nixos/applications/restic.nix

# nodes is all the nodes
{ lib, config, nodes, pkgs, ...}: with lib;
  let
    cfg = config.services.skynet_backup;


    # since they should all have the same config we can do this
    base = {
      paths           = cfg.normal.backups;
      exclude         = cfg.normal.exclude;
      initialize      = true;
      passwordFile    = config.age.secrets.restic.path;

      pruneOpts = [
        #"--keep-within 0y2m0d0h"
        #"--keep-monthly 2"
      ];

      timerConfig = {
        OnCalendar          = "daily";
        Persistent          = true;
        RandomizedDelaySec  = "5h";
      };
    };

    # takes nodes,
    # for each check if iut has teh abckup attribute,
    # then if the server is enabled,
    # then pull relevant dtails
    ownServers = builtins.listToAttrs (builtins.concatLists (
      lib.attrsets.mapAttrsToList (key: value:
        let
          backup = value.config.services.skynet_backup;
        in
        if (
          (builtins.hasAttr "skynet_backup" value.config.services)
          && backup.server.enable
          && backup.host.name != cfg.host.name
          && !backup.server.appendOnly
        )
        then [
          {
            name = backup.host.name;
            value = base // {
              repositoryFile = "/etc/skynet/restic/${backup.host.name}";

              backupPrepareCommand = ''
                #!${pkgs.stdenv.shell}
                set -euo pipefail

                baseDir="/etc/skynet/restic"

                mkdir -p $baseDir
                cd $baseDir

                echo -n "rest:http://root:password@${backup.host.ip}:${toString backup.server.port}/root/${cfg.host.name}" > ${backup.host.name}

                # read in teh password
                #PW = `cat ${config.age.secrets.restic.path}`
                line=$(head -n 1 ${config.age.secrets.restic.path})

                sed -i "s/password/$line/g" ${backup.host.name}
              '';

            };
          }
        ]
        else [ ]
      ) nodes
    ));



  in {

    imports = [

    ];

    # using https://github.com/greaka/ops/blob/818be4c4dea9129abe0f086d738df4cb0bb38288/apps/restic/options.nix as a base
    # https://git.hrnz.li/Ulli/nixos/src/commit/5edca2dfdab3ce52208e4dfd2b92951e500f8418/profiles/server/restic.nix
    # will eb enabled on every server
    options.services.skynet_backup = {
      # backup is enabled by default
      # enable = mkEnableOption "Skynet backup";

      # what folders to backup
      normal = {
        backups = lib.mkOption {
          default = [ ];
          type = lib.types.listOf lib.types.str;
          description = ''
            A list of paths to backup.
          '';
        };

        exclude = lib.mkOption {
          default = [ ];
          type = lib.types.listOf lib.types.str;
          description = ''
            A list of paths to exclide .
          '';
        };
      };

      # append only data so space limited
      secure = {
        backups = lib.mkOption {
          default = [ ];
          type = lib.types.listOf lib.types.str;
          description = ''
            A list of paths to backup.
          '';
        };

        exclude = lib.mkOption {
          default = [ ];
          type = lib.types.listOf lib.types.str;
          description = ''
            A list of paths to exclide .
          '';
        };
      };

      host = {
        ip = mkOption {
          type = types.str;
        };

        name = mkOption {
          type = types.str;
        };
      };

      server = {
        enable = mkEnableOption "Skynet backup Server";

        port = mkOption {
          type = types.port;
          default = 8765;
        };

        appendOnly = mkOption {
          type = types.bool;
          default = false;
        };
      };

    };


  config = {
    # these values are anabled for every client

    environment.systemPackages = [
      # for flakes
      pkgs.restic
    ];

    # A list of all login accounts. To create the password hashes, use
    # nix-shell -p apacheHttpd
    # htpasswd -nbB "" "password" | cut -d: -f2

    age.secrets.restic.file    = ../secrets/backup/restic.age;

    networking.firewall.allowedTCPPorts = [
      cfg.server.port
    ];

    services.restic.backups = ownServers // {
      # merge teh two configs together
#      backblaze = base // {
#        # backupos for each server are stored in a folder under their name
#        repository = "b2:NixOS-Main2:/${cfg.host.name}";
#        #environmentFile = config.age.secrets.backblaze.path;
#      };

    };

    age.secrets.restic_pw = mkIf cfg.server.enable {
      file = ../secrets/backup/restic_pw.age;
      path = "${config.services.restic.server.dataDir}/.htpasswd";
      symlink = false;
      mode = "770";
      owner = "restic";
      group = "restic";
    };

    services.restic.server = mkIf cfg.server.enable{
      enable = true;
      listenAddress = "${cfg.host.ip}:${toString cfg.server.port}";
      appendOnly = cfg.server.appendOnly;
      privateRepos = true;
    };


  };
}