tower: add vaultwarden backup service

1 files changed, 29 insertions, 1 deletions

diff --git a/hosts/tower/web/vaultwarden.nix b/hosts/tower/web/vaultwarden.nix
index a74494c..bf3c924 100644
--- a/hosts/tower/web/vaultwarden.nix
+++ b/hosts/tower/web/vaultwarden.nix
@@ -1,4 +1,4 @@
-{ lib, config, ... }:
+{ lib, config, pkgs, ... }:
 let
   cfg = config.services.vaultwarden;
   domain = "vaultwarden.sorre.internal";
@@ -25,4 +25,32 @@ in
       # "/var/secrets/vaultwarden.env"
     ];
   };
+
+  systemd.services.backup-vaultwarden = lib.mkIf cfg.enable {
+    serviceConfig.Type = "oneshot";
+    description = "Back up vaultwarden data";
+    conflicts = [ "vaultwarden.service" ];
+    path = [ pkgs.gnutar pkgs.systemdMinimal ];
+    enableStrictShellChecks = true;
+    script = ''
+      #!/usr/bin/env bash
+      set -euo pipefail
+
+      [ ! -d /var/lib/backup/vaultwarden ] && mkdir -p /var/lib/backup/vaultwarden
+      TIMESTAMP="$(date +%Y%m%d%H%M%S)"
+      tar cvf "/var/lib/backup/vaultwarden/$TIMESTAMP.backup.tar" /var/lib/vaultwarden
+
+      find /var/lib/backup/vaultwarden -type f -name '*.backup.tar' -print0 |
+        sort --zero-terminated --reverse |
+        tail --zero-terminated --lines=+6 |
+        xargs --null --no-run-if-empty rm --
+    '';
+    postStop = "systemctl start vaultwarden.service";
+  };
+
+  systemd.timers.backup-vaultwarden = {
+    description = "Back up vaultwarden every morning";
+    timerConfig.OnCalendar = "*-*-* 05:00:00";
+    wantedBy = [ "timers.target" ];
+  };
 }