{ config, pkgs, ... }: {
  environment.systemPackages = with pkgs; [ restic ];
  networking.firewall.allowedTCPPorts = [ 8000 ];
  services.restic.server = {
    enable = true;
    dataDir = "/data/restic";
    appendOnly = true;
    prometheus = true;
    extraFlags = [ "--no-auth" ];
  };

}