Configure restic repo for nextcloud data

modules/nixos/services/nextcloud/default.nix

@@ -5,6 +5,16 @@
   ...
 }: let
   cfg = config.aa.services.nextcloud;
+  secrets = config.age.secrets;
+
+  mkNextcloudSecret = attrs: {
+    name = attrs.name;
+    value = {
+      file = attrs.path;
+      owner = "nextcloud";
+      group = "nextcloud";
+    };
+  };
 in {
   options.aa.services.nextcloud = with lib; {
     enable = mkEnableOption "nextcloud";
@@ -19,11 +29,24 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
-    age.secrets.nextcloud_admin = {
-      file = ../../../../secrets/nextcloud_admin.age;
-      owner = "nextcloud";
-      group = "nextcloud";
-    };
+    age.secrets = builtins.listToAttrs (builtins.map (attrs: mkNextcloudSecret attrs) [
+      {
+        name = "restic/password";
+        path = ../../../../secrets/nextcloud_restic_password.age;
+      }
+      {
+        name = "restic/env";
+        path = ../../../../secrets/nextcloud_restic_env.age;
+      }
+      {
+        name = "restic/repo";
+        path = ../../../../secrets/nextcloud_restic_repo.age;
+      }
+      {
+        name = "nextcloud_admin";
+        path = ../../../../secrets/nextcloud_admin.age;
+      }
+    ]);
 
     services.nextcloud = {
       enable = true;
@@ -47,7 +70,7 @@ in {
       config = {
         dbtype = "pgsql";
         adminuser = "alejandro";
-        adminpassFile = config.age.secrets.nextcloud_admin.path;
+        adminpassFile = secrets.nextcloud_admin.path;
       };
     };
 
@@ -57,6 +80,23 @@ in {
       useACMEHost = cfg.acmeCertName;
     };
 
+    services.restic.backups = {
+      nextcloud = {
+        user = "nextcloud";
+        initialize = true;
+        paths = [config.services.nextcloud.datadir];
+        environmentFile = secrets."restic/env".path;
+        repositoryFile = secrets."restic/repo".path;
+        passwordFile = secrets."restic/password".path;
+        timerConfig = {
+          OnCalendar = "00:05";
+          Persistent = true;
+          RandomizedDelaySec = "5h";
+        };
+        pruneOpts = ["--keep-daily 7" "--keep-weekly 5" "--keep-monthly 12" "--keep-yearly 9001"];
+      };
+    };
+
     networking.firewall.allowedTCPPorts = [80 443];
   };
 }

secrets/nextcloud_restic_password.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> piv-p256 UIEGzg AtUSDrnOeV44xXzVmduHJgpJEzozc+LqdLKlkiiDdJXA
+cJWbnIZGvISxhNXa6Jpiw8NrEfCncMAQHfW8v5uzzvE
+-> ssh-ed25519 Yk7ehg OwDJrMxpMvaxDnGBaSr8+WjGy44DAYwcPo7qujD8zCQ
+7LjtdWBG9+n89+NWvWLX/E63se9okelHkEb2HxFAkU8
+--- 7f/WYFPS9vxFsRa6MNX6EAbGya42EsVxrZbCTEhuIOc
+PÂˆO˜<c‘ë[&ô!W*oñ›gJo©,à¿ P±ä@ÎØ”«Óö7ô®	´Ø%„Ò"rʽÌ=Öc½kå«c<0B>#°PÌ@ù¡ñlÆ—Š½Xi"ê
ï¸c庀GÔí¬m‰N»¢/ØjÜWâj‚ku:ˆx<CB86>¦(à.°>%×ß‘#~Ížæv¹¢ò/kbÒÃFÚg3®ŠçQêÝÀ

secrets/nextcloud_restic_repo.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> piv-p256 UIEGzg AowX1qo/8GwbPcZGt2yW77S7rA8/xtDGUocmR3hmQpTO
+vNy0dR5fwAk+2fV7xhEQq9Ja4VRW5RaDHo9a3L1FZhk
+-> ssh-ed25519 Yk7ehg IUjXb3+yVVIY3aa5wTagrRdm3bL9fGfCCfc20roqh1g
+D+aX+TYMg21CCfpVj6DQVcaRbU4sN5tB0aC0R6TfBFw
+--- u2cH5LG8E5DBRkL8FGq3s1I2Ht5Lhlk9hKrSaOjtISQ
+=q(ï=vßc×<19>~iß(Pa¸GÑùGŸãx!	‹Iãþ<&õüN•Á7åJA.½'e
+DHŽLt¿t	1JÞFéL‡(9éEk[¢šQ·<51>­×é³;Å‚?ì/ʤnPŒ´

secrets/secrets.nix

@@ -15,6 +15,9 @@ in {
   "hass_mqtt.age".publicKeys = [users.me machines.pi4 machines.node machines.gospel];
   "hydra-aws-creds.age".publicKeys = [users.me machines.gospel];
   "nextcloud_admin.age".publicKeys = [users.me machines.node machines.gospel];
+  "nextcloud_restic_env.age".publicKeys = [users.me machines.node];
+  "nextcloud_restic_password.age".publicKeys = [users.me machines.node];
+  "nextcloud_restic_repo.age".publicKeys = [users.me machines.node];
   "tailscale_git_server.age".publicKeys = [users.me machines.git]; # This key expires, might have to update
   "teslamate_db.age".publicKeys = [users.me machines.node machines.gospel];
   "teslamate_encryption.age".publicKeys = [users.me machines.node machines.gospel];