{pkgs, ...}: let
  backupScript = pkgs.writeShellScript "weekly-backup" ''
    BACKUP_DIR="/home/admin/backups"
    SRC="/home/admin"
    DATE=$(date +%Y-%m-%dT%H-%M-%S)
    FILENAME="weekly-backup-$DATE.tar.gz"

    mkdir -p "$BACKUP_DIR"
    # Backup everything under /home/admin EXCEPT:
    # - The backups dir itself (infinite loop)
    # - DMS mail data (GBs of email, backed up separately)
    # - NixOS-managed service data (at their own paths below)
    tar czf "$BACKUP_DIR/$FILENAME" \
      --exclude="$BACKUP_DIR" \
      --exclude="/home/admin/backups" \
      --exclude="/home/admin/dms/mail-data" \
      --exclude="/home/admin/dms/mail-state" \
      "$SRC"

    # Prune backups older than 14 days
    find "$BACKUP_DIR" -name "weekly-backup-*" -mtime +14 -delete
  '';
in {
  systemd.services.weekly-backup = {
    description = "Weekly backup of home directory";
    path = with pkgs; [coreutils gnutar findutils];
    serviceConfig = {
      Type = "oneshot";
      ExecStart = "${backupScript}";
      User = "root";
    };
  };

  systemd.timers.weekly-backup = {
    wantedBy = ["timers.target"];
    timerConfig = {
      OnCalendar = "Mon *-*-* 03:00:00";
      Persistent = true;
    };
  };
}