{ pkgs, ... }: {
  services.borgmatic = {
    enable = true;
    configurations = {
      default = {
        repositories = [
          { label = "plinth"; path = "ssh://backup@100.66.18.84/./plinth"; }
        ];
        source_directories = [
          "/etc/letsencrypt"
          "/srv/pds/data"
          "/srv/pds-testing/data"
        ];
        encryption_passcommand = "${pkgs.coreutils}/bin/cat /root/.borg_password";

        compression = "auto,zstd,10";
        relocated_repo_access_is_ok = true;

        keep_daily = 7;
        keep_weekly = 4;
        keep_monthly = 6;
        keep_yearly = 4;

        exclude_if_present = ["CACHEDIR.tag"];
      };
    };
  };
}