WIP: deploy pvv-doorbell-bot

flake.lock

@@ -207,6 +207,25 @@
         "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
       }
     },
+    "pvv-doorbell-bot": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "dirtyRev": "cec320746bbf5b5bc6618a145c1a997ebd0b5196-dirty",
+        "dirtyShortRev": "cec3207-dirty",
+        "lastModified": 1724515328,
+        "narHash": "sha256-Vj3ZJkCaLq+6d1LJtl7Hg5f7XV4NDPeNC1xEyu9QkOI=",
+        "type": "git",
+        "url": "file:///home/felixalb/doorbell-matrix-bot"
+      },
+      "original": {
+        "type": "git",
+        "url": "file:///home/felixalb/doorbell-matrix-bot"
+      }
+    },
     "pvv-nettsiden": {
       "inputs": {
         "nixpkgs": [
@@ -237,6 +256,7 @@
         "nixpkgs": "nixpkgs",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "pvv-calendar-bot": "pvv-calendar-bot",
+        "pvv-doorbell-bot": "pvv-doorbell-bot",
         "pvv-nettsiden": "pvv-nettsiden",
         "sops-nix": "sops-nix"
       }

flake.nix

@@ -17,6 +17,10 @@
     pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
     pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
 
+    pvv-doorbell-bot.url = "git+https://git.pvv.ntnu.no/Projects/doorbell-matrix-bot.git";
+    #pvv-doorbell-bot.url = "git+file:///home/felixalb/doorbell-matrix-bot";
+    pvv-doorbell-bot.inputs.nixpkgs.follows = "nixpkgs";
+
     matrix-next.url = "github:dali99/nixos-matrix-modules/v0.6.0";
     matrix-next.inputs.nixpkgs.follows = "nixpkgs";
 
@@ -81,9 +85,11 @@
         modules = [
           inputs.matrix-next.nixosModules.default
           inputs.pvv-calendar-bot.nixosModules.default
+          inputs.pvv-doorbell-bot.nixosModules.default
         ];
         overlays = [
           inputs.pvv-calendar-bot.overlays.x86_64-linux.default
+          inputs.pvv-doorbell-bot.overlays.x86_64-linux.default
         ];
       };
       bekkalokk = stableNixosConfig "bekkalokk" {

hosts/bicep/configuration.nix

@@ -9,10 +9,11 @@
 
     ./acmeCert.nix
 
+    ./services/calendar-bot.nix
+    ./services/doorbell-bot.nix
+    ./services/mysql.nix
     ./services/mysql.nix
     ./services/postgres.nix
-    ./services/mysql.nix
-    ./services/calendar-bot.nix
 
     ./services/matrix
   ];

hosts/bicep/services/doorbell-bot.nix

@@ -0,0 +1,16 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.pvv-doorbell-bot;
+in {
+  sops.secrets."doorbell-bot/config-json" = {
+    owner = cfg.user;
+    group = cfg.group;
+  };
+
+  services.pvv-doorbell-bot = {
+    enable = true;
+    settings = {
+      configFile = config.sops.secrets."doorbell-bot/config-json".path;
+    };
+  };
+}

hosts/bicep/services/mysql.nix

@@ -1,7 +1,4 @@
 { pkgs, lib, config, values, ... }:
-let
-  backupDir = "/var/lib/mysql/backups";
-in
 {
   sops.secrets."mysql/password" = {
     owner = "mysql";
@@ -39,6 +36,11 @@ in
     }];
   };
 
+  services.mysqlBackup = {
+    enable = true;
+    location = "/var/lib/mysql/backups";
+  };
+
   networking.firewall.allowedTCPPorts = [ 3306 ];
 
   systemd.services.mysql.serviceConfig = {
@@ -48,51 +50,4 @@ in
       values.ipv6-space
     ];
   };
-
-  # NOTE: instead of having the upstream nixpkgs postgres backup unit trigger
-  #       another unit, it was easier to just make one ourselves
-  systemd.services."backup-mysql" = {
-    description = "Backup MySQL data";
-    requires = [ "mysql.service" ];
-
-    path = [
-      pkgs.coreutils
-      pkgs.rsync
-      pkgs.gzip
-      config.services.mysql.package
-    ];
-
-    script = let
-      rotations = 10;
-      sshTarget1 = "root@isvegg.pvv.ntnu.no:/mnt/backup1/bicep/mysql";
-      sshTarget2 = "root@isvegg.pvv.ntnu.no:/mnt/backup2/bicep/mysql";
-    in ''
-      set -eo pipefail
-
-      mysqldump | gzip -c -9 --rsyncable > "${backupDir}/$(date --iso-8601)-dump.sql.gz"
-
-      while [ $(ls -1 "${backupDir}" | wc -l) -gt ${toString rotations} ]; do
-        rm $(find "${backupDir}" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)
-      done
-
-      rsync -avz --delete "${backupDir}" '${sshTarget1}'
-      rsync -avz --delete "${backupDir}" '${sshTarget2}'
-    '';
-
-    serviceConfig = {
-      Type = "oneshot";
-      User = "mysql";
-      Group = "mysql";
-      UMask = "0077";
-      ReadWritePaths = [ backupDir ];
-    };
-
-    startAt = "*-*-* 02:15:00";
-  };
-
-  systemd.tmpfiles.settings."10-mysql-backup".${backupDir}.d = {
-    user = "mysql";
-    group = "mysql";
-    mode = "700";
-  };
 }

hosts/bicep/services/postgres.nix

@@ -1,7 +1,6 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, ... }:
 let
   sslCert = config.security.acme.certs."postgres.pvv.ntnu.no";
-  backupDir = "/var/lib/postgresql/backups";
 in
 {
   services.postgresql = {
@@ -90,50 +89,9 @@ in
   networking.firewall.allowedTCPPorts = [ 5432 ];
   networking.firewall.allowedUDPPorts = [ 5432 ];
 
-  # NOTE: instead of having the upstream nixpkgs postgres backup unit trigger
+  services.postgresqlBackup = {
-  #       another unit, it was easier to just make one ourselves
+    enable = true;
-  systemd.services."backup-postgresql" = {
+    location = "/var/lib/postgres/backups";
-    description = "Backup PostgreSQL data";
+    backupAll = true;
-    requires = [ "postgresql.service" ];
-
-    path = [
-      pkgs.coreutils
-      pkgs.rsync
-      pkgs.gzip
-      config.services.postgresql.package
-    ];
-
-    script = let
-      rotations = 10;
-      sshTarget1 = "root@isvegg.pvv.ntnu.no:/mnt/backup1/bicep/postgresql";
-      sshTarget2 = "root@isvegg.pvv.ntnu.no:/mnt/backup2/bicep/postgresql";
-    in ''
-      set -eo pipefail
-
-      pg_dumpall -U postgres | gzip -c -9 --rsyncable > "${backupDir}/$(date --iso-8601)-dump.sql.gz"
-
-      while [ $(ls -1 "${backupDir}" | wc -l) -gt ${toString rotations} ]; do
-        rm $(find "${backupDir}" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)
-      done
-
-      rsync -avz --delete "${backupDir}" '${sshTarget1}'
-      rsync -avz --delete "${backupDir}" '${sshTarget2}'
-    '';
-
-    serviceConfig = {
-      Type = "oneshot";
-      User = "postgres";
-      Group = "postgres";
-      UMask = "0077";
-      ReadWritePaths = [ backupDir ];
-    };
-
-    startAt = "*-*-* 01:15:00";
-  };
-
-  systemd.tmpfiles.settings."10-postgresql-backup".${backupDir}.d = {
-    user = "postgres";
-    group = "postgres";
-    mode = "700";
   };
 }

secrets/bicep/bicep.yaml

@@ -1,6 +1,8 @@
 calendar-bot:
     matrix_token: ENC[AES256_GCM,data:zJv9sw6pEzb9hxKT682wsD87HC9iejbps2wl2Z5QW1XZUSBHdcqyg1pxd+jFKTeKGQ==,iv:zDbvF1H98NsECjCtGXS+Y9HIhXowzz9HF9mltqnArog=,tag:/ftcOSQ13ElkVJBxYIMUGQ==,type:str]
     mysql_password: ENC[AES256_GCM,data:Gqag8yOgPH3ntoT5TmaqJWv1j+si2qIyz5Ryfw5E2A==,iv:kQDcxnPfwJQcFovI4f87UDt18F8ah3z5xeY86KmdCyY=,tag:A1sCSNXJziAmtUWohqwJgg==,type:str]
+doorbell-bot:
+    config-json: ENC[AES256_GCM,data:QNFHiUqaBWfW9ZRAkZo9M18AMbn/oSxvEMq1N1NsDcBjxJMo/OE36fz1Uf4TagGccCDkWy56wSVSFZm8KZnXVaQ/X0EgJkUK1JZyR7i5yiEW8ByLaVzThMWBwxQoj2cz48z53krzfddyl250rLFQRa7Fco74yTFfBWruf/1clN5O/iHFspeW7uJtQh/oyFIVb87YisjKU2+jpU3IeDNsO6VFWOoOJd+ACmfwsAY0wOz5lzBEIrdU2k/PMgSVzECMV4S5ipwIUmVUpGzbvgAWZQGtsUeVevAbvZ1QgyH6bhDIUheeUrOKN0cbgEMc/xIi7yZ+VWHOMBqb8LkyBvunG2TjK31B1HAGL/krBS+gvvQnW0ZN,iv:K0djdxNOGaHBkE4vyh/22fruAHVsZYVT68cdVoMmogw=,tag:3fjjzD3bghvGy3aZ7/Ienw==,type:str]
 mysql:
     password: ENC[AES256_GCM,data:KqEe0TVdeMIzPKsmFg9x0X9xWijnOk306ycyXTm2Tpqo/O0F,iv:Y+hlQ8n1ZIP9ncXBzd2kCSs/DWVTWhiEluFVwZFKRCA=,tag:xlaUk0Wftk62LpYE5pKNQw==,type:str]
 sops:
@@ -63,8 +65,8 @@ sops:
             cTh5bnJ3WW90aXRCSUp6NHFYeU1tZ0kK4afdtJwGNu6wLRI0fuu+mBVeqVeB0rgX
             0q5hwyzjiRnHnyjF38CmcGgydSfDRmF6P+WIMbCwXC6LwfRhAmBGPg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-08-15T21:18:33Z"
+    lastmodified: "2024-08-24T16:49:06Z"
-    mac: ENC[AES256_GCM,data:uR5HgeDAYqoqB9kk1V6p0T30+v6WpQJi4+qIeCDRnoUPnQKUVR10hvBhICck+E+Uh8p+tGhM6Uf3YrAJAV0ZCUiNJjtwDJQQLUDT53vdOAXN4xADCQqNuhgVwVMaruoTheEiwOswRuhFeEwy0gBj3Ze2pu47lueHYclmEzumLeQ=,iv:t0UyXN2YaR2m7M/pV2wTLJG5wVfqTIUs7wSQMmyeTVw=,tag:O7dIffzrDAXz3kGx5uazhw==,type:str]
+    mac: ENC[AES256_GCM,data:A5pYM3yNt5GdlvpdDbRXxQwUccC/dr5JZwPBMjjx4ZRaJMbewpmGL/ySITnsCEuxOG1cagc1S28ti8k3z0bR4rfFlt/fZ93K8uwI9rT6KW5pSEAa1vPEz8Jq+7asfJIBMCpxFxN704JDSeOnBMaSHwQdICdmG4jfN/F+YbXTPIA=,iv:Y6gloFlYtnJZ3kzcUtZZZmJQ8KowQ29pwZaqo/ePrm8=,tag:r8XFLU5PGMr3U3K0N0cmlQ==,type:str]
     pgp:
         - created_at: "2024-08-04T00:03:40Z"
           enc: |-