feat(gerrit): run git-gc-preserve on a daily timer

services/gerrit/default.nix

@@ -41,6 +41,7 @@ in
   imports = [
     ./www.nix
     ./one-way-sync.nix
+    ./git-gc-preserve.nix
   ];
 
   config = mkIf cfg.enable {
@@ -318,6 +319,13 @@ in
       environment.REVWALK_USE_PRIORITY_QUEUE = "true";
     };
 
+    bagel.services.git-gc-preserve = {
+      nixpkgs = {
+        enable = true;
+        repoPath = "/var/lib/gerrit/git/nixpkgs.git";
+      };
+    };
+
     age.secrets.gerrit-prometheus-bearer-token.file = ../../secrets/gerrit-prometheus-bearer-token.age;
     bagel.monitoring.grafana-agent.exporters.gerrit = {
       port = 4778;  # grrt

services/gerrit/git-gc-preserve.nix

@@ -0,0 +1,86 @@
+{ lib, utils, config, pkgs, ... }: let
+  inherit (lib) mkOption mkEnableOption types;
+  cfg = config.bagel.services.git-gc-preserve;
+  enabledServices = lib.filterAttrs (_: gcConfig: gcConfig.enable) cfg;
+in
+{
+  options.bagel.services.git-gc-preserve = mkOption {
+    default = { };
+    description = "Repositories that should be garbage collected";
+    type = types.attrsOf (types.submodule {
+      options = {
+        enable = mkEnableOption "git-gc-preserve";
+        user = mkOption {
+          type = types.str;
+          default = "git";
+          description = "The user which will run the garbage collection script";
+          example = "forgejo";
+        };
+        group = mkOption {
+          type = types.str;
+          default = "git";
+          description = "The group which will run the garbage collection script";
+          example = "forgejo";
+        };
+        repoPath = mkOption {
+          type = types.path;
+          description = "The path to the git repository that should be garbage collected";
+          example = "/var/lib/gerrit/git/nixpkgs";
+        };
+        timeoutSec = mkOption {
+          type = types.str;
+          default = "1h";
+          description = "Garbage collection Systemd unit timeout";
+          example = "infinity";
+        };
+        timerConfig = mkOption {
+          type = types.attrsOf utils.systemdUtils.unitOptions.unitOption;
+          default = {
+            OnCalendar = "daily";
+          };
+          description = ''
+            When to run the git-gc-preserve. See {manpage}`systemd.timer(5)` for details.
+          '';
+          example = {
+            OnCalendar = "00:05";
+            RandomizedDelaySec = "5h";
+            Persistent = true;
+          };
+        };
+      };
+    });
+  };
+  config = {
+    systemd.services =
+      let
+        mkGCService = name: gcConfig: {
+          name = "git-gc-preserve-${name}";
+          value = {
+            description = "Git-GC-Preserve Service - ${name}";
+            serviceConfig = {
+              WorkingDirectory = gcConfig.repoPath;
+              Type = "oneshot";
+              User = gcConfig.user;
+              Group = gcConfig.group;
+              ExecStart = lib.getExe pkgs.git-gc-preserve;
+              TimeoutSec = gcConfig.timeoutSec;
+            };
+          };
+        };
+        mkServices = lib.mapAttrs' mkGCService;
+      in
+        mkServices enabledServices;
+
+    systemd.timers = let
+      mkGCTimer = name: gcConfig: {
+        name = "git-gc-preserve-${name}";
+        value = {
+          wantedBy = [ "timers.target" ];
+          after = [ "multi-user.target" ];
+          timerConfig = gcConfig.timerConfig;
+        };
+      };
+      mkTimer = lib.mapAttrs' mkGCTimer;
+    in mkTimer enabledServices;
+  };
+}