Added extra notes, manual database restore script (preliminary) and added teamspeak.nix configuration.
This commit is contained in:
parent
ee11c9171b
commit
39e044b757
GPG key ID:
087F0A95E5766D72
3 changed files with 220 additions and 0 deletions
7
nix-system-configs/modules/songsheet/wavelog/notes.md
Normal file
7
nix-system-configs/modules/songsheet/wavelog/notes.md
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
How to change passwords in case of a major heck up
|
||||
```zsh
|
||||
sudo podman exec -it -u www-data partdb sh
|
||||
# inside container:
|
||||
cd /var/www/html
|
||||
php bin/console partdb:users:set-password USERNAME
|
||||
```
|
||||
66
nix-system-configs/modules/system/teamspeak.nix
Normal file
66
nix-system-configs/modules/system/teamspeak.nix
Normal file
|
|
@ -0,0 +1,66 @@
|
|||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
options.local = {
|
||||
hostname = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "nixos-default";
|
||||
description = "System hostname";
|
||||
};
|
||||
username = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "user";
|
||||
description = "Primary user username";
|
||||
};
|
||||
userDescription = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "NixOS User";
|
||||
description = "Primary user description";
|
||||
};
|
||||
address = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "10.1.1.100";
|
||||
description = "Static IP address";
|
||||
};
|
||||
};
|
||||
|
||||
imports = [
|
||||
./modules/desktop-manager/sway_greetd_homemanager.nix
|
||||
./modules/local/hostname_username.nix
|
||||
./modules/local/networking_local.nix
|
||||
./modules/bootloader/seabios-assigned-iso-at-birth.nix
|
||||
./modules/lix-default.nix
|
||||
# Optionally: ./modules/toolsets/remote_building.nix
|
||||
#
|
||||
#
|
||||
## Compose modules for Portainer service
|
||||
./modules/songsheet/wavelog/docker-compose.nix
|
||||
./modules/secrets-config/sops-composesongsheet.nix
|
||||
];
|
||||
|
||||
config = {
|
||||
local.hostname = "christine-teamspeak";
|
||||
local.username = "teamspeak_christine";
|
||||
local.userDescription = "NixOS Teamspeak Service";
|
||||
local.address = "10.1.1.248";
|
||||
|
||||
services.teamspeak3 = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
80
|
||||
443
|
||||
];
|
||||
networking.firewall.allowedUDPPorts = [
|
||||
80
|
||||
443
|
||||
];
|
||||
|
||||
system.stateVersion = "25.11";
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,147 @@
|
|||
#!/usr/bin/env zsh
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
PATH_TO_BACKUPGPG_KEY=${PATH_TO_BACKUPGPG_KEY:-}
|
||||
PATH_TO_BACKUP_FILE=${PATH_TO_BACKUP_FILE:-}
|
||||
PATH_TO_OUTPUT_DIR=${PATH_TO_OUTPUT_DIR:-}
|
||||
|
||||
KEEP=false
|
||||
|
||||
# TIL You can do these kind of scripts.
|
||||
usage() {
|
||||
cat <<EOF
|
||||
Usage: $0 [-f <backup-file>] [-k <private-key-file>] [-o <output-dir>] [--keep]
|
||||
|
||||
Decrypt and unpack a .gz.gpg backup file for inspection. The script will
|
||||
create a temporary GNUPGHOME (if a key is provided), decrypt the file, and
|
||||
if needed gunzip it to produce a .sql file. The resulting SQL file path will
|
||||
be printed and a short preview will be shown.
|
||||
|
||||
Options:
|
||||
-f <file> Path to the .sql.gz.gpg backup file (or set PATH_TO_BACKUP_FILE)
|
||||
-k <key> Path to a private key file to import (optional; or set PATH_TO_BACKUPGPG_KEY)
|
||||
-o <dir> Output directory for the final .sql file (defaults to current working directory)
|
||||
--keep Keep temporary files (do not delete temp GNUPGHOME/dir)
|
||||
-h, --help Show this message
|
||||
EOF
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Simple arg parsing to allow flags
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
-f)
|
||||
PATH_TO_BACKUP_FILE="$2"; shift 2;;
|
||||
-k)
|
||||
PATH_TO_BACKUPGPG_KEY="$2"; shift 2;;
|
||||
-o)
|
||||
PATH_TO_OUTPUT_DIR="$2"; shift 2;;
|
||||
--keep)
|
||||
KEEP=true; shift;;
|
||||
-h|--help)
|
||||
usage;;
|
||||
*)
|
||||
echo "Unknown argument: $1" >&2; usage;;
|
||||
esac
|
||||
done
|
||||
|
||||
if [[ -z "$PATH_TO_BACKUP_FILE" ]]; then
|
||||
echo "Error: no backup file provided." >&2
|
||||
usage
|
||||
fi
|
||||
|
||||
if [[ ! -f "$PATH_TO_BACKUP_FILE" ]]; then
|
||||
echo "Error: backup file does not exist: $PATH_TO_BACKUP_FILE" >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
command -v gpg >/dev/null 2>&1 || { echo "gpg not found in PATH" >&2; exit 3; }
|
||||
command -v gunzip >/dev/null 2>&1 || { echo "gunzip not found in PATH" >&2; exit 3; }
|
||||
command -v file >/dev/null 2>&1 || { echo "file command not found in PATH" >&2; exit 3; }
|
||||
|
||||
TMPDIR=$(mktemp -d)
|
||||
trap '[[ "$KEEP" = false ]] && rm -rf "$TMPDIR"' EXIT
|
||||
|
||||
# If a key is provided, use an isolated GNUPGHOME so we don't touch the user's keyring.
|
||||
if [[ -n "$PATH_TO_BACKUPGPG_KEY" ]]; then
|
||||
if [[ ! -f "$PATH_TO_BACKUPGPG_KEY" ]]; then
|
||||
echo "Private key file not found: $PATH_TO_BACKUPGPG_KEY" >&2
|
||||
exit 4
|
||||
fi
|
||||
export GNUPGHOME="$TMPDIR/gnupg"
|
||||
# Create GNUPGHOME and explicitly set secure permissions
|
||||
mkdir -p "$GNUPGHOME"
|
||||
chmod 0700 "$GNUPGHOME"
|
||||
echo "Importing provided private key into temporary GNUPGHOME..."
|
||||
gpg --batch --import "$PATH_TO_BACKUPGPG_KEY" >/dev/null 2>&1
|
||||
fi
|
||||
|
||||
# Determine output directory: prefer PATH_TO_OUTPUT_DIR, otherwise current directory
|
||||
if [[ -n "$PATH_TO_OUTPUT_DIR" ]]; then
|
||||
OUTDIR="$PATH_TO_OUTPUT_DIR"
|
||||
else
|
||||
OUTDIR="$(pwd)"
|
||||
fi
|
||||
|
||||
mkdir -p "$OUTDIR"
|
||||
|
||||
# Keep decrypted intermediate in TMPDIR, final .sql in OUTDIR (PWD by default)
|
||||
DECRYPTED="$TMPDIR/backup.decrypted"
|
||||
|
||||
# Derive a reasonable final filename from the backup file name
|
||||
orig_base=$(basename -- "$PATH_TO_BACKUP_FILE")
|
||||
name_no_gpg=${orig_base%.gpg}
|
||||
name_no_gz=${name_no_gpg%.gz}
|
||||
if [[ "$name_no_gz" == *.sql ]]; then
|
||||
final_name="$name_no_gz"
|
||||
else
|
||||
final_name="${name_no_gz}.sql"
|
||||
fi
|
||||
FINAL_SQL="$OUTDIR/$final_name"
|
||||
# If file exists, append timestamp to avoid accidental overwrite
|
||||
if [[ -e "$FINAL_SQL" ]]; then
|
||||
ts=$(date +%Y%m%d%H%M%S)
|
||||
FINAL_SQL="$OUTDIR/${name_no_gz}.${ts}.sql"
|
||||
echo "Notice: output file already existed; writing to $FINAL_SQL"
|
||||
fi
|
||||
|
||||
echo "Decrypting: $PATH_TO_BACKUP_FILE"
|
||||
# Decrypt to a temporary file. gpg will prompt for passphrase if needed (user must be present)
|
||||
if ! gpg --batch --yes --decrypt --output "$DECRYPTED" "$PATH_TO_BACKUP_FILE"; then
|
||||
echo "gpg decryption failed" >&2
|
||||
exit 5
|
||||
fi
|
||||
|
||||
# Detect if the decrypted file is gzip compressed
|
||||
if file --brief --mime-type "$DECRYPTED" | grep -q gzip; then
|
||||
echo "Detected gzip compressed payload; decompressing to: $FINAL_SQL"
|
||||
if ! gunzip -c "$DECRYPTED" > "$FINAL_SQL"; then
|
||||
echo "gunzip failed" >&2
|
||||
exit 6
|
||||
fi
|
||||
else
|
||||
# Not gzip: assume plain SQL or other plain text
|
||||
echo "Writing decrypted payload to: $FINAL_SQL"
|
||||
cp "$DECRYPTED" "$FINAL_SQL"
|
||||
fi
|
||||
|
||||
echo "Unpacked SQL available at: $FINAL_SQL"
|
||||
|
||||
# Show a short preview
|
||||
echo
|
||||
echo "--- File preview (first 80 lines) ---"
|
||||
head -n 80 "$FINAL_SQL" || true
|
||||
echo "--- end preview ---"
|
||||
|
||||
echo
|
||||
if [[ "$KEEP" = true ]]; then
|
||||
echo "Temporary files (including GNUPGHOME) retained under: $TMPDIR"
|
||||
echo "Final SQL file retained at: $FINAL_SQL"
|
||||
else
|
||||
echo "Temporary files (excluding final SQL) were stored under: $TMPDIR (removed on exit)"
|
||||
echo "Final SQL file is at: $FINAL_SQL"
|
||||
fi
|
||||
|
||||
# Print final path so callers can copy it if they used --keep or scripting
|
||||
echo "$FINAL_SQL"
|
||||
Loading…
Add table
Add a link
Reference in a new issue