{
  config,
  lib,
  pkgs,
  ...
}:
{
  sops.secrets."restic/server_htpasswd" = {
    owner = "restic";
    group = "restic";
    mode = "0400";
    restartUnits = [ "restic-rest-server.service" ];
  };

  sops.secrets."restic/repo_password" = {
    owner = "restic";
    mode = "0400";
    restartUnits = [
      "restic-backups-prune.service"
      "restic-offsite.service"
    ];
  };

  sops.secrets."restic/offsite_repository" = {
    owner = "restic";
    mode = "0400";
    restartUnits = [ "restic-offsite.service" ];
  };

  services.restic.server = {
    enable = true;
    listenAddress = "${config.networking.hostName}:8008";
    # mkDefault: set services.restic.server.dataDir in a host config to relocate the repo.
    dataDir = lib.mkDefault "/var/lib/restic";
    htpasswd-file = config.sops.secrets."restic/server_htpasswd".path;
    appendOnly = lib.mkDefault true;
  };

  services.restic.backups.prune = {
    repository = "${config.services.restic.server.dataDir}/main";
    passwordFile = config.sops.secrets."restic/repo_password".path;
    user = "restic";
    paths = [ ];
    pruneOpts = [
      "--keep-daily 3"
      "--keep-weekly 5"
      "--keep-monthly 6"
      "--keep-yearly 5"
    ];
    runCheck = true;
    timerConfig = {
      OnCalendar = "weekly";
      Persistent = true;
    };
  };

  # # just uncommented until we have this running on elrond as well.
  #  systemd.services.restic-offsite = {
  #    description = "Mirror restic snapshots to the offsite repo";
  #    serviceConfig = {
  #      Type = "oneshot";
  #      User = "restic";
  #      Group = "restic";
  #    };
  #    path = [ pkgs.restic ];
  #    script = ''
  #      restic -r ${config.services.restic.server.dataDir}/main \
  #        --password-file ${config.sops.secrets."restic/repo_password".path} \
  #        copy \
  #        --repository-file2 ${config.sops.secrets."restic/offsite_repository".path} \
  #        --password-file2 ${config.sops.secrets."restic/repo_password".path}
  #    '';
  #  };

  systemd.timers.restic-offsite = {
    wantedBy = [ "timers.target" ];
    timerConfig = {
      OnCalendar = "daily";
      Persistent = true;
    };
  };

  networking.firewall.allowedTCPPorts = [ 8008 ];
}