add sops-nix and borgbackup

hosts/controller/default.nix

@@ -1,5 +1,12 @@
-{pkgs, ...}: {
+{
+  pkgs,
+  inputs,
+  username,
+  config,
+  ...
+}: {
   imports = [
+    inputs.sops-nix.nixosModules.sops
     ./hardware-configuration.nix
     ../../modules/nixos/default.nix
     ../../modules/nixos/headscale.nix
@@ -11,6 +18,15 @@
     ../../modules/nixos/monitoring/promtail.nix
   ];
 
+  sops = {
+    age.keyFile = "/home/${username}/.config/sops/age/keys.txt";
+    secrets = {
+      borg_encryption_key = {
+        sopsFile = ./secrets.yaml;
+      };
+    };
+  };
+
   boot = {
     kernelPackages = pkgs.linuxPackages_zen;
     initrd.systemd.enable = true;
@@ -29,6 +45,26 @@
     sudo.wheelNeedsPassword = false;
   };
 
+  services = {
+    borgbackup.jobs.controller-backup = {
+      paths = [
+        "/var/lib/bitwarden_rs"
+        "/var/lib/gitea"
+        "/var/lib/headscale"
+        "/var/lib/grafana"
+        "/var/lib/loki"
+      ];
+      encryption = {
+        mode = "repokey-blake2";
+        passCommand = "cat ${config.sops.secrets.borg_encryption_key.path}";
+      };
+      environment.BORG_RSH = "ssh -i /home/${username}/.ssh/storagebox";
+      repo = "ssh://u416910@u416910.your-storagebox.de:23/./controller-backups";
+      compression = "auto,zstd";
+      startAt = "daily";
+    };
+  };
+
   programs = {
     zsh.enable = true;
     nix-ld = {

hosts/controller/secrets.yaml

@@ -0,0 +1,21 @@
+borg_encryption_key: ENC[AES256_GCM,data:42q7OYR5HLqLzbCx0WZwurND8DGUnCw3fA+4ccEmNp4=,iv:GRj9jXnlfqDoxr55hS97gjqLzIP7rjqoYtRHlU5/9Lo=,tag:ybr8V9RumsU94ja0bLnfNA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age14vktfes95f33vuefwnmuvryas7az04u76dsgyhfvsx73czkvmp2q7njkl4
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwSzNTUzdTYzNpT21DL3gy
+            bjhHcXFWQjI5c0lSRUEwZXR2UmxOeG5jMEI4Ckg1OWx3NzVOWjIzRWtCblp5K2RK
+            b21xL2tBWDFqRXI2ZTloR0xwZkhtclUKLS0tIHFaYzM1dWdyUC95UWlsQU1xWjNV
+            akhaWXdrbXI0TDNNMlppcGovbjNia1EKNomA6zlZmQKE1DtX6JlurBxEkG9aiwjn
+            RZd5a9XPH8F1XhQF1tcZS+m3hGY00V7Zwiqe68PiiYWpxzZ/sSeR5A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-08-02T22:42:23Z"
+    mac: ENC[AES256_GCM,data:C4ueRlhrqollpi6ZE+126idf2SiAd2GooO7CTWR49ACW/y4q50B8girPtuY7Pgig0y/U0rWIFHFwmOwXyJJ8A6YtzD0VzWhZN7Aeb7HGvu/0o4V5OPjH1ZdQ6bb8YyeMQ5RljnG7/Pa/QasFS6h0pv3jnkKYrCCkbxNmKk/DcLY=,iv:UXi8rBLkdgp/bCxIE+6PvgdPv6xJmKtQX/WUVmoKeKc=,tag:Fpo44OFp0CYVAwDFx5WbWQ==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.0