nixos-common

Using as a flake

{
  inputs.nixos-common.url = "git+https://git.dsg.is/dsg/nixos-common.git";
  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
  inputs.nixpkgs-master.url = "github:NixOS/nixpkgs/master";

  # For autoupgrades:
  #inputs.nixpkgs.follows = "nixos-common/nixpkgs";

  outputs = { nixpkgs, nixos-common, nixpkgs-master, ... }: let
    nixpkgsConfig = { allowUnfree = true; };
    pkgs-master = import nixpkgs-master {
      config = nixpkgsConfig;
      system = "x86_64-linux";
    };

  in {
    nixosConfigurations.myhost = nixpkgs.lib.nixosSystem {
      system = "x86_64-linux";
      specialArgs = { inherit nixos-common; inherit pkgs-master; };
      modules = [
        { nixpkgs.config = nixpkgsConfig; }
        nixos-common.nixosModules.common
        nixos-common.nixosModules.kopia
        ./configuration.nix
      ];
    };
  };
}

Kopia backup module

Add nixos-common.nixosModules.kopia to your modules list, then configure repositories and backup jobs:

{ config, pkgs, ... }:
{
  services.kopia = {
    repositories."s3.dsg.is".s3Bucket = "backup-testvm";
  
    backups.system.paths = [ "/etc/nixos" "/var/lib" ];
  
    backups.home = {
      paths = [ "/home" ];
      exclude = [ ".cache" "Downloads" ];
    };
  };
}

Put repository password (encryption key) in /etc/nixos/kopia-password. Create /etc/nixos/kopia-s3-env with s3 auth:

AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=

Each repository generates a wrapper script (kopia-<name>) for manual CLI use, e.g. kopia-s3 snapshot list.