weilite/{restic,ocis}: add

machines/weilite/services/restic.nix

@@ -1,16 +1,43 @@
 { config, ... }:
+let
+  mkPrune = user: host: {
+    name = "${user}-${host}-prune";
+    value = {
+      user = "restic";
+      repository = "/var/lib/restic/${user}/${host}";
+      passwordFile = "/var/lib/restic/localpass";
+      timerConfig = {
+        OnCalendar = "02:05";
+        RandomizedDelaySec = "1h";
+      };
+      pruneOpts = [
+        "--keep-daily 7"
+        "--keep-weekly 5"
+        "--keep-monthly 12"
+        "--keep-yearly 75"
+      ];
+    };
+
+  };
+in
 {
   services.restic.server = {
     enable = true;
     dataDir = "/var/lib/restic";
     listenAddress = "127.0.0.1:19573";
-    privateRepos = "true";
+    privateRepos = true;
     extraFlags = [
       "--append-only"
+      "--prometheus-no-auth"
     ];
   };
 
-  networking.allowedTCPPorts = [ 8443 ];
+  services.restic.backups = builtins.listToAttrs [
+    (mkPrune "xin" "calcite")
+    (mkPrune "xin" "massicot")
+  ];
+
+  networking.firewall.allowedTCPPorts = [ 8443 ];
 
   services.caddy.virtualHosts."https://backup.xinyang.life:8443".extraConfig = ''
     reverse_proxy ${config.services.restic.server.listenAddress}