adjusted timings

modules/hosts/john-pc-ubuntu.nix

@@ -11,18 +11,18 @@ in
     certDir = "${config.mtls.certDir}";
     CACert = "${certDir}/root_ca.crt";
     mtlsBundle = "${certDir}/${config.mtls.bundleFilename}";
+    resticPasswordFile = "${config.xdg.configHome}/restic/password.txt";
   in
   {
     imports = with inputs.self.modules.homeManager; [
       rebuild
       john
-      resticprofile
       sops
-      docker
-      desktop
       step-ssh-user
       mtls
       restic
+      docker
+      desktop
     ];
     targets.genericLinux.enable = true;
 
@@ -48,11 +48,12 @@ in
         "192.168.1.85"
         "spiffe://john-stream.com/ubuntu"
       ];
+      lifetime = "1h";
+      renew.onCalendar = "*:1/10";
     };
 
     # TODO: Add host-specific settings here:
     # - sops secret for `restic_password/john_ubuntu`
-    # - resticprofile profile definition
     # - zsh RESTIC* session variables
 
     # TODO: make this more restrictive, rather than allowing all unfree packages
@@ -77,35 +78,21 @@ in
       };
     };
     sops.secrets."restic_password/john_ubuntu" = {
-      path = "${config.xdg.configHome}/restic/password.txt";
+      path = resticPasswordFile;
       mode = "0400";
     };
     restic = {
-      passwordFile = "${config.xdg.configHome}/restic/password.txt";
-      paths = [
-        "${config.xdg.userDirs.documents}"
-        "/conf"
+      passwordFile = resticPasswordFile;
+      OnCalendar = "*:0/15";
+      paths = [ "${config.xdg.userDirs.documents}" "/conf" ];
+      exclude = [
+        "/home/*/Pictures"
+        "/home/*/Videos"
+        "/home/*/go"
+        "/home/*/snap"
+        "/home/john/john-nas"
       ];
     };
-
-    # programs.resticprofile = {
-    #   enable= true;
-    #   profiles = {
-    #     default = {
-    #       "inherit" = "base";
-    #       repository = "rest:https://soteria.john-stream.com/john-ubuntu";
-    #       cacert = "${CACert}";
-    #       tls-client-cert = "${mtlsBundle}";
-    #       backup = {
-    #         source = [
-    #           "${config.xdg.userDirs.documents}"
-    #           "/conf"
-    #         ];
-    #         schedule = "*-*-* *:15,30,45:00";
-    #       };
-    #     };
-    #   };
-    # };
   };
 
   flake.homeConfigurations."${hostname}" = inputs.home-manager.lib.homeManagerConfiguration {

modules/hosts/soteria.nix

@@ -15,6 +15,7 @@ in
       nixos.zsh
       nixos.login-text
       nixos.mtls
+      nixos.restic-server
       {
         networking.hostName = hostname;
         step-ssh-host = {

modules/nixos/login-text.nix

@@ -22,9 +22,10 @@
         };
 
         service_status = {
-          SSH = "sshd.socket";
-          "SSH Certs" = "step-ssh-host-renew.timer";
           Docker = "docker";
+          SSH = "sshd.socket";
+          "SSH Cert Renewal" = "step-ssh-host-renew.timer";
+          "mTLS Renewal" = "mtls-renew.timer";
         };
 
         # This calculation is wrong for LXCs

modules/services/restic/base-profile.yaml

@@ -1,43 +0,0 @@
-base:
-  repository: local:/mnt/backup
-  password-file: '{{ .ConfigDir }}/password.txt'
-  status-file: '{{ .ConfigDir }}/backup-status.json'
-  retention:
-    after-backup: true
-    keep-last: '10'
-    keep-hourly: '8'
-    keep-daily: '14'
-    keep-weekly: '8'
-    keep-monthly: '6'
-  backup:
-    verbose: true
-    exclude:
-      - .cache
-      - .devenv
-      - .rustup
-      - .cargo
-      - .venv
-      - .pyenv
-      - .vscode*
-      - data/postgres
-      - build
-      - __pycache__
-      - '*.log'
-      - '*.egg-info'
-      - '*.csv'
-      - '*.m4a'
-      - .local/share/Steam
-      - .local/share/Trash
-      - build
-      - dist
-      - /home/*/Pictures
-      - /home/*/Videos
-      - /home/*/go
-      - /home/*/snap
-      - /home/john/john-nas
-    schedule-permission: user
-    schedule-priority: background
-    check-after: true
-  prune:
-    schedule-permission: user
-    schedule-lock-wait: 1h

modules/services/restic/restic.nix

@@ -1,4 +1,13 @@
 { inputs, ... }: {
+  flake.modules.nixos.restic-server = { config, pkgs, lib, ... }: {
+    services.restic.server = {
+      enable = true;
+      dataDir = "/mnt/restic";
+      listenAddress = "0.0.0.0:8080";
+      extraFlags = [ "--no-auth" ];
+    };
+  };
+
   flake.modules.homeManager.restic = { config, pkgs, lib, ... }:
     let
       cfg = config.restic;
@@ -19,23 +28,51 @@
           type = lib.types.listOf lib.types.str;
           default = [ ];
         };
+        exclude = lib.mkOption {
+          description = "List of string paths to include in the backup. There are already some common ones included by default.";
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+        };
+        OnCalendar = lib.mkOption {
+          description = "";
+          type = lib.types.str;
+        };
+        RandomizedDelaySec = lib.mkOption {
+          description = "";
+          type = lib.types.str;
+          default = "1m";
+        };
       };
 
-      config = {
+      config = let
+        resticRepository = "rest:https://soteria.john-stream.com/${cfg.repoName}";
+        caCert = "${config.mtls.certDir}/root_ca.crt";
+        mtlsClientCert = "${config.mtls.certDir}/${config.mtls.bundleFilename}";
+      in
+      {
+        home.sessionVariables = {
+          RESTIC_REPOSITORY = resticRepository;
+          RESTIC_PASSWORD_FILE = cfg.passwordFile;
+          RESTIC_CACERT = caCert;
+          RESTIC_TLS_CLIENT_CERT = mtlsClientCert;
+        };
+        
+        # This is necessary because the restic service in home manager doesn't otherwise expose these options.
+        systemd.user.services."restic-backups-${cfg.repoName}".Service.Environment = [
+          "RESTIC_CACERT=${caCert}"
+          "RESTIC_TLS_CLIENT_CERT=${mtlsClientCert}"
+        ];
+
         services.restic = {
           enable = true;
           backups.${cfg.repoName} = {
+            repository = resticRepository;
             passwordFile = cfg.passwordFile;
             paths = cfg.paths;
-            repository = "rest:https://soteria.john-stream.com/${cfg.repoName}";
-            extraBackupArgs = [
-              "--tls-client-cert ${config.mtls.certDir}/${config.mtls.bundleFilename}"
-              "--cacert ${config.mtls.certDir}/root_ca.crt"
-            ];
             timerConfig = {
-              OnCalendar = "00:05";
+              OnCalendar = cfg.OnCalendar;
+              RandomizedDelaySec = cfg.RandomizedDelaySec;
               Persistent = true;
-              RandomizedDelaySec = "5h";
             };
             runCheck = true;
             pruneOpts = [
@@ -45,7 +82,7 @@
               "--keep-weekly 8"
               "--keep-monthly 12"
             ];
-            exclude = [
+            exclude = cfg.exclude ++ [
               ".cache"
               ".devenv"
               ".rustup"
@@ -55,6 +92,7 @@
               ".vscode*"
               "data/postgres"
               "build"
+              "dist"
               "__pycache__"
               "*.log"
               "*.egg-info"
@@ -62,15 +100,10 @@
               "*.m4a"
               ".local/share/Steam"
               ".local/share/Trash"
-              "dist"
-              "/home/*/Pictures"
-              "/home/*/Videos"
-              "/home/*/go"
-              "/home/*/snap"
-              "/home/john/john-nas"
             ];
           };
         };
+
       };
     };
 }

modules/services/restic/resticprofile.nix

@@ -1,99 +0,0 @@
-{ inputs, ... }:
-{
-  perSystem = { pkgs, ... }:
-    let
-      resticprofilePkg = pkgs.buildGoModule rec {
-        pname = "resticprofile";
-        version = "0.32.0";
-        src = pkgs.fetchFromGitHub {
-          owner = "creativeprojects";
-          repo   = "resticprofile";
-          rev    = "v${version}";
-          sha256 = "sha256-fmYsoGYppNgbtoX18aF5UHBG9ieYorBJ9JZkwrR+UBI=";
-        };
-        vendorHash = "sha256-/GVWjOvkYe7xMRjANKIKV6FSU0F5VY1ZP/ppgAJyhvw=";
-        goPackagePath = "github.com/creativeprojects/resticprofile";
-        doCheck = false;
-        meta = with pkgs.lib; {
-          description = "Configuration profiles manager and scheduler for restic backup";
-          homepage    = "https://creativeprojects.github.io/resticprofile/";
-          license     = licenses.gpl3Only;
-          maintainers = [ ];
-          mainProgram = "resticprofile";
-        };
-      };
-    in {
-      packages = {
-        resticprofile = resticprofilePkg;
-        default = resticprofilePkg;
-      };
-    };
-
-  flake.lib.fromYAML = pkgs: path:
-    builtins.fromJSON (
-      builtins.readFile (
-        pkgs.runCommand "${builtins.baseNameOf path}.json"
-          {
-            nativeBuildInputs = [ pkgs.remarshal ];
-          }
-          ''
-            remarshal -if yaml -of json ${path} > "$out"
-          ''
-      )
-    );
-
-  flake.modules.homeManager.resticprofile = { config, lib, pkgs, ... }:
-    let
-      cfg = config.programs.resticprofile;
-      yamlFormat = pkgs.formats.yaml { };
-      # baseProfile = import ../../../resticprofile/base.nix;
-      baseProfile = inputs.self.lib.fromYAML pkgs ./base-profile.yaml;
-      profiles = lib.recursiveUpdate baseProfile cfg.profiles;
-    in {
-      options.programs.resticprofile = {
-        enable = lib.mkEnableOption "Enable resticprofile (Restic backup profile manager)";
-        package = lib.mkPackageOption pkgs "resticprofile" { };
-        profiles = lib.mkOption {
-          type = lib.types.attrsOf yamlFormat.type;
-          default = { };
-          description = ''
-            Additional resticprofile configuration merged on top of the base profile.
-            Each attribute becomes a profile entry in
-            `$XDG_CONFIG_HOME/resticprofile/profiles.yaml`.
-          '';
-        };
-      };
-
-      config = lib.mkIf cfg.enable (
-        let
-          resticprofilePackage = lib.mkDefault
-            inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.resticprofile;
-          resticprofileBin = lib.getExe cfg.package;
-          rpScript = pkgs.writeShellScriptBin "rp" ''
-            set -e
-            sudo ${resticprofileBin} --config "${config.xdg.configHome}/resticprofile/profiles.yaml" $@
-          '';
-          rpbackupScript = pkgs.writeShellScriptBin "rp-backup" ''
-            ${lib.getExe rpScript} run-schedule backup@default "$@"
-          '';
-        in {
-          programs.resticprofile.package = resticprofilePackage;
-          home.packages = [
-            cfg.package
-            rpScript
-            rpbackupScript
-            (pkgs.writeShellScriptBin "rps" ''
-              set -e
-              ${lib.getExe rpScript} unschedule --all
-              ${lib.getExe rpScript} schedule --all
-            '')
-            (pkgs.writeShellScriptBin "rp-test" "${lib.getExe rpbackupScript} --dry-run")
-          ];
-          xdg.configFile."resticprofile/profiles.yaml".source = yamlFormat.generate "profiles" {
-            version = "2";
-            profiles = profiles;
-          };
-        }
-      );
-    };
-}

modules/services/step-ca/mtls.nix

@@ -1,5 +1,6 @@
 { inputs, lib, ... }:
 let
+  # Options that will be in common between
   opts = {
     enable = lib.mkEnableOption "Enable mTLS";
     caURL = lib.mkOption {
@@ -34,6 +35,10 @@ let
       type = lib.types.str;
       default = "admin";
     };
+    lifetime = lib.mkOption {
+      type = lib.types.str;
+      default = "6h";
+    };
     renew = {
       enable = lib.mkOption {
         description = "Enable automatic mTLS certificate renewal using a systemd timer.";
@@ -50,6 +55,16 @@ let
         type = lib.types.str;
         default = "5m";
       };
+      user = lib.mkOption {
+        description = "User account to run the mTLS renewal service as.";
+        type = lib.types.str;
+        default = "root";
+      };
+      group = lib.mkOption {
+        description = "Group to run the mTLS renewal service as. Defaults to the configured renewal user when null.";
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+      };
       reloadUnits = lib.mkOption {
         description = "systemd units to try-reload-or-restart after a successful certificate renewal.";
         type = lib.types.listOf lib.types.str;
@@ -62,6 +77,134 @@ let
       };
     };
   };
+
+  mkMtlsRenewScript = {
+    pkgs,
+    tlsCert,
+    tlsKey,
+    mtlsBundle,
+    reloadUnits ? [ ],
+    postCommands ? [ ],
+    systemctlArgs ? [ ],
+  }:
+  let
+    renewReloadScript = lib.concatMapStringsSep "\n" (unit: ''
+      if ${lib.getExe' pkgs.systemd "systemctl"} ${lib.escapeShellArgs systemctlArgs} --quiet is-active "${unit}"; then
+        ${lib.getExe' pkgs.systemd "systemctl"} ${lib.escapeShellArgs systemctlArgs} try-reload-or-restart "${unit}"
+      fi
+    '') reloadUnits;
+    renewPostCommands = lib.concatStringsSep "\n" postCommands;
+  in
+    pkgs.writeShellScriptBin "mtls-renew" ''
+      set -euo pipefail
+
+      if ${lib.getExe pkgs.step-cli} certificate needs-renewal "${tlsCert}"; then
+        echo "Renewing mTLS certificate"
+      else
+        echo "Skipping renew"
+        exit "$?"
+      fi
+
+      ${lib.getExe pkgs.step-cli} ca renew --force "${tlsCert}" "${tlsKey}"
+
+      umask 077
+      ${lib.getExe' pkgs.coreutils "cat"} "${tlsCert}" "${tlsKey}" > "${mtlsBundle}"
+
+      ${renewReloadScript}
+      ${renewPostCommands}
+    '';
+
+  mkNixosMtlsRenewService = {
+    pkgs,
+    tlsCert,
+    tlsKey,
+    mtlsBundle,
+    reloadUnits ? [ ],
+    postCommands ? [ ],
+    user ? "root",
+    group ? null,
+  }:
+  let
+    serviceGroup = if group == null then user else group;
+    renewScript = mkMtlsRenewScript {
+      inherit pkgs tlsCert tlsKey mtlsBundle reloadUnits postCommands;
+    };
+  in
+  {
+    description = "Renew the mTLS certificate when Smallstep marks it ready";
+    wantedBy = [ ];
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      User = user;
+      Group = serviceGroup;
+      ExecStart = lib.getExe renewScript;
+    };
+  };
+
+  mkNixosMtlsRenewTimer = {
+    onCalendar,
+    randomizedDelaySec,
+    unit ? "mtls-renew.service",
+  }: {
+    description = "Periodic Smallstep renewal for the mTLS certificate";
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      Persistent = true;
+      OnCalendar = onCalendar;
+      AccuracySec = "1us";
+      RandomizedDelaySec = randomizedDelaySec;
+      Unit = unit;
+    };
+  };
+
+  mkHomeManagerMtlsRenewService = {
+    pkgs,
+    tlsCert,
+    tlsKey,
+    mtlsBundle,
+    reloadUnits ? [ ],
+    postCommands ? [ ],
+  }:
+  let
+    renewScript = mkMtlsRenewScript {
+      inherit pkgs tlsCert tlsKey mtlsBundle reloadUnits postCommands;
+      systemctlArgs = [ "--user" ];
+    };
+  in
+  {
+    Unit = {
+      Description = "Renew the mTLS certificate when Smallstep marks it ready";
+      After = [ "network-online.target" ];
+      Wants = [ "network-online.target" ];
+    };
+    Service = {
+      Type = "oneshot";
+      ExecStart = lib.getExe renewScript;
+    };
+  };
+
+  mkHomeManagerMtlsRenewTimer = {
+    onCalendar,
+    randomizedDelaySec,
+    unit ? "mtls-renew.service",
+  }: {
+    Unit = {
+      Description = "Periodic Smallstep renewal for the mTLS certificate";
+    };
+    Timer = {
+      Persistent = true;
+      OnCalendar = onCalendar;
+      AccuracySec = "1us";
+      RandomizedDelaySec = randomizedDelaySec;
+      Unit = unit;
+    };
+    Install = {
+      WantedBy = [ "timers.target" ];
+    };
+  };
+
 in
 {
   flake.modules.nixos.mtls = { config, lib, pkgs, ... }:
@@ -73,12 +216,6 @@ in
       mtlsBundle = "${certDir}/${cfg.bundleFilename}";
       rootCA = "${certDir}/root_ca.crt";
       sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
-    renewReloadScript = lib.concatMapStringsSep "\n" (unit: ''
-      if ${lib.getExe' pkgs.systemd "systemctl"} --quiet is-active "${unit}"; then
-        ${lib.getExe' pkgs.systemd "systemctl"} try-reload-or-restart "${unit}"
-      fi
-    '') cfg.renew.reloadUnits;
-    renewPostCommands = lib.concatStringsSep "\n" cfg.renew.postCommands;
     in
     {
       options.mtls = opts;
@@ -91,7 +228,9 @@ in
               --ca-url ${cfg.caURL} \
               --root ${rootCA} \
               --provisioner ${cfg.provisioner} \
-            ${sanArgs}
+              --not-before=-5m --not-after=${cfg.lifetime} \
+              ${sanArgs} \
+              "$@"
             cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
           '')
           (writeShellScriptBin "mtls-check" ''
@@ -102,59 +241,14 @@ in
           '')
         ];
 
-      systemd.services.mtls-renew = lib.mkIf cfg.renew.enable {
-        description = "Renew the mTLS certificate when Smallstep marks it ready";
-        wantedBy = [ ];
-        after = [ "network-online.target" ];
-        wants = [ "network-online.target" ];
-        path = [ pkgs.coreutils pkgs.step-cli pkgs.systemd ];
-        serviceConfig = {
-          Type = "oneshot";
-          User = "root";
-          Group = "root";
-        };
-        script = ''
-          set -euo pipefail
+        systemd.services.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewService {
+          inherit pkgs tlsCert tlsKey mtlsBundle;
+          inherit (cfg.renew) reloadUnits postCommands user group;
+        });
 
-          if ${lib.getExe pkgs.step-cli} certificate needs-renewal "${tlsCert}"; then
-            echo "Renewing mTLS certificate"
-          else
-            rc=$?
-            if [ "$rc" -eq 1 ]; then
-              echo "mTLS certificate does not need renewal"
-              exit 0
-            fi
-
-            if [ "$rc" -eq 2 ]; then
-              echo "mTLS certificate missing: ${tlsCert}" >&2
-              exit 1
-            fi
-
-            echo "step certificate needs-renewal failed with rc=$rc" >&2
-            exit "$rc"
-          fi
-
-          ${lib.getExe pkgs.step-cli} ca renew --force "${tlsCert}" "${tlsKey}"
-
-          umask 077
-          cat "${tlsCert}" "${tlsKey}" > "${mtlsBundle}"
-
-          ${renewReloadScript}
-          ${renewPostCommands}
-        '';
-      };
-
-      systemd.timers.mtls-renew = lib.mkIf cfg.renew.enable {
-        description = "Periodic Smallstep renewal for the mTLS certificate";
-        wantedBy = [ "timers.target" ];
-        timerConfig = {
-          Persistent = true;
-          OnCalendar = cfg.renew.onCalendar;
-          AccuracySec = "1us";
-          RandomizedDelaySec = cfg.renew.randomizedDelaySec;
-          Unit = "mtls-renew.service";
-        };
-      };
+        systemd.timers.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewTimer {
+          inherit (cfg.renew) onCalendar randomizedDelaySec;
+        });
       };
     };
 
@@ -178,14 +272,16 @@ in
       };
 
       config = {
-      home.packages = with pkgs; [
+        home.packages = with pkgs; lib.optionals cfg.enable [
           step-cli
           (writeShellScriptBin "mtls-generate" ''
             set -euo pipefail
             ${lib.getExe pkgs.step-cli} ca certificate \
-            john-pc-ubuntu ${tlsCert} ${tlsKey} \
+              ${cfg.subject} ${tlsCert} ${tlsKey} \
+              --not-before=-5m --not-after=${cfg.lifetime} \
               --provisioner ${cfg.provisioner} \
-            ${sanArgs}
+              ${sanArgs} \
+              "$@"
             cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
           '')
           (writeShellScriptBin "mtls-check" ''
@@ -194,7 +290,17 @@ in
             -ext subjectAltName,extendedKeyUsage \
             -enddate -in ${mtlsBundle}
           '')
+          (mkMtlsRenewScript { inherit pkgs tlsCert tlsKey mtlsBundle; })
         ];
+
+        systemd.user.services.mtls-renew = lib.mkIf cfg.renew.enable (mkHomeManagerMtlsRenewService {
+          inherit pkgs tlsCert tlsKey mtlsBundle;
+          inherit (cfg.renew) reloadUnits postCommands;
+        });
+
+        systemd.user.timers.mtls-renew = lib.mkIf cfg.renew.enable (mkHomeManagerMtlsRenewTimer {
+          inherit (cfg.renew) onCalendar randomizedDelaySec;
+        });
       };
     };
 }