improved backups + local dns instead of cloudflare

modules/system/backups.nix

@@ -1,20 +1,32 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}: {
+{pkgs, config, ...}: {
+  programs.ssh.extraConfig = ''
+    Host truenas
+      HostName storage.local
+      User restic
+      IdentityFile ${config.age.secrets.truenas-ssh.path}
+      StrictHostKeyChecking no
+      UserKnownHostsFile /dev/null
+  '';
+
   services.restic.backups.hermes = {
     initialize = true;
 
-    repository = "/mnt/backups/";
+    # Set the  repo
+    repositoryFile = config.age.secrets.repo.path;
 
+    # Restic password
     passwordFile = config.age.secrets.restic.path;
 
     paths = [
       "/var/lib"
     ];
 
+    exclude = [
+      "/var/lib/gitea-runner"
+      "/var/lib/containers"
+      "/var/lib/systemd/coredump"
+    ];
+
     timerConfig = {
       OnCalendar = "daily";
       RandomizedDelaySec = "1h";
@@ -27,7 +39,30 @@
     ];
   };
 
-  age.secrets.restic = {
-    file = ../../secrets/restic.age;
+  environment.systemPackages = [
+    (pkgs.writeShellScriptBin "restic-hermes" ''
+      exec ${pkgs.restic}/bin/restic \
+        -r "sftp:restic@storage.local:/mnt/data_pool/infra/backups" \
+        --password-file "${config.age.secrets.restic.path}" \
+        -o "sftp.command=ssh restic@storage.local -i ${config.age.secrets.truenas-ssh.path} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -s sftp" \
+        "$@"
+    '')
+  ];
+
+  # Secrets configuration
+  age.secrets = {
+    restic = {
+      file = ../../secrets/restic.age;
+      owner = "root";
+    };
+    repo = {
+      file = ../../secrets/restic-repo.age;
+      owner = "root";
+    };
+    truenas-ssh = {
+      file = ../../secrets/truenas-ssh.age;
+      owner = "root";
+      mode = "0400";
+    };
   };
 }