnNYcEUKTAoD9iAyLUr/v4OWiltiTzzJ+Rmx4zyf\neMEvirNzqac9pUcDE+ilP07EGB/hceou7eSQdw4hM+ow1ezQ4uRmxA==\n-----END AGE ENCRYPTED FILE-----\n" } ], - "lastmodified": "2026-02-07T21:00:49Z", - "mac": "ENC[AES256_GCM,data:9pZ6xXwUkOhNrfwz06+xJDWa7WT45p8tUERvfU3xIgKsgrGiyJRHZ2sewDE2kujrDz6qTwNL1Jo8d+sY3cmXJfSitxvwzLP9zKrV3cnpd1p/M7+RxZuz97k7XHTk97II/mlctYFg0X4oi9frbM4NFOaRsHfabfvAxOV4AMUo5Uk=,iv:HWxmk9Xda32/T6e+yECv+N6dGg/XGOKogDoW0cETId4=,tag:vkYFqE/tywo+Qv7sVe0AEg==,type:str]", - "unencrypted_suffix": "_unencrypted", + "lastmodified": "2026-02-07T22:27:15Z", + "mac": "ENC[AES256_GCM,data:51vWvevuX1A2mYC6HBRmL+qgJ0Bbvi1XEfl4km/LUGzOj2weSPvV+r/UJsIOVdkOr04On0YD58JXGDQMTWyV6FaaRdng7MgM4ffg5mnLLv3sPtqwaJJNT+7pqDfVc43qixbCHL+89nq2IPBrqNwVhHxm/WlE27K+7GA+JMtKmiQ=,iv:cseRzqtJgjVkNqdZplpmIaexfmOkKm0kieE1J2KSfLw=,tag:mhKzS0NNguygaHL4jdIpmg==,type:str]", "version": "3.11.0" } } From b3e83605db9b8c6fbd2db14be80ff2716431ecfa Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 7 Feb 2026 23:33:00 +0100 Subject: [PATCH 13/25] Ooops, fubbled the age key gen issue. --- .../modules/secrets-config/sops-database.nix | 2 +- nix-system-configs/secrets/database/gcloud_bucket.json | 7 ++++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/nix-system-configs/modules/secrets-config/sops-database.nix b/nix-system-configs/modules/secrets-config/sops-database.nix index 543e0dd..f823287 100644 --- a/nix-system-configs/modules/secrets-config/sops-database.nix +++ b/nix-system-configs/modules/secrets-config/sops-database.nix @@ -20,7 +20,7 @@ # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml"; sops.defaultSopsFile = ../../secrets/songsheet/secrets.yaml; # This will automatically import SSH keys as age keys - sops.age.sshKeyPaths = ["/home/database/.ssh/id_ed25519.pub"]; + sops.age.sshKeyPaths = ["/home/nixosdd/.ssh/id_ed25519.pub"]; # This is using an age key that is expected to already be in the filesystem sops.age.keyFile = "/var/lib/sops-nix/key.txt"; # This will generate a new key if the key specified above does not exist diff --git a/nix-system-configs/secrets/database/gcloud_bucket.json b/nix-system-configs/secrets/database/gcloud_bucket.json index de631df..e89245c 100644 --- a/nix-system-configs/secrets/database/gcloud_bucket.json +++ b/nix-system-configs/secrets/database/gcloud_bucket.json @@ -4,11 +4,16 @@ "age": [ { "recipient": "age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m", - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0ZHlvRko1ZGQyZmFscnlP\nNHZHYUREa3hBMUN5dTRYamZpdWdvZXo4ZUJrCmtzdnpPTXc1QnArVkxrV1hGd29Z\nckdrL1ZMVDA4TlJ5eGdJbk01KzJmMk0KLS0tIHZjbFgxbHpVYXhkL0F6cHVnQmZG\nckpBVm02WXRsYlNKaWkzSkV5NnNYcEUKTAoD9iAyLUr/v4OWiltiTzzJ+Rmx4zyf\neMEvirNzqac9pUcDE+ilP07EGB/hceou7eSQdw4hM+ow1ezQ4uRmxA==\n-----END AGE ENCRYPTED FILE-----\n" + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRL0E3QnNZOCt3RHdjTzBw\nM0tuSW1JQXNzVm4wZWtaNXZnSHJYdENUTGdnCmh6UnNTSWZqSkJrOTIzMmFHWElJ\nb0o2WGRLeEZjVzlCNURVZ1Z0eDl3eWsKLS0tIHNwQUEzUXIwSmRGMTRsSU1qbUNP\ndUdWOXYzU2tHa1IveUFFSG1OTHRiRGMKc1rmeYCy0zSxiOvPd9JwUduRbdjlUs7K\nAsTkw75P9UEitnMPrZziLtkxJGl9dochdB6y5/Eh4eJg7K9zeIr9Ug==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1k9ddvzypz986a7dt403ja6evql2agz0gehll79mx64zceteya38smxph8m", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVM1plZUhQUXdMTUMwZDNl\ndWM2OHV2RVRTS2hncjhjd0o4S1g5ZWNucWdVCm1PUG9kcHNXUFY3V2pJZndXZkdw\nUkhyNHdja0ZUSDU5aEgxeFhFR2VFTWcKLS0tIGl4UXp3bTJZWk1ZckJtK0M3RUFS\ncDlhV2NDSUsvVzJxYUhjT3JKUk55MkEKD13e9L1Xlh7q/a+sX4nCjlYfOpnnwodD\nMO2tDPt5odap7w9fra27BdEdBQiTdZxQXmE+7r85GEN8isk6xeqS/w==\n-----END AGE ENCRYPTED FILE-----\n" } ], "lastmodified": "2026-02-07T22:27:15Z", "mac": "ENC[AES256_GCM,data:51vWvevuX1A2mYC6HBRmL+qgJ0Bbvi1XEfl4km/LUGzOj2weSPvV+r/UJsIOVdkOr04On0YD58JXGDQMTWyV6FaaRdng7MgM4ffg5mnLLv3sPtqwaJJNT+7pqDfVc43qixbCHL+89nq2IPBrqNwVhHxm/WlE27K+7GA+JMtKmiQ=,iv:cseRzqtJgjVkNqdZplpmIaexfmOkKm0kieE1J2KSfLw=,tag:mhKzS0NNguygaHL4jdIpmg==,type:str]", + "unencrypted_suffix": "_unencrypted", "version": "3.11.0" } } From d6af466263f4a9f7e79850f4fb6f3b8f3bb094dc Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 7 Feb 2026 23:36:50 +0100 Subject: [PATCH 14/25] Made the bash scripts executable. --- nix-system-configs/modules/system_scripts/backup_mariadb.zsh | 0 nix-system-configs/modules/system_scripts/backup_postgresql.zsh | 0 2 files changed, 0 insertions(+), 0 deletions(-) mode change 100644 => 100755 nix-system-configs/modules/system_scripts/backup_mariadb.zsh mode change 100644 => 100755 nix-system-configs/modules/system_scripts/backup_postgresql.zsh diff --git a/nix-system-configs/modules/system_scripts/backup_mariadb.zsh b/nix-system-configs/modules/system_scripts/backup_mariadb.zsh old mode 100644 new mode 100755 diff --git a/nix-system-configs/modules/system_scripts/backup_postgresql.zsh b/nix-system-configs/modules/system_scripts/backup_postgresql.zsh old mode 100644 new mode 100755 From c4fe904896b68c50d4cccd9c6956d0de13e18748 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 7 Feb 2026 23:50:44 +0100 Subject: [PATCH 15/25] Oeh, I am "loving" NixOS right now. --- .../secrets-config/sops-composesongsheet.nix | 2 +- .../modules/secrets-config/sops-database.nix | 2 +- .../modules/system_scripts/backup_mariadb.zsh | 23 ------- .../system_scripts/backup_postgresql.zsh | 24 ------- .../modules/system_scripts/gcloud_backup.nix | 63 ++++++++++++++----- 5 files changed, 51 insertions(+), 63 deletions(-) delete mode 100755 nix-system-configs/modules/system_scripts/backup_mariadb.zsh delete mode 100755 nix-system-configs/modules/system_scripts/backup_postgresql.zsh diff --git a/nix-system-configs/modules/secrets-config/sops-composesongsheet.nix b/nix-system-configs/modules/secrets-config/sops-composesongsheet.nix index 3ef24f1..342ea2c 100644 --- a/nix-system-configs/modules/secrets-config/sops-composesongsheet.nix +++ b/nix-system-configs/modules/secrets-config/sops-composesongsheet.nix @@ -20,7 +20,7 @@ # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml"; sops.defaultSopsFile = ../../secrets/songsheet/secrets.yaml; # This will automatically import SSH keys as age keys - sops.age.sshKeyPaths = ["/home/songsheetprg/.ssh/id_ed25519.pub"]; + #sops.age.sshKeyPaths = ["/home/songsheetprg/.ssh/id_ed25519"]; # This is using an age key that is expected to already be in the filesystem sops.age.keyFile = "/var/lib/sops-nix/key.txt"; # This will generate a new key if the key specified above does not exist diff --git a/nix-system-configs/modules/secrets-config/sops-database.nix b/nix-system-configs/modules/secrets-config/sops-database.nix index f823287..e243528 100644 --- a/nix-system-configs/modules/secrets-config/sops-database.nix +++ b/nix-system-configs/modules/secrets-config/sops-database.nix @@ -20,7 +20,7 @@ # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml"; sops.defaultSopsFile = ../../secrets/songsheet/secrets.yaml; # This will automatically import SSH keys as age keys - sops.age.sshKeyPaths = ["/home/nixosdd/.ssh/id_ed25519.pub"]; + #sops.age.sshKeyPaths = ["/home/nixosdd/.ssh/id_ed25519"]; # This is using an age key that is expected to already be in the filesystem sops.age.keyFile = "/var/lib/sops-nix/key.txt"; # This will generate a new key if the key specified above does not exist diff --git a/nix-system-configs/modules/system_scripts/backup_mariadb.zsh b/nix-system-configs/modules/system_scripts/backup_mariadb.zsh deleted file mode 100755 index 1d500f5..0000000 --- a/nix-system-configs/modules/system_scripts/backup_mariadb.zsh +++ /dev/null @@ -1,23 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -TIMESTAMP=$(date +%Y%m%d%H%M%S) -BACKUP_DIR=$(mktemp -d) -trap 'rm -rf "$BACKUP_DIR"' EXIT - -gpg --batch --import "${GPG_KEY_FILE}" - -DATABASES=$(mysql -u root -e "SHOW DATABASES;" | grep -Ev "^(Database|information_schema|performance_schema|mysql|sys)$") - -for DB in $DATABASES; do - echo "Backing up MariaDB database: $DB" - - FILENAME="mariadb_${DB}_${TIMESTAMP}.sql.gz.gpg" - if mysqldump -u root "$DB" | gzip | gpg --batch --encrypt --recipient "${GPG_RECIPIENT}" > "$BACKUP_DIR/$FILENAME"; then - gsutil cp "$BACKUP_DIR/$FILENAME" "gs://${GCS_BUCKET}/mariadb/$FILENAME" - echo "Successfully uploaded encrypted $FILENAME" - else - echo "Failed to backup $DB" >&2 - exit 1 - fi -done diff --git a/nix-system-configs/modules/system_scripts/backup_postgresql.zsh b/nix-system-configs/modules/system_scripts/backup_postgresql.zsh deleted file mode 100755 index 53e4e68..0000000 --- a/nix-system-configs/modules/system_scripts/backup_postgresql.zsh +++ /dev/null @@ -1,24 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -TIMESTAMP=$(date +%Y%m%d%H%M%S) -BACKUP_DIR=$(mktemp -d) -trap 'rm -rf "$BACKUP_DIR"' EXIT - -# Import GPG key for encryption -gpg --batch --import "${GPG_KEY_FILE}" - -DATABASES=$(psql -U postgres -t -c "SELECT datname FROM pg_database WHERE datistemplate = false AND datname != 'postgres';" | grep -v '^$') - -for DB in $DATABASES; do - DB=$(echo "$DB" | xargs) - echo "Backing up PostgreSQL database: $DB" - FILENAME="pgsql_${DB}_${TIMESTAMP}.sql.gz.gpg" - if pg_dump -U postgres -d "$DB" | gzip | gpg --batch --encrypt --recipient "${GPG_RECIPIENT}" > "$BACKUP_DIR/$FILENAME"; then - gsutil cp "$BACKUP_DIR/$FILENAME" "gs://${GCS_BUCKET}/postgresql/$FILENAME" - echo "Successfully uploaded encrypted $FILENAME" - else - echo "Failed to backup $DB" >&2 - exit 1 - fi -done diff --git a/nix-system-configs/modules/system_scripts/gcloud_backup.nix b/nix-system-configs/modules/system_scripts/gcloud_backup.nix index 90e6dca..e2cf0e7 100644 --- a/nix-system-configs/modules/system_scripts/gcloud_backup.nix +++ b/nix-system-configs/modules/system_scripts/gcloud_backup.nix @@ -64,24 +64,59 @@ -----END PGP PUBLIC KEY BLOCK----- ''; - postgresBackupScript = pkgs.writeShellScript "backup-postgresql-wrapper" '' - export GOOGLE_APPLICATION_CREDENTIALS="${config.sops.secrets.gcloud_bucket.path}" - export GCS_BUCKET="${gcsBucket}" - export GPG_RECIPIENT="${gpgRecipient}" - export GPG_PUBLIC_KEY="${gpgPublicKey}" - export PATH="${lib.makeBinPath [pkgs.postgresql pkgs.gzip pkgs.google-cloud-sdk pkgs.gnupg]}:$PATH" + postgresBackupScript = pkgs.writeShellScript "backup-postgresql" '' + set -euo pipefail - exec ${./backup_postgresql.zsh} + export GOOGLE_APPLICATION_CREDENTIALS="${config.sops.secrets.gcloud_bucket.path}" + export PATH="${lib.makeBinPath [pkgs.postgresql pkgs.gzip pkgs.google-cloud-sdk pkgs.gnupg pkgs.coreutils pkgs.gnugrep]}:$PATH" + + TIMESTAMP=$(date +%Y%m%d%H%M%S) + BACKUP_DIR=$(mktemp -d) + trap 'rm -rf "$BACKUP_DIR"' EXIT + + gpg --batch --import "${gpgPublicKey}" + + DATABASES=$(psql -U postgres -t -c "SELECT datname FROM pg_database WHERE datistemplate = false AND datname != 'postgres';" | grep -v '^$') + + for DB in $DATABASES; do + DB=$(echo "$DB" | xargs) + echo "Backing up PostgreSQL database: $DB" + FILENAME="pgsql_''${DB}_''${TIMESTAMP}.sql.gz.gpg" + if pg_dump -U postgres -d "$DB" | gzip | gpg --batch --encrypt --recipient "${gpgRecipient}" > "$BACKUP_DIR/$FILENAME"; then + gsutil cp "$BACKUP_DIR/$FILENAME" "gs://${gcsBucket}/postgresql/$FILENAME" + echo "Successfully uploaded encrypted $FILENAME" + else + echo "Failed to backup $DB" >&2 + exit 1 + fi + done ''; - mariadbBackupScript = pkgs.writeShellScript "backup-mariadb-wrapper" '' - export GOOGLE_APPLICATION_CREDENTIALS="${config.sops.secrets.gcloud_bucket.path}" - export GCS_BUCKET="${gcsBucket}" - export GPG_RECIPIENT="${gpgRecipient}" - export GPG_PUBLIC_KEY="${gpgPublicKey}" - export PATH="${lib.makeBinPath [pkgs.mariadb pkgs.gzip pkgs.google-cloud-sdk pkgs.gnupg]}:$PATH" + mariadbBackupScript = pkgs.writeShellScript "backup-mariadb" '' + set -euo pipefail - exec ${./backup_mariadb.zsh} + export GOOGLE_APPLICATION_CREDENTIALS="${config.sops.secrets.gcloud_bucket.path}" + export PATH="${lib.makeBinPath [pkgs.mariadb pkgs.gzip pkgs.google-cloud-sdk pkgs.gnupg pkgs.coreutils pkgs.gnugrep]}:$PATH" + + TIMESTAMP=$(date +%Y%m%d%H%M%S) + BACKUP_DIR=$(mktemp -d) + trap 'rm -rf "$BACKUP_DIR"' EXIT + + gpg --batch --import "${gpgPublicKey}" + + DATABASES=$(mysql -u root -e "SHOW DATABASES;" | grep -Ev "^(Database|information_schema|performance_schema|mysql|sys)$") + + for DB in $DATABASES; do + echo "Backing up MariaDB database: $DB" + FILENAME="mariadb_''${DB}_''${TIMESTAMP}.sql.gz.gpg" + if mysqldump -u root "$DB" | gzip | gpg --batch --encrypt --recipient "${gpgRecipient}" > "$BACKUP_DIR/$FILENAME"; then + gsutil cp "$BACKUP_DIR/$FILENAME" "gs://${gcsBucket}/mariadb/$FILENAME" + echo "Successfully uploaded encrypted $FILENAME" + else + echo "Failed to backup $DB" >&2 + exit 1 + fi + done ''; in { systemd.services.backup-postgresql = { From 201a1d56fd49b3a3cea513c5e19aeff081944580 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 7 Feb 2026 23:56:11 +0100 Subject: [PATCH 16/25] Fix broken pipe --- nix-system-configs/modules/system_scripts/gcloud_backup.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nix-system-configs/modules/system_scripts/gcloud_backup.nix b/nix-system-configs/modules/system_scripts/gcloud_backup.nix index e2cf0e7..5916c7f 100644 --- a/nix-system-configs/modules/system_scripts/gcloud_backup.nix +++ b/nix-system-configs/modules/system_scripts/gcloud_backup.nix @@ -82,7 +82,7 @@ DB=$(echo "$DB" | xargs) echo "Backing up PostgreSQL database: $DB" FILENAME="pgsql_''${DB}_''${TIMESTAMP}.sql.gz.gpg" - if pg_dump -U postgres -d "$DB" | gzip | gpg --batch --encrypt --recipient "${gpgRecipient}" > "$BACKUP_DIR/$FILENAME"; then + if pg_dump -U postgres -d "$DB" | gzip | gpg --batch --trust-model always --encrypt --recipient "${gpgRecipient}" > "$BACKUP_DIR/$FILENAME"; then gsutil cp "$BACKUP_DIR/$FILENAME" "gs://${gcsBucket}/postgresql/$FILENAME" echo "Successfully uploaded encrypted $FILENAME" else @@ -109,7 +109,7 @@ for DB in $DATABASES; do echo "Backing up MariaDB database: $DB" FILENAME="mariadb_''${DB}_''${TIMESTAMP}.sql.gz.gpg" - if mysqldump -u root "$DB" | gzip | gpg --batch --encrypt --recipient "${gpgRecipient}" > "$BACKUP_DIR/$FILENAME"; then + if mysqldump -u root "$DB" | gzip | gpg --batch --trust-model always --encrypt --recipient "${gpgRecipient}" > "$BACKUP_DIR/$FILENAME"; then gsutil cp "$BACKUP_DIR/$FILENAME" "gs://${gcsBucket}/mariadb/$FILENAME" echo "Successfully uploaded encrypted $FILENAME" else From 92db9f8575f851fa4316655067ad9b921565264a Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sun, 8 Feb 2026 00:03:33 +0100 Subject: [PATCH 17/25] More dbugging/ --- .../modules/system_scripts/gcloud_backup.nix | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/nix-system-configs/modules/system_scripts/gcloud_backup.nix b/nix-system-configs/modules/system_scripts/gcloud_backup.nix index 5916c7f..9eba41b 100644 --- a/nix-system-configs/modules/system_scripts/gcloud_backup.nix +++ b/nix-system-configs/modules/system_scripts/gcloud_backup.nix @@ -96,20 +96,24 @@ set -euo pipefail export GOOGLE_APPLICATION_CREDENTIALS="${config.sops.secrets.gcloud_bucket.path}" + ## DEBUG ALL GOOGLE APPLICATION CREDENTIALS TO SEE IF THERE IS ANY ISSUE WITH THE CREDENTIALS + echo "GOOGLE_APPLICATION_CREDENTIALS: ${GOOGLE_APPLICATION_CREDENTIALS}" + export PATH="${lib.makeBinPath [pkgs.mariadb pkgs.gzip pkgs.google-cloud-sdk pkgs.gnupg pkgs.coreutils pkgs.gnugrep]}:$PATH" + TIMESTAMP=$(date +%Y%m%d%H%M%S) BACKUP_DIR=$(mktemp -d) trap 'rm -rf "$BACKUP_DIR"' EXIT gpg --batch --import "${gpgPublicKey}" - DATABASES=$(mysql -u root -e "SHOW DATABASES;" | grep -Ev "^(Database|information_schema|performance_schema|mysql|sys)$") + DATABASES=$(mariadb -u root -e "SHOW DATABASES;" | grep -Ev "^(Database|information_schema|performance_schema|mysql|sys)$") for DB in $DATABASES; do echo "Backing up MariaDB database: $DB" FILENAME="mariadb_''${DB}_''${TIMESTAMP}.sql.gz.gpg" - if mysqldump -u root "$DB" | gzip | gpg --batch --trust-model always --encrypt --recipient "${gpgRecipient}" > "$BACKUP_DIR/$FILENAME"; then + if mariadb-dump -u root "$DB" | gzip | gpg --batch --trust-model always --encrypt --recipient "${gpgRecipient}" > "$BACKUP_DIR/$FILENAME"; then gsutil cp "$BACKUP_DIR/$FILENAME" "gs://${gcsBucket}/mariadb/$FILENAME" echo "Successfully uploaded encrypted $FILENAME" else @@ -117,6 +121,7 @@ exit 1 fi done + ''; in { systemd.services.backup-postgresql = { From 0ad5eddb8d6fb00efb2d227ca193a60c55d50647 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sun, 8 Feb 2026 00:05:21 +0100 Subject: [PATCH 18/25] Nope wrong assumption --- nix-system-configs/modules/system_scripts/gcloud_backup.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nix-system-configs/modules/system_scripts/gcloud_backup.nix b/nix-system-configs/modules/system_scripts/gcloud_backup.nix index 9eba41b..2a2c9a9 100644 --- a/nix-system-configs/modules/system_scripts/gcloud_backup.nix +++ b/nix-system-configs/modules/system_scripts/gcloud_backup.nix @@ -97,7 +97,7 @@ export GOOGLE_APPLICATION_CREDENTIALS="${config.sops.secrets.gcloud_bucket.path}" ## DEBUG ALL GOOGLE APPLICATION CREDENTIALS TO SEE IF THERE IS ANY ISSUE WITH THE CREDENTIALS - echo "GOOGLE_APPLICATION_CREDENTIALS: ${GOOGLE_APPLICATION_CREDENTIALS}" + echo $GOOGLE_APPLICATION_CREDENTIALS export PATH="${lib.makeBinPath [pkgs.mariadb pkgs.gzip pkgs.google-cloud-sdk pkgs.gnupg pkgs.coreutils pkgs.gnugrep]}:$PATH" From 9a6d5cea0d1bfab524ac3393d58ca09668f149bf Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sun, 8 Feb 2026 00:33:23 +0100 Subject: [PATCH 19/25] Ok, more bug fixing. --- README.md | 18 +++++++++++++++++- nix-system-configs/modules/system/database.nix | 6 ++++++ .../modules/system_scripts/gcloud_backup.nix | 4 ---- 3 files changed, 23 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 227b58f..40cdbf9 100644 --- a/README.md +++ b/README.md @@ -21,4 +21,20 @@ TODO HECK - [ ] Read up more about how to a backup machine stuff and making it Nix-y... - [ ] Figure out my life - [ ] Setup Hardware Keys - - [ ] Setup a VPN (Likely OpenVPN) \ No newline at end of file + - [ ] Setup a VPN (Likely OpenVPN) + + +## NOTES FOR FUTURE + +``` +ServiceException: 401 Anonymous caller does not have storage.objects.list access to the Google Cloud Storage bucket. Permission 'storage.objects.list' denied on resource (or it may not exist). +``` + +You need to run +```zsh +sudo gcloud init +sudo gcloud auth activate-service-account --key-file /run/secrets/gcloud_bucket +``` + +Cheesus Crust, document this plz Google, whyyyyyyyyy + diff --git a/nix-system-configs/modules/system/database.nix b/nix-system-configs/modules/system/database.nix index 095c7c9..a4625c6 100644 --- a/nix-system-configs/modules/system/database.nix +++ b/nix-system-configs/modules/system/database.nix @@ -91,6 +91,12 @@ fastfetch hyfetch pgadmin4 + python3 + python3Packages.pip + python3Packages.setuptools + python3Packages.wheel + python3Packages.pyopenssl + python3Packages.cryptography google-cloud-sdk ]; diff --git a/nix-system-configs/modules/system_scripts/gcloud_backup.nix b/nix-system-configs/modules/system_scripts/gcloud_backup.nix index 2a2c9a9..adb4e4c 100644 --- a/nix-system-configs/modules/system_scripts/gcloud_backup.nix +++ b/nix-system-configs/modules/system_scripts/gcloud_backup.nix @@ -96,12 +96,8 @@ set -euo pipefail export GOOGLE_APPLICATION_CREDENTIALS="${config.sops.secrets.gcloud_bucket.path}" - ## DEBUG ALL GOOGLE APPLICATION CREDENTIALS TO SEE IF THERE IS ANY ISSUE WITH THE CREDENTIALS - echo $GOOGLE_APPLICATION_CREDENTIALS - export PATH="${lib.makeBinPath [pkgs.mariadb pkgs.gzip pkgs.google-cloud-sdk pkgs.gnupg pkgs.coreutils pkgs.gnugrep]}:$PATH" - TIMESTAMP=$(date +%Y%m%d%H%M%S) BACKUP_DIR=$(mktemp -d) trap 'rm -rf "$BACKUP_DIR"' EXIT From c0e252df71a2ac795e03a2fd817ca565feb78317 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sun, 8 Feb 2026 00:36:33 +0100 Subject: [PATCH 20/25] Triaging the weird issue. --- nix-system-configs/modules/system/database.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/nix-system-configs/modules/system/database.nix b/nix-system-configs/modules/system/database.nix index a4625c6..fdac7b9 100644 --- a/nix-system-configs/modules/system/database.nix +++ b/nix-system-configs/modules/system/database.nix @@ -95,7 +95,6 @@ python3Packages.pip python3Packages.setuptools python3Packages.wheel - python3Packages.pyopenssl python3Packages.cryptography google-cloud-sdk ]; From 0d903689a3183e6fb83754ae22d977c53b671680 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sun, 8 Feb 2026 00:40:43 +0100 Subject: [PATCH 21/25] Deprecated google cloud command replacement to fix the odd "module 'lib' has no attribute 'EVP_MD_CTX_new'" --- nix-system-configs/modules/system_scripts/gcloud_backup.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nix-system-configs/modules/system_scripts/gcloud_backup.nix b/nix-system-configs/modules/system_scripts/gcloud_backup.nix index adb4e4c..9ca9670 100644 --- a/nix-system-configs/modules/system_scripts/gcloud_backup.nix +++ b/nix-system-configs/modules/system_scripts/gcloud_backup.nix @@ -83,7 +83,7 @@ echo "Backing up PostgreSQL database: $DB" FILENAME="pgsql_''${DB}_''${TIMESTAMP}.sql.gz.gpg" if pg_dump -U postgres -d "$DB" | gzip | gpg --batch --trust-model always --encrypt --recipient "${gpgRecipient}" > "$BACKUP_DIR/$FILENAME"; then - gsutil cp "$BACKUP_DIR/$FILENAME" "gs://${gcsBucket}/postgresql/$FILENAME" + gcloud storage cp "$BACKUP_DIR/$FILENAME" "gs://${gcsBucket}/postgresql/$FILENAME" echo "Successfully uploaded encrypted $FILENAME" else echo "Failed to backup $DB" >&2 @@ -110,7 +110,7 @@ echo "Backing up MariaDB database: $DB" FILENAME="mariadb_''${DB}_''${TIMESTAMP}.sql.gz.gpg" if mariadb-dump -u root "$DB" | gzip | gpg --batch --trust-model always --encrypt --recipient "${gpgRecipient}" > "$BACKUP_DIR/$FILENAME"; then - gsutil cp "$BACKUP_DIR/$FILENAME" "gs://${gcsBucket}/mariadb/$FILENAME" + gcloud storage cp "$BACKUP_DIR/$FILENAME" "gs://${gcsBucket}/postgresql/$FILENAME" echo "Successfully uploaded encrypted $FILENAME" else echo "Failed to backup $DB" >&2 From 5e794336d84074ff18576288cdde23694408eeea Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sun, 8 Feb 2026 00:49:45 +0100 Subject: [PATCH 22/25] Force credential to be "alive", fixed a typo. --- nix-system-configs/modules/system_scripts/gcloud_backup.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/nix-system-configs/modules/system_scripts/gcloud_backup.nix b/nix-system-configs/modules/system_scripts/gcloud_backup.nix index 9ca9670..379690b 100644 --- a/nix-system-configs/modules/system_scripts/gcloud_backup.nix +++ b/nix-system-configs/modules/system_scripts/gcloud_backup.nix @@ -69,6 +69,7 @@ export GOOGLE_APPLICATION_CREDENTIALS="${config.sops.secrets.gcloud_bucket.path}" export PATH="${lib.makeBinPath [pkgs.postgresql pkgs.gzip pkgs.google-cloud-sdk pkgs.gnupg pkgs.coreutils pkgs.gnugrep]}:$PATH" + gcloud auth activate-service-account --key-file="$GOOGLE_APPLICATION_CREDENTIALS" TIMESTAMP=$(date +%Y%m%d%H%M%S) BACKUP_DIR=$(mktemp -d) @@ -97,6 +98,7 @@ export GOOGLE_APPLICATION_CREDENTIALS="${config.sops.secrets.gcloud_bucket.path}" export PATH="${lib.makeBinPath [pkgs.mariadb pkgs.gzip pkgs.google-cloud-sdk pkgs.gnupg pkgs.coreutils pkgs.gnugrep]}:$PATH" + gcloud auth activate-service-account --key-file="$GOOGLE_APPLICATION_CREDENTIALS" TIMESTAMP=$(date +%Y%m%d%H%M%S) BACKUP_DIR=$(mktemp -d) @@ -110,7 +112,7 @@ echo "Backing up MariaDB database: $DB" FILENAME="mariadb_''${DB}_''${TIMESTAMP}.sql.gz.gpg" if mariadb-dump -u root "$DB" | gzip | gpg --batch --trust-model always --encrypt --recipient "${gpgRecipient}" > "$BACKUP_DIR/$FILENAME"; then - gcloud storage cp "$BACKUP_DIR/$FILENAME" "gs://${gcsBucket}/postgresql/$FILENAME" + gcloud storage cp "$BACKUP_DIR/$FILENAME" "gs://${gcsBucket}/mariadb/$FILENAME" echo "Successfully uploaded encrypted $FILENAME" else echo "Failed to backup $DB" >&2 From 23fa0c13979558ef0edf3f286b1494da20c1c08d Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sun, 8 Feb 2026 00:51:31 +0100 Subject: [PATCH 23/25] Oeh --- nix-system-configs/modules/system_scripts/gcloud_backup.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nix-system-configs/modules/system_scripts/gcloud_backup.nix b/nix-system-configs/modules/system_scripts/gcloud_backup.nix index 379690b..cd232af 100644 --- a/nix-system-configs/modules/system_scripts/gcloud_backup.nix +++ b/nix-system-configs/modules/system_scripts/gcloud_backup.nix @@ -69,7 +69,7 @@ export GOOGLE_APPLICATION_CREDENTIALS="${config.sops.secrets.gcloud_bucket.path}" export PATH="${lib.makeBinPath [pkgs.postgresql pkgs.gzip pkgs.google-cloud-sdk pkgs.gnupg pkgs.coreutils pkgs.gnugrep]}:$PATH" - gcloud auth activate-service-account --key-file="$GOOGLE_APPLICATION_CREDENTIALS" + sudo gcloud auth activate-service-account --key-file="$GOOGLE_APPLICATION_CREDENTIALS" TIMESTAMP=$(date +%Y%m%d%H%M%S) BACKUP_DIR=$(mktemp -d) @@ -98,7 +98,7 @@ export GOOGLE_APPLICATION_CREDENTIALS="${config.sops.secrets.gcloud_bucket.path}" export PATH="${lib.makeBinPath [pkgs.mariadb pkgs.gzip pkgs.google-cloud-sdk pkgs.gnupg pkgs.coreutils pkgs.gnugrep]}:$PATH" - gcloud auth activate-service-account --key-file="$GOOGLE_APPLICATION_CREDENTIALS" + sudo gcloud auth activate-service-account --key-file="$GOOGLE_APPLICATION_CREDENTIALS" TIMESTAMP=$(date +%Y%m%d%H%M%S) BACKUP_DIR=$(mktemp -d) From c2e5f113b432d716633f6951a176f78685a1fe1b Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sun, 8 Feb 2026 00:53:09 +0100 Subject: [PATCH 24/25] More triaging. --- nix-system-configs/modules/system_scripts/gcloud_backup.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nix-system-configs/modules/system_scripts/gcloud_backup.nix b/nix-system-configs/modules/system_scripts/gcloud_backup.nix index cd232af..a4f9dfd 100644 --- a/nix-system-configs/modules/system_scripts/gcloud_backup.nix +++ b/nix-system-configs/modules/system_scripts/gcloud_backup.nix @@ -69,7 +69,7 @@ export GOOGLE_APPLICATION_CREDENTIALS="${config.sops.secrets.gcloud_bucket.path}" export PATH="${lib.makeBinPath [pkgs.postgresql pkgs.gzip pkgs.google-cloud-sdk pkgs.gnupg pkgs.coreutils pkgs.gnugrep]}:$PATH" - sudo gcloud auth activate-service-account --key-file="$GOOGLE_APPLICATION_CREDENTIALS" + #gcloud auth activate-service-account --key-file="$GOOGLE_APPLICATION_CREDENTIALS" TIMESTAMP=$(date +%Y%m%d%H%M%S) BACKUP_DIR=$(mktemp -d) @@ -98,7 +98,7 @@ export GOOGLE_APPLICATION_CREDENTIALS="${config.sops.secrets.gcloud_bucket.path}" export PATH="${lib.makeBinPath [pkgs.mariadb pkgs.gzip pkgs.google-cloud-sdk pkgs.gnupg pkgs.coreutils pkgs.gnugrep]}:$PATH" - sudo gcloud auth activate-service-account --key-file="$GOOGLE_APPLICATION_CREDENTIALS" + #sudo gcloud auth activate-service-account --key-file="$GOOGLE_APPLICATION_CREDENTIALS" TIMESTAMP=$(date +%Y%m%d%H%M%S) BACKUP_DIR=$(mktemp -d) From 54a3be635ba87e37dc3ea9cc7574b79b9b152a0c Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sun, 8 Feb 2026 00:58:27 +0100 Subject: [PATCH 25/25] Jfc, that was annoying thought typo, changed the systemd user to root for postgres backup. --- nix-system-configs/modules/system_scripts/gcloud_backup.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nix-system-configs/modules/system_scripts/gcloud_backup.nix b/nix-system-configs/modules/system_scripts/gcloud_backup.nix index a4f9dfd..f2c170a 100644 --- a/nix-system-configs/modules/system_scripts/gcloud_backup.nix +++ b/nix-system-configs/modules/system_scripts/gcloud_backup.nix @@ -126,7 +126,7 @@ in { description = "Backup PostgresSQL databases to GCS"; serviceConfig = { Type = "oneshot"; - User = "postgres"; + User = "root"; ExecStart = "${postgresBackupScript}"; }; };