use same restic password for all target repos

This makes the setup simpler, requires less agenix secrets, and overall should not be noticeably more insecure: if an attacker can exfiltrate one password from the machine, they could just as easily exfiltrate two.
datasektionen · Oct 3, 2024 · 586403e · 586403e
1 parent 7b005a8
commit 586403e
Show file tree

Hide file tree

Showing 4 changed files with 15 additions and 14 deletions.
diff --git a/hosts/ares.nix b/hosts/ares.nix
@@ -47,14 +47,15 @@ in
       "/var/lib/mattermost"
     ];
 
+    passwordFile = config.age.secrets.restic-repo-pwd-ares.path;
+
     targets.s3 = {
       repository = "s3:https://s3.amazonaws.com/dsekt-restic-ares";
-      passwordFile = config.age.secrets.restic-s3-repo-pwd-ares.path;
       credentialsEnvFile = config.age.secrets.restic-s3-creds-ares.path;
     };
   };
 
-  age.secrets.restic-s3-repo-pwd-ares.file = secretsDir + "/restic-s3-repo-pwd-ares.age";
+  age.secrets.restic-repo-pwd-ares.file = secretsDir + "/restic-repo-pwd-ares.age";
   age.secrets.restic-s3-creds-ares.file = secretsDir + "/restic-s3-creds-ares.env.age";
 
   # Change this if you want to lose all data on this machine!

diff --git a/modules/restic.nix b/modules/restic.nix
@@ -18,6 +18,15 @@
       '';
     };
 
+    passwordFile = lib.mkOption {
+      type = lib.types.singleLineStr;
+      example = "/etc/restic/repo-pwd";
+      description = lib.mdDoc ''
+        Path to file containing the password to
+        unlock all target repositories.
+      '';
+    };
+
     backupPrepareCommand = lib.mkOption {
       type = with lib.types; nullOr str;
       default = null;
@@ -44,15 +53,6 @@
                 '';
               };
 
-              passwordFile = lib.mkOption {
-                type = lib.types.singleLineStr;
-                example = "/etc/restic/repo-pwd";
-                description = lib.mdDoc ''
-                  Path to file containing the password to
-                  unlock the specified repository.
-                '';
-              };
-
               credentialsEnvFile = lib.mkOption {
                 type = lib.types.singleLineStr;
                 example = "/etc/restic/creds";
@@ -100,8 +100,8 @@
     lib.mkIf (builtins.length cfg.paths != 0) {
 
       services.restic.backups = builtins.mapAttrs (name: target: {
-        inherit (cfg) paths backupPrepareCommand;
-        inherit (target) repository passwordFile;
+        inherit (cfg) paths passwordFile backupPrepareCommand;
+        inherit (target) repository;
 
         initialize = true;
         timerConfig = {

diff --git a/secrets/restic-s3-repo-pwd-ares.age → secrets/restic-repo-pwd-ares.age b/secrets/restic-s3-repo-pwd-ares.age → secrets/restic-repo-pwd-ares.age
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
@@ -34,7 +34,7 @@ in
   # `CLOUDFLARE_DNS_API_TOKEN=...`
   "cloudflare-dns-api-token.env.age".publicKeys = sysadmins ++ [ ares ];
 
-  "restic-s3-repo-pwd-ares.age".publicKeys = sysadmins ++ [ ares ];
+  "restic-repo-pwd-ares.age".publicKeys = sysadmins ++ [ ares ];
 
   # `AWS_DEFAULT_REGION`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `RESTIC_PASSWORD`
   "restic-s3-creds-ares.env.age".publicKeys = sysadmins ++ [ ares ];