nixos-config/services/postgresql.nix

{ config, my, pkgs, ... }:

{
  services.postgresql = {
    enable = true;
    package = pkgs.postgresql_15;
    enableTCPIP = false;
    initdbArgs = [ "--data-checksums" ];
  };

  services.postgresqlBackup = {
    enable = true;
    backupAll = true;
    compression = "zstd";
    startAt = "*-*-* 04:00:00"; # daily at 04:00
  };

  users.users.postgres.extraGroups = [ "restic-backup" ];

  services.restic.backups.postgresql-15 =
    let resticCfg = my.homelab.services.restic;
    in {
      inherit (resticCfg) environmentFile;
      initialize = true;
      repository = "${resticCfg.repositoryBase}/${config.networking.hostName}";
      passwordFile = "/var/secrets/restic/repo/${config.networking.hostName}";
      user = "postgres";
      paths = [ "/var/backup/postgresql/all.sql.zstd" ];
      timerConfig.OnCalendar = "*-*-* 4:30:00"; # daily at 04:30
    };
}