2 files changed, 41 insertions, 6 deletions

diff --git a/modules/by-name/ba/backup/env.vars b/modules/by-name/ba/backup/env.vars
new file mode 100644
index 00000000..339c5a5b
--- /dev/null
+++ b/modules/by-name/ba/backup/env.vars
@@ -0,0 +1 @@
+RESTIC_COMPRESSION=max
diff --git a/modules/by-name/ba/backup/module.nix b/modules/by-name/ba/backup/module.nix
index d0805092..031445cf 100644
--- a/modules/by-name/ba/backup/module.nix
+++ b/modules/by-name/ba/backup/module.nix
@@ -11,6 +11,7 @@
   lib,
   config,
   pkgs,
+  libraries,
   ...
 }: let
   cfg = config.soispha.services.backup;
@@ -18,6 +19,8 @@
   snapshotDir = "/srv/last_snapshot";
 in {
   options.soispha.services.backup = {
+    enable = libraries.base.options.mkEnable "backups via restic";
+
     storagebox = {
       enable = lib.mkEnableOption "remote backups";
       user = lib.mkOption {
@@ -56,7 +59,27 @@ in {
     };
   };
 
-  config = {
+  config = lib.mkIf cfg.enable {
+    soispha.impermanence.directories = lib.mkMerge [
+      (lib.mkIf cfg.storagebox.enable [
+        "/var/cache/restic-backups-storagebox"
+
+        # Generate the base systemd.mount from impermanence (we will override this, so it
+        # points to the non-admin one instead)
+        "/var/cache/restic-backups-storagebox-admin"
+      ])
+      (lib.mkIf cfg.local.enable [
+        "/var/cache/restic-backups-local"
+      ])
+    ];
+
+    # TODO: Make this work (`systemd.mounts` is a list, so _this_ doesn't work.) <2026-07-07>
+    # systemd.mounts."/var/cache/restic-backups-storagebox-admin" = {
+    #   # TODO: Don't hardcode the path, but use
+    #   # `systemd.mounts."/var/cache/restic-backups-storagebox".what` instead <2026-07-07>
+    #   what = "/srv/var/cache/restic-backups-storagebox";
+    # };
+
     age.secrets = {
       resticStorageboxSshKey = lib.mkIf cfg.storagebox.enable {
         file = cfg.storagebox.sshKey;
@@ -85,6 +108,8 @@ in {
       };
     };
 
+    programs.fuse.enable = cfg.storagebox.enable || cfg.local.enable;
+
     systemd.services = {
       prepare-backup = {
         requires = [];
@@ -142,16 +167,21 @@ in {
       ];
       exclude = [
         "${homeDir}/soispha/.cache"
+        "${homeDir}/soispha/.local/share/lutris/install"
+        "${homeDir}/soispha/.local/share/Steam/steamapps/common"
       ];
       extraBackupArgs = [
+        # Don't scan the filesystem to determine an estimate.
+        "--no-scan"
         "--verbose=2"
       ];
+      environmentFile = "${./env.vars}";
     in {
       local = lib.mkIf cfg.local.enable {
         inhibitsSleep = true;
         initialize = true;
 
-        inherit paths exclude extraBackupArgs;
+        inherit paths exclude extraBackupArgs environmentFile;
 
         passwordFile = config.age.secrets.resticLocalRepositoryPassword.path;
 
@@ -165,7 +195,7 @@ in {
         inhibitsSleep = true;
         initialize = true;
 
-        inherit paths exclude extraBackupArgs;
+        inherit paths exclude extraBackupArgs environmentFile;
 
         passwordFile = config.age.secrets.resticStorageboxRepositoryPassword.path;
         extraOptions = [
@@ -174,7 +204,7 @@ in {
 
         # This setting is normally passed to rclone, but we force
         # the command on the remote.
-        # As such, the value does not matter and must only be parseable by restic.
+        # As such, the value does not matter and must only be parse-able by restic.
         repository = "rclone: ";
 
         timerConfig = {
@@ -187,9 +217,13 @@ in {
 
       # This is only for listing, pruning and such stuff.
       storagebox-admin = lib.mkIf cfg.storagebox.enable {
-        inhibitsSleep = false;
+        inhibitsSleep = true;
+
+        # Don't create the repository if it doesn't exist yet.
         initialize = false;
 
+        inherit paths exclude extraBackupArgs environmentFile;
+
         passwordFile = config.age.secrets.resticStorageboxRepositoryPassword.path;
         extraOptions = [
           "rclone.program='ssh -p 23 ${cfg.storagebox.user}@${cfg.storagebox.user}.your-storagebox.de command_forced_on_remote'"
@@ -197,7 +231,7 @@ in {
 
         # This setting is normally passed to rclone, but we force
         # the command on the remote.
-        # As such, the value does not matter and must only be parseable by restic.
+        # As such, the value does not matter and must only be parse-able by restic.
         repository = "rclone: ";
 
         timerConfig = null;