rice/hosts/ami/borg.nix

{
  config,
  pkgs,
  ...
}: let
  host = "zh4250@zh4250.rsync.net";
in {
  age.secrets.borgpassword.file = ../../secrets/borgpassword.age;

  services.borgbackup = {
    jobs.backup = {
      paths = ["/etc" "/home" "/root" "/var"];
      exclude = ["/var/log" "/home/buffet/Downloads" "/home/buffet/tmp"];
      repo = "${host}:${config.networking.hostName}";
      encryption = {
        mode = "repokey";
        passCommand = "cat ${config.age.secrets.borgpassword.path}";
      };
      startAt = "daily";
      persistentTimer = true;
      environment.BORG_RSH = "ssh -i /root/.ssh/id_borg";
      extraArgs = "--remote-path borg1";
      prune.keep = {
        within = "1d";
        daily = 7;
        weekly = 4;
        monthly = -1;
      };
    };
  };
}