document borg backup recovery

README.md

@@ -82,6 +82,10 @@ RABBI_GERZI_INITIAL_ADMIN_PASSWORD=replace-with-a-long-random-password
 - `RABBI_GERZI_INITIAL_ADMIN_PASSWORD` is used only to create that admin if
   it does not already exist.
 
+The module also requires paths to a Borg repository passphrase file and SSH
+private key through `services.rabbi-gerzi.secretFiles`. Keep both files
+outside the Nix store and readable only by root.
+
 Generate an app key inside the dev shell:
 
 ```sh
@@ -148,6 +152,34 @@ cd frontend/rabbi_gerzi
 printf '%s\n' 'VITE_API_BASE_URL=http://127.0.0.1:8000' > .env.local
 ```
 
+## Production Backups
+
+The NixOS module creates an encrypted Borg backup in:
+
+```text
+ssh://mgjjruz9@mgjjruz9.repo.borgbase.com/./repo
+```
+
+Each archive contains the complete application state directory and a
+custom-format PostgreSQL dump. This covers database records, users, sessions,
+and every uploaded icon and PDF. The Nix store, runtime secrets, and
+`/var/cache/rabbi-gerzi` are reproducible or recovered separately and are not
+archived.
+
+The persistent timer runs daily at 05:15 in the server's local timezone and
+keeps 7 daily, 4 weekly, and 6 monthly archives. PHP-FPM drains active requests
+and remains stopped while the dump and archive are created, so database rows
+and uploaded files come from the same write-free window. The static frontend
+remains available during that window.
+
+Run an immediate backup with:
+
+```sh
+sudo systemctl start borgbackup-job-rabbi-gerzi.service
+```
+
+See [RECOVERY.md](./RECOVERY.md) for archive verification and full restoration.
+
 ## Local Development
 
 Enter the Nix dev shell before running local development commands:
@@ -364,6 +396,8 @@ Example host configuration:
                   "app-key" = { };
                   "admin-email" = { };
                   "admin-password" = { };
+                  "borg-passphrase" = { };
+                  "borg-private-key" = { };
                 };
 
                 templates."rabbi-gerzi.env".content = ''
@@ -376,6 +410,13 @@ Example host configuration:
               services.rabbi-gerzi = {
                 enable = true;
 
+                secretFiles = {
+                  borgPassphrase =
+                    config.sops.secrets."borg-passphrase".path;
+                  borgPrivateKey =
+                    config.sops.secrets."borg-private-key".path;
+                };
+
                 frontend.hostName = "rabbigerzi.com";
 
                 backend = {
@@ -412,6 +453,11 @@ Add these values in the editor opened by `sops`:
 app-key: base64:replace-with-laravel-app-key
 admin-email: admin@example.com
 admin-password: replace-with-a-long-random-password
+borg-passphrase: replace-with-the-repository-passphrase
+borg-private-key: |
+  -----BEGIN OPENSSH PRIVATE KEY-----
+  replace-with-the-private-key
+  -----END OPENSSH PRIVATE KEY-----
 ```
 
 Commit only the encrypted file written by `sops`. At activation time,