From 7972fad90b2e7b62271556289325ad1b59c3ae15 Mon Sep 17 00:00:00 2001
From: randogoth <kflux@posteo.de>
Date: Mon, 8 Jun 2026 17:05:24 +0300
Subject: [PATCH] backup: add tor identity and tailscale state; fix dump dir

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 deploy.md                   | 45 +++++++++++++++++++++++++++++++++++++
 modules/services/backup.nix |  9 +++++++-
 2 files changed, 53 insertions(+), 1 deletion(-)
 create mode 100644 deploy.md

diff --git a/deploy.md b/deploy.md
new file mode 100644
index 0000000..591936c
--- /dev/null
+++ b/deploy.md
@@ -0,0 +1,45 @@
+# Deploying bucur
+
+## Connect
+
+SSH via Tailscale (preferred) or direct IP:
+
+```bash
+ssh tobias@bucur          # via Tailscale
+ssh tobias@194.68.44.28   # direct
+```
+
+User `tobias` has passwordless sudo (`wheel` group).
+
+## Deploy
+
+SSH into the server and run nixos-rebuild there — do not build locally:
+
+```bash
+ssh tobias@194.68.44.28 'cd /etc/nixos && sudo git pull && sudo nixos-rebuild switch --flake /etc/nixos#bucur'
+```
+
+The server pulls from Codeberg (`codeberg.org:randogoth/bucur`) using the deploy key in `secrets/bucur.yaml`.
+
+## Adding secrets
+
+Edit `secrets/bucur.yaml` with sops (age key at `secrets/age/keys.txt`):
+
+```bash
+SOPS_AGE_KEY_FILE=secrets/age/keys.txt nix run nixpkgs#sops -- secrets/bucur.yaml
+```
+
+Reference the new secret in the relevant module via `config.sops.secrets.<name>.path`.
+
+## Manual service ops
+
+```bash
+# Check a service
+ssh tobias@194.68.44.28 'sudo journalctl -fu <service>'
+
+# Trigger the daily database backup
+ssh tobias@194.68.44.28 'sudo systemctl start borgbackup-job-databases'
+
+# List backup archives
+ssh tobias@194.68.44.28 'sudo bash -c "BORG_RSH=\"ssh -i /run/secrets/borg_ssh_key\" BORG_PASSPHRASE=\$(cat /run/secrets/borg_passphrase) borg list ssh://snh7mkwh@snh7mkwh.repo.borgbase.com/./repo"'
+```
diff --git a/modules/services/backup.nix b/modules/services/backup.nix
index 73ffc7f..a19ef71 100644
--- a/modules/services/backup.nix
+++ b/modules/services/backup.nix
@@ -10,7 +10,14 @@ in
 
   services.borgbackup.jobs.databases = {
     repo  = "ssh://snh7mkwh@snh7mkwh.repo.borgbase.com/./repo";
-    paths = [ dumpDir ];
+    paths = [
+      dumpDir
+      "/var/lib/tor/keys"
+      "/var/lib/tor/fingerprint"
+      "/var/lib/tor/fingerprint-ed25519"
+      "/var/lib/tor/hashed-fingerprint"
+      "/var/lib/tailscale"
+    ];
 
     encryption = {
       mode        = "repokey-blake2";