{ config, pkgs, lib, ... }: {
  # set configuration in ~ so tarsnap cli works interactively
  home.file.".tarsnaprc".text = ''
    cachedir ${config.xdg.cacheHome}
    keyfile ${config.xdg.configHome}/tarsnap/read-write-delete.key
    nodump
    print-stats
    checkpoint-bytes 1G
    humanize-numbers
  '';
  # tarsnap periodic backup configuration
  launchd.agents.tarsnap = let
    logPath = "${config.xdg.stateHome}/tarsnap";
    tarsnapBackup = pkgs.writeShellScriptBin "tarsnap-backup-helper" ''
      date=$(date -u +%Y-%m-%dT%H:%M:%SZ)
      echo
      echo "Running tarsnap backup for $date"
      ${lib.getExe pkgs.tarsnap} -c \
        --configfile ${config.home.homeDirectory}/.tarsnaprc \
        --keyfile ${config.xdg.configHome}/tarsnap/write-only.key \
        -f $(uname -n)-$date \
        ${config.home.homeDirectory}/{dotfiles.nix,Desktop,Development,Documents}
    '';
  in {
    enable = true;
    config = {
      Label = "com.tarsnap.tarsnap";
      StandardErrorPath = "${logPath}/error.log";
      StandardOutPath = "${logPath}/out.log";
      StartCalendarInterval = [{
        # every sunday
        Weekday = 0;
        # at midnight
        Hour = 0;
        Minute = 0;
      }];
      Program = lib.getExe tarsnapBackup;
    };
  };
}