feat: add rest of the services to backup and remove direnv

.envrc

···
-eval "$(nix print-dev-env)"

README.md

···
 Services are automatically backed up nightly using restic to Backblaze B2. The `atelier-backup` CLI provides an interactive TUI for managing backups:
 
 ```bash
-atelier-backup              # Interactive menu
-atelier-backup status       # Show backup status
-atelier-backup restore      # Restore wizard
-atelier-backup dr           # Disaster recovery
+sudo atelier-backup              # Interactive menu
+sudo atelier-backup status       # Show backup status
+sudo atelier-backup restore      # Restore wizard
+sudo atelier-backup dr           # Disaster recovery
 ```
 
 See [modules/nixos/services/restic/README.md](modules/nixos/services/restic/README.md) for setup and usage.

machines/terebithia/default.nix

···
     ];
     allowedUDPPorts = [
       28869 # Minecraft voice chat
+      19132 # mc geyser
     ];
     logRefusedConnections = false;
     rejectPackets = true;
···
 
   # Backup configuration for tangled services
   atelier.backup.services.knot = {
-    paths = [ "/home/git" ];  # Git repositories managed by knot
+    paths = [ "/home/git" ]; # Git repositories managed by knot
     exclude = [ "*.log" ];
     # Uses SQLite, stop before backup
     preBackup = "systemctl stop knot";
···
 
   atelier.backup.services.spindle = {
     paths = [ "/var/lib/spindle" ];
-    exclude = [ "*.log" "cache/*" ];
+    exclude = [
+      "*.log"
+      "cache/*"
+    ];
     # Uses SQLite, stop before backup
     preBackup = "systemctl stop spindle";
     postBackup = "systemctl start spindle";
···
     enable = true;
     domain = "l4.dunkirk.sh";
     port = 3004;
-    autoUpdate = false;
+    deploy.autoUpdate = false;
     secretsFile = config.age.secrets.l4.path;
   };
 
···
   # Backup configuration for n8n
   atelier.backup.services.n8n = {
     paths = [ "/var/lib/n8n" ];
-    exclude = [ "*.log" "cache/*" ];
+    exclude = [
+      "*.log"
+      "cache/*"
+    ];
     # n8n uses SQLite, stop before backup
     preBackup = "systemctl stop n8n";
     postBackup = "systemctl start n8n";

modules/nixos/services/battleship-arena.nix

···
       description = "The battleship-arena package to use";
     };
 
-    backup = {
-      enable = mkEnableOption "Enable backups for battleship-arena" // { default = true; };
 
-      paths = mkOption {
-        type = types.listOf types.str;
-        default = [ "/var/lib/battleship-arena" ];
-        description = "Paths to back up";
-      };
-
-      exclude = mkOption {
-        type = types.listOf types.str;
-        default = [ "*.log" ];
-        description = "Patterns to exclude from backup";
-      };
-    };
   };
 
   config = mkIf cfg.enable {
···
 
     networking.firewall.allowedTCPPorts = [ cfg.sshPort ];
 
-    # Register backup configuration
-    atelier.backup.services.battleship-arena = mkIf cfg.backup.enable {
-      inherit (cfg.backup) paths exclude;
-      # Has SQLite database, stop before backup
+    # Register backup configuration (SQLite database)
+    atelier.backup.services.battleship-arena = {
+      paths = [ "/var/lib/battleship-arena" ];
+      exclude = [ "*.log" "battleship-engine" ];
       preBackup = "systemctl stop battleship-arena";
       postBackup = "systemctl start battleship-arena";
     };

modules/nixos/services/cachet.nix

···
   entryPoint = "src/index.ts";
 
   extraConfig = cfg: {
-    # Set DATABASE_PATH environment variable
+    # Set DATABASE_PATH environment variable (uses the data dir created by mkService)
     systemd.services.cachet.serviceConfig.Environment = [
       "DATABASE_PATH=${cfg.dataDir}/data/cachet.db"
     ];

modules/nixos/services/emojibot.nix

···
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
+# Emojibot - Slack emoji management service
+#
+# Stateless service, no database backup needed
+
 let
-  cfg = config.atelier.services.emojibot;
+  mkService = import ../../lib/mkService.nix;
 in
-{
-  options.atelier.services.emojibot = {
-    enable = lib.mkEnableOption "Emojibot Slack emoji management service";
 
-    domain = lib.mkOption {
-      type = lib.types.str;
-      description = "Domain to serve emojibot on";
-    };
+mkService {
+  name = "emojibot";
+  description = "Emojibot Slack emoji management service";
+  defaultPort = 3002;
+  runtime = "bun";
+  entryPoint = "src/index.ts";
 
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 3002;
-      description = "Port to run emojibot on";
-    };
-
-    dataDir = lib.mkOption {
-      type = lib.types.path;
-      default = "/var/lib/emojibot";
-      description = "Directory to store emojibot data";
-    };
-
-    secretsFile = lib.mkOption {
-      type = lib.types.path;
-      description = ''
-        Path to secrets file containing:
-        - SLACK_SIGNING_SECRET
-        - SLACK_BOT_TOKEN
-        - SLACK_APP_TOKEN
-        - SLACK_BOT_USER_TOKEN (get from browser, see emojibot README)
-        - SLACK_COOKIE (get from browser, see emojibot README)
-        - SLACK_WORKSPACE (e.g. "myworkspace" for myworkspace.slack.com)
-        - SLACK_CHANNEL (channel ID where emojis are posted)
-        - ADMINS (comma-separated list of slack user IDs)
-      '';
-    };
-
-    repository = lib.mkOption {
-      type = lib.types.str;
-      default = "https://github.com/taciturnaxolotl/emojibot.git";
-      description = "Git repository URL (optional, for auto-deployment)";
-    };
-
-    autoUpdate = lib.mkEnableOption "Automatically git pull on service restart";
-
-    backup = {
-      enable = lib.mkEnableOption "Enable backups for emojibot" // { default = true; };
-
-      paths = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ cfg.dataDir ];
-        description = "Paths to back up";
-      };
-
-      exclude = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ "*.log" "app/.git" "app/node_modules" ];
-        description = "Patterns to exclude from backup";
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    users.groups.services = { };
-
-    users.users.emojibot = {
-      isSystemUser = true;
-      group = "emojibot";
-      extraGroups = [ "services" ];
-      home = cfg.dataDir;
-      createHome = true;
-      shell = pkgs.bash;
-    };
-
-    users.groups.emojibot = { };
-
-    security.sudo.extraRules = [
-      {
-        users = [ "emojibot" ];
-        commands = [
-          {
-            command = "/run/current-system/sw/bin/systemctl restart emojibot.service";
-            options = [ "NOPASSWD" ];
-          }
-        ];
-      }
-    ];
-
-    systemd.services.emojibot = {
-      description = "Emojibot Slack emoji management service";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
-      path = [ pkgs.git ];
-
-      preStart = ''
-        if [ ! -d ${cfg.dataDir}/app/.git ]; then
-          ${pkgs.git}/bin/git clone ${cfg.repository} ${cfg.dataDir}/app
-        fi
-        
-        cd ${cfg.dataDir}/app
-      '' + lib.optionalString cfg.autoUpdate ''
-        ${pkgs.git}/bin/git pull
-      '' + ''
-        
-        if [ ! -f src/index.ts ]; then
-          echo "No code found at ${cfg.dataDir}/app/src/index.ts"
-          exit 1
-        fi
-        
-        echo "Installing dependencies..."
-        ${pkgs.unstable.bun}/bin/bun install
-      '';
-
-      serviceConfig = {
-        Type = "simple";
-        User = "emojibot";
-        Group = "emojibot";
-        EnvironmentFile = cfg.secretsFile;
-        Environment = [
-          "NODE_ENV=production"
-          "PORT=${toString cfg.port}"
-        ];
-        ExecStart = "${pkgs.bash}/bin/bash -c 'cd ${cfg.dataDir}/app && ${pkgs.unstable.bun}/bin/bun run src/index.ts'";
-        Restart = "always";
-        RestartSec = "10s";
-      };
-
-      serviceConfig.ExecStartPre = [
-        "+${pkgs.writeShellScript "emojibot-setup" ''
-          mkdir -p ${cfg.dataDir}/app
-          chown -R emojibot:services ${cfg.dataDir}
-          chmod -R g+rwX ${cfg.dataDir}
-        ''}"
-      ];
-    };
-
-    services.caddy.virtualHosts.${cfg.domain} = {
-      extraConfig = ''
-        tls {
-          dns cloudflare {env.CLOUDFLARE_API_TOKEN}
-        }
-
-        reverse_proxy localhost:${toString cfg.port}
-      '';
-    };
-
-    # Register backup configuration
-    atelier.backup.services.emojibot = lib.mkIf cfg.backup.enable {
-      inherit (cfg.backup) paths exclude;
-      # Stateless service, no pre/post hooks needed
-    };
+  extraConfig = cfg: {
+    # Stateless - no data declarations needed
+    # Files are just the app code which is in git
   };
 }

modules/nixos/services/hn-alerts.nix

···
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.atelier.services.hn-alerts;
-in
-{
-  options.atelier.services.hn-alerts = {
-    enable = lib.mkEnableOption "HN Alerts Hacker News monitoring service";
+# HN Alerts - Hacker News monitoring service
+#
+# Has a database that needs backup
 
-    domain = lib.mkOption {
-      type = lib.types.str;
-      description = "Domain to serve hn-alerts on";
-    };
+{ config, lib, pkgs, ... }:
 
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 3001;
-      description = "Port to run hn-alerts on";
-    };
+let
+  mkService = import ../../lib/mkService.nix;
+  baseModule = mkService {
+    name = "hn-alerts";
+    description = "HN Alerts Hacker News monitoring service";
+    defaultPort = 3001;
+    runtime = "bun";
+    startCommand = "${pkgs.unstable.bun}/bin/bun start";
 
-    dataDir = lib.mkOption {
-      type = lib.types.path;
-      default = "/var/lib/hn-alerts";
-      description = "Directory to store hn-alerts data";
-    };
-
-    secretsFile = lib.mkOption {
-      type = lib.types.path;
-      description = "Path to secrets file containing SLACK_BOT_TOKEN, SLACK_SIGNING_SECRET, SLACK_CHANNEL, SENTRY_DSN, DATABASE_URL";
-    };
-
-    repository = lib.mkOption {
-      type = lib.types.str;
-      default = "https://github.com/taciturnaxolotl/hn-alerts.git";
-      description = "Git repository URL (optional, for auto-deployment)";
-    };
-
-    autoUpdate = lib.mkEnableOption "Automatically git pull on service restart";
-
-    backup = {
-      enable = lib.mkEnableOption "Enable backups for hn-alerts" // { default = true; };
-
-      paths = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ cfg.dataDir ];
-        description = "Paths to back up";
-      };
-
-      exclude = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ "*.log" "app/.git" "app/node_modules" ];
-        description = "Patterns to exclude from backup";
+    extraConfig = cfg: {
+      # Data declarations for automatic backup
+      # App uses ./local.db relative to app dir by default
+      atelier.services.hn-alerts.data = {
+        sqlite = "${cfg.dataDir}/app/local.db";
       };
     };
   };
+  cfg = config.atelier.services.hn-alerts;
+in
+{
+  imports = [ baseModule ];
 
+  # Add db:push to preStart (after the base preStart runs bun install)
   config = lib.mkIf cfg.enable {
-    users.groups.services = { };
-
-    users.users.hn-alerts = {
-      isSystemUser = true;
-      group = "hn-alerts";
-      extraGroups = [ "services" ];
-      home = cfg.dataDir;
-      createHome = true;
-      shell = pkgs.bash;
-    };
-
-    users.groups.hn-alerts = { };
-
-    security.sudo.extraRules = [
-      {
-        users = [ "hn-alerts" ];
-        commands = [
-          {
-            command = "/run/current-system/sw/bin/systemctl restart hn-alerts.service";
-            options = [ "NOPASSWD" ];
-          }
-        ];
-      }
-    ];
-
-    systemd.services.hn-alerts = {
-      description = "HN Alerts Hacker News monitoring service";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
-      path = [ pkgs.git ];
-
-      preStart = ''
-        if [ ! -d ${cfg.dataDir}/app/.git ]; then
-          ${pkgs.git}/bin/git clone ${cfg.repository} ${cfg.dataDir}/app
-        fi
-        
-        cd ${cfg.dataDir}/app
-      '' + lib.optionalString cfg.autoUpdate ''
-        ${pkgs.git}/bin/git pull
-      '' + ''
-        
-        if [ ! -f src/index.ts ]; then
-          echo "No code found at ${cfg.dataDir}/app/src/index.ts"
-          exit 1
-        fi
-        
-        echo "Installing dependencies..."
-        ${pkgs.unstable.bun}/bin/bun install
-        
-        echo "Initializing database..."
-        ${pkgs.unstable.bun}/bin/bun run db:push
-      '';
-
-      serviceConfig = {
-        Type = "simple";
-        User = "hn-alerts";
-        Group = "hn-alerts";
-        EnvironmentFile = cfg.secretsFile;
-        Environment = [
-          "NODE_ENV=production"
-          "PORT=${toString cfg.port}"
-        ];
-        ExecStart = "${pkgs.bash}/bin/bash -c 'cd ${cfg.dataDir}/app && ${pkgs.unstable.bun}/bin/bun start'";
-        Restart = "always";
-        RestartSec = "10s";
-      };
-    };
-
-    services.caddy.virtualHosts.${cfg.domain} = {
-      extraConfig = ''
-        tls {
-          dns cloudflare {env.CLOUDFLARE_API_TOKEN}
-        }
-
-        reverse_proxy localhost:${toString cfg.port}
-      '';
-    };
-
-    # Register backup configuration
-    atelier.backup.services.hn-alerts = lib.mkIf cfg.backup.enable {
-      inherit (cfg.backup) paths exclude;
-      # Has database, stop before backup
-      preBackup = "systemctl stop hn-alerts";
-      postBackup = "systemctl start hn-alerts";
-    };
+    systemd.services.hn-alerts.preStart = lib.mkAfter ''
+      echo "Initializing database..."
+      cd ${cfg.dataDir}/app
+      ${pkgs.unstable.bun}/bin/bun run db:push || true
+    '';
   };
 }

modules/nixos/services/indiko.nix

···
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
+# Indiko - IndieAuth/OAuth2 server
+#
+# Uses mkService base with custom rate limiting on auth endpoints
+
 let
-  cfg = config.atelier.services.indiko;
+  mkService = import ../../lib/mkService.nix;
 in
-{
-  options.atelier.services.indiko = {
-    enable = lib.mkEnableOption "Indiko IndieAuth/OAuth2 server";
 
-    domain = lib.mkOption {
-      type = lib.types.str;
-      description = "Domain to serve Indiko on";
-    };
-
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 3003;
-      description = "Port to run Indiko on";
-    };
-
-    dataDir = lib.mkOption {
-      type = lib.types.path;
-      default = "/var/lib/indiko";
-      description = "Directory to store Indiko data";
-    };
+mkService {
+  name = "indiko";
+  description = "Indiko IndieAuth/OAuth2 server";
+  defaultPort = 3003;
+  runtime = "bun";
+  entryPoint = "src/index.ts";
 
-    secretsFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      default = null;
-      description = ''
-        Path to secrets file (optional).
-        If you need additional environment variables, define them here.
-      '';
-    };
-
-    repository = lib.mkOption {
-      type = lib.types.str;
-      default = "https://github.com/taciturnaxolotl/indiko.git";
-      description = "Git repository URL (optional, for auto-deployment)";
-    };
-
-    autoUpdate = lib.mkEnableOption "Automatically git pull on service restart";
-
-    backup = {
-      enable = lib.mkEnableOption "Enable backups for indiko" // { default = true; };
-
-      paths = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ cfg.dataDir ];
-        description = "Paths to back up";
-      };
-
-      exclude = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ "*.log" "app/.git" "app/node_modules" ];
-        description = "Patterns to exclude from backup";
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    users.groups.services = { };
-
-    users.users.indiko = {
-      isSystemUser = true;
-      group = "indiko";
-      extraGroups = [ "services" ];
-      home = cfg.dataDir;
-      createHome = true;
-      shell = pkgs.bash;
-    };
-
-    users.groups.indiko = { };
-
-    security.sudo.extraRules = [
-      {
-        users = [ "indiko" ];
-        commands = [
-          {
-            command = "/run/current-system/sw/bin/systemctl restart indiko.service";
-            options = [ "NOPASSWD" ];
-          }
-        ];
-      }
+  extraConfig = cfg: {
+    # Add ORIGIN and RP_ID environment variables
+    systemd.services.indiko.serviceConfig.Environment = [
+      "ORIGIN=https://${cfg.domain}"
+      "RP_ID=${cfg.domain}"
     ];
 
-    systemd.services.indiko = {
-      description = "Indiko IndieAuth/OAuth2 server";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
-      path = [ pkgs.git ];
-
-      preStart = ''
-        if [ ! -d ${cfg.dataDir}/app/.git ]; then
-          ${pkgs.git}/bin/git clone ${cfg.repository} ${cfg.dataDir}/app
-        fi
-        
-        cd ${cfg.dataDir}/app
-      '' + lib.optionalString cfg.autoUpdate ''
-        ${pkgs.git}/bin/git pull
-      '' + ''
-        
-        if [ ! -f src/index.ts ]; then
-          echo "No code found at ${cfg.dataDir}/app/src/index.ts"
-          exit 1
-        fi
-        
-        echo "Installing dependencies..."
-        ${pkgs.unstable.bun}/bin/bun install
-      '';
-
-      serviceConfig = {
-        Type = "simple";
-        User = "indiko";
-        Group = "indiko";
-        EnvironmentFile = lib.mkIf (cfg.secretsFile != null) cfg.secretsFile;
-        Environment = [
-          "NODE_ENV=production"
-          "PORT=${toString cfg.port}"
-          "ORIGIN=https://${cfg.domain}"
-          "RP_ID=${cfg.domain}"
-        ];
-        ExecStart = "${pkgs.bash}/bin/bash -c 'cd ${cfg.dataDir}/app && ${pkgs.unstable.bun}/bin/bun run src/index.ts'";
-        Restart = "always";
-        RestartSec = "10s";
-      };
-
-      serviceConfig.ExecStartPre = [
-        "+${pkgs.writeShellScript "indiko-setup" ''
-          mkdir -p ${cfg.dataDir}/app
-          chown -R indiko:services ${cfg.dataDir}
-          chmod -R g+rwX ${cfg.dataDir}
-        ''}"
-      ];
-    };
+    # Custom Caddy config with rate limiting on auth endpoints
+    services.caddy.virtualHosts.${cfg.domain}.extraConfig = ''
+      tls {
+        dns cloudflare {env.CLOUDFLARE_API_TOKEN}
+      }
 
-    services.caddy.virtualHosts.${cfg.domain} = {
-      extraConfig = ''
-        tls {
-          dns cloudflare {env.CLOUDFLARE_API_TOKEN}
+      # Rate limiting for auth endpoints
+      handle /auth/* {
+        rate_limit {
+          zone auth_limit {
+            key {http.request.remote_ip}
+            events 10
+            window 1m
+          }
         }
+        reverse_proxy localhost:${toString cfg.port}
+      }
 
-        # Rate limiting for auth endpoints
-        handle /auth/* {
-          rate_limit {
-            zone auth_limit {
-              key {http.request.remote_ip}
-              events 10
-              window 1m
-            }
+      # Rate limiting for API endpoints
+      handle /api/* {
+        rate_limit {
+          zone api_limit {
+            key {http.request.remote_ip}
+            events 30
+            window 1m
           }
-          reverse_proxy localhost:${toString cfg.port}
         }
+        reverse_proxy localhost:${toString cfg.port}
+      }
 
-        # Rate limiting for API endpoints
-        handle /api/* {
-          rate_limit {
-            zone api_limit {
-              key {http.request.remote_ip}
-              events 30
-              window 1m
-            }
+      # General rate limiting for all other routes
+      handle {
+        rate_limit {
+          zone general_limit {
+            key {http.request.remote_ip}
+            events 60
+            window 1m
           }
-          reverse_proxy localhost:${toString cfg.port}
         }
+        reverse_proxy localhost:${toString cfg.port}
+      }
+    '';
 
-        # General rate limiting for all other routes
-        handle {
-          rate_limit {
-            zone general_limit {
-              key {http.request.remote_ip}
-              events 60
-              window 1m
-            }
-          }
-          reverse_proxy localhost:${toString cfg.port}
-        }
-      '';
-    };
+    # Disable default caddy config since we're overriding it
+    atelier.services.indiko.caddy.enable = false;
 
-    # Register backup configuration  
-    atelier.backup.services.indiko = lib.mkIf cfg.backup.enable {
-      inherit (cfg.backup) paths exclude;
-      # Has SQLite database for sessions/tokens
-      preBackup = "systemctl stop indiko";
-      postBackup = "systemctl start indiko";
+    # Data declarations for automatic backup (SQLite for sessions/tokens)
+    # App uses hardcoded data/indiko.db relative to app dir
+    atelier.services.indiko.data = {
+      sqlite = "${cfg.dataDir}/app/data/indiko.db";
     };
   };
 }

modules/nixos/services/l4.nix

···
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.atelier.services.l4;
-in
-{
-  options.atelier.services.l4 = {
-    enable = lib.mkEnableOption "L4 Image CDN service";
-
-    domain = lib.mkOption {
-      type = lib.types.str;
-      description = "Domain to serve L4 on";
-    };
-
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 3004;
-      description = "Port to run L4 on";
-    };
-
-    dataDir = lib.mkOption {
-      type = lib.types.path;
-      default = "/var/lib/l4";
-      description = "Directory to store L4 data";
-    };
-
-    secretsFile = lib.mkOption {
-      type = lib.types.path;
-      description = ''
-        Path to secrets file containing:
-        - R2_ACCOUNT_ID
-        - R2_ACCESS_KEY_ID
-        - R2_SECRET_ACCESS_KEY
-        - R2_BUCKET
-        - R2_PUBLIC_URL
-        - SLACK_BOT_TOKEN
-        - SLACK_SIGNING_SECRET
-        - ALLOWED_CHANNELS (optional, comma-separated channel IDs)
-      '';
-    };
-
-    repository = lib.mkOption {
-      type = lib.types.str;
-      default = "https://github.com/taciturnaxolotl/l4.git";
-      description = "Git repository URL (optional, for auto-deployment)";
-    };
+# L4 - Image CDN / Slack image optimizer
+#
+# Images stored in R2, but keeps local stats
 
-    autoUpdate = lib.mkEnableOption "Automatically git pull on service restart";
+{ config, lib, pkgs, ... }:
 
-    backup = {
-      enable = lib.mkEnableOption "Enable backups for l4" // { default = true; };
+let
+  mkService = import ../../lib/mkService.nix;
+  baseModule = mkService {
+    name = "l4";
+    description = "L4 Image CDN - Slack image optimizer and R2 uploader";
+    defaultPort = 3004;
+    runtime = "bun";
+    entryPoint = "src/index.ts";
 
-      paths = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ cfg.dataDir ];
-        description = "Paths to back up";
+    extraConfig = cfg: {
+      # Add PUBLIC_URL environment variable
+      atelier.services.l4.environment = {
+        PUBLIC_URL = "https://${cfg.domain}";
       };
 
-      exclude = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ "*.log" "app/.git" "app/node_modules" ];
-        description = "Patterns to exclude from backup";
+      # Data declarations for backup (SQLite stats database)
+      # App runs from ${dataDir}/app and uses ./data/stats.db
+      atelier.services.l4.data = {
+        sqlite = "${cfg.dataDir}/app/data/stats.db";
       };
     };
   };
-
+  cfg = config.atelier.services.l4;
+in
+{
+  imports = [ baseModule ];
+  
+  # Add LD_LIBRARY_PATH for native dependencies (sharp image processing)
   config = lib.mkIf cfg.enable {
-    users.groups.services = { };
-
-    users.users.l4 = {
-      isSystemUser = true;
-      group = "l4";
-      extraGroups = [ "services" ];
-      home = cfg.dataDir;
-      createHome = true;
-      shell = pkgs.bash;
-    };
-
-    users.groups.l4 = { };
-
-    security.sudo.extraRules = [
-      {
-        users = [ "l4" ];
-        commands = [
-          {
-            command = "/run/current-system/sw/bin/systemctl restart l4.service";
-            options = [ "NOPASSWD" ];
-          }
-        ];
-      }
-    ];
-
-    systemd.services.l4 = {
-      description = "L4 Image CDN - Slack image optimizer and R2 uploader";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
-      path = [ pkgs.git pkgs.stdenv.cc.cc.lib ];
-
-      preStart = ''
-        if [ ! -d ${cfg.dataDir}/app/.git ]; then
-          ${pkgs.git}/bin/git clone ${cfg.repository} ${cfg.dataDir}/app
-        fi
-        
-        cd ${cfg.dataDir}/app
-      '' + lib.optionalString cfg.autoUpdate ''
-        ${pkgs.git}/bin/git pull
-      '' + ''
-        
-        if [ ! -f src/index.ts ]; then
-          echo "No code found at ${cfg.dataDir}/app/src/index.ts"
-          exit 1
-        fi
-        
-        echo "Installing dependencies..."
-        ${pkgs.unstable.bun}/bin/bun install
-      '';
-
-      serviceConfig = {
-        Type = "simple";
-        User = "l4";
-        Group = "l4";
-        EnvironmentFile = cfg.secretsFile;
-        Environment = [
-          "NODE_ENV=production"
-          "PORT=${toString cfg.port}"
-          "PUBLIC_URL=https://${cfg.domain}"
-          "LD_LIBRARY_PATH=${pkgs.stdenv.cc.cc.lib}/lib"
-        ];
-        ExecStart = "${pkgs.bash}/bin/bash -c 'cd ${cfg.dataDir}/app && ${pkgs.unstable.bun}/bin/bun run src/index.ts'";
-        Restart = "always";
-        RestartSec = "10s";
-      };
-
-      serviceConfig.ExecStartPre = [
-        "+${pkgs.writeShellScript "l4-setup" ''
-          mkdir -p ${cfg.dataDir}/app
-          chown -R l4:services ${cfg.dataDir}
-          chmod -R g+rwX ${cfg.dataDir}
-        ''}"
-      ];
-    };
-
-    services.caddy.virtualHosts.${cfg.domain} = {
-      extraConfig = ''
-        tls {
-          dns cloudflare {env.CLOUDFLARE_API_TOKEN}
-        }
-
-        reverse_proxy localhost:${toString cfg.port}
-      '';
-    };
-
-    # Register backup configuration
-    atelier.backup.services.l4 = lib.mkIf cfg.backup.enable {
-      inherit (cfg.backup) paths exclude;
-      # Stateless service (images in R2), no pre/post hooks needed
-    };
+    systemd.services.l4.environment.LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib";
+    systemd.services.l4.path = [ pkgs.stdenv.cc.cc.lib ];
   };
 }

modules/nixos/services/restic/README.md

···
 The `atelier-backup` command provides an interactive TUI:
 
 ```bash
-atelier-backup              # Interactive menu
-atelier-backup status       # Show backup status for all services
-atelier-backup list         # Browse snapshots
-atelier-backup backup       # Trigger manual backup
-atelier-backup restore      # Interactive restore wizard
-atelier-backup dr           # Disaster recovery mode
+sudo atelier-backup              # Interactive menu
+sudo atelier-backup status       # Show backup status for all services
+sudo atelier-backup list         # Browse snapshots
+sudo atelier-backup backup       # Trigger manual backup
+sudo atelier-backup restore      # Interactive restore wizard
+sudo atelier-backup dr           # Disaster recovery mode
 ```
 
 See `man atelier-backup` for full documentation.

modules/nixos/services/restic/atelier-backup.1.md

···
 
 # SYNOPSIS
 
-**atelier-backup** [*COMMAND*]
+**sudo atelier-backup** [*COMMAND*]
 
-**atelier-backup** **status**
+**sudo atelier-backup** **status**
 
-**atelier-backup** **list**
+**sudo atelier-backup** **list**
 
-**atelier-backup** **backup**
+**sudo atelier-backup** **backup**
 
-**atelier-backup** **restore**
+**sudo atelier-backup** **restore**
 
-**atelier-backup** **dr**
+**sudo atelier-backup** **dr**
 
 # DESCRIPTION
 
···
 
 Interactive menu:
 ```
-$ atelier-backup
+$ sudo atelier-backup
 ```
 
 Check backup status for all services:
 ```
-$ atelier-backup status
+$ sudo atelier-backup status
 ```
 
 Browse snapshots for a service:
 ```
-$ atelier-backup list
+$ sudo atelier-backup list
 ```
 
 Trigger manual backup:
 ```
-$ atelier-backup backup
+$ sudo atelier-backup backup
 ```
 
 Restore a service from backup:
 ```
-$ atelier-backup restore
+$ sudo atelier-backup restore
 ```
 
 Full disaster recovery:
 ```
-$ atelier-backup dr
+$ sudo atelier-backup dr
 ```
 
 # FILES

modules/nixos/services/restic/cli.nix

···
     input() { ${pkgs.gum}/bin/gum input "$@"; }
     spin() { ${pkgs.gum}/bin/gum spin "$@"; }
     
+    # Check for root
+    if [ "$(id -u)" -ne 0 ]; then
+      style --foreground 196 "Error: atelier-backup must be run as root"
+      echo "Try: sudo atelier-backup $*"
+      exit 1
+    fi
+    
     # Restic wrapper with secrets
     restic_cmd() {
       ${pkgs.restic}/bin/restic \
···
         "$@"
     }
     export -f restic_cmd
-    export B2_ACCOUNT_ID=$(cat ${config.age.secrets."restic/env".path} | grep B2_ACCOUNT_ID | cut -d= -f2)
-    export B2_ACCOUNT_KEY=$(cat ${config.age.secrets."restic/env".path} | grep B2_ACCOUNT_KEY | cut -d= -f2)
+    
+    # Load B2 credentials from environment file
+    set -a
+    source ${config.age.secrets."restic/env".path}
+    set +a
     
     # Available services
     SERVICES="${lib.concatStringsSep " " allBackupServices}"