bucur/modules/services/backup.nix

{ config, pkgs, ... }:
let
  nostrDb = "/var/lib/nostr-rs-relay/nostr.db";
  jiroriDb = "/var/lib/jirorian/jirorian.db";
  oberonDb = "/var/lib/oberon/oberon.db";
  forgejoDb = "/var/lib/forgejo/data/forgejo.db";
  dumpDir = "/tmp/borg-dumps";
in
{
  sops.secrets.borg_ssh_key = {
    mode = "0400";
  };
  sops.secrets.borg_passphrase = { };

  services.borgbackup.jobs.databases = {
    repo = "ssh://snh7mkwh@snh7mkwh.repo.borgbase.com/./repo";
    paths = [
      dumpDir
      "/var/lib/tor/keys"
      "/var/lib/tor/fingerprint"
      "/var/lib/tor/fingerprint-ed25519"
      "/var/lib/tor/hashed-fingerprint"
      "/var/lib/tailscale"
      "/var/lib/forgejo/repositories"
      "/var/lib/forgejo/data"
      "/var/lib/forgejo/custom"
    ];

    exclude = [
      "/var/lib/forgejo/data/forgejo.db" # live DB; use the consistent dump
      "/var/lib/forgejo/data/tmp"
      "/var/lib/forgejo/data/queues"
    ];

    encryption = {
      mode = "repokey-blake2";
      passCommand = "cat ${config.sops.secrets.borg_passphrase.path}";
    };

    environment.BORG_RSH = "ssh -i ${config.sops.secrets.borg_ssh_key.path} -o StrictHostKeyChecking=accept-new";

    preHook = ''
      mkdir -p ${dumpDir}
      ${pkgs.sqlite}/bin/sqlite3 ${nostrDb}  ".backup '${dumpDir}/nostr.db'"
      ${pkgs.sqlite}/bin/sqlite3 ${jiroriDb} ".backup '${dumpDir}/jirorian.db'"
      ${pkgs.sqlite}/bin/sqlite3 ${oberonDb} ".backup '${dumpDir}/oberon.db'"
      ${pkgs.sqlite}/bin/sqlite3 ${forgejoDb} ".backup '${dumpDir}/forgejo.db'"
    '';

    postHook = ''
      rm -f ${dumpDir}/nostr.db ${dumpDir}/jirorian.db ${dumpDir}/oberon.db ${dumpDir}/forgejo.db
    '';

    startAt = "daily";

    prune.keep = {
      daily = 7;
      weekly = 4;
      monthly = 6;
    };
  };
}