add borg

modules/system/backups.nix

@@ -0,0 +1,75 @@
+{ config, lib, pkgs, ... }:
+
+let
+  borg = "${pkgs.borgbackup}/bin/borg";
+  backup_paths = lib.unique config.modules.system.backups.paths;
+  passwd_file = config.sops.secrets."borg_passwd".path;
+in
+{
+  options.modules.system.backups = {
+    paths = lib.mkOption {
+      type = lib.types.listOf lib.types.path;
+      default = [];
+      description = "list of directories to back up";
+    };
+    repo = lib.mkOption {
+      type = lib.types.path;
+      default = "/backups";
+      description = "borg repository path";
+    };
+    passphraseFile = lib.mkOption {
+      type = lib.types.path;
+      default = passwd_file;
+      description = "borg repository passphrase file";
+    };
+  };
+
+  config = lib.mkIf (backup_paths != []) {
+    systemd.services.borg-backup = {
+      description = "BorgBackup service for system data";
+      serviceConfig = {
+        Type = "oneshot";
+        EnvironmentFile = config.modules.system.backups.passphraseFile;
+      };
+      script = ''
+        set -eux
+        export BORG_REPO=${config.modules.system.backups.repo}
+        export BORG_PASSPHRASE="$(cat ${config.modules.system.backups.passphraseFile})"
+
+        # Initialize repo if it doesn’t exist
+        if ! ${borg} info "${repo}" >/dev/null 2>&1; then
+          echo "Initializing new Borg repository at ${repo}"
+          ${borg} init --encryption=repokey "${repo}"
+        fi
+
+        timestamp=$(date +%Y-%m-%d_%H-%M-%S)
+
+        ${borg} create \
+          --stats \
+          --compression zstd,3 \
+          ::${timestamp} \
+          ${lib.concatStringsSep " " backup_paths}
+
+        # Retention policy
+        ${borg} prune -v --list \
+          --keep-daily=7 \
+          --keep-weekly=52 \
+          --keep-monthly=-1
+      '';
+    };
+
+    systemd.timers.borg-backup = {
+      description = "daily borg backup timer";
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnCalendar = "daily";
+        Persistent = true;
+      };
+    };
+
+    environment.systemPackages = [ pkgs.borgbackup ];
+  };
+}
+
+# add to module
+# modules.system.backups.paths = lib.mkIf cfg.backups [ <path> ];