{ pkgs, lib, config, machineName, machines, ... }:
let
  inherit (config) networking;
  inherit (config.services) syncoid;
  inherit (config.security) gnupg;
in
{
networking.nftables.ruleset = ''
  add rule inet filter fw2net \
    skuid "${syncoid.user}" \
    tcp dport 22 \
    ip daddr ${machines.mermet.extraArgs.ipv4} \
    counter accept \
    comment "SSH to mermet"
'';
security.gnupg.secrets."ssh/backup.ssh-ed25519" = {
  user = syncoid.user;
};
users.groups.keys.members = [ syncoid.user ];
services.syncoid = {
  enable = true;
  interval = "*-*-* *:05:00";
  sshKey = gnupg.secrets."ssh/backup.ssh-ed25519".path;
  commonArgs = [
    "--no-sync-snap"
    "--create-bookmark"
    #"--no-privilege-elevation"
    #"--no-stream"
  ];
  service = {
    after = [ gnupg.secrets."ssh/backup.ssh-ed25519".service ];
    wants = [ gnupg.secrets."ssh/backup.ssh-ed25519".service ];
  };
  commands = {
    "${machineName}/home/julm/work" = {
      sendOptions = "raw";
      target = "backup@mermet.${networking.domain}:rpool/backup/${machineName}/home/julm/work";
    };
    "backup@mermet.${networking.domain}:rpool/var/mail" = {
      sendOptions = "raw";
      target = "${machineName}/backup/mermet/var/mail";
    };
    "backup@mermet.${networking.domain}:rpool/var/public-inbox" = {
      sendOptions = "raw";
      target = "${machineName}/backup/mermet/var/public-inbox";
    };
    "backup@mermet.${networking.domain}:rpool/var/www" = {
      sendOptions = "raw";
      target = "${machineName}/backup/mermet/var/www";
    };
    "backup@mermet.${networking.domain}:rpool/var/git" = {
      sendOptions = "raw";
      target = "${machineName}/backup/mermet/var/git";
    };
    "backup@mermet.${networking.domain}:rpool/var/redis" = {
      sendOptions = "raw";
      target = "${machineName}/backup/mermet/var/redis";
    };
    "backup@mermet.${networking.domain}:rpool/home/julm/mail" = {
      sendOptions = "raw";
      target = "${machineName}/backup/mermet/home/julm/mail";
    };
    "backup@mermet.${networking.domain}:rpool/home/julm/log" = {
      sendOptions = "raw";
      target = "${machineName}/backup/mermet/home/julm/log";
    };
  };
};
}