{ lib, config, pkgs, ... }: {

  # provide borg backup repository
  services.borgbackup.repos = {
    default = {
      quota = "100G";
      allowSubRepos = true;
      authorizedKeys = [
        # todo rename
        (lib.fileContents <common_secrets/backup/ssh_rsa.pub>)
        (lib.fileContents <assets/ssh/card_rsa.pub>)
      ];
    };
  };

}