backwards: Backup sync to cloud with restic

hosts/backwards/modules/restic/default.nix

@@ -21,11 +21,31 @@ in
         "sync-to-external" = {
           initialize = true;
 
-          user = "alex";
           passwordFile = config.age.secrets.restic-password.path;
 
           paths = [ "/home/alex/sync" ];
-          repository = "/home/alex/backup";
+          repository = "/home/alex/backup/restic";
+
+          timerConfig = {
+            OnCalendar = "*-*-* 0/12:00:00"; # Every 12th hour, i.e. twice a day
+            Persistent = true;
+          };
+
+          pruneOpts = [
+            "--keep-daily 1"
+            "--keep-weekly 7"
+            "--keep-yearly 12"
+          ];
+        };
+
+        "sync-to-cloud" = {
+          initialize = true;
+
+          passwordFile = config.age.secrets.restic-password.path;
+          environmentFile = config.age.secrets.restic-cloud-sync-key.path;
+          repositoryFile = config.age.secrets.restic-cloud-sync-repository.path;
+
+          paths = ["/home/alex/sync"];
 
           timerConfig = {
             OnCalendar = "*-*-* 0/12:00:00"; # Every 12th hour, i.e. twice a day
@@ -44,6 +64,8 @@ in
     age = {
       secrets = {
         "restic-password".file = ../../../../secrets/backwards/restic-password.age;
+        "restic-cloud-sync-key".file = ../../../../secrets/backwards/restic-cloud-sync-key.age;
+        "restic-cloud-sync-repository".file = ../../../../secrets/backwards/restic-cloud-sync-repository.age;
       };
     };
   };

secrets/backwards/restic-cloud-sync-key.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 Pu0HWg rTAkGJbth0WCE8KM50fHaCyXeO/NrmWXiDT/JH9ciAI
+kTMVbJRwOSh9Da1O9YYx21/7IdfZrb2OhoOJxNEIKSg
+-> ssh-ed25519 +oNaHQ DtMpPTuAjS1GyK2WalNJzErEE1mCos/R5aZyMnun+UQ
+B81FnJ5z70HzI6yvqiy6Lhr2X9ZjEi5dhM6u47flujA
+--- r9HCFWVU5LBiRBdRwOA1+IRBY1/I/1UeukGtFz7BxWE
+TÔK%£žWÔ*&˜Ä°–-&àÛÕ8)|×áॣù Œ¯è07—<>µ¾ªŒúÍòl»ÁQò0†ÒßÔ––ÆÂ]¬¬Û¸”mP”^~ç/þ#†šõæ"ëÀš+ž)ÕY¾n¼@ã჌R§“¨_pÓÂFÜÛ%᤼#

secrets/backwards/restic-cloud-sync-repository.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 Pu0HWg tZ6zAXOBdiWyyUeOZZ66w1ij8xuHY98fvClPn8/jQVs
+AVp3Y04vSbnkurqjAouiDojd5IMFVCYyldXv0v4n9W4
+-> ssh-ed25519 +oNaHQ KK44MdrfQLZK44eYWpLiTFm3d/bx6WTsHm98MkvhQTw
+CYJJWbpHbLQHvzTWLbujg1AZ3KvgCshVUrolPE1hUho
+--- aBOxH3rbMriVBctdVGdQXFH/KYWLbweGzda5sN4HJOA
+íNo´Ç¡O>š‡æãõ\IÉ#
0¬‰õ+Y8ƒvàCS#é<>O›žÖeGè;-T“d®<64>,V@3” 䛸þ]`Ç\b²Dõ+„ö6½öšð䘤nŠ%‡NÈ’

secrets/backwards/restic-password.age

@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 Pu0HWg qnig6bOOnHbsTQ7AJfS0l6TUT7gPM3VreutamO5NfCs
-ZBX0HcsOKq2QrGRCJygwol/T2NWyvxGbqYpb5mfl5FQ
--> ssh-ed25519 +oNaHQ SgIEVphkOUqNzvPkoAQDS6wvDiHvcSNCLj46Qf1Lqyo
-HisQ0xxj1Qz79rmFdt0jda8D4hDWE+/d6zuA17fLsgk
---- UabMTXlGzIEj1guev4NyFyoXvP41i7oN1TMDKo517zs
-}†pÎ)Öâ¿«êöûBô¦®ô÷TØx¨r0ò÷7#•y¦2Ô¤ÑÅ;Z.&Ä]!•Âe(ßÓqvPQë<51> ?YÙy<C399>$?§¹X£2û™Ý€-&óA
+-> ssh-ed25519 Pu0HWg qmcWFPndrhXlpjBtSsVNARAOHM9UNtfcEvtSGx/BLHY
+EdnzUWju9g61idxWmDaaxSZ6ZiVvhFLOKH3hY1Kyk8s
+-> ssh-ed25519 +oNaHQ CMBvVWHwVsY89rbdYvVoVeoZlIXLJoIN8xsoqqBnSiA
++xogVU/MBezQzq1rbIOqT5PGNYqM8o0Pmojk2npqT4U
+--- mdhPf3weI9cOcaAh9j/CVB+KRfPSRuT678oueeJjdCk
+ZñmݹÿÅÓº*ˆŒ9kÀw¶N¯Zh&ÈGô

secrets/secrets.nix

@@ -35,7 +35,9 @@ in {
   "backwards/root.backwards.pub.age".publicKeys = [ backwards alex ];
   "backwards/syncthing-cert.age".publicKeys = [ backwards alex ];
   "backwards/syncthing-key.age".publicKeys = [ backwards alex ];
-  "backwards/restic-password.age".publicKeys = [ backwards alex ];
+  "backwards/restic-sync-password.age".publicKeys = [ backwards alex ];
+  "backwards/restic-cloud-sync-key.age".publicKeys = [ backwards alex ];
+  "backwards/restic-cloud-sync-repository.age".publicKeys = [ backwards alex ];
   "backwards/alex.backwards-codeberg.org.age".publicKeys = [ backwards alex ];
   "backwards/alex.backwards-codeberg.org.pub.age".publicKeys = [ backwards alex ];
   "backwards/wpa_supplicant.conf.age".publicKeys = [ backwards alex ];