define a nixos module, defining a systemd service and timer

flake.nix

@@ -9,7 +9,7 @@
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.11";
   };
 
-  outputs = inputs: with inputs;
+  outputs = { self, nixpkgs, cargo2nix, flake-utils }:
     flake-utils.lib.eachDefaultSystem (system:
       let
         pkgs = import nixpkgs {
@@ -28,5 +28,56 @@
           default = packages.restic-alarm;
         };
       }
-    );
+    ) // rec {
+      nixosModules.restic-alarm = { config, lib, pkgs, ... }:
+        with lib;
+        let
+          cfg = config.custom.restic-alarm;
+        in
+        {
+          options.custom.restic-alarm = {
+            enable = mkEnableOption (lib.mdDoc "restic-alarm: send alarms for inactive backups");
+
+            env_file = mkOption {
+              type = types.path;
+              description = lib.mdDoc
+                "The file containing the environment variables to pass to restic-alarm, for e.g. S3 access keys";
+            };
+          };
+
+          config = mkIf cfg.enable {
+            systemd.services.restic-alarm =
+              let
+                pkg = self.packages.${pkgs.system}.default;
+              in {
+                description = "restic-alarm: send alarms for inactive backups";
+                after = [ "network.target" "network-online.target" ];
+                wants = [ "network.target" "network-online.target" ];
+                wantedBy = [ "multi-user.target" ];
+                restartTriggers = [ cfg.env_file ];
+                serviceConfig = {
+                  ExecStart = "${pkg}/bin/restic-alarm";
+                  DynamicUser = true;
+                  EnvironmentFile = "${cfg.env_file}";
+                };
+              };
+
+            systemd.timers.restic-alarm = {
+              partOf = [ "restic-alarm.service" ];
+              wantedBy = [ "timers.target" ];
+              after = [ "network-online.target" ];
+              timerConfig = {
+                Unit = "restic-alarm.service";
+                Persistent = true;
+                # every 6 hours
+                OnCalendar = "*-*-* 00/6:00:00";
+                RandomizedDelaySec = "1h";
+                FixedRandomDelay = true;
+              };
+            };
+          };
+        };
+
+      nixosModules.default = nixosModules.restic-alarm;
+    };
 }