Backup script fixes

modules/backup.nix

@@ -37,6 +37,20 @@
 let
   cfg     = config.homey.backup;
   dataDir = config.homey.storage.mountPoint;
+
+  # The manual offload script backs up a mirror of the external HD onto a
+  # USB drive, so only extraPaths/extraExcludePaths actually under dataDir
+  # apply (e.g. eurovote's /var/lib/eurovote is OS state, out of scope here).
+  offloadDataPaths        = lib.filter (lib.hasPrefix "${dataDir}/") cfg.extraPaths;
+  offloadExcludeDataPaths = lib.filter (lib.hasPrefix "${dataDir}/") cfg.extraExcludePaths;
+
+  offloadBackupScript = pkgs.replaceVars ../scripts/offload-backup.sh {
+    backupPaths = lib.concatMapStringsSep "\n  " (p: ''"${p}"'') offloadDataPaths;
+    excludeArgs = lib.concatMapStringsSep "\n  " (p: ''--exclude "${p}"'') offloadExcludeDataPaths;
+  };
+
+  offloadBackupPackage = pkgs.writeShellScriptBin "homey-offload-backup"
+    (builtins.readFile offloadBackupScript);
 in
 {
   options.homey.backup = {
@@ -83,6 +97,14 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    # -----------------------------------------------------------------------
+    # Manual offload script — installed system-wide so its path list stays
+    # in sync with extraPaths/extraExcludePaths on every deploy, instead of
+    # being hand-copied and left to drift. Run via `homey-offload-backup`
+    # in the dev shell.
+    # -----------------------------------------------------------------------
+    environment.systemPackages = [ offloadBackupPackage ];
+
     # -----------------------------------------------------------------------
     # Secrets
     # -----------------------------------------------------------------------