{ config, lib, pkgs, ... }:

let
  cfg = config.modules.system.backups;
  borg = "${pkgs.borgbackup}/bin/borg";
  backup_paths = lib.unique config.modules.system.backups.paths;
  passwd_file = config.sops.secrets."borg_passwd".path;
in
{
  options.modules.system.backups = {
    enable = lib.mkEnableOption "enables backups with borg";
    paths = lib.mkOption {
      type = lib.types.listOf lib.types.path;
      default = [];
      description = "list of directories to back up";
    };
    jobs = lib.mkOption {
      type = lib.types.attrsOf (     # the set up backup jobs
        lib.types.attrsOf (   # the set of paths
          lib.types.listOf lib.types.path   # the paths
        )
      );
      default = null;
      description = "Borg backup jobs; each job has a list of paths.";
    };
    repo = lib.mkOption {
      type = lib.types.path;
      default = "/holocron/borg";
      description = "borg repository path";
    };
    passphraseFile = lib.mkOption {
      type = lib.types.path;
      default = passwd_file;
      description = "borg repository passphrase file";
    };
  };

  config = lib.mkIf (cfg.enable && backup_paths != []) {
    

    systemd.services.backups = {
      description = "backup service with borg!";
      path = [ pkgs.borgbackup ];
      serviceConfig = {
        Type = "oneshot";
        # the actual script borg is using
        ExecStart = pkgs.writeShellScript "borg-backup" ''
          set -euo pipefail
          export BORG_PASSPHRASE="$(cat ${passwd_file})"
          export BORG_REPO="${cfg.repo}"
          timestamp="$(date +'%Y-%m-%dT%H:%M:%S')"

          # Initialize repo if it doesn't exist
          if ! borg info "$BORG_REPO" >/dev/null 2>&1; then
            echo "Initializing Borg repo at $BORG_REPO"
            borg init --encryption=repokey "$BORG_REPO"
          fi

          echo "starting backup run at $timestamp"

          # Loop over all jobs (attribute set keys)
          ${lib.concatStringsSep "\n\n" (lib.mapAttrsToList (bak_name: bak_paths:
            ''
              echo "------------- Backing up ${bak_name} -------------"
              archive="${bak_name}-$timestamp"
              echo "backing up paths: ${lib.concatStringsSep " " bak_paths.paths} → $archive"
              borg create \
                --verbose \
                --filter AME \
                --list \
                --stats \
                --show-rc \
                --compression lzma,9 \
                "$BORG_REPO::$archive" \
                ${lib.concatStringsSep " " bak_paths.paths}

              echo "pruning old backups for ${bak_name}..."
              borg prune -v --list "$BORG_REPO" \
                --prefix "${bak_name}-" \
                --keep-daily=7 \
                --keep-weekly=52 \
                --keep-monthly=-1
            ''
          ) cfg.jobs)}

          echo "finshed backup at \"$BORG_REPO::$archive\"
        '';
      };
    };

    # create timer to run backups daily
    systemd.timers.backups = {
      description = "daily borg backup timer";
      wantedBy = [ "timers.target" ];
      timerConfig = {
        OnCalendar = "daily";
        Persistent = true;
      };
    };

    # install borg binary
    environment.systemPackages = [ pkgs.borgbackup ];

    # declare secret for repo password
    sops.secrets = {
      "borg_passwd" = { 
        owner = "root";
        group = "root";
      };
    };
  };
}

# add to modules
# modules.system.backups.paths = lib.mkIf cfg.backups [ <path> ];