agenix

host/roam/backup.nix

@@ -0,0 +1,41 @@
+{
+  config,
+  pkgs,
+  secrets,
+  var,
+  ...
+}:
+{
+  age.secrets.roam-rclone-conf = {
+    file = secrets.roam."rclone-conf.age";
+    mode = "440";
+    owner = "root";
+    group = "root";
+  };
+
+  systemd = {
+    timers."backup-rclone" = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnCalendar = "daily";
+        Persistent = true;
+        Unit = "backup-rclone.service";
+      };
+    };
+    services."backup-rclone" =
+      let
+        conf = config.age.secrets.roam-rclone-conf.path;
+      in
+      {
+        script = ''
+          ${pkgs.rclone}/bin/rclone --config ${conf} copy /home/hd/Documents odc:Documents
+          ${pkgs.rclone}/bin/rclone --config ${conf} copy /git odc:git
+        '';
+        path = [ pkgs.rclone ];
+        serviceConfig = {
+          Type = "oneshot";
+          User = "root";
+        };
+      };
+  };
+}

host/roam/default.nix

@@ -2,7 +2,12 @@
 {
   networking.hostName = "roam";
 
+  age.identityPaths = [
+    "/root/.ssh/id_ed25519"
+  ];
+
   imports = [
+    ./backup.nix
     ./git.nix
     ./hardware-configuration.nix
     ./networking.nix

host/roam/git.nix

@@ -8,6 +8,6 @@
     createHome = true;
     group = "git";
     shell = "${pkgs.git}/bin/git-shell";
-    openssh.authorizedKeys.keys = var.ssh-keys.unprivileged;
+    openssh.authorizedKeys.keys = var.ssh-keys.hd;
   };
 }

host/roam/services.nix

@@ -1,7 +1,5 @@
 {
   var,
-  config,
-  pkgs,
   ...
 }:
 {
@@ -36,26 +34,4 @@
       443
     ];
   };
-
-  systemd = {
-    timers."backup-rclone" = {
-      wantedBy = [ "timers.target" ];
-      timerConfig = {
-        OnCalendar = "daily";
-        Persistent = true;
-        Unit = "backup-rclone.service";
-      };
-    };
-    services."backup-rclone" = {
-      script = ''
-        ${pkgs.rclone}/bin/rclone copy /home/hd/Documents odc:Documents
-        ${pkgs.rclone}/bin/rclone copy /git odc:git
-      '';
-      path = [ pkgs.rclone ];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-      };
-    };
-  };
 }