{ lib, config, pkgs, ... }: {

  services.borgbackup.repos = {
    default = {
      quota = "100G";
      allowSubRepos = true;
      authorizedKeys = [
        (lib.fileContents ../../assets/ssh/borg_access.pub)
        (lib.fileContents ../../assets/ssh/card_rsa.pub)
      ];
    };
  };

  # mirror backup folder to /media
  systemd.services.borg-mirror-to-media = {
    enable = true;
    script = ''
      ${pkgs.rsync}/bin/rsync -a \
        /var/lib/borgbackup/ \
        /media/borg-backup-mirror \
        --delete-after
    '';
  };
  systemd.timers.borg-mirror-to-media = {
    enable = true;
    timerConfig.OnCalendar = "daily";
    wantedBy = [ "multi-user.target" ];
  };

}