{config, pkgs, ...}:
{
 services.restic = {
   backups = {
     vpsBackup = {
       user = "root";
       paths = [
         "/var/lib/private/lldap"
         "/var/lib/headscale"
       ];
       passwordFile = config.age.secrets.resticPW.path;
       repository = "/backup";
       initialize = true;
       
       timerConfig = {
         OnCalendar = "03:00";
	 RandomizedDelaySec = "30min";
       };
     };
   };
 };

  systemd.services."restore-vps" = {
    script = ''
      set -e
      systemctl stop lldap
      systemctl stop headscale 
      rm -rf /var/lib/private/lldap
      rm -rf /var/lib/headscale
      ${pkgs.restic}/bin/restic restore latest --target /
      systemctl start lldap
      systemctl start headscale 
    '';
    serviceConfig = {
      Type = "oneshot";
      User = "root";
      Environment = [
        "RESTIC_PASSWORD_FILE=${config.age.secrets.resticPW.path}"
        "RESTIC_REPOSITORY=/backup"
      ];
    };
  };

}