nixos/hosts/architect/backup.nix

{ config, ... }:

{
  age.secrets = {
    restic-passwords = {
      file = ../../secrets/restic-passwords.age;
    };
    restic-environment = {
      file = ../../secrets/restic-environment.age;
    };
  };

  services.restic.backups = {
    backblaze = {
      initialize = true;
      passwordFile = config.age.secrets.restic-passwords.path;
      environmentFile = config.age.secrets.restic-environment.path;
      repository = "b2:architect:/";
      paths = [ "/var/lib" "/secrets" "/services" ];
      pruneOpts = [
        "--keep-daily 45"
        "--keep-weekly 12"
        "--keep-monthly 12"
        "--keep-yearly 3"
      ];
      timerConfig = {
        OnCalendar = "monday 09:00";
        RandomizedDelaySec = "1h";
      };
    };
  };
}