yay

common.nix

@@ -24,8 +24,14 @@
       PasswordAuthentication = false;
       KbdInteractiveAuthentication = false;
       PermitRootLogin = "no";
-      AllowUsers = [ "ellie" ];
+      AllowUsers = [ "ellie" "forgejo" ];
     };
+    extraConfig = ''
+      Match User forgejo Address 10.10.0.1
+        AllowTcpForwarding no
+        X11Forwarding no
+        PermitTunnel no
+    '';
   };
 
   services.fail2ban = {

flake.nix

@@ -59,6 +59,7 @@
           ./services/ergo.nix
           ./services/forgejo.nix
           ./services/forgejo-runner.nix
+          ./services/borgbackup.nix
           # ./services/akkoma.nix
         ];
       };
@@ -84,6 +85,7 @@
           ./hosts/vps/disko-config.nix
           ./services/coturn.nix
           ./services/wireguard-outer.nix
+          ./services/borgbackup-vps.nix
         ];
       };
 

services/borgbackup-vps.nix

@@ -0,0 +1,19 @@
+{ ... }:
+
+{
+  # Inbound: accept desktop offsite backups
+  services.borgbackup.repos.desktop = {
+    path = "/var/lib/borg/desktop";
+    authorizedKeys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINvKMpaawaw5bp73/W4dm0YEZa2FT99pXHLOYqZS8NPL borg-desktop"
+    ];
+  };
+
+  # Inbound: accept homeserver backups
+  services.borgbackup.repos.homeserver = {
+    path = "/var/lib/borg/homeserver";
+    authorizedKeys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEkWV7RJuN4/cGGsER7oHJ55R4aZZZuDnCn/fjyPd9KX borg-homeserver"
+    ];
+  };
+}

services/borgbackup.nix

@@ -0,0 +1,41 @@
+{ ... }:
+
+{
+  # Outbound: back up homeserver to VPS
+  services.borgbackup.jobs.homeserver = {
+    paths = [
+      "/var/lib"
+      "/etc"
+      "/home"
+    ];
+    repo = "ssh://borg@10.10.0.1/./homeserver";
+    environment.BORG_RSH = "ssh -i /etc/borg/ssh_key";
+    encryption = {
+      mode = "repokey";
+      passCommand = "cat /etc/borg/passphrase";
+    };
+    compression = "zstd";
+    startAt = "daily";
+    prune.keep = {
+      daily = 7;
+      weekly = 4;
+      monthly = 6;
+    };
+    exclude = [
+      "/var/lib/docker"
+      "/var/lib/containers"
+      "/var/lib/systemd/coredump"
+      "*.pyc"
+      "__pycache__"
+      ".cache"
+    ];
+  };
+
+  # Inbound: accept desktop backups
+  services.borgbackup.repos.desktop = {
+    path = "/var/lib/borg/desktop";
+    authorizedKeys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINvKMpaawaw5bp73/W4dm0YEZa2FT99pXHLOYqZS8NPL borg-desktop"
+    ];
+  };
+}

services/forgejo.nix

@@ -7,8 +7,8 @@
   };
 
   networking.firewall.interfaces.wg0.allowedTCPPorts = [
+    22
     3000
-    2222
   ];
 
   services.forgejo = {
@@ -20,10 +20,9 @@
       ROOT_URL = "https://forgejo.ellie.town/";
       HTTP_ADDR = "10.10.0.2";
       HTTP_PORT = 3000;
-      START_SSH_SERVER = true;
+      START_SSH_SERVER = false;
       SSH_DOMAIN = "forgejo.ellie.town";
       SSH_PORT = 2222;
-      SSH_LISTEN_PORT = 2222;
     };
   };
 }

services/wireguard-outer.nix

@@ -97,7 +97,7 @@
       }
 
       upstream forgejo_ssh {
-        server 10.10.0.2:2222;
+        server 10.10.0.2:22;
       }
       server {
         listen 2222;