{ ... }: {
  services.restic.backups.hetzner-vm = {
    user = "root";
    paths = [ "/var/lib/postgresql" "/var/lib/vault" ];
    timerConfig = {
      OnBootSec = "1m";
      OnCalendar = "daily";
    };
    repository = "/root/backup";
    passwordFile = "/secrets/restic-password";
    environmentFile = "/secrets/restic-env";
  };
}