feat(backups): backups work

devices/p14s/default.nix

@@ -4,20 +4,26 @@
     ./hardware-configuration.nix
 
     ../../modules/boot
+    ../../modules/backups
     ../../modules/desktop
     ../../modules/develop
     ../../modules/networking
+    ../../modules/networking/tailscale.nix
     ../../modules/virtualisation
   ];
 
   networking.hostName = "p14s";
 
   # swap & hibernate
+  boot.initrd.luks.devices."luks-21284f67-5a63-41be-9354-07a0240cac50".crypttabExtraOpts = [
+    "fido2-device=auto"
+  ];
   boot.initrd.luks.devices."luks-d51bdb99-5966-40d3-a920-83ea78a73699" = {
     device = "/dev/disk/by-uuid/d51bdb99-5966-40d3-a920-83ea78a73699";
     crypttabExtraOpts = [ "tpm2-device=auto" ];
   };
-  boot.kernelParams = [ "resume=/dev/disk/by-uuid/d51bdb99-5966-40d3-a920-83ea78a73699" ];
+  boot.kernelParams = [ "resume=/dev/mapper/luks-d51bdb99-5966-40d3-a920-83ea78a73699" ];
+  boot.resumeDevice = "/dev/mapper/luks-d51bdb99-5966-40d3-a920-83ea78a73699";
 
   boot.initrd.checkJournalingFS = false;
 

modules/backups/default.nix

@@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  programs.ssh.extraConfig = ''
+    Host nas01-backup
+      HostName 10.1.0.2
+      User _sa_backup
+      IdentityFile /etc/5335/id_backup_nas01
+      IdentitiesOnly yes
+      StrictHostKeyChecking accept-new
+  '';
+
+  services.restic.backups.system = {
+    initialize = true;
+    inhibitsSleep = true;
+    paths = [
+      "/etc"
+      "/srv"
+      "/boot"
+      "/home"
+    ];
+    exclude = [
+      "/home/*/.cache"
+      "/home/*/.local/share/Steam"
+      "/home/*/.local/share/Trash"
+      "/home/*/.lmstudio"
+      "/home/*/Games"
+      "/home/*/Downloads"
+      "/home/*/Projects/**/target"
+    ];
+    repository = "sftp:nas01-backup:/h_Backups/${config.networking.hostName}";
+    passwordFile = "/etc/5335/restic-password";
+    pruneOpts = [
+      "--keep-daily 7"
+      "--keep-weekly 5"
+      "--keep-monthly 6"
+      "--keep-yearly 10"
+    ];
+    timerConfig = {
+      OnCalendar = "daily";
+      Persistent = true;
+      RandomizedDelaySec = "5h";
+    };
+  };
+}

modules/networking/default.nix

@@ -1,5 +1,8 @@
 { ... }: 
 {
+  imports = [
+    ./firewall.nix
+  ];
+
   networking.networkmanager.enable = true;
-  networking.firewall.enable = true;
 } 

modules/networking/firewall.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{ 
+  networking.firewall.enable = true;
+  
+  networking.firewall.allowedTCPPorts = [ 8080 ];
+  networking.firewall.allowedUDPPorts = [ 8080 ];
+}

modules/networking/tailscale.nix

@@ -0,0 +1,13 @@
+{ config, ... }:
+{
+  services.tailscale = {
+    enable = true;
+    extraUpFlags = [ "--accept-routes" ];
+  };
+
+  networking.firewall.trustedInterfaces = [ config.services.tailscale.interfaceName ];
+  networking.firewall.allowedUDPPorts = [ config.services.tailscale.port ];
+  
+  systemd.network.wait-online.enable = false; 
+  boot.initrd.systemd.network.wait-online.enable = false;
+}

users/strix/home.nix

@@ -28,7 +28,6 @@
     gnome-extension-manager
     lmstudio
     spotify
-    sccache
   ];
   
   programs.git.settings = {