From 356dde149f9a15a4f801a582c5f029f3a9812937 Mon Sep 17 00:00:00 2001
From: Vincent Ambo <mail@tazj.in>
Date: Sun, 12 Jul 2020 14:46:55 +0100
Subject: feat(whitby): Configure Gerrit backups on whitby

Change-Id: I84245fb809725853a301f217cdb11eacc1984cae
Reviewed-on: https://cl.tvl.fyi/c/depot/+/1103
Tested-by: BuildkiteCI
Reviewed-by: lukegb <lukegb@tvl.fyi>
---
 ops/nixos/whitby/default.nix | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

(limited to 'ops/nixos/whitby')

diff --git a/ops/nixos/whitby/default.nix b/ops/nixos/whitby/default.nix
index 4441c7d8dacd..9015efac1ce2 100644
--- a/ops/nixos/whitby/default.nix
+++ b/ops/nixos/whitby/default.nix
@@ -220,6 +220,28 @@ in {
     };
   };
 
+  # Regularly back up Gerrit to Google Cloud Storage.
+  systemd.services.restic-gerrit = {
+    description = "Gerrit backups to Google Cloud Storage";
+    script = "${nixpkgs.restic}/bin/restic backup /var/lib/gerrit";
+    serviceConfig.User = "git";
+
+    environment = {
+      GOOGLE_PROJECT_ID = "tazjins-infrastructure";
+      GOOGLE_APPLICATION_CREDENTIALS = "/var/lib/git/restic/gcp-key.json";
+      RESTIC_REPOSITORY = "gs:tvl-fyi-backups:/whitby";
+      RESTIC_PASSWORD_FILE = "/var/lib/git/restic/secret";
+      RESTIC_EXCLUDE_FILE = builtins.toFile "exclude-files" ''
+        /var/lib/gerrit/tmp
+      '';
+    };
+  };
+
+  systemd.timers.restic-gerrit = {
+    wantedBy = [ "multi-user.target" ];
+    timerConfig.OnCalendar = "hourly";
+  };
+
   security.sudo.extraRules = [
     {
       groups = ["wheel"];
-- 
cgit 1.4.1