{ lib, ... }:

    { lib, config, ... }:

      inherit (config.age) secrets;
      inherit (config.networking) hostName;

        # Backup creation helper with restic to keep constants consistent.
        # Can be used like so:
        # `services.restic.backups.<service> = mkResticBackup "<service>" { <rest> }`
        mkResticBackup =
          name: rest:
          {
            repository = "s3:https://fsn1.your-objectstorage.com/plumjam/backups/${hostName}/${name}";
            passwordFile = secrets.resticPassword.path;
            initialize = true;
            pruneOpts = [
              "--keep-daily 8"
              "--keep-weekly 5"
              "--keep-monthly 3"
            ];
          }
          // rest;

              resticPassword.rekeyFile = ../secrets/plum-restic-password.age;

      inherit (config.myLib) merge;

      inherit (config.myLib) merge mkResticBackup;

      # backup configuration for sqlite database and data
      systemd.services.forgejo-backup = {
        description = "Backup Forgejo data and database";
        after = [ "forgejo.service" ];
        script = ''
          mkdir -p /var/backup/forgejo
          cp -r /var/lib/forgejo /var/backup/forgejo/$(date +%Y%m%d_%H%M%S)
          # keep only last 7 backups
          ls -1t /var/backup/forgejo/ | tail -n +8 | xargs -r rm -rf
        '';
        serviceConfig = {
          Type = "oneshot";
          User = "forgejo";
        };
      };
      systemd.timers.forgejo-backup = {
        description = "Run Forgejo backup daily";
        wantedBy = [ "timers.target" ];

        timerConfig = {
          OnCalendar = "daily";
          Persistent = true;
        };

      services.restic.backups.forgejo = mkResticBackup "forgejo" {
        paths = [ "/var/lib/forgejo" ];
        exclude = [ "/var/lib/forgejo/data/repo-archive" ];