{ pkgs, config, secrets, ... }:
{
  systemd.services = {
    notify-backup-b2-failed = {
      description = "Notify on failed backup to B2";
      serviceConfig = {
        Type = "oneshot";
        User = "nettika";
      };
      environment = {
        DBUS_SESSION_BUS_ADDRESS = "unix:path=/run/user/1000/bus";
      };
      path = [ pkgs.libnotify ];
      script = "notify-send -u critical \"Backup to B2 failed\" \"$(journalctl -u restic-backups-b2 -n 5 -o cat)\"";
    };
    restic-backups-b2 = {
      onFailure = [ "notify-backup-b2-failed.service" ];
    };
  };

  environment.etc = {
    "restic-env".text = ''
      B2_ACCOUNT_ID="${secrets.b2.accountId}"
      B2_ACCOUNT_KEY="${secrets.b2.accountKey}"
    '';
    "restic-password".text = secrets.restic.password;
  };

  services.restic.backups = {
    b2 = {
      initialize = true;
      environmentFile = "/etc/restic-env";
      repository = "b2:marauder-backup";
      passwordFile = "/etc/restic-password";
      paths = [
        "${config.users.users.nettika.home}/Documents"
        "${config.users.users.nettika.home}/Artwork"
        "${config.users.users.nettika.home}/Projects"
      ];
      pruneOpts = [
        "--keep-daily 7"
        "--keep-weekly 5"
        "--keep-monthly 12"
      ];
    };
  };
}