1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

{
  config,
  lib,
  pkgs,
  ...
}:
let
  enable = true;
in
lib.mkIf enable {
  age.secrets = {
    restic-env.file = ../../secrets/restic-env.age;
    restic-pass.file = ../../secrets/restic-pass.age;
    restic-repo.file = ../../secrets/restic-repo.age;
    restic-webhook.file = ../../secrets/restic-webhook.age;
  };

  services.restic.backups.dragonwell = {
    initialize = true;
    environmentFile = config.age.secrets.restic-env.path;
    passwordFile = config.age.secrets.restic-pass.path;
    repositoryFile = config.age.secrets.restic-repo.path;
    paths = [
      "/var/lib/ugit/repos"
      "/var/lib/pocket-id"
      "/var/lib/miniserve"
      "/var/lib/pds"
      "/var/lib/foundryvtt/Data"
      "/var/lib/foundryvtt/Config"
    ];
    pruneOpts = [
      "--keep-daily 7"
      "--keep-weekly 2"
      "--keep-monthly 2"
    ];
    runCheck = true;
    checkOpts = [ "--read-data-subset=5%" ];
    timerConfig = {
      OnCalendar = "daily";
      Persistent = true;
    };
  };

  systemd.services = {
    restic-backups-dragonwell.onFailure = [ "restic-alert.service" ];
    restic-alert = {
      description = "Notify on restic backup/check failure";
      serviceConfig.Type = "oneshot";
      script = ''
        webhook=$(cat ${config.age.secrets.restic-webhook.path})
        ${lib.getExe pkgs.curl} -sf -H "Content-Type: application/json" \
          -d '{"content": "⚠️ restic backup/check failed on dragonwell"}' \
          "$webhook"
      '';
    };
  };
}