{config, ...}: {
  sops = {
    defaultSopsFile = ../../secrets/restic.yaml;
    secrets = {
      "b2-immich/env" = {};
      "b2-immich/repo" = {};
      "b2-immich/password" = {};
    };
  };
  services.restic.backups = {
    b2-immich = {
      initialize = true;
      environmentFile = config.sops.secrets."b2-immich/env".path;
      repositoryFile = config.sops.secrets."b2-immich/repo".path;
      passwordFile = config.sops.secrets."b2-immich/password".path;

      paths = [
        "/rice/immich"
      ];
      timerConfig = {
        OnCalendar = "06:00";
      };
      pruneOpts = [
        "--keep-daily 14"
        "--keep-monthly 6"
        "--keep-yearly 1"
      ];
    };
  };
}