From e2cc7983affdc09365e5652a8c9b1460602f6e09 Mon Sep 17 00:00:00 2001
From: Adrian G L <adrian@lauterer.it>
Date: Fri, 17 Jul 2026 18:26:32 +0200
Subject: [PATCH] feat(restic): add restic-client to all hosts

---
 developmentlog.md               |  6 ++++++
 hosts/aragon/configuration.nix  |  3 +++
 hosts/elrond/configuration.nix  |  1 +
 hosts/elros/configuration.nix   |  2 ++
 hosts/legolas/configuration.nix | 10 ++++++++++
 modules/restic-client.nix       |  4 +++-
 6 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/developmentlog.md b/developmentlog.md
index 327a654..65c5cb8 100644
--- a/developmentlog.md
+++ b/developmentlog.md
@@ -71,3 +71,9 @@ Hub-and-spoke via `modules/restic-server.nix` + `modules/restic-client.nix`. `se
 Secrets (`secrets/secrets.yaml`): `restic/server_htpasswd` (bcrypt hash, server), `restic/repository` (repo URL incl. transport pw, clients), `restic/repo_password` (encryption key, clients + server prune/offsite), `restic/offsite_repository` (offsite URL, galadriel). On galadriel both modules declare `restic/repo_password`; the server's `owner = "restic"` wins the merge, and root (the client job user) reads it regardless.
 
 Manual: add secrets; make every using-host a sops recipient; `restic init` the offsite repo once with `repo_password`; set `services.restic.backups.main.paths` per host. Caveat: `listenAddress = "${hostname}:8008"` relies on Tailscale MagicDNS resolving at socket-activation time — bind the tailnet IP directly if it ever flakes at boot.
+
+## restic-client on all hosts
+
+Rolled `../../modules/restic-client.nix` into the remaining hosts (aragon, elros, elrond); legolas and galadriel already had it. All three use the module's `mkDefault` paths (`/var/lib`, `/var/backups`, `/home/gunalx`) — no per-host `paths` override needed. No secret changes: the shared `restic/repository` + `restic/repo_password` already cover every host, and sops-nix auto-derives each host's age key from `age.sshKeyPaths`, so existing recipients decrypt the same secrets.
+
+Left to do manually: confirm each new client's SSH key (`/etc/ssh/nixos` on the host) is a sops recipient in `secrets/secrets.yaml` — if a host can't decrypt, re-run `sops updatekeys secrets/secrets.yaml`. Verify the first backup runs (`systemctl start restic-backups-main`) and shows in `restic snapshots` on galadriel.
diff --git a/hosts/aragon/configuration.nix b/hosts/aragon/configuration.nix
index 6f8cac1..11e09e9 100644
--- a/hosts/aragon/configuration.nix
+++ b/hosts/aragon/configuration.nix
@@ -54,6 +54,9 @@
     ../../secrets/sops.nix
     ../../secrets/sopsconf.nix
 
+    # Backup
+    ../../modules/restic-client.nix
+
   ];
 
   services.desktopManager.gnome.enable = true;
diff --git a/hosts/elrond/configuration.nix b/hosts/elrond/configuration.nix
index 5271aa6..340b26f 100644
--- a/hosts/elrond/configuration.nix
+++ b/hosts/elrond/configuration.nix
@@ -20,6 +20,7 @@
     ../../modules/basePackages.nix
     ../../modules/zfs.nix
     ../../modules/vm.nix
+    ../../modules/restic-client.nix
   ];
 
   networking.hostName = "elrond";
diff --git a/hosts/elros/configuration.nix b/hosts/elros/configuration.nix
index 0643910..3e49153 100644
--- a/hosts/elros/configuration.nix
+++ b/hosts/elros/configuration.nix
@@ -28,6 +28,8 @@
     ../../modules/acme.nix
     ../../modules/pangolin.nix
 
+    ../../modules/restic-client.nix
+
   ];
 
   boot.binfmt.emulatedSystems = [ "aarch64-linux" ]; # support rpi building
diff --git a/hosts/legolas/configuration.nix b/hosts/legolas/configuration.nix
index 0f8b4aa..7c1ab69 100644
--- a/hosts/legolas/configuration.nix
+++ b/hosts/legolas/configuration.nix
@@ -39,11 +39,21 @@
     ../../modules/desktopApplications.nix
     ../../modules/fcitx5.nix
 
+    ../../modules/restic-client.nix
+
   ];
 
   networking.hostName = "legolas";
   networking.networkmanager.enable = true;
   time.timeZone = "Europe/Amsterdam";
+
+  services.restic.backups.main.exclude = [
+    "/home/gunalx/Documents/div/qwen-asr-no"
+    "/home/gunalx/Pictures/google"
+    "/home/gunalx/.local/share/zed"
+    "/home/gunalx/.local/share/qwen-asr"
+    "/home/gunalx/.local/share/opencode"
+  ];
   # Select internationalisation properties.
   # i18n.defaultLocale = "en_US.UTF-8";
 
diff --git a/modules/restic-client.nix b/modules/restic-client.nix
index 76f9d03..ef0589a 100644
--- a/modules/restic-client.nix
+++ b/modules/restic-client.nix
@@ -23,7 +23,7 @@
       "/var/backups"
       "/home/gunalx"
     ];
-    exclude = lib.mkDefault [
+    exclude = [
       ".cache"
       "__pycache__"
       "*.pyc"
@@ -47,12 +47,14 @@
       "*.tmp"
       "*.swp"
       ".Trash-*"
+      "Trash"
       ".zcompdump*"
       ".nix-defexpr"
       ".steam"
       ".SteamCloud"
       "Steam"
       "/var/lib/containers"
+      ".local/share/containers"
     ];
     timerConfig = {
       OnCalendar = "daily";