configured backups

hosts/nuc/default.nix

@@ -35,6 +35,7 @@
     directories = [
       "/etc/ssh"
       "/root/.local/share/zsh"
+      "/root/.config/borg/security"
     ];
     files = [
       "/etc/machine-id"
@@ -83,6 +84,7 @@
     ../../keys/ssh/rouven-thinkpad
     ../../keys/ssh/root-thinkpad
     ../../keys/ssh/rouven-pixel
+    ../../keys/ssh/root-falkenstein
   ];
 
   system.stateVersion = "22.11";

hosts/nuc/modules/backup/default.nix

@@ -1,37 +1,35 @@
+{ config, pkgs, ... }:
 {
+  sops.secrets."borg/passphrase" = { };
+  environment.systemPackages = [ pkgs.borgbackup ];
   fileSystems."/mnt/backup" =
     {
-      device = "/dev/disk/by-uuid/f6905cdb-c130-465a-90a3-93997023b5d3 ";
-      fsType = "btrfs";
-      options = [ "compress=zstd" "noatime" "nofail" ];
+      device = "dev/disk/by-uuid/74e78699-fe27-4467-a9bb-99fc6e8d52c5";
+      fsType = "ext4";
+      options = [ "nofail" ];
       neededForBoot = false;
     };
+  services.borgmatic = {
+    enable = true;
+    settings = {
+      location.source_directories = [
+        "/var/lib"
+        "/var/log"
+        "/nix/persist"
+      ];
+      location.repositories = [
+        "/mnt/backup/nuc"
+      ];
+      storage = {
+        encryption_passcommand = "${pkgs.coreutils}/bin/cat ${config.sops.secrets."borg/passphrase".path}";
+        compression = "lz4";
+      };
+      retention = {
+        keep_daily = 7;
+        keep_weekly = 4;
+        keep_monthly = 12;
+        keep_yearly = 3;
 
-  fileSystems."/mnt/pool" =
-    {
-      device = "/dev/disk/by-uuid/16b0bd14-1b07-477d-a20d-982f9467f6df";
-      fsType = "btrfs";
-      options = [ "compress=zstd" "noatime" ];
-    };
-
-  services.btrbk = {
-    instances."nuc-to-disk".settings = {
-      snapshot_preserve = "14d";
-      snapshot_preserve_min = "2d";
-      target_preserve = "30d 4w 12m";
-      target_preserve_min = "2d";
-      volume = {
-        "/mnt/pool" = {
-          subvolume = {
-            log = {
-              snapshot_create = "always";
-            };
-            lib = {
-              snapshot_create = "always";
-            };
-          };
-          target = "/mnt/backup/nuc";
-        };
       };
     };
   };

hosts/nuc/modules/nextcloud/default.nix

@@ -11,19 +11,6 @@ in
   };
 
   services = {
-    postgresql = {
-      enable = true;
-      ensureUsers = [
-        {
-          name = "nextcloud";
-          ensurePermissions = {
-            "DATABASE nextcloud" = "ALL PRIVILEGES";
-          };
-        }
-      ];
-      ensureDatabases = [ "nextcloud" ];
-    };
-
     nextcloud = {
       enable = true;
       package = pkgs.nextcloud27; # Use current latest nextcloud package
@@ -56,4 +43,8 @@ in
     requires = [ "postgresql.service" ];
     after = [ "postgresql.service" ];
   };
+  systemd.services."nextcloud-cron" = {
+    requires = [ "postgresql.service" ];
+    after = [ "postgresql.service" ];
+  };
 }