{ lib, config, pkgs, ... }: {

  services.borgbackup.repos = {
    default = {
      quota = "100G";
      allowSubRepos = true;
      authorizedKeysAppendOnly = [
        # todo rename this one
        (toString <common_secrets/backup/sftp-user_rsa.pub>)
      ];
    };
  };

}