{
  config,
  lib,
  ...
}:
{
  sops.secrets."restic/repo_password" = {
    owner = "restic";
    mode = "0400";
    restartUnits = [ "restic-backups-prune.service" ];
  };

  services.restic.server = {
    enable = true;
    listenAddress = "0.0.0.0:8008";
    # mkDefault: set services.restic.server.dataDir in a host config to relocate the repo.
    dataDir = lib.mkDefault "/var/lib/restic";
    appendOnly = lib.mkDefault true;
    extraFlags = lib.mkDefault [ "--no-auth" ]; #lets just ignore the auth parts, keep it on internal network.
  };

  services.restic.backups.prune = {
    repository = "${config.services.restic.server.dataDir}/main";
    passwordFile = config.sops.secrets."restic/repo_password".path;
    user = "restic";
    paths = [ ];
    pruneOpts = [
      "--keep-daily 3"
      "--keep-weekly 5"
      "--keep-monthly 6"
      "--keep-yearly 5"
    ];
    runCheck = true;
    timerConfig = {
      OnCalendar = "weekly";
      Persistent = true;
    };
  };

  networking.firewall.allowedTCPPorts = [ 8008 ];
}