blob: 8d114630565dc33a189ea7e64bae3aa68252eabf (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
|
{
flake.modules.nixos.git =
{
config,
pkgs,
...
}:
{
users.users.git = {
isSystemUser = true;
group = "git";
home = "/var/lib/git-server";
createHome = true;
shell = "${pkgs.git}/bin/git-shell";
};
users.groups.git = { };
systemd.services.github-mirror = {
description = "Mirror GitHub repositories";
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
script = ''
set -euo pipefail
cd /var/lib/git-server
API_DATA="$(${pkgs.coreutils}/bin/mktemp)"
REPO_NAMES="$(${pkgs.coreutils}/bin/mktemp)"
trap '${pkgs.coreutils}/bin/rm -f "$API_DATA" "$REPO_NAMES"' EXIT
${pkgs.curl}/bin/curl -fsS \
"https://api.github.com/users/schererleander/repos?per_page=100" \
> "$API_DATA"
${pkgs.jq}/bin/jq -r '.[].name' "$API_DATA" > "$REPO_NAMES"
${pkgs.jq}/bin/jq -r '
.[]
| [
.clone_url,
(.description // "Unnamed repository")
]
| @tsv
' "$API_DATA" |
while IFS=$'\t' read -r REPO_URL REPO_DESC; do
REPO_NAME="$(${pkgs.coreutils}/bin/basename -s .git "$REPO_URL")"
TARGET_DIR="$REPO_NAME.git"
if [ -d "$TARGET_DIR" ]; then
echo "Updating $REPO_NAME"
${pkgs.git}/bin/git -C "$TARGET_DIR" fetch --prune origin
else
echo "Cloning $REPO_NAME"
${pkgs.git}/bin/git clone --mirror "$REPO_URL" "$TARGET_DIR"
fi
echo "$REPO_DESC" > "$TARGET_DIR/description"
done
for TARGET_DIR in *.git; do
[ -d "$TARGET_DIR" ] || continue
REPO_NAME="''${TARGET_DIR%.git}"
if ! ${pkgs.gnugrep}/bin/grep -Fxq "$REPO_NAME" "$REPO_NAMES"; then
echo "Deleting $REPO_NAME"
${pkgs.coreutils}/bin/rm -rf -- "$TARGET_DIR"
fi
done
'';
serviceConfig = {
Type = "oneshot";
User = "git";
Group = "git";
CapabilityBoundingSet = "";
ProtectSystem = "strict";
ProtectHome = true;
PrivateTmp = true;
ReadWritePaths = "/var/lib/git-server";
};
};
systemd.timers.github-mirror = {
description = "Timer to mirror GitHub repositories";
wantedBy = [ "timers.target" ];
timerConfig = {
OnCalendar = "hourly";
Persistent = true;
};
};
services.borgbackup.jobs.git = {
paths = [
"/var/lib/git-server"
];
repo = "$BORG_REPO";
encryption.mode = "none";
environment = {
BORG_RSH = "ssh -i ${
config.sops.secrets."borgbase_ssh_key".path
} -o StrictHostKeyChecking=accept-new";
};
extraCreateArgs = [
"--info"
"--stats"
];
compression = "auto,lzma";
startAt = "daily";
preHook = ''
set -euo pipefail
export BORG_REPO="$(cat ${config.sops.secrets."borg_git_repo".path})"
'';
};
systemd.services."borgbackup-job-git".unitConfig.OnFailure = [ "notify-backup-failure@%n.service" ];
};
}
|
