move runner to node

nixos/oracle/forgejo.nix

@@ -5,10 +5,14 @@ let
 in
 {
   sops = {
+    defaultSopsFile = ../../secrets/restic.yaml;
     secrets = {
       "env" = {
         sopsFile = ../../secrets/cf-acme.yaml;
       };
+      "b2-forgejo/env" = { };
+      "b2-forgejo/repo" = { };
+      "b2-forgejo/password" = { };
     };
   };
   security.acme = {
@@ -61,4 +65,24 @@ in
       };
     };
   };
+  services.restic.backups = {
+    b2-forgejo = {
+      initialize = true;
+      environmentFile = config.sops.secrets."b2-forgejo/env".path;
+      repositoryFile = config.sops.secrets."b2-forgejo/repo".path;
+      passwordFile = config.sops.secrets."b2-forgejo/password".path;
+
+      paths = [
+        "/var/lib/forgejo"
+      ];
+      timerConfig = {
+        OnCalendar = "*-*-* */6:00:00";
+      };
+      pruneOpts = [
+        "--keep-daily 31"
+        "--keep-monthly 6"
+        "--keep-yearly 2"
+      ];
+    };
+  };
 }