wip

bundles/archive/README.md

@@ -0,0 +1,10 @@
+```
+defaults = {
+    'archive': {
+        'exclude': [
+          '\.cache/',
+          '\.log$',
+        ],
+    },
+}
+```

bundles/archive/files/archive

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-if [[ '$1' == 'perform' ]]
+if [[ "$1" == 'perform' ]]
 then
   echo 'NON-DRY RUN'
   DRY=''
@@ -22,6 +22,6 @@ gsutil ${'\\'}
     -e ${'\\'}
     -x '${'|'.join(conf['exclude'])}' ${'\\'}
     '${dir}' ${'\\'}
-    'gs://${bucket}/${node.name}${dir}'
+    'gs://${bucket}/${node.name}${dir}' ${'\\'}
-
+    2>&1 | tee | logger -t gsutil
 % endfor

bundles/archive/items.py

@@ -7,7 +7,7 @@ files['/opt/archive'] = {
         'dirs': node.metadata.get('archive'),
         'bucket': node.metadata.get('gcloud/bucket'),
         'processes': 4,
-        'threads': 16,
+        'threads': 4,
     },
     'needs': [
         'bundle:gcloud',

bundles/archive/metadata.py

@@ -1,4 +1,20 @@
 defaults = {
-    'backup': [],
     'archive': {},
 }
+
+
+@metadata_reactor.provides(
+    'gocryptfs',
+)
+def gocryptfs(metadata):
+    gocryptfs = {}
+    
+    for path in metadata.get('archive'):
+        gocryptfs[path] = {
+            'mountpoint': f'/mnt/gocryptfs{path}',
+            'reverse': True,
+        } 
+
+    return {
+        'gocryptfs': gocryptfs,
+    }

bundles/gcloud/README.md

@@ -4,4 +4,8 @@ gcloud projects add-iam-policy-binding sublimity-182017 --member 'serviceAccount
 gsutil -o "GSUtil:parallel_process_count=3" -o GSUtil:parallel_thread_count=4 -m rsync -r -d -e /var/vmail gs://sublimity-backup/mailserver
 gsutil config
 gsutil versioning set on gs://sublimity-backup
+
+
+
+gcsfuse --key-file /root/.config/gcloud/service_account.json sublimity-backup gcsfuse
 ```

bundles/gocryptfs/items.py

@@ -0,0 +1,40 @@
+from hashlib import sha3_256
+from base64 import b64decode, b64encode
+from binascii import hexlify
+from uuid import UUID
+from json import dumps
+
+id = node.metadata.get('id')
+
+directories['/etc/gocryptfs'] = {
+    'purge': True,
+}
+
+files['/etc/gocryptfs/masterkey'] = {
+    'content': hexlify(b64decode(
+        str(repo.vault.random_bytes_as_base64_for(id, length=32))
+    )),
+    'mode': '500',
+}
+
+files['/etc/gocryptfs/gocryptfs.conf'] = {
+    'content': dumps({
+    	'Version': 2,
+    	'Creator': 'gocryptfs 1.6.1',
+    	'ScryptObject': {
+    		'Salt': b64encode(
+                sha3_256(UUID(id).bytes).digest()
+            ).decode(),
+    		'N': 65536,
+    		'R': 8,
+    		'P': 1,
+    		'KeyLen': 32,
+    	},
+    	'FeatureFlags': [
+    		'GCMIV128',
+    		'HKDF',
+    		'PlaintextNames',
+    		'AESSIV',
+    	]
+    }, indent=4, sort_keys=True)
+}

bundles/gocryptfs/metadata.py

@@ -0,0 +1,18 @@
+defaults = {
+    'gocryptfs': {},
+}
+
+
+@metadata_reactor.provides(
+    'gocryptfs',
+)
+def gocryptfs(metadata):
+    gocryptfs = {}
+    
+    for path, options in metadata.get('gocryptfs'):
+        gocryptfs[path] = {
+        } 
+
+    return {
+        'gocryptfs': gocryptfs,
+    }

groups/applications/archive.py

@@ -4,5 +4,6 @@
     ],
     'bundles': [
         'archive',
+        'gocryptfs',
     ],
 }

nodes/home.backups.py

@@ -2,5 +2,7 @@
     'groups': [
         'debian-10',
     ],
-    'metadata': {},
+    'metadata': {
+        'id': '9cf52515-63a1-4659-a8ec-6c3c881727e5',
+    },
 }

nodes/home.server.py

@@ -11,6 +11,7 @@
         'wireguard',
     ],
     'metadata': {
+        'id': 'af96709e-b13f-4965-a588-ef2cd476437a',
         'network': {
             'interface': 'enp1s0f0',
             'ipv4': '10.0.0.2/24',

nodes/htz.games.py

@@ -6,5 +6,7 @@
         'steam',
         'l4d2',
     ],
-    'metadata': {},
+    'metadata': {
+        'id': '353bb086-f3ce-4f36-8533-e91786c91ed9',
+    },
 }

nodes/htz.mails.py

@@ -1,6 +1,7 @@
 {
     'hostname': '162.55.188.157',
     'groups': [
+        'archive',
         'hetzner-cloud',
         'debian-10',
         'mailserver',
@@ -27,6 +28,7 @@
                 'ckn.li': [],
             },
         },
+        'id': 'ea29bdf0-0b47-4bf4-8346-67d60c9dc4ae',
         'network': {
             'interface': 'eth0',
             'ipv4': '162.55.188.157/32',