{ config, lib, pkgs, ... }:

let
  borg = "${pkgs.borgbackup}/bin/borg";
  backup_paths = lib.unique config.modules.system.backups.paths;
  passwd_file = config.sops.secrets."borg_passwd".path;
in
{
  options.modules.system.backups = {
    paths = lib.mkOption {
      type = lib.types.listOf lib.types.path;
      default = [];
      description = "list of directories to back up";
    };
    repo = lib.mkOption {
      type = lib.types.path;
      default = "/backups";
      description = "borg repository path";
    };
    passphraseFile = lib.mkOption {
      type = lib.types.path;
      default = passwd_file;
      description = "borg repository passphrase file";
    };
  };

  config = lib.mkIf (backup_paths != []) {
    systemd.services.borg-backup = {
      description = "BorgBackup service for system data";
      serviceConfig = {
        Type = "oneshot";
        EnvironmentFile = config.modules.system.backups.passphraseFile;
      };
      script = ''
        set -eux
        export BORG_REPO=${config.modules.system.backups.repo}
        export BORG_PASSPHRASE="$(cat ${config.modules.system.backups.passphraseFile})"

        # Initialize repo if it doesn’t exist
        if ! ${borg} info "${repo}" >/dev/null 2>&1; then
          echo "Initializing new Borg repository at ${repo}"
          ${borg} init --encryption=repokey "${repo}"
        fi

        timestamp=$(date +%Y-%m-%d_%H-%M-%S)

        ${borg} create \
          --stats \
          --compression zstd,3 \
          ::${timestamp} \
          ${lib.concatStringsSep " " backup_paths}

        # Retention policy
        ${borg} prune -v --list \
          --keep-daily=7 \
          --keep-weekly=52 \
          --keep-monthly=-1
      '';
    };

    systemd.timers.borg-backup = {
      description = "daily borg backup timer";
      wantedBy = [ "timers.target" ];
      timerConfig = {
        OnCalendar = "daily";
        Persistent = true;
      };
    };

    environment.systemPackages = [ pkgs.borgbackup ];
  };
}

# add to module
# modules.system.backups.paths = lib.mkIf cfg.backups [ <path> ];