migrate backups to borgbase

nixos/common/global/secrets/rekeyed/viridian/baf095ad1a114007e5c55aa2871fe105-borgbackup.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 KTkZog 5sg/hpf/62ScHhTff9oK26rKUHOOIOkaEvz6azRbIFs
+8YDQXQULAwfzazasdUqr+DhBMm0p4957vywLCmbsPOQ
+-> ^)fem:-grease ,C tq3PQ#"
+Dp5AeElkIQ9RTy0qPV91kur2jWvk2uJTgSRqk1gwoM8vUJM/BbpdqsimUCI0PFxG
+Dd507GmCEWDrmovhpAIBS1lAqlY
+--- +Xft4rCt53z0qwZsydGBaUanbAxv06yRHgJeDw6yUAI
+<ÀBÝ98Ê@_ä—h8c>›$KãÇ‚K@<žaÿF(ñؾ¼<C2BE>áÉìÍæ=¬µeù-;ÀÒL˯¹R—=;M·È83Õ>öjø]lµf§
¸ãÞÌNV*Æ¨jmôÛCm ÿ"Þ<>¦¾DêønTwõÜŸ[Ðÿ‡‚

nixos/viridian/hardware-configuration.nix

@@ -3,9 +3,7 @@
   lib,
   pkgs,
   ...
-}: let
+}: {
-  hostname = config.networking.hostName;
-in {
   imports = [
     # Our ephemeral system. Wipe root on reboot.
     ../common/optional/ephemeral-btrfs.nix
@@ -71,12 +69,6 @@ in {
     options = ["subvol=services" "compress=zstd"];
   };
 
-  fileSystems."/srv/backup" = {
-    device = "/dev/disk/by-label/data";
-    fsType = "btrfs";
-    options = ["subvol=backup" "compress=zstd"];
-  };
-
   fileSystems."/srv/shares" = {
     device = "/dev/disk/by-label/data";
     fsType = "btrfs";

nixos/viridian/services/borgbackup/default.nix

@@ -1,33 +1,33 @@
-{...}: {
+{config, ...}: {
-  services.borgbackup.jobs = {
+  age.secrets.borgbackup = {
-    containers = {
+    rekeyFile = ./passphrase.age;
-      paths = [
-        "/srv/containers"
-      ];
-      encryption.mode = "none";
-      repo = "/srv/backup/containers";
-      compression = "auto,zstd";
-      startAt = "daily";
   };
 
-    services = {
+  services.borgbackup.jobs."borgbase" = {
     paths = [
-        "/srv/services"
+      # Shares
+      "/srv/shares/sajenim"
+      # Services
+      "/srv/services/forgejo"
+      "/srv/services/immich"
+      "/srv/services/minecraft"
+      "/srv/services/paperless-ngx"
+      # Containers
+      "/srv/containers/jellyfin"
+      "/srv/containers/lidarr"
+      "/srv/containers/prowlarr"
+      "/srv/containers/qbittorrent"
+      "/srv/containers/radarr"
+      "/srv/containers/sonarr"
     ];
-      encryption.mode = "none";
-      repo = "/srv/backup/services";
-      compression = "auto,zstd";
-      startAt = "daily";
-    };
 
-    shares = {
+    repo = "o93k24r6@o93k24r6.repo.borgbase.com:repo";
-      paths = [
+    encryption = {
-        "/srv/shares"
+      mode = "repokey-blake2";
-      ];
+      passCommand = "cat ${config.age.secrets.traefik.path}";
-      encryption.mode = "none";
-      repo = "/srv/backup/shares";
-      compression = "auto,zstd";
-      startAt = "daily";
     };
+    environment.BORG_RSH = "ssh -i /etc/ssh/ssh_host_ed25519_key";
+    compression = "auto,lzma";
+    startAt = "daily";
   };
 }