{
  sops.secrets = builtins.listToAttrs (map (n: {
    name = "restic/${n}";
    value = {
      sopsFile = ../secrets/sops/restic.yaml;
      group = "restic-backup";
      mode = "0440";
    };
  }) [ "rest-env" "backup-bot-env" ]);

  users.groups.restic-backup = { };
}