{ config, lib, self, ... }:

{
  age.secrets.restic_repository_password.file = "${self}/secrets/cube_restic_repository_password.age";
  age.secrets.restic_ssh_private_key.file = "${self}/secrets/cube_restic_ssh_private_key.age";

  programs.ssh.extraConfig = ''
    Host backup
      HostName 10.0.1.12
      Port 32222
      User backup
      IdentityFile /run/agenix/restic_ssh_private_key
  '';

  services.postgresqlBackup = {
    enable = true;
    backupAll = true;
    compression = "zstd";
  };

  services.restic.backups = {
    cox = {
      passwordFile = "/run/agenix/restic_repository_password";
      paths = [
        "/mnt/internal/nextcloud"
        "/var/backup/postgresql"
      ];
      repository = "sftp:backup:/data/hdd/restic";
      timerConfig = {
        OnCalendar = "02:00";
      };
    };
  };
}