lots of stuff:

Moved syncthing to system service
Restic actually works now
removed some old system configs.
formatting.

hosts/cirrostratus/default.nix

@@ -14,11 +14,13 @@ inputs.nixpkgs.lib.nixosSystem {
     ./disk-config.nix
     ./hardware-configuration.nix
     ./nginx.nix
+    ./restic.nix
     ../../configs/nixos/common.nix
     ../../configs/nixos/tailscale.nix
     ../../configs/nixos/sshd.nix
     ../../configs/nixos/secrets.nix
     ../../configs/nixos/jellyfin.nix
+    ../../configs/nixos/syncthing.nix
     ({
       config,
       pkgs,
@@ -60,10 +62,6 @@ inputs.nixpkgs.lib.nixosSystem {
             format = "binary";
             owner = config.services.nginx.user;
           };
-          restic-server-credentials = {
-            sopsFile = "${inputs.nix-secrets}/restic-server";
-            format = "binary";
-          };
         };
       };
 

hosts/cirrostratus/disk-config.nix

@@ -70,11 +70,10 @@
         };
         datasets = {
           backup = {
-            type="zfs_fs";
-            options={
-              mountpoint="/backup";
-              compression="zstd";
-              quota="6T";
+            type = "zfs_fs";
+            options = {
+              mountpoint = "/backup";
+              quota = "6T";
             };
           };
         };

hosts/cirrostratus/restic.nix

@@ -7,21 +7,28 @@
 }: let
   port = "8090";
 in {
-  services.restic.server = {
+  services.restic.server = lib.mkIf (inputs ? nix-secrets) {
     enable = true;
     appendOnly = true;
     dataDir = "/backup/restic";
-    extraFlags = [
-      "--htpasswd-file ${config.sops.secrets.gabevenberg-draft-credentials.path}"
-      "--private-repos"
-    ];
     listenAddress = "127.0.0.1:${port}";
   };
-  services.nginx.virtualHosts."restic.gabevenberg.com" = {
+  services.nginx.virtualHosts."restic.venberg.xyz" = {
     enableACME = true;
     forceSSL = true;
     locations."/" = {
       proxyPass = "http://localhost:${port}";
     };
   };
+  sops = lib.mkIf (inputs ? nix-secrets) {
+    secrets.restic-server-credentials = {
+      sopsFile = "${inputs.nix-secrets}/restic-server";
+      format = "binary";
+      path = "/backup/restic/.htpasswd";
+      owner="restic";
+    };
+  };
+  environment.systemPackages = with pkgs; [
+    restic
+  ];
 }