backup calibre data

modules/services/backups.nix

@@ -23,9 +23,13 @@
 
   config = {
 
+    users.groups.backup = { };
+
     secrets.backup = {
       source = ../../private/backup.age;
       dest = "${config.secretsDirectory}/backup";
+      group = "backup";
+      permissions = "0440";
     };
 
     # # Backup library to object storage

modules/services/calibre.nix

@@ -1,6 +1,6 @@
 { config, pkgs, lib, ... }: {
 
-  imports = [ ./caddy.nix ];
+  imports = [ ./caddy.nix ./backups.nix ];
 
   options = {
     bookServer = lib.mkOption {
@@ -39,6 +39,35 @@
       }];
     }];
 
+    # Run a backup on a schedule
+    systemd.timers.calibre-backup = {
+      timerConfig = {
+        OnCalendar = "*-*-* 00:00:00"; # Once per day
+        Unit = "calibre-backup.service";
+      };
+      wantedBy = [ "timers.target" ];
+    };
+
+    # Backup Calibre data to object storage
+    systemd.services.calibre-backup =
+      let libraryPath = "/var/lib/calibre-web"; # Default location
+      in {
+        description = "Backup Calibre data";
+        environment.AWS_ACCESS_KEY_ID = config.backupS3.accessKeyId;
+        serviceConfig = {
+          Type = "oneshot";
+          User = "calibre-web";
+          Group = "backup";
+          EnvironmentFile = config.secrets.backup.dest;
+        };
+        script = ''
+          ${pkgs.awscli2}/bin/aws s3 sync \
+              ${libraryPath}/ \
+              s3://${config.backupS3.bucket}/calibre/ \
+              --endpoint-url=https://${config.backupS3.endpoint}
+        '';
+      };
+
   };
 
 }

modules/services/nextcloud.nix

@@ -60,7 +60,7 @@
       lib.mkForce "0770";
 
     # Allow litestream and nextcloud to share a sqlite database
-    users.users.litestream.extraGroups = [ "nextcloud" ];
+    users.users.litestream.extraGroups = [ "nextcloud" "backup" ];
     users.users.nextcloud.extraGroups = [ "litestream" ];
 
     # Backup sqlite database with litestream