From patchwork Wed May 1 21:15:07 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Giacomo Leidi X-Patchwork-Id: 63765 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id 766E127BBE2; Wed, 1 May 2024 22:16:12 +0100 (BST) X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,SPF_HELO_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.6 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTPS id 62F3327BBE9 for ; Wed, 1 May 2024 22:16:11 +0100 (BST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1s2HIu-0002vf-18; Wed, 01 May 2024 17:15:52 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1s2HIj-0002h6-6X for guix-patches@gnu.org; Wed, 01 May 2024 17:15:45 -0400 Received: from debbugs.gnu.org ([2001:470:142:5::43]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1s2HIi-0006AA-FJ for guix-patches@gnu.org; Wed, 01 May 2024 17:15:40 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1s2HJ3-0000wa-Pe for guix-patches@gnu.org; Wed, 01 May 2024 17:16:01 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#69513] [PATCH v3] services: Add restic-backup service. References: <3afc07b0f3e6663a9fb64203544bce1659f97364.1709412684.git.goodoldpaul@autistici.org> In-Reply-To: <3afc07b0f3e6663a9fb64203544bce1659f97364.1709412684.git.goodoldpaul@autistici.org> Resent-From: Giacomo Leidi Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Wed, 01 May 2024 21:16:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 69513 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 69513@debbugs.gnu.org Cc: Giacomo Leidi Received: via spool by 69513-submit@debbugs.gnu.org id=B69513.17145981503622 (code B ref 69513); Wed, 01 May 2024 21:16:01 +0000 Received: (at 69513) by debbugs.gnu.org; 1 May 2024 21:15:50 +0000 Received: from localhost ([127.0.0.1]:39491 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1s2HIr-0000wM-81 for submit@debbugs.gnu.org; Wed, 01 May 2024 17:15:50 -0400 Received: from confino.investici.org ([93.190.126.19]:60541) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1s2HIn-0000wE-Sk for 69513@debbugs.gnu.org; Wed, 01 May 2024 17:15:47 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=autistici.org; s=stigmate; t=1714598123; bh=o1zfNR0Ndts9C1FOYNxTLCCUArmJMK/0rtAVLQ4CZ7Q=; h=From:To:Cc:Subject:Date:From; b=Itcny7GlmxQNYNaXTBS+B0PofdQlWZx8o+aLZLbjldlifFzIKU7Szh2rw1GZHqvKQ /RDIX60VYoL5z6SaFw90R/db4c0kDH0843WGGJtvjfi1nNQYY6aaUpMooSs5ebEA0j HwkyZz/jdymyDUwhTC3QMstPG/XdsSCO206xY9Ow= Received: from mx1.investici.org (unknown [127.0.0.1]) by confino.investici.org (Postfix) with ESMTP id 4VV8wq2nftz11MZ; Wed, 1 May 2024 21:15:23 +0000 (UTC) Received: from [93.190.126.19] (mx1.investici.org [93.190.126.19]) (Authenticated sender: goodoldpaul@autistici.org) by localhost (Postfix) with ESMTPSA id 4VV8wq1zcXz112x; Wed, 1 May 2024 21:15:23 +0000 (UTC) Date: Wed, 1 May 2024 23:15:07 +0200 Message-ID: <4d1b9e86fa4c0f70b30d45de5a29ec19b41c0e8f.1714598106.git.goodoldpaul@autistici.org> X-Mailer: git-send-email 2.41.0 MIME-Version: 1.0 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-to: Giacomo Leidi X-ACL-Warn: , Giacomo Leidi via Guix-patches X-Patchwork-Original-From: Giacomo Leidi via Guix-patches via From: Giacomo Leidi Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org X-getmail-retrieved-from-mailbox: Patches * gnu/services/backup.scm: New file. * gnu/local.mk: Add this. * doc/guix.texi: Document this. Change-Id: I9efd5559bb445b484107a7c27c2d0a65ccad1e66 --- doc/guix.texi | 112 +++++++++++++++++++ gnu/local.mk | 1 + gnu/services/backup.scm | 236 ++++++++++++++++++++++++++++++++++++++++ 3 files changed, 349 insertions(+) create mode 100644 gnu/services/backup.scm base-commit: 7d4ae2fca723114fb1df56de33b82177fbc4d0a6 diff --git a/doc/guix.texi b/doc/guix.texi index 3f5d4e7f0d..1b52c43c34 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -40946,6 +40946,118 @@ Miscellaneous Services @c End of auto-generated fail2ban documentation. +@cindex Backup +@subsubheading Backup Services + +The @code{(gnu services backup)} module offers services for backing up +file system trees. For now, it provides the @code{restic-backup-service-type}. + +With @code{restic-backup-service-type}, you can periodically back up +directories and files with @uref{https://restic.net/, Restic}, which +supports end-to-end encryption and deduplication. Consider the +following configuration: + +@lisp +(operating-system + + (packages (list "rclone")) + + (services + (list + (service restic-backup-service-type + (restic-backup-configuration + (jobs + (list (restic-backup-job + (name "remote-ftp") + (repository "rclone:remote-ftp:backup/restic") + (password-file "/root/.restic") + ;; Every day at 23. + (schedule "0 23 * * *") + (files '("/root/.restic" + "/root/.config/rclone" + "/etc/ssh/ssh_host_rsa_key" + "/etc/ssh/ssh_host_rsa_key.pub" + "/etc/guix/signing-key.pub" + "/etc/guix/signing-key.sec")))))))))) +@end lisp + +Each @code{restic-backup-job} translates to an mcron job which sets the +@env{RESTIC_PASSWORD} environment variable by reading the first line of +@code{password-file} and runs @command{restic backup}. + +The @code{restic-backup-service-type} installs as well @code{restic-guix} +to the system profile, a @code{restic} utility wrapper that allows for easier +interaction with the Guix configured backup jobs. For example the following +could be used to instantaneusly trigger a backup for the above shown +configuration, without waiting for the scheduled job: + +@example +restic-guix backup remote-ftp +@end example + +@c %start of fragment + +@deftp {Data Type} restic-backup-configuration +Available @code{restic-backup-configuration} fields are: + +@table @asis +@item @code{jobs} (default: @code{'()}) (type: list-of-restic-backup-jobs) +The list of backup jobs for the current system. + +@end table + +@end deftp + + +@c %end of fragment + +@c %start of fragment + +@deftp {Data Type} restic-backup-job +Available @code{restic-backup-job} fields are: + +@table @asis +@item @code{restic} (default: @code{restic}) (type: package) +The restic package to be used for the current job. + +@item @code{user} (default: @code{"root"}) (type: string) +The user used for running the current job. + +@item @code{repository} (type: string) +The restic repository target of this job. + +@item @code{name} (type: string) +A string denoting a name for this job. + +@item @code{password-file} (type: string) +Name of the password file, readable by the configured @code{user}, +that will be used to set the @env{RESTIC_PASSWORD} environment variable +for the current job. + +@item @code{schedule} (type: gexp-or-string) +A string or a gexp that will be passed as time specification in the +mcron job specification (@pxref{Syntax, mcron job specifications,, +mcron,GNU@tie{}mcron}). + +@item @code{files} (default: @code{'()}) (type: list-of-lowerables) +The list of files or directories to be backed up. It must be a list of +values that can be lowered to strings. + +@item @code{verbose?} (default: @code{#f}) (type: boolean) +Whether to enable verbose output for the current backup job. + +@item @code{extra-flags} (default: @code{'()}) (type: list-of-lowerables) +A list of values that are lowered to strings. These will be passed as +command-line arguments to the current job @command{restic backup} +invokation. + +@end table + +@end deftp + + +@c %end of fragment + @node Setuid Programs @section Setuid Programs diff --git a/gnu/local.mk b/gnu/local.mk index f1dab53f2b..bb17ef182a 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -699,6 +699,7 @@ GNU_SYSTEM_MODULES = \ %D%/services/auditd.scm \ %D%/services/avahi.scm \ %D%/services/base.scm \ + %D%/services/backup.scm \ %D%/services/certbot.scm \ %D%/services/cgit.scm \ %D%/services/ci.scm \ diff --git a/gnu/services/backup.scm b/gnu/services/backup.scm new file mode 100644 index 0000000000..555e9fc959 --- /dev/null +++ b/gnu/services/backup.scm @@ -0,0 +1,236 @@ +;;; GNU Guix --- Functional package management for GNU +;;; Copyright © 2024 Giacomo Leidi +;;; +;;; This file is part of GNU Guix. +;;; +;;; GNU Guix is free software; you can redistribute it and/or modify it +;;; under the terms of the GNU General Public License as published by +;;; the Free Software Foundation; either version 3 of the License, or (at +;;; your option) any later version. +;;; +;;; GNU Guix is distributed in the hope that it will be useful, but +;;; WITHOUT ANY WARRANTY; without even the implied warranty of +;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +;;; GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License +;;; along with GNU Guix. If not, see . + +(define-module (gnu services backup) + #:use-module (gnu packages backup) + #:use-module (gnu services) + #:use-module (gnu services configuration) + #:use-module (gnu services mcron) + #:use-module (guix build-system copy) + #:use-module (guix gexp) + #:use-module ((guix licenses) + #:prefix license:) + #:use-module (guix modules) + #:use-module (guix packages) + #:use-module (srfi srfi-1) + #:export (restic-backup-job + restic-backup-job? + restic-backup-job-fields + restic-backup-job-restic + restic-backup-job-user + restic-backup-job-name + restic-backup-job-repository + restic-backup-job-password-file + restic-backup-job-schedule + restic-backup-job-files + restic-backup-job-verbose? + restic-backup-job-extra-flags + + restic-backup-configuration + restic-backup-configuration? + restic-backup-configuration-fields + restic-backup-configuration-jobs + + restic-backup-job-program + restic-backup-job->mcron-job + restic-guix + restic-guix-wrapper-package + restic-backup-service-profile + restic-backup-service-type)) + +(define (gexp-or-string? value) + (or (gexp? value) + (string? value))) + +(define (lowerable? value) + (or (file-like? value) + (gexp-or-string? value))) + +(define list-of-lowerables? + (list-of lowerable?)) + +(define-configuration/no-serialization restic-backup-job + (restic + (package restic) + "The restic package to be used for the current job.") + (user + (string "root") + "The user used for running the current job.") + (name + (string) + "A string denoting a name for this job.") + (repository + (string) + "The restic repository target of this job.") + (password-file + (string) + "Name of the password file, readable by the configured @code{user}, that +will be used to set the @code{RESTIC_PASSWORD} environment variable for the +current job.") + (schedule + (gexp-or-string) + "A string or a gexp that will be passed as time specification in the mcron +job specification (@pxref{Syntax, mcron job specifications,, mcron, +GNU@tie{}mcron}).") + (files + (list-of-lowerables '()) + "The list of files or directories to be backed up. It must be a list of +values that can be lowered to strings.") + (verbose? + (boolean #f) + "Whether to enable verbose output for the current backup job.") + (extra-flags + (list-of-lowerables '()) + "A list of values that are lowered to strings. These will be passed as +command-line arguments to the current job @command{restic backup} invokation.")) + +(define list-of-restic-backup-jobs? + (list-of restic-backup-job?)) + +(define-configuration/no-serialization restic-backup-configuration + (jobs + (list-of-restic-backup-jobs '()) + "The list of backup jobs for the current system.")) + +(define (restic-backup-job-program config) + (let ((restic + (file-append (restic-backup-job-restic config) "/bin/restic")) + (repository + (restic-backup-job-repository config)) + (password-file + (restic-backup-job-password-file config)) + (files + (restic-backup-job-files config)) + (extra-flags + (restic-backup-job-extra-flags config)) + (verbose + (if (restic-backup-job-verbose? config) + '("--verbose") + '()))) + (program-file + "restic-backup-job.scm" + #~(begin + (use-modules (ice-9 popen) + (ice-9 rdelim)) + (setenv "RESTIC_PASSWORD" + (with-input-from-file #$password-file read-line)) + + (execlp #$restic #$restic #$@verbose + "-r" #$repository + #$@extra-flags + "backup" #$@files))))) + +(define (restic-guix jobs) + (program-file + "restic-guix" + #~(begin + (use-modules (ice-9 match) + (srfi srfi-1)) + + (define names '#$(map restic-backup-job-name jobs)) + (define programs '#$(map restic-backup-job-program jobs)) + + (define (get-program name) + (define idx + (list-index (lambda (n) (string=? n name)) names)) + (unless idx + (error (string-append "Unknown job name " name "\n\n" + "Possible job names are: " + (string-join names " ")))) + (list-ref programs idx)) + + (define (backup args) + (define name (third args)) + (define program (get-program name)) + (execlp program program)) + + (define (validate-args args) + (when (not (>= (length args) 3)) + (error (string-append "Usage: " (basename (car args)) + " backup NAME")))) + + (define (main args) + (validate-args args) + (define action (second args)) + (match action + ("backup" + (backup args)) + (_ + (error (string-append "Unknown action: " action))))) + + (main (command-line))))) + +(define (restic-backup-job->mcron-job config) + (let ((user + (restic-backup-job-user config)) + (schedule + (restic-backup-job-schedule config)) + (name + (restic-backup-job-name config))) + #~(job #$schedule + #$(string-append "restic-guix backup " name) + #:user #$user))) + +(define (restic-guix-wrapper-package jobs) + (package + (name "restic-backup-service-wrapper") + (version "0.0.0") + (source (restic-guix jobs)) + (build-system copy-build-system) + (arguments + (list #:install-plan #~'(("./" "/bin")))) + (home-page "https://restic.net") + (synopsis + "Easily interact from the CLI with Guix configured backups") + (description + "This package provides a simple wrapper around @code{restic}, handled +by the @code{restic-backup-service-type}. It allows for easily interacting +with Guix configured backup jobs, for example for manually triggering a backup +without waiting for the scheduled job to run.") + (license license:gpl3+))) + +(define restic-backup-service-profile + (lambda (config) + (define jobs (restic-backup-configuration-jobs config)) + (if (> (length jobs) 0) + (list + (restic-guix-wrapper-package jobs)) + '()))) + +(define restic-backup-service-type + (service-type (name 'restic-backup) + (extensions + (list + (service-extension profile-service-type + restic-backup-service-profile) + (service-extension mcron-service-type + (lambda (config) + (map restic-backup-job->mcron-job + (restic-backup-configuration-jobs + config)))))) + (compose concatenate) + (extend + (lambda (config jobs) + (restic-backup-configuration + (inherit config) + (jobs (append (restic-backup-configuration-jobs config) + jobs))))) + (default-value (restic-backup-configuration)) + (description + "This service configures @code{mcron} jobs for running backups +with @code{restic}.")))