nixos/modules/restic.nix

{
  lib,
  config,
  ...
}: let
  cfg = config.services.resticConfigured;
in {
  options.services.resticConfigured = with lib; {
    enable = mkEnableOption "Configured Restic rest server service";
    rootDir = mkOption {
      type = types.str;
      description = "Path to use for storage";
    };
    port = mkOption {
      type = types.int;
      default = 8000;
      description = "Port to use for the rest server";
    };
    openFirewall = mkOption {
      type = types.bool;
      default = false;
      description = "Whether to open the firewall for port ${builtins.toString cfg.port}";
    };
  };

  config = lib.mkIf cfg.enable {
    services.restic.server = {
      enable = true;
      dataDir = cfg.rootDir;
      listenAddress = "0.0.0.0:${builtins.toString cfg.port}";
      extraFlags = ["--no-auth"];
    };

    networking.firewall.allowedTCPPorts =
      lib.mkIf cfg.openFirewall [cfg.port];

    # TODO: This should be moved
    systemd.services.restic-rest-server.unitConfig = {
      Requires = lib.mkForce ["network.target"];
      After = lib.mkForce ["network.target"];
    };
  };
}