feat(restic): add wrapper command

.github/workflows/flake.yml

@@ -0,0 +1,19 @@
+name: Update flake.lock
+on:
+  workflow_dispatch: # allows manual triggering
+  schedule:
+    - cron: '0 0 * * 0' # runs weekly on Sunday at 00:00
+
+jobs:
+  lockfile:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+      - name: Install Nix
+        uses: cachix/install-nix-action@v16
+        with:
+          extra_nix_config: |
+            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+      - name: Update flake.lock
+        uses: DeterminateSystems/update-flake-lock@v3

configs/backup.nix

@@ -0,0 +1,21 @@
+{ pkgs, config, ... }:
+let
+  repository = "rest:http://zaatar.r:3571/";
+in
+{
+  services.restic.backups.niveum = {
+    initialize = true;
+    inherit repository;
+    timerConfig = { OnCalendar = "00:05"; RandomizedDelaySec = "5h"; };
+    passwordFile = toString <secrets/restic/password>;
+    paths = [
+      "/home/kfm/work"
+    ];
+  };
+
+  environment.systemPackages = [
+    (pkgs.writers.writeDashBin "restic-niveum" ''
+      ${pkgs.restic}/bin/restic -r ${repository} -p ${<secrets/restic/password>} "$@"
+    '')
+  ];
+}

configs/default.nix

@@ -194,6 +194,7 @@ in {
       }) localAddresses;
     }
     ./alacritty.nix
+    ./backup.nix
     ./bash.nix
     ./beets.nix
     ./bluetooth.nix

configs/git.nix

@@ -78,25 +78,13 @@ in
         pull.ff = "only";
         rebase.autoStash = true;
         merge.autoStash = true;
-        core.pager =
-          "${pkgs.gitAndTools.diff-so-fancy}/bin/diff-so-fancy | ${pkgs.less}/bin/less --tabs=4 -RFX";
-        color = {
-          ui = true;
-          diff = {
-            meta = "11";
-            frag = "magenta bold";
-            commit = "yellow bold";
-            old = "red bold";
-            new = "green bold";
-            whitespace = "red reverse";
-          };
-          diff-highlight = {
-            oldNormal = "red bold";
-            oldHighlight = "red bold 52";
-            newNormal = "green bold";
-            newHighlight = "green bold 22";
-          };
-        };
+
+        # ref https://github.com/dandavison/delta
+        core.pager = "${pkgs.delta}/bin/delta";
+        interactive.diffFilter = "${pkgs.delta}/bin/delta --color-only";
+        delta.navigate = true;
+        merge.conflictStyle = "diff3";
+        diff.colorMoved = "default";
       };
     };
   };

lib/i3status-rust.nix

@@ -127,14 +127,6 @@ in {
         print("🌅 {} 🌇 {} {} {}".format(sun["sunrise"].strftime("%R"), sun["sunset"].strftime("%R"), moon_phases[closest_phase], round(current_phase, 1)))
       '';
     }
-    {
-      block = "custom";
-      interval = 60 * 60;
-      command = pkgs.writers.writeDash "vax" ''
-        ${pkgs.curl}/bin/curl -sSL https://api.corona-zahlen.org/vaccinations \
-          | ${pkgs.jq}/bin/jq -r '"💉 Ⅰ \(.data.quote * 1000 | floor | . / 10)% Ⅱ \(.data.secondVaccination.quote * 1000 | floor | . / 10)%"'
-      '';
-    }
     (let service = "openvpn-hu-berlin"; in {
       block = "custom";
       interval = 5;

systems/makanek/weechat.nix

@@ -31,6 +31,7 @@ in {
         settings = let nick = "kmein"; in {
           weechat = {
             look.mouse = true;
+            look.prefix_align_max = 15;
             color.chat_nick_colors = lib.lists.subtractLists (lib.range 52 69 ++ lib.range 231 248) (lib.range 31 254);
             look.highlight_tags = [
               "irc_notice+nick_niveum"

systems/zaatar/backup.nix

@@ -0,0 +1,31 @@
+{ lib, ... }:
+let
+  resticPort = 3571;
+  niveumLib = import <niveum/lib>;
+  inherit (niveumLib) retiolumAddresses;
+  firewall = niveumLib.firewall lib;
+in
+{
+  services.restic.server = {
+    enable = true;
+    appendOnly = true;
+    dataDir = "/backup/restic";
+    prometheus = true;
+    extraFlags = [ "--no-auth" "--prometheus-no-auth" ]; # auth is done via firewall
+    listenAddress = ":${toString resticPort}";
+  };
+
+  networking.firewall =
+  let
+    dport = resticPort;
+    protocol = "tcp";
+    rules = [
+      (firewall.accept { inherit dport protocol; source = retiolumAddresses.kabsa.ipv4; })
+      (firewall.accept { inherit dport protocol; source = retiolumAddresses.manakish.ipv4; })
+      (firewall.accept { inherit dport protocol; source = retiolumAddresses.makanek.ipv4; })
+    ];
+  in {
+    extraCommands = firewall.addRules rules;
+    extraStopCommands = firewall.removeRules rules;
+  };
+}

systems/zaatar/configuration.nix

@@ -4,6 +4,7 @@ let
 in
 {
   imports = [
+    ./backup.nix
     ./gaslight.nix
     ./hardware-configuration.nix
     ./kiosk.nix