add borgbackup to forgejo

forgejo.nix

@@ -1,6 +1,7 @@
 {
   domainName,
   config,
+  pkgs,
   ...
 }:
 {
@@ -49,7 +50,52 @@
         };
       };
     };
+    borgbackup.jobs.forgejo = {
+      paths = [ config.services.forgejo.stateDir ];
+      repo = "ssh://n5lniyfd@n5lniyfd.repo.borgbase.com/./repo";
+      user = "root";
+      group = "root";
+      encryption = {
+        mode = "repokey-blake2";
+        passCommand = "${pkgs.coreutils}/bin/cat ${config.sops.secrets."borg-passphrase".path}";
+      };
+      doInit = true;
+      compression = "auto,zstd";
+      startAt = "*-*-* 03:15:00";
+      persistentTimer = true;
+      prune.keep = {
+        daily = 7;
+        weekly = 4;
+        monthly = 6;
+      };
+      environment.BORG_RSH = "ssh -i ${config.sops.secrets."borg-private-key".path} -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/root/.config/borg/known_hosts";
+      preHook = ''
+        forgejoWasActive=/root/.cache/borg/forgejo-was-active
+        if ${pkgs.systemd}/bin/systemctl is-active --quiet forgejo.service; then
+          touch "$forgejoWasActive"
+          ${pkgs.systemd}/bin/systemctl stop forgejo.service
+        else
+          rm -f "$forgejoWasActive"
+        fi
+      '';
+      postHook = ''
+        forgejoWasActive=/root/.cache/borg/forgejo-was-active
+        if [ -e "$forgejoWasActive" ]; then
+          ${pkgs.systemd}/bin/systemctl start forgejo.service
+          rm -f "$forgejoWasActive"
+        fi
+      '';
+    };
   };
+
+  systemd.services.borgbackup-job-forgejo = {
+    after = [
+      "sops-install-secrets.service"
+      "network-online.target"
+    ];
+    wants = [ "network-online.target" ];
+  };
+
   sops.secrets."forgejo-mailer-user" = {
     sopsFile = ./secrets/forgejo.yaml;
     mode = "0400";
@@ -58,4 +104,18 @@
     sopsFile = ./secrets/forgejo.yaml;
     mode = "0400";
   };
+  sops.secrets."borg-private-key" = {
+    sopsFile = ./secrets/borgbackup.yaml;
+    mode = "0400";
+    key = "private-key";
+    owner = "root";
+    group = "root";
+  };
+  sops.secrets."borg-passphrase" = {
+    sopsFile = ./secrets/borgbackup.yaml;
+    mode = "0400";
+    key = "passphrase";
+    owner = "root";
+    group = "root";
+  };
 }