modules/backup: Simplify and align with server module

8 files changed, 84 insertions, 36 deletions

diff --git a/hosts/by-name/apzu/configuration.nix b/hosts/by-name/apzu/configuration.nix
index 9e5d97f0..a27688ba 100644
--- a/hosts/by-name/apzu/configuration.nix
+++ b/hosts/by-name/apzu/configuration.nix
@@ -57,8 +57,16 @@
     };
     users = {
       enable = true;
-      enableDeprecatedPlugdev = true;
-      hashedPassword = "$y$jFT$3qI9MYLDHPUdGKsVa8skV0$TOjX0SFHWuj52zd7/kmkNtG5EqQwYcqv0FKXWbLaro6";
+      users = [
+        {
+          name = "soispha";
+          groups = ["wheel" "audio"];
+          enableDeprecatedPlugdev = true;
+          uid = 1000;
+          sshKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIME4ZVa+IoZf6T3U08JG93i6QIAJ4amm7mkBzO14JSkz";
+          hashedPassword = "$y$jFT$3qI9MYLDHPUdGKsVa8skV0$TOjX0SFHWuj52zd7/kmkNtG5EqQwYcqv0FKXWbLaro6";
+        }
+      ];
     };
   };
 
diff --git a/modules/by-name/ba/backup/secrets/local/repository_password.age b/hosts/by-name/apzu/secrets/local/repository_password.age
index b1508e49..b1508e49 100644
--- a/modules/by-name/ba/backup/secrets/local/repository_password.age
+++ b/hosts/by-name/apzu/secrets/local/repository_password.age
diff --git a/modules/by-name/ba/backup/secrets/storagebox/repository_password.age b/hosts/by-name/apzu/secrets/storagebox/repository_password.age
index a2aa984a..a2aa984a 100644
--- a/modules/by-name/ba/backup/secrets/storagebox/repository_password.age
+++ b/hosts/by-name/apzu/secrets/storagebox/repository_password.age
diff --git a/modules/by-name/ba/backup/secrets/storagebox/ssh_key.age b/hosts/by-name/apzu/secrets/storagebox/ssh_key.age
index a7f30c7c..a7f30c7c 100644
--- a/modules/by-name/ba/backup/secrets/storagebox/ssh_key.age
+++ b/hosts/by-name/apzu/secrets/storagebox/ssh_key.age
diff --git a/modules/by-name/ba/backup/module.nix b/modules/by-name/ba/backup/module.nix
index e601d840..ca7a469c 100644
--- a/modules/by-name/ba/backup/module.nix
+++ b/modules/by-name/ba/backup/module.nix
@@ -1,25 +1,30 @@
-# nixos-config - My current NixOS configuration
-#
-# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# This file is part of my nixos-config.
-#
-# You should have received a copy of the License along with this program.
-# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
 {
   lib,
   config,
   pkgs,
-  libraries,
   ...
 }: let
-  cfg = config.soispha.services.backup;
+  cfg = config.vhack.services.backup;
 
   snapshotDir = "/srv/last_snapshot";
 in {
-  options.soispha.services.backup = {
-    enable = libraries.base.options.mkEnable "backups via restic";
+  options.vhack.services.backup = {
+    exclude = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = "Which paths to exclude from the backup. Should be absolute.";
+      example = [
+        "/var/lib/postgresql"
+      ];
+    };
+    backupPrepare = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      example = ''
+        {
+          postgresql = "pg_dumpall";
+        }
+      '';
+      default = {};
+    };
 
     storagebox = {
       enable = lib.mkEnableOption "remote backups";
@@ -32,13 +37,17 @@ in {
       sshKey = lib.mkOption {
         type = lib.types.path;
         description = "The age-encrypted ssh-key, passed to agenix";
-        default = ./secrets/storagebox/ssh_key.age;
+      };
+
+      sshHostKey = lib.mkOption {
+        type = lib.types.str;
+        description = "The ssh public host key, to authenticate that the server matches.";
+        example = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs";
       };
 
       repositoryPassword = lib.mkOption {
         type = lib.types.path;
         description = "The age-encrypted restic password, passed to agenix";
-        default = ./secrets/storagebox/repository_password.age;
       };
     };
 
@@ -48,7 +57,6 @@ in {
       repositoryPassword = lib.mkOption {
         type = lib.types.path;
         description = "The age-encrypted restic password, passed to agenix";
-        default = ./secrets/local/repository_password.age;
       };
 
       backupMountPoint = lib.mkOption {
@@ -59,11 +67,15 @@ in {
     };
   };
 
-  config = lib.mkIf cfg.enable {
-    soispha.impermanence.directories = lib.mkMerge [
+  config = lib.mkIf (cfg.local.enable || cfg.storagebox.enable) {
+    vhack.persist.directories = lib.mkMerge [
       (lib.mkIf cfg.storagebox.enable [
         "/var/cache/restic-backups-storagebox"
 
+        # TODO: Ideally we would not save the admin cache and normal cache separately, as
+        # they both access the exactly same data. The admin one just also has write
+        # access. But because the `systemd.mounts` thing does not work, they are saved
+        # separately now. <2026-10-31>
         # Generate the base systemd.mount from impermanence (we will override this, so it
         # points to the non-admin one instead)
         "/var/cache/restic-backups-storagebox-admin"
@@ -101,10 +113,10 @@ in {
       };
     };
 
-    soispha.programs.ssh = lib.mkIf cfg.storagebox.enable {
+    vhack.programs.ssh = lib.mkIf cfg.storagebox.enable {
       enable = true;
       rootKnownHosts = {
-        "[u459143-sub1.your-storagebox.de]:23" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs";
+        "[${cfg.storagebox.user}.your-storagebox.de]:23" = cfg.storagebox.sshHostKey;
       };
     };
 
@@ -120,14 +132,17 @@ in {
         serviceConfig = {
           ExecStart = lib.getExe (pkgs.writeShellApplication {
             name = "prepareBackup";
-            text = ''
-              set -x
-
-              [ -d "${snapshotDir}" ] && btrfs subvolume delete "${snapshotDir}"
+            text =
+              ''
+                set -x
+              ''
+              + builtins.concatStringsSep "\n\n" (builtins.attrValues cfg.backupPrepare)
+              + ''
+                [ -d "${snapshotDir}" ] && btrfs subvolume delete "${snapshotDir}"
 
-              # -r := Make the snapshot read-only
-              btrfs subvolume snapshot -r /srv "${snapshotDir}";
-            '';
+                # -r := Make the snapshot read-only
+                btrfs subvolume snapshot -r /srv "${snapshotDir}";
+              '';
 
             inheritPath = false;
             runtimeInputs = [
@@ -160,16 +175,10 @@ in {
     };
 
     services.restic.backups = let
-      homeDir = "${snapshotDir}/home";
-
       paths = [
         snapshotDir
       ];
-      exclude = [
-        "${homeDir}/soispha/.cache"
-        "${homeDir}/soispha/.local/share/lutris/install"
-        "${homeDir}/soispha/.local/share/Steam/steamapps/common"
-      ];
+      exclude = lib.map (path: "${snapshotDir}/${path}") cfg.exclude;
       extraBackupArgs = [
         # Don't scan the filesystem to determine an estimate.
         "--no-scan"
@@ -208,6 +217,7 @@ in {
         repository = "rclone: ";
 
         timerConfig = {
+          Requires = "network-online.target";
           OnActiveSec = "30m";
           OnUnitInactiveSec = "2h";
           Persistent = true;
diff --git a/modules/by-name/lu/lutris/module.nix b/modules/by-name/lu/lutris/module.nix
index eabc11fb..6864bacb 100644
--- a/modules/by-name/lu/lutris/module.nix
+++ b/modules/by-name/lu/lutris/module.nix
@@ -15,6 +15,8 @@
   ...
 }: let
   cfg = config.soispha.programs.lutris;
+
+  inherit (config.home-manager.users.soispha.home) homeDirectory;
 in {
   options.soispha.programs.lutris = {
     enable = libraries.base.options.mkEnable "Lutris";
@@ -27,6 +29,9 @@ in {
     soispha.services.unison.pathsToSync = [
       "~/.config/lutris"
     ];
+    vhack.services.backup.exclude = [
+      "${homeDirectory}/.local/share/lutris/install"
+    ];
 
     # TODO: This should also have something, to avoid giving the games network access: 'https://github.com/lutris/docs/blob/master/DisableNetworkAccess.md' <2026-07-10>
     home-manager.users.soispha = {
diff --git a/modules/by-name/po/postgresql/module.nix b/modules/by-name/po/postgresql/module.nix
index 319c3ac5..ccc08b37 100644
--- a/modules/by-name/po/postgresql/module.nix
+++ b/modules/by-name/po/postgresql/module.nix
@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }: let
   cfg = config.vhack.postgresql;
@@ -14,6 +15,25 @@ in {
       "/var/lib/postgresql"
     ];
 
+    vhack.services.backup = {
+      exclude = [
+        "/var/lib/postgresql" # included in the db dump
+      ];
+
+      backupPrepare.postgresql = ''
+        ${lib.getExe pkgs.sudo} -u postgres \
+            ${lib.getExe' "pg_dumpall" pkgs.postgresql} \
+              --clean \
+              --if-exists \
+              --quote-all-identifiers |
+            ${lib.getExe pkgs.xz} \
+              --compress \
+              -9 \
+              --extreme \
+              --threads=0 > /srv/db_backup.sql.xz
+      '';
+    };
+
     services.postgresql.enable = true;
   };
 }
diff --git a/modules/by-name/st/steam/module.nix b/modules/by-name/st/steam/module.nix
index f44aa0dd..8dbd8da5 100644
--- a/modules/by-name/st/steam/module.nix
+++ b/modules/by-name/st/steam/module.nix
@@ -13,6 +13,8 @@
   ...
 }: let
   cfg = config.soispha.programs.steam;
+
+  inherit (config.home-manager.users.soispha.home) homeDirectory;
 in {
   options.soispha.programs.steam = {
     enable = lib.mkEnableOption "Steam";
@@ -25,6 +27,9 @@ in {
       "steam-original"
       "steam-run"
     ];
+    vhack.services.backup.exclude = [
+      "${homeDirectory}/.local/share/Steam/steamapps/common"
+    ];
 
     soispha.services.unison.pathsToIgnore = [
       # That is just to big to be synchronized (# TODO: Work around that <2024-08-31> )