{
  config,
  lib,
  flake,
  ...
}: {
  age.secrets.restic_repository_password.file = "${flake.self}/secrets/chonk_restic_repository_password.age";
  age.secrets.restic_nextcloud_password.file = "${flake.self}/secrets/chonk_restic_nextcloud_password.age";

  programs.ssh.extraConfig = ''
    Host backup
      HostName 10.0.1.12
      Port 32222
      User backup
      IdentityFile /run/agenix/restic_ssh_private_key
  '';

  services.postgresqlBackup = {
    enable = true;
    backupAll = true;
    compression = "zstd";
  };

  services.restic.backups = {
    cox = {
      passwordFile = "/run/agenix/restic_repository_password";
      paths = [
        "/mnt/internal/nextcloud"
        "/var/backup/postgresql"
      ];
      repositoryFile = "/run/agenix/restic_nextcloud_password";
      timerConfig = {
        OnCalendar = "02:00";
      };
    };
  };
}