{ pkgs, config, ... }:
{

  clanCore.facts.services.syncoid = {
    secret."syncoid.ssh.id_ed25519" = { };
    public."syncoid.ssh.id_ed25519.pub" = { };
    generator.path = with pkgs; [ coreutils openssh ];
    generator.script = ''
      ssh-keygen -t ed25519 -N "" -f $secrets/syncoid.ssh.id_ed25519
      mv $secrets/syncoid.ssh.id_ed25519.pub $facts/syncoid.ssh.id_ed25519.pub
    '';
  };

  services.syncoid = {
    enable = true;

    # local
    commands.service2 = {
      source = "zroot/services2";
      target = "zraid/mirror/services2"; # should not be created up front!
    };
    commands.paperless = {
      source = "zroot/paperless";
      target = "zraid/mirror/paperless"; # should not be created up front!
    };
    commands.postgresql = {
      source = "zroot/postgresql";
      target = "zraid/mirror/postgresql"; # should not be created up front!
    };

    # remote
    commands.matrix-terranix = {
      sshKey = config.clanCore.facts.services.syncoid.secret."syncoid.ssh.id_ed25519".path;
      source = "root@orbi:zroot/matrix-terranix";
      target = "zraid/mirror/matrix-terranix"; # should not be created up front!
    };
    commands.nextcloud = {
      sshKey = config.clanCore.facts.services.syncoid.secret."syncoid.ssh.id_ed25519".path;
      source = "root@orbi:zroot/nextcloud";
      target = "zraid/mirror/nextcloud"; # should not be created up front!
    };
    commands.photoprism = {
      sshKey = config.clanCore.facts.services.syncoid.secret."syncoid.ssh.id_ed25519".path;
      source = "root@orbi:zmedia/photoprism";
      target = "zraid/mirror/photoprism"; # should not be created up front!
    };
    commonArgs = [
      # Does not create new snapshot, only transfers existing
      "--no-sync-snap"
    ];
  };

}