From ed4145090897bf10079950e6a2e26d0cabc3d04e Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Tue, 25 Aug 2026 19:06:35 +0200
Subject: implement git backup service

---
 hosts/tower/web/git.nix | 41 +++++++++++++++++++++++++++++++++++++++--
 1 file changed, 39 insertions(+), 2 deletions(-)

(limited to 'hosts/tower/web/git.nix')

diff --git a/hosts/tower/web/git.nix b/hosts/tower/web/git.nix
index 249b8ed..e46eb90 100644
--- a/hosts/tower/web/git.nix
+++ b/hosts/tower/web/git.nix
@@ -1,7 +1,7 @@
-{ config, ... }:
+{ pkgs, config, ... }:
 let
   # secrets = config.sops.secrets;
-  domainInternal = "git.sorre.internal";
+  # domainInternal = "git.sorre.internal";
   domainPublic = "git.sorre.xyz";
 
   commonSettings = {
@@ -59,4 +59,41 @@ in
     };
     settings = commonSettings;
   };
+
+  systemd.services.backup-git-repos = {
+    serviceConfig = {
+      Type = "exec";
+      DynamicUser = true;
+      Group = "cgit";
+      StateDirectory = "backups/git";
+      StateDirectoryMode = "0700";
+      Umask = "077";
+    };
+    # TODO: figure out how to check for in-progress transfers and handle that.
+    description = "Back up git repositories";
+    path = [ pkgs.gnutar ];
+    enableStrictShellChecks = true;
+    script = ''
+      #!/usr/bin/env bash
+      set -euo pipefail
+
+      TIMESTAMP="$(date +%Y%m%d%H%M%S)"
+      BACKUP_PATH="$STATE_DIRECTORY/$TIMESTAMP.backup.tar"
+      echo "Backing up git to $BACKUP_PATH" >&2
+
+      tar cf "$BACKUP_PATH" /var/lib/git
+      chmod u=r,go-rwx "$BACKUP_PATH"
+
+      find "$STATE_DIRECTORY" -type f -name '*.backup.tar' -print0 |
+        sort --zero-terminated --reverse |
+        tail --zero-terminated --lines=+6 |
+        xargs --null --no-run-if-empty rm --
+    '';
+  };
+
+  systemd.timers.backup-git-repos = {
+    description = "Back up git repos every morning";
+    timerConfig.OnCalendar = "*-*-* 05:00:00";
+    wantedBy = [ "timers.target" ];
+  };
 }
-- 
cgit v1.3.1