Rename modules directory system to nixos

modules/nixos/services/restic/backups.nix

@@ -0,0 +1,112 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  backups =
+    config.custom.services.restic.backups |> lib.attrValues |> lib.filter (backup: backup.enable);
+in
+{
+  options.custom.services.restic.backups = lib.mkOption {
+    type = lib.types.attrsOf (
+      lib.types.submodule (
+        { name, ... }:
+        {
+          options = {
+            enable = lib.mkEnableOption "" // {
+              default = true;
+            };
+            name = lib.mkOption {
+              type = lib.types.nonEmptyStr;
+              default = name;
+            };
+            conflictingService = lib.mkOption {
+              type = lib.types.nullOr lib.types.nonEmptyStr;
+              default = null;
+            };
+            paths = lib.mkOption {
+              type = lib.types.listOf lib.types.path;
+              default = [ ];
+            };
+            extraConfig = lib.mkOption {
+              type = lib.types.attrsOf lib.types.anything;
+              default = { };
+            };
+          };
+        }
+      )
+    );
+    default = { };
+  };
+
+  config = lib.mkIf (backups != [ ]) {
+    sops = {
+      secrets = {
+        "backblaze/key-id" = { };
+        "backblaze/application-key" = { };
+        "restic/password" = { };
+      };
+
+      templates."restic/environment".content = ''
+        AWS_ACCESS_KEY_ID=${config.sops.placeholder."backblaze/key-id"}
+        AWS_SECRET_ACCESS_KEY=${config.sops.placeholder."backblaze/application-key"}
+      '';
+    };
+
+    systemd.tmpfiles.rules =
+      backups |> lib.map (backup: "d /var/cache/restic-backups-${backup.name} 700 - - -");
+
+    services.restic.backups =
+      backups
+      |> lib.map (backup: {
+        inherit (backup) name;
+        value = lib.mkMerge [
+          {
+            inherit (backup) paths;
+            initialize = true;
+            repository = "s3:https://s3.eu-central-003.backblazeb2.com/stork-atlas/${backup.name}";
+            environmentFile = config.sops.templates."restic/environment".path;
+            passwordFile = config.sops.secrets."restic/password".path;
+            pruneOpts = [
+              "--keep-daily 7"
+              "--keep-weekly 4"
+              "--keep-monthly 6"
+            ];
+            timerConfig = {
+              OnCalendar = "03:00";
+              RandomizedDelaySec = "1h";
+            };
+          }
+          backup.extraConfig
+        ];
+      })
+      |> lib.listToAttrs;
+
+    systemd.services =
+      backups
+      |> lib.filter (backup: backup.conflictingService != null)
+      |> lib.map (backup: {
+        name = "restic-backups-${backup.name}";
+        value = {
+          unitConfig.Conflicts = [ backup.conflictingService ];
+          after = [ backup.conflictingService ];
+          onSuccess = [ backup.conflictingService ];
+          onFailure = [ backup.conflictingService ];
+        };
+      })
+      |> lib.listToAttrs;
+
+    environment.systemPackages =
+      let
+        backupAllScript = pkgs.writeShellApplication {
+          name = "restic-backup-all";
+          text = "systemctl start restic-backups-{${
+            backups |> lib.map (backup: backup.name) |> lib.concatStringsSep ","
+          }}";
+        };
+      in
+      [ backupAllScript ];
+  };
+}

modules/nixos/services/restic/healthchecks.nix

@@ -0,0 +1,58 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  backupsWithHealthchecks =
+    config.custom.services.restic.backups
+    |> lib.attrValues
+    |> lib.filter (backup: backup.enable && backup.doHealthchecks);
+in
+{
+  options.custom.services.restic.backups = lib.mkOption {
+    type = lib.types.attrsOf (
+      lib.types.submodule {
+        options.doHealthchecks = lib.mkEnableOption "" // {
+          default = true;
+        };
+      }
+    );
+  };
+
+  config = lib.mkIf (backupsWithHealthchecks != [ ]) {
+    sops.secrets."healthchecks/ping-key" = { };
+
+    systemd.services = {
+      "healthcheck-ping@" = {
+        description = "Pings healthcheck (%i)";
+        serviceConfig.Type = "oneshot";
+        scriptArgs = "%i";
+        script = ''
+          ping_key="$(cat ${config.sops.secrets."healthchecks/ping-key".path})"
+          slug="$(echo "$1" | tr _ /)"
+
+          ${lib.getExe pkgs.curl} \
+            --fail \
+            --silent \
+            --show-error \
+            --max-time 10 \
+            --retry 5 "https://hc-ping.com/$ping_key/$slug?create=1"
+        '';
+      };
+    }
+    // (
+      backupsWithHealthchecks
+      |> lib.map (backup: {
+        name = "restic-backups-${backup.name}";
+        value = {
+          wants = [ "healthcheck-ping@${backup.name}-backup_start.service" ];
+          onSuccess = [ "healthcheck-ping@${backup.name}-backup.service" ];
+          onFailure = [ "healthcheck-ping@${backup.name}-backup_fail.service" ];
+        };
+      })
+      |> lib.listToAttrs
+    );
+  };
+}

modules/nixos/services/restic/restore.nix

@@ -0,0 +1,66 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  backupsWithRestoreCommand =
+    config.custom.services.restic.backups
+    |> lib.attrValues
+    |> lib.filter (backup: backup.enable && backup.restoreCommand.enable);
+in
+{
+  options.custom.services.restic.backups = lib.mkOption {
+    type = lib.types.attrsOf (
+      lib.types.submodule {
+        options.restoreCommand = {
+          enable = lib.mkEnableOption "" // {
+            default = true;
+          };
+          preRestore = lib.mkOption {
+            type = lib.types.str;
+            default = "";
+          };
+          postRestore = lib.mkOption {
+            type = lib.types.str;
+            default = "";
+          };
+        };
+      }
+    );
+  };
+
+  config = {
+    environment.systemPackages =
+      let
+        restoreScripts =
+          backupsWithRestoreCommand
+          |> lib.map (
+            backup:
+            let
+              inherit (backup) name conflictingService;
+              inherit (backup.restoreCommand) preRestore postRestore;
+              hasConflictingService = conflictingService != null;
+            in
+            pkgs.writeShellApplication {
+              name = "restic-restore-${name}";
+              text = ''
+                ${lib.optionalString hasConflictingService "systemctl stop ${conflictingService}"}
+                ${preRestore}
+                restic-${name} restore latest --target /
+                ${postRestore}
+                ${lib.optionalString hasConflictingService "systemctl start ${conflictingService}"}
+              '';
+            }
+          );
+
+        restoreAllScript = pkgs.writeShellApplication {
+          name = "restic-restore-all";
+          text =
+            backupsWithRestoreCommand |> lib.map (backup: "restic-restore-${backup.name}") |> lib.concatLines;
+        };
+      in
+      restoreScripts ++ [ restoreAllScript ];
+  };
+}