{pkgs, config, ...}: {
  programs.ssh.extraConfig = ''
    Host truenas
      HostName storage.local
      User restic
      IdentityFile ${config.age.secrets.truenas-ssh.path}
      StrictHostKeyChecking no
      UserKnownHostsFile /dev/null
  '';

  services.restic.backups.hermes = {
    initialize = true;

    # Set the  repo
    repositoryFile = config.age.secrets.repo.path;

    # Restic password
    passwordFile = config.age.secrets.restic.path;

    paths = [
      "/var/lib"
    ];

    exclude = [
      "/var/lib/gitea-runner"
      "/var/lib/containers"
      "/var/lib/systemd/coredump"
    ];

    timerConfig = {
      OnCalendar = "daily";
      RandomizedDelaySec = "1h";
    };

    pruneOpts = [
      "--keep-daily=7"
      "--keep-weekly=4"
      "--keep-monthly=12"
    ];
  };

  environment.systemPackages = [
    (pkgs.writeShellScriptBin "restic-hermes" ''
      exec ${pkgs.restic}/bin/restic \
        -r "sftp:restic@storage.local:/mnt/data_pool/infra/backups" \
        --password-file "${config.age.secrets.restic.path}" \
        -o "sftp.command=ssh restic@storage.local -i ${config.age.secrets.truenas-ssh.path} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -s sftp" \
        "$@"
    '')
  ];

  # Secrets configuration
  age.secrets = {
    restic = {
      file = ../../secrets/restic.age;
      owner = "root";
    };
    repo = {
      file = ../../secrets/restic-repo.age;
      owner = "root";
    };
    truenas-ssh = {
      file = ../../secrets/truenas-ssh.age;
      owner = "root";
      mode = "0400";
    };
  };
}