From a226298f4d545ea66b830833ef9f19c1785a4546 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 23 Dec 2015 13:08:42 +0100
Subject: tv wu: services.bitlbee.plugins += fb

---
 tv/1systems/wu.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

(limited to 'tv')

diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index cd3139754..a768e781b 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -234,7 +234,12 @@ with lib;
     KERNEL=="hpet", GROUP="audio"
   '';
 
-  services.bitlbee.enable = true;
+  services.bitlbee = {
+    enable = true;
+    plugins = [
+      pkgs.bitlbee-facebook
+    ];
+  };
   services.tor.client.enable = true;
   services.tor.enable = true;
   services.virtualboxHost.enable = true;
-- 
cgit v1.2.3


From 763f0db52ad45eef6e09d7982cd0f6cd898857e3 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 26 Dec 2015 05:55:13 +0100
Subject: {pkgs => lib}.genid

---
 tv/1systems/wu.nix        | 1 -
 tv/1systems/xu.nix        | 1 -
 tv/2configs/charybdis.nix | 4 ++--
 tv/2configs/pulse.nix     | 8 +++-----
 tv/3modules/consul.nix    | 4 ++--
 tv/3modules/ejabberd.nix  | 4 ++--
 6 files changed, 9 insertions(+), 13 deletions(-)

(limited to 'tv')

diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index a768e781b..54ceb7783 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -16,7 +16,6 @@ with lib;
       environment.systemPackages = with pkgs; [
 
         # stockholm
-        genid
         gnumake
         hashPassword
         lentil
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index eac36fafb..1f3e010a4 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -19,7 +19,6 @@ with lib;
       environment.systemPackages = with pkgs; [
 
         # stockholm
-        genid
         gnumake
         hashPassword
         lentil
diff --git a/tv/2configs/charybdis.nix b/tv/2configs/charybdis.nix
index 80c6f7c4a..f9ab3da68 100644
--- a/tv/2configs/charybdis.nix
+++ b/tv/2configs/charybdis.nix
@@ -72,9 +72,9 @@ let
     };
   };
 
-  user = {
+  user = rec {
     name = "charybdis";
-    uid = 3748224544; # genid charybdis
+    uid = genid name;
   };
 
   configFile = toFile "charybdis-ircd.conf" ''
diff --git a/tv/2configs/pulse.nix b/tv/2configs/pulse.nix
index 0ddc52789..3db3532d5 100644
--- a/tv/2configs/pulse.nix
+++ b/tv/2configs/pulse.nix
@@ -69,12 +69,10 @@ in
     };
   };
 
-  users = let
-    id = 3768151709; # genid pulse
-  in {
-    groups.pulse.gid = id;
+  users = {
+    groups.pulse.gid = config.users.users.pulse.uid;
     users.pulse = {
-      uid = id;
+      uid = genid "pulse";
       group = "pulse";
       extraGroups = [ "audio" ];
       home = "${runDir}/home";
diff --git a/tv/3modules/consul.nix b/tv/3modules/consul.nix
index ccdee07f5..5c955fdb5 100644
--- a/tv/3modules/consul.nix
+++ b/tv/3modules/consul.nix
@@ -109,9 +109,9 @@ let
     };
   };
 
-  user = {
+  user = rec {
     name = "consul";
-    uid = 2999951406; # genid consul
+    uid = genid name;
   };
 
 in
diff --git a/tv/3modules/ejabberd.nix b/tv/3modules/ejabberd.nix
index 6b231fb56..581e10074 100644
--- a/tv/3modules/ejabberd.nix
+++ b/tv/3modules/ejabberd.nix
@@ -53,9 +53,9 @@ let
     };
   };
 
-  user = {
+  user = rec {
     name = "ejabberd";
-    uid = 3499746127; # genid ejabberd
+    uid = genid name;
   };
 
   my-ejabberdctl = pkgs.writeScriptBin "ejabberdctl" ''
-- 
cgit v1.2.3


From ecab96d64f057d639795578784f2785ee5f486a9 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 27 Dec 2015 19:33:12 +0100
Subject: tv vim: ensure relevant dirs exist

---
 tv/2configs/vim.nix | 34 +++++++++++++++++++++++++++++-----
 1 file changed, 29 insertions(+), 5 deletions(-)

(limited to 'tv')

diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index 0822fb5bf..0537fa7d8 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -4,7 +4,7 @@ with lib;
 let
   out = {
     environment.systemPackages = [
-      pkgs.vim
+      vim
     ];
 
     # Nano really is just a stupid name for Vim.
@@ -22,14 +22,38 @@ let
     "${pkgs.vimPlugins.undotree}/share/vim-plugins/undotree"
   ];
 
+  dirs = {
+    backupdir = "$HOME/.cache/vim/backup";
+    swapdir   = "$HOME/.cache/vim/swap";
+    undodir   = "$HOME/.cache/vim/undo";
+  };
+  files = {
+    viminfo   = "$HOME/.cache/vim/info";
+  };
+
+  mkdirs = let
+    dirOf = s: let out = concatStringsSep "/" (init (splitString "/" s));
+               in assert out != ""; out;
+    alldirs = attrValues dirs ++ map dirOf (attrValues files);
+  in unique (sort lessThan alldirs);
+
+  vim = pkgs.writeScriptBin "vim" ''
+    #! ${pkgs.dash}/bin/dash
+    set -f
+    umask 0077
+    ${concatStringsSep "\n" (map (x: "mkdir -p ${x}") mkdirs)}
+    umask 0022
+    exec ${pkgs.vim}/bin/vim "$@"
+  '';
+
   vimrc = pkgs.writeText "vimrc" ''
     set nocompatible
 
     set autoindent
     set backspace=indent,eol,start
     set backup
-    set backupdir=$HOME/.vim/backup/
-    set directory=$HOME/.vim/cache//
+    set backupdir=${dirs.backupdir}/
+    set directory=${dirs.swapdir}//
     set hlsearch
     set incsearch
     set mouse=a
@@ -40,11 +64,11 @@ let
     set showcmd
     set showmatch
     set ttimeoutlen=0
-    set undodir=$HOME/.vim/undo
+    set undodir=${dirs.undodir}
     set undofile
     set undolevels=1000000
     set undoreload=1000000
-    set viminfo='20,<1000,s100,h,n$HOME/.vim/cache/info
+    set viminfo='20,<1000,s100,h,n${files.viminfo}
     set visualbell
     set wildignore+=*.o,*.class,*.hi,*.dyn_hi,*.dyn_o
     set wildmenu
-- 
cgit v1.2.3


From 5b11cb09e24b8f6b89f80f6ca092cf4000418741 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 27 Dec 2015 23:12:01 +0100
Subject: tv: disable display-manager

---
 tv/2configs/xserver/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'tv')

diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix
index f56da7dcc..facde4e76 100644
--- a/tv/2configs/xserver/default.nix
+++ b/tv/2configs/xserver/default.nix
@@ -48,7 +48,7 @@ let
       "slock"
     ];
 
-    systemd.services.display-manager = mkForce {};
+    systemd.services.display-manager.enable = false;
 
     services.xserver.enable = true;
 
-- 
cgit v1.2.3


From b17e484d614486dc0c1cc45a954ead28f15dc074 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 28 Dec 2015 00:02:58 +0100
Subject: tv backup: initial commit

---
 tv/1systems/cd.nix     |   1 +
 tv/1systems/xu.nix     |   1 +
 tv/2configs/backup.nix | 254 +++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 256 insertions(+)
 create mode 100644 tv/2configs/backup.nix

(limited to 'tv')

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 8c2a9ae43..7cb903a44 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -7,6 +7,7 @@ with lib;
   krebs.build.target = "root@cd.internet";
 
   imports = [
+    ../2configs/backup.nix
     ../2configs/hw/CAC-Developer-2.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
     #../2configs/consul-server.nix
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 1f3e010a4..e1a9076dc 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -9,6 +9,7 @@ with lib;
     "7ae05edcdd14f6ace83ead9bf0d114e97c89a83a";
 
   imports = [
+    ../2configs/backup.nix # TODO
     ../2configs/hw/x220.nix
     #../2configs/consul-client.nix
     ../2configs/git.nix
diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix
new file mode 100644
index 000000000..1cef0a6dc
--- /dev/null
+++ b/tv/2configs/backup.nix
@@ -0,0 +1,254 @@
+{ config, lib, pkgs, ... }:
+with lib;
+let
+  # Users that are allowed to connect to the backup user.
+  # Note: the user must own a push plan destination otherwise no rsync.
+  backup-users = [
+    config.krebs.users.tv
+  ];
+
+  ## TODO parse.file-location admit user
+  ## loc has the form <host-name>:<abs-path>
+  #parse.file-location = loc: let
+  #  parts = splitString ":" loc;
+  #  host-name = head parts;
+  #  path = concatStringsSep ":" (tail parts);
+  #in {
+  #  type = "types.krebs.file-location";
+  #  host = config.krebs.hosts.${host-name};
+  #  path = path;
+  #};
+
+  # TODO assert plan.dst.path & co
+  plans = with config.krebs.users; with config.krebs.hosts; addNames {
+    xu-test-cd = {
+      method = "push";
+      #src = parse.file-location xu:/tmp/xu-test;
+      #dst = parse.file-location cd:/krebs/backup/xu-test;
+      src = { user = tv; host = xu; path = "/tmp/xu-test"; };
+      dst = { user = tv; host = cd; path = "/krebs/backup/xu-test"; };
+      startAt = "0,6,12,18:00";
+      retain = {
+        hourly = 4; # sneakily depends on startAt
+        daily = 7;
+        weekly = 4;
+        monthly = 3;
+      };
+    };
+    #xu-test-wu = {
+    #  method = "push";
+    #  dst = { user = tv; host = wu; path = "/krebs/backup/xu-test"; };
+    #};
+    cd-test-xu = {
+      method = "pull";
+      #src = parse.file-location cd:/tmp/cd-test;
+      #dst = parse.file-location xu:/bku/cd-test;
+      src = { user = tv; host = cd; path = "/tmp/cd-test"; };
+      dst = { user = tv; host = xu; path = "/bku/cd-test"; };
+    };
+
+  };
+
+  out = {
+    #options.krebs.backup = api;
+    config = imp;
+  };
+
+  imp = {
+    users.groups.backup.gid = genid "backup";
+    users.users = map makeUser (filter isPushDst (attrValues plans));
+    systemd.services =
+      flip mapAttrs' (filterAttrs (_:isPushSrc) plans) (name: plan: {
+        name = "backup.${name}";
+        value = makePushService plan;
+      });
+  };
+
+
+  # TODO getFQDN: admit hosts in other domains
+  getFQDN = host: "${host.name}.${config.krebs.search-domain}";
+
+  isPushSrc = plan:
+    plan.method == "push" &&
+    plan.src.host.name == config.krebs.build.host.name;
+
+  makePushService = plan: assert isPushSrc plan; {
+    startAt = plan.startAt;
+    serviceConfig.ExecStart = writeSh plan "rsync" ''
+      exec ${pkgs.rsync}/bin/rsync ${concatMapStringsSep " " shell.escape [
+        "-a"
+        "-e"
+        "${pkgs.openssh}/bin/ssh -F /dev/null -i ${plan.src.host.ssh.privkey.path}"
+        "${plan.src.path}"
+        "${plan.name}@${getFQDN plan.dst.host}::push"
+      ]}
+    '';
+  };
+
+  isPushDst = plan:
+    plan.method == "push" &&
+    plan.dst.host.name == config.krebs.build.host.name;
+
+  makeUser = plan: assert isPushDst plan; rec {
+    name = plan.name;
+    uid = genid name;
+    group = config.users.groups.backup.name;
+    home = plan.dst.path;
+    createHome = true;
+    shell = "${writeSh plan "shell" ''
+      case $2 in
+        'rsync --server --daemon .')
+          exec ${backup.rsync plan [ "--server" "--daemon" "." ]}
+          ;;
+        ''')
+          echo "ERROR: no command specified" >&2
+          exit 23
+          ;;
+        *)
+          echo "ERROR: no unknown command: $SSH_ORIGINAL_COMMAND" >&2
+          exit 23
+          ;;
+      esac
+    ''}";
+    openssh.authorizedKeys.keys = [ plan.src.host.ssh.pubkey ];
+  };
+
+  rsync = plan: args: writeSh plan "rsync" ''
+    install -v -m 0700 -d ${plan.dst.path}/push >&2
+    install -v -m 0700 -d ${plan.dst.path}/list >&2
+
+    ${pkgs.rsync}/bin/rsync \
+        --config=${backup.rsyncd-conf plan {
+          post-xfer = writeSh plan "rsyncd.post-xfer" ''
+            case $RSYNC_EXIT_STATUS in 0)
+              exec ${backup.rsnapshot plan {
+                preexec = writeSh plan "rsnapshot.preexec" ''
+                  touch ${plan.dst.path}/rsnapshot.$RSNAPSHOT_INTERVAL
+                '';
+                postexec = writeSh plan "rsnapshot.postexec" ''
+                  rm ${plan.dst.path}/rsnapshot.$RSNAPSHOT_INTERVAL
+                '';
+              }}
+            esac
+          '';
+        }} \
+        ${toString (map shell.escape args)}
+
+    fail=0
+    for i in monthly weekly daily hourly; do
+      if test -e ${plan.dst.path}/rsnapshot.$i; then
+        rm ${plan.dst.path}/rsnapshot.$i
+        echo "ERROR: $i snapshot failed" >&2
+        fail=1
+      fi
+    done
+    if test $fail != 0; then
+      exit -1
+    fi
+  '';
+
+  rsyncd-conf = plan: conf: pkgs.writeText "${plan.name}.rsyncd.conf" ''
+    fake super = yes
+    use chroot = no
+    lock file = ${plan.dst.path}/rsyncd.lock
+
+    [push]
+    max connections = 1
+    path = ${plan.dst.path}/push
+    write only = yes
+    read only = no
+    post-xfer exec = ${conf.post-xfer}
+
+    [list]
+    path = ${plan.dst.path}/list
+    read only = yes
+    write only = no
+  '';
+
+  rsnapshot = plan: conf: writeSh plan "rsnapshot" ''
+    rsnapshot() {
+      ${pkgs.proot}/bin/proot \
+          -b /bin \
+          -b /nix \
+          -b /run/current-system \
+          -b ${plan.dst.path} \
+          -r ${plan.dst.path} \
+          -w / \
+          ${pkgs.rsnapshot}/bin/rsnapshot \
+              -c ${pkgs.writeText "${plan.name}.rsnapshot.conf" ''
+                config_version	1.2
+                snapshot_root	${plan.dst.path}/list
+                cmd_cp	${pkgs.coreutils}/bin/cp
+                cmd_du	${pkgs.coreutils}/bin/du
+                #cmd_rm	${pkgs.coreutils}/bin/rm
+                cmd_rsync	${pkgs.rsync}/bin/rsync
+                cmd_rsnapshot_diff	${pkgs.rsnapshot}/bin/rsnapshot-diff
+                cmd_preexec	${conf.preexec}
+                cmd_postexec	${conf.postexec}
+                retain	hourly	4
+                retain	daily	7
+                retain	weekly	4
+                retain	monthly	3
+                lockfile	${plan.dst.path}/rsnapshot.pid
+                link_dest	1
+                backup	/push	./
+                verbose	4
+              ''} \
+          "$@"
+    }
+
+    cd ${plan.dst.path}/list/
+
+    now=$(date +%s)
+    is_older_than() {
+      test $(expr $now - $(date +%s -r $1 2>/dev/null || echo 0)) \
+       -ge $2
+    }
+
+    # TODO report stale snapshots
+    # i.e. there are $interval.$i > $interval.$max
+
+    hour_s=3600
+    day_s=86400
+    week_s=604800
+    month_s=2419200 # 4 weeks
+
+    set --
+
+    if test -e weekly.3 && is_older_than monthly.0 $month_s; then
+      set -- "$@" monthly
+    fi
+
+    if test -e daily.6 && is_older_than weekly.0 $week_s; then
+      set -- "$@" weekly
+    fi
+
+    if test -e hourly.3 && is_older_than daily.0 $day_s; then
+      set -- "$@" daily
+    fi
+
+    if is_older_than hourly.0 $hour_s; then
+      set -- "$@" hourly
+    fi
+
+
+    if test $# = 0; then
+      echo "taking no snapshots" >&2
+    else
+      echo "taking snapshots: $@" >&2
+    fi
+
+    export RSNAPSHOT_INTERVAL
+    for RSNAPSHOT_INTERVAL; do
+      rsnapshot "$RSNAPSHOT_INTERVAL"
+    done
+  '';
+
+  writeSh = plan: name: text: pkgs.writeScript "${plan.name}.${name}" ''
+    #! ${pkgs.dash}/bin/dash
+    set -efu
+    export PATH=${makeSearchPath "bin" (with pkgs; [ coreutils ])}
+    ${text}
+  '';
+
+in out
-- 
cgit v1.2.3


From 5a9ccbef0abe1f3acb16d716a2e1d7faa9bb0af1 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 28 Dec 2015 19:43:31 +0100
Subject: {tv 2 => krebs 3} backup

---
 tv/1systems/cd.nix      |   1 -
 tv/1systems/xu.nix      |   1 -
 tv/2configs/backup.nix  | 268 +++++-------------------------------------------
 tv/2configs/default.nix |   1 +
 4 files changed, 29 insertions(+), 242 deletions(-)

(limited to 'tv')

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 7cb903a44..8c2a9ae43 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -7,7 +7,6 @@ with lib;
   krebs.build.target = "root@cd.internet";
 
   imports = [
-    ../2configs/backup.nix
     ../2configs/hw/CAC-Developer-2.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
     #../2configs/consul-server.nix
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index e1a9076dc..1f3e010a4 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -9,7 +9,6 @@ with lib;
     "7ae05edcdd14f6ace83ead9bf0d114e97c89a83a";
 
   imports = [
-    ../2configs/backup.nix # TODO
     ../2configs/hw/x220.nix
     #../2configs/consul-client.nix
     ../2configs/git.nix
diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix
index 1cef0a6dc..51d3bb8a7 100644
--- a/tv/2configs/backup.nix
+++ b/tv/2configs/backup.nix
@@ -1,38 +1,22 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, ... }:
 with lib;
-let
-  # Users that are allowed to connect to the backup user.
-  # Note: the user must own a push plan destination otherwise no rsync.
-  backup-users = [
-    config.krebs.users.tv
-  ];
-
-  ## TODO parse.file-location admit user
-  ## loc has the form <host-name>:<abs-path>
-  #parse.file-location = loc: let
-  #  parts = splitString ":" loc;
-  #  host-name = head parts;
-  #  path = concatStringsSep ":" (tail parts);
-  #in {
-  #  type = "types.krebs.file-location";
-  #  host = config.krebs.hosts.${host-name};
-  #  path = path;
-  #};
-
-  # TODO assert plan.dst.path & co
-  plans = with config.krebs.users; with config.krebs.hosts; addNames {
+{
+  krebs.backup.plans = addNames {
     xu-test-cd = {
       method = "push";
-      #src = parse.file-location xu:/tmp/xu-test;
-      #dst = parse.file-location cd:/krebs/backup/xu-test;
-      src = { user = tv; host = xu; path = "/tmp/xu-test"; };
-      dst = { user = tv; host = cd; path = "/krebs/backup/xu-test"; };
-      startAt = "0,6,12,18:00";
-      retain = {
-        hourly = 4; # sneakily depends on startAt
-        daily = 7;
-        weekly = 4;
-        monthly = 3;
+
+      src = { host = config.krebs.hosts.xu; path = "/tmp/xu-test"; };
+      dst = { host = config.krebs.hosts.cd; path = "/tmp/backups/xu-test"; };
+
+      #startAt = "0,6,12,18:00";
+      startAt = "minutely";
+      snapshots = {
+        minutely = { format = "%Y-%m-%dT%H:%M"; retain =  5; };
+        hourly   = { format = "%Y-%m-%dT%H";    retain =  4; };
+        daily    = { format = "%Y-%m-%d";       retain =  7; };
+        weekly   = { format = "%YW%W";          retain =  4; };
+        monthly  = { format = "%Y-%m";          retain = 12; };
+        yearly   = { format = "%Y";                          };
       };
     };
     #xu-test-wu = {
@@ -41,214 +25,18 @@ let
     #};
     cd-test-xu = {
       method = "pull";
-      #src = parse.file-location cd:/tmp/cd-test;
-      #dst = parse.file-location xu:/bku/cd-test;
-      src = { user = tv; host = cd; path = "/tmp/cd-test"; };
-      dst = { user = tv; host = xu; path = "/bku/cd-test"; };
+      src = { host = config.krebs.hosts.cd; path = "/tmp/cd-test"; };
+      dst = { host = config.krebs.hosts.xu; path = "/tmp/backups/cd-test"; };
+      startAt = "minutely";
+      snapshots = {
+        minutely = { format = "%Y-%m-%dT%H:%M"; retain =  5; };
+        hourly   = { format = "%Y-%m-%dT%H";    retain =  4; };
+        daily    = { format = "%Y-%m-%d";       retain =  7; };
+        weekly   = { format = "%YW%W";          retain =  4; };
+        monthly  = { format = "%Y-%m";          retain = 12; };
+        yearly   = { format = "%Y";                          };
+      };
     };
 
   };
-
-  out = {
-    #options.krebs.backup = api;
-    config = imp;
-  };
-
-  imp = {
-    users.groups.backup.gid = genid "backup";
-    users.users = map makeUser (filter isPushDst (attrValues plans));
-    systemd.services =
-      flip mapAttrs' (filterAttrs (_:isPushSrc) plans) (name: plan: {
-        name = "backup.${name}";
-        value = makePushService plan;
-      });
-  };
-
-
-  # TODO getFQDN: admit hosts in other domains
-  getFQDN = host: "${host.name}.${config.krebs.search-domain}";
-
-  isPushSrc = plan:
-    plan.method == "push" &&
-    plan.src.host.name == config.krebs.build.host.name;
-
-  makePushService = plan: assert isPushSrc plan; {
-    startAt = plan.startAt;
-    serviceConfig.ExecStart = writeSh plan "rsync" ''
-      exec ${pkgs.rsync}/bin/rsync ${concatMapStringsSep " " shell.escape [
-        "-a"
-        "-e"
-        "${pkgs.openssh}/bin/ssh -F /dev/null -i ${plan.src.host.ssh.privkey.path}"
-        "${plan.src.path}"
-        "${plan.name}@${getFQDN plan.dst.host}::push"
-      ]}
-    '';
-  };
-
-  isPushDst = plan:
-    plan.method == "push" &&
-    plan.dst.host.name == config.krebs.build.host.name;
-
-  makeUser = plan: assert isPushDst plan; rec {
-    name = plan.name;
-    uid = genid name;
-    group = config.users.groups.backup.name;
-    home = plan.dst.path;
-    createHome = true;
-    shell = "${writeSh plan "shell" ''
-      case $2 in
-        'rsync --server --daemon .')
-          exec ${backup.rsync plan [ "--server" "--daemon" "." ]}
-          ;;
-        ''')
-          echo "ERROR: no command specified" >&2
-          exit 23
-          ;;
-        *)
-          echo "ERROR: no unknown command: $SSH_ORIGINAL_COMMAND" >&2
-          exit 23
-          ;;
-      esac
-    ''}";
-    openssh.authorizedKeys.keys = [ plan.src.host.ssh.pubkey ];
-  };
-
-  rsync = plan: args: writeSh plan "rsync" ''
-    install -v -m 0700 -d ${plan.dst.path}/push >&2
-    install -v -m 0700 -d ${plan.dst.path}/list >&2
-
-    ${pkgs.rsync}/bin/rsync \
-        --config=${backup.rsyncd-conf plan {
-          post-xfer = writeSh plan "rsyncd.post-xfer" ''
-            case $RSYNC_EXIT_STATUS in 0)
-              exec ${backup.rsnapshot plan {
-                preexec = writeSh plan "rsnapshot.preexec" ''
-                  touch ${plan.dst.path}/rsnapshot.$RSNAPSHOT_INTERVAL
-                '';
-                postexec = writeSh plan "rsnapshot.postexec" ''
-                  rm ${plan.dst.path}/rsnapshot.$RSNAPSHOT_INTERVAL
-                '';
-              }}
-            esac
-          '';
-        }} \
-        ${toString (map shell.escape args)}
-
-    fail=0
-    for i in monthly weekly daily hourly; do
-      if test -e ${plan.dst.path}/rsnapshot.$i; then
-        rm ${plan.dst.path}/rsnapshot.$i
-        echo "ERROR: $i snapshot failed" >&2
-        fail=1
-      fi
-    done
-    if test $fail != 0; then
-      exit -1
-    fi
-  '';
-
-  rsyncd-conf = plan: conf: pkgs.writeText "${plan.name}.rsyncd.conf" ''
-    fake super = yes
-    use chroot = no
-    lock file = ${plan.dst.path}/rsyncd.lock
-
-    [push]
-    max connections = 1
-    path = ${plan.dst.path}/push
-    write only = yes
-    read only = no
-    post-xfer exec = ${conf.post-xfer}
-
-    [list]
-    path = ${plan.dst.path}/list
-    read only = yes
-    write only = no
-  '';
-
-  rsnapshot = plan: conf: writeSh plan "rsnapshot" ''
-    rsnapshot() {
-      ${pkgs.proot}/bin/proot \
-          -b /bin \
-          -b /nix \
-          -b /run/current-system \
-          -b ${plan.dst.path} \
-          -r ${plan.dst.path} \
-          -w / \
-          ${pkgs.rsnapshot}/bin/rsnapshot \
-              -c ${pkgs.writeText "${plan.name}.rsnapshot.conf" ''
-                config_version	1.2
-                snapshot_root	${plan.dst.path}/list
-                cmd_cp	${pkgs.coreutils}/bin/cp
-                cmd_du	${pkgs.coreutils}/bin/du
-                #cmd_rm	${pkgs.coreutils}/bin/rm
-                cmd_rsync	${pkgs.rsync}/bin/rsync
-                cmd_rsnapshot_diff	${pkgs.rsnapshot}/bin/rsnapshot-diff
-                cmd_preexec	${conf.preexec}
-                cmd_postexec	${conf.postexec}
-                retain	hourly	4
-                retain	daily	7
-                retain	weekly	4
-                retain	monthly	3
-                lockfile	${plan.dst.path}/rsnapshot.pid
-                link_dest	1
-                backup	/push	./
-                verbose	4
-              ''} \
-          "$@"
-    }
-
-    cd ${plan.dst.path}/list/
-
-    now=$(date +%s)
-    is_older_than() {
-      test $(expr $now - $(date +%s -r $1 2>/dev/null || echo 0)) \
-       -ge $2
-    }
-
-    # TODO report stale snapshots
-    # i.e. there are $interval.$i > $interval.$max
-
-    hour_s=3600
-    day_s=86400
-    week_s=604800
-    month_s=2419200 # 4 weeks
-
-    set --
-
-    if test -e weekly.3 && is_older_than monthly.0 $month_s; then
-      set -- "$@" monthly
-    fi
-
-    if test -e daily.6 && is_older_than weekly.0 $week_s; then
-      set -- "$@" weekly
-    fi
-
-    if test -e hourly.3 && is_older_than daily.0 $day_s; then
-      set -- "$@" daily
-    fi
-
-    if is_older_than hourly.0 $hour_s; then
-      set -- "$@" hourly
-    fi
-
-
-    if test $# = 0; then
-      echo "taking no snapshots" >&2
-    else
-      echo "taking snapshots: $@" >&2
-    fi
-
-    export RSNAPSHOT_INTERVAL
-    for RSNAPSHOT_INTERVAL; do
-      rsnapshot "$RSNAPSHOT_INTERVAL"
-    done
-  '';
-
-  writeSh = plan: name: text: pkgs.writeScript "${plan.name}.${name}" ''
-    #! ${pkgs.dash}/bin/dash
-    set -efu
-    export PATH=${makeSearchPath "bin" (with pkgs; [ coreutils ])}
-    ${text}
-  '';
-
-in out
+}
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 3400c13b6..c300633bb 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -28,6 +28,7 @@ with lib;
 
   imports = [
     <secrets>
+    ./backup.nix
     ./vim.nix
     {
       # stockholm dependencies
-- 
cgit v1.2.3