From 909db2cd31b1749f1565cf23c3feebee9b62acb5 Mon Sep 17 00:00:00 2001
From: Dennis <me@dnsc.io>
Date: Sun, 22 Jun 2025 21:35:04 +0200
Subject: [PATCH] sets up restic on dnsc-server

---
 hosts/dnsc-server/default.nix |  23 +++++++++++++++++++++++
 modules/restic/default.nix    |   3 ---
 secrets/restic/password.age   | Bin 0 -> 478 bytes
 secrets/secrets.nix           |   8 ++++++--
 4 files changed, 29 insertions(+), 5 deletions(-)
 delete mode 100644 modules/restic/default.nix
 create mode 100644 secrets/restic/password.age

diff --git a/hosts/dnsc-server/default.nix b/hosts/dnsc-server/default.nix
index a01154e..a540b91 100644
--- a/hosts/dnsc-server/default.nix
+++ b/hosts/dnsc-server/default.nix
@@ -1,4 +1,5 @@
 {
+  config,
   inputs,
   outputs,
   pkgs,
@@ -27,6 +28,12 @@
   boot.zfs.forceImportRoot = false;
   boot.zfs.extraPools = [ "main" ];
 
+  # Secrets
+  age = {
+    identityPaths = [ "${config.users.users.dennis.home}/.ssh/id_ed25519" ];
+    secrets."restic/password".file = ../../secrets/restic/password.age;
+  };
+
   # Nix Settings
   # Perform garbage collection weekly to maintain low disk usage
   nix.gc = {
@@ -167,6 +174,22 @@
   # Tailscale
   services.tailscale.enable = true;
 
+  # Backups
+  services.restic.backups = {
+    initialize = true;
+    passwordFile = config.age.secrets."restic/password".path;
+    repository = "sftp:dnsc-storage:restic";
+    paths = [
+      "/home/dennis/notes"
+      "/main/share"
+    ];
+    timerConfig = {
+      onCalendar = "daily";
+      Persistent = true;
+      RandomizedDelaySec = "5h";
+    };
+  };
+
   # Environment variables
   environment.variables.EDITOR = "nvim";
 
diff --git a/modules/restic/default.nix b/modules/restic/default.nix
deleted file mode 100644
index 0db3279..0000000
--- a/modules/restic/default.nix
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-
-}
diff --git a/secrets/restic/password.age b/secrets/restic/password.age
new file mode 100644
index 0000000000000000000000000000000000000000..e754b5c0b2b05ef1d817550ee106afc62562e15b
GIT binary patch
literal 478
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCUl@+>z_4pi`W&iB(U
zb$1K&%yBOED{?dqPb^L=wG7VpNe`;b4Gr}SPEK?UcTUu=3gt43aLUhg&CLxqOG*hS
zs?0BS4RlLR@+v3^ammc~E)NMd42%j3j_~y}vp}~kG%+Q^qFlkrF|op{&^aTsAhFQ6
z$jBv7+rmGpve>gKIWaA}!riOV%f&3vBhB5Z!j~&5II}`O)Farkz$h@p(50fRw7ks8
z*Rra_*e5$ZGAS=9DmXOKKP58C*Z|$O<d8@=gK~vb)AZ83lHBn8V&^Cq$I=x463f8k
zfGAhPQp3E0oTBg`*N}o@i!#p=!*nhe7r)4mDwitn(xd`YLubn>BTs*~h>#TjbR(mp
z@SI9>W8=~+V-sgjzho|5U0sE&KvVN_*J8^ur!>b9cZ0O#QiI^s@TzRDzyLS>GJm&#
z41;n@LqoS5=WMR$)^D=T<y;kT$bK$llsT1wap&gtHl35d7p0%7h<LSQ!RKY(Z2Am`
u-bu_iue&}&bmesmm#wEe=g2rNDEVA<z=*#uK8oe1-ImOMyXQI`^9KNiai}i<

literal 0
HcmV?d00001

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index dd85c33..2ed3fb5 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -2,11 +2,16 @@ let
   dnsc-air = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILvXWZOPOJJDAoF+Sx/ZLoAVu6G/7/MAWoknBgMAzjul dennis@dnsc-mac";
   dnsc-vps-sm = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHHS4Cq3G0yjoXB9qargJc/zbZdlClnJOcLxSC5ROo7h dennis@dnsc-vps-sm";
   dnsc-server = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM3mkEgvHrwjsEReHQHpLbMP71JLvp6XxMPyW7PTaLCd dennis@dnsc-server";
-  systems = [ dnsc-air dnsc-vps-sm dnsc-server ];
+  systems = [
+    dnsc-air
+    dnsc-vps-sm
+    dnsc-server
+  ];
 in
 {
   # Add like this: "secret1.age".publicKeys = systems;
   "vaultwarden/env.age".publicKeys = systems;
+  "restic/password.age".publicKeys = systems;
 }
 
 # 1. Create a file with secret
@@ -19,4 +24,3 @@ in
 #
 # 3. And use it like this:
 # passwordFile = config.age.secrets.secret1.path;
-