From 207a682045074af8cd0ff4af24c47d7963540e48 Mon Sep 17 00:00:00 2001
From: Gabriel Arazas <foo.dogsquared@gmail.com>
Date: Sat, 19 Feb 2022 16:58:08 +0800
Subject: [PATCH] backup-archive: switch to NixOS borg module

While Borgmatic is great, the NixOS module does have easier
configuration for various use cases such as backups in removable
devices. To make this possible in Borgmatic, you have to go through some
loops.

Borgmatic does have easier way of indicating paths. However, in recent
versions of Borg, they have the experimental feature of indicate both
include and exclude through patterns which is close enough.

Also, because of this, we'll be deprecating the custom borgmatic service
at this point. It'll be removed once all of my NixOS-related backup
setups are not using it.
---
 .../nixos/hardware-setup/backup-archive.nix   |  43 -------
 .../hardware-setup/backup-archive/README.adoc |   5 +
 .../backup-archive/borg-ssh-key.pub           |   1 +
 .../hardware-setup/backup-archive/default.nix | 114 ++++++++++++++++++
 secrets/archive/borg-patterns                 | Bin 0 -> 1831 bytes
 secrets/archive/borg-patterns-local           | Bin 0 -> 2166 bytes
 secrets/archive/borgmatic.json                | Bin 1773 -> 0 bytes
 secrets/archive/key                           | Bin 0 -> 1680 bytes
 secrets/archive/password                      | Bin 518 -> 835 bytes
 secrets/secrets.nix                           |  10 +-
 10 files changed, 128 insertions(+), 45 deletions(-)
 delete mode 100644 modules/nixos/hardware-setup/backup-archive.nix
 create mode 100644 modules/nixos/hardware-setup/backup-archive/README.adoc
 create mode 100644 modules/nixos/hardware-setup/backup-archive/borg-ssh-key.pub
 create mode 100644 modules/nixos/hardware-setup/backup-archive/default.nix
 create mode 100644 secrets/archive/borg-patterns
 create mode 100644 secrets/archive/borg-patterns-local
 delete mode 100644 secrets/archive/borgmatic.json
 create mode 100644 secrets/archive/key

diff --git a/modules/nixos/hardware-setup/backup-archive.nix b/modules/nixos/hardware-setup/backup-archive.nix
deleted file mode 100644
index 6374d621..00000000
--- a/modules/nixos/hardware-setup/backup-archive.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-# This is my external hard drive.
-{ config, options, lib, pkgs, ... }:
-
-# TODO: Make this a generic service.
-#       There are multiple external storage drives now.
-let cfg = config.hardware-setup.backup-archive;
-in {
-  options.hardware-setup.backup-archive.enable = lib.mkEnableOption
-    "external hard drive and automated backup service with BorgBackup";
-
-  config = lib.mkIf cfg.enable {
-    assertions = [{
-      assertion = config.profiles.agenix.enable;
-      message = "Agenix module is not enabled.";
-    }];
-
-    age.secrets.external-backup-borgmatic-settings.file =
-      lib.getSecret "archive/borgmatic.json";
-
-    fileSystems."/mnt/external-storage" = {
-      device = "/dev/disk/by-uuid/665A391C5A38EB07";
-      fsType = "ntfs";
-      noCheck = true;
-      options = [
-        "nofail"
-        "noauto"
-        "user"
-
-        # See systemd.mount.5 and systemd.automount.5 manual page for more
-        # details.
-        "x-systemd.automount"
-        "x-systemd.device-timeout=2"
-        "x-systemd.idle-timeout=2"
-      ];
-    };
-
-    # This uses the custom borgmatic NixOS service.
-    services.borgmatic-fds.jobs.external-storage = {
-      startAt = "04/6:00:00";
-      configPath = config.age.secrets.external-backup-borgmatic-settings.path;
-    };
-  };
-}
diff --git a/modules/nixos/hardware-setup/backup-archive/README.adoc b/modules/nixos/hardware-setup/backup-archive/README.adoc
new file mode 100644
index 00000000..0003808b
--- /dev/null
+++ b/modules/nixos/hardware-setup/backup-archive/README.adoc
@@ -0,0 +1,5 @@
+= BorgBackup setup for the archive
+
+It's a NixOS configuration that configures my basic BorgBackup backup battlestation for my local archive.
+Not all of the required files are here (i.e., the SSH key used for Borg).
+In other words, if it's not yours, don't attempt to activate this setup.
diff --git a/modules/nixos/hardware-setup/backup-archive/borg-ssh-key.pub b/modules/nixos/hardware-setup/backup-archive/borg-ssh-key.pub
new file mode 100644
index 00000000..10c413ac
--- /dev/null
+++ b/modules/nixos/hardware-setup/backup-archive/borg-ssh-key.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ1IdisweU/qW+Np36K1WoR+RsPSyG6JcLNp96m1rDWx foo-dogsquared@ni
diff --git a/modules/nixos/hardware-setup/backup-archive/default.nix b/modules/nixos/hardware-setup/backup-archive/default.nix
new file mode 100644
index 00000000..67209506
--- /dev/null
+++ b/modules/nixos/hardware-setup/backup-archive/default.nix
@@ -0,0 +1,114 @@
+# This is my external hard drive with the backup setup with borg.
+{ config, options, lib, pkgs, ... }:
+
+let
+  cfg = config.hardware-setup.backup-archive;
+
+  borgJobCommonSetting = { patterns ? [ ] }: {
+    compression = "zstd,9";
+    dateFormat = "+%F-%H-%M-%S-%z";
+    doInit = true;
+    encryption = {
+      mode = "repokey-blake2";
+      passCommand = "cat ${config.age.secrets.borg-password.path}";
+    };
+    extraCreateArgs = lib.concatStringsSep " "
+      (builtins.map (patternFile: "--patterns-from ${patternFile}") patterns);
+    extraInitArgs = "--make-parent-dirs";
+
+    # We're emptying them since we're specifying them all through the patterns file.
+    paths = [ ];
+
+    persistentTimer = true;
+    preHook = ''
+      extraCreateArgs="$extraCreateArgs --exclude-if-present .nobackup"
+      extraCreateArgs="$extraCreateArgs --stats"
+    '';
+    prune = {
+      keep = {
+        within = "1d";
+        hourly = 8;
+        daily = 30;
+        weekly = 4;
+        monthly = 6;
+        yearly = 3;
+      };
+    };
+  };
+
+in {
+  options.hardware-setup.backup-archive.enable =
+    lib.mkEnableOption "backup setup with BorgBackup";
+
+  config = lib.mkIf cfg.enable {
+    assertions = [{
+      assertion = config.profiles.agenix.enable;
+      message = ''
+        Agenix module is not enabled. This is for the borgmatic configuration
+        we're using.
+      '';
+    }];
+
+    age.secrets.borg-password.file = lib.getSecret "archive/password";
+    age.secrets.borg-patterns.file = lib.getSecret "archive/borg-patterns";
+    age.secrets.borg-patterns-local.file =
+      lib.getSecret "archive/borg-patterns-local";
+    age.secrets.borg-ssh-key.file = lib.getSecret "archive/borg-ssh-key";
+
+    fileSystems."/mnt/external-storage" = {
+      device = "/dev/disk/by-uuid/665A391C5A38EB07";
+      fsType = "ntfs";
+      noCheck = true;
+      options = [
+        "nofail"
+        "noauto"
+        "user"
+
+        # See systemd.mount.5 and systemd.automount.5 manual page for more
+        # details.
+        "x-systemd.automount"
+        "x-systemd.device-timeout=2"
+        "x-systemd.idle-timeout=2"
+      ];
+    };
+
+    services.borgbackup.jobs = {
+      local = borgJobCommonSetting {
+        patterns = [
+          config.age.secrets.borg-patterns-local.path
+          config.age.secrets.borg-patterns.path
+        ];
+      } // {
+        doInit = true;
+        repo = "/archives/";
+        startAt = "04/5:00:00";
+      };
+
+      local-archive = borgJobCommonSetting {
+        patterns = [
+          config.age.secrets.borg-patterns-local.path
+          config.age.secrets.borg-patterns.path
+        ];
+      } // {
+        doInit = false;
+        removableDevice = true;
+        repo = "/mnt/external-storage/backups";
+        startAt = "daily";
+      };
+
+      remote-borgbase = borgJobCommonSetting {
+        patterns = [ config.age.secrets.borg-patterns.path ];
+      } // {
+        doInit = false;
+        repo = "m9s7d92s@m9s7d92s.repo.borgbase.com:repo";
+        startAt = "daily";
+        environment.BORG_RSH = "ssh -i ${config.age.secrets.borg-ssh-key.path}";
+      };
+    };
+
+    programs.ssh.extraConfig = ''
+      Host *.repo.borgbase.com
+       IdentityFile ${config.age.secrets.borg-ssh-key.path}
+    '';
+  };
+}
diff --git a/secrets/archive/borg-patterns b/secrets/archive/borg-patterns
new file mode 100644
index 0000000000000000000000000000000000000000..ea77c67aabb88234de333db915b07cf2ae0112ee
GIT binary patch
literal 1831
zcmZY7`CAhQ9>;OPA|)b-rIm_e#Hv7yxhE4Z%zeyE!sJfmia95QT$5yycmaJ-o(J1<
zJZcr}ZiQ-FML_VWcWs|_7h76cT1C+cTCG)JZ7W`jb=UpX{R>{-_viUqoOY_+YYoQy
zA<XAp;R`xx5eA96mW<;rs@=xqa2Pyt2&-TP_+&2)(*YGuW6Udd+kASp84^mA+<;vu
z_Eab$Y7~om?H<ey$HhJp-&m=ogfSlm39S4$OC|;oCQ%{e$N;rRR}tl~F<J!S#sII#
z`Ko3XLSeg;OecgMVTi{e{6r)`hphrF!s8k%0v3=#@xc^3D0j<HuNz@&#U!5ItVG;V
zw?!$5%HRs7TfjkVFn0q%SK(R_0U%ah7?pBhky-buhN_^DjZfadjfO$3L>wlBh%%}d
z`=l0Ej3K7ME)5i>G1y*Q9`o1~s6H+y>6{Xq+u$L%F^7Y1#gHNqn~3P*AP|QMX3)<C
zH3XtINlk1I{Z&n^Gn@P<ndOknA}*m?ZZ+sMIGbe@m{F6>!(jX36g)&>isDgEB&Mn~
z3UN}@1k(ZzA?Al*C@#=5;}VWVB?(u$tY%oCjp-GYI+G?SH93v{w<Myr=qOIIQtJun
zC^AY64k9>9C9A{(AWsRq<p2gFVnkpz5FuS<1<ugXN#3A_Vzm%D9p4@|_(g!6ivw!9
zSQ!Q(1rBmuC<E2|qal;khQHe83c*5*Amf<UK&UxVX_U^83;clA=u!9y4c*`|Ky-##
z8zn$W42+6xbUBGF(;5LB62nRZ2Q#{@Ql^^DRS2QD-6T;nP@2KV033*#sdQTZr?~?w
zeQK&RXt&^YvX@-wqC!PvAD>q0V3Jfg%LG%*FMB;qsfb~;I7KkX<QFN-91UNA1nmqx
z7If<9DzPg<P}B(10s>qYU4hDQokFQKll=OKI?f6sQndw9`%QXO1JINn6oLF)w$P0D
z<QAz*%NK=FpO}frF@^#X2b6|@K_v?KG({8&$>)E0B$Y~LaozrxKN{BCgt(I%gDonk
zf?$XA_BaHwF+J{-;k-B#<h-mP_0*5n8)9tcoExhP+1RH|_RgJEn}@R3RZaNCE%ot-
z!@Er{s%poIo!=9EP{Vo-_p6cgs~513HZIH{5&Ea4&$Dd*8AA<cGl*@-nX+9;neLp~
z;ns<3x5tLjriPQ<y+?xEzPQu;$+d8*BjxH;vg+I)<%!wo`JH<J`@oF#qvNM%x0WAx
z7Rzk2DidVKlWtBdoLJnZtUO|K+&hu^;MY`cy=5jno4;vr$N?Nm_djfLy%@;9b+hhB
zO>py!=eN$iR}wEhv+CnDQzLom6Zb!AoV<2$XVsj{bt|`Do<rj`KFXeX3~Ri<zOZH+
zbIa5Uf0F*>zJ}ta=H@cxz(zsmcW?Ys*l|2d3C2%ey<cU?8|!5QcP=d0#Ocqu)#uxK
zu;fw8mb8sq4;D{Wb@r#3Za?N<r}2gJhFJwSrvKCh>`PktL(Ma#7Rhhjd$e?{8EtLq
z%Aw;)+QH-{&uVwS1!%~3QeS&hG^d_X@(90OHrQdj7@Lw0d2F9AAunC`uimFeJIxHe
z7r2?4J<mB;*w<;?HSut7!_xyfbRua%Zco0eXVF$b`q>}Gjy1MhpChLu_{i9!+78K^
zA9VITZOLN(-nH)?uw6>}xuH0E4(m-^KBG)tvv{0W{nOiv{;{CLmTVg@icV|861JN&
za$Aep%N%1zoq;zjf+hOzpWN<Rwrsv&kcoIAq}3<BnKyRw%=-oX`3ITZ-@V-(&&oTD
zoZ;m3Zkm>G*V3N#wR3jql}|!-gOu{b_F^nJ|N4hze;)e#hQFlMuB{H;TiyEPRC5g}
zZF*Yikn&-QBg!oR-+BMFSr-SV@)EzT9)hbLd^)Zwmfw3U`Qh+T!Rel!A6ZKrJ5F_-
zA5OL=+}$Ip@?2jrx+)i5-a9&eR-Q#Ib1+oeFBdL8>%MVz=25Uvxp?iO#H?d~O#s^`
z_MS@m^^*9#*WKsBPrkl1IsHLR-CFzpx59N==&_`yV`&+>-n#tT3#n~~Tclloo7n+$
zLnA$hmhPWFZKS(8b?<0O@(1b1kS#}WO8zg?pEuR%3*4d4IKQRSO18l0dDX@7tA_{k
zOQc14wR~IT%XOt=zf<Q9X6-mF6JANIP7x!g2J%a;Y%doqf|d6&<WcQ?&#D!Np3R!I
zMy2WB(bo0NhsTGXb93*yR_@D~Oe~>Z$_(eez9+5l@=)-}X0*ThvTW`PoU);v)g1Kw
tRu1k;n;iM)?*033@<u=IZ+wvQV>&Mj<Tn1?hYkGu-NYGxIu3~B{{;&P+p_=w

literal 0
HcmV?d00001

diff --git a/secrets/archive/borg-patterns-local b/secrets/archive/borg-patterns-local
new file mode 100644
index 0000000000000000000000000000000000000000..e91a84309353fc3953b4633c5c9ab3129b729931
GIT binary patch
literal 2166
zcmZ9~`9Bm00|xMr)aW3|3TsrZ7&BwcnAx&xW|;dv%t07)Gxvd+YWH=dB07|9y^h$F
z(n*I3DJ5F1YL%-TwW%m6qEfuQzxEe=pU?9=BDoYK)rbuiok^+HglG+Na4Hl4`Wa|6
zDnL?6C>#z&0Zqyjm>vy;ig;$40!A<+s9Yf$N#jI8!~(h!!X?m60y&hXN+Qs3QG6&E
ziw5X<B3&|xkCP&)bUa!qPf1EghH`WQJxM~;q@s0vwJuytBhk#1l<zemmTZ>FfiMdh
ziBpAZc?=m<7)9kr(U=A#f<Q6~lu9U<kjh}t`2-`IodhEStSWxAoM9qLtQusHg1`<#
z5SSz=&CI59qWR)9Q#3I~jl$C52n_mrjY%h)BxoSS3}aD59Hxl`PUBj*cpWMFTYeQ=
zZ<VU>7C{i$l#+%~1z}<GFn}4UOwnV~Ehv`Jtl$v|CKF4oNKeKXXkaZ8rP8nrlyDX@
znE}HKzSme>p+Lt33RPIJKrN$FEC{BB8IukprkPZFB@&!&=AbpCB%LJ`3YVl>xiAQT
z#t~@=G%{1Kqi~bC1U-r;OhY9}jc8u9f~!tOQ;8B0AJ3C8!j0c+RF;SvBnO70SO|?-
zo*JfuGGu&ul3Dhxs33*{j4`KZAx136s!uYJ*(`XB5r7iFkdP>XKtzynEI7IdE9YS7
zsBnP^LQ|q7IAofPqJ|n^EFnModre`YV3lb=t{N_4p}rNO5gH&VT9Z(Q;FAP`WQ0OQ
zl;cojCYKmvurMiBH4=cNS+sCI4{C+!StOj1hYd{%Hz>ZH1fpUS7#I!7V$dZcX*jYO
z`G3v8kF<j12C2v>1@It7I9C~_4#lczU=)Oe##>bkEfbz9l&KM5yqRuQAh2p#G~?Ui
zAP_JnNY2HF=@mwGm_&@=BcmjE7?^@E#~|1!MQRYAr_qY(DMpyoN(GSRAV1OgwoG*H
zC8rDih3k;r>Fn;)3ElBejztgV<)8gPF+BX~dYY%M6R;Io;pKFbRMVjJXeSq(^nrI4
z{Wx_b5O#L{%{%4B$O-2RS9q=rPQvz=t=sACe`==P0nI;7KkWA^T{t<wewp2x?Oe9Q
z+pq_}(B;+QkCLNz%A|>-Ih<Zm)mCP4VEsv3-s}$%Q?;-20HMV$`ONqC_9UNaBkDzK
zIx=D?cPjUH?RM;cvHR>S*g8(A%xGEaG4Q03-7@j~$^nVKDD#nzXr}aVcyX2epunR(
z?lEx7+sSzL<NSf8*@JGqHKQjuB@?c8pFfJO{^#n-1MH+Tvoi3G+nX5uEZ<=yx3!P}
zxWC3r7+CQ9c3X8F;x{+Y;(dh;$J8tDF7KbU?Jl*?^T71)U0*v-oD1%vdo7+V3)p`K
zy?fR8&yP{vAty4g{^gP{+O%HEz6YBcdVKp>RYcRHT+amM?>k%eLKP0~V?UHE-M%PL
zyefCmT$V>P)%|Pvxg8GqLxVRlUoK3C#*aNKDIJ@-<u=)}W!FPB5L;1=_wk-6kg7dW
z59T?sdzaaIxtDh>D=(S$$m*S$h{e8x05`pCsbM><b-)C~9v$#ydZ*V80sEY?y{m@0
zJ~^MuEKoMv7k%!V0IAN6Ot}PH%=H4Qg1T%Rnr)s>_bgT9>lfx-iCR`{zjt#_eE6d*
zg0gn5^TY603qUw*8z8=%u*yHN>&}xbE8)Sfj|;RBCDXAR$cskufC_tET-b)ySJqbi
zvL^GX>xo8a@|uk|hSkbe*#gJbogT4$?we6(7T(!VSKhEq(z?QSSL}aFbk*8{tVnPo
z?3C)CMBl+XFP&VrUTkW^%3XXzE?;x!_@6JovBYm+DzOr=`OxRn1y6(91#UIBik=0`
zV<LL1(0V^Oqw{jOpV|2?qT_n`3?XG8K+>IC<g&Ig@&0kT-MZjQxCPYl45-cDAK(dz
zxa+WeuUiy6L}!d@C$&s<p{&k-WU{0Cyf}hYs6}&Zm_5#>JVyGy?WJPUuBoDmHR+o-
znci$vHaa&8a0PQJlByf{C(e2~FlPU$2CqZgdm^8D6zaNQ)pF@JXLz4ARG)J%!E)5+
zY}WQw1k#E2)C=ZQ2ia~dGoLy#`nU-tp0<C#wH(<2c5oS;vXIt?{5HX8agf#s`nFmE
zZ?ztoy)mGl`Z3YRc7(O0zIkOsE%+^D{#WFlWvyerxX%Ze-d9H28)|`N+t#1E*LChK
z&gRg7-Ir$3R&{-YB|A17$;kgwHIJnhx+!J$7N_$qO-JWKe!93DF-a`<cOD&U5!|P`
zo>)jz4I}Iv8y9PiAI=Voa3q&z{B_^|{mm>rHVK`bYtXxcbJp4{SbTkMUR*s&OwQ~e
z9jf?h21a4ynVmiKoClFbh}Q@HDJU1eDYp&WQP}Ue`Y5#_j0}A`c`aW1#~X<Mzdc)(
zWspyTj;064Dw`hI0V4Laz1si&moeOXyBtAZdtvv)IKZ=LVpZJ1_;*iZDTA`$i|g^y
zC0pLqgS2i(j{B3nvL9u>sEkeRz7k?v#meXli8%B58K`<41T@4E8;Y~kl&>X?e(G%>
zR|KzKeHOUlaP{;d!PRmn<<R7!^1~hZ2^h&AT<<v3Sl#HKS7-8bLW2XGE?q#658$nv
zZB3`egONi}7;!^;rSWdvGN@>>m)*nA6_zz4zKSaz`mkOvTJCeBw8>?{HI%;py=&Y<
z;I#su7w4U>_tn%!x{ZlL9et<&^&BVNdzTZ#JlK_G(?<Fg*h)(Gl-99N*7r-jp4Dz?
ji`czq`NrbY802zsS~LLHRUb$HeZu?E$TJOn<M96gqN<`J

literal 0
HcmV?d00001

diff --git a/secrets/archive/borgmatic.json b/secrets/archive/borgmatic.json
deleted file mode 100644
index 599e6807a89ad48c38737002da33c1c39b7602e7..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1773
zcmV<J1`_#UXJsvAZewzJaCB*JZZ2<fXD@a!3N1b$b8~1dWn?lnH8D9LQBO;BWI-TF
zMldjBT4!e~IYC!RXm?^yZd7kGGiX{;IaxC|Lv3eiMMp15Lu+I>MK}sgXhvyrW_mVS
zHC0GwY;r?VGjelfLo0S_X*OnhIb}*}LNhRQLqk=0YFP>`J|J^*Xf0)AGBq_ZIUrJ1
zT3K*WAVY0fQF>-^Mod>yVPsWJS9e%rX*F<2YH34wNHb+oYIJy3a#mwUGcQ;)3Tj6|
zD?xW<VliQOM?^4UX=*u4M_MyVPdPO?LP|MWLT+tYFjqokLNQNc3N1b$b8~1dWn?ln
zH8D9LT0={9WoIBSd2nM|G-G2~aARaeO)*9@Sz0(wNm^-9G*(GBN>ylYD`szFG)Q80
zX>STqY-vPnaXC{_OgA)AK{#eFZBs-sHAziDFi<&Ka8OTdS50GKX;EP@QCSKtJ|H$n
za7J8TEoX9NVRL05V0dOwO*n0C3Q#t1cW!oaXGUjDHA6u#PfbZRQFcs1cv5LqcTYl9
zPb+RTMrCO$bZtapXm&SCFhN;jdRQ`MOJp%wWn+3#SqfEHOF}DGM>laXG%-wacVkjQ
zLRmF3X9_JXEg&mFM0#RLYD-Z>O<8tpS65L=M@36#Hc3cLLQ{A}FL7u$ZAoHTT2U`>
zcM8_TOG%BCtneHmMs?5VAq_psQ?pzhE#XhB{)eQu8!9VpJvrSCqb<w^ppgL-FcLdX
z?cF5}Z5a8GjdM=6(I`a#F^t?;_XLxaoOb(>Ih*OoXO^6n<Lt){$}L_1Ij*T<V>!I!
zju5KaTLK#Rk88+f!M`#Wt__7DH_*&YA}}ZIHYX8G3C_2Ad1zT*{sPf83UI?`iQpjo
zrm30x@_|FT4vbk-hrF(e@tRfYa?Y0M!g}8+w60XaGp{-Hr*ewZ%^|PMN*p{Gl6$Wu
zQ|NOHb`cvJYtnd>(I>B^(5HcAfpXR8S*C|mSD0?}JQ5<K0;MqRH?ii=rmI2+pU^W-
zp~S?n4+4VXAblmj7(l<a)AR;PL#3=z!%K)`AmJMpLatWUrrz6>QGAU>8q^0LtEO_^
zIRl^iR23!vVq?raW1BH!e{J8@3ZA`y9=j^+&T_5J^S}K2KYt{|H`yJW0dPFfRzRd^
zYWQ*orr{;)h$COtDLbetO{bInUi;1*Phu<R%0EF^Uw368UbFQy`a9T+KDKu(gO<ql
zI`>NJ&L6mT@pNORh@l$m5G6>>%=z^Ztr)bKU~7J~(E`E*90os6ze5Je9(a0lRg;(T
zr3GIl-Br>Org{VPH7K(TklnhGwa`;dP@gEfWKluYTEDx|-w*%}NnOC22`DTd6hxIo
zO0SDKjoIENl<r!f4&?;w@X;Z=cOABFe&qClDhiPPI7H_rlPE<VOjcEXM7^7)Wv6xH
z*}Z!%g*R5(ku_4mrrG!!!aWdk6<61K^c6clXp3-fLdjI`Yca#YL-BD8g4Q<%=Kr;4
z24<mcIRX_<@BRineyaq&HpRYkjI~>nj^%5+VeLX1l6<SHXX@eLLT;hVyTely&^8w9
z6rw47DJ3+OMO71l_VSQI$KD7VYbNP#+>)!2mkOq;l%;dg=q${dWFDSDr=WoI!O@!5
zqrY@ySnrlm7adbFmW7T?4bH|WDHrfS18RzO;q0M-j%@D^eiVlWrrlKyE)z(*$f9OE
z&vAR&#v)*Db1zDgLgFO?8*PL%Ayh&=Hz)~jQwD@rTjnPiZO~+yku6vGgpPaB#XnwX
z+*<v)sq>wM|I`#vVoFv5h+Y~_1ia-FaH8>{h1DASCbR<INC16>Mj<xrZd|^MwLt%#
zHPb)dG?56);&IM$AY&vOnulTHdVk3*x+$;wO&O}5OjB8|cLA+?VP&gzXS3*j+-KL2
z-WS^9CYhW&vN^zrj-_d^z(3sZlKtZQD4IDkiZvNI1Tc37#g8WcVsG~v{rr|q$Kre(
zP)}Smt?~G$*-BF<;5vi-U9n50op81xW-(^S^=|rSb4@H;`Cy`Tsh9^hi@P7Uo4b{s
zkOA){KWKI8Y{YI`=L_<lf+O%1E#09A?Ixu&0zHC4I~3LzQSf+cqYSzodWRSPUMgzd
zp`sHlVC-3*g%QkHf!rqYmEeZp`BJ9JhAV1HJK;6)bDV$X0{9|1)x)4RyuxXxpALGY
z?Wi7yHDvVyp{SXrB0j9_fs$(y&BPBG9~(CB$V;#0tt+0yfCeJQSc8Oh#Pdw4-We#)
zSwyp|@5AE2_^d2zC&kvIA#M&+Jr7wr8PRJKssX}L%)mueRJENH-TbANOJXgD_^yVM
P1gZ6Lx`Eh)cl<xB3V#WR

diff --git a/secrets/archive/key b/secrets/archive/key
new file mode 100644
index 0000000000000000000000000000000000000000..1bf68bca175363c8907ef6b2cf4b3b25651e6583
GIT binary patch
literal 1680
zcmZ9~`%@DK0>E*xIATEM<SL#VHWnYy2qDRa1bQ$R@*pA4O?Eer3MI*Ic9ZOGUYl$-
zdiB%}IEuDKiU(?8II-fL)l=!f`2ancYh`R{OVyr;?^?C3t@VYr$Mt^YFZj%N=Ih3>
zVvP1ixiI4o(IufME=-7c#Z~-Rj3~xXu~aH5=QIAGB%<KUX>S4&Gqp@K0aphk00ii4
zZY~9-6cko%@R}_FTx^Vc^*Ev6Nm+-yG#(<OGMzCV6ZrfZgR2yXOVw<tM<_5QX_b|e
zVR|K?4^7uxN_`x|`A{+xPXbn@Q<!8e4n@G_GQl+=L?lJcR?O`pC=x+kHdx9~PM#f3
zsY|s%6Rm;-wY1-$vG}0?48)>Z&<5d#h(H%~_$W7K!13uCXx1~Rg3tQAI#e2p00@hP
zeVj-KBJpSnjYjlgpRNW{fIiSsOVe?sLcs%rF%gEy9V!KyvPeO)%;sREtlZ>qX*olH
zvIY^m#t2ZL&1#&kSz(tm4D#&+kqA>9Cgu#Z45*DM?Q9Y=VTKgqw9~qv7841QBups`
z;vf$Ju($<}gEbfs^m-_dM9i8X)~fRnoI>j_)dR3GY>DciRGgiz8Le(ufb*rQ2oA_8
zxmgZ~lOl-#hakoy)k;LcYAamLcx8y!<2Cz<a#qcgBo&^7o@1@3fYnJ7!m<eID-$D#
z)hGf2Dny_(d(ep98lW8Tbd6vPN<Yg7xi~3g<Oa2yiz9%_5T+R{T5X46%Ajz?Qe+Kn
zVk7~ZMy!T;T8CGQ+g%zlsUhK73RHl44d;{^#Tu|I43~N+XAEFt%8-x*{;!pk1f1?-
zJc_wv7+;e#q7sziuZ{+J)k3wKsHT72!vi@iXiz~|k^&@IV^s##!l2D;av^@ZGsFZ5
z)J(f#I+pTr5x6`M1PH<+0$n_@55v@mF~q5U%_=VDYay=*)Rc>@F0<A~kP%R+kvnWI
zQtb?sL!hh-5&NJRs~{K%;Ptm08J}0zgRb9$j}G2nJNf4KJ4!A-7F<fpn2oxYoqAvx
zdZqp21;et--jT__TE5#T+{L>-#1GNWw^41sJ+bnxcZsjyk}d7YXN$h;yZjoHef4Uw
z{aPc{ckfVFpJ1l$;tTuN{IuxLFU(r}_Q4zLKWQ!A_-V(P@s0uCm6J!a*H}O6{KWLq
zRw%#xdXH+2Eb-#-+;_4o4v$4EUtN~-;L+bB@wCEg9}Wy}eXuK2)$;hq((fDJ&wAZb
z_Tmh#%74EKzf03r@yEkYb`BWV{qfT9FS8bG8X1q}6R(eroj!UofDbO)-dQ)a_N}$8
zzNgJwChPk$vkSc;Pe-Ppee~ZG8KZd;=b47#vE}6bgZ?kjhkfPnRP*QQ=>;bzse&7k
zzMnss_pg2D`bWaI<p);O&jNNn8CbgH+lgb<bfZ&zbg!rVR&?aQ-}ZmqUDL}|t_?1%
z3lEAPsn2HK^fzCFP8H7U7w(?DGI?D3Mr-cqS5V!nZ~ft;u6BH`^W}_Nb0)ih)BbM)
z`DbqLJ3sT?ysW2fHx5`VoxbPIeWOL|+B+nNP952^eCLtQLRnkoxwB7`7pSJ=hr8Zx
zbhXqHLwUOqe1dy~kIdh&>`&vrFB*%Ow&eYIezUwncA#oZi$JTEOik=Nxx$!Fyt6ZJ
zdBcvGQ@slseoA}q%iMojgm*Sv7fhbsRhRa8R%uoLUPYE(Kj-n?)yVkn4Is0=b=__*
zayv8ULc)8s*VBEYY3?nN9DO)|OXoLLmR-2Jx2Cssea@%A>V@tu)R+Dmu-T+<11o^B
z8O<-bsh(Jy?evVq#T``Y7>_;iLHp+JTfIvczHt;B=D(@@&9m)ya^7EEUj#Ljv~N#f
zS!BjS@8bR0<ix0Z=Fg2&ztjqcD0zkI!7KSiStmA;v2D-Dr_tPb_~Dz6(~Nk+*!>XR
z^Wox**h5e2Wu$|7_r%76_cAv@iv(HqO~!M%Ximw!J*VR5GN}KIoo}Pbsmd+0hpznX
z%O8sB<~pZPdE=^R_t3GDE4o;x=Zo}>J<Rdn)i2)K-TSO1WIy<iPGN47(zv-m`Sqa&
zY168u=J4!6((r7KVDP}U4)2Qj+R!)q0Vv&Ry7~Nv-ip6SzG}SpQAc6jol8xQvsZgs
HoGbqato^R~

literal 0
HcmV?d00001

diff --git a/secrets/archive/password b/secrets/archive/password
index fb261cbe7c46f7bb6514f575c1bfa47af0d1fd30..d5bc28799065be69e151a050df65475a47f3a997 100644
GIT binary patch
literal 835
zcmZY4yQ<S*007`cK>~t<AZ|e?jkRqqZ6hM2Nt5Q<+)vU)n&i**G--1^sjGv7n~OL(
zIfyzq2rlB_a%M*#K;4`KbrIL&6MTG|2n;~(m;J6ziu`s_M#FXt4er5J6%Rmw62zE<
z>m<YW6pZ3VePTGe-Ww}N4nWefb>LRk)C5fvu2_@Nyd{GN2#rIg6i*K#Ips`{%qt<<
zkb8mHY#Vn%Z(XjhQlGH2C>l=E(OGRxiw%h2DZ4&+RH#|G=8E*16o+bxVhP<Xj^=be
z<=0qpTwwls!}5@>h2GW$))KHRGox)*Fe#3RIDrVLO4TGrk(az`^fsQI)wGpZ2NX=_
z0PE^lb|q6%kuaz2*|yN-VL3EfUiCX;t!u_8n2;C_?czk>>!sr&c$d+hN;Z1E0@>2*
zwO(k25@&(4ING7!(c-M8TWfcx!Ll#sBoT9yG41)ASsL@6$Trg$&>Gn96F0%*e2%s@
zc{GBmf*_8aN>vy_=MLP#6qr(6;Yw&3B~Tc(Ke%a4t>QfWPm}eHg+y@4Bdm|nL6Y(4
zIF9yG=!LA+Gqnh6I}AlCElmgA?YCS8?G?*1mPx9&ERj*D>@u^wRS=Ba8i|O^8%H0-
z5?VHDSe(7ZwL~W!ysUizS%oFBGtf5d15EGB89o;J%}E^RLpNY$Gi6#n=L!gQNJq&t
z!)Gzoq}HX->C=#~=aR;Gs513=A~g^{3yjGBr#;vXq7rN>0JTkNX(tXrvnXyCli30h
zdPai=g8{7KWZ~KVab2gwUDxf4E{cRU7&UWGm*`&QM@tn$7xrBDp|`sSH@>pymuFRQ
zU%vb9>g&6|&pp4ST)*=3!c+9+og3dSmLFd|djI5>{Q1p`YgbPHU=Lqj{`BMg_YXIJ
Noy-=e)Z6Cq>0cV{6runC

delta 472
zcmWmAxr)?a007_>7lmNGS`G_hF@#*^0uhsJ=GfdbIc9<=lVc{Ee>RE9<ey}>SZr)W
z5G=&f#$wSY5Jj=DSP;Y)&_b{g1noRfpWuV<&6zu!_b=YC3}qDw9kDg&e$r0s%=5|!
z6f>K0rjk`;PQy@RG28Q~LJ3K!O*CY(Lz^6LXLwJQ*oxTc`irSY>j$x+71G+IVVXdL
z(q+OF9^5>2{%DoVmNQ6a+Bobc%UyCm=whHPhQP@w64qd9Srb#=HF{))1Z@b?+HmvP
znpblXuk^8{a_fmuHF+6jBa6=Qxhd2b2N3jXr>YV(j!2p&_>M0rb-d^}b_jW9;2Yrr
zu-$=uaO4J_?ldkZ4oVCsSTXRtLQ#k;kr6Grl}EB65Bg;};_J)oToAeCGG+E{2})WB
z8QHADw$Rtke~whIxpKLUF3NaT#mLAYLY(us2^QzMT3db6^=$=XNHF%y1%jez2e@I@
zXk}VxystZhJvanIyw6S7QjaSFI#vzf*#Eld6||6#8$t7BJFPZ8UwL@%0`&+xewLp8
zbqSvP!<@a1ynMp{MEvg`?mqp!`Ss-W=*P)iye_}$etLhrbqJq-YuUH&Mvq_o1x-Vw
A?*IS*

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index af0d9416..7449beb9 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -1,6 +1,9 @@
 let
   system1 =
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG42LafAFOeh3oYz/cm6FXes0ss59/EOCXpGsYvhpI21";
+  system2 =
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHjRjAddjbyoM32tQhCjj8OrnqNBsXj+5D379iryupK+";
+  systems = [ system1 system2 ];
 
   user1 =
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMclb6WPpYRoMVqCCzQcG2XQHczB6vaIEDIHqjVsyQJi";
@@ -10,7 +13,10 @@ let
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIytwsseYS6kV8ldiUV767C2Gy7okxckdDRW4aA3q/Ku";
   user4 =
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGtn+t2D7clY1U1rzKcSCBJjNbuJzbRArEiM3soyFcnv";
+  users = [ user1 user2 user3 user4 ];
 in {
-  "archive/password".publicKeys = [ system1 user3 user4 ];
-  "archive/borgmatic.json".publicKeys = [ system1 user3 user4 ];
+  "archive/borg-patterns".publicKeys = users ++ systems;
+  "archive/borg-patterns-local".publicKeys = users ++ systems;
+  "archive/password".publicKeys = users ++ systems;
+  "archive/key".publicKeys = users ++ systems;
 }