From de4843c5002f3f58f8bc69dd57d368324b67f4ce Mon Sep 17 00:00:00 2001
From: Martin Fischer <martin@push-f.com>
Date: Sat, 13 Dec 2025 15:08:25 +0100
Subject: feat: automatic backups

---
 nixos/hosts/ev/default.nix              |  34 ++++++++++++++++++++++++++++++++
 nixos/hosts/ev/secrets/restic-db.age    |  10 ++++++++++
 nixos/hosts/ev/secrets/restic-media.age | Bin 0 -> 343 bytes
 3 files changed, 44 insertions(+)
 create mode 100644 nixos/hosts/ev/secrets/restic-db.age
 create mode 100644 nixos/hosts/ev/secrets/restic-media.age

(limited to 'nixos/hosts/ev')

diff --git a/nixos/hosts/ev/default.nix b/nixos/hosts/ev/default.nix
index 353d761..252e5c8 100644
--- a/nixos/hosts/ev/default.nix
+++ b/nixos/hosts/ev/default.nix
@@ -7,6 +7,7 @@
 let
   ports = import ./ports.nix;
   helpers = import <top/helpers.nix> { inherit config lib pkgs; };
+  backupHost = "u518695-sub2@u518695-sub2.your-storagebox.de";
 in
 {
   imports = [
@@ -17,6 +18,7 @@ in
     <top/shared/tailscale.nix>
     <top/shared/basics-physical.nix>
     <top/shared/vpn.nix>
+    <top/shared/restic-database-backups.nix>
     ./exporters.nix
     ./home-automation.nix
     ./kodi.nix
@@ -73,6 +75,38 @@ in
     };
   };
 
+  # Backups
+  age.secrets.restic-db.file = ./secrets/restic-db.age;
+  age.secrets.restic-media.file = ./secrets/restic-media.age;
+
+  restic-database-backups = {
+    repository = "sftp://${backupHost}:23" + "/db";
+    passwordFile = config.age.secrets.restic-db.path;
+    postgresDatabases = [
+      "miniflux"
+    ];
+    sqliteDatabases = {
+      navidrome = "/var/lib/navidrome/navidrome.db";
+    };
+    timerConfig = { OnCalendar = "00:20"; };
+    pruneOpts = ["--keep-daily 30" "--keep-weekly 8" "--keep-monthly 12"];
+  };
+
+  services.restic.backups = {
+    media = {
+      repository = "sftp://${backupHost}:23" + "/media";
+      passwordFile = config.age.secrets.restic-media.path;
+      paths = [
+        "/mnt/personal/photos"
+        "/mnt/personal/music"
+      ];
+      timerConfig = { OnCalendar = "00:30"; };
+      pruneOpts = ["--keep-daily 30" "--keep-weekly 8"];
+      extraBackupArgs = ["--skip-if-unchanged"];
+      progressFps = 0.0166; # once per minute
+    };
+  };
+
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
diff --git a/nixos/hosts/ev/secrets/restic-db.age b/nixos/hosts/ev/secrets/restic-db.age
new file mode 100644
index 0000000..eadf2ef
--- /dev/null
+++ b/nixos/hosts/ev/secrets/restic-db.age
@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 PHC5tQ y9tYkynZ58Jy0MPKAVVIDEIwF9yUiGMqryAEbo2q+28
+PSRxZdfZmcIol+FMoPh0bda/bUfkMSChF5Y72GcGfIg
+-> ssh-ed25519 PMTW+A jMWBSj3z0EdY72S2XeCUGCnjEH26asIxM2mR7UJszRc
+DaV91wChTq41w+Ij6aiAPDNcCi/20eWV3AaTxO1nrec
+--- w0m1n/71+Ux37APY3bTxb8NhL9SpZJbKhvzj8tTA30k
+v�QK�7���
+���>�p
+���{
+�
�嵦_����+�.��l�܀�Nʚ)^
\ No newline at end of file
diff --git a/nixos/hosts/ev/secrets/restic-media.age b/nixos/hosts/ev/secrets/restic-media.age
new file mode 100644
index 0000000..745db28
Binary files /dev/null and b/nixos/hosts/ev/secrets/restic-media.age differ
-- 
cgit v1.3.1