feat: restic

configs/backup.nix

@@ -0,0 +1,11 @@
+{
+  services.restic.backups.niveum = {
+    initialize = true;
+    repository = "rest:http://zaatar.r:3571/";
+    timerConfig = { OnCalendar = "00:05"; RandomizedDelaySec = "5h"; };
+    passwordFile = toString <secrets/restic/password>;
+    paths = [
+      "/home/kfm/work"
+    ];
+  };
+}

configs/default.nix

@@ -194,6 +194,7 @@ in {
       }) localAddresses;
     }
     ./alacritty.nix
+    ./backup.nix
     ./bash.nix
     ./beets.nix
     ./bluetooth.nix

systems/zaatar/backup.nix

@@ -0,0 +1,31 @@
+{ lib, ... }:
+let
+  resticPort = 3571;
+  niveumLib = import <niveum/lib>;
+  inherit (niveumLib) retiolumAddresses;
+  firewall = niveumLib.firewall lib;
+in
+{
+  services.restic.server = {
+    enable = true;
+    appendOnly = true;
+    dataDir = "/backup/restic";
+    prometheus = true;
+    extraFlags = [ "--no-auth" "--prometheus-no-auth" ]; # auth is done via firewall
+    listenAddress = ":${toString resticPort}";
+  };
+
+  networking.firewall =
+  let
+    dport = resticPort;
+    protocol = "tcp";
+    rules = [
+      (firewall.accept { inherit dport protocol; source = retiolumAddresses.kabsa.ipv4; })
+      (firewall.accept { inherit dport protocol; source = retiolumAddresses.manakish.ipv4; })
+      (firewall.accept { inherit dport protocol; source = retiolumAddresses.makanek.ipv4; })
+    ];
+  in {
+    extraCommands = firewall.addRules rules;
+    extraStopCommands = firewall.removeRules rules;
+  };
+}

systems/zaatar/configuration.nix

@@ -4,6 +4,7 @@ let
 in
 {
   imports = [
+    ./backup.nix
     ./gaslight.nix
     ./hardware-configuration.nix
     ./kiosk.nix