{ lib
, pkgs
, config
, ...
}:
assert (builtins.length
  (lib.mapAttrsToList (a: _: a) config.services.restic.backups))
  <= 1; let
  resticBin = "${pkgs.restic}/bin/restic";
  cfg = config.services.restic.backups;
  bkp = lib.mapAttrs' (_: lib.nameValuePair "default") cfg;
in
''
  #!/usr/bin/env sh

  set -e

  export $(cat ${bkp.default.environmentFile})
  ${resticBin} -r ${bkp.default.repository} --password-file ${bkp.default.passwordFile} $@
''