From bd964bad48edae4dab7ad47eda785c5e0d9fc041 Mon Sep 17 00:00:00 2001
From: strix <strix@saluco.nl>
Date: Fri, 28 Aug 2026 00:46:08 +0200
Subject: [PATCH] feat(backups): backups work

---
 devices/p14s/default.nix         | 12 ++++++--
 modules/backups/default.nix      | 49 ++++++++++++++++++++++++++++++++
 modules/networking/default.nix   |  5 +++-
 modules/networking/firewall.nix  |  7 +++++
 modules/networking/tailscale.nix | 13 +++++++++
 users/strix/home.nix             |  3 +-
 6 files changed, 83 insertions(+), 6 deletions(-)
 create mode 100644 modules/backups/default.nix
 create mode 100644 modules/networking/firewall.nix
 create mode 100644 modules/networking/tailscale.nix

diff --git a/devices/p14s/default.nix b/devices/p14s/default.nix
index eeb74d5..bbcf9ee 100644
--- a/devices/p14s/default.nix
+++ b/devices/p14s/default.nix
@@ -4,22 +4,28 @@
     ./hardware-configuration.nix
 
     ../../modules/boot
+    ../../modules/backups
     ../../modules/desktop
     ../../modules/develop
     ../../modules/networking
+    ../../modules/networking/tailscale.nix
     ../../modules/virtualisation
   ];
 
   networking.hostName = "p14s";
 
   # swap & hibernate
+  boot.initrd.luks.devices."luks-21284f67-5a63-41be-9354-07a0240cac50".crypttabExtraOpts = [
+    "fido2-device=auto"
+  ];
   boot.initrd.luks.devices."luks-d51bdb99-5966-40d3-a920-83ea78a73699" = {
     device = "/dev/disk/by-uuid/d51bdb99-5966-40d3-a920-83ea78a73699";
     crypttabExtraOpts = [ "tpm2-device=auto" ];
   };
-  boot.kernelParams = [ "resume=/dev/disk/by-uuid/d51bdb99-5966-40d3-a920-83ea78a73699" ];
-  
-  boot.initrd.checkJournalingFS = false; 
+  boot.kernelParams = [ "resume=/dev/mapper/luks-d51bdb99-5966-40d3-a920-83ea78a73699" ];
+  boot.resumeDevice = "/dev/mapper/luks-d51bdb99-5966-40d3-a920-83ea78a73699";
+
+  boot.initrd.checkJournalingFS = false;
 
   hardware.graphics = {
     enable = true;
diff --git a/modules/backups/default.nix b/modules/backups/default.nix
new file mode 100644
index 0000000..986ce31
--- /dev/null
+++ b/modules/backups/default.nix
@@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  programs.ssh.extraConfig = ''
+    Host nas01-backup
+      HostName 10.1.0.2
+      User _sa_backup
+      IdentityFile /etc/5335/id_backup_nas01
+      IdentitiesOnly yes
+      StrictHostKeyChecking accept-new
+  '';
+
+  services.restic.backups.system = {
+    initialize = true;
+    inhibitsSleep = true;
+    paths = [
+      "/etc"
+      "/srv"
+      "/boot"
+      "/home"
+    ];
+    exclude = [
+      "/home/*/.cache"
+      "/home/*/.local/share/Steam"
+      "/home/*/.local/share/Trash"
+      "/home/*/.lmstudio"
+      "/home/*/Games"
+      "/home/*/Downloads"
+      "/home/*/Projects/**/target"
+    ];
+    repository = "sftp:nas01-backup:/h_Backups/${config.networking.hostName}";
+    passwordFile = "/etc/5335/restic-password";
+    pruneOpts = [
+      "--keep-daily 7"
+      "--keep-weekly 5"
+      "--keep-monthly 6"
+      "--keep-yearly 10"
+    ];
+    timerConfig = {
+      OnCalendar = "daily";
+      Persistent = true;
+      RandomizedDelaySec = "5h";
+    };
+  };
+}
diff --git a/modules/networking/default.nix b/modules/networking/default.nix
index 795494e..942812a 100644
--- a/modules/networking/default.nix
+++ b/modules/networking/default.nix
@@ -1,5 +1,8 @@
 { ... }: 
 {
+  imports = [
+    ./firewall.nix
+  ];
+
   networking.networkmanager.enable = true;
-  networking.firewall.enable = true;
 } 
\ No newline at end of file
diff --git a/modules/networking/firewall.nix b/modules/networking/firewall.nix
new file mode 100644
index 0000000..b959269
--- /dev/null
+++ b/modules/networking/firewall.nix
@@ -0,0 +1,7 @@
+{ ... }:
+{ 
+  networking.firewall.enable = true;
+  
+  networking.firewall.allowedTCPPorts = [ 8080 ];
+  networking.firewall.allowedUDPPorts = [ 8080 ];
+}
\ No newline at end of file
diff --git a/modules/networking/tailscale.nix b/modules/networking/tailscale.nix
new file mode 100644
index 0000000..298d709
--- /dev/null
+++ b/modules/networking/tailscale.nix
@@ -0,0 +1,13 @@
+{ config, ... }:
+{
+  services.tailscale = {
+    enable = true;
+    extraUpFlags = [ "--accept-routes" ];
+  };
+
+  networking.firewall.trustedInterfaces = [ config.services.tailscale.interfaceName ];
+  networking.firewall.allowedUDPPorts = [ config.services.tailscale.port ];
+  
+  systemd.network.wait-online.enable = false; 
+  boot.initrd.systemd.network.wait-online.enable = false;
+}
diff --git a/users/strix/home.nix b/users/strix/home.nix
index 173de92..87ec712 100644
--- a/users/strix/home.nix
+++ b/users/strix/home.nix
@@ -28,9 +28,8 @@
     gnome-extension-manager
     lmstudio
     spotify
-    sccache
   ];
-
+  
   programs.git.settings = {
     user.name = "strix";
     user.email = "strix@saluco.nl";