{ ... }:

{
  # Outbound: back up homeserver to VPS
  services.borgbackup.jobs.homeserver = {
    paths = [
      "/var/lib"
      "/etc"
      "/home"
    ];
    repo = "ssh://borg@10.10.0.1/./homeserver";
    environment.BORG_RSH = "ssh -i /etc/borg/ssh_key";
    encryption = {
      mode = "repokey";
      passCommand = "cat /etc/borg/passphrase";
    };
    compression = "zstd";
    startAt = "daily";
    prune.keep = {
      daily = 7;
      weekly = 4;
      monthly = 6;
    };
    exclude = [
      "/var/lib/docker"
      "/var/lib/containers"
      "/var/lib/systemd/coredump"
      "*.pyc"
      "__pycache__"
      ".cache"
    ];
  };

  # Inbound: accept desktop backups
  services.borgbackup.repos.desktop = {
    path = "/var/lib/borg/desktop";
    authorizedKeys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINvKMpaawaw5bp73/W4dm0YEZa2FT99pXHLOYqZS8NPL borg-desktop"
    ];
  };
}