Move confess-web to its own file

caddy/default.nix

@@ -223,15 +223,6 @@ in
         redir https://catnip.ee{uri} permanent
       '';
 
-      "confess.catnip.ee".extraConfig = ''
-        tls {
-          dns cloudflare {env.CLOUDFLARE_API_TOKEN}
-          resolvers 1.1.1.1
-        }
-
-        reverse_proxy :${toString config.services.confess-web.port}
-      '';
-
       ":80".extraConfig = ''
         respond awawaw
       '';

configuration.nix

@@ -30,8 +30,8 @@
     ./services/pds
     ./services/gonic.nix
     ./services/youtuee.nix
+    ./services/confess.nix
     inputs.lastfm-status.nixosModules.default
-    inputs.confess.nixosModules.default
     inputs.common-modules.nixosModules.nixos-upgrade
   ];
 
@@ -209,7 +209,6 @@
         "/var/lib/syncthing"
         "/var/lib/matrix-synapse"
         "/var/lib/plex"
-        "/var/lib/confess-web"
         "/var/lib/influxdb2"
 
         "/etc/secrets"
@@ -247,13 +246,6 @@
       guiAddress = "0.0.0.0:8384";
       openDefaultPorts = true;
     };
-    confess-web = {
-      enable = true;
-      port = 8011;
-      reverseProxy = true;
-      trustedProxy = "127.0.0.1";
-      environmentFile = "/etc/secrets/confess.env";
-    };
     lastfm-status = {
       enable = true;
       port = 4014;

services/confess.nix

@@ -0,0 +1,28 @@
+{ config, inputs, ... }: {
+  imports = [
+    inputs.confess.nixosModules.default
+  ];
+
+  services = {
+    confess-web = {
+      enable = true;
+      port = 8011;
+      reverseProxy = true;
+      trustedProxy = "127.0.0.1";
+      environmentFile = "/etc/secrets/confess.env";
+    };
+
+    borgbackup.jobs."borgbase".paths = [
+      "/var/lib/confess-web"
+    ];
+
+    caddy.virtualHosts."confess.catnip.ee".extraConfig = ''
+      tls {
+        dns cloudflare {env.CLOUDFLARE_API_TOKEN}
+        resolvers 1.1.1.1
+      }
+
+      reverse_proxy :${toString config.services.confess-web.port}
+    '';
+  };
+}