Add backup for bictoin-pulse db

modules/bitcoin-pulse.nix

@@ -1,6 +1,10 @@
 { bitcoin-pulse, config, lib, pkgs, ... }:
 
 let
+  backupDirectory = "/var/backup/bitcoin-pulse";
+  backupDump = "${backupDirectory}/bitcoin-pulse.dump";
+  backupRepository = "b2:tobcloud-backup:bitcoin-pulse";
+  backupServiceName = "restic-backups-bitcoin-pulse";
   containerName = "bitcoin-pulse-postgres";
   databaseUrl = "jdbc:postgresql://127.0.0.1:5432/bitcoin_pulse?tcpKeepAlive=true";
   migrationServiceName = "bitcoin-pulse-migrate";
@@ -10,7 +14,9 @@ let
   secretFiles = {
     admin = config.sops.secrets."bitcoin-pulse/postgres/admin-password".path;
     app = config.sops.secrets."bitcoin-pulse/postgres/app-password".path;
+    backblaze = config.sops.secrets."backblaze/tobcloud-backup-env".path;
     migration = config.sops.secrets."bitcoin-pulse/postgres/migration-password".path;
+    restic = config.sops.secrets."restic/bitcoin-pulse-password".path;
   };
 
   prepareSecrets = pkgs.writeShellApplication {
@@ -106,6 +112,67 @@ in
     };
   };
 
+  services.restic.backups.bitcoin-pulse = {
+    initialize = true;
+    repository = backupRepository;
+
+    passwordFile = secretFiles.restic;
+    environmentFile = secretFiles.backblaze;
+
+    paths = [ backupDump ];
+
+    backupPrepareCommand = ''
+      set -euo pipefail
+
+      install -d -m 0700 -o root -g root ${lib.escapeShellArg backupDirectory}
+
+      dump_path=${lib.escapeShellArg backupDump}
+      temporary_dump="$dump_path.tmp"
+      pgpass_file="$RUNTIME_DIRECTORY/postgresql.pgpass"
+
+      rm -f "$dump_path" "$temporary_dump" "$pgpass_file"
+
+      password="$(cat "$CREDENTIALS_DIRECTORY/postgres-password")"
+      escaped_password="''${password//\\/\\\\}"
+      escaped_password="''${escaped_password//:/\\:}"
+      printf '127.0.0.1:5432:bitcoin_pulse:bitcoin_pulse_admin:%s\n' \
+        "$escaped_password" > "$pgpass_file"
+      chmod 0600 "$pgpass_file"
+
+      trap 'rm -f "$temporary_dump" "$pgpass_file"' EXIT
+
+      PGPASSFILE="$pgpass_file" ${pkgs.postgresql_18}/bin/pg_dump \
+        --host=127.0.0.1 \
+        --port=5432 \
+        --username=bitcoin_pulse_admin \
+        --dbname=bitcoin_pulse \
+        --format=custom \
+        --no-password \
+        --file="$temporary_dump"
+
+      mv "$temporary_dump" "$dump_path"
+    '';
+
+    backupCleanupCommand = ''
+      rm -f \
+        ${lib.escapeShellArg backupDump} \
+        ${lib.escapeShellArg "${backupDump}.tmp"} \
+        "$RUNTIME_DIRECTORY/postgresql.pgpass"
+    '';
+
+    timerConfig = {
+      OnCalendar = "*-*-* 03:00:00";
+      Persistent = true;
+      RandomizedDelaySec = "30m";
+    };
+
+    pruneOpts = [
+      "--keep-daily 7"
+      "--keep-weekly 4"
+      "--keep-monthly 12"
+    ];
+  };
+
   users.groups = {
     bitcoin-pulse = { };
     bitcoin-pulse-migration = { };
@@ -151,6 +218,12 @@ in
       group = "bitcoin-pulse-migration";
       mode = "0440";
     };
+
+    "restic/bitcoin-pulse-password" = {
+      owner = "root";
+      group = "root";
+      mode = "0400";
+    };
   };
 
   virtualisation.oci-containers = {
@@ -263,6 +336,19 @@ in
       requires = [ "${migrationServiceName}.service" ];
       after = [ "${migrationServiceName}.service" ];
     };
+
+    ${backupServiceName} = {
+      requires = [ "${serviceName}.service" ];
+      after = [ "${serviceName}.service" ];
+
+      serviceConfig = {
+        LoadCredential = [
+          "postgres-password:${secretFiles.admin}"
+        ];
+        TimeoutStartSec = "6h";
+        UMask = "0077";
+      };
+    };
   };
 
   services.nginx = {
@@ -297,5 +383,9 @@ in
     };
   };
 
+  systemd.tmpfiles.rules = [
+    "d ${backupDirectory} 0700 root root - -"
+  ];
+
   environment.systemPackages = [ pkgs.postgresql_18 ];
 }