[byjpr]

Closes #6

Changes

• modules/backup.nix (settings.backup), using services.restic.backups.mail:
  • backs up /var/vmail (all mailboxes, including Sieve scripts) and /var/lib/redis-rspamd (Rspamd's learned data);
  • runs daily to any S3-compatible bucket;
  • prunes with keep.daily/weekly/monthly;
  • verifies a random 1% of the data on each run.
• Secrets. The restic password and bucket keys are sops secrets. The keys reach restic through a sops template as an EnvironmentFile, never the Nix store.
• backup.appendOnly for object-locked / no-delete buckets, so a compromised server can't delete its own backups. The server then never prunes, and just backup-prune does it from the operator's machine with a key that may delete.
• just backup-setup: prompts for the bucket key and generates the restic password, printed once with instructions to store it elsewhere.
• just backup-now, just backup-snapshots, and restic in the dev shell.
• docs/backups.md: setup, protecting backups from the server (B2/S3 object lock or restricted keys), and restore steps.
• Backups are off by default, since they need a bucket at another provider. The CI example config enables them so the module is built.

Testing

• I inspected the generated restic-backups-mail.service: repository, RESTIC_PASSWORD_FILE=/run/secrets/backup/password, the env file from /run/secrets/rendered/, then backup, unlock, forget/prune and check.
• The timer is OnCalendar=daily, and the restic-mail wrapper is installed.
• All 5 provider example systems build. nixfmt, shellcheck and tofu validate pass.
• Not run against a real bucket.

🤖 Generated with Claude Code

https://claude.ai/code/session_01G22o7QQ17GRtkCqpJNFr9B

---

Generated by Claude Code