{ config, pkgs, ... }: {

  environment.systemPackages = with pkgs; [ restic ];

  sops.secrets."restic-backups-b2-repo-password" = {
    sopsFile = ./restic.sops.yaml;
  };
  sops.secrets."restic-backups-b2-environment" = {
    sopsFile = ./restic-environment.sops;
    format = "binary";
    path = "/etc/nixos/secrets/b2-env";
  };
  services = {
    restic.backups.b2 = {
      passwordFile = "/run/secrets/restic-backups-b2-repo-password";
      paths = [ "/var/lib/foundryvtt" ];
      repository = "b2:cyplo-restic-vpsfree";
      timerConfig = { OnCalendar = "hourly"; };
      environmentFile = "/etc/nixos/secrets/b2-env";
    };
  };

  systemd.services.restic-backups-b2.serviceConfig = {
    Nice = 19;
    IOSchedulingClass = "idle";
  };
}