add offsite backup support to borg

modules/homelab/system/backups/default.nix

@@ -31,6 +31,21 @@ in {
       default = "/holocron/archives/homelab";
       description = "path to take daily backups to with borg!";
     };
+    offsite_user = lib.mkOption {
+      type = lib.types.path;
+      default = "lifeboat";
+      description = "user to connect to offsite host with";
+    };
+    offsite_target = lib.mkOption {
+      type = lib.types.path;
+      default = "/holocron/archives/homelab";
+      description = "ip or domain for offsite backups";
+    };
+    offsite_dir = lib.mkOption {
+      type = lib.types.path;
+      default = "blake/archives/homelab";
+      description = "path to rsync offsite backups to";
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -48,6 +63,13 @@ in {
         systemctl start mysql-backup.service
         systemctl start $(systemctl list-unit-files 'postgresqlBackup-*.service' --no-legend --no-pager | cut -d' ' -f1)
       '';
+      postHook = ''
+        sshpass -f ${sec."lifeboat_rsync".path} \
+          rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 \
+          -e ssh \
+          ${cfg.backup_repo} \
+          ${cfg.offsite_user}@${cfg.offsite_taget}::${cfg.offsite_dir}
+      '';
       extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
       extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
       prune.keep = {
@@ -77,13 +99,17 @@ in {
     };
 
     # helpful and for scripts
-    environment.systemPackages = with pkgs; [borgbackup tree];
+    environment.systemPackages = with pkgs; [borgbackup sshpass tree];
 
     sops.secrets = {
       "borg_passwd" = {
         owner = "root";
         group = "root";
       };
+      "lifeboat_rsync" = {
+        owner = "root";
+        group = "archives";
+      };
     };
   };
 }