{
  config,
  lib,
  ...
}:
{
  sops.secrets."restic/repository" = {
    mode = "0400";
    restartUnits = [ "restic-backups-main.service" ];
  };

  sops.secrets."restic/repo_password" = {
    mode = "0400";
    restartUnits = [ "restic-backups-main.service" ];
  };

  services.restic.backups.main = {
    repositoryFile = config.sops.secrets."restic/repository".path;
    passwordFile = config.sops.secrets."restic/repo_password".path;
    initialize = true;
    paths = lib.mkDefault [
      "/var/lib"
      "/var/backups"
      "/home/gunalx"
    ];
    exclude = lib.mkDefault [
      ".cache"
      "__pycache__"
      "*.pyc"
      "*.pyo"
      ".pytest_cache"
      ".mypy_cache"
      ".ruff_cache"
      "node_modules"
      ".cargo"
      ".rustup"
      ".platformio"
      ".ipython"
      ".config"
      ".gitconfig"
      ".bashrc"
      ".bash_history"
      ".zsh_history"
      ".atuin"
      ".history.db*"
      ".tmp"
      "*.tmp"
      "*.swp"
      ".Trash-*"
      ".zcompdump*"
      ".nix-defexpr"
      ".steam"
      ".SteamCloud"
      "Steam"
      "/var/lib/containers"
    ];
    timerConfig = {
      OnCalendar = "daily";
      Persistent = true;
    };
  };
}