{
  config,
  lib,
  pkgs,
  ...
}:
{

  sops.secrets."restic/repo_password" = {
    owner = "restic";
    mode = "0400";
    restartUnits = [ "restic-offsite.service" ];
  };

  sops.secrets."restic/offsite_repository" = {
    owner = "restic";
    mode = "0400";
    restartUnits = [ "restic-offsite.service" ];
  };

  # destination = offsite repo (primary global opts: --repository-file/--password-file)
  # source      = local repo (--from-repo/--from-password-file)
  # the legacy --repo2/--repository-file2/--password-file2 flags are deprecated in restic.
  systemd.services.restic-offsite = {
    description = "Mirror restic snapshots to the offsite repo";
    serviceConfig = {
      Type = "oneshot";
      User = "restic";
      Group = "restic";
    };
    path = [ pkgs.restic ];
    script = ''
      restic \
        --repository-file ${config.sops.secrets."restic/offsite_repository".path} \
        --password-file ${config.sops.secrets."restic/repo_password".path} \
        --from-repo ${config.services.restic.server.dataDir}/main \
        --from-password-file ${config.sops.secrets."restic/repo_password".path} \
        copy
    '';
  };

  systemd.timers.restic-offsite = {
    wantedBy = [ "timers.target" ];
    timerConfig = {
      OnCalendar = "daily";
      Persistent = true;
    };
  };
}