refactor(ops/restic): Move restic configuration into a new module r/2878

Relates to b/147.

First step towards giving depot modules the ability to declare their
own backup directories by moving all restic configuration into a new
module and adding a NixOS option for inclusion/exclusion paths for
backups.

This still keeps all backup paths within the whitby config.

Change-Id: Ia96833668f1a3d02da892261153d8b02156b8ac0
Reviewed-on: https://cl.tvl.fyi/c/depot/+/3565
Tested-by: BuildkiteCI
Reviewed-by: flokli <flokli@flokli.de>

2 files changed, 75 insertions, 22 deletions

diff --git a/ops/machines/whitby/default.nix b/ops/machines/whitby/default.nix
index a21096325251..d59900776c34 100644
--- a/ops/machines/whitby/default.nix
+++ b/ops/machines/whitby/default.nix
@@ -16,6 +16,7 @@ in {
     "${depot.path}/ops/modules/owothia.nix"
     "${depot.path}/ops/modules/panettone.nix"
     "${depot.path}/ops/modules/paroxysm.nix"
+    "${depot.path}/ops/modules/restic.nix"
     "${depot.path}/ops/modules/smtprelay.nix"
     "${depot.path}/ops/modules/sourcegraph.nix"
     "${depot.path}/ops/modules/tvl-buildkite.nix"
@@ -324,6 +325,23 @@ in {
 
     # Run cgit & josh to serve git
     git-serving.enable = true;
+
+    # Configure backups to Google Cloud Storage
+    restic = {
+      enable = true;
+      paths = [
+        "/var/backup/postgresql"
+        "/var/html/deploys.tvl.fyi"
+        "/var/lib/gerrit"
+        "/var/lib/grafana"
+        "/var/lib/josh"
+        "/var/lib/znc"
+      ];
+
+      exclude = [
+        "/var/lib/gerrit/tmp"
+      ];
+    };
   };
 
   services.postgresql = {
@@ -386,28 +404,6 @@ in {
     zfstools
   ];
 
-  # Regularly back up whitby to Google Cloud Storage.
-  systemd.services.restic = {
-    description = "Backups to Google Cloud Storage";
-    script = "${pkgs.restic}/bin/restic backup /var/lib/gerrit /var/backup/postgresql /var/lib/grafana /var/lib/znc /var/html/deploys.tvl.fyi /var/lib/josh";
-
-    environment = {
-      GOOGLE_PROJECT_ID = "tazjins-infrastructure";
-      GOOGLE_APPLICATION_CREDENTIALS = "/var/backup/restic/gcp-key.json";
-      RESTIC_REPOSITORY = "gs:tvl-fyi-backups:/whitby";
-      RESTIC_PASSWORD_FILE = "/var/backup/restic/secret";
-      RESTIC_CACHE_DIR = "/var/backup/restic/cache";
-      RESTIC_EXCLUDE_FILE = builtins.toFile "exclude-files" ''
-        /var/lib/gerrit/tmp
-      '';
-    };
-  };
-
-  systemd.timers.restic = {
-    wantedBy = [ "multi-user.target" ];
-    timerConfig.OnCalendar = "hourly";
-  };
-
   services.journaldriver = {
     enable = true;
     googleCloudProject = "tvl-fyi";
diff --git a/ops/modules/restic.nix b/ops/modules/restic.nix
new file mode 100644
index 000000000000..f107609586ed
--- /dev/null
+++ b/ops/modules/restic.nix
@@ -0,0 +1,57 @@
+# Configure restic backups to Google Cloud Storage.
+#
+# Conventions: Restic state is kept in /var/backup/restic, with
+# secrets in /var/backup/restic/secret.
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.depot.restic;
+  description = "Restic backups to GCS";
+  mkStringOption = default: lib.mkOption {
+    inherit default;
+    type = lib.types.string;
+  };
+in {
+  options.services.depot.restic = {
+    enable = lib.mkEnableOption description;
+    project = mkStringOption "tazjins-infrastructure";
+    credentialPath = mkStringOption "/var/backup/restic/gcp-key.json";
+    repository = mkStringOption "gs:tvl-fyi-backups:/whitby";
+    interval = mkStringOption "hourly";
+
+    paths = with lib; mkOption {
+      description = "Directories that should be backed up";
+      type = types.listOf types.string;
+    };
+
+    exclude = with lib; mkOption {
+      description = "Files that should be excluded from backups";
+      type = types.listOf types.string;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # Regularly back up whitby to Google Cloud Storage.
+    systemd.services.restic = {
+      description = "Backups to Google Cloud Storage";
+
+      script = "${pkgs.restic}/bin/restic backup ${lib.concatStringsSep " " cfg.paths}";
+
+      environment = {
+        GOOGLE_PROJECT_ID = cfg.project;
+        GOOGLE_APPLICATION_CREDENTIALS = cfg.credentialPath;
+        RESTIC_REPOSITORY = cfg.repository;
+        RESTIC_PASSWORD_FILE = "/var/backup/restic/secret";
+        RESTIC_CACHE_DIR = "/var/backup/restic/cache";
+
+        RESTIC_EXCLUDE_FILE =
+          builtins.toFile "exclude-files" (lib.concatStringsSep "\n" cfg.exclude);
+      };
+    };
+
+    systemd.timers.restic = {
+      wantedBy = [ "multi-user.target" ];
+      timerConfig.OnCalendar = cfg.interval;
+    };
+  };
+}