New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
nixos/restic: correct location of cache directory #99579
Conversation
Looks quite reasonable. I merged it locally and will report back after I see whether a couple of nightly backups work okay. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nightly backups seem to be working just fine; approving.
Do we have to take care of the now stale And if so, what approach could be used to handle this? |
Good point. We could add a release note, not sure what else to do beyond that. |
+1 to a release note. |
0415014
to
f46cf9e
Compare
I added a release note and amended it into the existing commit. |
f46cf9e
to
ca45de4
Compare
By default, restic determines the location of the cache based on the XDG base dir specification, which is `~/.cache/restic` when the environment variable `$XDG_CACHE_HOME` isn't set. As restic is executed as root by default, this resulted in the cache being written to `/root/.cache/restic`, which is not quite right for a system service and also meant, multiple backup services would use the same cache directory - potentially causing issues with locking, data corruption, etc. The goal was to ensure, restic uses the correct cache location for a system service - one cache per backup specification, using `/var/cache` as the base directory for it. systemd sets the environment variable `$CACHE_DIRECTORY` once `CacheDirectory=` is defined, but restic doesn't change its behavior based on the presence of this environment variable. Instead, the specifier [1] `%C` can be used to point restic explicitly towards the correct cache location using the `--cache-dir` argument. Furthermore, the `CacheDirectoryMode=` was set to `0700`, as the default of `0755` is far too open in this case, as the cache might contain sensitive data. [1] https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Specifiers
ca45de4
to
3b1de09
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Diff LGTM. Thanks!
Also, thanks for such a great commit message. We should all strive to be as detailed as you were :) |
Motivation for this change
By default, restic determines the location of the cache based on the XDG
base dir specification, which is
~/.cache/restic
when the environmentvariable
$XDG_CACHE_HOME
isn't set.As restic is executed as root by default, this resulted in the cache being
written to
/root/.cache/restic
, which is not quite right for a systemservice and also meant, multiple backup services would use the same cache
directory - potentially causing issues with locking, data corruption,
etc.
The goal was to ensure, restic uses the correct cache location for a
system service - one cache per backup specification, using
/var/cache
as the base directory for it.
systemd sets the environment variable
$CACHE_DIRECTORY
onceCacheDirectory=
is defined, but restic doesn't change its behaviorbased on the presence of this environment variable.
Instead, the specifier [1]
%C
can be used to point restic explicitlytowards the correct cache location using the
--cache-dir
argument.Furthermore, the
CacheDirectoryMode=
was set to0700
, as the defaultof
0755
is far too open in this case, as the cache might containsensitive data.
[1] https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Specifiers
Things done
sandbox
innix.conf
on non-NixOS linux)nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
./result/bin/
)nix path-info -S
before and after)