From 492bd530d3ddb4ecc4e3755cbfab2211d4bd49c2 Mon Sep 17 00:00:00 2001
From: Felix Albrigtsen <felix@albrigtsen.it>
Date: Sat, 18 Oct 2025 23:46:32 +0200
Subject: [PATCH] challenger/backup: add hostBackups

---
 hosts/challenger/backup.nix        | 17 ++++++++++++++---
 secrets/challenger/challenger.yaml | 13 +++++++------
 2 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/hosts/challenger/backup.nix b/hosts/challenger/backup.nix
index 8315706..e318282 100644
--- a/hosts/challenger/backup.nix
+++ b/hosts/challenger/backup.nix
@@ -33,13 +33,22 @@
       "/var/lib/calibre-server"
     ];
 
+    # Other system backups (NB: Large!)
+    hostBackups = localJob "hostBackups" [
+      "/tank/backup"
+    ] // {
+      pruneOpts = [ "--keep-monthly 12" ];
+    };
+
     media = localJob "media" [
-      "/tank/media/music"
       "/tank/media/books"
+      "/tank/media/komga"
+      "/tank/media/music"
     ];
     media-remote = cloudJob "media" [
-      "/tank/media/music"
       "/tank/media/books"
+      "/tank/media/komga"
+      "/tank/media/music"
     ] // {
       pruneOpts = [ "--keep-monthly 12" ];
     };
@@ -48,6 +57,7 @@
     nextcloud = localJob "nextcloud" [ "/tank/nextcloud" ];
     nextcloud-remote = cloudJob "nextcloud" [ "/tank/nextcloud" ];
 
+    # Postgresql databases
     postgres = (localJob "postgres" [ "/var/backup/postgres" ]) // {
       timerConfig.OnCalendar = "05:15"; # 2h after postgresqlBackup
     };
@@ -58,10 +68,11 @@
     # Transmission metadata/config
     transmission = localJob "transmission" [ "/var/lib/transmission" ];
 
-    # TODO: timemachine, komga
+    # TODO: timemachine
   };
 
   sops.secrets."restic/calibre" = { };
+  sops.secrets."restic/hostBackups" = { };
   sops.secrets."restic/media" = { };
   sops.secrets."restic/nextcloud" = { };
   sops.secrets."restic/postgres" = { };
diff --git a/secrets/challenger/challenger.yaml b/secrets/challenger/challenger.yaml
index e5a18c4..5629fde 100644
--- a/secrets/challenger/challenger.yaml
+++ b/secrets/challenger/challenger.yaml
@@ -4,11 +4,12 @@ nextcloud:
     adminpass: ENC[AES256_GCM,data:DL5SnyPPUxiVjfIHZ/ZYJi2pNu6x,iv:/bThFVYgHsN3Yr2EJf0+YWhAVIei9ENaHfAH1ADC5Ws=,tag:bNp+2trtwFNYOqruvqPRGw==,type:str]
     secretsjson: ENC[AES256_GCM,data:xmdwWBe8LWsSEI64KhSeXbA1B0ahfoGwNmgl33JWteF4AakdI73zfbdIhUBqqlqfbL0uCGlqCiOyRA02h8197mk=,iv:ncKz9ObwoFoVjT0qMzBJ0BqVBNx0ScdMRl82ZNQp4FI=,tag:6S8fqHhvE/gaknxsb+q3Jg==,type:str]
 restic:
-    transmission: ENC[AES256_GCM,data:UUf8/WV7Q7vbs05lEeqflcSj0uH9abilFF1daATyrwU=,iv:WQZ7hGRQ3/3t34aO7K5Az1AOZtR6qG4p1CqZTdsEqZA=,tag:2ELh2bYVi1sgW66FbSnVHg==,type:str]
-    postgres: ENC[AES256_GCM,data:AZv28LIbGC2oAKjbU1H4gaCZF28utJJFXlKNO/BkL0U=,iv:xOJCIoFGtnEqV80rmiBBMa3dMZnPjaDIce+MAZkGZdo=,tag:dLTwE004KGfP3z9EoMVCCw==,type:str]
-    nextcloud: ENC[AES256_GCM,data:O7qT07ns9FodnZu63cPwBqHGslfMIafFvyPPrTrYEdk=,iv:fJ7A5gLThuVumnteL1P82Gq1EtiSAPGXoCZgzJKqVQs=,tag:Hp/kI3TeZQCaM+gP1W1i7w==,type:str]
     calibre: ENC[AES256_GCM,data:wAvhB303cUm0rJKwQ31pd8lYHJSlOzBW8BiCygF3JC8=,iv:kUFEiP8sTcaiAIW4QZ7ZfA4aqjJsIIA5mq+gVzgryaU=,tag:STHLWF+T4XeQIDSt4F63Lw==,type:str]
+    hostBackups: ENC[AES256_GCM,data:lUK1oi+efynRbweO7sg6ayr3LI3G4aXyx5s4n+rtw3A=,iv:oPZLmCXh2G0xnFrmOokx8yixbRSwlmz5NY1s9pJGDgs=,tag:imKUkCfPGeOjRh6reODG7g==,type:str]
     media: ENC[AES256_GCM,data:JwIX2r/ebE+LMS49s1xqbRjA8yfMRDEAnln5eN57L4o=,iv:zqxeEv7ogujMqBPZnRF7STDjVlKqMa1rGLjMY5iusgU=,tag:O9PofkyovSYH7qlX6r97DQ==,type:str]
+    nextcloud: ENC[AES256_GCM,data:O7qT07ns9FodnZu63cPwBqHGslfMIafFvyPPrTrYEdk=,iv:fJ7A5gLThuVumnteL1P82Gq1EtiSAPGXoCZgzJKqVQs=,tag:Hp/kI3TeZQCaM+gP1W1i7w==,type:str]
+    postgres: ENC[AES256_GCM,data:AZv28LIbGC2oAKjbU1H4gaCZF28utJJFXlKNO/BkL0U=,iv:xOJCIoFGtnEqV80rmiBBMa3dMZnPjaDIce+MAZkGZdo=,tag:dLTwE004KGfP3z9EoMVCCw==,type:str]
+    transmission: ENC[AES256_GCM,data:UUf8/WV7Q7vbs05lEeqflcSj0uH9abilFF1daATyrwU=,iv:WQZ7hGRQ3/3t34aO7K5Az1AOZtR6qG4p1CqZTdsEqZA=,tag:2ELh2bYVi1sgW66FbSnVHg==,type:str]
 sops:
     age:
         - recipient: age1j43eqpnq5hy6zt3gmdtzdnne2yfvccd832kpt69qavst44leec6sj2l773
@@ -38,7 +39,7 @@ sops:
             QUFVam5VSkxLVmhsdU02eWtoWmdoeG8KXnixIU8SaD1DCe9Z1doBdwGs1sqv5k8W
             WLNGcfKXW4sMU712nYSz05SVl99sCJSzUMJFEQWjdVAaR9TRO6Qz8w==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-07-30T21:51:23Z"
-    mac: ENC[AES256_GCM,data:oVHx7fjXjqBVVPSP6Ei7BnOuRieaIpJNjTKbeP2tU7PDB7quhngEgb7K07dJvpAz7MB7dIkLx5e5oL408zy4xMHBHdTst4Qbzpieh0FmJ9LfueQs37IO2OaVL7HcWf4cTF1sV4o2CldGQoL/724s9kOB1wDGVz9/KDGCR/X2gSI=,iv:UP1k9GJ3oRqzNZxwEosaeIrncpE0Om4tI1YqLvLvweI=,tag:Ys/nMJ28Y3IbySiKj/qqHw==,type:str]
+    lastmodified: "2025-10-18T21:43:12Z"
+    mac: ENC[AES256_GCM,data:Bt5CrMY2Etl3iSZRVl58PN1ogYpLn3eXhuVCB0j4MKMphyLVJP1qxiQimpa5wriycJKqwBwvCDzJ7pLTxpHDOZaG6R3YfNYPEZlLAIiyOjZvF1ZBTbnF7cFp0thDuzPoFlEHeTFmY6Pe5GwXmSeUFo4ijghvbsFQ5IYXfWNoYz0=,iv:NCwLoI9g7poYbCME0/fUOZegMNOhc3ZvGpAhYoVeLMc=,tag:fiops2KveC/u3Nrmrftk/Q==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.11.0