{
  config,
  pkgs,
  ...
}: {
  environment.systemPackages = with pkgs; [restic];
  networking.firewall.allowedTCPPorts = [8000];
  services.restic.server = {
    enable = true;
    dataDir = "/data/restic";
    appendOnly = true;
    prometheus = true;
    extraFlags = ["--no-auth"];
  };
}