{
  config,
  pkgs,
  ...
}: let
  serviceName = "cld-var-backup-sync";
  sourceDir = "/var/backup/";
  targetHost = "100.91.49.26";
  targetPort = "2022";
  targetUser = "backup-ingest";
  targetDir = "/srv/veeam-ingest/AZ-CLD-1/var-backup/";
  sshKey = config.age.secrets.cld-var-backup-sync-ssh-key.path;
in {
  environment.systemPackages = with pkgs; [
    rsync
    openssh
  ];

  systemd.tmpfiles.rules = [
    "d /var/lib/${serviceName} 0700 root root - -"
  ];

  systemd.services.${serviceName} = {
    description = "Mirror /var/backup from AZ-CLD-1 to AZ-PRM-1 for VEEAM";
    after = ["network-online.target" "netbird.service"];
    wants = ["network-online.target" "netbird.service"];

    path = with pkgs; [
      coreutils
      openssh
      rsync
      util-linux
    ];

    serviceConfig = {
      Type = "oneshot";
      User = "root";
      Group = "root";
      RuntimeDirectory = serviceName;
      RuntimeDirectoryMode = "0700";
      LockPersonality = true;
      NoNewPrivileges = true;
      PrivateTmp = true;
    };

    script = ''
      set -euo pipefail

      lock_file="/run/${serviceName}/${serviceName}.lock"

      flock -n "$lock_file" \
        rsync \
          -aH \
          --no-owner \
          --no-group \
          --no-devices \
          --no-specials \
          --numeric-ids \
          --delete \
          --partial \
          --delay-updates \
          --human-readable \
          --stats \
          -e "ssh -i ${sshKey} -p ${targetPort} -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/var/lib/${serviceName}/known_hosts" \
          ${sourceDir} \
          ${targetUser}@${targetHost}:${targetDir}
    '';
  };

  systemd.timers.${serviceName} = {
    wantedBy = ["timers.target"];
    timerConfig = {
      OnCalendar = "*-*-* 05:00:00";
      Persistent = true;
      RandomizedDelaySec = "10m";
      Unit = "${serviceName}.service";
    };
  };
}