fix(ops/restic): Move whitby's backup to GleSYS object storage r/3078

Since GCP nuked us, the backups are now moving to GleSYS'
S3-compatible object storage.

This refactors the restic module to support S3-compatible storage
instead of GCP, and switches to the appropriate new secret paths.

The secrets were placed on whitby manually and I verified that the
backups work.

This fixes b/157

Change-Id: I6a9d2b0581967605ce736605a3befb44cdeae7e1
Reviewed-on: https://cl.tvl.fyi/c/depot/+/3883
Tested-by: BuildkiteCI
Reviewed-by: grfn <grfn@gws.fyi>

2 files changed, 17 insertions, 13 deletions

diff --git a/ops/machines/whitby/default.nix b/ops/machines/whitby/default.nix
index 9a928dad30..20abd72be8 100644
--- a/ops/machines/whitby/default.nix
+++ b/ops/machines/whitby/default.nix
@@ -328,7 +328,7 @@ in {
     # Run cgit & josh to serve git
     git-serving.enable = true;
 
-    # Configure backups to Google Cloud Storage
+    # Configure backups to GleSYS
     restic = {
       enable = true;
       paths = [
diff --git a/ops/modules/restic.nix b/ops/modules/restic.nix
index 3d5ec30c1c..1aacf68973 100644
--- a/ops/modules/restic.nix
+++ b/ops/modules/restic.nix
@@ -1,12 +1,15 @@
-# Configure restic backups to Google Cloud Storage.
+# Configure restic backups to S3-compatible storage, in our case
+# GleSYS object storage.
 #
-# Conventions: Restic state is kept in /var/backup/restic, with
-# secrets in /var/backup/restic/secret.
+# Conventions:
+# - restic's cache lives in /var/backup/restic/cache
+# - repository password lives in /var/backup/restic/secret
+# - object storage credentials in /var/backup/restic/glesys-key
 { config, lib, pkgs, ... }:
 
 let
   cfg = config.services.depot.restic;
-  description = "Restic backups to GCS";
+  description = "Restic backups to GleSYS";
   mkStringOption = default: lib.mkOption {
     inherit default;
     type = lib.types.str;
@@ -14,9 +17,10 @@ let
 in {
   options.services.depot.restic = {
     enable = lib.mkEnableOption description;
-    project = mkStringOption "tazjins-infrastructure";
-    credentialPath = mkStringOption "/var/backup/restic/gcp-key.json";
-    repository = mkStringOption "gs:tvl-fyi-backups:/whitby";
+    bucketEndpoint = mkStringOption "objects.dc-sto1.glesys.net";
+    bucketName = mkStringOption "aged-resonance";
+    bucketCredentials = mkStringOption "/var/backup/restic/glesys-key";
+    repository = mkStringOption config.networking.hostName;
     interval = mkStringOption "hourly";
 
     paths = with lib; mkOption {
@@ -31,16 +35,14 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
-    # Regularly back up whitby to Google Cloud Storage.
     systemd.services.restic = {
-      description = "Backups to Google Cloud Storage";
+      description = "Backups to GleSYS";
 
       script = "${pkgs.restic}/bin/restic backup ${lib.concatStringsSep " " cfg.paths}";
 
       environment = {
-        GOOGLE_PROJECT_ID = cfg.project;
-        GOOGLE_APPLICATION_CREDENTIALS = cfg.credentialPath;
-        RESTIC_REPOSITORY = cfg.repository;
+        RESTIC_REPOSITORY = "s3:${cfg.bucketEndpoint}/${cfg.bucketName}/${cfg.repository}";
+        AWS_SHARED_CREDENTIALS_FILE = cfg.bucketCredentials;
         RESTIC_PASSWORD_FILE = "/var/backup/restic/secret";
         RESTIC_CACHE_DIR = "/var/backup/restic/cache";
 
@@ -53,5 +55,7 @@ in {
       wantedBy = [ "multi-user.target" ];
       timerConfig.OnCalendar = cfg.interval;
     };
+
+    environment.systemPackages = [ pkgs.restic ];
   };
 }