feat: mirror cld var backups to prm

hosts/AZ-PRM-1/services/backup-ingest.nix

@@ -0,0 +1,25 @@
+{pkgs, ...}: let
+  backupUser = "backup-ingest";
+  backupGroup = "backup-ingest";
+  backupRoot = "/srv/veeam-ingest";
+  cldBackupTarget = "${backupRoot}/AZ-CLD-1/var-backup";
+in {
+  users.groups.${backupGroup} = {};
+
+  users.users.${backupUser} = {
+    isSystemUser = true;
+    group = backupGroup;
+    home = backupRoot;
+    createHome = false;
+    shell = pkgs.bashInteractive;
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL6FhMvJqh7m+AfC5yeHUIxhEvalSoA5OzqtDVstuAX1 cld-var-backup-sync@AZ-CLD-1-to-AZ-PRM-1"
+    ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "d ${backupRoot} 0750 ${backupUser} ${backupGroup} - -"
+    "d ${backupRoot}/AZ-CLD-1 0750 ${backupUser} ${backupGroup} - -"
+    "d ${cldBackupTarget} 0750 ${backupUser} ${backupGroup} - -"
+  ];
+}

hosts/AZ-PRM-1/services/default.nix

@@ -1,6 +1,7 @@
 {
   imports = [
     ./containers
+    ./backup-ingest.nix
     ./azion-scheduler.nix
     ./bpi.nix
     ./n8n.nix