added restic user options

modules/services/restic/restic.nix

@@ -1,7 +1,37 @@
-{ ... }:
+{ inputs, ... }: {
-let
+  flake.modules.homeManager.restic = { config, pkgs, lib, ... }:
-  resticFactory = repoName: {
+    let
-    repository = "rest:https://soteria.john-stream.com/${repoName}";
+      cfg = config.restic;
+    in
+    {
+      options.restic = {
+        repoName = lib.mkOption {
+          description = "Name of the restic repo to use";
+          type = lib.types.str;
+          default = "john-ubuntu";
+        };
+        passwordFile = lib.mkOption {
+          description = "String path to the restic password file";
+          type = lib.types.str;
+        };
+        paths = lib.mkOption {
+          description = "List of string paths to include in the backup";
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+        };
+      };
+
+      config = {
+        services.restic = {
+          enable = true;
+          backups.${cfg.repoName} = {
+            passwordFile = cfg.passwordFile;
+            paths = cfg.paths;
+            repository = "rest:https://soteria.john-stream.com/${cfg.repoName}";
+            extraBackupArgs = [
+              "--tls-client-cert ${config.mtls.certDir}/${config.mtls.bundleFilename}"
+              "--cacert ${config.mtls.certDir}/root_ca.crt"
+            ];
             timerConfig = {
               OnCalendar = "00:05";
               Persistent = true;
@@ -40,36 +70,6 @@ let
               "/home/john/john-nas"
             ];
           };
-in {
-  flake.modules.homeManager.restic = { config, pkgs, lib, ... }:
-    let
-      cfg = config.restic;
-    in
-    {
-      options.restic = {
-        repoName = lib.mkOption {
-          description = "Name of the restic repo to use";
-          type = lib.types.str;
-          default = "john-ubuntu";
-        };
-        passwordFile = lib.mkOption {
-          description = "String path to the restic password file";
-          type = lib.types.str;
-        };
-        paths = lib.mkOption {
-          description = "List of string paths to include in the backup";
-          type = lib.types.listOf lib.types.str;
-          default = [ ];
-        };
-      };
-
-      config = {
-        services.restic = {
-          enable = true;
-          backups.${cfg.repoName} = (resticFactory cfg.repoName) // {
-            passwordFile = cfg.passwordFile;
-            paths = cfg.paths;
-          };
         };
       };
     };