From 7681e2ed28ddc0574ce42a1e2dbbfd82e2ded3d4 Mon Sep 17 00:00:00 2001
From: Tobias Ostner <tobias.ostner@gmail.com>
Date: Tue, 16 Jun 2026 19:36:51 +0200
Subject: [PATCH] Manage restic and backblaze secrets with sops

---
 modules/nextcloud.nix  | 21 +++++++++++++++++++--
 secrets/tobserver.yaml |  8 ++++++--
 2 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/modules/nextcloud.nix b/modules/nextcloud.nix
index f7e63c9..10469ab 100644
--- a/modules/nextcloud.nix
+++ b/modules/nextcloud.nix
@@ -16,6 +16,18 @@
     mode = "0400";
   };
 
+  sops.secrets."restic/nextcloud-password" = {
+    owner = "root";
+    group = "root";
+    mode = "0400";
+  };
+
+  sops.secrets."backblaze/nextcloud-env" = {
+    owner = "root";
+    group = "root";
+    mode = "0400";
+  };
+
   services = {
 
     nextcloud = {
@@ -85,21 +97,26 @@
     restic.backups.nextcloud = {
       initialize = true;
       repository = "b2:tobcloud-backup:nextcloud";
-      passwordFile = "/var/lib/nextcloud/restic-password";
-      environmentFile = "/var/lib/nextcloud/backblaze-env";
+
+      passwordFile = config.sops.secrets."restic/nextcloud-password".path;
+      environmentFile = config.sops.secrets."backblaze/nextcloud-env".path;
+
       paths = [
         "/nextcloud-data"
         "/var/backup/nextcloud"
       ];
+
       backupPrepareCommand = ''
         set -euo pipefail
         install -d -m 0750 -o root -g root /var/backup/nextcloud
         ${pkgs.mariadb}/bin/mysqldump --single-transaction --databases nextcloud \
           > /var/backup/nextcloud/nextcloud.sql
       '';
+
       timerConfig = {
         OnCalendar = "daily";
       };
+
       pruneOpts = [
         "--keep-daily 7"
         "--keep-weekly 4"
diff --git a/secrets/tobserver.yaml b/secrets/tobserver.yaml
index d58df91..5c058d4 100644
--- a/secrets/tobserver.yaml
+++ b/secrets/tobserver.yaml
@@ -3,6 +3,10 @@ mempool:
     mariadb-root-password: ENC[AES256_GCM,data:CjXQWw==,iv:3amyq9/3Nq7pz8s7wk4UORI1gSgURufGh1u/cITQf/I=,tag:4ulBVRDh0Ws04IqHT5P6tg==,type:str]
 nextcloud:
     admin-pass: ENC[AES256_GCM,data:3xufFHvcm5g5+jn+B4qxRljuWDqDXo1mLu4IlSuax7Cz+3ZoOuNXoCXoiaY=,iv:WaWeu/a45Vuz+HvO7m0dUlCGCexk4IX/ijURmb/7jPU=,tag:ytRjS89AmHiGOhKymViTrg==,type:str]
+restic:
+    nextcloud-password: ENC[AES256_GCM,data:fbH++0KWr9V4QR90t4kmBdhwyF+dbtBdf9RFarv2E9MyrH7QMO4yxdppaeE=,iv:VnS2936xTO2sTl51lqXl8/3MBeGldARc4/ZFZYL/hG4=,tag:QGp6OFqEmt6iP11lG6GwmA==,type:str]
+backblaze:
+    nextcloud-env: ENC[AES256_GCM,data:fZsW4+R0nDTqhx6pKQCOKULrheseS1j6JOBvHVCuOPaVqkkZv8/TsgtDJdWnKXTNS9/RBTqhLFPIaUSUrfH/bh6rIc4iDe0BehPzHCxh/0CBwirmu2iS,iv:6ggfA8R+zpj+kxcfaWlG4OH1Iteex6zGIin8+TUemGw=,tag:VQW3hbrbgNBQXzmeSrMaAw==,type:str]
 checker:
     env: ENC[AES256_GCM,data:TkeIRm8CXS9AiFpOrMD04dX5L/kL1XAYwOavDwtAuaCsg8bhAsmI6L9rdHsVuMnL46EaUwG4mAgn6EK6kfiSzkzgZ63MKrhcwhD3B4ybMMjj1opIWvifKBY2+wJ9bLI1ygZtQToOgti5oWLtcCt7zlDx8RqXKbAYNq9j0SBDhZBiZK/m+YJPPHclxr8cn9TlKfEhW78sZ2fyH8V65vT1Rz8gVDARdaz3G12CO5jLVY0q5ucqXrS8YRsuYczMSI3aUcBwRyf2UESsjDBXqfg7OKsgabGqvEwIK+rlbvo1ylIWFJZGC80FEcn/dAIsxC8ew8vhHwDch+dlbgrdyUxktb0qNBJU+7HdyP9QZ+mfU2Y/FIvRbicZXFIVdTnwls9tt2p+uxJQkLCp7OTyZgDHTECDQBRmg5hAdrvyyJUZAUvbcFVYkK984kSNyELbGsZBz+SGnxbQLuQDYi98T6HbIk448pDaWy43QGiEZERcFfLAVHnhK8wYsw6ta4BJSf95t+Ka9zMDhR/j0v3mkTrvXpprnTTp727jUY8AM+dUfavETfi9VtrD9P73UZWkL/Wy4PezBGGhm/8l6PU8C+6cfKfKswLGkKW8tDzxVKgvAHiWcK3adyW1/wLdTOHP5XMgDxWEGc3EZRJ4hrw1cQRrVqkxHI9q8a2pmQZxi7l1u61V/EXBKQSSHGDX8pg1HFwGSkj4a39llz5auFk3QsWIntDFYIYpQKDXns2pH+A+PbTJEv+UfMvDQnMKMG99njn2r8KKXf88VWs64tCq/uylaslx3f/1CnVwTlr3REI=,iv:5nbRJpjNReztdAaTlHHjh7MH0PAN9eSSEEhE1Z8ynA4=,tag:9gYKrH/0g0bca/Q67LchFA==,type:str]
 hermes-env: ENC[AES256_GCM,data:WcN3pP4BIrMoKfehixAHZFTI2rk0js2mwi0m4+NsfgqamDH8IqHpbMJGhIg4zUmJBUlyz+4ZhjtNmvlxtj/i7UxIkPNq4qg95eK59gEM3npW9euRoX+BziKvsM6fFMRbWt60GaKigiI05z83M9I9/A8qbZC/PEWPfj6a5wlqHSVSe2qJjg5tGpthVhApaJ9ZmuTzhyHjs9zRvlkC9SFp9WsdyWWxNfChIKj8MySeAGs1YlDAGFVzsjX3+JlPVlCwPw==,iv:euK36Gk50/NQfjkspCP7tv3/a/gknzrDM21GUqVhEBY=,tag:jPF67Qa6e1VrY7byXKQw0w==,type:str]
@@ -30,7 +34,7 @@ sops:
             cVE5VG56cFAzT1dsRFN4cCtnVEJJdU0KSBWm4blGhnVlOJ3k7lh8aJVOEH8NfFOh
             EwU/4Up6zWYBoe2+GKiQf8imnVLSSxMR7dlNd06ttuFD4B5baqFRcA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-06-09T08:33:08Z"
-    mac: ENC[AES256_GCM,data:/pSGLgzeZ0Qpk7xC0NOSMgh0s3J3YCxLIY9S555bFg7jwR+Bx9MykAtbHcGr4ehiQIXwSF9M0QoNyGVooBGyivVopoyWnqhKEJJ+lyi4/vEC9K0m4caXrqxuw8Fed6SZRda4XzzfT9dq2ApJ/udxuOGz0SXcMxQmSOYtthvOrW8=,iv:kvUiIyG7fIyc7ofUMbDEOApc1C19tEZuKuQdq2Sv2rY=,tag:rjFDgH+9/5S+PlhY7TN/ZA==,type:str]
+    lastmodified: "2026-06-16T17:25:58Z"
+    mac: ENC[AES256_GCM,data:fQNxcm5uOIMGreLwi5gZTQafDQO+4R9m+mU5rg/Wq/FROtfNLwcrf45jDUxqYk82Bad+QgZMWnwe+PjzW9y/bf/Q8h8rvTXGqKe0UdyLstif3Umm2wt1ou/WUWjLLqtSBHWMl3Z0/BOdufDshUansQR1FlNrsyJCQ1iWDUQEO8g=,iv:jD6xoGyfDKGzACKtczArS/+8FrfS+mW6ll3MQmXPXwU=,tag:HQJbJjfHODYH37zni8yYrA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.12.1