brackets

nixos/hosts/gandalf/default.nix

@@ -93,7 +93,7 @@ in
       #   repo = "ssh://t3zvn0dd@t3zvn0dd.repo.borgbase.com/./repo";
       #   repoKeyPath = "/run/secrets/borgbackup/telchar";
       # };
-
+    };
     services = {
       podman.enable = true;
       libvirt-qemu.enable = true;
@@ -115,4 +115,4 @@ in
       };
     };
   };
-  }
+}

nixos/modules/nixos/system/borg/default.nix

@@ -0,0 +1,44 @@
+{ lib, config, ... }:
+let
+  cfg = config.mySystem.system.borgbackup;
+in
+{
+  options.mySystem.system.borgbackup = {
+    enable = lib.mkEnableOption "borgbackup";
+    paths = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      required = true;
+    };
+    exclude = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      required = false;
+    };
+    repo = lib.mkOption {
+      example = "borgbackup@myserver:repo";
+      type = lib.types.str;
+      default = "";
+      required = true;
+    };
+    repoKeyPath = lib.mkOption {
+      example = "/run/secrets/borgbackup/telchar";
+      type = lib.types.str;
+      default = "";
+      required = false;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.borgbackup.jobs."borgbackup" = {
+      paths = cfg.paths;
+      exclude = cfg.exclude;
+      repo = cfg.repo;
+      encryption = {
+        mode = "repokey-blake2";
+        passCommand = "cat ${cfg.repoKeyPath}";
+      };
+      environment.BORG_RSH = "ssh -i /etc/ssh/ssh_host_ed25519_key";
+    };
+  };
+}

nixos/modules/nixos/system/default.nix

@@ -1,5 +1,6 @@
 {
   imports = [
+    ./borg
     ./impermanence.nix
     ./motd
     ./nix.nix