{ config, pkgs, ... }:
let
  nostrDb   = "/var/lib/nostr-rs-relay/nostr.db";
  jiroriDb  = "/var/lib/jirorian/jirorian.db";
  dumpDir   = "/tmp/borg-dumps";
in
{
  sops.secrets.borg_ssh_key    = { mode = "0400"; };
  sops.secrets.borg_passphrase = {};

  services.borgbackup.jobs.databases = {
    repo  = "ssh://snh7mkwh@snh7mkwh.repo.borgbase.com/./repo";
    paths = [
      dumpDir
      "/var/lib/tor/keys"
      "/var/lib/tor/fingerprint"
      "/var/lib/tor/fingerprint-ed25519"
      "/var/lib/tor/hashed-fingerprint"
      "/var/lib/tailscale"
    ];

    encryption = {
      mode        = "repokey-blake2";
      passCommand = "cat ${config.sops.secrets.borg_passphrase.path}";
    };

    environment.BORG_RSH =
      "ssh -i ${config.sops.secrets.borg_ssh_key.path} -o StrictHostKeyChecking=accept-new";

    preHook = ''
      mkdir -p ${dumpDir}
      ${pkgs.sqlite}/bin/sqlite3 ${nostrDb}  ".backup '${dumpDir}/nostr.db'"
      ${pkgs.sqlite}/bin/sqlite3 ${jiroriDb} ".backup '${dumpDir}/jirorian.db'"
    '';

    postHook = ''
      rm -f ${dumpDir}/nostr.db ${dumpDir}/jirorian.db
    '';

    startAt = "daily";

    prune.keep = {
      daily   = 7;
      weekly  = 4;
      monthly = 6;
    };
  };
}