feat(nixos): add shared restic-backup module

hosts/glyph/default.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: {
+{...}: {
   imports = [
     ./hardware.nix
     ./services
@@ -56,5 +51,8 @@
   time.timeZone = "America/Los_Angeles";
   i18n.defaultLocale = "en_US.UTF-8";
 
+  # Beets library database (beets configured in home-manager)
+  rc.backup.paths = ["/home/mu/.config/beets/library.db"];
+
   system.stateVersion = "24.05";
 }

hosts/glyph/services/default.nix

@@ -73,6 +73,13 @@
   };
 
   services.basic-memory.enable = true;
+  rc.backup = {
+    enable = true;
+    paths = [
+      "/var/lib/basic-memory"
+      "/var/lib/roon-server/backup"
+    ];
+  };
   services.mcp-nixos.enable = true;
   services.kagi-mcp = {
     enable = true;

hosts/spore/backup.nix

@@ -1,27 +1,8 @@
-{
-  config,
-  pkgs,
-  ...
-}: {
-  age.secrets.restic-env.file = ./secrets/restic-env.age;
-  age.secrets.restic-password.file = ./secrets/restic-password.age;
-  services.restic.backups = {
-    daily = {
-      initialize = true;
-
-      environmentFile = config.age.secrets.restic-env.path;
-      passwordFile = config.age.secrets.restic-password.path;
-
-      repository = "s3:https://9c12166db465350c0f02410b390d0cbc.r2.cloudflarestorage.com/restic";
-      paths = [
-        config.services.postgresqlBackup.location
-      ];
-
-      pruneOpts = [
-        "--keep-daily 7"
-        "--keep-weekly 5"
-        "--keep-monthly 12"
-      ];
-    };
+{config, ...}: {
+  rc.backup = {
+    enable = true;
+    paths = [
+      config.services.postgresqlBackup.location
+    ];
   };
 }

lib/secrets/default.nix

@@ -1,3 +1,7 @@
 # Global secrets that multiple hosts need access to
-# Currently empty - all secrets are host-specific
-{}
+let
+  keys = with (import ../keys.nix); [glyph spore Rhizome];
+in {
+  "secrets/restic-env.age".publicKeys = keys;
+  "secrets/restic-password.age".publicKeys = keys;
+}

lib/secrets/spore.nix

@@ -12,7 +12,5 @@ in {
   "hosts/spore/secrets/notifier-smtp-password.age".publicKeys = keys;
   "hosts/spore/secrets/oauth2-proxy-env.age".publicKeys = keys;
   "hosts/spore/secrets/pocket-id-encryption-key.age".publicKeys = keys;
-  "hosts/spore/secrets/restic-env.age".publicKeys = keys;
-  "hosts/spore/secrets/restic-password.age".publicKeys = keys;
   "hosts/spore/secrets/tailscale-auth-key.age".publicKeys = keys;
 }

modules/nixos/default.nix

@@ -4,6 +4,7 @@
     ./llm
     ./web
     ./filebrowser-quantum.nix
+    ./restic-backup.nix
     ./users.nix
     ./ssh.nix
     ./sudo.nix

modules/nixos/restic-backup.nix

@@ -0,0 +1,42 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.rc.backup;
+in {
+  options.rc.backup = {
+    enable = lib.mkEnableOption "restic backup to Cloudflare R2";
+
+    paths = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [];
+      description = "Paths to back up.";
+    };
+
+    pruneOpts = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [
+        "--keep-daily 7"
+        "--keep-weekly 5"
+        "--keep-monthly 12"
+      ];
+      description = "Prune options for restic forget.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    age.secrets.restic-env.file = ../../secrets/restic-env.age;
+    age.secrets.restic-password.file = ../../secrets/restic-password.age;
+
+    services.restic.backups.daily = {
+      initialize = true;
+
+      environmentFile = config.age.secrets.restic-env.path;
+      passwordFile = config.age.secrets.restic-password.path;
+
+      repository = "s3:https://9c12166db465350c0f02410b390d0cbc.r2.cloudflarestorage.com/restic";
+      inherit (cfg) paths pruneOpts;
+    };
+  };
+}

secrets/restic-password.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 rSr+rA Z+9XxNGsbQouTkhq32ZBlkFYokGsmUCMLHeR5sP9tWk
+qB/oBmbxbEFBAuSBhbpnD6eIUWTm6/c7fGiYQ/xKotI
+-> ssh-ed25519 2AxgaQ qoh952wnvfuC5n+/SSsinOkCvKd54VHjpX88hOwzRwc
+Be2yGLfBjsu+Cb2GBFmcXqk7G85WUGkepbY0aF3H8yI
+-> ssh-ed25519 3EWhnQ cM+TTJ/BW6tb3XjbslHn+LF5wsMEcq/DY6hlwdVBGyk
+Mr94UI7pJor2uQAuFP/8bBs8fcV9+LcIXV0iT5f92Hg
+--- OFrrfEub5HYBAoHsGi38coK2Jw3qrDyl3sg1gIYYT3c
+(��>�����|�Hp80k3�2!ּDg��?5�ۨ��3�eA(�v�,O�[d��4@b퐿�
�