{ pkgs, config, ... }: {
  systemd.services = {
    notify-backup-b2-failed = {
      description = "Notify on failed backup to B2";
      serviceConfig = {
        Type = "oneshot";
        User = "nettika";
      };
      environment = {
        DBUS_SESSION_BUS_ADDRESS = "unix:path=/run/user/1000/bus";
      };
      path = [ pkgs.libnotify ];
      script = ''
        notify-send -u critical "Backup to B2 failed" "$(journalctl -u restic-backups-b2 -n 5 -o cat)"'';
    };
    restic-backups-b2 = { onFailure = [ "notify-backup-b2-failed.service" ]; };
  };

  age.secrets = {
    restic-env.file = ./secrets/restic-env.age;
    restic-password.file = ./secrets/restic-password.age;
  };

  services.restic.backups = {
    b2 = {
      initialize = true;
      environmentFile = config.age.secrets.restic-env.path;
      passwordFile = config.age.secrets.restic-password.path;
      repository = "b2:marauder-backup";
      paths = let home = config.users.users.nettika.home;
      in [
        "${home}/Artwork"
        "${home}/Documents"
        "${home}/Music"
        "${home}/Pictures"
        "${home}/Projects"
        "${home}/Videos"
      ];
      pruneOpts = [ "--keep-daily 7" "--keep-weekly 5" "--keep-monthly 12" ];
    };
  };
}