Using restic service with the security wrapper

waffle8946 · January 22, 2025, 4:33pm

There’s dedicated build helpers to make scripts, I’d use one of those. (Usually writeShellApplication since I don’t trust bash.)
https://nixos.org/manual/nixpkgs/unstable/#chap-trivial-builders

I also prefer not to hardcode paths if possible, but I don’t exactly see where the wrapper is defined… If you’ve defined the wrapper in your own config, then ${config.security.wrapperDir}/${config.security.wrappers.restic.program} should work to build the absolute path string.

Also, the NixOS restic module should be using getExe, not hardcoding /bin/restic…

github.com

NixOS/nixpkgs/blob/ae584d90cbd0396a422289ee3efb1f1c9d141dc3/nixos/modules/services/backup/restic.nix#L315


      
          (name: backup:
            let
              extraOptions = lib.concatMapStrings (arg: " -o ${arg}") backup.extraOptions;
              inhibitCmd = lib.concatStringsSep " " [
                "${pkgs.systemd}/bin/systemd-inhibit"
                "--mode='block'"
                "--who='restic'"
                "--what='sleep'"
                "--why=${lib.escapeShellArg "Scheduled backup ${name}"} "
              ];
              resticCmd = "${lib.optionalString backup.inhibitsSleep inhibitCmd}${backup.package}/bin/restic${extraOptions}";
              excludeFlags = lib.optional (backup.exclude != []) "--exclude-file=${pkgs.writeText "exclude-patterns" (lib.concatStringsSep "\n" backup.exclude)}";
              filesFromTmpFile = "/run/restic-backups-${name}/includes";
              doBackup = (backup.dynamicFilesFrom != null) || (backup.paths != null && backup.paths != []);
              pruneCmd = lib.optionals (builtins.length backup.pruneOpts > 0) [
                (resticCmd + " forget --prune " + (lib.concatStringsSep " " backup.pruneOpts))
              ];
              checkCmd = lib.optionals backup.runCheck [
                  (resticCmd + " check " + (lib.concatStringsSep " " backup.checkOpts))
              ];
              # Helper functions for rclone remotes