add borg backup for discourse

discourse.nix

@@ -36,6 +36,75 @@
     };
   };
 
+  services.borgbackup.jobs.discourse = {
+    paths = [
+      "/var/lib/discourse"
+      "/var/backup/discourse/discourse.dump"
+    ];
+    repo = "ssh://oas17j8p@oas17j8p.repo.borgbase.com/./repo";
+    user = "root";
+    group = "root";
+    encryption = {
+      mode = "repokey-blake2";
+      passCommand = "${pkgs.coreutils}/bin/cat ${config.sops.secrets."borg-passphrase".path}";
+    };
+    doInit = true;
+    compression = "auto,zstd";
+    startAt = "*-*-* 04:15:00";
+    persistentTimer = true;
+    prune.keep = {
+      daily = 7;
+      weekly = 4;
+      monthly = 6;
+    };
+    readWritePaths = [ "/var/backup/discourse" ];
+    environment.BORG_RSH = "ssh -i ${config.sops.secrets."borg-private-key".path} -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/root/.config/borg/known_hosts";
+    preHook = ''
+      discourseWasActive=/root/.cache/borg/discourse-was-active
+      dumpFile=/var/backup/discourse/discourse.dump
+
+      if ${pkgs.systemd}/bin/systemctl is-active --quiet discourse.service; then
+        touch "$discourseWasActive"
+        ${pkgs.systemd}/bin/systemctl stop discourse.service
+      else
+        rm -f "$discourseWasActive"
+      fi
+
+      rm -f "$dumpFile"
+      umask 077
+      ${lib.getExe' pkgs.su "su"} -s ${pkgs.runtimeShell} ${config.services.postgresql.superUser} -c '${config.services.postgresql.package}/bin/pg_dump --format=custom --dbname=${config.services.discourse.database.name}' > "$dumpFile"
+    '';
+    postHook = ''
+      discourseWasActive=/root/.cache/borg/discourse-was-active
+      dumpFile=/var/backup/discourse/discourse.dump
+
+      rm -f "$dumpFile"
+
+      if [ -e "$discourseWasActive" ]; then
+        ${pkgs.systemd}/bin/systemctl start discourse.service
+        rm -f "$discourseWasActive"
+      fi
+    '';
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /var/backup/discourse 0700 root root - -"
+  ];
+
+  systemd.services.borgbackup-job-discourse = {
+    after = [
+      "sops-install-secrets.service"
+      "network-online.target"
+      "postgresql.target"
+      "discourse-postgresql.service"
+    ];
+    wants = [
+      "network-online.target"
+      "postgresql.target"
+      "discourse-postgresql.service"
+    ];
+  };
+
   sops.secrets = {
     "discourse-admin-password" = {
       sopsFile = ./secrets/discourseAdminPassword.yaml;