feat: sync postgres backups to backblaze

Signed-off-by: Lander Van den Bulcke <landervandenbulcke@gmail.com>

hosts/db-01/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ config, pkgs, ... }:
 {
   imports = [
     ./disk-config.nix
@@ -53,5 +53,45 @@
     ];
   };
 
+  services.restic.backups = {
+    postgresql = {
+      initialize = true;
+
+      repositoryFile = config.sops.secrets.restic-repository.path;
+      passwordFile = config.sops.secrets.restic-password.path;
+      environmentFile = config.sops.secrets.restic-environment.path;
+
+      timerConfig = {
+        OnCalendar = "03:00";
+        Persistent = true;
+      };
+
+      paths = [
+        "/var/backup/postgresql"
+      ];
+
+      pruneOpts = [
+        "--keep-daily 7"
+        "--keep-weekly 5"
+        "--keep-weekly 12"
+      ];
+    };
+  };
+
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+    secrets = {
+      restic-environment = {
+        owner = "root";
+      };
+      restic-password = {
+        owner = "root";
+      };
+      restic-repository = {
+        owner = "root";
+      };
+    };
+  };
+
   system.stateVersion = "25.05";
 }