{
  pkgs,
  config,
  lib,
  ...
}: {
  services.restic.backups.hermes = {
    initialize = true;

    repository = "/mnt/backups/";

    passwordFile = config.age.secrets.restic.path;

    paths = [
      "/var/lib"
    ];

    timerConfig = {
      OnCalendar = "daily";
      RandomizedDelaySec = "1h";
    };

    pruneOpts = [
      "--keep-daily=7"
      "--keep-weekly=4"
      "--keep-monthly=12"
    ];
  };

  age.secrets.restic = {
    file = ../../secrets/restic.age;
  };
}