# nixos-config - My current NixOS configuration
#
# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
# SPDX-License-Identifier: GPL-3.0-or-later
#
# This file is part of my nixos-config.
#
# You should have received a copy of the License along with this program.
# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
{
  lib,
  config,
  pkgs,
  ...
}: let
  cfg = config.soispha.services.backup;
in {
  options.soispha.services.backup = {
    enable = lib.mkEnableOption "backups via restic to a storagebox";

    user = lib.mkOption {
      type = lib.types.str;
      description = "The storagebox-user to use";
      example = "u384702-sub2";
    };
    privateSshKey = lib.mkOption {
      type = lib.types.path;
      description = "The age-encrypted ssh-key, passed to agenix";
    };
    privatePassword = lib.mkOption {
      type = lib.types.path;
      description = "The age-encrypted restic password, passed to agenix";
    };
  };

  config = lib.mkIf cfg.enable {
    age.secrets = {
      resticpass = {
        file = cfg.privatePassword;
        mode = "0700";
        owner = "root";
        group = "root";
      };
      resticssh = {
        file = cfg.privateSshKey;
        mode = "0700";
        owner = "root";
        group = "root";
      };
    };

    services.restic.backups = let
      snapshotDir = "/srv/last_snapshot";
      homeDir = "${snapshotDir}/home";
    in {
      storagebox = {
        initialize = true;
        backupPrepareCommand =
          # bash
          ''
            [ -d "${snapshotDir}" ] && ${lib.getExe' pkgs.btrfs-progs "btrfs"} subvolume delete "${snapshotDir}"

            # -r := Make the snapshot read-only
            ${lib.getExe' pkgs.btrfs-progs "btrfs"} subvolume snapshot -r /srv "${snapshotDir}";
          '';
        paths = [
          snapshotDir
        ];
        exclude = [
          "${homeDir}/soispha/.cache"
        ];
        extraBackupArgs = [
          "--verbose" # Spam log
        ];

        passwordFile = config.age.secrets.resticpass.path;
        extraOptions = [
          "rclone.program='ssh -p 23 ${cfg.user}@${cfg.user}.your-storagebox.de -i ${config.age.secrets.resticssh.path} command_forced_on_remote'"
        ];

        # This setting is normally passed to rclone, but we force
        # the command on the remote.
        # As such, the value does not matter and must only be parseable by restic.
        repository = "rclone: ";

        timerConfig = {
          Requires = "network-online.target";
          OnActiveSec = "30m";
          OnUnitInactiveSec = "2h";
          Persistent = true;
        };
      };
    };
  };
}