From 1d592f3943230a0550293d124c1c3c7517108d24 Mon Sep 17 00:00:00 2001
From: Benedikt Peetz <benedikt.peetz@b-peetz.de>
Date: Tue, 7 Jul 2026 02:34:09 +0200
Subject: modules/backup: Don't pass command line arguments as options

---
 modules/by-name/ba/backup/env.vars   |  1 +
 modules/by-name/ba/backup/module.nix | 27 ++++++++++-----------------
 2 files changed, 11 insertions(+), 17 deletions(-)
 create mode 100644 modules/by-name/ba/backup/env.vars

diff --git a/modules/by-name/ba/backup/env.vars b/modules/by-name/ba/backup/env.vars
new file mode 100644
index 00000000..339c5a5b
--- /dev/null
+++ b/modules/by-name/ba/backup/env.vars
@@ -0,0 +1 @@
+RESTIC_COMPRESSION=max
diff --git a/modules/by-name/ba/backup/module.nix b/modules/by-name/ba/backup/module.nix
index eab1281b..031445cf 100644
--- a/modules/by-name/ba/backup/module.nix
+++ b/modules/by-name/ba/backup/module.nix
@@ -173,20 +173,17 @@ in {
       extraBackupArgs = [
         # Don't scan the filesystem to determine an estimate.
         "--no-scan"
-      ];
-      defaultExtraOptions = [
-        "--compression=max"
         "--verbose=2"
       ];
+      environmentFile = "${./env.vars}";
     in {
       local = lib.mkIf cfg.local.enable {
         inhibitsSleep = true;
         initialize = true;
 
-        inherit paths exclude extraBackupArgs;
+        inherit paths exclude extraBackupArgs environmentFile;
 
         passwordFile = config.age.secrets.resticLocalRepositoryPassword.path;
-        extraOptions = defaultExtraOptions;
 
         repository = "${cfg.local.backupMountPoint}/restic-backup-data/";
 
@@ -198,14 +195,12 @@ in {
         inhibitsSleep = true;
         initialize = true;
 
-        inherit paths exclude extraBackupArgs;
+        inherit paths exclude extraBackupArgs environmentFile;
 
         passwordFile = config.age.secrets.resticStorageboxRepositoryPassword.path;
-        extraOptions =
-          defaultExtraOptions
-          ++ [
-            "rclone.program='ssh -p 23 ${cfg.storagebox.user}@${cfg.storagebox.user}.your-storagebox.de -i ${config.age.secrets.resticStorageboxSshKey.path} command_forced_on_remote'"
-          ];
+        extraOptions = [
+          "rclone.program='ssh -p 23 ${cfg.storagebox.user}@${cfg.storagebox.user}.your-storagebox.de -i ${config.age.secrets.resticStorageboxSshKey.path} command_forced_on_remote'"
+        ];
 
         # This setting is normally passed to rclone, but we force
         # the command on the remote.
@@ -227,14 +222,12 @@ in {
         # Don't create the repository if it doesn't exist yet.
         initialize = false;
 
-        inherit paths exclude extraBackupArgs;
+        inherit paths exclude extraBackupArgs environmentFile;
 
         passwordFile = config.age.secrets.resticStorageboxRepositoryPassword.path;
-        extraOptions =
-          defaultExtraOptions
-          ++ [
-            "rclone.program='ssh -p 23 ${cfg.storagebox.user}@${cfg.storagebox.user}.your-storagebox.de command_forced_on_remote'"
-          ];
+        extraOptions = [
+          "rclone.program='ssh -p 23 ${cfg.storagebox.user}@${cfg.storagebox.user}.your-storagebox.de command_forced_on_remote'"
+        ];
 
         # This setting is normally passed to rclone, but we force
         # the command on the remote.
-- 
cgit v1.3.1