refactor(ops/restic): Move restic configuration into a new module r/2878

Relates to b/147.

First step towards giving depot modules the ability to declare their
own backup directories by moving all restic configuration into a new
module and adding a NixOS option for inclusion/exclusion paths for
backups.

This still keeps all backup paths within the whitby config.

Change-Id: Ia96833668f1a3d02da892261153d8b02156b8ac0
Reviewed-on: https://cl.tvl.fyi/c/depot/+/3565
Tested-by: BuildkiteCI
Reviewed-by: flokli <flokli@flokli.de>

1 files changed, 18 insertions, 22 deletions

diff --git a/ops/machines/whitby/default.nix b/ops/machines/whitby/default.nix
index a21096325251..d59900776c34 100644
--- a/ops/machines/whitby/default.nix
+++ b/ops/machines/whitby/default.nix
@@ -16,6 +16,7 @@ in {
     "${depot.path}/ops/modules/owothia.nix"
     "${depot.path}/ops/modules/panettone.nix"
     "${depot.path}/ops/modules/paroxysm.nix"
+    "${depot.path}/ops/modules/restic.nix"
     "${depot.path}/ops/modules/smtprelay.nix"
     "${depot.path}/ops/modules/sourcegraph.nix"
     "${depot.path}/ops/modules/tvl-buildkite.nix"
@@ -324,6 +325,23 @@ in {
 
     # Run cgit & josh to serve git
     git-serving.enable = true;
+
+    # Configure backups to Google Cloud Storage
+    restic = {
+      enable = true;
+      paths = [
+        "/var/backup/postgresql"
+        "/var/html/deploys.tvl.fyi"
+        "/var/lib/gerrit"
+        "/var/lib/grafana"
+        "/var/lib/josh"
+        "/var/lib/znc"
+      ];
+
+      exclude = [
+        "/var/lib/gerrit/tmp"
+      ];
+    };
   };
 
   services.postgresql = {
@@ -386,28 +404,6 @@ in {
     zfstools
   ];
 
-  # Regularly back up whitby to Google Cloud Storage.
-  systemd.services.restic = {
-    description = "Backups to Google Cloud Storage";
-    script = "${pkgs.restic}/bin/restic backup /var/lib/gerrit /var/backup/postgresql /var/lib/grafana /var/lib/znc /var/html/deploys.tvl.fyi /var/lib/josh";
-
-    environment = {
-      GOOGLE_PROJECT_ID = "tazjins-infrastructure";
-      GOOGLE_APPLICATION_CREDENTIALS = "/var/backup/restic/gcp-key.json";
-      RESTIC_REPOSITORY = "gs:tvl-fyi-backups:/whitby";
-      RESTIC_PASSWORD_FILE = "/var/backup/restic/secret";
-      RESTIC_CACHE_DIR = "/var/backup/restic/cache";
-      RESTIC_EXCLUDE_FILE = builtins.toFile "exclude-files" ''
-        /var/lib/gerrit/tmp
-      '';
-    };
-  };
-
-  systemd.timers.restic = {
-    wantedBy = [ "multi-user.target" ];
-    timerConfig.OnCalendar = "hourly";
-  };
-
   services.journaldriver = {
     enable = true;
     googleCloudProject = "tvl-fyi";