restic: add daily external backups of all safe/backups

secrets/default.nix

@@ -41,6 +41,10 @@
 
     # wger
     wger-env.file = ./wger/env.age;
+
+    # restic
+    restic-env.file = ./restic/env.age;
+    restic-pass.file = ./restic/pass.age;
   };
 
   users.groups.secrets-lldap-bind-user-pass = {};

secrets/restic/env.age

@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 QSDXqg PybnzljzRzswiQPSo1I10lSPRjXHd8rVFSNDH1ZsUig
+RzLFaSgJWuDDBS+eTmz0J2aVWjTWV50laojbkyzp4fM
+-> X25519 ZCS4baMlt3oGpkHjdeQibFt4oxum00sHV55sW5yW+3I
+oT/YlQ4sAYkOC4V6+PfK+CYgDT2l/fOlQJ+sVaBVYV4
+-> ssh-ed25519 n8n9DQ anOLNIDopvdtK7A8BH/bzcz3plEzULJW73BvGS9aSmQ
+YPzmwoT/Ltnu5GvicbCs9qqN5CjlsoHClN3seAQdRSo
+-> ssh-ed25519 BTp6UA 8H6CnD8TJUP5acPMs/9Yvnc9cu2kx1blrK/oDlts4Fg
+O6JIlYDxQB10liQ8tqIqi/Gya3k0v/pcIKbI0VBUyn0
+--- PjFfEkfF3yWY4QolKjwCv6Mj30AcoL4cE0qKlgaUV5o
+„h8°^&C¹“ôÏ<C3B4>=‘“&âö«éÒò#Þo…Y–+{j<>ÒÞ]Œ“Vïî<C3AF>ÝEîQ	<09>[M±«òb
»wsྼe¨£l
Г0}3Ò´ÚCæ5HK<uïÄò{Ãa´ôbÎ,KoD[“
탗_ך¨

secrets/restic/pass.age

@@ -0,0 +1,12 @@
+age-encryption.org/v1
+-> ssh-ed25519 QSDXqg +vE6VbbU5XgX0XkEWh9crm+5mdtURyQAqVffU7EXfFg
+UAx9/0QBx+liLIHc2S6Z/JZmtIcBuzxYOlM9YMC4CfI
+-> X25519 KcSKOsQyykcTUtcJYhkU+s6b9xzEQp5nxxdC2lmd8xU
+oZUIGnUXg5bYCCqeNSHs2cXF4LnxGIYC0HyapGoaF0k
+-> ssh-ed25519 n8n9DQ E47ziDXHHPcsQtaHPT17XkgoCcvCQcyFIluEycWfQWw
+MHpLKSfAUAuVoCxcrpH87dJKnq0qK0Nvek9QIpdLPpE
+-> ssh-ed25519 BTp6UA JlHAZaDZkZoL8jHepRFB6CpfmgNPD/gNeXBMXzQuVmY
+XadtJ2aBU5f6mxAb7iCvBRvTr8skt+1OMIqJ2DOr8JI
+--- m/WIZdO5VuSKn3rj6f0ZY5+P8dejPOf1N8niALApC08
+}L<>vÆ"Ë{ã÷%¤ð²ñwáÏÌÑFk7ó¯0™Ð.‚ŒËÀÁ“b2VCêí{…ò‰åîêœ')ˆowóD/þÅ`ö¨*ìñr	Ã
+xî…ÌdD’ß±À&¥<ß

secrets/secrets.nix

@@ -51,4 +51,8 @@ in
 
   # wger
   "wger/env.age".publicKeys = defaultAccess;
+
+  # restic
+  "restic/env.age".publicKeys = defaultAccess;
+  "restic/pass.age".publicKeys = defaultAccess;
 }