harden vaultwarden backup service

1 files changed, 32 insertions, 9 deletions

diff --git a/hosts/tower/web/vaultwarden.nix b/hosts/tower/web/vaultwarden.nix
index c277d65..d356e36 100644
--- a/hosts/tower/web/vaultwarden.nix
+++ b/hosts/tower/web/vaultwarden.nix
@@ -32,28 +32,51 @@ in
   };
 
   systemd.services.backup-vaultwarden = lib.mkIf cfg.enable {
-    serviceConfig.Type = "oneshot";
+    serviceConfig = {
+      Type = "exec";
+      User = config.systemd.services.vaultwarden.serviceConfig.User;
+      Group = config.systemd.services.vaultwarden.serviceConfig.Group;
+      StateDirectory = "backups/vaultwarden";
+      StateDirectoryMode = "0700";
+      Umask = "077";
+    };
     description = "Back up vaultwarden data";
     conflicts = [ "vaultwarden.service" ];
-    path = [
-      pkgs.gnutar
-      pkgs.systemdMinimal
-    ];
+    path = [ pkgs.gnutar ];
     enableStrictShellChecks = true;
     script = ''
       #!/usr/bin/env bash
       set -euo pipefail
 
-      [ ! -d /var/lib/backup/vaultwarden ] && mkdir -p /var/lib/backup/vaultwarden
       TIMESTAMP="$(date +%Y%m%d%H%M%S)"
-      tar cvf "/var/lib/backup/vaultwarden/$TIMESTAMP.backup.tar" /var/lib/vaultwarden
+      BACKUP_PATH="$STATE_DIRECTORY/$TIMESTAMP.backup.tar"
+      echo "Backing up Vaultwarden to $BACKUP_PATH" >&2
 
-      find /var/lib/backup/vaultwarden -type f -name '*.backup.tar' -print0 |
+      tar cf "$BACKUP_PATH" /var/lib/vaultwarden
+      chmod u=r,go-rwx "$BACKUP_PATH"
+
+      find "$STATE_DIRECTORY" -type f -name '*.backup.tar' -print0 |
         sort --zero-terminated --reverse |
         tail --zero-terminated --lines=+6 |
         xargs --null --no-run-if-empty rm --
     '';
-    postStop = "systemctl start vaultwarden.service";
+  };
+
+  # See: https://unix.stackexchange.com/a/804263
+  systemd.services.backup-vaultwarden-restart-service = {
+    unitConfig = {
+      StopPropagatedFrom = "backup-vaultwarden.service";
+      Before = "backup-vaultwarden.service";
+      User = "root";
+    };
+    path = [ pkgs.systemdMinimal ];
+    serviceConfig = {
+      Type = "oneshot";
+      User = "root";
+      RemainAfterExit = true;
+      ExecStop = "systemctl start vaultwarden.service";
+    };
+    wantedBy = [ "backup-vaultwarden.service" ];
   };
 
   systemd.timers.backup-vaultwarden = {