feat: backup ugit repos

Signed-off-by: jolheiser <john.olheiser@gmail.com>

flake.nix

@@ -243,6 +243,7 @@
         };
         dragonwell = {
           imports = [
+            inputs.agenix.nixosModules.default
             inputs.golink.nixosModules.default
             inputs.ugit.nixosModules.default
             ./machines/dragonwell

machines/dragonwell/default.nix

@@ -2,7 +2,7 @@ let
   username = "jolheiser";
   key = ''ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDfKqCWtDlS3tgvfT6hQN+ii8UtabIZ+ZNmYN+bLwIa8PHOEW5MbfaqXSlhKkSi4+7SfQDCHphw0SMfhsQ4qMEcoywZ+4niDgKlQEVkl+S/VGbLuPe92NRStkyreZBLPr3Rh7ScNlGHcmHmoV9v7725fMnsMmabGVhpGO84PwNHOfJyv2tx2h6LxFbAV8S44UQu2lc8YLWCK2UvKuRnBerBXLnDQThUUX8UuCFzb786gQzD5XDU0MENbByxiy0XdVGAC+tFXEiSIgFZlFbFYyShgdTP9MzX2MOglEi+ae+1UIFncraW7ptUey7qHFJylpHWWWvE+GTwsg2G50i0FvFj jolheiser@jolheiser'';
 in {
-  imports = [./caddy.nix ./golink.nix ./gotosocial.nix ./ugit.nix ./hardware.nix];
+  imports = [./caddy.nix ./golink.nix ./gotosocial.nix ./restic.nix ./ugit.nix ./hardware.nix];
 
   boot.tmp.cleanOnBoot = true;
   zramSwap.enable = true;

machines/dragonwell/restic.nix

@@ -0,0 +1,19 @@
+{config, ...}: {
+  age.secrets = {
+    restic-env.file = ../../secrets/personal/restic-env.age;
+    restic-pass.file = ../../secrets/personal/restic-pass.age;
+    restic-repo.file = ../../secrets/personal/restic-repo.age;
+  };
+  services.restic.backups.ugit = {
+    initialize = true;
+    environmentFile = config.age.secrets.restic-env.path;
+    passwordFile = config.age.secrets.restic-pass.path;
+    repositoryFile = config.age.secrets.restic-repo.path;
+    paths = ["/var/lib/ugit/repos"];
+    pruneOpts = ["--keep-daily 7" "--keep-weekly 2" "--keep-monthly 2"];
+    timerConfig = {
+      OnCalendar = "daily";
+      Persistent = true;
+    };
+  };
+}

secrets/personal/restic-env.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 E8j6/g 1HJtBNf8fXHgPxE/igj2b6z9o4Etlp+GHoLo8L6YnRs
+v+Sh2QlLbfixF7YkHTHM1luL4/SGlFzhNqQASH1UGDk
+-> ssh-ed25519 f31uNA 7HHWKFc59n5Y2UJ+qaNoYDfLJZbry/pZRvIFR4DWBWc
+DXcG+KGcE8JMPQt8cv4ted6vtkBf+u2uZsyPm4MMkwI
+-> psKyV-grease "MM~T(~g tK+-AO4 >-T !n090?K|
+Dtc2xPmFxFcTTC48EGs6awFQszoIjNY
+--- 7U9PGgjHxlCoYcyS5Mke4lhCcdqkQLjc9M5UycDSYWk
+€2„Ù 5͈¥ávUC‰è&†êòv5úÏôRè‰Ü¹q›ø-˺Z½Ò[ U%ýkÐrúVÖ™,ÛQ#jZ…Ùy”nJd9·Û~z^³ƒ\ÞŠâByv¡/qI¾ˆQ"ÂUý»ÀÑ	×d+ÿA<C3BF>¡þgû†ö£ Š<>öŠl•EÎ-Æ

secrets/personal/restic-pass.age

@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 E8j6/g IxilZcPJYM7QuBM+2/NTzzv4YNJVI41FvmTlkL+KoUw
+P7RK+wlfEdBeGVIU52QG43sRDJ9KxF0/6TarT9W+wbc
+-> ssh-ed25519 f31uNA pQCg9BCiIk//YdV3AHr3w2Y84K6MwH/HK/k7w4EapQQ
+9EySD+N5XEz/w4AyRBsLioYhr6PaPOkckMLhE7LONdk
+-> M-grease d_4>8< / 1V($
+yc2NhRg1u6HU1bAVVTqdi4qKyHdPINhhZt7HUPubLWR0KJyPb2Aaz6c66UmMu8La
+49kh/q2eAcgQ+GVOHUSc6ZYEf+WD
+--- YX4Fl76QjEubDmrpQcVx1ihZiVY2hQJhzrnIlxNlEHw
+¬{é<>tÔÔišûHÑ™¯ÔxŦÓçAt+epVJ•Ë¬ì²LÒæpYå
+LÎã

secrets/personal/restic-repo.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 E8j6/g rowSqBtScMXL4bm55633pfNeqZoRm3SCn4L34tcImSg
+Q//MbLOkqaEdyXoh7a/Tpfpn9hZ/CvZkERbyCE3Mu/c
+-> ssh-ed25519 f31uNA Uqd3VFq2E3eDn+PS2nA8+PiDgWquMXiVdpvZBxilwWE
+NI8cPIAgqyEujRyfEzk1JfqBhegLz35YuqgvCGaz1eE
+-> Le"!A-grease NuqxJ(p+ Cm'a)_Cn n7jH*
+repfVIM56jfigReUYNUiwkvhAuudOWqanbOrnwK7koarB8J7IYtufWh0GZT+Jusg
+oxlDpgqYkIcqwt2Zw+cjuUnWEKKv0o9OUw
+--- h6ZaemRWYqiGTTMvTpfDUpuxEdAi6xYp95wLHEBDO3E
+%”/4¨0ÆŒ<C386>³Tr‰vÖ0Ê1hTuÄÛ:ìkH
µc³²€Uõ`¬,ãk<C3A3>dõ„ÓÚ@õ`¢?‚¥	¡Ò¿ã€«›¥t7rö	¾±è4ÀLA

secrets/secrets.nix

@@ -18,4 +18,7 @@ in {
   "work/pip.conf.age".publicKeys = [jolheiser chai masala];
   "work/pypirc.age".publicKeys = [jolheiser chai masala];
   "work/cifs.age".publicKeys = [jolheiser chai masala];
+  "personal/restic-env.age".publicKeys = [jolheiser dragonwell];
+  "personal/restic-pass.age".publicKeys = [jolheiser dragonwell];
+  "personal/restic-repo.age".publicKeys = [jolheiser dragonwell];
 }