broke out the password file

modules/hosts/john-pc-ubuntu.nix

@@ -11,18 +11,18 @@ in
     certDir = "${config.mtls.certDir}";
     CACert = "${certDir}/root_ca.crt";
     mtlsBundle = "${certDir}/${config.mtls.bundleFilename}";
+    resticPasswordFile = "${config.xdg.configHome}/restic/password.txt";
   in
   {
     imports = with inputs.self.modules.homeManager; [
       rebuild
       john
-      resticprofile
       sops
-      docker
-      desktop
       step-ssh-user
       mtls
       restic
+      docker
+      desktop
     ];
     targets.genericLinux.enable = true;
 
@@ -54,7 +54,6 @@ in
 
     # TODO: Add host-specific settings here:
     # - sops secret for `restic_password/john_ubuntu`
-    # - resticprofile profile definition
     # - zsh RESTIC* session variables
 
     # TODO: make this more restrictive, rather than allowing all unfree packages
@@ -79,35 +78,20 @@ in
       };
     };
     sops.secrets."restic_password/john_ubuntu" = {
-      path = "${config.xdg.configHome}/restic/password.txt";
+      path = resticPasswordFile;
       mode = "0400";
     };
     restic = {
-      passwordFile = "${config.xdg.configHome}/restic/password.txt";
-      paths = [
-        "${config.xdg.userDirs.documents}"
-        "/conf"
+      passwordFile = resticPasswordFile;
+      paths = [ "${config.xdg.userDirs.documents}" "/conf" ];
+      exclude = [
+        "/home/*/Pictures"
+        "/home/*/Videos"
+        "/home/*/go"
+        "/home/*/snap"
+        "/home/john/john-nas"
       ];
     };
-
-    # programs.resticprofile = {
-    #   enable= true;
-    #   profiles = {
-    #     default = {
-    #       "inherit" = "base";
-    #       repository = "rest:https://soteria.john-stream.com/john-ubuntu";
-    #       cacert = "${CACert}";
-    #       tls-client-cert = "${mtlsBundle}";
-    #       backup = {
-    #         source = [
-    #           "${config.xdg.userDirs.documents}"
-    #           "/conf"
-    #         ];
-    #         schedule = "*-*-* *:15,30,45:00";
-    #       };
-    #     };
-    #   };
-    # };
   };
 
   flake.homeConfigurations."${hostname}" = inputs.home-manager.lib.homeManagerConfiguration {

modules/hosts/soteria.nix

@@ -15,6 +15,7 @@ in
       nixos.zsh
       nixos.login-text
       nixos.mtls
+      nixos.restic-server
       {
         networking.hostName = hostname;
         step-ssh-host = {

modules/services/restic/base-profile.yaml

@@ -1,43 +0,0 @@
-base:
-  repository: local:/mnt/backup
-  password-file: '{{ .ConfigDir }}/password.txt'
-  status-file: '{{ .ConfigDir }}/backup-status.json'
-  retention:
-    after-backup: true
-    keep-last: '10'
-    keep-hourly: '8'
-    keep-daily: '14'
-    keep-weekly: '8'
-    keep-monthly: '6'
-  backup:
-    verbose: true
-    exclude:
-      - .cache
-      - .devenv
-      - .rustup
-      - .cargo
-      - .venv
-      - .pyenv
-      - .vscode*
-      - data/postgres
-      - build
-      - __pycache__
-      - '*.log'
-      - '*.egg-info'
-      - '*.csv'
-      - '*.m4a'
-      - .local/share/Steam
-      - .local/share/Trash
-      - build
-      - dist
-      - /home/*/Pictures
-      - /home/*/Videos
-      - /home/*/go
-      - /home/*/snap
-      - /home/john/john-nas
-    schedule-permission: user
-    schedule-priority: background
-    check-after: true
-  prune:
-    schedule-permission: user
-    schedule-lock-wait: 1h

modules/services/restic/restic.nix

@@ -1,4 +1,13 @@
 { inputs, ... }: {
+  flake.modules.nixos.restic-server = { config, pkgs, lib, ... }: {
+    services.restic.server = {
+      enable = true;
+      dataDir = "/mnt/restic";
+      listenAddress = "0.0.0.0:8080";
+      extraFlags = [ "--no-auth" ];
+    };
+  };
+
   flake.modules.homeManager.restic = { config, pkgs, lib, ... }:
     let
       cfg = config.restic;
@@ -19,6 +28,11 @@
           type = lib.types.listOf lib.types.str;
           default = [ ];
         };
+        exclude = lib.mkOption {
+          description = "List of string paths to include in the backup. There are already some common ones included by default.";
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+        };
       };
 
       config = let
@@ -59,7 +73,7 @@
               "--keep-weekly 8"
               "--keep-monthly 12"
             ];
-            exclude = [
+            exclude = cfg.exclude ++ [
               ".cache"
               ".devenv"
               ".rustup"
@@ -69,6 +83,7 @@
               ".vscode*"
               "data/postgres"
               "build"
+              "dist"
               "__pycache__"
               "*.log"
               "*.egg-info"
@@ -76,12 +91,6 @@
               "*.m4a"
               ".local/share/Steam"
               ".local/share/Trash"
-              "dist"
-              "/home/*/Pictures"
-              "/home/*/Videos"
-              "/home/*/go"
-              "/home/*/snap"
-              "/home/john/john-nas"
             ];
           };
         };

modules/services/restic/resticprofile.nix

@@ -1,99 +0,0 @@
-{ inputs, ... }:
-{
-  perSystem = { pkgs, ... }:
-    let
-      resticprofilePkg = pkgs.buildGoModule rec {
-        pname = "resticprofile";
-        version = "0.32.0";
-        src = pkgs.fetchFromGitHub {
-          owner = "creativeprojects";
-          repo   = "resticprofile";
-          rev    = "v${version}";
-          sha256 = "sha256-fmYsoGYppNgbtoX18aF5UHBG9ieYorBJ9JZkwrR+UBI=";
-        };
-        vendorHash = "sha256-/GVWjOvkYe7xMRjANKIKV6FSU0F5VY1ZP/ppgAJyhvw=";
-        goPackagePath = "github.com/creativeprojects/resticprofile";
-        doCheck = false;
-        meta = with pkgs.lib; {
-          description = "Configuration profiles manager and scheduler for restic backup";
-          homepage    = "https://creativeprojects.github.io/resticprofile/";
-          license     = licenses.gpl3Only;
-          maintainers = [ ];
-          mainProgram = "resticprofile";
-        };
-      };
-    in {
-      packages = {
-        resticprofile = resticprofilePkg;
-        default = resticprofilePkg;
-      };
-    };
-
-  flake.lib.fromYAML = pkgs: path:
-    builtins.fromJSON (
-      builtins.readFile (
-        pkgs.runCommand "${builtins.baseNameOf path}.json"
-          {
-            nativeBuildInputs = [ pkgs.remarshal ];
-          }
-          ''
-            remarshal -if yaml -of json ${path} > "$out"
-          ''
-      )
-    );
-
-  flake.modules.homeManager.resticprofile = { config, lib, pkgs, ... }:
-    let
-      cfg = config.programs.resticprofile;
-      yamlFormat = pkgs.formats.yaml { };
-      # baseProfile = import ../../../resticprofile/base.nix;
-      baseProfile = inputs.self.lib.fromYAML pkgs ./base-profile.yaml;
-      profiles = lib.recursiveUpdate baseProfile cfg.profiles;
-    in {
-      options.programs.resticprofile = {
-        enable = lib.mkEnableOption "Enable resticprofile (Restic backup profile manager)";
-        package = lib.mkPackageOption pkgs "resticprofile" { };
-        profiles = lib.mkOption {
-          type = lib.types.attrsOf yamlFormat.type;
-          default = { };
-          description = ''
-            Additional resticprofile configuration merged on top of the base profile.
-            Each attribute becomes a profile entry in
-            `$XDG_CONFIG_HOME/resticprofile/profiles.yaml`.
-          '';
-        };
-      };
-
-      config = lib.mkIf cfg.enable (
-        let
-          resticprofilePackage = lib.mkDefault
-            inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.resticprofile;
-          resticprofileBin = lib.getExe cfg.package;
-          rpScript = pkgs.writeShellScriptBin "rp" ''
-            set -e
-            sudo ${resticprofileBin} --config "${config.xdg.configHome}/resticprofile/profiles.yaml" $@
-          '';
-          rpbackupScript = pkgs.writeShellScriptBin "rp-backup" ''
-            ${lib.getExe rpScript} run-schedule backup@default "$@"
-          '';
-        in {
-          programs.resticprofile.package = resticprofilePackage;
-          home.packages = [
-            cfg.package
-            rpScript
-            rpbackupScript
-            (pkgs.writeShellScriptBin "rps" ''
-              set -e
-              ${lib.getExe rpScript} unschedule --all
-              ${lib.getExe rpScript} schedule --all
-            '')
-            (pkgs.writeShellScriptBin "rp-test" "${lib.getExe rpbackupScript} --dry-run")
-          ];
-          xdg.configFile."resticprofile/profiles.yaml".source = yamlFormat.generate "profiles" {
-            version = "2";
-            profiles = profiles;
-          };
-        }
-      );
-    };
-}