add offsite backup support to borg

modules/homelab/system/backups/default.nix

@@ -31,6 +31,21 @@ in {
       default = "/holocron/archives/homelab";
       description = "path to take daily backups to with borg!";
     };
+    offsite_user = lib.mkOption {
+      type = lib.types.path;
+      default = "lifeboat";
+      description = "user to connect to offsite host with";
+    };
+    offsite_target = lib.mkOption {
+      type = lib.types.path;
+      default = "/holocron/archives/homelab";
+      description = "ip or domain for offsite backups";
+    };
+    offsite_dir = lib.mkOption {
+      type = lib.types.path;
+      default = "blake/archives/homelab";
+      description = "path to rsync offsite backups to";
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -48,6 +63,13 @@ in {
         systemctl start mysql-backup.service
         systemctl start $(systemctl list-unit-files 'postgresqlBackup-*.service' --no-legend --no-pager | cut -d' ' -f1)
       '';
+      postHook = ''
+        sshpass -f ${sec."lifeboat_rsync".path} \
+          rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 \
+          -e ssh \
+          ${cfg.backup_repo} \
+          ${cfg.offsite_user}@${cfg.offsite_taget}::${cfg.offsite_dir}
+      '';
       extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
       extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
       prune.keep = {
@@ -77,13 +99,17 @@ in {
     };
 
     # helpful and for scripts
-    environment.systemPackages = with pkgs; [borgbackup tree];
+    environment.systemPackages = with pkgs; [borgbackup sshpass tree];
 
     sops.secrets = {
       "borg_passwd" = {
         owner = "root";
         group = "root";
       };
+      "lifeboat_rsync" = {
+        owner = "root";
+        group = "archives";
+      };
     };
   };
 }

secrets/secrets.yaml

@@ -6,6 +6,8 @@ klefki_auth_map: ENC[AES256_GCM,data:u8OBLtT/,iv:THW21BDyhyFIjcwixsAnaAODofxbuQZ
 tailscale_authkey: ENC[AES256_GCM,data:SqBbzV43arnLJZX0bnCZZGqO3jAKXBPZvIe6lqtf8L8RtqVNPvhxzeHR3Nki5LoSd7f3Za01puBAwpZY2QQ=,iv:f3jNCmrQrWsD2cvB6Ji8H0Ez/kpZ+4K9NIEhGfKU/N4=,tag:ej1gW8fBhAd9j53G7g8/HA==,type:str]
 #ENC[AES256_GCM,data:bEbCic+ZDAA5ieNedCbiVbJrse17,iv:UwRYlis6NPB/RUcv+YnPxrGdbIcF4hrNiZt19YvWZNQ=,tag:m6PVlzPNnahX7X7KzMUj7A==,type:comment]
 borg_passwd: ENC[AES256_GCM,data:XOMJtr+DRs7xn5Iclc49iTzK9cFJyc/fSXJjhdKa9jdN,iv:YB8z7zNYjh6NpSxQb1TfPxAYUdzThdVfNZIe6tO5grA=,tag:bO6kZ3cLJDL4IQoWmGvRdg==,type:str]
+#ENC[AES256_GCM,data:b75Jb5eEKZQlzC6zYJhDNhOOwA4oetNp52J7kE7eCpA=,iv:yNq/pYLtzVfqItBG9peGd0NtL7PkVkaKI8jpzAbWUo0=,tag:suibUsiuNkxrQqWumHTbXA==,type:comment]
+lifeboat_rsync: ENC[AES256_GCM,data:70R6bKLh21x9LjLE76o=,iv:jqAPg0TJ/CqxaCf8fqt8u+YN3JEzxhjJ+zb41Um7qF4=,tag:riDGORM6q0qXRHzB0JbXPg==,type:str]
 #ENC[AES256_GCM,data:NbXyRroLF2uxHjROnBg9OLQ=,iv:W9Nse9yamov3rflDKBeISO+miQkjH7QfBUZdsDmDM4I=,tag:/RmH3JyriXFxf0hEh9/iRQ==,type:comment]
 cloudflare:
     api_token: ENC[AES256_GCM,data:VuRwfZe1cdnQLvxlp9GCDOt9Ijhz4fh2yOev2wLOdLV+zw91blA3Zis2BRyI/ZwN4y+IhiqlpBzXCsoFqw==,iv:6Bt11zz1/slvszh9ZGQ0ov5ts0jAZIAMx3G2AimKIs4=,tag:tyEVhsKCGrJWm6yn+GUlUQ==,type:str]
@@ -81,7 +83,7 @@ sops:
             PRu+itNolpPTHm96pe+P93g2iP0wgekG0cX21wkiU2xaLF3dY2FEIA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age14gfh682a7m7jfp3qrulql03x5rs7yedwmxwksxrrmgjsunstyuksqx93pz
-    lastmodified: "2026-06-13T02:51:58Z"
-    mac: ENC[AES256_GCM,data:0UOZP1Tm52GgZsi7wUowoYKtno6tSTj2AK0lyB4ZzfpFq2RRloAxaMDVtykm/VLtHEm1sQKe7il0oyvPoiQ4ZFcOCX+rr+C0lSTdtw55X029H1dndL+wCeRo9P/qrDlq1scYt/RABspMwB6ZXPRdGD/oaWtAnj9aAOMad0Bz9SI=,iv:QDobOe+JGN5RJpRz1+9z1WEfd1Ph4C19QfR4z611Kn0=,tag:ULYYshFR8MronGNE3wxT0A==,type:str]
+    lastmodified: "2026-06-19T23:50:30Z"
+    mac: ENC[AES256_GCM,data:SchZtSlesZv0ee/peEXq5dTA0/DsSP9RxBAq/N9QHgqzHr/kj71vvGmZ+cM6QzX0UL/wOXwlNQHt0ougk3mZ21/+gHid5PDFz8uDxLPAxxNg0jXhqTFEJYcPn77CS6RiRgbzWV8KaktcNENTdSTSoNHKNNaJVSexh19WlWZSAI0=,iv:wzNECxd5L26CChou6bCQ+sZCVtKAuCWtsE9BeWf9cNA=,tag:JtdnZsHa0wWrxSUfmFaD5Q==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1