{
  config,
  pkgs,
  lib,
  ...
}: let
  gcsBucket = "polyteknisk-db-backups-bucket";
  gpgRecipient = "dtu.prg@dtu.dk";

  # Embed the public key directly (not sensitive)
  gpgPublicKey = pkgs.writeText "backup-public-key.asc" ''
    -----BEGIN PGP PUBLIC KEY BLOCK-----

    mQINBGmHsFcBEADuiQeZSU2KMBT3+PAECEi4qW87WbMpeMIJlN7b5dNvSIVgaOie
    n/KNDcZiKL5WkxIoxcEy1k64EQ8oY+xdAgUItZAL4zoB2bBY2rHmbhaRx36rYOdZ
    ECI1VAe+yQ6gMSCZ26HxTSQebwocXC7LYj2qkn32TwQfNwl/93/ZSb64Np+qt8zL
    ym0yl6ruz+du2qd9eAOJSVKAiRsvvW6LxC/+jBqdgBpYXhvjtqC8wtS6hW26jing
    BauktYy3hjWy14JPCjSMIclIx7zqkW3+gu7lvGu9osKXwdjMWC1R+j1UvGufNczK
    O05RR9EVrfbrv2P0+JoxQhRhEN3TXjRmx98YwPOHzD6rG2u2mIM666Huxrl8xKhn
    cxs/p0lcbUhrmiwr3rn33r0v91s5KFhBxSNQs3FnDfET9zGx+YPwoVDpR61EelfD
    lCowWHmsjXXjcvOBGwA5quYaep7idgM9gcmMVh6OKgHo6NlgBAeQQOSsF9u832OH
    TjttMUFw0+NeaVO1hWFQgQvBNIk1b7qp77sFwRrrXsE1orC0ii4yODQ+OV7C2A8G
    2Non0yHWST4scd8WbiEOv3SLxyGlV+hER/HtHeQ7Ke8vvMUW5ZObv4qy17RHNJZS
    lQY4/cBODV04sLz2GGEChpeZ8w2ebTHxp2LhhedPgYLyi5Fr6OMcJe3WvwARAQAB
    tGtQUkcgQmFja3VwIChUaGlzIGlzIGEgR1BHIEtleSB0byBjbG91ZCBiYWNrdXAg
    ZGF0YWJhc2VzIGJlZm9yZSBiZWluZyBwdXNoZWQgdG8gdGhlIGNsb3VkLikgPGR0
    dS5wcmdAZHR1LmRrPokCUQQTAQgAOxYhBI+Qr5IHE1lTHC/nNY/ZDvQidP7iBQJp
    h7BXAhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEI/ZDvQidP7izk0Q
    AK6m5jkKU8sGsKdTqmE8cd6cLtFsbTnk6abi6iv0ZZ1wsWNie/fdy8RGuaQJOvpm
    FDxGaMaSYoMsdG/ONNRH/kBWybHba51c19Rr5ePKoL0aHHMnYuzT1xzPyQ/a/Ckh
    8WyIYflHRO0DU8sonnKlDZiwaq/bfu3FL03IsnPVbQOpZ0o8c9HIxDG0efgvO5li
    v+ajiDMld5iwvSBz9+9yDDiSNYPRipNlhaFDaoT9pM6s7ETmRCYQ75T7z0FMaugt
    iTJRz0emyj/canJ2/JrkVBGNw8Kb9JG8Nd6ix2oZagcv96niRKQoqzWyiWizNWnq
    /wQ7QHqMxXGymNseF8Ig/a/0oJs+mRYYCBNj2hkF2COQdHqSr+NduSJfaZGCdHOe
    kTeWtit9iWzeXnA6FjQX3SXynL89Nv9uJlfYZQX5Kai1DIxvPGvIpI3M1vVjGRfG
    0/WNwoCOmLRhGndaW9iqk7Xk7+k43q4CAsEsKhNQnAH7TzHOuOUmM7pSi3mK4Eby
    6tmiz0nJRdXwh0Fgl3VUZfU6aQqD5cdPDP4EAJpUuR1LCHMQLkDEL61gibBvuPkv
    nsuqKuG2avFU87CCxZjusWtvp11Pv3JA2gmVPETWp3Gw0Yi+sIgLFKI4HOyb2UdB
    STooGKvwHVfGm+AKovitDFT0eHlcUCkJFP6U+TRCYKNMuQINBGmHsFcBEACkbyGK
    9T3+FJydvYAdCkkdohTy4yyOuOC+9P3Fv3LN2jM+CqdW8LPKZKgU4upemae3hANQ
    345fTebYqvrCyaHbdSV64q9leV0M/NwAiDOpWYHUVuM2vKciBTalx+d9TgnW5gLk
    QuG+G+gD43GLr9wj/Ewuyj0bGx16jzFk0iD9ZcCEvBjE3Fymd3UFQmFMpsMPZ+CB
    KgnwksD0SmUFA1budhB+okFGfcHympMwebKCR30Kb1/MV9Y3GgPwjzOeL3vckhuo
    0bYKh6FLHv83DRnVDTBA2LgT9AprjHIZAOgpVyWWFz6WU5oSIGnHCrf9RSLor1BR
    QwRQsoqWgea4qSDfnyCzZcmYf4H8aV/QOl5GDSSQ4XWFBRGZ/gke3AiRKTRCFvgg
    0iDL2m4oNuHlnM/J2sg25mBMItutPPK+UFQWDVvaVXe64/yDaKOLFN+9k5GGneIG
    rh0ucCY3OOUZPotC94YbTWSZGmxwouFVvfHkuxN9DtL2w9au/60i+Z0/cbMfUgqc
    URsgxnGTb7OncCWj3WNqLVoxF4l8lFEKQXx/EJblasx68vV318q7AsTCWOK+c3m6
    K50yXfagyqLbcXKwmSpYz/NJ6ozyVmd1LEULNpP2TPrCE5n/iCG284IRkESRVkgC
    JdXOL8jdTcUHUAvZ0MRonXydRhWOvJlljoxlgQARAQABiQI2BBgBCAAgFiEEj5Cv
    kgcTWVMcL+c1j9kO9CJ0/uIFAmmHsFcCGwwACgkQj9kO9CJ0/uLQzg/9F1FekOup
    NOSwqfCWWZCURe0onigkGlRmVzxbefkiFWyBPoVIpyPWEOfKBDlSSeg7caeYyXK0
    3s9uLFJ/qiusIFhgts/Y4nmbW3E6CfuOUhwukKJqWbv2HTBDzypUgiNiyYWSitU0
    Xt1I3P3M8rAp1X/WJ/jZ5pTGqc9Rh+zvQIuYU3+MWOVds6nfPpUFv5EDsa88puLS
    ti5O7/dqV6TEp9qpDofKkIiUlWbDZQ1te2DmasgskGwVMLNZ5rxwzSxrZKwHAhQ4
    7FuvISIK5QOy2dEjVdjgB9eD+RBvDbsxB/i5bIn5l2TPIaKq0SzcG3N2msfUUGuF
    BGeRgAnlPgLH+2rOZh6KH8FlRUHH9pxkiSo87qXmgxkA1XNeZp0wV8yOFWiPvW22
    kgTmmOIftXIfMWFlM6+fp+WDO3Fhh3XvSvjeBHJRaSp3e9dRqm5U8qtoGfqgJklE
    6TJBj6xOqh+i3CC/4EymjvO5+1X9CUsR+TsKvT0t7c0DW78S+Ly+gKAUPgNv0ifs
    3GU403nHnHD/Esl9r+xLdMPdU4x37uL48dByxHZ1ThR11u5QZBSVSToRQFca4/nL
    swC2tsvzP503rVKFehdavT7wxYER03Gz6/y5JueHuBN5RgP6H6PLBu32FjDQPLK2
    DFYqkeE28Uzz52DpHGvbw4cT08w17WWrf6A=
    =jpAS
    -----END PGP PUBLIC KEY BLOCK-----
  '';

  postgresBackupScript = pkgs.writeShellScript "backup-postgresql" ''
    set -euo pipefail

    export GOOGLE_APPLICATION_CREDENTIALS="${config.sops.secrets.gcloud_bucket.path}"
    export PATH="${lib.makeBinPath [pkgs.postgresql pkgs.gzip pkgs.google-cloud-sdk pkgs.gnupg pkgs.coreutils pkgs.gnugrep]}:$PATH"
    #gcloud auth activate-service-account --key-file="$GOOGLE_APPLICATION_CREDENTIALS"

    TIMESTAMP=$(date +%Y%m%d%H%M%S)
    BACKUP_DIR=$(mktemp -d)
    trap 'rm -rf "$BACKUP_DIR"' EXIT

    gpg --batch --import "${gpgPublicKey}"

    DATABASES=$(psql -U postgres -t -c "SELECT datname FROM pg_database WHERE datistemplate = false AND datname != 'postgres';" | grep -v '^$')

    for DB in $DATABASES; do
      DB=$(echo "$DB" | xargs)
      echo "Backing up PostgreSQL database: $DB"
      FILENAME="pgsql_''${DB}_''${TIMESTAMP}.sql.gz.gpg"
      if pg_dump -U postgres -d "$DB" | gzip | gpg --batch --trust-model always --encrypt --recipient "${gpgRecipient}" > "$BACKUP_DIR/$FILENAME"; then
        gcloud storage cp "$BACKUP_DIR/$FILENAME" "gs://${gcsBucket}/postgresql/$FILENAME"
        echo "Successfully uploaded encrypted $FILENAME"
      else
        echo "Failed to backup $DB" >&2
        exit 1
      fi
    done
  '';

  mariadbBackupScript = pkgs.writeShellScript "backup-mariadb" ''
    set -euo pipefail

    export GOOGLE_APPLICATION_CREDENTIALS="${config.sops.secrets.gcloud_bucket.path}"
    export PATH="${lib.makeBinPath [pkgs.mariadb pkgs.gzip pkgs.google-cloud-sdk pkgs.gnupg pkgs.coreutils pkgs.gnugrep]}:$PATH"
    #sudo gcloud auth activate-service-account --key-file="$GOOGLE_APPLICATION_CREDENTIALS"

    TIMESTAMP=$(date +%Y%m%d%H%M%S)
    BACKUP_DIR=$(mktemp -d)
    trap 'rm -rf "$BACKUP_DIR"' EXIT

    gpg --batch --import "${gpgPublicKey}"

    DATABASES=$(mariadb -u root -e "SHOW DATABASES;" | grep -Ev "^(Database|information_schema|performance_schema|mysql|sys)$")

    for DB in $DATABASES; do
      echo "Backing up MariaDB database: $DB"
      FILENAME="mariadb_''${DB}_''${TIMESTAMP}.sql.gz.gpg"
      if mariadb-dump -u root "$DB" | gzip | gpg --batch --trust-model always --encrypt --recipient "${gpgRecipient}" > "$BACKUP_DIR/$FILENAME"; then
        gcloud storage cp "$BACKUP_DIR/$FILENAME" "gs://${gcsBucket}/mariadb/$FILENAME"
        echo "Successfully uploaded encrypted $FILENAME"
      else
        echo "Failed to backup $DB" >&2
        exit 1
      fi
    done

  '';
in {
  systemd.services.backup-postgresql = {
    description = "Backup PostgresSQL databases to GCS";
    serviceConfig = {
      Type = "oneshot";
      User = "root";
      ExecStart = "${postgresBackupScript}";
    };
  };

  systemd.timers.backup-postgresql = {
    description = "Timer for PostgresSQL backups";
    wantedBy = ["timers.target"];
    timerConfig = {
      OnCalendar = "Mon,Thu,Sun 03:00";
      Persistent = true;
    };
  };

  systemd.services.backup-mariadb = {
    description = "Backup MariaDB databases to GCS";
    serviceConfig = {
      Type = "oneshot";
      User = "root";
      ExecStart = "${mariadbBackupScript}";
    };
  };

  systemd.timers.backup-mariadb = {
    description = "Timer for MariaDB backups";
    wantedBy = ["timers.target"];
    timerConfig = {
      OnCalendar = "Mon,Thu,Sun 04:00";
      Persistent = true;
    };
  };
}