a borgmatic configuration, which uses extra options to create archives from forgejo dumps on stdin

forgejo-borgmatic.yml

# List of source directories and files to back up. Globs and tildes
# are expanded. Do not backslash spaces in path names.
source_directories:
  # Actually, this is interpreted as a command due to extra options below.
  - /usr/local/bin/forgejo-dump-stdout

# If true, then source directories must exist, otherwise an error is
# raised. Defaults to false.
source_directories_must_exist: false # source is a command

# Additional options to pass directly to particular Borg commands,
# handy for Borg options that borgmatic does not yet support natively.
# Note that borgmatic does not perform any validation on these options.
extra_borg_options:
    create: --content-from-command --stdin-mode 600 --stdin-name forgejo-dump-stdin.zip

# A required list of local or remote repositories with paths and
# optional labels (which can be used with the --repository flag to
# select a repository). Tildes are expanded. Multiple repositories are
# backed up to in sequence.
repositories:
    - path: /tank/backup/git
      label: tank

# Standard output of this command is used to unlock the encryption key.
# https://torsion.org/borgmatic/docs/how-to/provide-your-passwords/
encryption_passcommand: cat /root/borgkeys/git

# Type of compression to use when creating archives. (Compression
# level can be added separated with a comma, like "zstd,7".) See
# http://borgbackup.readthedocs.io/en/stable/usage/create.html for
# details. Defaults to "lz4".
compression: zstd # or none

# Name of the archive to create. Borg placeholders can be used. See
# the output of "borg help placeholders" for details. Defaults to
# "{hostname}-{now:%Y-%m-%dT%H:%M:%S.%f}" with Borg 1 and
# "{hostname}" with Borg 2, as Borg 2 does not require unique
# archive names; identical archive names form a common "series" that
# can be targeted together. When running actions like repo-list,
# info, or check, borgmatic automatically tries to match only
# archives created with this name format.
archive_name_format: 'forgejo-dump-{now:%s}.zip'

# A Borg pattern for filtering down the archives used by borgmatic
# actions that operate on multiple archives. For Borg 1.x, use a shell
# pattern here and see the output of "borg help placeholders" for
# details. For Borg 2.x, see the output of "borg help match-archives".
# If match_archives is not specified, borgmatic defaults to deriving
# the match_archives value from archive_name_format.
# This rule will also match my older gitea-dump-*.zip files.
match_archives: sh:*-dump-*.zip

# Bypass Borg error about a repository that has been moved.
relocated_repo_access_is_ok: true

# Retention rules when pruning old archives.
keep_secondly: 3
keep_daily: 5
keep_weekly: 4
keep_monthly: 6
keep_yearly: 10

# Support for the "borgmatic bootstrap" action, used to extract
# borgmatic configuration files from a backup archive.
bootstrap:
    # Store configuration files used to create a backup inside the
    # backup itself. Defaults to true. Changing this to false
    # prevents "borgmatic bootstrap" from extracting configuration
    # files from the backup.
    # WARN: it also avoids a conflict with content-from-command!
    store_config_files: false

ntfy: # https://ntfy.sh/docs/publish/
  topic: notifymeonmytopic
  fail:
    title: forgejo dump failed
    message: The borgmatic backup of forgejo failed!
    priority: high
    tags: incoming_envelope

forgejo-dump-stdout

#!/usr/bin/env bash
# this just runs forgejo dump to stdout because borgmatic
# can't properly pass a full commandline as stdin command

# become git user, if we're not already
if [[ $(id --user --name) != git ]]; then
  exec sudo -u git "${BASH_SOURCE[@]}"
fi

cd /srv/git
forgejo dump --config /etc/forgejo/app.ini --type zip --file -