{pkgs, ...}: let
  rclone-raspberry = pkgs.writeShellScriptBin "rclone-raspberry" (let
    vault = "${pkgs.vault-bin}/bin/vault";
    jq = "${pkgs.jq}/bin/jq";
    rclone = "${pkgs.rclone}/bin/rclone";
  in ''
    TMP_DIR="$(mktemp -d)"

    cp ${../data/rclone_config.template} "$TMP_DIR/rclone.conf"

    vault-login 2>&1

    STORAGEBOX_PASSWORD=$(${vault} kv get -format json "/api-keys/hetzner/storagebox" \
      | ${jq} -r ".data.data.password")
    STORAGEBOX_PASSWORD=$(rclone obscure "$STORAGEBOX_PASSWORD")

    sed -i "s/STORAGEBOX_PASSWORD/$STORAGEBOX_PASSWORD/" "$TMP_DIR/rclone.conf"

    ${rclone} --config "$TMP_DIR/rclone.conf" "$@"
    returnVal=$?

    rm -rf "$TMP_DIR"

    return returnVal
  '');
in {
  environment.systemPackages = with pkgs; [rclone rclone-raspberry];
}