feat(restic): enable offsite copy service

Uncommented the hand-rolled restic-offsite service and switched to the
non-deprecated --from-* flag family (destination = offsite via
--repository-file/--password-file, source = local repo via
--from-repo/--from-password-file). The timer now references a service
that actually exists.

modules/restic-offsite.nix

@@ -18,23 +18,26 @@
     restartUnits = [ "restic-offsite.service" ];
   };
 
-  # # just uncommented until we have this running on elrond as well.
-  #  systemd.services.restic-offsite = {
-  #    description = "Mirror restic snapshots to the offsite repo";
-  #    serviceConfig = {
-  #      Type = "oneshot";
-  #      User = "restic";
-  #      Group = "restic";
-  #    };
-  #    path = [ pkgs.restic ];
-  #    script = ''
-  #      restic -r ${config.services.restic.server.dataDir}/main \
-  #        --password-file ${config.sops.secrets."restic/repo_password".path} \
-  #        copy \
-  #        --repository-file2 ${config.sops.secrets."restic/offsite_repository".path} \
-  #        --password-file2 ${config.sops.secrets."restic/repo_password".path}
-  #    '';
-  #  };
+  # destination = offsite repo (primary global opts: --repository-file/--password-file)
+  # source      = local repo (--from-repo/--from-password-file)
+  # the legacy --repo2/--repository-file2/--password-file2 flags are deprecated in restic.
+  systemd.services.restic-offsite = {
+    description = "Mirror restic snapshots to the offsite repo";
+    serviceConfig = {
+      Type = "oneshot";
+      User = "restic";
+      Group = "restic";
+    };
+    path = [ pkgs.restic ];
+    script = ''
+      restic \
+        --repository-file ${config.sops.secrets."restic/offsite_repository".path} \
+        --password-file ${config.sops.secrets."restic/repo_password".path} \
+        --from-repo ${config.services.restic.server.dataDir}/main \
+        --from-password-file ${config.sops.secrets."restic/repo_password".path} \
+        copy
+    '';
+  };
 
   systemd.timers.restic-offsite = {
     wantedBy = [ "timers.target" ];