{ config, ... }:
{
  services.restic = {
    enable = true;

    backups = {
      localbackup = {
        exclude = [
          "/home/*/.cache/*"
          "*venv*"
        ];
        initialize = true;
        passwordFile = config.age.secrets.restic-password.path;
        paths = [
          "/home"
        ];
        repository = "s3:https://s3.filmsli.de/restic-framework";
        environmentFile = ''
          AWS_ACCESS_KEY_ID=XFRV1PZVN3W4OJMTTQRS
          AWS_SECRET_ACCESS_KEY=${builtins.readFile config.age.secrets.restic-s3-key.path}
        '';
      };
    };
  };
}