3 files changed, 169 insertions, 0 deletions
diff --git a/lass/3modules/default.nix b/lass/3modules/default.nix
index 0c10e1ec2..2cf6a66b9 100644
--- a/lass/3modules/default.nix
+++ b/lass/3modules/default.nix
@@ -7,7 +7,9 @@ _:
     ./hosts.nix
     ./mysql-backup.nix
     ./news.nix
+    ./nichtparasoup.nix
     ./pyload.nix
+    ./restic.nix
     ./screenlock.nix
     ./umts.nix
     ./usershadow.nix
diff --git a/lass/3modules/nichtparasoup.nix b/lass/3modules/nichtparasoup.nix
new file mode 100644
index 000000000..632481b69
--- /dev/null
+++ b/lass/3modules/nichtparasoup.nix
@@ -0,0 +1,48 @@
+{ config, lib, pkgs, ... }:
+
+with import <stockholm/lib>;
+
+{
+  options.lass.nichtparasoup = {
+    enable = mkEnableOption "nichtparasoup funny image page";
+    config = mkOption {
+      type = types.str;
+      default = ''
+        [General]
+        Port: 5001
+        IP: 0.0.0.0
+        Useragent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1.25
+
+        [Cache]
+        Images_min_limit: 15
+
+        [Logging]
+        ;; possible destinations: file syslog
+        Destination: syslog
+        Verbosity: ERROR
+
+        [Sites]
+        SoupIO: everyone
+        Pr0gramm: new,top
+        Reddit: gifs,reactiongifs,ANormalDayInRussia,perfectloops,reallifedoodles,bizarrebuildings,cablefail,cableporn,educationalgifs,EngineeringPorn,holdmybeer,itsaunixsystem,loadingicon,michaelbaygifs,nononoyesno,oddlysatisfying,ofcoursethatsathing,OSHA,PeopleFuckingDying,PerfectTiming,PixelArt,RetroFuturism,robotsbeingjerks,scriptedasiangifs,shittyrobots,startrekstabilized,ThingsCutInHalfPorn,totallynotrobots,Unexpected
+        NineGag: geeky,wtf,hot,trending
+        Instagram: nature,wtf
+        Fourchan: sci
+      '';
+    };
+  };
+
+  config = mkIf config.lass.nichtparasoup.enable {
+    systemd.services.nichtparasoup = {
+      description = "nichtparasoup";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      restartIfChanged = true;
+      serviceConfig = {
+        Restart = "always";
+        ExecStart = "${pkgs.nichtparasoup}/bin/nichtparasoup -c ${pkgs.writeText "config.ini"config.lass.nichtparasoup.config}";
+      };
+    };
+  };
+}
diff --git a/lass/3modules/restic.nix b/lass/3modules/restic.nix
new file mode 100644
index 000000000..c720793b1
--- /dev/null
+++ b/lass/3modules/restic.nix
@@ -0,0 +1,119 @@
+{ config, lib, pkgs, ... }:
+
+with import <stockholm/lib>;
+
+{
+  options.lass.restic = mkOption {
+    type = types.attrsOf (types.submodule ({ config, ... }: {
+      options = {
+        name = mkOption {
+          type = types.str;
+          default = config._module.args.name;
+        };
+        passwordFile = mkOption {
+          type = types.str;
+          default = toString <secrets/restic-password>;
+          description = ''
+            read the repository password from a file.
+          '';
+          example = "/etc/nixos/restic-password";
+
+        };
+        repo = mkOption {
+          type = types.str;
+          default = "sftp:backup@prism.r:/backups/${config.name}";
+          description = ''
+            repository to backup to.
+          '';
+          example = "sftp:backup@192.168.1.100:/backups/${config.name}";
+        };
+        dirs = mkOption {
+          type = types.listOf types.str;
+          default = [];
+          description = ''
+            which directories to backup.
+          '';
+          example = [
+            "/var/lib/postgresql"
+            "/home/user/backup"
+          ];
+        };
+        timerConfig = mkOption {
+          type = types.attrsOf types.str;
+          default = {
+            OnCalendar = "daily";
+          };
+          description = ''
+            When to run the backup. See man systemd.timer for details.
+          '';
+          example = {
+            OnCalendar = "00:05";
+            RandomizedDelaySec = "5h";
+          };
+        };
+        user = mkOption {
+          type = types.str;
+          default = "root";
+          description = ''
+            As which user the backup should run.
+          '';
+          example = "postgresql";
+        };
+        extraArguments = mkOption {
+          type = types.listOf types.str;
+          default = [];
+          description = ''
+            Extra arguments to append to the restic command.
+          '';
+          example = [
+            "sftp.command='ssh backup@192.168.1.100 -i /home/user/.ssh/id_rsa -s sftp"
+          ];
+        };
+        initialize = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Create the repository if it doesn't exist.
+          '';
+        };
+      };
+    }));
+    default = {};
+  };
+
+  config = {
+    systemd.services =
+      mapAttrs' (_: plan:
+        let
+          extraArguments = concatMapStringsSep " " (arg: "-o ${arg}") plan.extraArguments;
+          connectTo = elemAt (splitString ":" plan.repo) 1;
+          resticCmd = "${pkgs.restic}/bin/restic ${extraArguments}";
+        in nameValuePair "backup.${plan.name}" {
+          environment = {
+            RESTIC_PASSWORD_FILE = plan.passwordFile;
+            RESTIC_REPOSITORY = plan.repo;
+          };
+          path = with pkgs; [
+            openssh
+          ];
+          restartIfChanged = false;
+          serviceConfig = {
+            ExecStartPre = mkIf plan.initialize (pkgs.writeScript "rustic-${plan.name}-init" ''
+              #! ${pkgs.bash}/bin/bash
+              ${resticCmd} snapshots || ${resticCmd} init
+            '');
+            ExecStart = pkgs.writeDash "rustic-${plan.name}" (
+              "#! ${pkgs.bash}/bin/bash\n" +
+              concatMapStringsSep "\n" (dir: "${resticCmd} backup ${dir}") plan.dirs
+            );
+            User = plan.user;
+          };
+        }
+      ) config.lass.restic;
+    systemd.timers =
+      mapAttrs' (_: plan: nameValuePair "backup.${plan.name}" {
+        wantedBy = [ "timers.target" ];
+        timerConfig = plan.timerConfig;
+      }) config.lass.restic;
+  };
+}