path: root/profiles/restic-backup.nix

{ config, pkgs, ... }:
let
  restic-local = pkgs.writeShellScriptBin "restic-local" ''
    export RESTIC_REPOSITORY="/data/backups/"
    export RESTIC_PASSWORD_FILE="${config.age.secrets.restic-local-pw.path}"
    exec ${pkgs.restic}/bin/restic "$@"
  '';
in
{
  age = {
    secrets = {
      restic-local-pw = {
        file = ../secrets/restic-pw.age;
      };
    };
  };

  environment.systemPackages = [
    pkgs.restic
    restic-local
  ];

  services.restic = {
    backups = {
      local = {
        paths = [ ];
        passwordFile = config.age.secrets.restic-local-pw.path;
        repository = "/data/backups/";
        initialize = true;
        timerConfig.OnCalendar = "*-*-* *:00:00";
        timerConfig.RandomizedDelaySec = "5m";
        extraBackupArgs = [ ];
      };
    };
  };
}