defiant: Enable postgresql backups

hosts/defiant/services/gitea.nix

@@ -58,5 +58,7 @@ in {
 
     systemd.services.gitea.serviceConfig.WorkingDirectory = lib.mkForce "${cfg.stateDir}/work";
 
+    services.postgresqlBackup.databases = [ "gitea" ];
+
     networking.firewall.allowedTCPPorts = [ sshPort ];
 }

hosts/defiant/services/hedgedoc.nix

@@ -95,6 +95,8 @@ in {
     }];
   };
 
+  services.postgresqlBackup.databases = [ "hedgedoc" ];
+
   services.nginx.virtualHosts."${domain}" = {
     listen = [
       { addr = "192.168.10.175"; port = 43443; ssl = true; }

hosts/defiant/services/matrix/synapse.nix

@@ -72,6 +72,8 @@
     };
   };
 
+  services.postgresqlBackup.databases = [ "matrix-synapse" ];
+
   services.redis.servers."".enable = true;
 
   services.nginx.virtualHosts."matrix.feal.no" = {

hosts/defiant/services/metrics/loki.nix

@@ -71,4 +71,8 @@ in {
       };
     };
   };
+
+  networking.firewall.allowedTCPPorts = [
+    cfg.configuration.server.http_listen_port
+  ];
 }

hosts/defiant/services/microbin.nix

@@ -3,7 +3,6 @@ let
   cfg = config.services.microbin;
   domain = "p.feal.no";
   address = "127.0.1.2";
-  max_upload_mb = 1024;
   port = 5006;
 in {
 
@@ -14,14 +13,13 @@ in {
       MICROBIN_BIND = address;
       MICROBIN_DISABLE_TELEMETRY = true;
       MICROBIN_ENABLE_BURN_AFTER = true;
-      MICROBIN_ETERNAL_PASTA = true;
       MICROBIN_FOOTER_TEXT = "Be nice or go away";
-      MICROBIN_MAX_FILE_SIZE_ENCRYPTED_MB = max_upload_mb;
+      MICROBIN_NO_FILE_UPLOAD = true;
-      MICROBIN_MAX_FILE_SIZE_UNENCRYPTED_MB = max_upload_mb;
+      MICROBIN_NO_LISTING = true;
       MICROBIN_PORT = port;
       MICROBIN_PUBLIC_PATH = "https://${domain}/";
       MICROBIN_QR = true;
-      MICROBIN_TITLE = "felixalbs pasta collection";
+      MICROBIN_TITLE = "Temporary pasta collection";
     };
   };
 
@@ -36,10 +34,6 @@ in {
       { addr = "192.168.10.175"; port = 43080; ssl = false; }
     ];
 
-    extraConfig = ''
-      client_max_body_size ${toString max_upload_mb}M;
-    '';
-
     locations."/" = {
       proxyPass = "http://${address}:${toString port}";
     };

hosts/defiant/services/postgresql.nix

@@ -6,10 +6,12 @@
   };
 
   services.postgresqlBackup = {
-    # enable = true;
+    enable = true;
     location = "/data/backup/postgresql/";
     startAt = "*-*-* 03:15:00";
-    backupAll = true;
+
+    # Each service is registered in its own configuration file
+    databases = [ ];
   };
 
   environment.systemPackages = [ config.services.postgresql.package ];

hosts/defiant/services/vaultwarden.nix

@@ -35,6 +35,8 @@ in {
     }];
   };
 
+  services.postgresqlBackup.databases = [ "vaultwarden" ];
+
   services.nginx.virtualHosts."${domain}" = {
     forceSSL = true;
     enableACME = true;

secrets/defiant/defiant.yaml

@@ -6,7 +6,7 @@ hedgedoc:
 vaultwarden:
     admintoken: ENC[AES256_GCM,data:sUPOe3goxpJFpe5fBdwcM5Z6+DXNdZr5Xd6HzRUb7LtDk9IUtwL4wtlckwnMRoLF628XvCV3ObrX2UmTqUX/6pWqLkWL/vWb3C8ogq4=,iv:vvO9nEkCjcKvl+ILEMlMorMmvyNM1juRYRnEolwg9sQ=,tag:wFnz9oOA+ZGrb4UqKrtUcA==,type:str]
 microbin:
-    secrets: ENC[AES256_GCM,data:GaEbiNENeLnVrqcJBHCks844WiYtVmU3yeGTLdrhPhPCfdgMiGst2nwIeTAGxqcy2Wn3Jo6hsGsHaGnFVgZ8+6Ej8rAU2Q==,iv:0EPKzBU/iy8YWZhJDF/iPCpfOneiLgf27XHby89RvB8=,tag:4oNhGEFjz4GylUXH/UuF+Q==,type:str]
+    secrets: ENC[AES256_GCM,data:B2yOSEXFyge7fgphtKcy8CjaeEiwmHAxgGoiqa4lmQtRtnxy5UuH3dFuCXHvbd3n6YA24zX3ANIQpj6ilT4I96+P+L9TjA==,iv:3mryQf3GdKCqBkLsfyqJk5ZN+/gOEbL/LmEzreINGME=,tag:YD8uvkS23c5B7J9srRrU9w==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -31,8 +31,8 @@ sops:
             RXcvQU1JYnl0bUtocTZuNkRxcGQwR2MKnyAYtF2y7XBmNuIYi6RzqEJEPPg7B22A
             fQVeDfIhiNSVva784KTU+y4TU1UPxumriRrLRFPF3h42ZEq2zQAgrQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-02-21T21:11:56Z"
+    lastmodified: "2024-02-28T16:10:53Z"
-    mac: ENC[AES256_GCM,data:NBmL+eOcavjU/xhQZtDvuJvvG+wXjU+PGayaNuTDdbo4zk1j8twoVrLCSOLVZuCFO88/2YEtmMJkNOEsPO2hbDhJl5k20g1880rQt4LhPn5sdHyxzrPL3ehDWNLyZy+JMl0SbDI/yjNRH/jX7UxjcBjMCW4WVQpqFK2na20PYfI=,iv:A9h6ziIZUDbtzTmTeSFYZcBKQ1KMkEkQe7PW6ahW/XQ=,tag:VfYygPnzeTMDUXyyNlCcZg==,type:str]
+    mac: ENC[AES256_GCM,data:Yid2Q5JTjWTLeh3qR2K0cX/Fk2p78Asj3x+kCDLtwJoULiZ+7xJKi/h2X4sRYw+vUou7HO3u+b8/MPvEapNjvqLyf4gseuvqdr2m/vR8DqxOdtl0xvrMoE8bTTR6tuCCIGIKEcEA7VviU+aCIm68CLkgq03DkF3g3hyC/VSKo9Y=,iv:66FpFV7mdTv1r+o3p4cK7CigDxGJOW70JZaEJE+fSLA=,tag:gNyPFbRc8VP9vOYdTt2YZg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1