Sergei Poljanski
71047d179d
Some checks failed
nixos / asxpio-services (push) Failing after 54s
Renovate now runs from its own repository for every repo, with the shared rules in its preset. Extend that preset here and keep only what is specific to this repo (the Ansible var manager, the Paper JRE, the runner and nix notes); drop the workflow that ran it for iac alone. Assisted-by: Claude:opus-5-5
93 lines
2.7 KiB
Nix
93 lines
2.7 KiB
Nix
# Daily one-way replica of the hel1 buckets into their fsn1 twins.
|
|
# restic/ is excluded: restic writes its own, independent fsn1 repository.
|
|
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
pairs = [
|
|
{
|
|
src = "asxpio-backups-main";
|
|
dst = "asxpio-backups-repl";
|
|
exclude = [ "restic/**" ];
|
|
}
|
|
{
|
|
src = "asxpio-terraform-main";
|
|
dst = "asxpio-terraform-repl";
|
|
}
|
|
{
|
|
src = "k8s-asxpio-main";
|
|
dst = "k8s-asxpio-repl";
|
|
}
|
|
];
|
|
|
|
# A run that would delete more than this stops and fails (and mails):
|
|
# a mistake on the hel1 side must not empty the replica the next morning
|
|
maxDelete = 1000;
|
|
|
|
secret = name: config.sops.placeholder.${name};
|
|
remote = name: region: extra: ''
|
|
RCLONE_CONFIG_${name}_TYPE=s3
|
|
RCLONE_CONFIG_${name}_PROVIDER=Other
|
|
RCLONE_CONFIG_${name}_ENDPOINT=https://${region}.your-objectstorage.com
|
|
RCLONE_CONFIG_${name}_REGION=${region}
|
|
RCLONE_CONFIG_${name}_ACCESS_KEY_ID=${secret "s3/access_key"}
|
|
RCLONE_CONFIG_${name}_SECRET_ACCESS_KEY=${secret "s3/secret_key"}
|
|
${extra}'';
|
|
|
|
replicate = pkgs.writeShellApplication {
|
|
name = "s3-replicate";
|
|
runtimeInputs = [ pkgs.rclone ];
|
|
# No errexit: a failing pair does not stop the others, but fails the run
|
|
bashOptions = [
|
|
"nounset"
|
|
"pipefail"
|
|
];
|
|
text = ''
|
|
failed=0
|
|
''
|
|
+ lib.concatMapStrings (p: ''
|
|
echo "s3-replicate: ${p.src} -> ${p.dst}"
|
|
rclone sync hel1:${p.src} fsn1:${p.dst} \
|
|
--fast-list --checkers 16 --transfers 8 --max-delete ${toString maxDelete} \
|
|
${lib.concatMapStringsSep " " (e: "--exclude ${lib.escapeShellArg e}") (p.exclude or [ ])} \
|
|
--stats-one-line -v || failed=1
|
|
'') pairs
|
|
+ ''
|
|
exit $failed
|
|
'';
|
|
};
|
|
in
|
|
{
|
|
# The object storage remotes hel1: and fsn1:, as rclone environment
|
|
# variables. The migration's restore script reads them too.
|
|
sops.templates."s3-replicate-env".content =
|
|
remote "HEL1" "hel1" ""
|
|
+ remote "FSN1" "fsn1" ''
|
|
RCLONE_CONFIG_FSN1_NO_CHECK_BUCKET=true
|
|
'';
|
|
|
|
systemd.services.s3-replicate = {
|
|
description = "Replicate the hel1 buckets to fsn1";
|
|
wants = [ "network-online.target" ];
|
|
after = [ "network-online.target" ];
|
|
onFailure = [ "restic-alert@%n.service" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
ExecStart = lib.getExe replicate;
|
|
EnvironmentFile = config.sops.templates."s3-replicate-env".path;
|
|
TimeoutStartSec = "12h";
|
|
};
|
|
};
|
|
systemd.timers.s3-replicate = {
|
|
description = "Daily hel1 -> fsn1 bucket replica";
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnCalendar = "*-*-* 06:00:00";
|
|
RandomizedDelaySec = "15m";
|
|
Persistent = true;
|
|
};
|
|
};
|
|
}
|