config/modules/base/zfsborg/default.nix

{
  config,
  lib,
  pkgs,
  ...
}:
let
  mkPreHook = zfs_name: i: ''
    set -x
    sleep ${toString i}
    mkdir "$RUNTIME_DIRECTORY/snapshot"
    ${pkgs.util-linux}/bin/mount \
      -t zfs \
      -o ro \
      $(${pkgs.zfs}/bin/zfs list -H -t snapshot -o name ${zfs_name} | sort | tail -1) \
      "$RUNTIME_DIRECTORY/snapshot"
    cd "$RUNTIME_DIRECTORY/snapshot"
  '';
in
{
  options.mj.base.zfsborg = with lib.types; {
    enable = lib.mkEnableOption "backup zfs snapshots with borg";

    passwordPath = lib.mkOption { type = str; };
    sshKeyPath = lib.mkOption {
      type = nullOr path;
      default = null;
    };

    dirs = lib.mkOption {
      default = { };
      type = listOf (submodule {
        options = {
          mountpoint = lib.mkOption { type = path; };
          repo = lib.mkOption { type = str; };
          paths = lib.mkOption { type = listOf str; };
          patterns = lib.mkOption {
            type = listOf str;
            default = [ ];
          };
          prune = lib.mkOption {
            type = anything;
            default = { };
          };
          backup_at = lib.mkOption { type = str; };
        };
      });
    };
  };

  config =
    with config.mj.base.zfsborg;
    lib.mkIf enable {
      systemd.services = lib.listToAttrs (
        lib.imap0 (
          i: attr:
          let
            svcName = "borgbackup-job-${lib.strings.sanitizeDerivationName attr.mountpoint}-${toString i}";
          in
          lib.nameValuePair svcName { serviceConfig.RuntimeDirectory = svcName; }
        ) dirs
      );

      services.borgbackup.jobs = builtins.listToAttrs (
        lib.imap0 (
          i: attrs:
          let
            mountpoint = builtins.getAttr "mountpoint" attrs;
            fs = builtins.getAttr mountpoint config.fileSystems;
          in
          assert fs.fsType == "zfs";
          assert lib.assertMsg config.mj.base.unitstatus.enable
            "config.mj.base.unitstatus.enable must be true";
          lib.nameValuePair "${lib.strings.sanitizeDerivationName mountpoint}-${toString i}" (
            {
              inherit (attrs) repo paths;

              doInit = true;
              encryption = {
                mode = "repokey-blake2";
                passCommand = "cat ${config.mj.base.zfsborg.passwordPath}";
              };
              extraArgs = "--remote-path=borg1";
              compression = "auto,zstd,10";
              extraCreateArgs = "--chunker-params buzhash,10,23,16,4095";
              startAt = attrs.backup_at;
              preHook = mkPreHook fs.device i;
              prune.keep = {
                within = "1d";
                daily = 7;
                weekly = 4;
                monthly = 3;
              };
              environment =
                {
                  BORG_HOST_ID =
                    let
                      h = config.networking;
                    in
                    "${h.hostName}.${h.domain}@${h.hostId}";
                }
                // lib.optionalAttrs (sshKeyPath != null) {
                  BORG_RSH = ''ssh -i "${config.mj.base.zfsborg.sshKeyPath}"'';
                };
            }
            // lib.optionalAttrs (attrs ? patterns) { inherit (attrs) patterns; }
            // lib.optionalAttrs (attrs ? prune) { inherit (attrs) prune; }
          )
        ) dirs
      );

      mj.base.unitstatus.units =
        let
          sanitized = map lib.strings.sanitizeDerivationName (lib.catAttrs "mountpoint" dirs);
        in
        lib.imap0 (i: name: "borgbackup-job-${name}-${toString i}") sanitized;
    };
}