borgbackup: add check service

For each defined job, define a unit and a weekly timer that checks the
associated repo.

nixos/modules/services/backup/borgbackup.nix

@@ -98,6 +98,25 @@ let
       inherit (cfg) startAt;
     };
 
+  mkCheckService = name: cfg: nameValuePair "borgbackup-check-${name}" rec {
+      description = "Check BorgBackup repository ${name}";
+      after = [ "borgbackup-job-${name}" ];
+      conflicts = after;
+      path = with pkgs; [ borgbackup openssh ];
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        CPUSchedulingPolicy = "idle";
+        IOSchedulingClass = "idle";
+        ReadWritePaths = mkIf (isLocalPath cfg.repo) [ cfg.repo ];
+        ExecStart = "${pkgs.borgbackup}/bin/borg check";
+      };
+      environment = {
+        BORG_REPO = cfg.repo;
+      } // (mkPassEnv cfg) // cfg.environment;
+      startAt = "weekly";
+    };
+
   # utility function around makeWrapper
   mkWrapperDrv = {
       original, name, set ? {}
@@ -666,7 +685,9 @@ in {
         # A job named "foo" is mapped to systemd.services.borgbackup-job-foo
         mapAttrs' mkBackupService jobs
         # A repo named "foo" is mapped to systemd.services.borgbackup-repo-foo
-        // mapAttrs' mkRepoService repos;
+        // mapAttrs' mkRepoService repos
+        # A job named "foo" is mapped to systemd.services.borgbackup-check-foo
+        // mapAttrs' mkCheckService jobs;
 
       users = mkMerge (mapAttrsToList mkUsersConfig repos);
 

nixos/tests/borgbackup.nix

@@ -152,6 +152,8 @@ in {
         client.wait_for_unit("network.target")
         client.systemctl("start --wait borgbackup-job-remote")
         client.fail("systemctl is-failed borgbackup-job-remote")
+        client.systemctl("start --wait borgbackup-check-remote")
+        client.fail("systemctl is-failed borgbackup-check-remote")
 
         # Make sure we can't access repos other than the specified one
         client.fail("{} list borg\@server:wrong".format(borg))