helm/profiles/backup/default.nix

{
  # Assumes the remote borg backup server has already been initialized
  # borg init --encryption-key=repokey-blake2 -rsh 'ssh -i /run/keys/id_ed25519_borgbase' 20779@hk-s020.rsync.net:<borg-archive>
  services.borgbackup.jobs = {
    backupTaskwarriorRsync = {
      paths = [ "/var/lib/taskserver" ];
      doInit = true;
      repo = "20779@hk-s020.rsync.net:taskwarrior";
      encryption = {
        mode = "repokey-blake2";
        passCommand = "cat /run/keys/rsync";
      };
      environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; };
      compression = "auto,lzma";
      startAt = "weekly";
      extraArgs = "--remote-path=borg1";
    };
  };
  services.borgbackup.jobs = {
    backupShaarliRsync = {
      paths = [ "/var/www/shaarli-config/data/datastore.php" "/var/www/shaarli-config/config" "/var/www/shaarli-config/.json.config" ];
      doInit = true;
      repo = "20779@hk-s020.rsync.net:shaarli";
      encryption = {
        mode = "repokey-blake2";
        passCommand = "cat /run/keys/rsync";
      };
      environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; };
      compression = "auto,lzma";
      startAt = "weekly";
      extraArgs = "--remote-path=borg1";
    };
  };
}