Configure fafprod3 restic backups

machines/prod3/configuration.nix

@@ -37,6 +37,69 @@
       enable = true;
       extraFlags = "--disable traefik";
     };
+
+    #
+    # The password in /etc/restic-password is also secured in our Vaultwarden.
+    # This config requires an ssh-config for rsync.net for a username and host using <username>.rsync.net.
+    # Also, the public key of this root user must be placed in rsync.net (.ssh/authorized_keys)
+
+    restic.backups = {
+      backup_config = {
+        passwordFile = "/etc/restic-password";
+        paths = [
+          "/opt/faf/config"
+        ];
+        repository = "sftp:@rsync.net:restic/config";
+        timerConfig = {
+          OnCalendar = "04:00";
+        };
+      };
+
+      maps = {
+        passwordFile = "/etc/restic-password";
+        paths = [
+          "/opt/faf/data/maps"
+        ];
+        repository = "sftp:@rsync.net:restic/maps";
+        timerConfig = {
+          OnCalendar = "04:05";
+        };
+      };
+
+      mods = {
+        passwordFile = "/etc/restic-password";
+        paths = [
+          "/opt/faf/data/mods"
+        ];
+        repository = "sftp:@rsync.net:restic/mods";
+        timerConfig = {
+          OnCalendar = "04:15";
+        };
+      };
+
+      featured_mods = {
+        passwordFile = "/etc/restic-password";
+        paths = [
+          "/opt/faf/data/legacy-featured-mod-files"
+        ];
+        repository = "sftp:@rsync.net:restic/featured_mods";
+        timerConfig = {
+          OnCalendar = "04:30";
+        };
+      };
+
+      nodebb_uploads = {
+        passwordFile = "/etc/restic-password";
+        paths = [
+          "/opt/faf/data/nodebb/uploads"
+        ];
+        repository = "sftp:@rsync.net:restic/nodebb_uploads";
+        timerConfig = {
+          OnCalendar = "04:45";
+        };
+      };
+
+    };
   };
 
   networking.hostName = "fafprod3";