{
  config,
  lib,
  ...
}: let
  inherit
    (lib)
    mkIf
    mkEnableOption
    ;
  cfg = config.services.mathebau-borgbackup;
in {
  imports = [];

  options.services.mathebau-borgbackup = {
    enable = mkEnableOption "mathebau borgbackup service";
  };

  config = mkIf cfg.enable {
    services.borgbackup = {
      # repos are made available at ssh://borg@hostname and served according to the presented ssh-key
      repos = {
        aphoom-zhah = {
          authorizedKeysAppendOnly = [
            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA8pI6uinXezAMH4vG2yEbu/yOYU5vXcsZN74tYgV+Wj Aphoom-Zhah Backup"
          ];
          path = "/var/lib/backups/aphoom-zhah";
          # subrepos are allowed because each vm creates at least one repo below this filepath and yibb-tstll even more
          allowSubRepos = true;
        };
        azathoth = {
          authorizedKeysAppendOnly = [
            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGBEwllQ77ktoirXX6dJ6ET8TfK4lzq0aaq+X4rrX2Vk Azathoth Backup"
          ];
          path = "/var/lib/backups/azathoth";
          allowSubRepos = true;
        };
        cthulhu = {
          authorizedKeysAppendOnly = [
            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSJl1MvabUADTdOCgufsBzn1tIIpxMq4iDcYZsaW1lV Cthulhu Backup"
          ];
          path = "/var/lib/backups/cthulhu";
          allowSubRepos = true;
        };
        dagon = {
          authorizedKeysAppendOnly = [
            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJaTBennwqT9eB43gVD1nM1os3dMPZ8RWwIKPEjqMK5V Dagon Backup"
          ];
          path = "/var/lib/backups/dagon";
          allowSubRepos = true;
        };
        eihort = {
          authorizedKeysAppendOnly = [
            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHLoDxtY4Tp6NKxLt9oHmWT6w4UpU6eA1TnPU2Ut83BN Eihort Backup"
          ];
          path = "/var/lib/backups/eihort";
          allowSubRepos = true;
        };
        fsaccount = {
          authorizedKeysAppendOnly = [
            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG+Y7fQTYdIWHehrKdk92CaJ0AisEux4OrS4nIyMstU4 FS Account Backup"
          ];
          path = "/var/lib/backups/fsaccount";
          allowSubRepos = true;
        };
        hastur = {
          authorizedKeysAppendOnly = [
            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILeDvTyOUdIPARatX0PPhHgrV1gjERWLt2Twa8E2GETb Hastur Backupsystem"
          ];
          path = "/var/lib/backups/hastur";
          allowSubRepos = true;
        };
        ithaqua = {
          authorizedKeysAppendOnly = [
            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPJmBf8cz3FTDdeuxWbp1MO2yPT5rvH8ZIGUzfogjpXi Ithaqua Backup"
          ];
          path = "/var/lib/backups/ithaqua";
          allowSubRepos = true;
        };
        sanctamariamaterdei = {
          authorizedKeysAppendOnly = [
            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH9Le5OI4ympQ0mQKYHmxgxGF598rzpD5VVpWK1mGfd8 Sanctamariamaterdei Backupsystem"
          ];
          path = "/var/lib/backups/sanctamariamaterdei";
          allowSubRepos = true;
        };
        tsathoggua = {
          authorizedKeysAppendOnly = [
            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKS9/1lFOhv+3sNuGcysM3TYh2xRrjMeAZX3K7CBx0QW Tsathoggua Backup"
          ];
          path = "/var/lib/backups/tsathoggua";
          allowSubRepos = true;
        };
        uvhash = {
          authorizedKeysAppendOnly = [
            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB8DjIqgFgmYhQnTLpbqL0r7xBPb8TPy6SO5RhQ31OGj Uvhash Backup"
          ];
          path = "/var/lib/backups/uvhash";
          allowSubRepos = true;
        };
        yibb-tstll = {
          authorizedKeysAppendOnly = [
            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlnGOV58Ks9lu+WTI4F7QAHtDrJq2jY8ZocITZG8K0+ Yibb-Tstll Backup"
          ];
          path = "/var/lib/backups/yibb-tstll";
          allowSubRepos = true;
        };
      };
      # Configure backup of files on the department's fs account
      jobs.fsaccount = {
        preHook = ''
          rm -rf /home/fsaccount/sicherung
          mkdir /home/fsaccount/sicherung
          scp -i /home/fsaccount/.ssh/fsaccount -r fachschaft@gw1.mathematik.tu-darmstadt.de:/home/fachschaft/* /home/fsaccount/sicherung/
        '';
        paths = "/home/fsaccount/sicherung";
        encryption.mode = "none";
        environment.BORG_RSH = "ssh -i /home/fsaccount/.ssh/fsaccount";
        repo = "ssh://borg@localhost:fsaccount";
        startAt = "hourly";
        user = "fsaccount";
        group = "users";
        readWritePaths = ["/home/fsaccount"];
      };
    };
    environment.persistence.${config.impermanence.name} = {
      directories = [
        {
          directory = "/home/fsaccount/.ssh"; # SSH Key with access to FS Account and Borg repo and known_hosts
          user = "fsaccount";
          group = "users";
          mode = "u=rwx,g=,o=";
        }
      ];
    };
    # Extra user for FS account backup
    users.users = {
      fsaccount = {
        description = "FS Account backup";
        isNormalUser = true;
      };
    };
  };
}