turned off visualizer for ncmpcpp, enabled restic server.

hosts/cirrostratus/default.nix

@@ -60,6 +60,10 @@ inputs.nixpkgs.lib.nixosSystem {
             format = "binary";
             owner = config.services.nginx.user;
           };
+          restic-server-credentials = {
+            sopsFile = "${inputs.nix-secrets}/restic-server";
+            format = "binary";
+          };
         };
       };
 

hosts/cirrostratus/disk-config.nix

@@ -68,6 +68,16 @@
           compression = "zstd";
           mountpoint = "/storage";
         };
+        datasets = {
+          backup = {
+            type="zfs_fs";
+            options={
+              mountpoint="/backup";
+              compression="zstd";
+              quota="6T";
+            };
+          };
+        };
       };
     };
   };

hosts/cirrostratus/nginx.nix

@@ -8,15 +8,17 @@
   imports = [
     ../../configs/nixos/nginx.nix
   ];
-  services.nginx.virtualHosts."gabevenberg.com" = {
-    enableACME = true;
-    forceSSL = true;
-    root = "/var/www/gabevenberg.com";
-  };
-  services.nginx.virtualHosts."draft.gabevenberg.com" = {
-    enableACME = true;
-    forceSSL = true;
-    root = "/var/www/draft.gabevenberg.com";
-    basicAuthFile = config.sops.secrets.gabevenberg-draft-credentials.path;
+  services.nginx.virtualHosts = {
+    "gabevenberg.com" = {
+      enableACME = true;
+      forceSSL = true;
+      root = "/var/www/gabevenberg.com";
+    };
+    "draft.gabevenberg.com" = {
+      enableACME = true;
+      forceSSL = true;
+      root = "/var/www/draft.gabevenberg.com";
+      basicAuthFile = config.sops.secrets.gabevenberg-draft-credentials.path;
+    };
   };
 }

hosts/cirrostratus/restic.nix

@@ -0,0 +1,27 @@
+{
+  inputs,
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  port = "8090";
+in {
+  services.restic.server = {
+    enable = true;
+    appendOnly = true;
+    dataDir = "/backup/restic";
+    extraFlags = [
+      "--htpasswd-file ${config.sops.secrets.gabevenberg-draft-credentials.path}"
+      "--private-repos"
+    ];
+    listenAddress = "127.0.0.1:${port}";
+  };
+  services.nginx.virtualHosts."restic.gabevenberg.com" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://localhost:${port}";
+    };
+  };
+}