backwards: Backup sync to cloud with restic

hosts/backwards/modules/restic/default.nix

@@ -21,11 +21,31 @@ in
         "sync-to-external" = {
           initialize = true;
 
-          user = "alex";
           passwordFile = config.age.secrets.restic-password.path;
 
           paths = [ "/home/alex/sync" ];
-          repository = "/home/alex/backup";
+          repository = "/home/alex/backup/restic";
+
+          timerConfig = {
+            OnCalendar = "*-*-* 0/12:00:00"; # Every 12th hour, i.e. twice a day
+            Persistent = true;
+          };
+
+          pruneOpts = [
+            "--keep-daily 1"
+            "--keep-weekly 7"
+            "--keep-yearly 12"
+          ];
+        };
+
+        "sync-to-cloud" = {
+          initialize = true;
+
+          passwordFile = config.age.secrets.restic-password.path;
+          environmentFile = config.age.secrets.restic-cloud-sync-key.path;
+          repositoryFile = config.age.secrets.restic-cloud-sync-repository.path;
+
+          paths = ["/home/alex/sync"];
 
           timerConfig = {
             OnCalendar = "*-*-* 0/12:00:00"; # Every 12th hour, i.e. twice a day
@@ -44,6 +64,8 @@ in
     age = {
       secrets = {
         "restic-password".file = ../../../../secrets/backwards/restic-password.age;
+        "restic-cloud-sync-key".file = ../../../../secrets/backwards/restic-cloud-sync-key.age;
+        "restic-cloud-sync-repository".file = ../../../../secrets/backwards/restic-cloud-sync-repository.age;
       };
     };
   };

secrets/backwards/restic-cloud-sync-key.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 Pu0HWg rTAkGJbth0WCE8KM50fHaCyXeO/NrmWXiDT/JH9ciAI
+kTMVbJRwOSh9Da1O9YYx21/7IdfZrb2OhoOJxNEIKSg
+-> ssh-ed25519 +oNaHQ DtMpPTuAjS1GyK2WalNJzErEE1mCos/R5aZyMnun+UQ
+B81FnJ5z70HzI6yvqiy6Lhr2X9ZjEi5dhM6u47flujA
+--- r9HCFWVU5LBiRBdRwOA1+IRBY1/I/1UeukGtFz7BxWE
+T<1F>K%<25><>W<EFBFBD>*&<26>İ<19>-&<26><><EFBFBD>8)|<7C><><EFBFBD><EFBFBD><16><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>07<06><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>l<EFBFBD><6C>Q<03>0<EFBFBD><30><EFBFBD>Ԗ<EFBFBD><D496><EFBFBD>]<5D><>۸<>mP<6D>^~<7E>/<2F>#<23><><EFBFBD><EFBFBD>"<22><1A><19>+<15>)<29>Y<EFBFBD>n<6E>@<1B>჌R<E1838C><52><EFBFBD>_p<5F><70>F<EFBFBD><46>%<25><1E><18>#

secrets/backwards/restic-cloud-sync-repository.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 Pu0HWg tZ6zAXOBdiWyyUeOZZ66w1ij8xuHY98fvClPn8/jQVs
+AVp3Y04vSbnkurqjAouiDojd5IMFVCYyldXv0v4n9W4
+-> ssh-ed25519 +oNaHQ KK44MdrfQLZK44eYWpLiTFm3d/bx6WTsHm98MkvhQTw
+CYJJWbpHbLQHvzTWLbujg1AZ3KvgCshVUrolPE1hUho
+--- aBOxH3rbMriVBctdVGdQXFH/KYWLbweGzda5sN4HJOA
+<EFBFBD>No<EFBFBD>ǡO><3E><><EFBFBD><EFBFBD><EFBFBD>\I<>#
0<><30><EFBFBD>+Y8<59>v<76>CS#<23><>O<10><><EFBFBD>eG<65>;-T<>d<EFBFBD><64>,V@3<0E> <20><><1B><>]`<60>\b<>D<EFBFBD>+<2B><>6<EFBFBD><36><EFBFBD><EFBFBD>䘤n<E498A4>%<25>NȒ

secrets/backwards/restic-password.age

@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 Pu0HWg qnig6bOOnHbsTQ7AJfS0l6TUT7gPM3VreutamO5NfCs
-ZBX0HcsOKq2QrGRCJygwol/T2NWyvxGbqYpb5mfl5FQ
--> ssh-ed25519 +oNaHQ SgIEVphkOUqNzvPkoAQDS6wvDiHvcSNCLj46Qf1Lqyo
-HisQ0xxj1Qz79rmFdt0jda8D4hDWE+/d6zuA17fLsgk
---- UabMTXlGzIEj1guev4NyFyoXvP41i7oN1TMDKo517zs
-}<7D>p<EFBFBD>)<29>⿫<EFBFBD><E2BFAB><EFBFBD>B<EFBFBD><42><EFBFBD><EFBFBD><EFBFBD>T<1D>x<>r0<72><30>7#<23>y<EFBFBD>2Ԥ<32><D4A4>;Z.&<26>]!<21><>e(<28><>qvPQ돠?Y<>y<EFBFBD>$?<3F><>X<EFBFBD>2<EFBFBD><32>݀-&<26>A
+-> ssh-ed25519 Pu0HWg qmcWFPndrhXlpjBtSsVNARAOHM9UNtfcEvtSGx/BLHY
+EdnzUWju9g61idxWmDaaxSZ6ZiVvhFLOKH3hY1Kyk8s
+-> ssh-ed25519 +oNaHQ CMBvVWHwVsY89rbdYvVoVeoZlIXLJoIN8xsoqqBnSiA
++xogVU/MBezQzq1rbIOqT5PGNYqM8o0Pmojk2npqT4U
+--- mdhPf3weI9cOcaAh9j/CVB+KRfPSRuT678oueeJjdCk
+Z<EFBFBD>mݹ<EFBFBD><EFBFBD>Ӻ*<2A><>9k<39>w<EFBFBD>N<EFBFBD>Zh&<26>G<EFBFBD>

secrets/secrets.nix

@@ -35,7 +35,9 @@ in {
   "backwards/root.backwards.pub.age".publicKeys = [ backwards alex ];
   "backwards/syncthing-cert.age".publicKeys = [ backwards alex ];
   "backwards/syncthing-key.age".publicKeys = [ backwards alex ];
-  "backwards/restic-password.age".publicKeys = [ backwards alex ];
+  "backwards/restic-sync-password.age".publicKeys = [ backwards alex ];
+  "backwards/restic-cloud-sync-key.age".publicKeys = [ backwards alex ];
+  "backwards/restic-cloud-sync-repository.age".publicKeys = [ backwards alex ];
   "backwards/alex.backwards-codeberg.org.age".publicKeys = [ backwards alex ];
   "backwards/alex.backwards-codeberg.org.pub.age".publicKeys = [ backwards alex ];
   "backwards/wpa_supplicant.conf.age".publicKeys = [ backwards alex ];