encrypt backups

backup.nix

@@ -10,9 +10,8 @@ let
   user = "misskey-backup";
   group = user;
 
-  # shell script file to be sourced. must have values "MISSKEY_BACKUP_BUCKET" "MISSKEY_BACKUP_PREFIX" and "S3CFG"
-  # $S3CFG must be a path to a .s3cfg file compatible with s3cmd
   backupConfigFile = "/etc/misskey-backup/conf";
+  s3Cfg = "/etc/misskey-backup/s3cfg";
   backupScript = pkgs.writeShellApplication {
     name = "misskey-backup";
 
@@ -21,13 +20,36 @@ let
       config.services.postgresql.package
       s3cmd
       coreutils
+      age
     ];
 
-    excludeShellChecks = [ "SC1091" ];
-
     text = ''
-      source "${backupConfigFile}"
-      pg_dump misskey | gzip | s3cmd put --config "$S3CFG" - "s3://$MISSKEY_BACKUP_BUCKET/\$\{MISSKEY_BACKUP_PREFIX}misskey-pgdump-$(date --iso-8601).sql.gz"
+      configFile="$1"
+      s3cfg="$2"
+
+      ageRecipient="age17ckyc69njpryytc63ynn545jswyucg28k5xg3043g3j6q38dxqwq0wzhm2"
+      bucket="$(cat "$configFile" | grep 'bucket=' | sed 's/bucket \?= \?')"
+      prefix="$(cat "$configFile" | grep 'prefix=' | sed 's/prefix \?= \?')"
+
+      s3Dir="s3://$bucket/\$\{prefix}misskey-$(date --iso-8601)"
+      echo "Uploading backups to '$s3Dir'"
+
+      function upload () {
+        name="$1"
+
+        age -r "$ageRecipient" | s3cmd put --config "$s3cfg" - "$s3Dir/$name.age"
+      }
+
+      echo "Uploading config"
+      tar -cz -C /srv/misskey/.config . | upload "config.tar.gz"
+
+      echo "Dumping postgres database..."
+      pg_dump misskey | gzip | upload "pg_dump.sql.gz"
+
+      echo "Uploading redis database..."
+      tar -cz -C /var/lib/redis-misskey . | upload "redis.tar.gz"
+
+      echo "Backup complete to '$s3Dir'"
     '';
   };
 in {
@@ -42,7 +64,7 @@ in {
     enable = true;
     systemCronJobs = [
       # run every monday at ass in the morning, EST"
-      "0 8 0 0 1 ${user} ${backupScript}"
+      "0 8 0 0 1 ${user} ${backupScript} ${backupConfigFile} ${s3Cfg}"
     ];
   };
 }