feat: enable restic backup service for vaultwarden and paperless

Signed-off-by: Chinmay D. Pai <chinmaydpai@gmail.com>

data.nix

@@ -16,6 +16,10 @@
       };
     };
     services = {
+      backups = {
+        environment.file = ./secrets/services/backups/environment.age;
+        password.file = ./secrets/services/backups/password.age;
+      };
       gitea = {
         password.file = ./secrets/services/gitea/password.age;
       };

modules/nixos/services/paperless/default.nix

@@ -63,5 +63,15 @@
           };
         };
       };
+
+      snowflake.services.backups.paperless.config = {
+        dynamicFilesFrom = let
+          path = config.services.paperless.dataDir;
+        in ''
+          mkdir -p ${path}/exported
+          ${path}/paperless-manage document_exporter ${path}/exported
+          echo ${path}/exported/
+        '';
+      };
     };
 }

modules/nixos/services/vaultwarden/default.nix

@@ -3,8 +3,7 @@
   lib,
   pkgs,
   ...
-}:
+}: {
-{
   options.snowflake.services.vaultwarden = {
     enable = lib.mkEnableOption "Enable vaultwarden service with postgres and nginx";
 
@@ -19,8 +18,10 @@
     };
   };
 
-  config =
+  # TODO: when upgrading stateVersion to 24.11, the data directory will
-    let
+  # change from /var/lib/bitwarden_rs to /var/lib/vaultwarden.
+  # We need to move the data and then change the backup service directory.
+  config = let
     cfg = config.snowflake.services.vaultwarden;
   in
     lib.mkIf cfg.enable {
@@ -75,5 +76,9 @@
           };
         };
       };
+
+      snowflake.services.backups.vaultwarden.paths = [
+        "/var/lib/bitwarden_rs"
+      ];
     };
 }

systems/x86_64-linux/bicboye/default.nix

@@ -121,6 +121,13 @@
     services = {
       arr.enable = true;
 
+      backups = {
+        enable = true;
+        repository = "b2:restic-nix";
+        resticPasswordFile = userdata.secrets.services.backups.password;
+        resticEnvironmentFile = userdata.secrets.services.backups.environment;
+      };
+
       gitea = {
         enable = true;
         domain = "git.deku.moe";