modules/backup: Simplify and align with server module

7 files changed, 74 insertions, 90 deletions

diff --git a/modules/by-name/ba/backup/module.nix b/modules/by-name/ba/backup/module.nix
index e601d840..ca7a469c 100644
--- a/modules/by-name/ba/backup/module.nix
+++ b/modules/by-name/ba/backup/module.nix
@@ -1,25 +1,30 @@
-# nixos-config - My current NixOS configuration
-#
-# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# This file is part of my nixos-config.
-#
-# You should have received a copy of the License along with this program.
-# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
 {
   lib,
   config,
   pkgs,
-  libraries,
   ...
 }: let
-  cfg = config.soispha.services.backup;
+  cfg = config.vhack.services.backup;
 
   snapshotDir = "/srv/last_snapshot";
 in {
-  options.soispha.services.backup = {
-    enable = libraries.base.options.mkEnable "backups via restic";
+  options.vhack.services.backup = {
+    exclude = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = "Which paths to exclude from the backup. Should be absolute.";
+      example = [
+        "/var/lib/postgresql"
+      ];
+    };
+    backupPrepare = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      example = ''
+        {
+          postgresql = "pg_dumpall";
+        }
+      '';
+      default = {};
+    };
 
     storagebox = {
       enable = lib.mkEnableOption "remote backups";
@@ -32,13 +37,17 @@ in {
       sshKey = lib.mkOption {
         type = lib.types.path;
         description = "The age-encrypted ssh-key, passed to agenix";
-        default = ./secrets/storagebox/ssh_key.age;
+      };
+
+      sshHostKey = lib.mkOption {
+        type = lib.types.str;
+        description = "The ssh public host key, to authenticate that the server matches.";
+        example = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs";
       };
 
       repositoryPassword = lib.mkOption {
         type = lib.types.path;
         description = "The age-encrypted restic password, passed to agenix";
-        default = ./secrets/storagebox/repository_password.age;
       };
     };
 
@@ -48,7 +57,6 @@ in {
       repositoryPassword = lib.mkOption {
         type = lib.types.path;
         description = "The age-encrypted restic password, passed to agenix";
-        default = ./secrets/local/repository_password.age;
       };
 
       backupMountPoint = lib.mkOption {
@@ -59,11 +67,15 @@ in {
     };
   };
 
-  config = lib.mkIf cfg.enable {
-    soispha.impermanence.directories = lib.mkMerge [
+  config = lib.mkIf (cfg.local.enable || cfg.storagebox.enable) {
+    vhack.persist.directories = lib.mkMerge [
       (lib.mkIf cfg.storagebox.enable [
         "/var/cache/restic-backups-storagebox"
 
+        # TODO: Ideally we would not save the admin cache and normal cache separately, as
+        # they both access the exactly same data. The admin one just also has write
+        # access. But because the `systemd.mounts` thing does not work, they are saved
+        # separately now. <2026-10-31>
         # Generate the base systemd.mount from impermanence (we will override this, so it
         # points to the non-admin one instead)
         "/var/cache/restic-backups-storagebox-admin"
@@ -101,10 +113,10 @@ in {
       };
     };
 
-    soispha.programs.ssh = lib.mkIf cfg.storagebox.enable {
+    vhack.programs.ssh = lib.mkIf cfg.storagebox.enable {
       enable = true;
       rootKnownHosts = {
-        "[u459143-sub1.your-storagebox.de]:23" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs";
+        "[${cfg.storagebox.user}.your-storagebox.de]:23" = cfg.storagebox.sshHostKey;
       };
     };
 
@@ -120,14 +132,17 @@ in {
         serviceConfig = {
           ExecStart = lib.getExe (pkgs.writeShellApplication {
             name = "prepareBackup";
-            text = ''
-              set -x
-
-              [ -d "${snapshotDir}" ] && btrfs subvolume delete "${snapshotDir}"
+            text =
+              ''
+                set -x
+              ''
+              + builtins.concatStringsSep "\n\n" (builtins.attrValues cfg.backupPrepare)
+              + ''
+                [ -d "${snapshotDir}" ] && btrfs subvolume delete "${snapshotDir}"
 
-              # -r := Make the snapshot read-only
-              btrfs subvolume snapshot -r /srv "${snapshotDir}";
-            '';
+                # -r := Make the snapshot read-only
+                btrfs subvolume snapshot -r /srv "${snapshotDir}";
+              '';
 
             inheritPath = false;
             runtimeInputs = [
@@ -160,16 +175,10 @@ in {
     };
 
     services.restic.backups = let
-      homeDir = "${snapshotDir}/home";
-
       paths = [
         snapshotDir
       ];
-      exclude = [
-        "${homeDir}/soispha/.cache"
-        "${homeDir}/soispha/.local/share/lutris/install"
-        "${homeDir}/soispha/.local/share/Steam/steamapps/common"
-      ];
+      exclude = lib.map (path: "${snapshotDir}/${path}") cfg.exclude;
       extraBackupArgs = [
         # Don't scan the filesystem to determine an estimate.
         "--no-scan"
@@ -208,6 +217,7 @@ in {
         repository = "rclone: ";
 
         timerConfig = {
+          Requires = "network-online.target";
           OnActiveSec = "30m";
           OnUnitInactiveSec = "2h";
           Persistent = true;
diff --git a/modules/by-name/ba/backup/secrets/local/repository_password.age b/modules/by-name/ba/backup/secrets/local/repository_password.age
deleted file mode 100644
index b1508e49..00000000
--- a/modules/by-name/ba/backup/secrets/local/repository_password.age
+++ /dev/null
@@ -1,20 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqVCtBZzNBWFlxQnhlb3c2
-NG0xMjV3V2hQUWhNb01ROGpFbzM0c3NjRWlvCjRqMTdxNlNsY1lDM2VCUGRjcldZ
-SUhScGRSejY3TFlwVjlweTRERkU4ZTQKLT4gc3NoLWVkMjU1MTkgelpFb25nIGtj
-cVN4RzFseTJCVXhOc0tEWi96ckpGQjhNdUZrb1FVWnJ6TU1vSHZCMUkKc1JwM2Ir
-TzNzZEV5VEE4QUp4cDdTNWZvTFlZR0tUbUFZTnNEZE1McnhISQotPiBzc2gtZWQy
-NTUxOSA3SGZGVXcgYVQzRHdaa1NYUUpLODUyL0orV3d4Z1o1V2hhekZXVWFzNW50
-enhSYnlWbwpzbnZwK1dSczJ5SGZsRjNyRWZraUcreWlBakZOZkVyZ01CWml5V0E4
-TzY4Ci0+ICpMUC1ncmVhc2UgV0IKUTZVMzR1QTVGdWRyNWprVVpjaWhCTTFSRzY3
-bHVtdHpJQXlWQVFHZ3FzbkZncHRsQnJIaHlEekl5ZE15Sko0YQpSVEUKLS0tIGFy
-N1Y2OUREY1NOL2xPODd4Y3Y4Wk83NFJ5ZVBpNnJYelo3RmZPL1V4Q28KcA+6qt2d
-LrL0FS279XL1uqSeXiDdBBBh5i951dRx9ML33g7IoQxaGqSWU0yP/y7fcSp3B/rT
-/alQGRL/uYnCS2z8zCngr2YCQBXAI8bOgf+th7fzc15FXNB14WMGvrCVRB8Rr6JZ
-itTxcAebY192xeINJG269iL6Ef0YrmZLUufKQ9lcVob/G32tG0vxSbSBBx3asf7y
-toiNdlXpxJPrIpFx5mc3dnkaXCTSRuXjiAqnncW/HNxovCI90sY3dyL+XRC8iEOD
-sql7C7jUUvLubptk1gGW5pHmGvqeCLr+fJ6XrVqXE5VxOSbzvSUsdS84WOBInLiO
-V36aUtthEzdRXd81P/n7U26O93GWpIwzctu0WwSHHHsPKhxqFY4RuWa3mO4Zk6fu
-O6fsYnpAqYiCUd/k2zKrDtLosTnwuwc7Vm1glm4DEEtvteVibw47SR1LLfUds5XL
-j1OR7Z6/ljIEKPjE1a81pQjYRfHDUtceXUvrlL6iCID30zU=
------END AGE ENCRYPTED FILE-----
diff --git a/modules/by-name/ba/backup/secrets/storagebox/repository_password.age b/modules/by-name/ba/backup/secrets/storagebox/repository_password.age
deleted file mode 100644
index a2aa984a..00000000
--- a/modules/by-name/ba/backup/secrets/storagebox/repository_password.age
+++ /dev/null
@@ -1,14 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzbnJ5Z3NXRFRtdEdCNk1z
-NG9Cb2FUTEZ2U2hTdUptWGpneHd2RGxGQlY0ClhqcHlMSUZlLzBPZko4a2hKdnE1
-Q1hnc3ErWlJiSk1HVXFLcSswQlV0WTAKLT4gc3NoLWVkMjU1MTkgelpFb25nIG5I
-cFpMY21ZdU9TUHY5VksraG1xeFByQlM1WE1INEk0SWFJQzIvSXhZbXMKSWxiNlIr
-NjZ6bEgySUJGdnpoZTY2MmxxajJMaUVTM3RkTmhpdkxaRnNCQQotPiBzc2gtZWQy
-NTUxOSA3SGZGVXcgRGtLMHFORm9mUDUwZnBXM0djcFlxTExJbWVDeDJmbVVSRi9l
-QTFmekpROApZY3Z0Zlc1SUdCcllKQ01ZNmdFQkI3UnViVGxzNTJNUkhqc2hOejY3
-MndrCi0+IG1Hbi1ncmVhc2UgUDJJdgpGUmVHa1NPWGtzUmZmMXM3eWkxVnJkek1h
-MUxZeS9qMlArendXZ1ltdFgvMTBabTlPM2hzSjhuVXBQNktHKzc1ClF6bjZob09B
-Ci0tLSB3dEZpbnpVR0pPdGpFVmNyM0JzUGl6eGcreXpkTG9xQUc5S09ndUthaEpR
-CuHgXCIq/AUCuIQWepBRapAab6zczOwxEBpDv5R2kw2mw34UVRLuFs7hB1cHE79y
-7Fc=
------END AGE ENCRYPTED FILE-----
diff --git a/modules/by-name/ba/backup/secrets/storagebox/ssh_key.age b/modules/by-name/ba/backup/secrets/storagebox/ssh_key.age
deleted file mode 100644
index a7f30c7c..00000000
--- a/modules/by-name/ba/backup/secrets/storagebox/ssh_key.age
+++ /dev/null
@@ -1,22 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJOTFaQVpnQ2VJN1pJbmdu
-STF2UTF1Y3lyU2p3OUJlcWRFWlg3Mm9vSEFFCjg4RklaZ0hqdWdZSlJ0dGx0ckJN
-eHE4R1QyTEJEVkZudnVQV2VpblBYTW8KLT4gc3NoLWVkMjU1MTkgelpFb25nIDR0
-Z2RwTXJGV1VYT2Y1OUcxbXpnOGNEbG9BWmFxeWUzZ1huNW1YQk5BM3cKK1hLNnYx
-VnNvRDZWM3Y4VUpCQTRtbHJOcDJLdTBOUXJ1ak52Mkp3TE9OcwotPiBzc2gtZWQy
-NTUxOSA3SGZGVXcgSHFSOXM1Vm1lY0ErRkZobndEU0xvQjVXbnhDbUlGNmE2dStY
-SEFqSk9TMAo2VU5UbW9rc29kendvcHNuU3hFQ2lBQWNjRUxUSE10RmtjbkdwWGlv
-cTRVCi0+IDwtZ3JlYXNlIHNPT3N1IHNkZzcoQzUgLUM3Ml1Tcgorb3FQcWlDSkJQ
-L1g4WisydkYxdnJMeDNISVVDTGlZdmUyRkV0TkFUdW4ycXZBSlF3UWM2R3FTYjRs
-ckEyaTg2ClVrbwotLS0gdHF5Q3BqV3h2TzEySCs4OFNIYmx1U0hsTWo1RDlTV3VC
-T1RmelZaWXh4YwoeRkYbirDGX9aZj6OVxZ8sVsm2Sz23ikcBhAdTIXKErM7eQcdp
-Y2nA5kUebPVznbSq/XSQNbqvCfSv9wVVTZWww7AqkrltjFS8yxQVMKB37IfnJsZI
-92OCjJKArxAbvS7ERKY51Cf9oY/VqGk5WqxExH5ZvdbL144UI8JzrxhDopVXBWNd
-fCrHirRAdlu3wgVILXV3vk1kmE69sspuV4cer5f/kOBKT1w09s2NFFHH4TO3cLTJ
-Obgi/HWYHBjqGSgwd4bDtNOW2UDE1LN3YeUhloutWhuX8yt+NFzZJtl+CBrRqLKA
-0CK+ZPKPWWKYPCNlzKT4vDF9BZeyCfoEj9dTXvxrNPEB6YYi16aQ8DhI8wxADl41
-ShrULlEmB8rfz7V+8TFmERKISBRSSH0p+XJi8e2DWh2dSco16rizmbFFNDdcYiGT
-WWbXYCFNzj+kNFI/vEtt9dEWmfXlgg01khnyoOuRLedtoCDSuF+8z7YYy6oYt/2h
-gmf4NHOUgyxK56c17JMQ3xT97d2odgqmwB+YZQ13IJCjt3M3pmSssD4sTgmA5alH
-vtUlci6dZdO801h5vOesbAJplXCEyw==
------END AGE ENCRYPTED FILE-----
diff --git a/modules/by-name/lu/lutris/module.nix b/modules/by-name/lu/lutris/module.nix
index eabc11fb..6864bacb 100644
--- a/modules/by-name/lu/lutris/module.nix
+++ b/modules/by-name/lu/lutris/module.nix
@@ -15,6 +15,8 @@
   ...
 }: let
   cfg = config.soispha.programs.lutris;
+
+  inherit (config.home-manager.users.soispha.home) homeDirectory;
 in {
   options.soispha.programs.lutris = {
     enable = libraries.base.options.mkEnable "Lutris";
@@ -27,6 +29,9 @@ in {
     soispha.services.unison.pathsToSync = [
       "~/.config/lutris"
     ];
+    vhack.services.backup.exclude = [
+      "${homeDirectory}/.local/share/lutris/install"
+    ];
 
     # TODO: This should also have something, to avoid giving the games network access: 'https://github.com/lutris/docs/blob/master/DisableNetworkAccess.md' <2026-07-10>
     home-manager.users.soispha = {
diff --git a/modules/by-name/po/postgresql/module.nix b/modules/by-name/po/postgresql/module.nix
index 319c3ac5..ccc08b37 100644
--- a/modules/by-name/po/postgresql/module.nix
+++ b/modules/by-name/po/postgresql/module.nix
@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }: let
   cfg = config.vhack.postgresql;
@@ -14,6 +15,25 @@ in {
       "/var/lib/postgresql"
     ];
 
+    vhack.services.backup = {
+      exclude = [
+        "/var/lib/postgresql" # included in the db dump
+      ];
+
+      backupPrepare.postgresql = ''
+        ${lib.getExe pkgs.sudo} -u postgres \
+            ${lib.getExe' "pg_dumpall" pkgs.postgresql} \
+              --clean \
+              --if-exists \
+              --quote-all-identifiers |
+            ${lib.getExe pkgs.xz} \
+              --compress \
+              -9 \
+              --extreme \
+              --threads=0 > /srv/db_backup.sql.xz
+      '';
+    };
+
     services.postgresql.enable = true;
   };
 }
diff --git a/modules/by-name/st/steam/module.nix b/modules/by-name/st/steam/module.nix
index f44aa0dd..8dbd8da5 100644
--- a/modules/by-name/st/steam/module.nix
+++ b/modules/by-name/st/steam/module.nix
@@ -13,6 +13,8 @@
   ...
 }: let
   cfg = config.soispha.programs.steam;
+
+  inherit (config.home-manager.users.soispha.home) homeDirectory;
 in {
   options.soispha.programs.steam = {
     enable = lib.mkEnableOption "Steam";
@@ -25,6 +27,9 @@ in {
       "steam-original"
       "steam-run"
     ];
+    vhack.services.backup.exclude = [
+      "${homeDirectory}/.local/share/Steam/steamapps/common"
+    ];
 
     soispha.services.unison.pathsToIgnore = [
       # That is just to big to be synchronized (# TODO: Work around that <2024-08-31> )