3 files changed, 36 insertions, 3 deletions

diff --git a/modules/by-name/ba/backup/env.vars b/modules/by-name/ba/backup/env.vars
new file mode 100644
index 00000000..339c5a5b
--- /dev/null
+++ b/modules/by-name/ba/backup/env.vars
@@ -0,0 +1 @@
+RESTIC_COMPRESSION=max
diff --git a/modules/by-name/ba/backup/module.nix b/modules/by-name/ba/backup/module.nix
index 7987a31f..031445cf 100644
--- a/modules/by-name/ba/backup/module.nix
+++ b/modules/by-name/ba/backup/module.nix
@@ -63,12 +63,23 @@ in {
     soispha.impermanence.directories = lib.mkMerge [
       (lib.mkIf cfg.storagebox.enable [
         "/var/cache/restic-backups-storagebox"
+
+        # Generate the base systemd.mount from impermanence (we will override this, so it
+        # points to the non-admin one instead)
+        "/var/cache/restic-backups-storagebox-admin"
       ])
       (lib.mkIf cfg.local.enable [
         "/var/cache/restic-backups-local"
       ])
     ];
 
+    # TODO: Make this work (`systemd.mounts` is a list, so _this_ doesn't work.) <2026-07-07>
+    # systemd.mounts."/var/cache/restic-backups-storagebox-admin" = {
+    #   # TODO: Don't hardcode the path, but use
+    #   # `systemd.mounts."/var/cache/restic-backups-storagebox".what` instead <2026-07-07>
+    #   what = "/srv/var/cache/restic-backups-storagebox";
+    # };
+
     age.secrets = {
       resticStorageboxSshKey = lib.mkIf cfg.storagebox.enable {
         file = cfg.storagebox.sshKey;
@@ -156,16 +167,21 @@ in {
       ];
       exclude = [
         "${homeDir}/soispha/.cache"
+        "${homeDir}/soispha/.local/share/lutris/install"
+        "${homeDir}/soispha/.local/share/Steam/steamapps/common"
       ];
       extraBackupArgs = [
+        # Don't scan the filesystem to determine an estimate.
+        "--no-scan"
         "--verbose=2"
       ];
+      environmentFile = "${./env.vars}";
     in {
       local = lib.mkIf cfg.local.enable {
         inhibitsSleep = true;
         initialize = true;
 
-        inherit paths exclude extraBackupArgs;
+        inherit paths exclude extraBackupArgs environmentFile;
 
         passwordFile = config.age.secrets.resticLocalRepositoryPassword.path;
 
@@ -179,7 +195,7 @@ in {
         inhibitsSleep = true;
         initialize = true;
 
-        inherit paths exclude extraBackupArgs;
+        inherit paths exclude extraBackupArgs environmentFile;
 
         passwordFile = config.age.secrets.resticStorageboxRepositoryPassword.path;
         extraOptions = [
@@ -201,9 +217,13 @@ in {
 
       # This is only for listing, pruning and such stuff.
       storagebox-admin = lib.mkIf cfg.storagebox.enable {
-        inhibitsSleep = false;
+        inhibitsSleep = true;
+
+        # Don't create the repository if it doesn't exist yet.
         initialize = false;
 
+        inherit paths exclude extraBackupArgs environmentFile;
+
         passwordFile = config.age.secrets.resticStorageboxRepositoryPassword.path;
         extraOptions = [
           "rclone.program='ssh -p 23 ${cfg.storagebox.user}@${cfg.storagebox.user}.your-storagebox.de command_forced_on_remote'"
diff --git a/modules/by-name/ss/ssh/module.nix b/modules/by-name/ss/ssh/module.nix
index 87c50728..39c203fd 100644
--- a/modules/by-name/ss/ssh/module.nix
+++ b/modules/by-name/ss/ssh/module.nix
@@ -55,6 +55,13 @@ in {
               text = cfg.rootKnownHosts;
             })
           );
+          "Host *.your-storagebox.de" = {
+            # Don't try to authenticate via password for these, because we need to use the
+            # forced commands, and they are only provided via the ssh key login.
+            # So password login is a footgun (it is, however, valid to use it for non-root
+            # use-cases)
+            PasswordAuthentication = false;
+          };
         };
       };
 
@@ -64,6 +71,11 @@ in {
 
         settings = {
           "Host *" = mkDefaultMatchBlock "${config.home-manager.users.soispha.xdg.dataHome}/ssh/known_hosts";
+          "Host *.your-storagebox.de" = {
+            # Port 22 is for sftp, and when we connect as user, we probably want an
+            # interactive shell.
+            Port = 23;
+          };
         };
       };
     };