btrfs.autoScrub: enable

hosts/common/programs/assorted.nix

@@ -445,13 +445,6 @@ in
 
     bridge-utils.sandbox.net = "all";
 
-    btrfs-progs.sandbox.autodetectCliPaths = "existing";  # e.g. `btrfs filesystem df /my/fs`
-    btrfs-progs.sandbox.extraPaths = [
-      "/dev/btrfs-control"
-    ];
-    btrfs-progs.sandbox.tryKeepUsers = true;
-    btrfs-progs.sandbox.capabilities = [ "sys_admin" ];  # for `btrfs scrub`
-
     "cacert.unbundled".sandbox.enable = false;  #< data only
 
     cargo.persist.byStore.plaintext = [ ".cargo" ];

hosts/common/programs/btrfs-progs.nix

@@ -0,0 +1,19 @@
+{ config, lib, ... }:
+let
+  cfg = config.sane.programs.btrfs-progs;
+in
+{
+  sane.programs.btrfs-progs = {
+    sandbox.autodetectCliPaths = "existing";  # e.g. `btrfs filesystem df /my/fs`
+    sandbox.extraPaths = [
+      "/dev/btrfs-control"
+    ];
+    sandbox.tryKeepUsers = true;
+    sandbox.capabilities = [ "sys_admin" ];  # for `btrfs scrub`
+  };
+
+  # TODO: service sandboxing
+  services.btrfs.autoScrub.enable = lib.mkIf cfg.enabled true;
+  services.btrfs.autoScrub.interval = "weekly";
+}
+

hosts/common/programs/default.nix

@@ -17,6 +17,7 @@
     ./bonsai.nix
     ./brave.nix
     ./brightnessctl.nix
+    ./btrfs-progs.nix
     ./bubblewrap.nix
     ./bunpen.nix
     ./callaudiod.nix