feat(restic): add restic-client to all hosts

developmentlog.md

@@ -71,3 +71,9 @@ Hub-and-spoke via `modules/restic-server.nix` + `modules/restic-client.nix`. `se
 Secrets (`secrets/secrets.yaml`): `restic/server_htpasswd` (bcrypt hash, server), `restic/repository` (repo URL incl. transport pw, clients), `restic/repo_password` (encryption key, clients + server prune/offsite), `restic/offsite_repository` (offsite URL, galadriel). On galadriel both modules declare `restic/repo_password`; the server's `owner = "restic"` wins the merge, and root (the client job user) reads it regardless.
 
 Manual: add secrets; make every using-host a sops recipient; `restic init` the offsite repo once with `repo_password`; set `services.restic.backups.main.paths` per host. Caveat: `listenAddress = "${hostname}:8008"` relies on Tailscale MagicDNS resolving at socket-activation time — bind the tailnet IP directly if it ever flakes at boot.
+
+## restic-client on all hosts
+
+Rolled `../../modules/restic-client.nix` into the remaining hosts (aragon, elros, elrond); legolas and galadriel already had it. All three use the module's `mkDefault` paths (`/var/lib`, `/var/backups`, `/home/gunalx`) — no per-host `paths` override needed. No secret changes: the shared `restic/repository` + `restic/repo_password` already cover every host, and sops-nix auto-derives each host's age key from `age.sshKeyPaths`, so existing recipients decrypt the same secrets.
+
+Left to do manually: confirm each new client's SSH key (`/etc/ssh/nixos` on the host) is a sops recipient in `secrets/secrets.yaml` — if a host can't decrypt, re-run `sops updatekeys secrets/secrets.yaml`. Verify the first backup runs (`systemctl start restic-backups-main`) and shows in `restic snapshots` on galadriel.

hosts/aragon/configuration.nix

@@ -54,6 +54,9 @@
     ../../secrets/sops.nix
     ../../secrets/sopsconf.nix
 
+    # Backup
+    ../../modules/restic-client.nix
+
   ];
 
   services.desktopManager.gnome.enable = true;

hosts/elrond/configuration.nix

@@ -20,6 +20,7 @@
     ../../modules/basePackages.nix
     ../../modules/zfs.nix
     ../../modules/vm.nix
+    ../../modules/restic-client.nix
   ];
 
   networking.hostName = "elrond";

hosts/elros/configuration.nix

@@ -28,6 +28,8 @@
     ../../modules/acme.nix
     ../../modules/pangolin.nix
 
+    ../../modules/restic-client.nix
+
   ];
 
   boot.binfmt.emulatedSystems = [ "aarch64-linux" ]; # support rpi building

hosts/legolas/configuration.nix

@@ -39,11 +39,21 @@
     ../../modules/desktopApplications.nix
     ../../modules/fcitx5.nix
 
+    ../../modules/restic-client.nix
+
   ];
 
   networking.hostName = "legolas";
   networking.networkmanager.enable = true;
   time.timeZone = "Europe/Amsterdam";
+
+  services.restic.backups.main.exclude = [
+    "/home/gunalx/Documents/div/qwen-asr-no"
+    "/home/gunalx/Pictures/google"
+    "/home/gunalx/.local/share/zed"
+    "/home/gunalx/.local/share/qwen-asr"
+    "/home/gunalx/.local/share/opencode"
+  ];
   # Select internationalisation properties.
   # i18n.defaultLocale = "en_US.UTF-8";
 

modules/restic-client.nix

@@ -23,7 +23,7 @@
       "/var/backups"
       "/home/gunalx"
     ];
-    exclude = lib.mkDefault [
+    exclude = [
       ".cache"
       "__pycache__"
       "*.pyc"
@@ -47,12 +47,14 @@
       "*.tmp"
       "*.swp"
       ".Trash-*"
+      "Trash"
       ".zcompdump*"
       ".nix-defexpr"
       ".steam"
       ".SteamCloud"
       "Steam"
       "/var/lib/containers"
+      ".local/share/containers"
     ];
     timerConfig = {
       OnCalendar = "daily";