{ config, lib, ... }:
{

  options = {
    backup.all.restic.dirs = lib.mkOption {
      default = [];
      type = with lib.types; listOf str;
    };
  };

  config = {

  backup.services.restic =
    let
      setup = server: {
        passwordFile = toString <secrets/backup/restic-repo>;
        repo = "sftp::backup/remote-${config.networking.hostName}";
        requires = [];
        extraArguments = [
          "sftp.command='ssh backup@${server} -i ${toString <secrets/backup/sftp-user_rsa>} -s sftp'"
        ];
        initialize = true;
        timerConfig = {
          OnCalendar = "daily";
          Persistent = "true";
        };
        dirs = config.backup.all.restic.dirs;
      };
    in
    {
      "on-porani" = setup "porani.private";
      "on-workhorse" = setup "workhorse.private";
      "on-workout" = setup "workout.private";
    };
  };
}