M flake.nix → flake.nix

@@ -71,6 +71,7 @@ ./profiles/onyx/hardware-configuration.nix
             ./profiles/onyx/base.nix
             ./profiles/onyx/nvidia.nix
             ./profiles/onyx/hyper-v.nix
+            ./profiles/onyx/borg.nix
           ];
         };
       };

A profiles/onyx/borg.nix

@@ -0,0 +1,19 @@
+{ ... }: {
+  services.borgbackup.jobs.onyx = {
+    paths = [
+      "/home/charlotte/.ssh/id_ed25519"
+      "/home/charlotte/.ssh/id_ed25519.pub"
+    ];
+    repo = "borg@runestone.bunny-hops.ts.net:~/onyx";
+    encryption = {
+      mode = "keyfile";
+      passCommand = "cat /x/secrets/borg_password";
+    };
+    startAt = "daily";
+    prune.keep = {
+      daily = 7;
+      weekly = 4;
+      monthly = 6;
+    };
+  };
+}

M profiles/onyx/hyper-v.nix → profiles/onyx/hyper-v.nix

@@ -1,6 +1,8 @@
 { ... }: {
   boot.initrd.availableKernelModules = [ "hv_vmbus" "hv_storvsc" ];
 
+  # since tailscale tries to use the TPM and we're sharing the same install
+  # between Hyper-V and bare metal, we have to turn encryption off for tailscaled to work:
   systemd.services.tailscaled.environment = {
     TS_ENCRYPT_STATE = "false";
   };

M profiles/runestone/base.nix → profiles/runestone/base.nix

@@ -62,6 +62,7 @@ isSystemUser = true;
     group = "borg";
     description = "borg backup user";
     home = "/home/borg";
+    shell = pkgs.bash;
   };
   users.groups.borg = {};