Refactor Tailscale and Restic Into Common Nixos Modules.

machines/lebesgue/config/backups.nix

@@ -1,40 +0,0 @@
-{
-  pkgs,
-  config,
-  ...
-}: let
-  paths = ["/var/lib/vaultwarden"];
-  exclude = [];
-
-  secrets = config.sops.secrets;
-in {
-  users.groups.restic = {};
-  users.users.restic = {
-    isSystemUser = true;
-    group = "restic";
-  };
-
-  security.wrappers.restic = {
-    source = "${pkgs.restic.out}/bin/restic";
-    owner = "restic";
-    group = "restic";
-    permissions = "u=rwx,g=,o=";
-    capabilities = "cap_dac_read_search=+ep";
-  };
-
-  services.restic.backups = {
-    s3 = {
-      inherit paths exclude;
-      user = "restic";
-
-      repositoryFile = secrets.restic-repository.path;
-      environmentFile = secrets.restic-env.path;
-      passwordFile = secrets.restic-password.path;
-
-      pruneOpts = [
-        "--keep-daily 7"
-        "--keep-weekly 4"
-      ];
-    };
-  };
-}

machines/lebesgue/config/configuration.nix

@@ -16,12 +16,21 @@
       signups = false;
       envPath = config.sops.secrets.vaultwarden-env.path;
     };
-  };
 
-  services.tailscale = {
-    enable = true;
-    authKeyFile = config.sops.secrets.tskey.path;
-    openFirewall = true;
+    backups.restic = {
+      enable = true;
+
+      repositoryFile = config.sops.secrets.restic-repository.path;
+      environmentFile = config.sops.secrets.restic-env.path;
+      passwordFile = config.sops.secrets.restic-password.path;
+
+      paths = ["/var/lib/vaultwarden"];
+    };
+
+    tailscale = {
+      enable = true;
+      authKeyFile = config.sops.secrets.tskey.path;
+    };
   };
 
   boot.loader.systemd-boot.enable = true;
@@ -30,7 +39,6 @@
   i18n.defaultLocale = "en_US.UTF-8";
 
   networking.firewall.allowedTCPPorts = [22];
-  networking.firewall.trustedInterfaces = ["tailscale0"];
 
   system.stateVersion = "24.11";
 }