feat(nix): add tmux-backup module for Google Drive sync#941
feat(nix): add tmux-backup module for Google Drive sync#941shunkakinoki wants to merge 1 commit intomainfrom
Conversation
Adds a new modules.tmux-backup NixOS/home-manager module that periodically syncs ~/.local/share/tmux/ (session logs, pane snapshots, archive) to Google Drive using rclone. - Darwin: launchd agent running hourly (StartInterval=3600) - Linux: systemd oneshot service + hourly timer - Configurable remote, remotePath, localPath options - Enabled on galactica (Darwin) and kyber (Linux) hosts
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (4)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello @shunkakinoki, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces a new Home Manager module designed to automate the backup of tmux session logs to Google Drive. It establishes a robust, platform-agnostic solution for data persistence by leveraging rclone for synchronization and integrating with native scheduling mechanisms like launchd on Darwin and systemd on Linux. The module is configurable and has been activated on key development environments, ensuring critical session data is regularly archived. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
Mesa DescriptionTL;DRAdds What changed?A new home-manager module
Description generated by Mesa. Update settings |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new home-manager module, tmux-backup, designed to periodically sync tmux logs to cloud storage via rclone, supporting both Darwin (launchd) and Linux (systemd). A security audit identified two medium-severity vulnerabilities: potential command injection in the backup script due to missing shell argument escaping, and insecure temporary log file handling in the Darwin launchd agent configuration. Additionally, consider reducing rclone log verbosity and generalizing the module's descriptions to reflect broader rclone remote compatibility. Overall, this is a valuable addition, but addressing these security and general improvements will enhance its robustness and usability.
| cfg = config.modules.tmux-backup; | ||
|
|
||
| backupScript = pkgs.writeShellScript "tmux-backup" '' | ||
| ${pkgs.rclone}/bin/rclone sync "${cfg.localPath}/" "${cfg.remote}:${cfg.remotePath}/" --log-level INFO |
There was a problem hiding this comment.
This line is vulnerable to command injection. Nix configuration options like remote or localPath are interpolated directly into the shell script without proper escaping. This could lead to command injection if they contain shell metacharacters. Use lib.escapeShellArg to safely pass these strings. Additionally, consider changing --log-level INFO to --log-level NOTICE to reduce log verbosity for automated tasks, as INFO logs every file check.
${pkgs.rclone}/bin/rclone sync ${lib.escapeShellArg "${cfg.localPath}/"} ${lib.escapeShellArg "${cfg.remote}:${cfg.remotePath}/"} --log-level INFO
| StandardOutPath = "/tmp/tmux-backup.log"; | ||
| StandardErrorPath = "/tmp/tmux-backup.error.log"; |
There was a problem hiding this comment.
Using fixed log file paths in /tmp is insecure and vulnerable to symlink attacks on multi-user systems. A malicious user could create a symlink to a sensitive file, leading to overwrites. It is safer to store logs within the user's home directory to prevent such attacks and avoid conflicts.
StandardOutPath = "${config.home.homeDirectory}/.tmux-backup.log";
StandardErrorPath = "${config.home.homeDirectory}/.tmux-backup.error.log";
| in | ||
| { | ||
| options.modules.tmux-backup = { | ||
| enable = mkEnableOption "tmux session log backup to Google Drive"; |
There was a problem hiding this comment.
The module is described as being specifically for 'Google Drive', but it's implemented generically using rclone and could work with any rclone remote (e.g., S3, Dropbox). It would be better to make the descriptions more generic to reflect this, which improves the module's clarity and reusability.
You should update the descriptions in the following places:
- Line 1 (file comment)
- Line 23 (
remoteoption description) - Line 55 (
systemdservice description)
enable = mkEnableOption "tmux session log backup via rclone";
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
1 participant
Summary
modules.tmux-backuphome-manager module (pattern followsmodules.tailscale)~/.local/share/tmux/togdrive:tmux-logs/via rclonelaunchd.agents.tmux-backupwithStartInterval = 3600(hourly)systemd.user.services.tmux-backup(oneshot) +systemd.user.timers.tmux-backup(hourly)remote,remotePath,localPathoptions (defaults togdrive:tmux-logs)galactica(Darwin) andkyber(Linux) hostsTest plan
home-manager switchcompletes without errors on Darwin and Linuxlaunchctl list | grep tmux-backupshows agent loadedsystemctl --user status tmux-backup.{service,timer}shows activerclone ls gdrive:tmux-logs/shows files🤖 Generated with Claude Code
Summary by cubic
Adds a tmux-backup Home Manager module that syncs ~/.local/share/tmux to Google Drive via rclone on an hourly schedule. Enabled on galactica (macOS) and kyber (Linux).
New Features
Migration
Written for commit df176ad. Summary will update on new commits.