move encrypted secrets near relevant files

platforms/nixos/modules/nmasur/presets/services/litestream/backup.age

@@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBDNTh4
+dERZY3Q1cyt6d2RwODR3aWd0dUx6UUR6WWUxUERFV3Zwb1lVU0MwClZZTzY1bXd4
+dnVMS2haWnA3dURhZFgyWFR0c0J1SGhvUEZ3OFJtTmJObzgKLT4gc3NoLWVkMjU1
+MTkgWXlTVU1RIFNMSWJZSCtzTTBlbm4zd0hJWXJSYWdJcUd3RGY1ZkZWTmJPZGtz
+Ym0yUVEKWnFtSDVNZDNNd0FBUURmN1ZJbnJjNlNIdVduM1hSRmlGNlVVMWliOUE0
+SQotPiBzc2gtZWQyNTUxOSBuanZYNUEgVEVlTkFidE1UWnh2NGJibDR6dkh6aEZY
+eElpWE81UUNQcHlVc0JXU2RqUQpneC9ueFFVTldVZzhjN3NrK05IcXhrY1BHempF
+R0p2RVA3bi9XN2dVaXprCi0+IHNzaC1lZDI1NTE5IENxSU9VQSBlR2RlN0dsQkNZ
+R2Ixd0YwdnE0dkhIa1RucUlOWTBLMlJRMVVuOUoreUZJClcwWDdwZVlrSkZWZ1BT
+WjBWK2RNUDFKdXNibVJUQlVhdGs1Yk9IdC92UDAKLT4gc3NoLWVkMjU1MTkgejFP
+Y1p3IGNDM1RiVWtWU1FsaG1tQVVkeGtyYlJzZldHUkZnelozVFVQcG1XQ1hSVmsK
+MFRMS2dNL01VY3pJVWtCWlZmM21BcFZvM1c1djdCcUxCcnQzYTJuV3FDdwotLS0g
+MU5LTzREZ2p0dW1RMWhsWExHb1FtRUJlL0pUdFpKRThpWnVTYS8zbVdIRQrUKXp+
+0HWMPJHIieCvle5qXgzr4iMUL9VxH9ydVl6gkOLM/r7DO36kVkgqr4whSsk8mihY
+boq66cjj1dUVij2fMD3zf62n948EQnPZHIBwnDS05eOW4A==
+-----END AGE ENCRYPTED FILE-----

platforms/nixos/modules/nmasur/presets/services/litestream/litestream.nix

@@ -0,0 +1,68 @@
+# This is my setup for backing up SQlite databases and other systems to S3 or
+# S3-equivalent services (like Backblaze B2).
+
+{ config, lib, ... }:
+
+let
+  cfg = config.nmasur.presets.services.litestream;
+in
+{
+
+  options.nmasur.presets.services.litestream = {
+    enable = lib.mkEnableOption "Litestream SQLite backups";
+    s3 = {
+      endpoint = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        description = "S3 endpoint for Litestream backups";
+        default = "s3.us-west-002.backblazeb2.com";
+      };
+      bucket = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        description = "S3 bucket for Litestream backups";
+        default = "noahmasur-backup";
+      };
+      accessKeyId = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        description = "S3 access key ID for Litestream backups";
+        default = "0026b0e73b2e2c80000000005";
+      };
+      accessKeySecret = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        description = "S3 secret key path for Litestream backups";
+        default = ./backup.age;
+      };
+    };
+  };
+
+  config = lib.mkIf (cfg.enable) {
+
+    users.groups.backup = { };
+
+    secrets.litestream-backup = {
+      source = cfg.s3.accessKeySecret;
+      dest = "${config.secretsDirectory}/backup";
+      group = "backup";
+      permissions = "0440";
+    };
+
+    users.users.litestream.extraGroups = [ "backup" ];
+
+    services.litestream = {
+      enable = true;
+      environmentFile = config.secrets.litestream-backup.dest;
+      settings = { };
+    };
+
+    # Broken on 2024-08-23
+    # https://github.com/NixOS/nixpkgs/commit/0875d0ce1c778f344cd2377a5337a45385d6ffa0
+    allowInsecurePackages = [ "litestream-0.3.13" ];
+
+    # Wait for secret to exist
+    systemd.services.litestream = {
+      after = [ "backup-secret.service" ];
+      requires = [ "backup-secret.service" ];
+      environment.AWS_ACCESS_KEY_ID = cfg.s3.accessKeyId;
+    };
+
+  };
+}