{ lib, config, pkgs, ... }: {

  # backup repository
  services.borgbackup.repos = {
    default = {
      quota = "100G";
      allowSubRepos = true;
      authorizedKeys = [
        # todo rename
        (lib.fileContents ../../assets/ssh/borg_access.pub)
        (lib.fileContents ../../assets/ssh/palo_rsa.pub)
      ];
    };
    removable = {
      quota = "250G";
      allowSubRepos = true;
      user = "removable";
      path = "/removable/borg";
      authorizedKeys = [
        # todo rename
        (lib.fileContents ../../assets/ssh/borg_access.pub)
        (lib.fileContents ../../assets/ssh/palo_rsa.pub)
      ];
    };
  };

  backup.enable = true;
  backup.dirs = [
    "/home/palo/jobrad"
    "/home/palo/.timewarrior"
    "/home/palo/.ssh"
  ];

  backup.servers = {
    robi.host = "144.76.13.147";
    pepe.host = "pepe.private";
    cream.host = "cream.private";
    cream-removable = {
      user = "removable";
      host = "cream.private";
    };
  };

}