{
  config,
  name,
  ...
}: {
  sops.secrets."restic/default-password" = {};

  homelab = {
    enable = true;
    hostname = name;
    tags = [name];

    monitoring.enable = true;
    logging.enable = true;
    motd.enable = true;

    backups = {
      enable = true;
      backends = {
        restic = {
          enable = true;
          repository = "/srv/restic-repo";
          passwordFile = config.sops.secrets."restic/default-password".path;
        };
      };
      jobs = [
        {
          name = "sandbox-home";
          backend = "restic";
          backendOptions = {
            paths = ["/home/plasmagoat"];
            repository = "/srv/restic-repo";
            pruneOpts = [
              "--keep-daily 7"
              "--keep-weekly 4"
              "--keep-monthly 6"
              "--keep-yearly 3"
            ];
          };
        }
      ];
    };

    # services.loki.enable = true;
    # services.prometheus.enable = true;
    # services.grafana.enable = true;
    # services.gatus.enable = true;
    services.vaultwarden.enable = true;
    services.caddy.enable = true;
  };

  system.stateVersion = "25.05";
}