{
  config,
  pkgs,
  lib,
  ...
}: let
  service = "offsite";
  cfg = config.holocron.${service};
  sec = config.sops.secrets;
in {
  options.holocron.offsite = {
    enable = lib.mkEnableOption "enables backup script for holocron fileshare";
    paths = lib.mkOption {
      type = with lib.types; listOf str;
      default = [
        "/holocron/srv"
        "/holocron/users"
      ];
      description = "list of paths to backup";
    };
    offsite_user = lib.mkOption {
      type = lib.types.str;
      default = "lifeboat";
      description = "user to connect to offsite host with";
    };
    offsite_target = lib.mkOption {
      type = lib.types.str;
      default = "lifeboat.holocron.blue";
      description = "ip or domain for offsite backups";
    };
    offsite_dir = lib.mkOption {
      type = lib.types.str;
      default = "lifeboat/holocron";
      description = "path to rsync offsite backups to";
    };
  };

  config = lib.mkIf cfg.enable {
    systemd.services.${service} = {
      description = "holocron daily sync";

      serviceConfig = {
        Type = "oneshot";
        User = "root";
        Group = "archives";
      };

      script = ''
        ${pkgs.sshpass}/bin/sshpass -f ${sec."lifeboat_rsync".path} \
          ${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
          -e "${pkgs.openssh}/bin/ssh -o StrictHostKeyChecking=no" \
          ${builtins.concatStringsSep " " cfg.paths}  \
          ${cfg.offsite_user}@${cfg.offsite_target}::${cfg.offsite_dir}
      '';
    };

    systemd.timers.${service} = {
      description = "timer for ${service}";

      wantedBy = ["timers.target"];

      timerConfig = {
        OnCalendar = "*-*-* 05:00:00";
        Persistent = true;
      };
    };
  };
}