{pkgs, ...}: let
  backupUser = "backup-ingest";
  backupGroup = "backup-ingest";
  backupRoot = "/srv/veeam-ingest";
  cldBackupTarget = "${backupRoot}/AZ-CLD-1/var-backup";
in {
  users.groups.${backupGroup} = {};

  users.users.${backupUser} = {
    isSystemUser = true;
    group = backupGroup;
    home = backupRoot;
    createHome = false;
    shell = pkgs.bashInteractive;
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL6FhMvJqh7m+AfC5yeHUIxhEvalSoA5OzqtDVstuAX1 cld-var-backup-sync@AZ-CLD-1-to-AZ-PRM-1"
    ];
  };

  systemd.tmpfiles.rules = [
    "d ${backupRoot} 0750 ${backupUser} ${backupGroup} - -"
    "d ${backupRoot}/AZ-CLD-1 0750 ${backupUser} ${backupGroup} - -"
    "d ${cldBackupTarget} 0750 ${backupUser} ${backupGroup} - -"
  ];
}