have gitea actually backup full repos

modules/nixos/services/gitea.nix

@@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, pkgs, lib, ... }:
 
 let giteaPath = "/var/lib/gitea"; # Default service directory
 
@@ -44,6 +44,7 @@ in {
     };
 
     networking.firewall.allowedTCPPorts = [ 122 ];
+    users.users.${config.user}.extraGroups = [ "gitea" ];
 
     caddy.routes = [{
       match = [{ host = [ config.gitServer ]; }];
@@ -84,6 +85,34 @@ in {
       requires = [ "gitea.service" ];
     };
 
+    # Run a repository file backup on a schedule
+    systemd.timers.gitea-backup = lib.mkIf (config.backup.s3.endpoint != null) {
+      timerConfig = {
+        OnCalendar = "*-*-* 00:00:00"; # Once per day
+        Unit = "gitea-backup.service";
+      };
+      wantedBy = [ "timers.target" ];
+    };
+
+    # Backup Gitea repos to object storage
+    systemd.services.gitea-backup =
+      lib.mkIf (config.backup.s3.endpoint != null) {
+        description = "Backup Gitea data";
+        environment.AWS_ACCESS_KEY_ID = config.backup.s3.accessKeyId;
+        serviceConfig = {
+          Type = "oneshot";
+          User = "gitea";
+          Group = "backup";
+          EnvironmentFile = config.secrets.backup.dest;
+        };
+        script = ''
+          ${pkgs.awscli2}/bin/aws s3 sync --exclude */gitea.db* \
+              ${giteaPath}/ \
+              s3://${config.backup.s3.bucket}/gitea-data/ \
+              --endpoint-url=https://${config.backup.s3.endpoint}
+        '';
+      };
+
   };
 
 }

modules/nixos/services/prometheus.nix

@@ -20,16 +20,15 @@
       webExternalUrl = lib.mkIf config.services.grafana.enable
         "https://${config.prometheusServer}";
       # Web config file: https://prometheus.io/docs/prometheus/latest/configuration/https/
-      webConfigFile =
+      webConfigFile = lib.mkIf config.services.grafana.enable
-        lib.mkIf config.services.grafana.enable (pkgs.formats.yaml { }).generate
+        ((pkgs.formats.yaml { }).generate "webconfig.yml" {
-        "webconfig.yml" {
           basic_auth_users = {
             # Generate password: htpasswd -nBC 10 "" | tr -d ':\n'
             # Encrypt and place in private/prometheus.age
             "prometheus" =
               "$2y$10$r7FWHLHTGPAY312PdhkPEuvb05aGn9Nk1IO7qtUUUjmaDl35l6sLa";
           };
-        };
+        });
       remoteWrite = lib.mkIf (!config.services.grafana.enable) [{
         name = config.networking.hostName;
         url = "https://${config.prometheusServer}";