"hosts/plum/password.age".publicKeys = [ plum ] ++ admins;
  "hosts/kiwi/password.age".publicKeys = [ kiwi ] ++ admins;
  "hosts/plum/id.age".publicKeys       = [ plum ] ++ admins;
  "hosts/pear/id.age".publicKeys       = [ pear ] ++ admins;
	"hosts/kiwi/id.age".publicKeys       = [ kiwi ] ++ admins;

  "hosts/plum/password.age".publicKeys         = [ plum ] ++ admins;
  "hosts/kiwi/password.age".publicKeys         = [ kiwi ] ++ admins;
  "hosts/plum/id.age".publicKeys               = [ plum ] ++ admins;
  "hosts/pear/id.age".publicKeys               = [ pear ] ++ admins;
	"hosts/kiwi/id.age".publicKeys               = [ kiwi ] ++ admins;
	"hosts/plum/forgejo-password.age".publicKeys = [ plum ] ++ admins;

  # secrets for forgejo
  age.secrets.forgejoAdminPassword = {
    file = ../hosts/plum/forgejo-password.age;
    owner = "forgejo";
    group = "forgejo";
  };

    };
    # backup configuration for sqlite database and data
    systemd.services.forgejo-backup = {
      description = "Backup Forgejo data and database";
      after = [ "forgejo.service" ];
      script = ''
        mkdir -p /var/backup/forgejo
        cp -r /var/lib/forgejo /var/backup/forgejo/$(date +%Y%m%d_%H%M%S)
        # keep only last 7 backups
        ls -1t /var/backup/forgejo/ | tail -n +8 | xargs -r rm -rf
      '';
      serviceConfig = {
        Type = "oneshot";
        User = "forgejo";
      };

    systemd.timers.forgejo-backup = {
      description = "Run Forgejo backup daily";
      wantedBy = [ "timers.target" ];
      timerConfig = {
        OnCalendar = "daily";
        Persistent = true;
      };
    };

}

}