nixos-config/hosts/voyager/backup.nix

{ config, pkgs, lib, ... }:
{
  services.borgbackup.jobs =
    let
      borgJob = name: {
        environment.BORG_RSH = "ssh -i /root/.ssh/fealsyn1";
        environment.BORG_REMOTE_PATH = "/usr/local/bin/borg";
        repo = "ssh://backup@feal-syn1.home.feal.no/volume2/backup/borg/voyager/${name}";
        compression = "auto,zstd";
      };
    in {
      postgresDaily = borgJob "postgres::daily" // {
        paths = "/var/backup/postgres";
        startAt = "*-*-* 05:15:00"; # 2 hours after postgresqlBackup
        extraInitArgs = "--storage-quota 10G";
        encryption = {
          mode = "repokey-blake2";
          passCommand = "cat ${config.sops.secrets."borg/postgres".path}";
        };
      };

      postgresWeekly = borgJob "postgres::weekly" // {
        paths = "/var/backup/postgres";
        startAt = "Mon *-*-* 05:15:00"; # 2 hours after postgresqlBackup
        extraInitArgs = "--storage-quota 10G";
        encryption = {
          mode = "repokey-blake2";
          passCommand = "cat ${config.sops.secrets."borg/postgres".path}";
        };
      };

      transmission = borgJob "transmission::weekly" // {
        paths = "/var/lib/transmission";
        startAt = "weekly";
        encryption = {
          mode = "repokey-blake2";
          passCommand = "cat ${config.sops.secrets."borg/transmission".path}";
        };
      };

      # TODO: kanidm, timemachine, calibre(?), nextcloud

    };

  sops.secrets."borg/postgres" = { };
  sops.secrets."borg/transmission" = { };
}